ZyXEL WAP6805

abgn+ac (AC2100)
range extender
Homepage	Product page
Wikipedia	ZyXEL
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Partial Support
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	ZyXEL WAP6805
FCC ID	none specified
Type	range extender
CPU1 Y	MediaTek MT7621ST
CPU1 Type	MIPS 1004Kc
CPU1 Speed	880 MHz 16-bit
Flash1 Chip	Brand? Model?
Flash1 Size	128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (NAND)
RAM1 Size	64 MiB 67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br />
RAM1 Chip	Brand? Model?
ETH chip1	MediaTek MT7621ST
Switch	MediaTek MT7530
Ethernet Port Count	4-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified
Stock bootloader	U-Boot
Expansion IF types	none specified
Power	12 VDC, 1 A
Serial Port (UART)	yes, 3.3V TTL, (57600 8N1)
Other
3rd Party Firmware Support	OpenWrt • (List | Dev | DLs)
Retail
Availability	End of Life
Radio 1
Chip1	MediaTek MT7603EN
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Quantenna QT3840BC
Chip2	Quantenna QT2518B
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	4x4:4
Wireless Standard	IEEE 802.11a/n/ac
802.11ac	up to 1733 Mbps
802.11n	up to 600 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.
For a list of all currently documented Quantenna chipsets with specifications, see Quantenna.

For a list of all currently documented ZyXEL devices with specifications, see ZyXEL.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.),

• 1733 Mbps - 4SS 5GHz 802.11ac (80MHz chan.) = AC2100 class

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki

Target: ramips
Subtarget: mt7621
Package architecture: mipsel_24kc
Supported Since Commit
Support started version: 21.02.0
Current supported version: 25.12.2

Unsupported Functions:
WiFi 5GHz
LAN Hardware: MediaTek MT7530
WLAN Hardware: MediaTek MT7603EN, Quantenna QT3840BC, Quantenna QT2518B
WLAN Comment: 2x2:2 and 4x4:4. Quantenna module lacks OpenWrt support
Installation method(s):
U-Boot TFTP + serial recovery, see devicepage
Install Comment:
root pw required for OEM install - known only for 2016 firmware revision
Recovery method(s):
U-Boot TFTP + serial recovery

git • >>

ramips: add support for ZyXEL WAP6805 (Altibox WiFi+) Hardware -------- SoC: MediaTek MT7621ST WiFi: MediaTek MT7603 Quantenna QT3840BC Flash: 128M NAND RAM: 64M LED: Dual colour red and green BTN: Reset WPS Eth: 4 x 10/100/1000 connected to MT7621 internal switch MT7621 RGMII port connected to Quantenna module GPIO: Power/reset of Quantenna module Quantenna module ---------------- The Quantenna QT3840BC (or QV840) is a separate SoC running another Linux installation. It is mounted on a wide mini-PCIe form factor module, but is connected to the RGMII port of the MT7621. It loads both a second uboot stage and an os image from the MT7621 using tftp. The module is configured using Quantenna specific RPC calls over IP, using 802.1q over the RGMII link to support multiple SSIDs. There is no support for using this module as a WiFi device in OpenWrt. A package with basic firmware and management tools is being prepared. Serial ports ------------ Two serial ports with headers: RRJ1 - 115200 8N1 - Connected to the Quantenna console J1 - 57600 8N1 - Connected to the MT7621 console Both share pinout with many other Zyxel/Mitrastar devices: 1 - NC (VDD) 2 - TX 3 - RX 4 - NC (no pin) 5 - GND Dual system partitions ---------------------- The vendor firmware and boot loader use a dual partition scheme storing a counter in the header of each partition. The partition with the highest number will be selected for boot. OpenWrt does not support this scheme and will always use the first OS partition. It will reset both counters to zero the first time sysupgrade is run, making sure the first partition is selected by the boot loader. Installation from vendor firmware --------------------------------- 1. Run a DHCP server. The WAP6805 is configured as a client device and does not have a default static IP address. Make a note of which address it is assigned 2. tftp the OpenWrt initramfs-kernel.bin image to this address. Wait for the WAP6805 to reboot. 3. ssh to the OpenWrt initramfs system on 192.168.1.1. Make a backup of all mtd partitions now. The last used OEM image is still present in either "Kernel" or "Kernel2" at this point, and can be restored later if you save a copy. 4. sysupgrade to the OpenWrt sysupgrade.bin image. Installation from U-Boot ------------------------ This requires serial console access 1. Copy the OpenWrt initramfs-kernel.bin image as "ras.bin" to your tftp server directory. Configure the server address as 192.168.0.33/24 2. Hit ESC when the message "Hit ESC key to stop autoboot" appears 3. Type "ATGU" + Enter, and then "2" immediately after pressing enter. 4. Answer Y to the question "Erase Linux in Flash then burn new one. Are you sure?", and answer the address/filename questions. Defaults: Input device IP (192.168.0.2) Input server IP (192.168.0.33) Input Linux Kernel filename ("ras.bin") 5. Wait until after you see the message "Done!" and power cycle the device. It will hang after flashing. 6. Continue with step 3 and 4 from the vendor firmware procedure. Notes on the WAP6805 U-Boot --------------------------- The bootloader has been modified with both ZyXELs zyloader and the device specific dual partition scheme. These changes appear to have broken a few things. The zyloader shell claims to support a number of ZyXEL AT commands, but not all of them work. The image selection scheme is unreliable and inconsistent. A limited U-Boot menu is available - and used by the above U-Boot install procedure. But direct booting into an uploaded image does not work, neither with ram nor with flash. Flashing works, but requires a hard reset after it is finished. Reverting to OEM firmware ------------------------- The OEM firmware can be restored by using mtd write from OpenWrt, flashing it to the "Kernel" partition. E.g. ssh root@192.168.1.1 "mtd -r -e Kernel write - Kernel" < oem.bin OEM firmwares for the WAP6805 are not avaible for public download, so a backup of the original installation is required. See above. Alternatively, firmware for the WAP6806 (Armor X1) may be used. This is exactly the same hardware. But the branding features do obviously differ. LED controller -------------- Hardware implementation is unknown. The dual-color LED is controlled by 3 GPIOs: 4: red 7: blinking green 13: green Enabling both red and green makes the LED appear yellow. The boot loader enables hardware blinking, causing the green LED to blink slowly on power-on, until the OpenWrt boot mode starts a faster software blink.

JTAG-Serial Info

Serial

Serial Pinouts

Two serial ports with headers:

RRJ1 - 115200 8N1 - Connected to the Quantenna console
J1 - 57600 8N1 - Connected to the MT7621 console

Both share pinout with many other Zyxel/Mitrastar devices:

1 - NC (VDD)
2 - TX
3 - RX
4 - NC (no pin)
5 - GND