Buffalo WZR-1750DHP

• The WZR-1750DHP is an official build target as of the OpenWrt 15.05 release, but hardware support is incomplete.
• The WZR-1750DHPD is identical to the WZR-1750DHP, except that it is shipped with DD-WRT firmware.¹⁾

The WZR-1750DHP model has at least two hardware revisions:

• Older revisions have a case with screws and tabs that can be easily opened for serial port access.
• Newer revisions are glued together and cannot be opened without damaging the case.

→ Install OpenWrt (generic explanation)

Please add the installation procedure here.

Reverting from OpenWrt to the wzr1750dhpd-v24sp2-23709c.bin vendor image is safe and easy to do through the LUCI web interface

J14 is the CFE console and Linux console at ttyS0. It ships with a four-pin header installed and is compatible with PL2303 adapters.

The J14 pinout from the key pin (a white triangle) is:

1. +5 VCC
2. Ground
3. Rx
4. Tx

The positive pin does not require power, but it can keep the SoC running, and it must be disconnected to completely reset the hardware.

Generally:

• Flashing AC1750 firmware on a WZR-1750DHPD locks the device, which makes it difficult to install DD-WRT or OpenWrt afterwards.
• Flashing DD-WRT firmware on a WZR-1750DHP voids its warranty.
• The CFE does not recognize TRX checksums, which must ignored or forced.

As of OpenWrt 15.05 (Chaos Calmer):

• The 802.11an radio is not recognized.
• The 802.11bg radio is misconfigured such that most wireless clients will connect to the AP with only a very weak signal.

As of OpenWrt r47881 (Designated Driver):

• The 802.11an radio is recognized but misconfigured.
• The USB2 and USB3 host controllers are detected but misconfigured.

The USB error in the dmesg is:

   hub 1-0:1.0: USB hub found
   hub 1-0:1.0: config failed, hub doesn't have any ports! (err -19)

As of LEDE 17.01:

• The 802.11a/b/g/n radio (BCM4331) PHY (OSI Layer 1) is recognized, however Layer 2 802.11n functionality is not implemented. This radio works as a 802.11g device.
• The 802.11ac radio (BCM4360) is not recognized
• USB controller is properly detected and loaded as USB 3.0 (not tested)
• Aforementioned usb hub kernel error message still exists

  [    5.081275] bcm_ns_usb3 18105000.usb3-phy: Registered Broadcom Northstar USB 3.0 PHY driver

CFE version 6.30.163.18 (r377098) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Thu May  8 19:47:46 JST 2014 (root@fc17.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.

This build does not have a USB driver and can be rescued only through TFTP.

Uploading the openwrt .trx as a firmware upgrade using Buffalo's stock web interface is rejected as invalid firmware. Note that with stock firmware revisions v2.27 (and probably higher), uploads of non-Buffalo firmware and firmware older than v2.27 are blocked by the web interface. If you have a unit shipped with such a firmware, you can manually override this check as documented at https://www.dd-wrt.com/phpBB2/viewtopic.php?p=783040 and summarized here:

1. Open the debug interface at http://192.168.11.1/cgi-bin/cgi?req=frm&frm=py-db/55debug.html
2. Use username “bufpy” and password “otdpopypassword” to log in
3. Go to the normal web interface at http://192.168.11.1 (automatically logged in in debug mode)
4. Click on the new button “debug-disp”
5. Click on the (second to last) link “admin”, then on the (first) link “name”
6. Click on the last link ending in firmup.html
7. In this interface, any “.bin” firmware (i.e. not in the typical Buffalo .zip package) can be uploaded without the normal validation. I have successfully tested it with “factory-to-dd-wrt.bin” from ftp://ftp.dd-wrt.com/betas/2015/12-05-2015-r28444/buffalo_wzr-1750dhp/ (in the DD-WRT forum, r28444 is rumored to be stable in terms of WLAN performance, other releases will most likely work as well). It should also be possible to downgrade to an earlier Buffalo stock firmware at this place (e.g. v2.22 without this problem).

One option is to first go through DD-WRT as described nicely at http://kdpeter.blogspot.co.at/2015/03/buffalo-wzr-1750dhp-openwrt.html?m=1 and summarized here (note that the first 2 steps will already by done if you followed the above steps to downgrade from v2.27):

1. Download the latest versions of the files factory-to-dd-wrt.bin and buffalo-wzr-1750dhp-webflash.bin from: ftp://ftp.dd-wrt.com/betas/2015/12-05-2015-r28444/buffalo_wzr-1750dhp/ As the directories names are build dates, you can browse the directories to see if there is a newer version available.
2. Update the firmware to the file factory-to-dd-wrt.bin using the web interface of the router. Be patient as this process takes some time.
3. Now your router is running DD-WRT. Using DD-WRT web interface update the firmware to the file buffalo-wzr-1750dhp-webflash.bin. Be patient as this process takes some time.
4. Download the latest version of the file openwrt-bcm53xx-bcm4708-buffalo-wzr-1750dhp-squashfs.trx as linked above.
5. Using DD-WRT web interface update the firmware to the file openwrt-bcm53xx-bcm4708-buffalo-wzr-1750dhp-squashfs.trx. Be patient as this process takes some time.

The second option is to go directly through TFTP with uboot. Buffalo routers typically default to address 192.168.11.1, and the WZR-1750DHP uses the same in uboot. Timing is difficult to get right, one option is to start the following on the command line (assuming a Linux host) immediately after plugging in the router (connected to a LAN port):

sudo ip a a 192.168.11.7/24 dev <your ethernet interface>; atftp 192.168.11.1 --verbose -p -l openwrt-bcm53xx-buffalo-wzr-1750dhp-squashfs.trx 

* Note: I have not yet managed to make this work on a new WZR-1750DHP running Buffalo firmware v2.27! It seems that this firmware will (currently) no longer support flashing anything non-Buffalo. *

1. Connect header J14 to a low voltage TTL serial adapter like a PL2303. (Do not use an RS-232 or DB9 adapter.)
2. Connect port 1 to the LAN.
3. Use a terminal emulator to open J14 in mode 115200/8/N/1.
4. Hold CTRL+C in the terminal window.
5. Start the WZR-1750DHP using the hard power button beside the power barrel.
6. Wait for the CFE> prompt in the terminal window.
7. Set a convenient IPv4 address on the WZR-1750DHP using the ifconfig command.
8. Install the firmware image using the flash -noheader command to the nflash1.trx device.
9. Send the TRX firmware file in octet or binary mode, which is not the default in some TFTP clients.

The console transcript on the WZR-1750DHP should look like this:

CFE> ifconfig eth0 -addr=192.168.0.99
Device eth0:  hwaddr 00-11-22-33-44-55, ipaddr 192.168.0.99, mask 255.255.255.0
        gateway not set, nameserver not set
*** command status = 0
CFE> flash -noheader : nflash1.trx
Reading ::

Double-check that the nflash1.trx argument is entered exactly correct here and then start the TFTP client...

Reading :: Done. 7733248 bytes read
Programming...done. 7733248 bytes written
*** command status = 0
CFE> go
check_trx: start nflash1.trx
check_trx: exit nflash1.trx
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: .. 1263056 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
Uncompressing Linux... done, booting the kernel.

The TFTP client transcript should look like this:

$ tftp 192.168.0.99
tftp> verbose
Verbose mode on.
tftp> mode octet
mode set to octet
tftp> put openwrt-15.05-bcm53xx-buffalo-wzr-1750dhp-squashfs.trx
putting openwrt-15.05-bcm53xx-buffalo-wzr-1750dhp-squashfs.trx to 192.168.0.99:openwrt-15.05-bcm53xx-buffalo-wzr-1750dhp-squashfs.trx [octet]
Sent 7733248 bytes in 2.9 seconds [21390263 bit/s]

OpenWrt BCM5XX Overview

How to add tags