MZK-WNHでOpenWrt trunkを使ってみる

未だに安価に入手できるMZK-WNHでOpenWrt trunkを動かしてみました。
MZK-WNHはRT3050Fを使った11nルータです。
FreeBSDやNetBSDも動かせるとか噂のあるルータでもあるので、ハック用にはちょうど良いのではないでしょうか。ワンコインで入手できてしまう状態なので文鎮化も怖くないですね。


OpenWrt trunkを焼く場合は、基本シリアルを出してu-bootから焼いてください。
純正ファームの管理画面から焼いた場合、Edimaxヘッダーの20バイトの罠に嵌ります。
このEdimaxヘッダー20バイトの罠については別途メモしておきますが、MZK-WNHの元になっていると思われるEdimax BR-6424N V2の仕様がかなり不思議仕様なのである。
結構面倒なので、純正ファームから直接書き換える為のバイナリは公開する予定。

シリアルでu-bootにアクセスして書き込む場合は、このEdimaxヘッダー20バイトの罠を踏まずに済むので心配はありません。
開封時に爪を折らないよう様に注意するぐらいでしょうか。
保存状態にもよりますが折れやすい状況の事が多々あります。


あとは半田で埋められてしまっているシリアルのパターンから半田を吸い出す地道な作業。
結構面倒なので、純正ファームから直接書き換える為のバイナリは公開する予定。
シリアルは写真の上側から順番に、3.3V、RX、GND、TXです。


焼くファームは、MZK-W300NHのファームで問題ありません。
OpenWrtでは、MZK-WNHもMZK-W300NHも同じもので動作します。
/proc/cpuinfoにMZK-WNHってでなきゃ嫌だとか、Luciの画面にMZK-WNHってでなきゃ嫌だとかいう方は以下パッチを利用してみてください。
さすがにパッチを投稿する気はありません。（既に消えゆくデバイスですし。。。）
ビルド済みイメージは容量節約のためにppp系を削除、デバッグ系情報けしたり、セキュリティオプション系削ってます。あくまで試し用と考えてください。
※毎度の事でくどいですが、日本国内での利用を想定したものではありません。利用は自己責任でお願い致します。

仕様感は、Luciは重いのでCUIのみにして遅い無線用のAPとして使うのが一番ありなのかなぁといった処です。
11acのルータ使ってるのに、11aとか11gの端末が繋がってしまってるとかありませんか？


r46741で作成したMZK-WNHの名前付けのパッチとバイナリです。
r46741_mzk-wnh.patch
openwrt-ramips-rt305x-mzk-wnh-squashfs-sysupgrade.bin
openwrt-ramips-rt305x-mzk-w300nh2-squashfs-sysupgrade.bin




OpenWrt化されたMZK-WNHのログを貼っておきますね。

U-Boot 1.1.3 (Nov  7 2008 - 13:35:55)

Board: Ralink APSoC DRAM:  16 MB
relocate_code Pointer at: 80fa8000
****************************
Init GPIO Pin****************************
flash_protect ON: from 0xBFC00000 to 0xBFC26213
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBFC30000 to 0xBFC3FFFF
protect on 10
============================================
Ralink UBoot Version: 3.1
--------------------------------------------
ASIC 3052_MP1 (MAC to GigaMAC Mode)
DRAM COMPONENT: 256Mbits
DRAM BUS: 16BIT
Total memory: 32 MBytes
Flash: 4 MBytes
Date:Nov  7 2008  Time:13:35:55
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384

 ##### The CPU freq = 320 MHZ ####

SDRAM bus set to 16 bit
 SDRAM size =16 Mbytes

Please choose the operation:
   0: Load ucos code to SDRAM via TFTP Client.
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.
 0

3: System Boot system code via Flash.
## Booting image at bfc50000 ...
   Image Name:   MIPS OpenWrt Linux-3.18.20
   Created:      2015-08-28  18:04:21 UTC

 System Control Status = 0x21000000
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    987708 Bytes = 964.6 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 16

Starting kernel ...

[    0.000000] Linux version 3.18.20 (dev@mt7620) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46741) ) #3 Sat Aug 29 02:52:44 JST 2015
[    0.000000] SoC Type: Ralink RT3052 id:1 rev:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001964c (MIPS 24KEc)
[    0.000000] MIPS: machine is Planex MZK-WNH
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 01000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x00ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x00ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x00ffffff]
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 64 (order: -4, 256 bytes)
[    0.000000] Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Writing ErrCtl register=0007320c
[    0.000000] Readback ErrCtl register=0007320c
[    0.000000] Memory: 13052K/16384K available (2370K kernel code, 120K rwdata, 304K rodata, 140K init, 177K bss, 3332K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 320MHz
[    0.000000] clocksource_of_init: no matching clocksources found
[    0.000000] Calibrating delay loop... 212.58 BogoMIPS (lpj=1062912)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100000] pinctrl core: initialized pinctrl subsystem
[    0.110000] NET: Registered protocol family 16
[    0.160000] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.170000] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.180000] Switched to clocksource MIPS
[    0.190000] NET: Registered protocol family 2
[    0.200000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.210000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.220000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.240000] TCP: reno registered
[    0.240000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.250000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.270000] NET: Registered protocol family 1
[    0.280000] rt-timer 10000100.timer: maximum frequency is 6510Hz
[    0.290000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.330000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.340000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.390000] msgmni has been set to 25
[    0.400000] io scheduler noop registered
[    0.410000] io scheduler deadline registered (default)
[    0.420000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.430000] console [ttyS0] disabled
[    0.440000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 6666666) is a 16550A
[    0.460000] console [ttyS0] enabled
[    0.460000] console [ttyS0] enabled
[    0.470000] bootconsole [early0] disabled
[    0.470000] bootconsole [early0] disabled
[    0.490000] 1f000000.cfi: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a8
[    0.510000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.520000]   Amd/Fujitsu Extended Query version 1.1.
[    0.530000] number of CFI chips: 1
[    0.550000] 5 ofpart partitions found on MTD device 1f000000.cfi
[    0.560000] Creating 5 MTD partitions on "1f000000.cfi":
[    0.570000] 0x000000000000-0x000000030000 : "u-boot"
[    0.580000] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.590000] 0x000000040000-0x000000050000 : "factory"
[    0.610000] 0x0000003e0000-0x000000400000 : "cimage"
[    0.620000] 0x000000050000-0x0000003e0000 : "firmware"
[    0.640000] 2 uimage-fw partitions found on MTD device firmware
[    0.650000] 0x000000050000-0x00000014127c : "kernel"
[    0.670000] 0x00000014127c-0x0000003e0000 : "rootfs"
[    0.680000] mtd: device 6 (rootfs) set to be root filesystem
[    0.690000] 1 squashfs-split partitions found on MTD device rootfs
[    0.700000] 0x000000320000-0x0000003e0000 : "rootfs_data"
[    0.720000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5
[    0.740000] rt2880_wdt 10000120.watchdog: Initialized
[    0.750000] TCP: cubic registered
[    0.750000] NET: Registered protocol family 17
[    0.760000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    0.790000] 8021q: 802.1Q VLAN Support v1.8
[    0.820000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[    0.840000] Freeing unused kernel memory: 140K (802bd000 - 802e0000)
[    2.120000] init: Console is alive
[    2.130000] init: - watchdog -
[    4.190000] init: - preinit -
[    5.440000] 8021q: adding VLAN 0 to HW filter on device eth0
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    5.730000] random: procd urandom read with 9 bits of entropy available
[    9.090000] jffs2: notice: (272) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[    9.130000] mount_root: switching to jffs2 overlay
[    9.190000] procd: - early -
[    9.190000] procd: - watchdog -
[   10.190000] procd: - ubus -
[   11.210000] procd: - init -
Please press Enter to activate this console.
[   12.380000] Loading modules backported from Linux version master-2015-07-21-0-g47cd203
[   12.400000] Backport generated by backports.git backports-20150626-0-gc1a4168
[   12.420000] nf_conntrack version 0.5.0 (206 buckets, 824 max)
[   12.490000] xt_time: kernel timezone is -0000
[   12.540000] cfg80211: World regulatory domain updated:
[   12.550000] cfg80211:  DFS Master region: unset
[   12.560000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   12.580000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   12.600000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   12.620000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   12.630000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[   12.650000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   12.670000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   12.690000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   12.700000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   12.730000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   12.900000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 2872, rev 0200 detected
[   12.920000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0005 detected
[   24.900000] 8021q: adding VLAN 0 to HW filter on device eth0
[   24.920000] device eth0.1 entered promiscuous mode
[   24.930000] device eth0 entered promiscuous mode
[   24.980000] br-lan: port 1(eth0.1) entered forwarding state
[   24.990000] br-lan: port 1(eth0.1) entered forwarding state
[   25.000000] br-lan: received packet on eth0.1 with own address as source address
[   26.990000] br-lan: port 1(eth0.1) entered forwarding state
[   30.370000] device wlan0 entered promiscuous mode
[   31.230000] br-lan: port 2(wlan0) entered forwarding state
[   31.240000] br-lan: port 2(wlan0) entered forwarding state
[   33.240000] br-lan: port 2(wlan0) entered forwarding state
[   65.240000] random: nonblocking pool is initialized



BusyBox v1.23.2 (2015-08-29 02:22:22 JST) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER (Bleeding Edge, r46741)
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
root@OpenWrt:/#