Porting OpenWRT to an unbranded 3GN router

Ok, not porting, but more like adding support for the board, ’cause the chip is already quite known.
I got this thing from my favourite place to waste money – DX. It has RTL3050F inside, 32MB RAM, 4MB FLASH, and runs at 320Mhz. A good bonus is a usb host and a usual uart, well hidden in a small case.
Obligatory photo follows:

Ok, so what next? As usual, the first thing I do, once I get a router… Turn on the soldering iron, take it apart and solder the 2,54 header to connect to the uart. Hehe.
UART is here, the usual 4 pins. GND, RX, TX and Vcc. Logic levels are 3,3 volts (As if I expected anything else), so I just soldered the pins and hooked the bus pirate.


The board is shipped with u-boot, has no jtag whatsoever (careful not to brick – or else you’ll have some bad time desoldering the flash chip, programming it and soldering back!).
Next I got the latest OpenWRT trunk… To just find that this thing doesn’t boot with any of the images generated.
the MOFI3500-3GN image kind of worked, but complained about incorrect mtd patitioning schema.
Time to get some coffee and start hacking OpenWRT to get things right.

As the result, I:

  • Created a new mach-type called ‘mach-unbranded-3gn’
  • Altered the scripts to correctly pack the firmware for this new supported router.
  • Figured out the correct GPIOS for LEDs, so that all 5+1 leds that can be controlled are avaliable from /sys/class/leds
  • Figured out the GPIOS for both buttons at the back to work
  • Altered some scripts to correctly extract firmware for wireless chip
  • Sent the patches to openwrt-devel.
USB didn’t work, so I grabbed some GPL code from asus router based on the same chip and gave it a look. USB host is called here dwc_otg. According to the headers ralink just grabbed the IP core of that from synopsys. Actually, it can act both as a device and as a host. But you cannot switch that in the runtime, since the modes of operation are hardcoded there.
Synopsys didn’t use ohci/ehci, but just invented their own shit(tm) whith blackjack and hoo… err… hmmm… other stuff. As the result the code resides in drivers/usb/dwc_otg and looks quite alien.
Layne Edwards from OpenWRT-devel has already provided some patches, but:
  • I haven’t yet tried them yet
  • They aren’t yet in the OpenWRT trunk
So no usb support this time. Check back in a week or so.
To flash, you have to solder the uart and hook a terminal at 57600 baud 8n1 (for dummies: speed 57600, 8 data bits, no parity, 1 stop bits, no software or hardware flow control).
Once it boots and you see the 5 sec countdown – press a key, and select “2”.
You need a tftpd server running – the firmware is transferred via ethernet using tftp.
If you do everything correctly – you’ll see something like that in your terminal:

U-Boot 1.1.3 (Apr 7 2010 - 09:43:57)

Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fac000
======= config usb otg =====
flash_protect ON: from 0xBF000000 to 0xBF0205C3
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================
Ralink UBoot Version: 3.2
--------------------------------------------
ASIC 3052_MP2 (Port5<->None)
DRAM COMPONENT: 256Mbits
DRAM BUS: 16BIT
Total memory: 32 MBytes
Date:Apr 7 2010 Time:09:43:57
============================================
icache: sets:128, ways:4, linesz:32 ,total:16384
dcache: sets:128, ways:4, linesz:32 ,total:16384

##### The CPU freq = 320 MHZ ####

SDRAM bus set to 16 bit
SDRAM size =32 Mbytes

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
0

3: System Boot system code via Flash.
## Booting image at bf050000 ...
Image Name: MIPS OpenWrt Linux-2.6.39.2
Created: 2011-08-04 17:34:58 UTC

System Control Status = 0x00400000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 804635 Bytes = 785.8 kB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 32

Starting kernel ...

Linux version 2.6.39.2 (necromant@ilwyn) (gcc version 4.5.4 20110526 (prerelease) (Linaro GCC 4.5-2011.06-0) ) #18 Thu Aug 4 21:34:21 MSD 2011
bootconsole [early0] enabled
CPU revision is: 0001964c (MIPS 24Kc)
Ralink RT3350 id:1 rev:2 running at 320.00 MHz
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: board=NONAME-3GN mtdparts=physmap-flash.0:192k(u-boot)ro,64k(devdata)ro,64k(devconf)ro,832k(kernel),2944k(rootfs),3776k@0x50000(firmware) console=ttyS1,57600 rootfstype=squashfs,jffs2
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 16kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0007a000
Readback ErrCtl register=0007a000
Memory: 30032k/32768k available (1849k kernel code, 2736k reserved, 312k data, 148k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:48
console [ttyS1] enabled, bootconsole disabled
console [ttyS1] enabled, bootconsole disabled
Calibrating delay loop... 212.58 BogoMIPS (lpj=1062912)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is Unbranded 3G router from DX
bio: create slab at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 58
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
physmap platform flash device: 00800000 at bf000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a8
Amd/Fujitsu Extended Query Table at 0x0040
Amd/Fujitsu Extended Query version 1.1.
Silicon revision: 0
Address sensitive unlock: Required
Erase Suspend: Read/write
Block protection: 4 sectors per group
Temporary block unprotect: Supported
Block protect/unprotect scheme: 4
Number of simultaneous operations: 0
Burst mode: Not supported
Page mode: Not supported
Vpp Supply Minimum Program/Erase Voltage: 9.5 V
Vpp Supply Maximum Program/Erase Voltage: 10.5 V
Top/Bottom Boot Block: Bottom boot
number of CFI chips: 1
cmdlinepart partition parsing not available
RedBoot partition parsing not available
Using physmap partition information
Creating 6 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "config"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000120000 : "kernel"
0x000000120000-0x000000800000 : "rootfs"
mtd: partition "rootfs" extends beyond the end of device "physmap-flash.0" -- size truncated to 0x2e0000
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=260000, len=1A0000
0x000000260000-0x000000400000 : "rootfs_data"
0x000000050000-0x000000800000 : "firmware"
mtd: partition "firmware" extends beyond the end of device "physmap-flash.0" -- size truncated to 0x3b0000
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
lib80211: common routines for IEEE802.11 drivers
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 148k freed
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
JFFS2 notice: (290) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 4 of xref (0 dead, 2 orphan) found.
switching to jffs2
- init -

Please press Enter to activate this console. Compat-wireless backport release: compat-wireless-2011-06-23
Backport based on wireless-testing.git master-2011-06-22
cfg80211: Calling CRDA to update world regulatory domain
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
br-lan: port 1(eth0.1) entering forwarding state
br-lan: port 1(eth0.1) entering forwarding state
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (471 buckets, 1884 max)
cfg80211: World regulatory domain updated:
cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)

BusyBox v1.18.5 (2011-08-02 21:37:04 MSD) built-in shell (ash)
Enter 'help' for a list of built-in commands.

_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
ATTITUDE ADJUSTMENT (bleeding edge, r27878) ----------
* 1/4 oz Vodka Pour all ingredients into mixing
* 1/4 oz Gin tin with ice, strain into glass.
* 1/4 oz Amaretto
* 1/4 oz Triple sec
* 1/4 oz Peach schnapps
* 1/4 oz Sour mix
* 1 splash Cranberry juice
-----------------------------------------------------
root@OpenWrt:/#

5 thoughts on “Porting OpenWRT to an unbranded 3GN router”

  2. Hello friend, i see your work, the router “”Aztech HW553″” is based on rt3050=rt3052, and this frimware “”HW553_Firmware_v220.106.2-010.zip”” supourt, some 3g umts,
    1. Additional support for following USB 3G modems
    a. Alcatel X220
    b. BMobile
    c. Huawei E1782
    d. Huawei E367
    e. Huawei E1820
    f. Onda MT833UP
    g. Prolink PHS101
    h. ZTE K3565-Z

    Can you detail, hardware of your board, it is mx29lv640dbti-90g, W9812G6IH,wich rt3050..??

    Reply

  4. Dear Necromancer,

    After some days tries to hack the same 3G/WIFI router as the one you described in your nice post, I read your article and would like to know if you could share your work on how to create a bootable firmware image for the router ? I would like to learn how to add an unsupported device to OpenWRT.

    Many thanks in advance,
    Best regards,
    Jean

    Reply

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.