|Model||Version||Current Release||Firmware OpenWrt Install||Firmware OpenWrt Upgrade||Firmware OEM Stock|
Connect through serial adapter. Setup a TFTP server on 192.168.1.2 with the firmware file available, connect to LAN. Stop boot hitting CTRL+C, you'll get to the CFE environment.
To get help on CFE type help or help command. Set ip and gateway.
Press CTRL+C to cancel startup... CFE> ^C CFE> ifconfig eth0 -addr=192.168.1.55 -gw=192.168.1.1 Device eth0: hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.55, mask 255.255.255.0 gateway 192.168.1.1, nameserver not set *** command status = 0 CFE> ifconfig eth0 Device eth0: hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.55, mask 255.255.255.0 gateway 192.168.1.1, nameserver not set *** command status = 0 CFE> ping 192.168.1.2 192.168.1.2 (192.168.1.2) is alive 192.168.1.2 (192.168.1.2): 1 packets sent, 1 received *** command status = 0 CFE> flash -noheader 192.168.1.2:openwrt-18.06.1-bcm53xx-buffalo-wzr-600dhp2-squashfs.trx nflash1.trx Reading 192.168.1.2:openwrt-18.06.1-bcm53xx-buffalo-wzr-600dhp2-squashfs.trx: Done. 7077888 bytes read Programming...done. 7077888 bytes written *** command status = 0 CFE> reboot
|Flash size||128 MiB NAND|
|Flash Chip||Zentel A5U1GA31ATS-BC|
|RAM size||256 MiB|
|Wireless No1||BCM43217 w/ 2.2:2 MIMO for 2.4GHz 802.11b/g/n|
|Wireless No2||BCM43228 w/ 2.2:2 MIMO for 5GHz 802.11a/n/an|
|USB||Yes 1 x 2.0|
Note: This will void your warranty!
Remove rear sticker and the two screws under it. Pull and remove left side cover.
→ port.serial general information about the serial port, serial port cable, etc.
After opening the case, you will find jumper J14 near the cpu with the big heatsink. This is the console serial port, with pins assigned as:
|Pin 1||Pin 2||Pin 3||Pin 4|
Console serial port parameters
Connect your serial adapter (a generic CH340 USB to TTL adapter set to 3.3v is known to work) to J14 with crossed RX/TX as follows:
|J14||Pin 1||Pin 2||Pin 3||Pin 4|
|Serial Adapter||Not Connected||Gnd||RX||TX|
After powering on the router, type Control-C to interrupt the boot sequence until you see a CFE> prompt, at which point you will be in the Broadcom Common Firmware Environment (CFE) firmware interface.
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Photo of PCB with markings
There are two small torx screws that hold the case together. They are hidden underneath the label on the back of the unit.
Running 18.06.4, IPv4 throughput between an upstream router on the wan port and a single station on a swtich port, with NAT, is about 250Mb/s. The 2.4Ghz radio is functional, but has very low throughput, less than 10Mb/s. The 5Ghz radio has extremely low transmit strength regardless of power setting, and couldn't be connected to reliably enough for testing on any channel.