User Tools

Site Tools


toh:nexx:wt3020

Nexx WT3020

The Nexx WT3020 is a series of miniature routers based on the MediaTek MT7620n with two Ethernet ports and a 802.11n 2T/2R 2.4 GHz 300Mbps wireless interface. There are several models with different hardware and software features.

Nexx WT3020A (top view). Click to enlarge Nexx WT3020A (bottom view). Click to enlarge Nexx WT3020A (top board view). Click to enlarge

Nexx WT3020H (detailed top board view). Click to enlarge Nexx WT3020H (detailed bottom board view). Click to enlarge

Known models

There are four known versions (according to the manufacturer) with different functionalities:

Model USB port Flash memory Description OpenWrt support
WT3020A No 4 MB Wireless router R42983
WT3020H Yes 8 MB Wireless router with USB port¹ R42983
WT3020F Yes 8 MB Wireless router with USB port and 3G dongle support¹ R42983
WT3020AD Yes 8 MB Wireless router with USB port, 3G dongle support and extra features¹² R42983

¹: differences between WT3020H, WT3020F and WT3020AD are only found in the original firmware
²: extra features are unknown

Hardware details

Architecture: MIPS 24KEc V5.0 (ramips)
Vendor: MediaTek
Bootloader: U-boot 1.1.3
System-On-Chip: MediaTek MT7620n
CPU Speed: 580MHz
RAM memory: 64 MB DDR
RAM chip: EtronTech EM6AB160TSE-5G
Flash memory: 4 or 8 MB ¹
Flash chip: Winbond W25Q32BV (4MB), W25Q64BV (8MB) or cFeon Q64-104HIP (8MB) ¹
Wired network: 2 x Ethernet 100 Mbps (switched)
Ethernet chip: MediaTek MT7530 (SoC)
Ethernet switch: MediaTek MT7530 (integrated)
Wireless network: 2.4 GHz 802.11n MiMo 2x2:2
Wireless chip: MediaTek RT5390 (SoC)
Wireless antennas: 2 x printed on-board
USB: No / 1 x USB 2.0 host (A-type)
Serial port: Yes (TTL pins)

¹: depending on model

Serial connection

The serial port of the WT3020 can be accessed using the TTL pins shown in the image below. A voltage level converter (such as a CP2102 TTL-USB dongle) is required.

Nexx WT3020A (serial port)

The communication settings are: 57600 bps 8N1.

Identifying the device

On the WT3020H model (8 MB flash), the Ethernet MAC starts with 20:28:18:…

GPIO

GPIOs 0, 2, 18, and 19 are exposed on the board, as was tested with this method. They are connected to pull-down resistors. Click to enlarge the photos to see where the GPIOs are.

Nexx WT3020H (GPIO 2 and 18). Click to enlarge Nexx WT3020H (GPIO 0 and 19). Click to enlarge

OpenWrt support

The Nexx WT3020 devices are supported by OpenWrt trunk since R42983. As of December 2014 the Nightly Builds are generated for mt7620. Support for Barrier Breaker has not been backported, but a github repo with patches is available.

device-specific, known problems

Precompiled images for Chaos Calmer

You can find precompiled images from the OpenWrt download portal here. Use the 4 MB or the 8 MB image according to your device's flash memory size (use the factory image for initial install via factory firmware web-UI.

  1. Download https://downloads.openwrt.org/chaos_calmer/15.05/ramips/mt7620/openwrt-15.05-ramips-mt7620-wt3020-xM-squashfs-factory.bin (replace x with 4 or 8 depending on the version of the device that you have).
  2. Connect to the WLAN "NEXX_…", no password is needed or connect via LAN cable (preferred)
  3. Go to http://192.168.8.1 → Username: admin, Password: admin, System Setting → Upgrade Firmware
  4. Select the openwrt-15.05-ramips-mt7620-wt3020-xM-squashfs-factory.bin image and press "Upgrade"
  5. After a while, you will get "Rebooting… System reboot takes a few moment, you might need to reconnect to the Router after rebooting."
  6. After the system comes up, you should be able to log-in via LuCI at http://192.168.1.1/.

Flash Layout and Content

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 007b0000 00010000 "firmware"
mtd4: 001369e9 00010000 "kernel"
mtd5: 00679617 00010000 "rootfs"
mtd6: 004f0000 00010000 "rootfs_data"

offset 0x00000 0x30000 0x40000 0x50000 0x17cde2* 0x30000*
mtd 0 1 2 3
name u-boot u-boot-env factory firmware
mtd 4 5
name kernel rootfs
mtd 6
name rootfs-data

* These values depend on the kernel image size.

U-Boot Environment

The u-boot-env mtd partition contains 4096 bytes of data used by U-Boot and some remaining garbage from the original firmware.

Configuration for uboot-envtools:

root@OpenWrt:/# cat /etc/fw_env.config
# MTD device    Offset     Env size     Flash sector size
/dev/mtd1       0x0000     0x1000

Factory

The /dev/mtd2 partition contains configuration and calibration data. The MAC address is stored with offset 4.

root@OpenWrt:/# hexdump -C /dev/mtd2
00000000  20 76 05 01 20 28 18 aa  bb cc ff ff ff ff ff ff  | v.. (... ......|
[...]
The MAC address (macaddr / hwaddr) is copied to /etc/config/network on the first boot after flashing a new OpenWrt image.

The MAC address of eth0.1 in this example is 20:28:18:aa:bb:cc. eth0.2 will get the same MAC address increased by one, e.g. 20:28:18:aa:bb:cd.

The meaning of the remaining data is still unknown. It may contain some calibration data for WiFi.

OpenWrt Failsafe

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

Failsafe mode appears to be broken as of r43977 (fixme). Please see https://dev.openwrt.org/ticket/18768

Since there is no visible (blinking LED) indication that would tell when the kernel has finished loading, you need to find out the right timing. Looking at the output of the serial console, a reliable way of entering failsafe mode is to power on the device, wait for 10 seconds, then start pressing the reset button repeatedly until you reach 20 seconds. Now you should be in failsafe mode (as can be verified by looking at the serial console).

However, as of r43977, it seems to be impossible to log in over Ethernet. Is this a bug?

In failsafe mode as of r43977, the network is configured like this as we can see from the serial console:

root@(none):/# ifconfig

eth0      Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:xx  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:1043 (1.0 KiB)
          Interrupt:5 

Looking at /rom/lib/preinit/07_set_preinit_iface_ramips, it appears that failsafe mode is known broken on this device as of r43977.

root@WT3020H:~# cat /rom/lib/preinit/07_set_preinit_iface_ramips
#!/bin/sh
#
# Copyright (C) 2013 OpenWrt.org
#

. /lib/ramips.sh

ramips_set_preinit_iface() {
	RT3X5X=`cat /proc/cpuinfo | egrep "(RT3.5|RT5350|MT7628)"`
	if [ -n "${RT3X5X}" ]; then
		swconfig dev rt305x set reset 1
	fi

	if echo $RT3X5X | egrep -q "(RT5350|MT7628)"; then
		# This is a dirty hack to get by while the switch
		# problem is investigated. When VLAN is disabled, ICMP
		# pings work as expected, but TCP connections time
		# out, so telnetting in failsafe is impossible. The
		# likely reason is TCP checksumming hardware getting
		# disabled:
		# https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg19870.html
		swconfig dev rt305x set enable_vlan 1
		swconfig dev rt305x vlan 1 set ports "0 6"
		swconfig dev rt305x port 6 set untag 0
		swconfig dev rt305x set apply 1
		vconfig add eth0 1
		ifconfig eth0 up
		ifname=eth0.1
	else
		ifname=eth0
	fi
}

As you can see, the code is looking for MT7628 but the Nexx WT3020 has MT7620N.

root@WT3020H:~# cat /proc/cpuinfo
system type		: Ralink MT7620N ver:2 eco:6
machine			: Nexx WT3020
processor		: 0
cpu model		: MIPS 24KEc V5.0
BogoMIPS		: 766.77

In failsafe mode, using the serial console, we see:

root@(none):/# swconfig list
Found: switch0 - mt7620

So possibly some code along the lines of https://lists.openwrt.org/pipermail/openwrt-devel/2014-August/027316.html needs to be added in order for OpenWrt Failsafe to work on this device, since as of r43977 it does not work yet.

OpenWrt default network configuration

As of r43977, after booting OpenWrt, the nework configuration looks like this by default. Note that the WAN port (towards the edge of the PCB) is eth0.2.

root@OpenWrt:/# cat /etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd98:xxx:0888::/48'

config interface 'lan'
	option ifname 'eth0.1'
	option force_link '1'
	option macaddr '20:28:18:xx:xx:7e'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option ifname 'eth0.2'
	option force_link '1'
	option macaddr '20:28:18:xx:xx:7f'
	option proto 'dhcp'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0 6t'

root@OpenWrt:/# ifconfig

br-lan    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fd98:xxxx:888::1/60 Scope:Global
          inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:5430 (5.3 KiB)

eth0      Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet6 addr: fe80::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:275 errors:0 dropped:0 overruns:0 frame:0
          TX packets:143 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:43656 (42.6 KiB)  TX bytes:16916 (16.5 KiB)
          Interrupt:5 

eth0.1    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:30 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:4324 (4.2 KiB)

eth0.2    Link encap:Ethernet  HWaddr 20:28:xx:xx:xx:7E  
          inet addr:192.168.0.16  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::2228:xxxx:xxxx:xxxx/64 Scope:Link
          inet6 addr: 2a02:908:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:267 errors:0 dropped:0 overruns:0 frame:0
          TX packets:105 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:37258 (36.3 KiB)  TX bytes:9905 (9.6 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1648 (1.6 KiB)  TX bytes:1648 (1.6 KiB)

Without Ethernet cable attached:

root@WT3020H:/# swconfig dev switch0  show
Global attributes:
	enable_vlan: 1
Port 0:
	pvid: 2
	link: port:0 link:down
Port 1:
	pvid: 1
	link: port:1 link:down
Port 2:
	pvid: 1
	link: port:2 link:down
Port 3:
	pvid: 1
	link: port:3 link:down
Port 4:
	pvid: 1
	link: port:4 link:down
Port 5:
	pvid: 0
	link: port:5 link:down
Port 6:
	pvid: 0
	link: port:6 link:up speed:1000baseT full-duplex 
Port 7:
	pvid: 0
	link: port:7 link:down
VLAN 1:
	vid: 1
	ports: 1 2 3 4 6t 
VLAN 2:
	vid: 2
	ports: 0 6t 

With Ethernet cable attached to the WAN port (edge of the PCB):

root@WT3020H:/# swconfig dev switch0  show
Global attributes:
	enable_vlan: 1
Port 0:
	pvid: 2
	link: port:0 link:up speed:100baseT full-duplex 
Port 1:
	pvid: 1
	link: port:1 link:down
Port 2:
	pvid: 1
	link: port:2 link:down
Port 3:
	pvid: 1
	link: port:3 link:down
Port 4:
	pvid: 1
	link: port:4 link:down
Port 5:
	pvid: 0
	link: port:5 link:down
Port 6:
	pvid: 0
	link: port:6 link:up speed:1000baseT full-duplex 
Port 7:
	pvid: 0
	link: port:7 link:down
VLAN 1:
	vid: 1
	ports: 1 2 3 4 6t 
VLAN 2:
	vid: 2
	ports: 0 6t 

Original firmware telnet login

Out of the box, you can connect the device to your Ethernet network using the WAN ethernet port (the one next to the edge of the board). It will grab an IP address from the network using DHCP. You then can log in to the device using telnet like this:

$ telnet <IP address assigned by DHCP>

Escape character is '^]'.

(none) login: nexxadmin
Password: y1n2inc.com0755

OpenWrt bootlog

This is a log using OpenWrt CHAOS CALMER (Bleeding Edge, r43977)

U-Boot 1.1.3 (Jan  3 2014 - 09:12:42)

MAX Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb4000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
******************************
Software System Reset Occurred
******************************
spi_wait_nsec: 29 
spi device id: 1c 30 17 1c 30 (30171c30)
find flash: EN25Q64
raspi_read: from:30000 len:1000 
raspi_read: from:30000 len:1000 
============================================ 
Ralink UBoot Version: 4.1.1.0
-------------------------------------------- 
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jan  3 2014  Time:09:12:42
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 4  3  2  1  0 

3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40 
   Image Name:   MIPS OpenWrt Linux-3.14.28
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1164568 Bytes =  1.1 MB
   Load Address: 80000000
   Entry Point:  80000000
raspi_read: from:50040 len:11c518 
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 3.14.28 (openwrt@gb-10) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r43977) ) #1 Fri Jan 16 16:33:53 UTC 2015
[    0.000000] Board has DDR1
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: Ralink MT7620N ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is Nexx WT3020
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00017df8
[    0.000000] Readback ErrCtl register=00017df8
[    0.000000] Memory: 61316K/65536K available (2549K kernel code, 134K rwdata, 508K rodata, 192K init, 188K bss, 4220K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 580MHz
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] genirq: Flags mismatch irq 7. 00014600 (timer) vs. 00014600 (systick)
[    0.010000] Calibrating delay loop... 766.77 BogoMIPS (lpj=3833856)
[    0.050000] pid_max: default: 32768 minimum: 301
[    0.050000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.060000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.060000] pinctrl core: initialized pinctrl subsystem
[    0.070000] NET: Registered protocol family 16
[    0.080000] bio: create slab <bio-0> at 0
[    0.080000] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.090000] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.090000] rt2880_gpio 10000660.gpio: registering 32 gpios
[    0.100000] rt2880_gpio 10000660.gpio: registering 32 irq handlers
[    0.100000] rt2880_gpio 10000688.gpio: registering 1 gpios
[    0.110000] rt2880_gpio 10000688.gpio: registering 1 irq handlers
[    0.110000] Switched to clocksource systick
[    0.120000] NET: Registered protocol family 2
[    0.120000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.140000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.150000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.170000] TCP: reno registered
[    0.170000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.170000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.200000] NET: Registered protocol family 1
[    0.200000] rt-timer 10000100.timer: maximum frequency is 2441Hz
[    0.220000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.240000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.260000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.280000] msgmni has been set to 119
[    0.280000] io scheduler noop registered
[    0.300000] io scheduler deadline registered (default)
[    0.300000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.320000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a 16550A
[    0.350000] console [ttyS0] enabled
[    0.350000] console [ttyS0] enabled
[    0.350000] bootconsole [early0] disabled
[    0.350000] bootconsole [early0] disabled
[    0.380000] m25p80 spi32766.0: found en25q64, expected w25q64
[    0.380000] m25p80 spi32766.0: en25q64 (8192 Kbytes)
[    0.400000] 4 ofpart partitions found on MTD device spi32766.0
[    0.410000] Creating 4 MTD partitions on "spi32766.0":
[    0.420000] 0x000000000000-0x000000030000 : "u-boot"
[    0.440000] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.440000] 0x000000040000-0x000000050000 : "factory"
[    0.460000] 0x000000050000-0x000000800000 : "firmware"
[    0.490000] 2 uimage-fw partitions found on MTD device firmware
[    0.510000] 0x000000050000-0x00000016c558 : "kernel"
[    0.510000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.540000] 0x00000016c558-0x000000800000 : "rootfs"
[    0.550000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.580000] mtd: device 5 (rootfs) set to be root filesystem
[    0.590000] 1 squashfs-split partitions found on MTD device rootfs
[    0.600000] 0x000000340000-0x000000800000 : "rootfs_data"
[    0.620000] ralink_soc_eth 10100000.ethernet (unregistered net_device): port 0 link up (100Mbps/Full duplex)
[    0.640000] ralink_soc_eth 10100000.ethernet: loaded mt7620 driver
[    0.650000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5
[    0.670000] rt3xxx-usbphy usbphy.3: loaded
[    0.670000] rt2880_wdt 10000120.watchdog: Initialized
[    0.690000] TCP: cubic registered
[    0.690000] NET: Registered protocol family 17
[    0.700000] Bridge firewalling registered
[    0.710000] 8021q: 802.1Q VLAN Support v1.8
[    0.730000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    0.750000] Freeing unused kernel memory: 192K (80320000 - 80350000)
procd: Console is alive
procd: - watchdog -
[    5.370000] usbcore: registered new interface driver usbfs
[    5.390000] usbcore: registered new interface driver hub
[    5.390000] usbcore: registered new device driver usb
[    5.410000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.430000] ehci-platform: EHCI generic platform driver
[    5.830000] rt3xxx-usbphy usbphy.3: remote usb device wakeup disabled
[    5.850000] rt3xxx-usbphy usbphy.3: UTMI 16bit 30MHz
[    5.850000] ehci-platform 101c0000.ehci: EHCI Host Controller
[    5.870000] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[    5.890000] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[    5.910000] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[    5.910000] hub 1-0:1.0: USB hub found
[    5.930000] hub 1-0:1.0: 1 port detected
[    5.930000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    5.950000] ohci-platform: OHCI generic platform driver
[    5.960000] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[    5.980000] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[    5.980000] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[    6.070000] hub 2-0:1.0: USB hub found
[    6.070000] hub 2-0:1.0: 1 port detected
procd: - preinit -
[    6.950000] 8021q: adding VLAN 0 to HW filter on device eth0
[    6.990000] random: mktemp urandom read with 65 bits of entropy available
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
No jffs2 marker was found
[   10.640000] jffs2: notice: (310) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 6 of xref (0 dead, 0 orphan) found.
switching to overlay
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   13.590000] NET: Registered protocol family 10
[   13.610000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.630000] Loading modules backported from Linux version master-2014-11-04-0-gf3660a2
[   13.650000] Backport generated by backports.git backports-20141023-2-g4ff890b
[   13.670000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.690000] nf_conntrack version 0.5.0 (961 buckets, 3844 max)
[   13.730000] xt_time: kernel timezone is -0000
[   13.770000] cfg80211: Calling CRDA to update world regulatory domain
[   13.780000] cfg80211: World regulatory domain updated:
[   13.800000] cfg80211:  DFS Master region: unset
[   13.800000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   13.820000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   13.840000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   13.860000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   13.860000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   13.890000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   13.910000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   13.910000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   13.940000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   13.940000] PPP generic driver version 2.4.2
[   13.940000] NET: Registered protocol family 24
[   13.940000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5390, rev 0500 detected
[   13.940000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected
procd: - init complete -
[   19.730000] 8021q: adding VLAN 0 to HW filter on device eth0
[   19.760000] device eth0.1 entered promiscuous mode
[   19.770000] device eth0 entered promiscuous mode
[   19.780000] br-lan: port 1(eth0.1) entered forwarding state
[   19.800000] br-lan: port 1(eth0.1) entered forwarding state
[   21.800000] br-lan: port 1(eth0.1) entered forwarding state
[   21.800000] ralink_soc_eth 10100000.ethernet eth0: port 0 link down
[   22.120000] br-lan: port 1(eth0.1) entered disabled state
[   28.150000] random: nonblocking pool is initialized

Original firmware bootlog

U-boot bootlog

U-Boot 1.1.3 (Jan  7 2013 - 11:32:07)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb4000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
******************************
Software System Reset Occurred
******************************
spi_wait_nsec: 29 
spi device id: ef 40 16 0 0 (40160000)
find flash: W25Q32BV
raspi_read: from:30000 len:1000 
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 4.1.0.0
-------------------------------------------- 
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jan  7 2013  Time:11:32:07
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 

Firmware bootlog

   
3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40 
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3153749 Bytes =  3 MB
   Load Address: 80000000
   Entry Point:  8000c310
raspi_read: from:50040 len:301f55 
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.36 (root@localhost.localdomain) (gcc version 3.4.2) #609 Wed Jan 8 04:44:20 CST 2014

 The CPU feqenuce set to 580 MHz

 MIPS CPU sleep mode enabled.
 PCIE: bypass PCIe DLL.
 PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
 disable all power about PCIe
 PCIE: PLL power down for MT7620N
CPU revision is: 00019650 (MIPS 24Kc)
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=00036478
Readback ErrCtl register=00036478
Memory: 57820k/65536k available (4453k kernel code, 7716k reserved, 846k data, 1568k init, 0k highmem)
NR_IRQS:128
MTK/Ralink System Tick Counter init... cd:8050ff18, m:214748, s:32
Console: colour dummy device 80x25
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource Ralink external timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/W].
fuse init (API version 7.15)
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
HDLC line discipline maxframe=4096
N_HDLC line discipline registered.
Ralink gpio driver initialized
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
brd: module loaded
deice id : ef 40 16 0 0 (40160000)
W25Q32BV(ef 40160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (0M) .erasesize = 0x00000004 (0K) .numeraseregions = 65536
Creating 4 MTD partitions on "raspi":
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000800000 : "Kernel"
mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0x3b0000
rdm_major = 253
SMACCR1 -- : 0x00008c88
SMACCR0 -- : 0x2b001802
Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
SMACCR1 -- : 0x00008c88
SMACCR0 -- : 0x2b001802
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24


=== pAd = c0105000, size = 651752 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
AP Driver version-2.7.1.5
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
i8042.c: i8042 controller self test timeout.
Trying to free nonexistent resource <0000000000000060-000000000000006f>
mice: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
nf_conntrack version 0.5.0 (903 buckets, 3612 max)
nf_conntrack_rtsp v0.6.21 loading
matchsize=264
xt_time: kernel timezone is -0000
nf_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
_nvram_read checksum = 6771 save checksum = 6771
Freeing unused kernel memory: 1568k freed
Hit enter to continue...Restoring defaults...hwaddr = C0:FF:EE:C0:FF:EE
ssid === NEXX_c0ffee
done
7620.
switch reg write offset=2004, value=ff0003
switch reg write offset=2104, value=ff0003
switch reg write offset=2204, value=ff0003
switch reg write offset=2304, value=ff0003
switch reg write offset=2404, value=ff0003
switch reg write offset=2504, value=ff0003
switch reg write offset=2010, value=81000c0
switch reg write offset=2110, value=81000c0
switch reg write offset=2210, value=81000c0
switch reg write offset=2310, value=81000c0
switch reg write offset=2410, value=81000c0
switch reg write offset=2510, value=81000c0
switch reg write offset=2610, value=8100000
switch reg write offset=2710, value=8100000
switch reg write offset=2604, value=20ff0003
switch reg write offset=2704, value=Raeth v3.0 (20Taskletff,SkbRecycle0)
003

phy_tx_ring = 0x03231000, tx_ring = 0xa3231000

phy_rx_ring0 = 0x03232000, rx_ring0 = 0xa3232000
SMACCR1 -- : 0x00008c88
SMACCR0 -- : 0x2b001802
swESW: Link Status Changed - Port4 Link UP
itCDMA_CSG_CFG = 81000000
chGDMA1_FWD_CFG = 20710000
 reg write offset=2610, value=81000000
switch reg write offset=2014, value=10001
switch reg write offset=2114, value=10001
switch reg write offset=2214, value=10001
Algorithmics/MIPS FPU Emulator v1.5
switch reg write offset=2314, value=10001
switch reg write offset=2414, value=10002
switch reg write offset=2514, value=10001
insmod: scsi_mod.ko: module not found
insmod: cdrom.ko: module not found
insmod: sr_mod.ko: module not found
insmod: scsi_wait_scan.ko: module not found
insmod: usb-storage.ko: module not found
insmod: sd_mod.ko: module not found
sh: can't create /proc/sys/net/netfilter/nf_conntrack_buckets: Permission denied
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
RX DESC a30f0000  size = 2048
RTMP_TimerListAdd: add timer obj c0174a80!
RTMP_TimerListAdd: add timer obj c0142260!
RTMP_TimerListAdd: add timer obj c0142234!
RTMP_TimerListAdd: add timer obj c0142208!
RTMP_TimerListAdd: add timer obj c014b5ec!
RTMP_TimerListAdd: add timer obj c014b708!
RTMP_TimerListAdd: add timer obj c014b618!
RTMP_TimerListAdd: add timer obj c014298c!
RTMP_TimerListAdd: add timer obj c010a550!
RTMP_TimerListAdd: add timer obj c010b3cc!
RTMP_TimerListAdd: add timer obj c010c248!
RTMP_TimerListAdd: add timer obj c010d0c4!
RTMP_TimerListAdd: add timer obj c010df40!
RTMP_TimerListAdd: add timer obj c010edbc!
RTMP_TimerListAdd: add timer obj c010fc38!
RTMP_TimerListAdd: add timer obj c0110ab4!
RTMP_TimerListAdd: add timer obj c014269c!
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
E2PROM: D0 target power=0xff20 
E2PROM: 40 MW Power Delta= 0 
3. Phy Mode = 9
RTMP_TimerListAdd: add timer obj c010a148!
AntCfgInit: primary/secondary ant 0/1
Initialize RF Central Registers for E2 !!!
Initialize RF Central Registers for E3 !!!
Initialize RF Channel Registers for E2 !!!
Initialize RF Channel Registers for E3 !!!
Initialize RF DCCal Registers for E2 !!!
Initialize RF DCCal Registers for E3 !!!
D1 = 0, D2 = 8, CalCode = 19 !!!
RT6352_Temperature_Init : BBPR49 = 0x0
RT6352_Temperature_Init : TemperatureRef25C = 0xfffffff6
Current Temperature from BBP_R49=0xfffffffd
 TX BW Filter Calibration !!!
 RX BW Filter Calibration !!!
LOFT Calibration Done!
IQCalibration Start!
IQCalibration Done! CH = 0, (gain= 0, phase=3e)
IQCalibration Start!
IQCalibration Done! CH = 1, (gain= 1, phase= 2)
TX IQ Calibration Done!
internal ALC is not enabled in NVM !
MCS Set = ff ff 00 00 01
RTMP_TimerListAdd: add timer obj c0142ef8!
Main bssid = C0:FF:EE:C0:FF:EE
<==== rt28xx_init, Status=0
0x1300 = 00064380
killall: rt2860apd: no process killed
rt2860apd: No such file or directory
device eth2 entered promiscuous mode
device ra0 entered promiscuous mode
device eth2.2 entered promiscuous mode
br0: port 2(eth2.2) entering forwarding state
br0: port 2(eth2.2) entering forwarding state
br0: port 1(ra0) entering forwarding state
br0: port 1(ra0) entering forwarding state
Changing password for admin
Password for admin changed by admin
proftpd: No such file or directory
config_samba.sh: No such file or directory
info, udhcp server (v0.9.8) started
time.windows.com: Unknown host
open error
Open /proc/max/macfilter Failed
Interface doesn't accept private ioctl...
set (8BE2): Invalid argument
Open /proc/max/trackerurl Failed
IDLE
Hit enter to continue...Hit enter to continue...Hit enter to continue...info, udhcp client (v0.9.8) started
info, Sending discover... (4)

Nexx WT3020 POE mod

The device is small and convenient for plug and forget usage in many ways. Therefore it is shame it does not have a POE capability. As it has only Fast ethernet 100 Mbps (WAN and LAN ports), we can manually take unusued ethernet conductors and use them for do-it-yourself POE.

What you need:

  • Some thin wires
  • DC-DC converter
  • Power switch or relay (to prevent reverse current flow to ethernet in case of using microUSB power delivery)
  • Multimeter and patience
  • DO NOT FORGET, THAT ALL PARTS OF THE CIRCUIT MUST HANDLE MAXIMUM CURRENT DELIVERY. NEXX ITSELF HAS 1.2 ADC, for me the weakest part is DC-DC converter that can handle 1.7 A, but it is still higher than the limit.

The basic idea

POE mod pic, I can not upload it here
POE uses unusued ethernet pins 5-6 (blue; +DC) and 7-8 (brown; GND) to power delivery in case you have only fast ethernet 10/100 Mbit. So you can unsolder them from the board and use them for POE. For that task, I used small scissors and ripped them off the board :P
You can use pins from WAN or LAN ports or both if you wish. I used pins from WAN port (in the picture 1a with GND connected to ethernet shield and 1b).
You can power POE by many voltage sources, so there is step down DC-DC converter (2.) which can handle 5-17 VDC input and is set up to 5 VDC output. Therefore you can POE it from 5 to 17 volts power sources.
From there, the left side output GND is again connected to (not visible) ethernet shield (not necessary, 1a GND is also connected so this is "just in case") and the +5 VDC output goes to power switch. The power switch is important if you do not have reverse current protection! There you choose between POE and microUSB power delivery. You can also use some relay to do this automaticaly.
I connected the +5 VDC output to female USB-A +5 VDC pin as it was the largest part that you can use for this ;)
You also need to "adjust" the above router cover if you use the power switch - I fixed the switch on the USB-A port. And remember to isolate all moving parts to prevent unwanted short-circuit. I used glue gun for that (see the bottom of DC-DC converter).

Final thoughts

Use multimeter resistance measurement to see, which parts are connected to which. The 5 VDC are short-circuited on both microUSB and USB-A ports, same with the GND.
Do not use diode for reverse current protection as there will be voltage drop and unnecessary power losses.
And the last thing - this is only my idea how to do POE on Nexx WT3020. Do it as you wish if you like to.
The result pic, I can not upload it here

toh/nexx/wt3020.txt · Last modified: 2016/05/10 15:42 by stas2z