Tenda W306R

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

Version 1.x and 2.x of this model are different in some fairly important aspects and have different OEM firmwares. This will almost certainly result in two different OpenWrt firmware images.

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v1.01) Dec 2008 - - -
v2.0 Nov 2009 W306R001294700029 since commit fc88a36 -
v2.12) - - - -
v2.23) - - - -

NOTE:

  • Only Version 2.0 boards have been tested so far.
  • It may be possible to use W306R V1.0 firmware on W307R V3.0 Platform
  • It may be possible to use W306R V2.0 firmware on W307R V4.0 Platform
  • For other devices that are similar check out similar devices below

Hardware Highlights

Ver CPU Ram Flash Network Wireless USB Serial JTag
1.0 16MiB 5x 10/100 802.11 bgn
2.0 MIPS 24K V4.12 @384 MHz 32MiB 4MiB 5x 10/100 802.11 bgn No Yes Unlikely
2.1
2.2

Installation

→ Install OpenWrt (generic explanation)

Identify your Hardware Revision

It is possible to identify the version using the web interface but if you do not have this access, you may need to open the device and read the circuit board. To identify your hardware version of W306R you can open the device, or check in the settings page of the router. After logging in to the routers html setup page use the links on the left to select “System Status” then scroll down to the last line in the table which may read “Hardware Version 2.0” or similar.

Method 1

Using a serial connection:

  1. → Identify your Hardware Version and therefore, your options.
  2. → Connect a Serial Cable (Soldering recommended).
  3. → downloads.
  4. → Setup a PC using instructions here: NetBoot or here generic.flashing.tftp.

Now when rebooting the router you have two options:

  1. Load system code to SDRAM via TFTP.
    Uses the ram of the router and will not overwrite firmware, if the router looses power or is reset in software it will then boot the OEM firmware. Use image named openwrt-ramips-rt305x-w306r-v20-initramfs-uImage.bin

    OR

  2. Load system code then write to Flash via TFTP.
    Will overwrite the old firmware with OpenWrt and you should use openwrt-ramips-rt305x-w306r-v20-squashfs-sysupgrade.bin

Method 2

OEM Installation, Flash using a binary compatible with the OEM upgrade method

  1. Access the routers html settings web pages, default settings are:
    • Address: http://192.168.0.1
    • User name: admin
    • password: admin
  2. Using left section select + System Tools then Upgrade
  3. Use Browse to select the correct firmware file (openwrt-ramips-rt305x-w306r-v20-squashfs-factory.bin)
  4. Then click upload (select OK to the are you sure question).
  5. The router will upgrade and reboot then follow the OpenWrt firstlogin

Defaults After Install

Interface Name Description Default configuration MAC correct
br-lan LAN & WiFi 192.168.1.1/24 Same as LAN
eth0 Internal Switch N/A N/A
eth0.1 LAN ports (1 to 4) Static Same as OEM
eth0.2 Wan port DHCP Same as OEM
wlan0 WiFi - uses both antenna1 Disabled Same as LAN

Note: 1. Actually the antenna when scanning appears to be the one on the left when the router is facing you, further testing is needed as to whether the OpenWrt firmware actually implements MIMO or similar technologies.

Tenda W306R (2.0) Flash Layout

Tenda W306R Flash Layout
Layer0 4096KiB
Layer1 mtd0 u-boot 192KiB mtd5 firmware 3904KiB
Layer2 192KiB Bootloader 64KiB Config 64KiB Factory mtd1 kernel 704KiB
Layer3

TOP

Basic configuration

Having installed OpenWrt follow the the Basic configuration

Hardware

Info

Hardware Version V1.04) V2.0 V2.15) V2.26)
Architecture MIPS
Vendor Ralink Ralink
bootloader U-Boot
System-On-Chip Ralink 2880 RT3052 Ralink 2880 RT3052
CPU/Speed MIPS 24K V4.12 @384 MHz 266MHz
Flash-Chip KH29LV320DBTC
Flash size 4 MiB 4MiB
RAM-Chip 2 x Hynix HY57V641620FTP-7 2 x w9812g6ih
RAM size 16 MiB 32 MiB 16 MiB
Wireless Ralink RT28x0 (Integrated) 802.11 bgn RT3052 (Integrated) 802.11 bgn Ralink RT2820 (Integrated) RT3052 (Integrated) 802.11 bgn
Ethernet IP175C RT3052 (Integrated) IP175C RT3052 (Integrated)
Internet
Serial Yes
JTAG unknown

Photos

Model 1.0

Model 2.0


Opening the case

Note: This will void your warranty!

To remove the cover:

  1. Disconnect power supply and network leads.
  2. Remove the four rubber feet (i stuck them back to the case nearby).
  3. Remove the now revealed four small screws.
  4. Use screwdriver or plastic leaver to pry open cover from sides then front.

Main PCB Model 2.0

Serial

Photo of PCB with markings

In order to de-brick, or install OpenWrt using Method 1, you will need to connect a serial cable to the device. You will need to solder wires to a header, then connect port.serial.cables device to communicate to the serial port of a computer.

In Version 2.0: The pads to solder to are near the CPU on the underside of the circuit board.

The serial settings needed are:

Rate 57600
Data Bits 8
Stop Bits 1
Parity none
Flow Control none

→ port.serial general information about the serial port, serial port cable, etc.

TOP

Debricking

  • generic.debrick
  • If a html upgrade option is unavailable because the system hangs on startup then you will need to follow Install, Method 1
  • If the bootloader has been overwritten your router is most likely undebrickable

Uninstall OpenWrt

To revert to manufacture firmware:

  • From a working OpenWrt installation:
    1. Use the sysupgrade utility but use the OEM firmware
  • Without a working firmware:
    1. Setup as per Method 1
    2. At the serial console for the router press “2” key when router is rebooting to use tft server and boot to flash.
    3. Use the original image file, i renamed mine to “revert.bin” from “U306Rv2en_I2_V3.3.6f.bin”.

Notes

Someone needs to verify all hardware versions other than 2.0. I cannot be sure about researched details for all other hardware versions.

Goals

  1. Write a customized profile following ramips.platform
Primary Tasks 1.0 V2.0 2.1 2.2
Add a new machine image in image/Makefile DONE
write machine file mach-w306r.c DONE
GPIO pins for LEDs and buttons DONE
Port layout for the device (vlan configuration) DONE
Flash memory configuration DONE
Wifi DONE
Watchdog timer DONE
Reference the new machine file in
arch/mips/ralink/$CHIP/{Kconfig,Makefile} 		DONE
Reference the new machine name in files/arch/mips/include/asm/mach-ralink/machine.h DONE
Add your board to base-files/lib/ramips.sh for userspace scripts to read the board name DONE
Secondary Tasks 1.0 V2.0 2.1 2.2
base-files/etc/diag.sh to set a LED which OpenWrt should blink on bootup DONE
base-files/lib/upgrade/platform.sh to allow sysupgrade to work on your board DONE
base-files/etc/uci-defaults/network to configure default network interface settings, particularly MAC addresses DONE
base-files/etc/uci-defaults/leds if you have configurable LEDs which should default to a behavior, like a WLAN activity LED DONE
base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom to extract the firmware image for the wireless module DONE
base-files/lib/preinit/06_set_iface_mac to set the MAC addresses of any other interfaces DONE
Tertiary Tasks 1.0 V2.0 2.1 2.2
Compile images for people to use DONE
openwrt-ramips-rt305x-w306r-v20-initramfs-uImage.bin DONE
openwrt-ramips-rt305x-w306r-v20-squashfs-factory.bin DONE
openwrt-ramips-rt305x-w306r-v20-squashfs-sysupgrade.bin DONE

Technical Data

The following is the raw data collected to understand the way this device is put together and the technical content below should be used to construct a useful summary above.

Original Firmware

The firmware file is from Tenda and marked as: “I2_V3.3.6f_EN-Jun 22 2010”

Boot Log

This is the entire output on serial port when V2.0 board boots.

U-Boot 1.1.3 (Feb 13 2009 - 09:48:32) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fac000 flash_protect ON: from 0xBF000000 to 0xBF01FFAF protect on 0 protect on 1 protect on 2 protect on 3 protect on 4 protect on 5 protect on 6 protect on 7 protect on 8 flash_protect ON: from 0xBF030000 to 0xBF03FFFF protect on 10 ============================================ Ralink UBoot Version: 3.2 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM COMPONENT: 128Mbits DRAM BUS: 32BIT Total memory: 32 MBytes Date:Feb 13 2009 Time:09:48:32 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 384 MHZ #### SDRAM bus set to 32 bit SDRAM size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bf050000 ... Image Name: linkn Kernel Image Created: 2010-06-22 4:23:26 UTC System Control Status = 0x20440000 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 2174143 Bytes = 2.1 MB Load Address: 80000000 Entry Point: 8036a000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 8036a000) ... ## Giving linux memsize in MB, 32 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.21 (root@linux-6091) (gcc version 3.4.2) #1366 Tue Jun 22 12:0 The CPU feqenuce set to 384 MHz CPU revision is: 0001964c Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Built 1 zonelists. Total pages: 8128 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled cause = 90800058, status = 1100ff00 PID hash table entries: 128 (order: 7, 512 bytes) calculating r4koff... 00177000(1536000) CPU frequency 384.00 MHz Using 192.000 MHz high precision timer. Console: colour dummy device 80x25 Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 27708k/32768k available (3052k kernel code, 5060k reserved, 439k data, ) Mount-cache hash table entries: 512 NET: Registered protocol family 16 NET: Registered protocol family 2 Time: MIPS clocksource has been installed. IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered detected lzma initramfs detected lzma initramfs initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=4108800 LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com>...........................) squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro io scheduler noop registered (default) FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB Ralink gpio driver initialized HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize loop: loaded (max 8 devices) rdm_major = 254 PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 AP Driver version-2.3.0.0 ralink flash device: 0x1000000 at 0x1f000000 Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. Creating 4 MTD partitions on "Ralink SoC physically mapped flash": 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x01000000 : "Kernel" mtd: partition "Kernel" extends beyond the end of device "Ralink SoC physically0 block2mtd: version $Revision: 1.1.1.1 $ nf_conntrack version 0.5.0 (256 buckets, 2048 max) arp_tables: (C) 2002 David S. Miller IPv4 over IPv4 tunneling driver GRE over IPv4 tunneling driver ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone net/ipv4/netfilter/ipt_netcheck.c 191 ipt_netcheck init TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> GDMA1_MAC_ADRH -- : 0x00000000 GDMA1_MAC_ADRL -- : 0x00000000 Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors alloca! GDMA1_MAC_ADRH -- : 0x0000000c GDMA1_MAC_ADRL -- : 0x43305277 PROC INIT OK! Freeing unused kernel memory: 1144k freed init started: BusyBox v1.12.1 (2010-06-22 12:19Algorithmics/MIPS FPU Emulator v5 :00 CST) starting pid 13, tty '': '/etc_ro/rcS' devpts: called with bogus options Welcome to _______ _______ ___ __ ____ _ _ ___ | ___ \| __ || kernel reg pid 20 success . | |__|| \ | || | / / | |___| || |__| || |__ __ | \| || |/ / | _ /| _ || || || |\ || \ |__| \__\|__| |__||______||__||_| \____||_|\___\ =System Architecture Department= Yes: ****** WeLoveLinux ****** Welcome to ... httpd Reg gpio hook success . starting pid 23, tty '/dev/ttyS1': '/bin/sh' BusyBox v1.12.1 (2010-06-22 12:19:00 CST) built-in shellRX DESC a1c51000 size 8 (ash) Enter 'help' for a list <-- RTMPAllocTxRxRingMemory, Status=0 of built-in commands. # Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff ff 00 00 01 SYNC - BBP R4 to 20MHz.l Main bssid = c8:3a:35:16:87:00 <==== rt28xx_init, Status=0 0x1300 = 00064380 getIfLive: device eth2.1 not found. Commit crc = 6f4dd889 maclist: WLan[C8:3A:35:16:87:00] Lan[C8:3A:35:16:87:00] Wan[C8:3A:35:GDMA1_MAC_ADRH -- : 0x0000c83a 16:87:05] GDMA1_MAC_ADRL -- : 0x35168700 phy_tx_ring = 0x01d29000, tx_ring = 0xa1d29000 phy_rx_ring = 0x00000000, rx_ring = 0x00000000 RT305x_ESW: Link Status Changed CDMA_CSG_CFG = 81000000 GDMA1_FWD_CFG = 10000 eth2.1: Setting MAC address to c8 3a 35 16 87 00. VLAN (eth2.1): Underlying device (eth2) has same MAC, not checking promiscious. eth2.2: Setting MAC address to c8 3a 35 16 87 05. device eth2 entered promiscuous mode VLAN (eth2.2): Setting underlying device (eth2) to promiscious mode. getIfLive: device br0 not found. eth2.1: dev_set_promiscuity(master, 1) device eth2.1 entered promiscuous mode Router ip address config success. br0: port 1(eth2.1) entering learning state device ra0 entered promiscuous mode br0: port 2(ra0) entering learning state libupnp: using UDP SSDP_PORT = 1900 br0: topology change detected, propagating br0: port 1(eth2.1) entering forwarding state br0: topology change detected, propagating br0: port 2(ra0) entering forwarding state killall: udhcpd: no process killed ND -> Bad_Sig_entry [18]... ***** g_wl_interface = ra0 ****** sh: rjclient: not found httpd listen ip = 192.168.1.2 port = 80 MfgThread start loop. TendaLog -> ok rtn. macBcast uses obsolete (PF_INET,SOCK_PACKET) udhcpc (v1.12.1) started


Info from console

# cat /proc/cpuinfo system type : Ralink SoC processor : 0 cpu model : MIPS 24K V4.12 BogoMIPS : 255.48 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : yes ASEs implemented : mips16 dsp VCED exceptions : not available VCEI exceptions : not available # cat /proc/version Linux version 2.6.21 (root@linux-6091) (gcc version 3.4.2) #1366 Tue Jun 22 12:0 # cat /proc/meminfo MemTotal: 28852 kB MemFree: 18516 kB Buffers: 0 kB Cached: 4516 kB SwapCached: 0 kB Active: 2396 kB Inactive: 2948 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 856 kB Mapped: 1028 kB Slab: 4160 kB SReclaimable: 500 kB SUnreclaim: 3660 kB PageTables: 144 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 14424 kB Committed_AS: 2224 kB VmallocTotal: 1048404 kB VmallocUsed: 504 kB VmallocChunk: 1047900 kB # cat /proc/mtd dev: size erasesize name mtd0: 00030000 00010000 "Bootloader" mtd1: 00010000 00010000 "Config" mtd2: 00010000 00010000 "Factory" mtd3: 003b0000 00010000 "Kernel" # cat /proc/partitions major minor #blocks name 31 0 192 mtdblock0 31 1 64 mtdblock1 31 2 64 mtdblock2 31 3 3776 mtdblock3 # cat /proc/net/nf_conntrack ipv4 2 unknown 2 221 src=192.168.1.2 dst=224.0.0.22 packets=2 bytes=80 [UN1 ipv4 2 udp 17 5 src=192.168.1.107 dst=239.255.255.250 sport=57633 dpor1 ipv4 2 udp 17 23 src=192.168.1.2 dst=239.255.255.250 sport=3073 dport=1 # cat /proc/cmdline console=ttyS1,57600n8 root=/dev/ram0 # cat /proc/iomem 00000000-01ffffff : System RAM 00000000-002fb147 : Kernel code 002fb148-003690bf : Kernel data root@OpenWrt:/# hexdump -C /dev/mtd2 00000000 52 30 01 01 c8 3a 35 16 87 00 ff ff ff ff ff ff |R0...:5.........| 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| 00000020 ff ff ff ff ff ff ff ff 00 0c 43 30 52 77 00 0c |..........C0Rw..| 00000030 43 30 52 66 22 08 26 00 ff ff 2a 01 55 77 a8 aa |C0Rf".&...*.Uw..| 00000040 8c 88 ff ff 0c 00 00 00 00 00 00 00 00 00 ff ff |................| 00000050 ff ff 0c 0c 0c 0c 0c 0c 0a 0a 0a 0a 0a 0a 08 08 |................| 00000060 11 11 11 11 11 11 11 11 11 11 11 11 10 10 ff f7 |................| 00000070 e0 a0 80 44 28 10 ff 01 ff ff ff ff ff ff ff ff |...D(...........| 00000080 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 000000d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 66 66 |..............ff| 000000e0 cc aa 88 66 cc aa 88 66 cc aa 88 66 cc aa 88 66 |...f...f...f...f| 000000f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 00010000


See Also

Similar Devices

In order of similarity and informativeness.

Tags

How to add tags

, , , , , , , , , , ,
1) , 2) , 3) , 4) , 5) , 6)
Please verify and correct details on this Version
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1