Buffalo WZR-600DHP2

Install OpenWrt (generic explanation)

Connect through serial adapter. Setup a TFTP server on with the firmware file available, connect to LAN. Stop boot hitting CTRL+C, you'll get to the CFE environment.

To get help on CFE type help or help command. Set ip and gateway.

Press CTRL+C to cancel startup...

CFE> ifconfig eth0 -addr= -gw=
Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr, mask
        gateway, nameserver not set
*** command status = 0
CFE> ifconfig eth0
Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr, mask
        gateway, nameserver not set
*** command status = 0
CFE> ping ( is alive ( 1 packets sent, 1 received
*** command status = 0
CFE> flash -noheader nflash1.trx
Reading Done. 7077888 bytes read
Programming...done. 7077888 bytes written
*** command status = 0
CFE> reboot
Instruction set ARM
Vendor Broadcom
bootloader cfe
System-On-Chip BCM47081A0
CPU @Frq 800MHz
Flash size 128 MiB NAND
Flash Chip Zentel A5U1GA31ATS-BC
RAM size 256 MiB
RAM Chip
Wireless No1 BCM43217 w/ 2.2:2 MIMO for 2.4GHz 802.11b/g/n
Wireless No2 BCM43228 w/ 2.2:2 MIMO for 5GHz 802.11a/n/an
switch (Gigabit, VLAN)
USB Yes 1 x 2.0
Serial Yes

Note: This will void your warranty!

Remove rear sticker and the two screws under it. Pull and remove left side cover.

port.serial general information about the serial port, serial port cable, etc.

After opening the case, you will find jumper J14 near the cpu with the big heatsink. This is the console serial port, with pins assigned as:

Pin 1 Pin 2 Pin 3 Pin 4
VCC (3.3v) Gnd TX RX

Console serial port parameters

  • Speed (baud rate): 115200
  • Bits: 8
  • Parity: None
  • Stop Bits: 1
  • Flow Control: None (both hardware and software flow control)

Connect your serial adapter (a generic CH340 USB to TTL adapter set to 3.3v is known to work) to J14 with crossed RX/TX as follows:

J14 Pin 1 Pin 2 Pin 3 Pin 4
Serial Adapter Not Connected Gnd RX TX

After powering on the router, type Control-C to interrupt the boot sequence until you see a CFE> prompt, at which point you will be in the Broadcom Common Firmware Environment (CFE) firmware interface.

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

There are two small torx screws that hold the case together. They are hidden underneath the label on the back of the unit.

Running 18.06.4, IPv4 throughput between an upstream router on the wan port and a single station on a swtich port, with NAT, is about 250Mb/s. The 2.4Ghz radio is functional, but has very low throughput, less than 10Mb/s. The 5Ghz radio has extremely low transmit strength regardless of power setting, and couldn't be connected to reliably enough for testing on any channel.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by