Netgear EX6120


 * • 867Mbps - 2SS 5GHz 802.11ac (80MHz chan.),
 * • 300Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = 1200 Mbps class



The product page for this device says that it is AC1200 while the support page says AC750.
 * The hardware supports AC1200 so we'll assume that's the true spec.

This model shares a design with the Netgear EX3700 but uses different RAM/Flash sources.

The Netgear EX6920 (PPage) appears to be a 2-pack of EX6120 devices.
 * It is advertised as AC1200.


 * "U12H319 801801 REV.0 GP" is silkscreened on the board in the FCC photos.
 * "U12H319T30 LF Z142000923-00S0" is printed on a sticker adhered to the board in the FCC photos.

Internally, the board is powered by 3.3V at 2.1A.


 * Web GUI: http://www.mywifiext.net

Boot Log
{{SCollapse|boot log EX3700 UBoot v1.0.3

U-Boot 1.1.3 (Nov 19 2014 - 22:45:38)

Board: Ralink APSoC DRAM: 64 MB RT2880_GPIOMODE_REG:0x1A311C RT2880_GPIOMODE_REG:0x1A351C Stack Pointer at: 83f52f98 relocate_code Pointer at: 83fb4000 enable ephy clock...done. rf reg 29 = 5 SSC disabled. spi_wait_nsec: 29 spi device id: c2 20 17 c2 20 (2017c220) find flash: MX25L6405D flash info: size=0x800000, sector_size=0x10000, n_sectors=0x80
 * Warning - bad CRC, using default environment

=
=============================== Ralink UBoot Version: 4.2.1.0 EX3700 UBoot Version: v1.0.3

ASIC 7620_MP (Port5<->None) DRAM component: 512 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 64 MBytes Flash component: SPI Flash Date:Nov 19 2014 Time:22:45:38

=
=============================== icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768

estimate memory size =64 Mbytes
 * 1) The CPU freq = 580 MHZ ####

Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 0

3: System Boot system code via Flash.

NetTxPacket = 0x83FE4CC0

KSEG1ADDR(NetTxPacket) = 0xA3FE4CC0

NetLoop,call eth_halt !

NetLoop,call eth_init ! Trying Eth0 (10/100-M)

Waitting for RX_DMA_BUSY status Start... done

ETH_STATE_ACTIVE!! LAN MAC: 3C:37:86:80:84:AA

[Listening] for ADVERTISE... T3T3T3 Retry count exceeded; boot the image as usual Image Name:  Linux Kernel Image Image Type:  MIPS Linux Kernel Image (lzma compressed) Data Size:   5777647 Bytes =  5.5 MB   Load Address: 80000000 Entry Point: 8000c310 Verifying Checksum ... OK  Uncompressing Kernel Image ... OK No initrd
 * 1) Booting image at bc050000 ...
 * 1) Transferring control to Linux (at address 8000c310) ...
 * 2) Giving linux memsize in MB, 64

Starting kernel ...

LINUX started...

THIS IS ASIC Linux version 2.6.36+ (rhaegar@sw-server-206) (gcc version 3.4.2) #103 Mon Oct 8 15:23:24 CST 2018

The CPU feqenuce set to 580 MHz

MIPS CPU sleep mode enabled. PCIE: bypass PCIe DLL. PCIE: Elastic buffer control: Addr:0x68 -> 0xB4 disable all power about PCIe CPU revision is: 00019650 (MIPS 24Kc) Software DMA cache coherency Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Zone PFN ranges: Normal  0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 console=ttyS0 PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT,, 4-waylinesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes Writing ErrCtl register=0007f670 Readback ErrCtl register=0007f670 Memory: 60900k/65536k available (2594k kernel code, 4636k reserved, 821k data, 156k init, 0k highmem) NR_IRQS:128 console [ttyS1] enabled Calibrating delay loop... 386.04 BogoMIPS (lpj=772096) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 NET: Registered protocol family 16 RALINK_GPIOMODE = 1a351c RALINK_GPIOMODE = 18351c PPLL_CFG1=0xe6c000 MT7620 PPLL lock PPLL_DRV =0x80080504 start PCIe register access RALINK_RSTCTRL = 2400000 RALINK_CLKCFG1 = 75afffc0

PCIE0 enabled init_rt2880pci done bio: create slab  at 0 vgaarb: loaded SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000) pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff] pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit] pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref] pci 0000:00:00.0: PCI bridge to [bus 01-01] pci 0000:00:00.0:  bridge window [io  disabled] pci 0000:00:00.0:  bridge window [mem 0x20000000-0x200fffff] pci 0000:00:00.0:  bridge window [mem 0x20100000-0x201fffff pref] BAR0 at slot 0 = 0 bus=0x0, slot = 0x0 res[0]->start = 0 res[0]->end = 0 res[1]->start = 20200000 res[1]->end = 2020ffff res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=0x1, slot = 0x0 res[0]->start = 20000000 res[0]->end = 200fffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 Switching to clocksource Ralink Systick timer NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 Load Ralink Timer0 Module Load Ralink Timer1 Module RT3xxx EHCI/OHCI init. squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 118 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered (default) RALINK_REG_GPIOMODE:0x18351C RALINK_REG_GPIOMODE:0x18351D Ralink gpio driver initialized Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A brd: module loaded deice id : c2 20 17 c2 20 (2017c220) MX25L6405D(c2 2017c220) (8192 Kbytes) mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536 Creating 19 MTD partitions on "raspi": 0x000000000000-0x000000800000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config" 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x00000017b92f : "Kernel" 0x00000017b92f-0x0000006d0000 : "RootFS" 0x000000050000-0x0000006d0000 : "Kernel_RootFS" 0x0000006d0000-0x0000006f0000 : "ML1" 0x0000006f0000-0x000000710000 : "ML2" 0x000000710000-0x000000730000 : "ML3" 0x000000730000-0x000000750000 : "ML4" 0x000000750000-0x000000770000 : "ML5" 0x000000770000-0x000000790000 : "ML6" 0x000000790000-0x0000007b0000 : "ML7" 0x0000007b0000-0x0000007c0000 : "T_Meter1" 0x0000007c0000-0x0000007d0000 : "T_Meter2" 0x0000007d0000-0x0000007e0000 : "POT" 0x0000007e0000-0x0000007f0000 : "board_data" 0x0000007f0000-0x000000800000 : "nvram" rdm_major = 253 SMACCR1 -- : 0x00003c37 SMACCR0 -- : 0x868084aa Ralink APSoC Ethernet Driver Initilization. v3.1 512 rx/tx descriptors allocated, mtu = 1500! SMACCR1 -- : 0x00003c37 SMACCR0 -- : 0x868084aa PROC INIT OK! PPP generic driver version 2.4.2 NET: Registered protocol family 24 [wifi_fwd_alloc_tbl] size of WiFiFwdBase = 600bytes [wifi_fwd_alloc_tbl] size of pkt_src = 1200bytes ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. MTK MSDC device init. mtk-sd: MediaTek MT6575 MSDC Driver GRE over IPv4 demultiplexor driver TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear  All bugs added by David S. Miller  msdc0 -> ops_get_cd return<0> <- msdc_ops_get_cd : L PID VFS: Mounted root (squashfs filesystem) readonly on device 31:5. Freeing unused kernel memory: 156k freed init started: BusyBox v1.12.1 (Algorithmics/MIPS FPU Emulator v1.5 ) starting pid 39, tty '': '/etc_ro/rcS' mount: mounting devpts on /dev/pts failed: No such file or directory mknod: /dev/pts/0: No such file or directory mknod: /dev/pts/1: No such file or directory mknod: /dev/pts/2: No such file or directory mknod: /dev/pts/3: No such file or directory Reading board data... WSC UUID: 0x92e26c321266836639907d8670141c78 NTP synchronized date/time: 00-00-00 MAC address of 1st STA connected: 00-00-00-00-00-00 starting pid 195, tty '/dev/ttyS1': '/bin/sh'
 * MT7620 PCIe RC mode *************
 * Starting ACOS Router *******************
 * Starting ACOS Router *******************

BusyBox v1.12.1 built-in shell (ash) Enter 'help' for a list of built-in commands.

restore GSW to dump switch mode switch reg write offset=2004, value=ff0000 switch reg write offset=2104, value=ff0000 switch reg write offset=2204, value=ff0000 switch reg write offset=2304, value=ff0000 switch reg write offset=2404, value=ff0000 switch reg write offset=2504, value=ff0000 switch reg write offset=2604, value=ff0000 switch reg write offset=2704, value=ff0000 switch reg write offset=2010, value=810000c0 switch reg write offset=2110, value=810000c0 switch reg write offset=2210, value=810000c0 switch reg write offset=2310, value=810000c0 switch reg write offset=2410, value=810000c0 switch reg write offset=2510, value=810000c0 switch reg write offset=2610, value=810000c0 switch reg write offset=2710, value=810000c0 REG_ESW_WT_MAC_ATC is 0x7ff0002 done. route: ioctl 0x890c failed: No such process route: ioctl 0x890b failed: Network is unreachable Jan 1 00:00:22 miniupnpd[1854]: WPS listening on port 7777 Jan 1 00:00:22 miniupnpd[1858]: WPS listening on port 8888 Reading board data... WSC UUID: 0x92e26c321266836639907d8670141c78 wan_lan_conflict_flag_on:0 POT integrity check OK. sche_action: no 2G state. sche_action: no 5G state. check_opmodeIOCTL_AG_REGION_SET: English
 * 1) ##### restore Ralink ESW to dump switch #####
 * 1) disable 1st wireless interface done #####
 * 2) disable 2nd wireless interface done #####
 * 3) bring up 1st interface done #####
 * 4) bring up 2nd interface done #####
 * 5) disable 2nd AP interface done #####
 * 6) enable 1st wireless interface done #####
 * 7) enable 2nd wireless interface done #####
 * No such file or directory

Can't find handler for ASP command: profile_cgi_get_profile_table; httpd: socket bound in 0.0.0.0:80 }}