Netgear WAX202 WiFi 6 $30 at Amazon

Hardware Questions and Recommendations
21

Do you need the fw_env.config from a WAX202 running OpenWrt? (I haven't flashed mine yet)

There's a fw_env.config nestled in the Netgear GPL source listed in the commit message - don't know if that's helpful.

Pasted in its entirety (/bootloader/u-boot-mt7621-2018.09-gitb178829-20200526/tools/env/fw_env.config):

# Configuration file for fw_(printenv/setenv) utility.
# Up to two entries are valid, in this case the redundant
# environment sector is assumed present.
# Notice, that the "Number of sectors" is not required on NOR and SPI-dataflash.
# Futhermore, if the Flash sector size is omitted, this value is assumed to
# be the same as the Environment size, which is valid for NOR and SPI-dataflash
# Device offset must be prefixed with 0x to be parsed as a hexadecimal value.

# NOR example
# MTD device name	Device offset	Env. size	Flash sector size	Number of sectors
/dev/mtd1		0x0000		0x4000		0x4000
/dev/mtd2		0x0000		0x4000		0x4000

# MTD SPI-dataflash example
# MTD device name	Device offset	Env. size	Flash sector size	Number of sectors
#/dev/mtd5		0x4200		0x4200
#/dev/mtd6		0x4200		0x4200

# NAND example
#/dev/mtd0		0x4000		0x4000		0x20000			2

# On a block device a negative offset is treated as a backwards offset from the
# end of the device/partition, rather than a forwards offset from the start.

# Block device example
#/dev/mmcblk0		0xc0000		0x20000
#/dev/mmcblk0		-0x20000	0x20000

# VFAT example
#/boot/uboot.env	0x0000          0x4000

# UBI volume
#/dev/ubi0_0		0x0		0x1f000		0x1f000
#/dev/ubi0_1		0x0		0x1f000		0x1f000

# UBI volume by name
#/dev/ubi0:env		0x0		0x1f000		0x1f000
#/dev/ubi0:env-redund	0x0		0x1f000		0x1f000
1 Like
22

@Ansuel No sorry :frowning:. Does that mean it's broken in master as well?

@edwrap Can you copy the contents of mtd1 (which I assume could be the u-boot environment settings but it might as well be not) and check the contents with strings? 512 KiB might be a bit big maybe, but it's worth a try. Going by the DTS in OpenWrt there's nothing that immediately pops out as a u-boot config.

With a bit of luck you can run strings from the OEM firmware even. This is what e.g my switch (on OpenWrt) prints:


# strings /dev/mtd1
baudrate=115200
boardmodel=ZyXEL_GS1900_10HP
bootargs=console=ttyS0,115200 mem=64M quiet
bootcmd=cst fcTest; boota
bootdelay=0
ethact=rtl8380#0
ethaddr=xx:xx:xx:xx:xx:xx
ipaddr=192.168.1.1
netmask=255.255.255.0
serverip=192.168.1.111
stderr=serial
stdin=serial
stdout=serial
23

We need to find values that makes fw_printenv correctly output uboot config. The partition label is Config.

1 Like
24

Which should be /dev/mtd1 on the WAX202 :slight_smile:.

25

No luck with SSH in the OEM firmware, unsurprisingly. I wasn't planning on flashing my WAX202 at the moment, as I don't have a backup router in case things go awry, but I can give it a go this weekend if nobody else can help with this.

@Ansuel What's the consequence of this config being missing?

26

an error on such command use and in general having a device with some missing values...
Finding the right values for fw_env.econfig is very easy and safe... Someone can even brute force the values on the partition until the command runs and print values :smiley:

1 Like
27 
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "Bootloader"
mtd1: 00080000 00020000 "Config"
mtd2: 00080000 00020000 "Factory"
mtd3: 02600000 00020000 "firmware"
mtd4: 00400000 00020000 "kernel"
mtd5: 02200000 00020000 "ubi"
mtd6: 02600000 00020000 "firmware_backup"
mtd7: 00800000 00020000 "CFG"
mtd8: 00400000 00020000 "RAE"
mtd9: 00100000 00020000 "POT"
mtd10: 00400000 00020000 "Language"
mtd11: 00200000 00020000 "Traffic"
mtd12: 00100000 00020000 "Cert"
mtd13: 00100000 00020000 "NTGRcryptK"
mtd14: 00500000 00020000 "NTGRcryptD"
mtd15: 00100000 00020000 "LOG"
mtd16: 00640000 00020000 "User_data"

That's mtd1:

��baudrate=115200boot_nmrp_clr_str_blks=nand erase.spread ${stringtableoffset} ${stringtablefreesize}boot_nmrp_wr_str=mtkupgrade strboot_version=20210408boot_wr_img=writeimgbootcmd=mtkautobootbootdelay=0ethaddr=34:98:B5:0F:B0:6Ffenv_factory=offfenv_model=WAX202fenv_region=EUinvaild_env=noipaddr=192.168.1.1netmask=255.255.255.0serverip=192.168.1.2Ifactory_mode=offpcba_sn=241B0C890E35region=EUmodel=WAX202axmodel=AX1800mac=3498B50FB06Fsn=6MT31BDF51655ssid=NETGEAR0FB06Fpassphrase=niftycomet822hardware=V1default_region=EU

root@OpenWrt:~# strings /dev/mtd1
baudrate=115200
boot_nmrp_clr_str_blks=nand erase.spread ${stringtableoffset} ${stringtablefreesize}
boot_nmrp_wr_str=mtkupgrade str
boot_version=20210408
boot_wr_img=writeimg
bootcmd=mtkautoboot
bootdelay=0
ethaddr=34:98:B5:0F:B0:6F
fenv_factory=off
fenv_model=WAX202
fenv_region=EU
invaild_env=no
ipaddr=192.168.1.1
netmask=255.255.255.0
serverip=192.168.1.2
factory_mode=off
pcba_sn=241B0C890E35
region=EU
model=WAX202
axmodel=AX1800
mac=3498B50FB06F
sn=6MT31BDF51655
ssid=NETGEAR0FB06F
passphrase=niftycomet822
hardware=V1
default_region=EU

http://0x0.st/ojP6.backup

sha256sum: 03da6c8ea975ae70df9389eeba43796cffa0a9f603f8263e8629961babdb8cbd

2 Likes
28

@TomH Could you install uboot-envtools, then add this to /etc/fw_env.config and run fw_printenv afterwards?

/dev/mtd1 0x0 0x80000 0x80000

P.S. I'd redact your MAC address and serial.

29

@Borromini

root@OpenWrt:~# cat /etc/fw_env.config
/dev/mtd1 0x0 0x80000 0x80000
root@OpenWrt:~# fw_printenv
Warning: Bad CRC, using default environment
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
baudrate=115200
root@OpenWrt:~#

In the case of this device it doesn't really matter. At least the mac will be public anyway.

2 Likes
30

Weird, the DTS says the Config partition starts at 0x80000, must be doing something wrong there...

31

@TomH Can you modify /etc/fw_env.config as follows?

/dev/mtd1 0x0 0x4000 0x20000 2

And check if fw_printenv works? I'm taking cues from the file @edwrap posted but I'm not familiar with NAND, so this might not work either (but it should not break anything either, as @Ansuel indicated). You're reading, not writing.

32

nope, looks the same :frowning:

root@OpenWrt:~# cat /etc/fw_env.config
/dev/mtd1 0x0 0x4000 0x20000 2
root@OpenWrt:~# fw_printenv
Warning: Bad CRC, using default environment
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
baudrate=115200
33

Out of ideas then, we'll have to wait for someone with a better grasp of this :frowning:.

34

the bad CRC error is just that nobody ever mod the config values so it's not an error... the fact that the same result works with 2 different values... we need to find the right one just to make sure we don't destroy the env on a write.

2 Likes
35

The case of mine is still open and I already soldered pins to the UART interface. If there is anyhting i can do you just need to say so. My problem is unfortunately just that I lack the knowledge how to get the correct values.
If it helps I could also connect network and serial to another system and make it reachable via ssh.

1 Like
36

Hello, im new to openwrt and i ordered this router because i saw the open pull request for adding support to it like a week ago, ive been curious, is all i need to do to install it just use the factory os on the router to install netgear_wax202-squashfs-factory.img on it as an update? Is everything more or less safe to use, just have to install luci through ssh? i assume i will be able to ssh to the router when i flash openwrt on it. Thanks in advance, and sorry if its a noob question :slight_smile:

37

The commit contains the flashing instructions. Tip for future purchases: the commit adding support always contains flashing instructions. It's mandatory for new devices gaining support, has been for a while.

1 Like
38

Oooh, alright, thanks for the info! Just wanted to make sure so i dont brick my new router!

1 Like
39

@TomH Mind trying the following?

/dev/mtd1 0x80000 0x20000 0x20000 1

I followed this guide and used the values from mt7621_nand.h, which also corresponds to the cat /proc/mtd output you posted earlier. :crossed_fingers:

1 Like
40 
root@OpenWrt:~# cat /etc/fw_env.config
/dev/mtd1 0x80000 0x20000 0x20000 1
root@OpenWrt:~# fw_printenv
Cannot read bad block mark: Invalid argument
root@OpenWrt:~#

At least those values result in a different output :sweat_smile:

@edwrap If you have any other variations feel free to let me try them :slight_smile:

1 Like