Would it be possible to squeeze OpenWrt onto an Asus RP-N12

For Developers
1

No, I don't mean the RT-N12, I'm talking about the RP-N12 range extender / access point.

I opened it up and found these chips:

  • MediaTek MT7628NN
  • Winbond 25Q32JVSIQ
  • EtronTech EM6A9160TSC

Getting UART was trivially easy. I traced the header pins to the MediaTek, looked up the datasheet and figured out RX and TX. Boad rate is 115200.

U-Boot 1.1.3 (Mar 19 2015 - 14:00:57)

RP-N12 bootloader version: 1.0.0.1
Board: Ralink APSoC DRAM:  16 MB
ASUS RP-N12 gpio init : wps / reset pin
flash manufacture id: ef, device id 40 16
find flash: W25Q32BV
raspi_read: from:40035 len:1 
raspi_read: from:40036 len:1 
raspi_read: from:30000 len:1000 
Maximum malloc length: 1024 KBytes
mem_malloc_start/brk/end: 0x80eb3000/80eb5000/80fb4000
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 128 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 16 MBytes
Flash component: SPI Flash
Date:Mar 19 2015  Time:14:00:57
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
RESET MT7628 PHY!!!!!!
Please choose the operation: 
   0: Load System code then write to Flash via Serial. 
   1: Load System code to SDRAM via TFTP. 
   2: Load System code then write to Flash via TFTP. 
   3: Boot System code via Flash (default).
   4: Entr boot command line interface.
   5: Load Boot Loader code to SDRAM via Serial. 
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 1  0 
   
3: System Boot System code via Flash.
raspi_read: from:40230 len:4 

RP-N12 bootloader version: 1.0.0.1
raspi_read: from:40004 len:6 
MAC Address: 70:4D:7B:4E:D9:B0
raspi_read: from:40004 len:6 

## Checking 1st firmware at bc050000 ...
raspi_read: from:50000 len:40 
   Image Name:   
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2876316 Bytes =  2.7 MB
   Load Address: 80000000
   Entry Point:  8000c2f0
raspi_read: from:50040 len:2be39c 
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Giving linux ramsize: 16777216 (16 MB)

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.36 (root@asus) (gcc version 3.4.2) #1 Wed Apr 8 15:44:07 CST 2015

 The CPU feqenuce set to 575 MHz
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line: console=ttyS1,115200n8 root=/dev/mtdblock5
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=000677a5
Readback ErrCtl register=000677a5
Memory: 13732k/16384k available (1911k kernel code, 2652k reserved, 313k data, 132k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
Console: colour dummy device 80x25
console [ttyS1] enabled
Calibrating delay loop... 382.97 BogoMIPS (lpj=765952)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 26
io scheduler noop registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
flash manufacture id: ef, device id 40 16
W25Q32BV(ef 40160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x000000000000-0x000000400000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x00000010b3dc : "Kernel"
mtd: partition "Kernel" doesn't end on an erase block -- force read-only
0x00000010b3dc-0x000000800000 : "RootFS"
mtd: partition "RootFS" extends beyond the end of device "raspi" -- size truncated to 0x2f4c24
mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only
0x000000050000-0x000000800000 : "Kernel_RootFS"
mtd: partition "Kernel_RootFS" extends beyond the end of device "raspi" -- size truncated to 0x3b0000
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x43e17629
Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x43e17629
PROC INIT OK!
nf_conntrack version 0.5.0 (214 buckets, 856 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 132k freed
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Open pseudo device failed
Open pseudo device failed
Open pseudo device failed
/dev/gpio: No such file or directory
/dev/gpio: No such file or directory
devpts: called with bogus options
mount: mounting none on /proc/bus/usb failed: No such file or directory
offset 0x3000 elapse 4ms
[rc] main_loop: state= 2

---change mode from 2 to 3---

led_drv: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ASUS LED driver initialized
--- start to gen ralink AP config. ---
create_ifname
start_wlan
[track_set] ok: 607
ifconfig: SIOCSIFHWADDR: Operation not supported
efuse_probe: efuse = 10000012
tssi_1_target_pwr_g_band = 34
device ra0 entered promiscuous mode
start_lanRaeth v3.1 (
Tasklet)

phy_tx_ring = 0x00b0a000, tx_ring = 0xa0b0a000

phy_rx_ring0 = 0x00af2000, rx_ring0 = 0xa0af2000
GMAC1_MAC_ADRH -- : 0x0000704d
GMAC1_MAC_ADRL -- : 0x7b4ed9b0
RT305x_ESW: Link Status Changed
device eth2 entered promiscuous mode
br0: port 2(eth2) entering learning state
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
br0: port 1(ra0) entering learning state
Algorithmics/MIPS FPU Emulator v1.5
info, udhcp client (v0.9.8) started
br0: No such process
br0: port 2(eth2) entering forwarding state
br0: port 1(ra0) entering forwarding state
### Enable direct rule (C2D) ###
start_services
start_dnsmasq
[track_set] ok: 605
[track_set] ok: 606
[track_set] ok: 601
Set: phy[0].reg[0] = 3300


BusyBox v1.12.1 (2015-04-08 15:38:57 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# 
***** g_wl_interface = ra0 ******

info, Performing a DHCP renew, under state:0

But the specs of this thing are absolutely abysmal. I mean 16MBytes of RAM, 4MBytes of SPI flash...
Can you even fit a kernel image on there? Let's say you remove literally everything that isn't required for a dumb access point. Completely strip OpenWrt down. Don't need a firewall, don't need an DHCP server...

Now I do know that this MediaTek chip is supported in OpenWrt, so is there anything useful at all I can do with this thing? Would it perhaps be possible to replace the SPI flash with a bigger one?

2

According to the specs it doesn't even have 5GHz. I would not bother to spend so much time to strip down an image to bare essentials just to fit it in there. At the end of the day you'll have the same functionality with the stock firmware.

3

Well I was hoping that maybe I could get 802.11r. I don't think any stock Asus firmware, not even the expensive routers, support that. Now I don't actually know if 802.11r requires any hardware features, or if it's just a software feature of OpenWrt.

4

I did find a section on how to build an image for devices with only 4MB of flash. https://openwrt.org/docs/guide-user/additional-software/saving_space

Is it worth trying this? I don't mind bricking this device.

5

Game over.

--
4 MB flash is equally a disqualifier, but 16 MB RAM are the immediate death sentence. You'd have serious problems to even boot with 16 MB RAM, but as soon as the wireless drivers get loaded, it's OOM at the latest.

1 Like
6

It doesn't really need to do anything other than be a dumb access point. I guess LuCI isn't even required. No NAT, no DHCP server, no VPN, no firewall, no SQM, no DNS, no PPP, no routing.

7

I guess it would need to boot up without crashing (OOM)?

Not going to happen with 16 MB RAM.
Oh, you want wireless as well (in case in inexplicably did manage to boot), not at all with 16 MB RAM.

32 MB RAM are not enough for OpenWrt, although that might work with a limited feature set, halving that will not work at all.

1 Like
8

Yeah the original firmware uses Linux kernel 2.6, what is OpenWrt at now, 5.10?

9

Desolder the RAM and flash, replace with bigger ones? Not particularly difficult to do.

10

Flash? Probably. RAM? Eh I guess I could, I have a reflow station.
Etron has larger capacity chips in the same series https://www.etron.com/en/products/specialtydram_detial.php?Product_ID=2

11

Let's be reasonable for a minute, the used markets have supported devices with sufficient system specifications starting around 5-10 bucks...

I'm all for extending the life time of existing gear and teaching it new tricks, but there are limits in terms of economic viability and their medium term prospects. Yes, costs aside, you may be able to replace flash/ RAM, but that may entail adapting the OEM u-boot and will still require you to port OpenWrt to your device from scratch - in the end you'll pay around as much for single quantities of flash and RAM + shipping (much, much more if you'd also need to buy soldering tools, usb uart, spi-nor writer, etc.) than a fully functional second hand device would cost you, before still having to spend multiple weeks on the software side. This just doesn't make sense.

2 Likes
12

Eh, it depends. If one uses it as an excuse to learn how to port OpenWrt to a new device (with an already well supported SoC and as such not all the way from scratch) and how to compile upstream uboot for it, it can teach a ton. For practical uses, though, no, I fully agree.

Me, I'm screwed up in the head enough to do this kind of stuff just as an exercise and for fun :slight_smile:

13

I'd be all with you, if we were talking about a device where this would make practical sense. and in the mid- to late (20)00s there simply were no better devices. But even after extending this device to 8/64, it would still be the bottom of the barrel with fragile rt2x00 wireless, 100 MBit/s ethernet, single-band 802.11n, 7 years old and easily replaced by a sub-10-bucks device that can actually deliver (e.g. tl-wdr3600, which I wouldn't buy in 2022 either, but it's cheap, abundantly common on the second hand market, easy to flash, dual-band 802.11n and 8/128; to be clear, there are better options on the second hand market, but I'd define this as a sensible minimum base line).

14

nerd

You're hurting the poor device's feelings!

15

An thus the e-waste cycle continues.
I understand that you can buy something way better for next to nothing. It's not that I'm unable to get anything better. It's just a shame that this thing is effectively useless now.

16

Yours at least has 16MB memory, and I have one router on my hand with the same chip and no external memory (this 7628N chip has a design of built-in 8MB) and 1MB ROM. That is an 1+8 marvelous router!
Of course it cannot run Liunx-based firmware, it is vxworks that can fit onto an 1MB ROM. :crazy_face: