toh:nexx:wt3020

Nexx WT3020

The Nexx WT3020 is a series of miniature routers based on the MediaTek MT7620n with two Ethernet ports and a 802.11n 2T/2R 2.4 GHz 300Mbps wireless interface. There are several models with different hardware and software features.

Supported Versions

Hardware Highlights

There are four known versions (according to the manufacturer) with different functionalities: Model Version SoC CPU MHz Flash MB RAM MB WLAN Hardware WLAN2.4 WLAN5.0 100M ports Gbit ports Modem USB WT3020A MediaTek MT7620N 580 4 64 MediaTek MT7620N b/g/n - 2 - - 1x µUSB (power) WT3020AD MediaTek MT7620N 580 8 64 MediaTek MT7620N b/g/n - 2 - - 1x 2.0, 1x µUSB (power) WT3020F MediaTek MT7620N 580 8 64 MediaTek MT7620N b/g/n - 2 - - 1x 2.0, 1x µUSB (power) WT3020H MediaTek MT7620N 580 8 64 MediaTek MT7620N b/g/n - 2 - - 1x 2.0, 1x µUSB (power) Model USB port Flash memory Description WT3020A No 4 MB Wireless router WT3020H Yes 8 MB Wireless router with USB port¹ WT3020F Yes 8 MB Wireless router with USB port and 3G dongle support¹ WT3020F³ Yes 8 MB Wireless router with USB port and 3G dongle support¹ WT3020AD Yes 8 MB Wireless router with USB port, 3G dongle support and extra features¹² ¹: differences between WT3020H, WT3020F and WT3020AD are only found in the original firmware

²: extra features are unknown

³: different hardware model, see below

Hardware

Info

Architecture MIPS 24KEc V5.0 (ramips) Vendor MediaTek Bootloader U-boot 1.1.3 System-On-Chip MediaTek MT7620n CPU Speed 580MHz RAM memory 64 MB DDR RAM chip EtronTech EM6AB160TSE-5G Flash memory 4 or 8 MB ¹ Flash chip Winbond W25Q32BV (4MB), W25Q64BV or cFeon Q64-104HIP or 25Q64FVSIG (8MB) ¹ Wired network 2 x Ethernet 100 Mbps (switched) Ethernet chip MediaTek MT7530 (SoC) Ethernet switch MediaTek MT7530 (integrated) Wireless network 2.4 GHz 802.11n MiMo 2×2:2 Wireless chip MediaTek RT5390 (SoC) Wireless antennas 2 x printed on-board USB No / 1 x USB 2.0 host (A-type) ¹ Serial port Yes ( TTL pins) ¹: depending on model

Serial connection

The serial port of the WT3020 can be accessed using the TTL pins shown in the image below. A voltage level converter (such as a CP2102 TTL -USB dongle) is required. The communication settings are: 57600 bps 8N1.

Identifying the device

On the WT3020H model (8 MB flash), the Ethernet MAC starts with 20:28:18:…

GPIO

GPIOs 0, 2, 18, and 19 are exposed on the board, as was tested with this method. They are connected to pull-down resistors. Click to enlarge the photos to see where the GPIOs are.

device-specific, known problems

Installation

Flash uboot

As of 2016-09-03 the following is confirmed to be working: Uboot http://breed.hackpascal.net/ Filename breed-mt7620-reset1.bin Size 80KB (82015B) MD5 0294140fdaa4c736f5a05fbcd7b7d130 Filename breed-mt7620-reset1.bin Timestamp 2018-10-14 20:50 Size 89K (91224B) MD5 04df1cf3aec4cf6e2b676e49f20830ad (tested successfully with stock firmware, OpenWRT 18.06.1 and snapshot from 2018-10-21 on WT3020F, but flashed before moving to OpenWRT) A guide for getting from stock to OpenWrt and to install OnionWrt can be found here: http://www.securityskeptic.com/2016/01/how-to-turn-a-nexx-wt3020-router-into-a-tor-router.html. The referenced OnionWrt Tor router install script can be found on the Internet Archive. Uboot can be flashed like this (only if mtd0 is writable, on stock it's possible, on OpenWrt mtd0 is usually read-only in dts): # mtd_write unlock mtd0 GetFileSize: No such file or directory Unlocking mtd0 … # mtd_write erase mtd0 GetFileSize: No such file or directory Unlocking mtd0 … Erasing mtd0 … Erase char is 255 # mtd_write -r write breed-mt7620-reset1.bin mtd0 Unlocking mtd0 … Writing from breed-mt7620-reset1.bin to mtd0 … [w] (at this time router output may stop and router will reboot)

Flash firmware

Use the factory.bin image for initial install via stock firmware web-UI. Download firmware (see above) Connect to the WLAN “NEXX_…”, no password is needed or connect via LAN cable (preferred) Go to http://192.168.8.1 → Username: admin, Password: admin, System Setting → Upgrade Firmware Select the downloaded firmware file and press “Upgrade” After a while, you will get “Rebooting… System reboot takes a few moment, you might need to reconnect to the Router after rebooting.” After the system comes up, you should be able to log-in via LuCI at http://192.168.1.1/

Flash Layout and Content

root@OpenWrt:/# cat /proc/mtd dev: size erasesize name mtd0: 00030000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 00010000 00010000 "factory" mtd3: 007b0000 00010000 "firmware" mtd4: 001369e9 00010000 "kernel" mtd5: 00679617 00010000 "rootfs" mtd6: 004f0000 00010000 "rootfs_data" offset 0x00000 0x30000 0x40000 0x50000 0x17cde2* 0x30000* mtd 0 1 2 3 name u-boot u-boot-env factory firmware mtd 4 5 name kernel rootfs mtd 6 name rootfs-data * These values depend on the kernel image size.

Access Flash With Flashrom

The flash chip usually holds the operating system, mac address and calibration data. To get the binary blob from the flash chip, use a SPI programmer (CH341A in this case, or use a RasPi). Attach a clamp on the flash chip and connecting it to the SPI programmer: flashrom -c W25Q64.V -p ch341a_spi -r /tmp/data

U-Boot Environment

The u-boot-env mtd partition contains 4096 bytes of data used by U-Boot and some remaining garbage from the original firmware. Configuration for uboot-envtools : root@OpenWrt:/# cat /etc/fw_env.config # MTD device Offset Env size Flash sector size /dev/mtd1 0x0000 0x1000

Factory

The /dev/mtd2 partition contains configuration and calibration data. The MAC address is stored with offset 4. root@OpenWrt:/# hexdump -C /dev/mtd2 00000000 20 76 05 01 20 28 18 aa bb cc ff ff ff ff ff ff | v.. (... ......| [...] The MAC address (macaddr / hwaddr) is copied to /etc/config/network on the first boot after flashing a new OpenWrt image. The MAC address of eth0.1 in this example is 20:28:18:aa:bb:cc . eth0.2 will get the same MAC address increased by one, e.g. 20:28:18:aa:bb:cd . The meaning of the remaining data is still unknown. It may contain some calibration data for WiFi.

OpenWrt Failsafe

Warning!

This section describes actions that might damage your device or firmware. Proceed with care!

Failsafe mode appears to be broken as of r43977 (fixme). Please see https://dev.openwrt.org/ticket/18768



Update 03 jan 2018:

Failsafe mode appears again to be broken, with the new hardware model. More details will follow. Since there is no visible (blinking LED) indication that would tell when the kernel has finished loading, you need to find out the right timing. Looking at the output of the serial console, a reliable way of entering failsafe mode is to power on the device, wait for 10 seconds, then start pressing the reset button repeatedly until you reach 20 seconds. Now you should be in failsafe mode (as can be verified by looking at the serial console). However, as of r43977, it seems to be impossible to log in over Ethernet. Is this a bug? In failsafe mode as of r43977, the network is configured like this as we can see from the serial console: root@(none):/# ifconfig eth0 Link encap:Ethernet HWaddr 20:28:xx:xx:xx:xx inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:1 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:1043 (1.0 KiB) Interrupt:5 Looking at /rom/lib/preinit/07_set_preinit_iface_ramips, it appears that failsafe mode is known broken on this device as of r43977. root@WT3020H:~# cat /rom/lib/preinit/07_set_preinit_iface_ramips #!/bin/sh # # Copyright (C) 2013 OpenWrt.org # . /lib/ramips.sh ramips_set_preinit_iface() { RT3X5X=`cat /proc/cpuinfo | egrep "(RT3.5|RT5350|MT7628)"` if [ -n "${RT3X5X}" ]; then swconfig dev rt305x set reset 1 fi if echo $RT3X5X | egrep -q "(RT5350|MT7628)"; then # This is a dirty hack to get by while the switch # problem is investigated. When VLAN is disabled, ICMP # pings work as expected, but TCP connections time # out, so telnetting in failsafe is impossible. The # likely reason is TCP checksumming hardware getting # disabled: # https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg19870.html swconfig dev rt305x set enable_vlan 1 swconfig dev rt305x vlan 1 set ports "0 6" swconfig dev rt305x port 6 set untag 0 swconfig dev rt305x set apply 1 vconfig add eth0 1 ifconfig eth0 up ifname=eth0.1 else ifname=eth0 fi } As you can see, the code is looking for MT7628 but the Nexx WT3020 has MT7620N. root@WT3020H:~# cat /proc/cpuinfo system type : Ralink MT7620N ver:2 eco:6 machine : Nexx WT3020 processor : 0 cpu model : MIPS 24KEc V5.0 BogoMIPS : 766.77 In failsafe mode, using the serial console, we see: root@(none):/# swconfig list Found: switch0 - mt7620 So possibly some code along the lines of https://lists.openwrt.org/pipermail/openwrt-devel/2014-August/027316.html needs to be added in order for OpenWrt Failsafe to work on this device, since as of r43977 it does not work yet.

OpenWrt default network configuration

As of r43977, after booting OpenWrt, the nework configuration looks like this by default. Note that the WAN port (towards the edge of the PCB) is eth0.2. root@OpenWrt:/# cat /etc/config/network config interface 'loopback' option ifname 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0' config globals 'globals' option ula_prefix 'fd98:xxx:0888::/48' config interface 'lan' option ifname 'eth0.1' option force_link '1' option macaddr '20:28:18:xx:xx:7e' option type 'bridge' option proto 'static' option ipaddr '192.168.1.1' option netmask '255.255.255.0' option ip6assign '60' config interface 'wan' option ifname 'eth0.2' option force_link '1' option macaddr '20:28:18:xx:xx:7f' option proto 'dhcp' config interface 'wan6' option ifname 'eth0.2' option proto 'dhcpv6' config switch option name 'switch0' option reset '1' option enable_vlan '1' config switch_vlan option device 'switch0' option vlan '1' option ports '1 2 3 4 6t' config switch_vlan option device 'switch0' option vlan '2' option ports '0 6t' root@OpenWrt:/# ifconfig br-lan Link encap:Ethernet HWaddr 20:28:xx:xx:xx:7E inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fd98:xxxx:888::1/60 Scope:Global inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:41 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:5430 (5.3 KiB) eth0 Link encap:Ethernet HWaddr 20:28:xx:xx:xx:7E inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:275 errors:0 dropped:0 overruns:0 frame:0 TX packets:143 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:43656 (42.6 KiB) TX bytes:16916 (16.5 KiB) Interrupt:5 eth0.1 Link encap:Ethernet HWaddr 20:28:xx:xx:xx:7E UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:30 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:4324 (4.2 KiB) eth0.2 Link encap:Ethernet HWaddr 20:28:xx:xx:xx:7E inet addr:192.168.0.16 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::2228:xxxx:xxxx:xxxx/64 Scope:Link inet6 addr: 2a02:908:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64 Scope:Global UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:267 errors:0 dropped:0 overruns:0 frame:0 TX packets:105 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:37258 (36.3 KiB) TX bytes:9905 (9.6 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:16 errors:0 dropped:0 overruns:0 frame:0 TX packets:16 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1648 (1.6 KiB) TX bytes:1648 (1.6 KiB) Without Ethernet cable attached: root@WT3020H:/# swconfig dev switch0 show Global attributes: enable_vlan: 1 Port 0: pvid: 2 link: port:0 link:down Port 1: pvid: 1 link: port:1 link:down Port 2: pvid: 1 link: port:2 link:down Port 3: pvid: 1 link: port:3 link:down Port 4: pvid: 1 link: port:4 link:down Port 5: pvid: 0 link: port:5 link:down Port 6: pvid: 0 link: port:6 link:up speed:1000baseT full-duplex Port 7: pvid: 0 link: port:7 link:down VLAN 1: vid: 1 ports: 1 2 3 4 6t VLAN 2: vid: 2 ports: 0 6t With Ethernet cable attached to the WAN port (edge of the PCB): root@WT3020H:/# swconfig dev switch0 show Global attributes: enable_vlan: 1 Port 0: pvid: 2 link: port:0 link:up speed:100baseT full-duplex Port 1: pvid: 1 link: port:1 link:down Port 2: pvid: 1 link: port:2 link:down Port 3: pvid: 1 link: port:3 link:down Port 4: pvid: 1 link: port:4 link:down Port 5: pvid: 0 link: port:5 link:down Port 6: pvid: 0 link: port:6 link:up speed:1000baseT full-duplex Port 7: pvid: 0 link: port:7 link:down VLAN 1: vid: 1 ports: 1 2 3 4 6t VLAN 2: vid: 2 ports: 0 6t

Original firmware telnet login

Out of the box, you can connect the device to your Ethernet network using the WAN ethernet port (the one next to the edge of the board). It will grab an IP address from the network using DHCP . You then can log in to the device using telnet like this: $ telnet <IP address assigned by DHCP> Escape character is '^]'. (none) login: nexxadmin Password: y1n2inc.com0755

Bootlogs

OpenWrt bootlog

This is a log using OpenWrt CHAOS CALMER (Bleeding Edge, r43977) U-Boot 1.1.3 (Jan 3 2014 - 09:12:42) MAX Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83fb4000 enable ephy clock...done. rf reg 29 = 5 SSC disabled. ****************************** Software System Reset Occurred ****************************** spi_wait_nsec: 29 spi device id: 1c 30 17 1c 30 (30171c30) find flash: EN25Q64 raspi_read: from:30000 len:1000 raspi_read: from:30000 len:1000 ============================================ Ralink UBoot Version: 4.1.1.0 -------------------------------------------- ASIC 7620_MP (Port5<->None) DRAM component: 512 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 64 MBytes Flash component: SPI Flash Date:Jan 3 2014 Time:09:12:42 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 580 MHZ #### estimate memory size =64 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 4 3 2 1 0 3: System Boot system code via Flash. ## Booting image at bc050000 ... raspi_read: from:50000 len:40 Image Name: MIPS OpenWrt Linux-3.14.28 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1164568 Bytes = 1.1 MB Load Address: 80000000 Entry Point: 80000000 raspi_read: from:50040 len:11c518 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80000000) ... ## Giving linux memsize in MB, 64 Starting kernel ... [ 0.000000] Linux version 3.14.28 (openwrt@gb-10) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r43977) ) #1 Fri Jan 16 16:33:53 UTC 2015 [ 0.000000] Board has DDR1 [ 0.000000] Analog PMU set to hw control [ 0.000000] Digital PMU set to hw control [ 0.000000] SoC Type: Ralink MT7620N ver:2 eco:6 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019650 (MIPS 24KEc) [ 0.000000] MIPS: machine is Nexx WT3020 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x03ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x03ffffff] [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=00017df8 [ 0.000000] Readback ErrCtl register=00017df8 [ 0.000000] Memory: 61316K/65536K available (2549K kernel code, 134K rwdata, 508K rodata, 192K init, 188K bss, 4220K reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:256 [ 0.000000] CPU Clock: 580MHz [ 0.000000] systick: running - mult: 214748, shift: 32 [ 0.000000] genirq: Flags mismatch irq 7. 00014600 (timer) vs. 00014600 (systick) [ 0.010000] Calibrating delay loop... 766.77 BogoMIPS (lpj=3833856) [ 0.050000] pid_max: default: 32768 minimum: 301 [ 0.050000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.060000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.060000] pinctrl core: initialized pinctrl subsystem [ 0.070000] NET: Registered protocol family 16 [ 0.080000] bio: create slab <bio-0> at 0 [ 0.080000] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.090000] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.090000] rt2880_gpio 10000660.gpio: registering 32 gpios [ 0.100000] rt2880_gpio 10000660.gpio: registering 32 irq handlers [ 0.100000] rt2880_gpio 10000688.gpio: registering 1 gpios [ 0.110000] rt2880_gpio 10000688.gpio: registering 1 irq handlers [ 0.110000] Switched to clocksource systick [ 0.120000] NET: Registered protocol family 2 [ 0.120000] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.140000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.150000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.170000] TCP: reno registered [ 0.170000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.170000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.200000] NET: Registered protocol family 1 [ 0.200000] rt-timer 10000100.timer: maximum frequency is 2441Hz [ 0.220000] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.240000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.260000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.280000] msgmni has been set to 119 [ 0.280000] io scheduler noop registered [ 0.300000] io scheduler deadline registered (default) [ 0.300000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.320000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a 16550A [ 0.350000] console [ttyS0] enabled [ 0.350000] console [ttyS0] enabled [ 0.350000] bootconsole [early0] disabled [ 0.350000] bootconsole [early0] disabled [ 0.380000] m25p80 spi32766.0: found en25q64, expected w25q64 [ 0.380000] m25p80 spi32766.0: en25q64 (8192 Kbytes) [ 0.400000] 4 ofpart partitions found on MTD device spi32766.0 [ 0.410000] Creating 4 MTD partitions on "spi32766.0": [ 0.420000] 0x000000000000-0x000000030000 : "u-boot" [ 0.440000] 0x000000030000-0x000000040000 : "u-boot-env" [ 0.440000] 0x000000040000-0x000000050000 : "factory" [ 0.460000] 0x000000050000-0x000000800000 : "firmware" [ 0.490000] 2 uimage-fw partitions found on MTD device firmware [ 0.510000] 0x000000050000-0x00000016c558 : "kernel" [ 0.510000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.540000] 0x00000016c558-0x000000800000 : "rootfs" [ 0.550000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.580000] mtd: device 5 (rootfs) set to be root filesystem [ 0.590000] 1 squashfs-split partitions found on MTD device rootfs [ 0.600000] 0x000000340000-0x000000800000 : "rootfs_data" [ 0.620000] ralink_soc_eth 10100000.ethernet (unregistered net_device): port 0 link up (100Mbps/Full duplex) [ 0.640000] ralink_soc_eth 10100000.ethernet: loaded mt7620 driver [ 0.650000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5 [ 0.670000] rt3xxx-usbphy usbphy.3: loaded [ 0.670000] rt2880_wdt 10000120.watchdog: Initialized [ 0.690000] TCP: cubic registered [ 0.690000] NET: Registered protocol family 17 [ 0.700000] Bridge firewalling registered [ 0.710000] 8021q: 802.1Q VLAN Support v1.8 [ 0.730000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5. [ 0.750000] Freeing unused kernel memory: 192K (80320000 - 80350000) procd: Console is alive procd: - watchdog - [ 5.370000] usbcore: registered new interface driver usbfs [ 5.390000] usbcore: registered new interface driver hub [ 5.390000] usbcore: registered new device driver usb [ 5.410000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 5.430000] ehci-platform: EHCI generic platform driver [ 5.830000] rt3xxx-usbphy usbphy.3: remote usb device wakeup disabled [ 5.850000] rt3xxx-usbphy usbphy.3: UTMI 16bit 30MHz [ 5.850000] ehci-platform 101c0000.ehci: EHCI Host Controller [ 5.870000] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1 [ 5.890000] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000 [ 5.910000] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00 [ 5.910000] hub 1-0:1.0: USB hub found [ 5.930000] hub 1-0:1.0: 1 port detected [ 5.930000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 5.950000] ohci-platform: OHCI generic platform driver [ 5.960000] ohci-platform 101c1000.ohci: Generic Platform OHCI controller [ 5.980000] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2 [ 5.980000] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000 [ 6.070000] hub 2-0:1.0: USB hub found [ 6.070000] hub 2-0:1.0: 1 port detected procd: - preinit - [ 6.950000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 6.990000] random: mktemp urandom read with 65 bits of entropy available Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level jffs2 is ready No jffs2 marker was found [ 10.640000] jffs2: notice: (310) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found. switching to overlay procd: - early - procd: - watchdog - procd: - ubus - procd: - init - Please press Enter to activate this console. [ 13.590000] NET: Registered protocol family 10 [ 13.610000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 13.630000] Loading modules backported from Linux version master-2014-11-04-0-gf3660a2 [ 13.650000] Backport generated by backports.git backports-20141023-2-g4ff890b [ 13.670000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 13.690000] nf_conntrack version 0.5.0 (961 buckets, 3844 max) [ 13.730000] xt_time: kernel timezone is -0000 [ 13.770000] cfg80211: Calling CRDA to update world regulatory domain [ 13.780000] cfg80211: World regulatory domain updated: [ 13.800000] cfg80211: DFS Master region: unset [ 13.800000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time) [ 13.820000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 13.840000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A) [ 13.860000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A) [ 13.860000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 13.890000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s) [ 13.910000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s) [ 13.910000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A) [ 13.940000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A) [ 13.940000] PPP generic driver version 2.4.2 [ 13.940000] NET: Registered protocol family 24 [ 13.940000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5390, rev 0500 detected [ 13.940000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected procd: - init complete - [ 19.730000] 8021q: adding VLAN 0 to HW filter on device eth0 [ 19.760000] device eth0.1 entered promiscuous mode [ 19.770000] device eth0 entered promiscuous mode [ 19.780000] br-lan: port 1(eth0.1) entered forwarding state [ 19.800000] br-lan: port 1(eth0.1) entered forwarding state [ 21.800000] br-lan: port 1(eth0.1) entered forwarding state [ 21.800000] ralink_soc_eth 10100000.ethernet eth0: port 0 link down [ 22.120000] br-lan: port 1(eth0.1) entered disabled state [ 28.150000] random: nonblocking pool is initialized



Original firmware bootlog

U-boot bootlog

U-Boot 1.1.3 (Jan 7 2013 - 11:32:07) Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83fb4000 enable ephy clock...done. rf reg 29 = 5 SSC disabled. ****************************** Software System Reset Occurred ****************************** spi_wait_nsec: 29 spi device id: ef 40 16 0 0 (40160000) find flash: W25Q32BV raspi_read: from:30000 len:1000 *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 4.1.0.0 -------------------------------------------- ASIC 7620_MP (Port5<->None) DRAM component: 512 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 64 MBytes Flash component: SPI Flash Date:Jan 7 2013 Time:11:32:07 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 580 MHZ #### estimate memory size =64 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP.



Firmware bootlog

3: System Boot system code via Flash. ## Booting image at bc050000 ... raspi_read: from:50000 len:40 Image Name: Linux Kernel Image Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3153749 Bytes = 3 MB Load Address: 80000000 Entry Point: 8000c310 raspi_read: from:50040 len:301f55 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.36 (root@localhost.localdomain) (gcc version 3.4.2) #609 Wed Jan 8 04:44:20 CST 2014 The CPU feqenuce set to 580 MHz MIPS CPU sleep mode enabled. PCIE: bypass PCIe DLL. PCIE: Elastic buffer control: Addr:0x68 -> 0xB4 disable all power about PCIe PCIE: PLL power down for MT7620N CPU revision is: 00019650 (MIPS 24Kc) Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0 PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes Writing ErrCtl register=00036478 Readback ErrCtl register=00036478 Memory: 57820k/65536k available (4453k kernel code, 7716k reserved, 846k data, 1568k init, 0k highmem) NR_IRQS:128 MTK/Ralink System Tick Counter init... cd:8050ff18, m:214748, s:32 Console: colour dummy device 80x25 console [ttyS1] enabled Calibrating delay loop... 386.04 BogoMIPS (lpj=772096) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 NET: Registered protocol family 16 bio: create slab <bio-0> at 0 usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb Switching to clocksource Ralink external timer NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RT3xxx EHCI/OHCI init. squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [Flags: R/W]. fuse init (API version 7.15) Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered (default) HDLC line discipline maxframe=4096 N_HDLC line discipline registered. Ralink gpio driver initialized Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A brd: module loaded deice id : ef 40 16 0 0 (40160000) W25Q32BV(ef 40160000) (4096 Kbytes) mtd .name = raspi, .size = 0x00400000 (0M) .erasesize = 0x00000004 (0K) .numeraseregions = 65536 Creating 4 MTD partitions on "raspi": 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config" 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000800000 : "Kernel" mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0x3b0000 rdm_major = 253 SMACCR1 -- : 0x00008c88 SMACCR0 -- : 0x2b001802 Ralink APSoC Ethernet Driver Initilization. v3.0 256 rx/tx descriptors allocated, mtu = 1500! SMACCR1 -- : 0x00008c88 SMACCR0 -- : 0x2b001802 PROC INIT OK! PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 === pAd = c0105000, size = 651752 === <-- RTMPAllocTxRxRingMemory, Status=0 <-- RTMPAllocAdapterBlock, Status=0 AP Driver version-2.7.1.5 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected usbcore: registered new interface driver cdc_acm cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters i8042.c: i8042 controller self test timeout. Trying to free nonexistent resource <0000000000000060-000000000000006f> mice: PS/2 mouse device common for all mice usbcore: registered new interface driver usbhid usbhid: USB HID core driver nf_conntrack version 0.5.0 (903 buckets, 3612 max) nf_conntrack_rtsp v0.6.21 loading matchsize=264 xt_time: kernel timezone is -0000 nf_nat_rtsp v0.6.21 loading ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> _nvram_read checksum = 6771 save checksum = 6771 Freeing unused kernel memory: 1568k freed Hit enter to continue...Restoring defaults...hwaddr = C0:FF:EE:C0:FF:EE ssid === NEXX_c0ffee done 7620. switch reg write offset=2004, value=ff0003 switch reg write offset=2104, value=ff0003 switch reg write offset=2204, value=ff0003 switch reg write offset=2304, value=ff0003 switch reg write offset=2404, value=ff0003 switch reg write offset=2504, value=ff0003 switch reg write offset=2010, value=81000c0 switch reg write offset=2110, value=81000c0 switch reg write offset=2210, value=81000c0 switch reg write offset=2310, value=81000c0 switch reg write offset=2410, value=81000c0 switch reg write offset=2510, value=81000c0 switch reg write offset=2610, value=8100000 switch reg write offset=2710, value=8100000 switch reg write offset=2604, value=20ff0003 switch reg write offset=2704, value=Raeth v3.0 (20Taskletff,SkbRecycle0) 003 phy_tx_ring = 0x03231000, tx_ring = 0xa3231000 phy_rx_ring0 = 0x03232000, rx_ring0 = 0xa3232000 SMACCR1 -- : 0x00008c88 SMACCR0 -- : 0x2b001802 swESW: Link Status Changed - Port4 Link UP itCDMA_CSG_CFG = 81000000 chGDMA1_FWD_CFG = 20710000 reg write offset=2610, value=81000000 switch reg write offset=2014, value=10001 switch reg write offset=2114, value=10001 switch reg write offset=2214, value=10001 Algorithmics/MIPS FPU Emulator v1.5 switch reg write offset=2314, value=10001 switch reg write offset=2414, value=10002 switch reg write offset=2514, value=10001 insmod: scsi_mod.ko: module not found insmod: cdrom.ko: module not found insmod: sr_mod.ko: module not found insmod: scsi_wait_scan.ko: module not found insmod: usb-storage.ko: module not found insmod: sd_mod.ko: module not found sh: can't create /proc/sys/net/netfilter/nf_conntrack_buckets: Permission denied ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device RX DESC a30f0000 size = 2048 RTMP_TimerListAdd: add timer obj c0174a80! RTMP_TimerListAdd: add timer obj c0142260! RTMP_TimerListAdd: add timer obj c0142234! RTMP_TimerListAdd: add timer obj c0142208! RTMP_TimerListAdd: add timer obj c014b5ec! RTMP_TimerListAdd: add timer obj c014b708! RTMP_TimerListAdd: add timer obj c014b618! RTMP_TimerListAdd: add timer obj c014298c! RTMP_TimerListAdd: add timer obj c010a550! RTMP_TimerListAdd: add timer obj c010b3cc! RTMP_TimerListAdd: add timer obj c010c248! RTMP_TimerListAdd: add timer obj c010d0c4! RTMP_TimerListAdd: add timer obj c010df40! RTMP_TimerListAdd: add timer obj c010edbc! RTMP_TimerListAdd: add timer obj c010fc38! RTMP_TimerListAdd: add timer obj c0110ab4! RTMP_TimerListAdd: add timer obj c014269c! APSDCapable[0]=0 APSDCapable[1]=0 APSDCapable[2]=0 APSDCapable[3]=0 APSDCapable[4]=0 APSDCapable[5]=0 APSDCapable[6]=0 APSDCapable[7]=0 APSDCapable[8]=0 APSDCapable[9]=0 APSDCapable[10]=0 APSDCapable[11]=0 APSDCapable[12]=0 APSDCapable[13]=0 APSDCapable[14]=0 APSDCapable[15]=0 default ApCliAPSDCapable[0]=0 Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 E2PROM: D0 target power=0xff20 E2PROM: 40 MW Power Delta= 0 3. Phy Mode = 9 RTMP_TimerListAdd: add timer obj c010a148! AntCfgInit: primary/secondary ant 0/1 Initialize RF Central Registers for E2 !!! Initialize RF Central Registers for E3 !!! Initialize RF Channel Registers for E2 !!! Initialize RF Channel Registers for E3 !!! Initialize RF DCCal Registers for E2 !!! Initialize RF DCCal Registers for E3 !!! D1 = 0, D2 = 8, CalCode = 19 !!! RT6352_Temperature_Init : BBPR49 = 0x0 RT6352_Temperature_Init : TemperatureRef25C = 0xfffffff6 Current Temperature from BBP_R49=0xfffffffd TX BW Filter Calibration !!! RX BW Filter Calibration !!! LOFT Calibration Done! IQCalibration Start! IQCalibration Done! CH = 0, (gain= 0, phase=3e) IQCalibration Start! IQCalibration Done! CH = 1, (gain= 1, phase= 2) TX IQ Calibration Done! internal ALC is not enabled in NVM ! MCS Set = ff ff 00 00 01 RTMP_TimerListAdd: add timer obj c0142ef8! Main bssid = C0:FF:EE:C0:FF:EE <==== rt28xx_init, Status=0 0x1300 = 00064380 killall: rt2860apd: no process killed rt2860apd: No such file or directory device eth2 entered promiscuous mode device ra0 entered promiscuous mode device eth2.2 entered promiscuous mode br0: port 2(eth2.2) entering forwarding state br0: port 2(eth2.2) entering forwarding state br0: port 1(ra0) entering forwarding state br0: port 1(ra0) entering forwarding state Changing password for admin Password for admin changed by admin proftpd: No such file or directory config_samba.sh: No such file or directory info, udhcp server (v0.9.8) started time.windows.com: Unknown host open error Open /proc/max/macfilter Failed Interface doesn't accept private ioctl... set (8BE2): Invalid argument Open /proc/max/trackerurl Failed IDLE Hit enter to continue...Hit enter to continue...Hit enter to continue...info, udhcp client (v0.9.8) started info, Sending discover... (4)



Nexx WT3020 PoE mod

The device is small and convenient for plug and forget usage in many ways. Therefore it is shame it does not have a PoE capability. As it has only Fast ethernet 100 Mbps ( WAN and LAN ports), we can manually take unusued ethernet conductors and use them for do-it-yourself PoE.

What you need

Some thin wires

DC-DC converter

Power switch or relay (to prevent reverse current flow to ethernet in case of using microUSB power delivery)

Multimeter and patience

DO NOT FORGET, THAT ALL PARTS OF THE CIRCUIT MUST HANDLE MAXIMUM CURRENT DELIVERY. NEXX ITSELF HAS 1.2 ADC, for me the weakest part is DC-DC converter that can handle 1.7 A, but it is still higher than the limit.

The basic idea

PoE mod pic, I can not upload it here

PoE uses unusued ethernet pins 5-6 (blue; +DC) and 7-8 (brown; GND) to power delivery in case you have only fast ethernet 10/100 Mbit. So you can unsolder them from the board and use them for PoE. For that task, I used small scissors and ripped them off the board :P

You can use pins from WAN or LAN ports or both if you wish. I used pins from WAN port (in the picture 1a with GND connected to ethernet shield and 1b).

You can power PoE by many voltage sources, so there is step down DC-DC converter (2.) which can handle 5-17 VDC input and is set up to 5 VDC output. Therefore you can PoE it from 5 to 17 volts power sources.

From there, the left side output GND is again connected to (not visible) ethernet shield (not necessary, 1a GND is also connected so this is “just in case”) and the +5 VDC output goes to power switch. The power switch is important if you do not have reverse current protection! There you choose between PoE and microUSB power delivery. You can also use some relay to do this automaticaly.

I connected the +5 VDC output to female USB-A +5 VDC pin as it was the largest part that you can use for this ;)

You also need to “adjust” the above router cover if you use the power switch - I fixed the switch on the USB-A port. And remember to isolate all moving parts to prevent unwanted short-circuit. I used glue gun for that (see the bottom of DC-DC converter).

Final thoughts

Use multimeter resistance measurement to see, which parts are connected to which. The 5 VDC are short-circuited on both microUSB and USB-A ports, same with the GND.

Do not use diode for reverse current protection as there will be voltage drop and unnecessary power losses.

And the last thing - this is only my idea how to do PoE on Nexx WT3020. Do it as you wish if you like to.

The result pic, I can not upload it here