The content of this topic has been archived between 15 Mar 2016 and 30 Apr 2018. Unfortunately there are posts – most likely complete pages – missing.
I've noticed on a few Russian and Chinese sites (e.g. here: http://mysku.ru/blog/aliexpress/29103.html) that there appears to be a U-boot mod for the WT3020 that adds web flashing support.
I have a WT3020 with OpenWrt on it, but I'd like to upgrade the stock U-boot. Can someone provide a guide in English?
You can't write to the U-Boot partition from a standard OpenWrt build, it has safeguards in place specifically to prevent U-Boot from being overwritten. You'd need to either build a custom OpenWrt with that safeguard disabled, flash it, and then flash U-Boot from there, or directly go through the bootloader with a serial console connected.
You can't write to the U-Boot partition from a standard OpenWrt build, it has safeguards in place specifically to prevent U-Boot from being overwritten. You'd need to either build a custom OpenWrt with that safeguard disabled, flash it, and then flash U-Boot from there, or directly go through the bootloader with a serial console connected.
Thanks, think I had heard that before.
I was looking for a guide specific to the WT3020 though, and I haven't been able to find proper download of the latest U-boot.
I was looking for a guide specific to the WT3020 though, and I haven't been able to find proper download of the latest U-boot.
The site that you mentioned contains a link to download a bootloader u-boot-nexx-3020-7620.bin (there's however no mention of the origins of this "alternative" bootloader). The site also contains instructions for flashing it from the _stock_ firmware. But you already have OpenWRT, where mtd0 is write protected. You could probably revert to stock in order to flash the bootloader, and then back to OpenWRT. (Please note that I don't have this device, so what I suggest is pure theory.)
You could try step by step guide from italian site translate it with google web translator here.
OR
Do tftp job with serial console by pressing option 9.
U-Boot 1.1.3 (Jan 14 2015 - 09:15:58)
Board: Ralink APSoC DRAM: 64 MB
GPIO#44 updated GPIOMODE register: 001a311c -> 001ab11c
MT7620 Ai-BR100 gpio init : WPS / RESET pin
relocate_code Pointer at: 83fb0000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: ef 40 18 0 0 (40180000)
find flash: W25Q128FV
raspi_read: from:30000 len:1000
*** Warning - bad CRC, using default environment
============================================
CleanWRT u-boot_mt7620 Version: 0.0.0.1
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jan 14 2015 Time:09:15:58
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =64 Mbytes
Press press WPS button for more than 2 seconds to run web failsafe mode
WPS button is pressed for: 0 second(s)
Catution: WPS button wasn't pressed or not long enough!
Continuing normal boot...
Please choose the operation:
0: System Load Linux then write to Flash via Serial.
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
8: System Load UBoot to SDRAM via TFTP.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 9
0
raspi_read: from:40028 len:6
9: System Load Boot Loader then write to Flash via TFTP.
Warning!! Erase Boot Loader in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.128.1) ==:192.168.128.1
Input server IP (192.168.128.32) ==:192.168.128.32
Input Uboot filename () ==:u-boot-nexx-3020-7620.bin
netboot_common, argc= 3
NetTxPacket = 0x83FE6F80
KSEG1ADDR(NetTxPacket) = 0xA3FE6F80
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
ETH_STATE_ACTIVE!!
TFTP from server 192.168.128.32; our IP address is 192.168.128.1
Filename 'u-boot-nexx-3020-7620.bin'.
TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (00:24:1d:74:12:09)
Got it
#######################################
done
Bytes transferred = 196608 (30000 hex)
NetBootFileXferSize= 00030000
raspi_erase_write: offs:0, count:30000
raspi_erase: offs:0 len:30000
...
raspi_write: 80100000 to:0 len:30000
...
raspi_read: from:0 len:10000
raspi_read: from:10000 len:10000
raspi_read: from:20000 len:10000
Done!
U-Boot 1.1.4 (Nov 18 2014 - 22:58:07)
Ralink APSoC (MT7620 E2 ver 2, eco 6)
DRAM: 64 MB
Flash: Winbond W25Q128 (16 MB)
*** Warning - bad CRC, using default environment
Clocks: CPU:600MHz, Bus:200MHz
In: serial
Out: serial
Err: serial
Net: rt2880_eth_initialize...
VLAN: None
Fetching MAC Address from 0xbc040028
eth0: 8c:88:2b:00:20:6c
eth0 up
eth0
Hit any key to stop autoboot: 0
## Booting image at 9c050000 ...
Image Name: MIPS OpenWrt Linux-3.14.28
Created: 2015-01-13 6:33:54 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1104496 Bytes = 1.1 MB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum at 0x9c050040 ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...DO SO AT YOUR OWN RISK
I just completely brick my WT3020 and have to reprogram it with program tools.
(Last edited by saturn-b on 17 Jan 2015, 18:39)
roger_ wrote:I was looking for a guide specific to the WT3020 though, and I haven't been able to find proper download of the latest U-boot.
The site that you mentioned contains a link to download a bootloader u-boot-nexx-3020-7620.bin (there's however no mention of the origins of this "alternative" bootloader). The site also contains instructions for flashing it from the _stock_ firmware. But you already have OpenWRT, where mtd0 is write protected. You could probably revert to stock in order to flash the bootloader, and then back to OpenWRT. (Please note that I don't have this device, so what I suggest is pure theory.)
Thanks, I had found that but I was hoping to find where that U-boot was developed to make sure it was the latest one and that I wasn't missing any gotchas or anything.
You could try step by step guide from italian site translate it with google web translator here.
...
I just completely brick my WT3020 and have to reprogram it with program tools.
Damn! Where'd you go wrong? Did you flash from the stock firmware?
Damn! Where'd you go wrong?
It just stop at "Starting kernel..." after flashing another firmware.
Did you flash from the stock firmware?
No, my router already upgraded to 16MB but I'll roll back to original state for the next test, since my flash ic is not permanently soldered.
There is another MT7620 uboot mod with web fail safe that I've manage to mod it for WT3020 but still at testing stage if you interested.
U-Boot 1.1.3 (Jan 18 2015 - 21:33:50)
Board: Ralink APSoC DRAM: 64 MB
GPIO#44 updated GPIOMODE register: 001a311c -> 001ab11c
NEXX WT-3020 gpio init : WPS / RESET pin
GPIO#1 updated GPIOMODE register: 001ab11c -> 001ab11d
relocate_code Pointer at: 83fb0000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: ef 40 18 0 0 (40180000)
find flash: W25Q128FV
raspi_read: from:30000 len:1000
raspi_read: from:30000 len:1000
============================================
CleanWRT u-boot_mt7620 Version: 0.0.0.3
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jan 18 2015 Time:21:33:50
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =64 Mbytes
Press press RESET button for more than 2 seconds to run web failsafe mode
RESET button is pressed for: 0 second(s)reset button pressed! 1 second(s)
RESET button was pressed for 1 seconds
HTTP server is starting for firmware update...
raspi_read: from:40028 len:6
NetTxPacket = 0x83FE7000
NetRxPackets[0] = 0x83FE7600
NetRxPackets[1] = 0x83FE7C00
NetRxPackets[2] = 0x83FE8200
NetRxPackets[3] = 0x83FE8800
NetRxPackets[4] = 0x83FE8E00
NetRxPackets[5] = 0x83FE9400
NetRxPackets[6] = 0x83FE9A00
NetRxPackets[7] = 0x83FEA000
NetRxPackets[8] = 0x83FEA600
NetRxPackets[9] = 0x83FEAC00
NetRxPackets[10] = 0x83FEB200
NetRxPackets[11] = 0x83FEB800
NetRxPackets[12] = 0x83FEBE00
NetRxPackets[13] = 0x83FEC400
NetRxPackets[14] = 0x83FECA00
NetRxPackets[15] = 0x83FED000
NetRxPackets[16] = 0x83FED600
NetRxPackets[17] = 0x83FEDC00
NetRxPackets[18] = 0x83FEE200
NetRxPackets[19] = 0x83FEE800
NetRxPackets[20] = 0x83FEEE00
NetRxPackets[21] = 0x83FEF400
NetRxPackets[22] = 0x83FEFA00
NetRxPackets[23] = 0x83FF0000
KSEG1ADDR(NetTxPacket) = 0xA3FE7000
NetLoopHttpd,call eth_halt !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
ETH_STATE_ACTIVE!!
HTTP server is starting at IP: 192.168.0.111
HTTP server is ready!
Request for: /
Request for: /style.css
Request for: /favicon.ico
## Error: file not found!
Data will be downloaded at 0x81000000 in RAM
Upgrade type: firmware
Upload file size: 3670020 bytes
Loading: #######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######################################
#######
HTTP upload is done! Upgrading...
****************************
* FIRMWARE UPGRADING *
* DO NOT POWER OFF DEVICE! *
****************************
raspi_erase_write: offs:50000, count:380004
raspi_erase: offs:50000 len:380000
........................................................
raspi_write: 81000000 to:50000 len:380000
........................................................
raspi_read: from:50000 len:10000
raspi_read: from:60000 len:10000
raspi_read: from:70000 len:10000
raspi_read: from:80000 len:10000
raspi_read: from:90000 len:10000
raspi_read: from:a0000 len:10000
raspi_read: from:b0000 len:10000
raspi_read: from:c0000 len:10000
raspi_read: from:d0000 len:10000
raspi_read: from:e0000 len:10000
raspi_read: from:f0000 len:10000
raspi_read: from:100000 len:10000
raspi_read: from:110000 len:10000
raspi_read: from:120000 len:10000
raspi_read: from:130000 len:10000
raspi_read: from:140000 len:10000
raspi_read: from:150000 len:10000
raspi_read: from:160000 len:10000
raspi_read: from:170000 len:10000
raspi_read: from:180000 len:10000
raspi_read: from:190000 len:10000
raspi_read: from:1a0000 len:10000
raspi_read: from:1b0000 len:10000
raspi_read: from:1c0000 len:10000
raspi_read: from:1d0000 len:10000
raspi_read: from:1e0000 len:10000
raspi_read: from:1f0000 len:10000
raspi_read: from:200000 len:10000
raspi_read: from:210000 len:10000
raspi_read: from:220000 len:10000
raspi_read: from:230000 len:10000
raspi_read: from:240000 len:10000
raspi_read: from:250000 len:10000
raspi_read: from:260000 len:10000
raspi_read: from:270000 len:10000
raspi_read: from:280000 len:10000
raspi_read: from:290000 len:10000
raspi_read: from:2a0000 len:10000
raspi_read: from:2b0000 len:10000
raspi_read: from:2c0000 len:10000
raspi_read: from:2d0000 len:10000
raspi_read: from:2e0000 len:10000
raspi_read: from:2f0000 len:10000
raspi_read: from:300000 len:10000
raspi_read: from:310000 len:10000
raspi_read: from:320000 len:10000
raspi_read: from:330000 len:10000
raspi_read: from:340000 len:10000
raspi_read: from:350000 len:10000
raspi_read: from:360000 len:10000
raspi_read: from:370000 len:10000
raspi_read: from:380000 len:10000
raspi_read: from:390000 len:10000
raspi_read: from:3a0000 len:10000
raspi_read: from:3b0000 len:10000
raspi_read: from:3c0000 len:10000
raspi_read: from:3d0000 len:10000
raspi_erase: offs:3d0000 len:10000
.
raspi_write: 83f711f0 to:3d0000 len:10000
.
raspi_read: from:3d0000 len:10000
Done!
HTTP ugrade is done! Rebooting...
(Last edited by saturn-b on 19 Jan 2015, 04:45)
rambler wrote:roger_ wrote:I was looking for a guide specific to the WT3020 though, and I haven't been able to find proper download of the latest U-boot.
The site that you mentioned contains a link to download a bootloader u-boot-nexx-3020-7620.bin (there's however no mention of the origins of this "alternative" bootloader). The site also contains instructions for flashing it from the _stock_ firmware. But you already have OpenWRT, where mtd0 is write protected. You could probably revert to stock in order to flash the bootloader, and then back to OpenWRT. (Please note that I don't have this device, so what I suggest is pure theory.)
Thanks, I had found that but I was hoping to find where that U-boot was developed to make sure it was the latest one and that I wasn't missing any gotchas or anything.
This U-boot mod is developed by hackpascal and he posted on a chinese forum:
http://www.right.com.cn/forum/thread-150908-1-1.html
DL: http://pan.baidu.com/s/1bnkzwAz
The Nexx WT3020 using GPIO#1, so you can try "u-boot-mt7620-public-reset1.bin"
This U-boot mod is developed by hackpascal and he posted on a chinese forum:
http://www.right.com.cn/forum/thread-150908-1-1.html
DL: http://pan.baidu.com/s/1bnkzwAzThe Nexx WT3020 using GPIO#1, so you can try "u-boot-mt7620-public-reset1.bin"
This modification is based on my work (GPL, link in my footer).
Just look on the page for firmware update - it's mine design.
Do you know when we can expect public availability of the sources?
This guy ("hackpascal") is stealing my work, Atheros work, TP-Link work, MediaTek/Ralink work etc., etc.
U-Boot project is licensed under GPL. All mentioned above manufacturers provide sources for their modified U-Boot sources.
LazyZhu wrote:This U-boot mod is developed by hackpascal and he posted on a chinese forum:
http://www.right.com.cn/forum/thread-150908-1-1.html
DL: http://pan.baidu.com/s/1bnkzwAzThe Nexx WT3020 using GPIO#1, so you can try "u-boot-mt7620-public-reset1.bin"
This modification is based on my work (GPL, link in my footer).
Just look on the page for firmware update - it's mine design.Do you know when we can expect public availability of the sources?
This guy ("hackpascal") is stealing my work, Atheros work, TP-Link work, MediaTek/Ralink work etc., etc.U-Boot project is licensed under GPL. All mentioned above manufacturers provide sources for their modified U-Boot sources.
I asked this question here:
http://www.right.com.cn/Forum/forum.php … pid=847018
He openly declared he only use the UI design, and not provided source.
You can contact him with hackpascal <at> gmail.com for more detail.
pepe2k wrote:LazyZhu wrote:This U-boot mod is developed by hackpascal and he posted on a chinese forum:
http://www.right.com.cn/forum/thread-150908-1-1.html
DL: http://pan.baidu.com/s/1bnkzwAzThe Nexx WT3020 using GPIO#1, so you can try "u-boot-mt7620-public-reset1.bin"
This modification is based on my work (GPL, link in my footer).
Just look on the page for firmware update - it's mine design.Do you know when we can expect public availability of the sources?
This guy ("hackpascal") is stealing my work, Atheros work, TP-Link work, MediaTek/Ralink work etc., etc.U-Boot project is licensed under GPL. All mentioned above manufacturers provide sources for their modified U-Boot sources.
I asked this question here:
http://www.right.com.cn/Forum/forum.php … pid=847018
He openly declared he only use the UI design, and not provided source.
Nope, it's not only UI design. He took my sources and my work. Almost all output from serial console during web upgrade came from my project.
So he stole my work... did he wrote U-Boot from scratch or stole it too? 
Your question is almost year old...
You can contact him with hackpascal <at> gmail.com for more detail.
OK, I will politely ask him for sources last time and then I will contact directly with authors of software which licenses he is violating.
That guy simply doesn't understand and violating GPL license terms. He can't publicly provide binaries WITHOUT source codes! If he want to make modification and use them privately... no problem.
I hate that kind of stupid people.
The following worked just without any problem on my wt3020f (8mb).
Download the following archive:
https://mega.co.nz/#!jdRECSxA!tq4kk0zHI … svxoP9gYe4
unzip it and check it:
$ md5sum u-boot-nexx-3020-7620.bin
9002d70c8af2ca878df956934b122a39 u-boot-nexx-3020-7620.bin
offer it via http, so it can be downloaded from the router
$ python -m SimpleHTTPServer
directly connect the router via the lan port to your computer.
$ sudo ifconfig eth0 192.168.8.5
$ telnet 192.168.8.1 (login: nexxadmin pass: y1n2inc.com0755 )
# cd /tmp/
# wget http://192.168.8.5:8000/u-boot-nexx-3020-7620.bin
// proceed only, if you successfully downloaded the new uboot file
# mtd_write unlock mtd0
GetFileSize: No such file or directory
Unlocking mtd0 ...
# mtd_write erase mtd0
GetFileSize: No such file or directory
Unlocking mtd0 ...
Erasing mtd0 ...
Erase char is 255
# mtd_write -r write u-boot-nexx-3020-7620.bin mtd0
Unlocking mtd0 ...
Writing from u-boot-nexx-3020-7620.bin to mtd0 ... [w]
it hangs now, just wait another minute and then power it down and start it up again
To check if the new uboot works, press and hold reset-button, then connect power.
Once the led flashes several times, you can release the reset button.
$ sudo ifconfig eth0 192.168.1.5
On http://192.168.1.1 is the uboot-webinterface
download https://downloads.openwrt.org/snapshots … pgrade.bin
and upgrade it directly from uboot. (Firmware Upgrade -> generic firmware -> firmware)
after a reboot:
$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
=== IMPORTANT ============================
Use 'passwd' to set your login password
this will disable telnet and enable SSH
------------------------------------------
BusyBox v1.22.1 (2015-03-06 13:37:14 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.
(Last edited by malfi on 17 Apr 2015, 15:59)
Does anyone have a link to the stock firmware for the WT3020?
Attention, failsafe is broken in WT3020 - https://dev.openwrt.org/ticket/18768
Maybe someone in this thread has the knowledge to fix it? I suspect that TCP connections are not working when VLAN is disabled just like on other MediaTek/Ralink chipsets.
not exactly, just take a look at 07_set_preinit_iface_ramips file in /lib/preinit/.
i think you will notice what's wrong here.
hint, two possible solutions(don't remember which is okay):
1)
swconfig dev mt7620 set enable_vlan 1
swconfig dev mt7620 vlan 1 set ports "0 6"
swconfig dev mt7620 port 6 set untag 0
swconfig dev mt7620 set apply 1
vconfig add eth0 1
ifconfig eth0 up
2)
swconfig dev mt7620 set enable_vlan 2
swconfig dev mt7620 vlan 2 set ports "1 2 3 4 5 6"
swconfig dev mt7620 port 6 set untag 0
swconfig dev mt7620 set apply 1
vconfig add eth0 2
ifconfig eth0 up
I too am looking for the stock firmware for WT3020F
I've noticed that there's a new u-boot called "Breed" by this Chinese guy -- anyone try it?
blog.hackru.ru
yes, i tested it, obviously 
works perfectly, but without english language in web-interface. google chrome's internal translator works well.
(Last edited by hackru on 6 Jun 2015, 21:04)
Ah, cool I didn't even realize whose site it was haha.
I just found what I think might be an English version for the WT3020, can you confirm anything (my Russian is bad 
): http://mysku.ru/blog/china-stores/31557 … ment912788
Also any idea why the file size is 128KB, compared to official version (which is 77KB)?
(Last edited by roger_ on 6 Jun 2015, 21:08)
it's my article and my comment i padded file with 0xFF(as i explained in my blog - http://blog.hackru.ru/2015/04/pad-file- … xff.html), because previous uboot was complaining about loader size, expecting 128kb file.
about english version - nope, it's just screenshot from my screen, translated with google chrome from chinese.
Thanks hackru, makes sense!
BTW I finally got around to upgrading the U-Boot on a factory WT3020 based on malfi's instructions above (also on the wiki) and had some issues. The actual U-Boot installation went fine, but I couldn't get OpenWrt to boot after flashing it from the U-Boot recovery console webpage (note that you have to use the sysupgrade firmware, not the factory one).
I fixed it by upgrading to the Breed bootloader (again, from the recovery console). I used breed-mt7620-reset1_128k.bin from 2015/4, which was pre-padded. After the upgrade the router booted straight into the OpenWrt installation that wouldn't boot before!
I then upgraded to the latest Breed (breed-mt7620-reset1.bin, build r623, non-padded) from http://breed.hackpascal.net and all seems fine still. Turns out that upgrading to this one directly (skipping breed-mt7620-reset1_128k.bin) also works.
(Last edited by roger_ on 8 Jun 2015, 16:15)
Can someone point me to the stock firmware for the WT3020F (8M)? Their website (http://www.nexx.com.cn/index.php/home/page?p=222) only has the WT3020A (4M).
I did track down this: http://www.nexx.com.cn/download/NEXX_30 … pgrade.bin
But I may be flashing it wrong (from LuCI) because it says wrong format.
(Last edited by roger_ on 7 Jun 2015, 22:44)
(Last edited by saturn-b on 8 Jun 2015, 08:10)