Nradio C2000 - anybody seen these yet?

rjadams82 · February 13, 2024, 10:20pm

Found these nice looking routers on ebay/amz shipped with an EC25AF CAT4 modem on miniPCIe. Clean look with no external antennas which is rare for a wifi & LTE & ethernet device. They do have UMCC connections on the PCB. There is no USB A port. Unsure if the USB-C carries data or just for power.

I scoured the forum/google but didnt find any info on them. According to the mfr website (https://www.nradiowifi.net/article/6.html) the founder was some former project manager at TPLINK.

Anyways I grabbed an nradio C2000 model <$40usd & decided to dig in to see whats up.

It does run openwrt but with custom build, stripped down LUCI and ssh disabled. I was able to get some specs from digging through backup archive & firmware image.

config system 'board'
	option ptype 'rt'
	option id 'FC:83:C6:05:DB:28'
	option pname 'C2000-450'
	option vendor 'nradio'
	option name 'WT6509'
	option keep '1'

DISTRIB_ID='LEDE'
DISTRIB_RELEASE='17.01-SNAPSHOT'
DISTRIB_REVISION='1.9.1.n6.c8'
DISTRIB_CODENAME='reboot'
DISTRIB_TARGET='ramips/mt7628'
DISTRIB_ARCH='mipsel_24kc'
DISTRIB_DESCRIPTION='LEDE Reboot 17.01-SNAPSHOT 1.9.1.n6.c8'

Still having a hard time determining RAM/FLASH. Going to see if I have a jtag somewhere to get connected to console.

If anyone has tips or recognizes these please chime in. I have not done near enough debugging custom build work so I'm learning as I go.

rjadams82 · February 13, 2024, 10:22pm

rjadams82 · February 13, 2024, 10:22pm

johnsmith31 · February 13, 2024, 10:36pm

Nice initial write-up & photos. Encouraging that the unit is already running a knee-capped fork of OpenWRT, seems likely it shouldn't be too hard to figure out how to flash it to the full, non-proprietary mainline OpenWRT.

rjadams82 · February 13, 2024, 10:47pm

(https://fccid.io/2ATDI-C2000)

(https://device.report/nradio/c2000)

(https://electric.garden/nradio-2atdi/dual-band-4g-lte-router-c2000)

stragies · February 14, 2024, 12:03am

JP1 looks like a prepopulated 4 pin UART header

frollic · February 14, 2024, 7:44am

RAM is a Winbond 1gbit W971GG6NB-25, that's 128MB.

Hopefully the flash chip is 16MB or more.

pic from https://youtu.be/M5R2IPaAymM?t=295

rjadams82 · February 25, 2024, 3:40am

UART Pinout

Heres the bootup output.

[05000C08][05000C0B]
DDR Calibration DQS reg = 00008988


U-Boot 1.1.3 (Dec 27 2022 - 16:34:54)

Board: Ralink APSoC DRAM:  128 MB
mtest end addr: 87f4df88
relocate_code Pointer at: 87fb0000
flash manufacture id: c8, device id 40 18 40185555
find flash: GD25Q128C
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 5.0.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 1024 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: SPI Flash
Date:Dec 27 2022  Time:16:34:54
============================================ 
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =128 Mbytes
RESET MT7628 PHY!!! 0 
   
3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   HCMT7628
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1278232 Bytes =  1.2 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 128

Starting kernel ...

[    0.000000] Linux version 4.4.157 (jenkins@f2602813649f) (gcc version 5.4.0 (LEDE GCC 5.4.0 1.8.2.n0.c0) ) #0 Tue Dec 27 08:27:30 2022
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is HC-WT6509
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=0003fbe1
[    0.000000] Readback ErrCtl register=0003fbe1
[    0.000000] Memory: 125636K/131072K available (2952K kernel code, 136K rwdata, 704K rodata, 168K init, 199K bss, 5436K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 575MHz
[    0.000000] clocksource_probe: no matching clocksources found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6647862422 ns
[    0.000010] sched_clock: 32 bits at 287MHz, resolution 3ns, wraps every 7469508094ns
[    0.007525] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[    0.069996] pid_max: default: 32768 minimum: 301
[    0.074578] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080915] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093710] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.103202] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.109209] pinctrl core: initialized pinctrl subsystem
[    0.114956] NET: Registered protocol family 16
[    0.223345] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[    0.377999] PCI host bridge /pcie@10140000 ranges:
[    0.382575]  MEM 0x0000000020000000..0x000000002fffffff
[    0.387599]   IO 0x0000000010160000..0x000000001016ffff
[    0.406651] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.412123] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.417596] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.423654] PCI host bridge to bus 0000:00
[    0.427601] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.434185] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.439906] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.446450] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.454565] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.462940] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.469316] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.475994] pci 0000:00:00.0: BAR 9: assigned [mem 0x20000000-0x201fffff pref]
[    0.482972] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.489525] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    0.497019] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    0.504484] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    0.511965] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.516735] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff pref]
[    0.523724] pci 0000:00:00.0: card - bus=0x0, slot = 0x0 irq=0
[    0.529334] pci 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[    0.535926] clocksource: Switched to clocksource MIPS
[    0.542128] NET: Registered protocol family 2
[    0.547235] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.553926] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.560115] TCP: Hash tables configured (established 1024 bind 1024)
[    0.566312] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.571909] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.578270] NET: Registered protocol family 1
[    0.588563] Crashlog allocated RAM at address 0x3f00000
[    0.610782] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.616437] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.628878] io scheduler noop registered
[    0.632620] io scheduler deadline registered (default)
[    0.638559] gpio-export gpio_export: 3 gpio(s) exported
[    0.643767] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.651108] console [ttyS0] disabled
[    0.654543] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    0.663318] console [ttyS0] enabled
[    0.663318] console [ttyS0] enabled
[    0.670305] bootconsole [early0] disabled
[    0.670305] bootconsole [early0] disabled
[    0.679150] ralink_priv_init
[    0.682700] spi-mt7621 10000b00.spi: sys_freq: 191666666
[    0.692673] m25p80 spi32766.0: using chunked io (size=32)
[    0.698231] m25p80 spi32766.0: gd25q128 (16384 Kbytes)
[    0.703476] 6 ofpart partitions found on MTD device spi32766.0
[    0.709398] Creating 6 MTD partitions on "spi32766.0":
[    0.714610] 0x000000000000-0x000000030000 : "u-boot"
[    0.721460] 0x000000030000-0x000000040000 : "kpanic"
[    0.728437] 0x000000040000-0x000000050000 : "factory"
[    0.735391] 0x000000050000-0x000000fe0000 : "firmware"
[    0.792400] 2 uimage-fw partitions found on MTD device firmware
[    0.798445] 0x000000050000-0x000000190000 : "kernel"
[    0.805138] 0x000000190000-0x000000fe0000 : "rootfs"
[    0.812098] mtd: device 5 (rootfs) set to be root filesystem
[    0.818009] 1 squashfs-split partitions found on MTD device rootfs
[    0.824283] 0x000000b90000-0x000000fe0000 : "rootfs_data"
[    0.831681] 0x000000fe0000-0x000000ff0000 : "bdinfo"
[    0.913520] 0x000000ff0000-0x000001000000 : "reserve"
[    0.930168] rt3050-esw 10110000.esw: link changed 0x00
[    0.935970] mt7621_wdt 10000120.watchdog: Initialized
[    0.942533] NET: Registered protocol family 10
[    0.950787] NET: Registered protocol family 17
[    0.955387] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    0.968247] 8021q: 802.1Q VLAN Support v1.8
[    0.975891] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    0.992888] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.

rjadams82 · February 25, 2024, 4:29am

Ok reading through this I’m seeing

find flash: GD25Q128C
and
m25p80 spi32766.0: gd25q128 (16384 Kbytes)

So I’m assuming 16mb which seems to jive with the spec found on this SPI flash chip:

rjadams82 · February 25, 2024, 4:49am

hardware list so far

SoC: MediaTek MT7628AN
Winbond W971GG6NB-25 128MB DRAM
gd25q128 (16384 Kbytes) GigaDevice spi flash
rt3050-esw ralink embedded switch
mt7620-pci mediatek Router/802.11

ramips mt7628 mipsel_24kc

rjadams82 · August 6, 2024, 2:47pm

Decided to take another run at this.

Do subtargets/profiles have a specific hardware list? For instance I found a device page for this SOC, but it lists flash as 8MB where the device in question is 16MB.

https://openwrt.org/toh/hwdata/evaluation_boards/unbranded_boards/evaluation_boards_unbranded_boards_mediatek_mt7628an_eval_board

The toh for the dev board also doesnt have any net/wifi drivers probably because its an eval board so the particular hardware layout would be unknown. Does that mean the target source/kernel needs to be re-compiled to include the drivers that would be necessary for the specific device?

I'm trying to search the ramips target list and deviwiki/toh to see what other devices might share the same hardware set.

Trying to gauge how futile my efforts will be to flash this thing without bricking it.

frollic · August 6, 2024, 2:52pm

Don't blindly flash some random image, you'll soft brick your device, at best.

Start by stopping the boot loader, and load an initramfs (KERNEL) of a device sharing the same SoC.

https://firmware-selector.openwrt.org/?version=23.05.4&target=ramips%2Fmt76x8&id=mediatek_mt7628an-eval-board

If it boots, you can install the wifi packages required for wifi support (not that you really need them atm).

rjadams82 · August 7, 2024, 4:50am

so if i have a known working kernel to boot i can then try to get the subtarget/profile created/adjusted for the flash?

starting to understand the complexity of supporting uncommon devices. not even an uncommon soc but cant seem to find documentation on other devices that share the 128MB winbond flash.

frollic · August 7, 2024, 6:58am

doubt someone will assist you, except for holding your hand through the forum, and points out the mistakes you make along the way ...

I don't really see it as a very odd device.

don't think the git commits usually mention the flash chip, this stuff usually "just works".

NPeca75 · August 7, 2024, 7:35am

hi @rjadams82
first of all, you need to make your own DTS for this specific device
most important part is flash layout
then, boot initramfs image to RAM, and first !!! backup complete flash, and specialy 'factory' partition listed above

after this, you could start experimenting with rest of stuff

if you 'kill' factory, then your wifi calibration data is lost forever
edit: maybe it is in 'bdinfo' or in 'reserve' partitions

frollic · August 7, 2024, 7:41am

make a copy of them all ?

rjadams82 · August 9, 2024, 3:55pm

looking at flash layout fiddling with uboot and will try loading the initramfs. Added a device page to collect data. Appreciate the pointers.

https://openwrt.org/inbox/toh/evaluation_boards/unbranded_boards/c2000_mediatek_mt7628an