User Tools

Site Tools


Tenda W306R

Version 1.x and 2.x of this model are different in some fairly important aspects and have different OEM firmwares. This will almost certainly result in two different OpenWrt firmware images.

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v1.01) Dec 2008 - - -
v2.0 Nov 2009 W306R001294700029 since R31396! -
v2.12) - - - -
v2.23) - - - -


  • Only Version 2.0 boards have been tested so far.
  • It may be possible to use W306R V2.0 firmware on W307R V4.0 Platform
  • It may be possible to use W306R V1.0 firmware on W307R V3.0 Platform
  • For other devices that are similar check out similar devices below

Hardware Highlights

Ver CPU Ram Flash Network Wireless USB Serial JTag
1.0 16MiB 5x 10/100 802.11 bgn
2.0 MIPS 24K V4.12 @384 Mhz 32MiB 4MiB 5x 10/100 802.11 bgn No Yes Unlikely


Identify your Hardware Revision

It is possible to identify the version using the web interface but if you do not have this access, you may need to open the device and read the circuit board. To identify your hardware version of W306R you can open the device, or check in the settings page of the router. After logging in to the routers html setup page use the links on the left to select "System Status" then scroll down to the last line in the table which may read "Hardware Version 2.0" or similar.

Method 1

Using a serial connection:

  1. Identify your Hardware Version and therefore, your options.
  2. Connect a Serial Cable (Soldering recommended).
  3. → Setup a PC using instructions here: NetBoot or here generic.flashing.tftp.

Now when rebooting the router you have two options:

  1. Load system code to SDRAM via TFTP.
    Uses the ram of the router and will not overwrite firmware, if the router looses power or is reset in software it will then boot the OEM firmware. Use image named openwrt-ramips-rt305x-w306r-v20-initramfs-uImage.bin


  2. Load system code then write to Flash via TFTP.
    Will overwrite the old firmware with OpenWRT and you should use openwrt-ramips-rt305x-w306r-v20-squashfs-sysupgrade.bin

Method 2

OEM Installation, Flash using a binary compatible with the OEM upgrade method

  1. Access the routers html settings web pages, default settings are:
  2. Using left section select + System Tools then Upgrade
  3. Use Browse to select the correct firmware file (openwrt-ramips-rt305x-w306r-v20-squashfs-factory.bin)
  4. Then click upload (select OK to the are you sure question).
  5. The router will upgrade and reboot then follow the OpenWRT firstlogin

Defaults After Install

Interface Name Description Default configuration MAC correct
br-lan LAN & WiFi Same as LAN
eth0 Internal Switch N/A N/A
eth0.1 LAN ports (1 to 4) Static Same as OEM
eth0.2 Wan port DHCP Same as OEM
wlan0 WiFi - uses both antenna1 Disabled Same as LAN

Note: 1. Actually the antenna when scanning appears to be the one on the left when the router is facing you, further testing is needed as to whether the OpenWrt firmware actually implements MIMO or similar technologies.

Tenda W306R (2.0) Flash Layout

Tenda W306R Flash Layout
Layer0 4096KiB
Layer1 mtd0 u-boot 192KiB mtd5 firmware 3904KiB
Layer2 192KiB Bootloader 64KiB Config 64KiB Factory mtd1 kernel 704KiB


Basic configuration

Having installed OpenWRT follow the the Basic configuration



Hardware Version: V1.04) V2.0 V2.15) V2.26)
Architecture: MIPS
Vendor: Ralink Ralink
Bootloader: U-Boot
System-On-Chip: Ralink 2880 RT3052 Ralink 2880 RT3052
CPU/Speed: MIPS 24K V4.12 @384 Mhz 266Mhz
Flash-Chip: KH29LV320DBTC
Flash size: 4 MiB 4MiB
RAM-Chip: 2 x Hynix HY57V641620FTP-7 2 x w9812g6ih
RAM size: 16 MiB 32 MiB 16 MiB
Wireless: Ralink RT28x0 (Integrated) 802.11 bgn RT3052 (Integrated) 802.11 bgn Ralink RT2820 (Integrated) RT3052 (Integrated) 802.11 bgn
Ethernet: IP175C RT3052 (Integrated) IP175C RT3052 (Integrated)
Serial: Yes
JTAG: unknown


Model 1.0

Model 2.0

Opening the case

Note: This will void your warranty!

To remove the cover:

  1. Disconnect power supply and network leads.
  2. Remove the four rubber feet (i stuck them back to the case nearby).
  3. Remove the now revealed four small screws.
  4. Use screwdriver or plastic leaver to pry open cover from sides then front.

Main PCB Model 2.0


Photo of PCB with markings

In order to de-brick, or install OpenWRT using Method 1, you will need to connect a serial cable to the device. You will need to solder wires to a header, then connect port.serial.cables device to communicate to the serial port of a computer.

In Version 2.0: The pads to solder to are near the CPU on the underside of the circuit board.

The serial settings needed are:

Rate 57600
Data Bits 8
Stop Bits 1
Parity none
Flow Control none

port.serial general information about the serial port, serial port cable, etc.



  • If a html upgrade option is unavailable because the system hangs on startup then you will need to follow Install, Method 1
  • If the bootloader has been overwritten your router is most likely undebrickable

Uninstall OpenWrt

To revert to manufacture firmware:

  • From a working OpenWRT installation:
    1. Use the sysupgrade utility but use the OEM firmware
  • Without a working firmware:
    1. Setup as per Method 1
    2. At the serial console for the router press "2" key when router is rebooting to use tft server and boot to flash.
    3. Use the original image file, i renamed mine to "revert.bin" from "U306Rv2en_I2_V3.3.6f.bin".


Someone needs to verify all hardware versions other than 2.0. I cannot be sure about researched details for all other hardware versions.


  1. Write a customized profile following ramips.platform
Primary Tasks 1.0 V2.0 2.1 2.2
Add a new machine image in image/Makefile DONE
write machine file mach-w306r.c DONE
GPIO pins for LEDs and buttons DONE
Port layout for the device (vlan configuration) DONE
Flash memory configuration DONE
Watchdog timer DONE
Reference the new machine file in
Reference the new machine name in files/arch/mips/include/asm/mach-ralink/machine.h DONE
Add your board to base-files/lib/ for userspace scripts to read the board name DONE
Secondary Tasks 1.0 V2.0 2.1 2.2
base-files/etc/ to set a LED which OpenWRT should blink on bootup DONE
base-files/lib/upgrade/ to allow sysupgrade to work on your board DONE
base-files/etc/uci-defaults/network to configure default network interface settings, particularly MAC addresses DONE
base-files/etc/uci-defaults/leds if you have configurable LEDs which should default to a behavior, like a WLAN activity LED DONE
base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom to extract the firmware image for the wireless module DONE
base-files/lib/preinit/06_set_iface_mac to set the MAC addresses of any other interfaces DONE
Tertiary Tasks 1.0 V2.0 2.1 2.2
Compile images for people to use DONE
openwrt-ramips-rt305x-w306r-v20-initramfs-uImage.bin DONE
openwrt-ramips-rt305x-w306r-v20-squashfs-factory.bin DONE
openwrt-ramips-rt305x-w306r-v20-squashfs-sysupgrade.bin DONE

Technical Data

The following is the raw data collected to understand the way this device is put together and the technical content below should be used to construct a useful summary above.

Original Firmware

The firmware file is from Tenda and marked as: "I2_V3.3.6f_EN-Jun 22 2010"

Boot Log

This is the entire output on serial port when V2.0 board boots.

U-Boot 1.1.3 (Feb 13 2009 - 09:48:32)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fac000
flash_protect ON: from 0xBF000000 to 0xBF01FFAF
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
Ralink UBoot Version: 3.2
ASIC 3052_MP2 (Port5<->None)
DRAM BUS: 32BIT                                                                 
Total memory: 32 MBytes                                                         
Date:Feb 13 2009  Time:09:48:32                                                 
icache: sets:256, ways:4, linesz:32 ,total:32768                                
dcache: sets:128, ways:4, linesz:32 ,total:16384                                
 ##### The CPU freq = 384 MHZ ####                                              
 SDRAM bus set to 32 bit                                                        
 SDRAM size =32 Mbytes                                                          
Please choose the operation:                                                    
   1: Load system code to SDRAM via TFTP.                                       
   2: Load system code then write to Flash via TFTP.                            
   3: Boot system code via Flash (default).                                     
   4: Entr boot command line interface.                                         
   9: Load Boot Loader code then write to Flash via TFTP.                       
3: System Boot system code via Flash.                                           
## Booting image at bf050000 ...                                                
   Image Name:   linkn Kernel Image                                             
   Created:      2010-06-22   4:23:26 UTC                                       
 System Control Status = 0x20440000                                             
   Image Type:   MIPS Linux Kernel Image (lzma compressed)                      
   Data Size:    2174143 Bytes =  2.1 MB                                        
   Load Address: 80000000                                                       
   Entry Point:  8036a000                                                       
   Verifying Checksum ... OK                                                    
   Uncompressing Kernel Image ... OK                                            
No initrd                                                                       
## Transferring control to Linux (at address 8036a000) ...                      
## Giving linux memsize in MB, 32                                               
Starting kernel ...                                                             
LINUX started...                                                                
 THIS IS ASIC                                                                   
Linux version 2.6.21 (root@linux-6091) (gcc version 3.4.2) #1366 Tue Jun 22 12:0
 The CPU feqenuce set to 384 MHz                                                
CPU revision is: 0001964c                                                       
Determined physical RAM map:                                                    
 memory: 02000000 @ 00000000 (usable)                                           
Initrd not found or empty - disabling initrd                                    
Built 1 zonelists.  Total pages: 8128                                           
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0                       
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.    
Primary data cache 16kB, 4-way, linesize 32 bytes.                              
Synthesized TLB refill handler (20 instructions).                               
Synthesized TLB load handler fastpath (32 instructions).                        
Synthesized TLB store handler fastpath (32 instructions).                       
Synthesized TLB modify handler fastpath (31 instructions).                      
Cache parity protection disabled                                                
cause = 90800058, status = 1100ff00                                             
PID hash table entries: 128 (order: 7, 512 bytes)                               
calculating r4koff... 00177000(1536000)                                         
CPU frequency 384.00 MHz                                                        
Using 192.000 MHz high precision timer.                                         
Console: colour dummy device 80x25                                              
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)                   
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)                     
Memory: 27708k/32768k available (3052k kernel code, 5060k reserved, 439k data, )
Mount-cache hash table entries: 512                                             
NET: Registered protocol family 16                                              
NET: Registered protocol family 2                                               
Time: MIPS clocksource has been installed.                                      
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)                  
TCP established hash table entries: 1024 (order: 1, 8192 bytes)                 
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)                        
TCP: Hash tables configured (established 1024 bind 1024)                        
TCP reno registered                                                             
detected lzma initramfs                                                         
detected lzma initramfs                                                         
initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=4108800                
LZMA initramfs by Ming-Ching Tiew <>...........................)
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher                           
squashfs: LZMA suppport for by jro                                     
io scheduler noop registered (default)                                          
FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB                                       
Ralink gpio driver initialized                                                  
HDLC line discipline: version $Revision: $, maxframe=4096               
N_HDLC line discipline registered.                                              
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled        
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A                      
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A                      
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize          
loop: loaded (max 8 devices)                                                    
rdm_major = 254                                                                 
PPP generic driver version 2.4.2                                                
PPP Deflate Compression module registered                                       
PPP BSD Compression module registered                                           
PPP MPPE Compression module registered                                          
NET: Registered protocol family 24                                              
AP Driver version-                                                       
ralink flash device: 0x1000000 at 0x1f000000                                    
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank   
 Amd/Fujitsu Extended Query Table at 0x0040                                     
number of CFI chips: 1                                                          
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.        
Creating 4 MTD partitions on "Ralink SoC physically mapped flash":              
0x00000000-0x00030000 : "Bootloader"                                            
0x00030000-0x00040000 : "Config"                                                
0x00040000-0x00050000 : "Factory"                                               
0x00050000-0x01000000 : "Kernel"                                                
mtd: partition "Kernel" extends beyond the end of device "Ralink SoC physically0
block2mtd: version $Revision: $                                         
nf_conntrack version 0.5.0 (256 buckets, 2048 max)                              
arp_tables: (C) 2002 David S. Miller                                            
IPv4 over IPv4 tunneling driver                                                 
GRE over IPv4 tunneling driver                                                  
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone              
net/ipv4/netfilter/ipt_netcheck.c 191 ipt_netcheck init                         
TCP cubic registered                                                            
NET: Registered protocol family 1                                               
NET: Registered protocol family 10                                              
NET: Registered protocol family 17                                              
802.1Q VLAN Support v1.8 Ben Greear <>                   
All bugs added by David S. Miller <>                            
GDMA1_MAC_ADRH -- : 0x00000000                                                  
GDMA1_MAC_ADRL -- : 0x00000000                                                  
Ralink APSoC Ethernet Driver Initilization. v2.00  256 rx/tx descriptors alloca!
GDMA1_MAC_ADRH -- : 0x0000000c                                                  
GDMA1_MAC_ADRL -- : 0x43305277                                                  
PROC INIT OK!                                                                   
Freeing unused kernel memory: 1144k freed                                       
init started: BusyBox v1.12.1 (2010-06-22 12:19Algorithmics/MIPS FPU Emulator v5
:00 CST)                                                                        
starting pid 13, tty '': '/etc_ro/rcS'                                          
devpts: called with bogus options                                               
Welcome to                                                                      
     _______  _______  ___     __  ____   _  _   ___                            
    |  ___  \|   __  || kernel reg pid 20 success .                             
  |   |__||    \ | || | /  /                                                    
    | |___| ||  |__| ||   |__  __ |     \| || |/  /                             
    |   _   /|   _   ||      ||  || |\     ||     \                             
    |__| \__\|__| |__||______||__||_| \____||_|\___\                            
                     =System Architecture Department=                           
      ****** WeLoveLinux ******                                                 
 Welcome to ...                                                                 
httpd Reg gpio hook success .                                                   
starting pid 23, tty '/dev/ttyS1': '/bin/sh'                                    
BusyBox v1.12.1 (2010-06-22 12:19:00 CST) built-in shellRX DESC a1c51000  size 8
Enter 'help' for a list <-- RTMPAllocTxRxRingMemory, Status=0                   
of built-in commands.                                                           
# Key1Str is Invalid key length(0) or Type(0)                                   
Key2Str is Invalid key length(0) or Type(0)                                     
Key3Str is Invalid key length(0) or Type(0)                                     
Key4Str is Invalid key length(0) or Type(0)                                     
1. Phy Mode = 9                                                                 
2. Phy Mode = 9                                                                 
3. Phy Mode = 9                                                                 
RTMPSetPhyMode: channel is out of range, use first channel=0                    
MCS Set = ff ff 00 00 01                                                        
SYNC - BBP R4 to 20MHz.l                                                        
Main bssid = c8:3a:35:16:87:00                                                  
<==== rt28xx_init, Status=0                                                     
0x1300 = 00064380                                                               
getIfLive: device eth2.1 not found.                                             
Commit crc = 6f4dd889                                                           
Wan[C8:3A:35:GDMA1_MAC_ADRH -- : 0x0000c83a                                     
GDMA1_MAC_ADRL -- : 0x35168700                                                  
phy_tx_ring = 0x01d29000, tx_ring = 0xa1d29000                                  
phy_rx_ring = 0x00000000, rx_ring = 0x00000000                                  
RT305x_ESW: Link Status Changed                                                 
CDMA_CSG_CFG = 81000000                                                         
GDMA1_FWD_CFG = 10000                                                           
eth2.1: Setting MAC address to  c8 3a 35 16 87 00.                              
VLAN (eth2.1):  Underlying device (eth2) has same MAC, not checking promiscious.
eth2.2: Setting MAC address to  c8 3a 35 16 87 05.                              
device eth2 entered promiscuous mode                                            
VLAN (eth2.2):  Setting underlying device (eth2) to promiscious mode.           
getIfLive: device br0 not found.                                                
eth2.1: dev_set_promiscuity(master, 1)                                          
device eth2.1 entered promiscuous mode                                          
Router ip address config success.                                               
br0: port 1(eth2.1) entering learning state                                     
device ra0 entered promiscuous mode                                             
br0: port 2(ra0) entering learning state                                        
libupnp: using UDP SSDP_PORT = 1900                                             
br0: topology change detected, propagating                                      
br0: port 1(eth2.1) entering forwarding state                                   
br0: topology change detected, propagating                                      
br0: port 2(ra0) entering forwarding state                                      
killall: udhcpd: no process killed                                              
ND -> Bad_Sig_entry [18]...                                                     
***** g_wl_interface = ra0 ******                                               
sh: rjclient: not found                                                         
httpd listen ip = port = 80                                         
MfgThread start loop.                                                           
TendaLog -> ok rtn.                                                             
macBcast uses obsolete (PF_INET,SOCK_PACKET)                                    
udhcpc (v1.12.1) started

Info from console

# cat /proc/cpuinfo                                                             
system type             : Ralink SoC                                            
processor               : 0                                                     
cpu model               : MIPS 24K V4.12                                        
BogoMIPS                : 255.48                                                
wait instruction        : yes                                                   
microsecond timers      : yes                                                   
tlb_entries             : 32                                                    
extra interrupt vector  : yes                                                   
hardware watchpoint     : yes                                                   
ASEs implemented        : mips16 dsp                                            
VCED exceptions         : not available                                         
VCEI exceptions         : not available              

# cat /proc/version                                                             
Linux version 2.6.21 (root@linux-6091) (gcc version 3.4.2) #1366 Tue Jun 22 12:0

# cat /proc/meminfo                                                             
MemTotal:        28852 kB                                                       
MemFree:         18516 kB                                                       
Buffers:             0 kB                                                       
Cached:           4516 kB                                                       
SwapCached:          0 kB                                                       
Active:           2396 kB                                                       
Inactive:         2948 kB                                                       
SwapTotal:           0 kB                                                       
SwapFree:            0 kB                                                       
Dirty:               0 kB                                                       
Writeback:           0 kB                                                       
AnonPages:         856 kB                                                       
Mapped:           1028 kB                                                       
Slab:             4160 kB                                                       
SReclaimable:      500 kB                                                       
SUnreclaim:       3660 kB                                                       
PageTables:        144 kB                                                       
NFS_Unstable:        0 kB                                                       
Bounce:              0 kB                                                       
CommitLimit:     14424 kB                                                       
Committed_AS:     2224 kB                                                       
VmallocTotal:  1048404 kB                                                       
VmallocUsed:       504 kB                                                       
VmallocChunk:  1047900 kB

# cat /proc/mtd                                                                 
dev:    size   erasesize  name                                                  
mtd0: 00030000 00010000 "Bootloader"                                            
mtd1: 00010000 00010000 "Config"                                                
mtd2: 00010000 00010000 "Factory"                                               
mtd3: 003b0000 00010000 "Kernel"    

# cat /proc/partitions                                                          
major minor  #blocks  name                                                      
  31     0        192 mtdblock0                                                 
  31     1         64 mtdblock1                                                 
  31     2         64 mtdblock2                                                 
  31     3       3776 mtdblock3  

# cat /proc/net/nf_conntrack                                                    
ipv4     2 unknown  2 221 src= dst= packets=2 bytes=80 [UN1
ipv4     2 udp      17 5 src= dst= sport=57633 dpor1
ipv4     2 udp      17 23 src= dst= sport=3073 dport=1

# cat /proc/cmdline         
console=ttyS1,57600n8 root=/dev/ram0 

# cat /proc/iomem                                                               
00000000-01ffffff : System RAM                                                  
  00000000-002fb147 : Kernel code                                               
  002fb148-003690bf : Kernel data

root@OpenWrt:/# hexdump -C /dev/mtd2                                            
00000000  52 30 01 01 c8 3a 35 16  87 00 ff ff ff ff ff ff  |R0...:5.........|  
00000010  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|  
00000020  ff ff ff ff ff ff ff ff  00 0c 43 30 52 77 00 0c  |..........C0Rw..|  
00000030  43 30 52 66 22 08 26 00  ff ff 2a 01 55 77 a8 aa  |C0Rf".&...*.Uw..|  
00000040  8c 88 ff ff 0c 00 00 00  00 00 00 00 00 00 ff ff  |................|  
00000050  ff ff 0c 0c 0c 0c 0c 0c  0a 0a 0a 0a 0a 0a 08 08  |................|  
00000060  11 11 11 11 11 11 11 11  11 11 11 11 10 10 ff f7  |................|  
00000070  e0 a0 80 44 28 10 ff 01  ff ff ff ff ff ff ff ff  |...D(...........|  
00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|  
000000d0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff 66 66  |..............ff|  
000000e0  cc aa 88 66 cc aa 88 66  cc aa 88 66 cc aa 88 66  |...f...f...f...f|  
000000f0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|  

See Also

Similar Devices

In order of similarity and informativeness.



1) , 2) , 3) , 4) , 5) , 6) Please Verify and correct details on this Version
toh/tenda/w306r.txt · Last modified: 2015/10/23 21:09 by tmomas