Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ath79: add support for Huawei AP5030DN #2

Closed
wants to merge 1 commit into from
Closed

Conversation

CodingMarco
Copy link

Huawei AP5030DN is a dual-band, dual-radio 802.11ac Wave 1 3x3 MIMO enterprise access point with two Gigabit Ethernet ports and PoE support.

Hardware highlights:

  • CPU: QCA9550 SoC at 720MHz
  • RAM: 256MB DDR2
  • Flash: 32MB SPI-NOR
  • Wi-Fi 2.4GHz: QCA9550-internal radio
  • Wi-Fi 5GHz: QCA9880 PCIe WLAN SoC
  • Ethernet 1: 10/100/1000 Mbps Ethernet through Broadcom B50612E PHY
  • Ethernet 2: 10/100/1000 Mbps Ethernet through Marvell 88E1510 PHY
  • PoE: input through Ethernet 1 port
  • Standalone 12V/2A power input
  • Serial console externally available through RJ45 port
  • External watchdog: SGM706 (1.6s timeout)

Serial console:
9600n8 (9600 baud, no stop bits, no parity, 8 data bits)

MAC addresses:
Each device has 32 consecutive MAC addresses allocated by the vendor, which don't overlap between devices. This was confirmed with multiple devices with consecutive serial numbers. The MAC address range starts with the address on the label. To be able to distinguish between the interfaces, the following MAC address scheme is used: - eth0 = label MAC - eth1 = label MAC + 1 - radio0 (Wi-Fi 5GHz) = label MAC + 2 - radio1 (Wi-Fi 2.4GHz) = label MAC + 3

Installation:
0. Connect some sort of RJ45-to-USB adapter to "Console" port of the AP

  1. Power up the AP

  2. At prompt "Press f or F to stop Auto-Boot in 3 seconds", do what they say. Log in with default admin password "[email protected]".

  3. Boot the OpenWrt initramfs from TFTP using the hidden script "run ramboot". Replace IP address as needed:

    setenv serverip 192.168.1.10
    setenv ipaddr 192.168.1.1
    setenv rambootfile
    openwrt-ath79-generic-huawei_ap5030dn-initramfs-kernel.bin
    saveenv
    run ramboot

  4. Optional but recommended as the factory firmware cannot be downloaded publicly: Back up contents of "firmware" partition using the web interface or ssh:

    $ ssh [email protected] cat /dev/mtd11 > huawei_ap5030dn_fw_backup.bin

  5. Run sysupgrade using sysupgrade image. OpenWrt shall boot from flash afterwards.

Return to factory firmware (using firmware upgrade package downloaded from non-public Huawei website):

  1. Start a TFTP server in the directory where the firmware upgrade package is located

  2. Boot to u-boot as described above

  3. Install firmware upgrade package and format the config partitions:

    update system FatAP5X30XN_SOMEVERSION.bin
    format_fs

Return to factory firmware (from previously created backup):

  1. Copy over the firmware partition backup to /tmp, for example using scp

  2. Use sysupgrade with force to restore the backup: sysupgrade -F huawei_ap5030dn_fw_backup.bin

  3. Boot AP to U-Boot as described above

Quirks and known issues:

  • On initial power-up, the Huawei-modified bootloader suspends both ethernet PHYs (it sets the "Power Down" bit in the MII control register). Unfortunately, at the time of the initial port, the kernel driver for the B50612E/BCM54612E PHY behind eth0 doesn't have a resume callback defined which would clear this bit. This makes the PHY unusable since it remains suspended forever. This is why the backported kernel patches in this commit are required which add this callback and for completeness also a suspend callback.
  • The stock firmware has a semi dual boot concept where the primary kernel uses a squashfs as root partition and the secondary kernel uses an initramfs. This dual boot concept is circumvented on purpose to gain more flash space and since the stock firmware's flash layout isn't compatible with mtdsplit.
  • The external watchdog's timeout of 1.6s is very hard to satisfy during bootup. This is why the GPIO15 pin connected to the watchdog input is configured directly in the LZMA loader to output the CPU_CLK/4 signal which keeps the watchdog happy until the wdt-gpio kernel driver takes over. Because it would also take too long to read the whole kernel image from flash, the uImage header only includes the loader which then reads the kernel image from flash after GPIO15 is configured.

Huawei AP5030DN is a dual-band, dual-radio 802.11ac Wave 1 3x3 MIMO enterprise
access point with two Gigabit Ethernet ports and PoE support.

Hardware highlights:
- CPU: QCA9550 SoC at 720MHz
- RAM: 256MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: QCA9550-internal radio
- Wi-Fi 5GHz: QCA9880 PCIe WLAN SoC
- Ethernet 1: 10/100/1000 Mbps Ethernet through Broadcom B50612E PHY
- Ethernet 2: 10/100/1000 Mbps Ethernet through Marvell 88E1510 PHY
- PoE: input through Ethernet 1 port
- Standalone 12V/2A power input
- Serial console externally available through RJ45 port
- External watchdog: SGM706 (1.6s timeout)

Serial console:
  9600n8 (9600 baud, no stop bits, no parity, 8 data bits)

MAC addresses:
  Each device has 32 consecutive MAC addresses allocated by
  the vendor, which don't overlap between devices.
  This was confirmed with multiple devices with consecutive
  serial numbers.
  The MAC address range starts with the address on the label.
  To be able to distinguish between the interfaces,
  the following MAC address scheme is used:
    - eth0 = label MAC
    - eth1 = label MAC + 1
    - radio0 (Wi-Fi 5GHz) = label MAC + 2
    - radio1 (Wi-Fi 2.4GHz) = label MAC + 3

Installation:
0. Connect some sort of RJ45-to-USB adapter to "Console" port of the AP

1. Power up the AP

2. At prompt "Press f or F  to stop Auto-Boot in 3 seconds",
   do what they say.
   Log in with default admin password "[email protected]".

3. Boot the OpenWrt initramfs from TFTP using the hidden script "run ramboot".
   Replace IP address as needed:

   > setenv serverip 192.168.1.10
   > setenv ipaddr 192.168.1.1
   > setenv rambootfile
     openwrt-ath79-generic-huawei_ap5030dn-initramfs-kernel.bin
   > saveenv
   > run ramboot

4. Optional but recommended as the factory firmware cannot
   be downloaded publicly:
   Back up contents of "firmware" partition using the web interface or ssh:

   $ ssh [email protected] cat /dev/mtd11 > huawei_ap5030dn_fw_backup.bin

5. Run sysupgrade using sysupgrade image. OpenWrt
   shall boot from flash afterwards.

Return to factory firmware (using firmware upgrade package downloaded from
non-public Huawei website):
1. Start a TFTP server in the directory where
   the firmware upgrade package is located

2. Boot to u-boot as described above

3. Install firmware upgrade package and format the config partitions:

   > update system FatAP5X30XN_SOMEVERSION.bin
   > format_fs

Return to factory firmware (from previously created backup):
1. Copy over the firmware partition backup to /tmp,
   for example using scp

2. Use sysupgrade with force to restore the backup:
   sysupgrade -F huawei_ap5030dn_fw_backup.bin

3. Boot AP to U-Boot as described above

Quirks and known issues:
- On initial power-up, the Huawei-modified bootloader suspends both ethernet
PHYs (it sets the "Power Down" bit in the MII control register). Unfortunately,
at the time of the initial port, the kernel driver for the B50612E/BCM54612E PHY
behind eth0 doesn't have a resume callback defined which would clear this bit.
This makes the PHY unusable since it remains suspended forever. This is why the
backported kernel patches in this commit are required which add this callback
and for completeness also a suspend callback.
- The stock firmware has a semi dual boot concept where the primary kernel uses
a squashfs as root partition and the secondary kernel uses an initramfs. This
dual boot concept is circumvented on purpose to gain more flash space and since
the stock firmware's flash layout isn't compatible with mtdsplit.
- The external watchdog's timeout of 1.6s is very hard to satisfy during bootup.
This is why the GPIO15 pin connected to the watchdog input is configured
directly in the LZMA loader to output the CPU_CLK/4 signal which keeps the
watchdog happy until the wdt-gpio kernel driver takes over. Because it would
also take too long to read the whole kernel image from flash, the uImage header
only includes the loader which then reads the kernel image from flash after
GPIO15 is configured.

Signed-off-by: Marco von Rosenberg <[email protected]>
@CodingMarco CodingMarco closed this Apr 2, 2024
CodingMarco pushed a commit that referenced this pull request Sep 15, 2024
Hardware specification:
  SoC: MediaTek MT7981B 2x A53
  Flash: 16MB NOR
  RAM: 256MB
  Ethernet: 2x 10/100/1000 Mbps
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976C
  Button: Reset
  Power: DC 12V 1A, PoE 802.3af 48V

Flash instructions:

Option #1 - SSH

  I was able to SSH into the stock firmware of my device.

  1. Attach the router to the network
  2. Use scp (-O) to copy the sysupgrade image
  3. Connect using SSH and run `sysupgrade -n`

Option #2 - U-Boot

  One way to use the bootloader for flashing is using TFTP:

  1. Connect to the router using an ethernet cable
  2  Spin up a TFTP server serving the sysupgrade file
  3. Open the case and attach a UART
  4. Attach power to the router and interrupt the countdown by pressing
     any key
  5. Select option #2 (Upgrade firmware)
  6. Enter IP address information and image name
  7. Wait patiently

Co-Authored-By: Enrique Rodríguez Valencia <[email protected]>
Co-Authored-By: Hauke Mehrtens <[email protected]>
Signed-off-by: Leon M. Busch-George <[email protected]>
(cherry picked from commit b4086f4)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant