Buffalo WZR-600DHP2

→ Install OpenWrt (generic explanation)

Connect through serial adapter. Setup a TFTP server on 192.168.1.2 with the firmware file available, connect to LAN. Stop boot hitting CTRL+C, you'll get to the CFE environment.

To get help on CFE type help or help command. Set ip and gateway.

Press CTRL+C to cancel startup...

CFE> ^C
CFE> ifconfig eth0 -addr=192.168.1.55 -gw=192.168.1.1
Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.55, mask 255.255.255.0
        gateway 192.168.1.1, nameserver not set
*** command status = 0
CFE> ifconfig eth0
Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.55, mask 255.255.255.0
        gateway 192.168.1.1, nameserver not set
*** command status = 0
CFE> ping 192.168.1.2
192.168.1.2 (192.168.1.2) is alive
192.168.1.2 (192.168.1.2): 1 packets sent, 1 received
*** command status = 0
CFE> flash -noheader 192.168.1.2:openwrt-18.06.1-bcm53xx-buffalo-wzr-600dhp2-squashfs.trx nflash1.trx
Reading 192.168.1.2:openwrt-18.06.1-bcm53xx-buffalo-wzr-600dhp2-squashfs.trx: Done. 7077888 bytes read
Programming...done. 7077888 bytes written
*** command status = 0
CFE> reboot

Note: This will void your warranty!

Remove rear sticker and the two screws under it. Pull and remove left side cover.

→ port.serial general information about the serial port, serial port cable, etc.

After opening the case, you will find jumper J14 near the cpu with the big heatsink. This is the console serial port, with pins assigned as:

Console serial port parameters

• Speed (baud rate): 115200
• Bits: 8
• Parity: None
• Stop Bits: 1
• Flow Control: None (both hardware and software flow control)

Connect your serial adapter (a generic CH340 USB to TTL adapter set to 3.3v is known to work) to J14 with crossed RX/TX as follows:

After powering on the router, type Control-C to interrupt the boot sequence until you see a CFE> prompt, at which point you will be in the Broadcom Common Firmware Environment (CFE) firmware interface.

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

There are two small torx screws that hold the case together. They are hidden underneath the label on the back of the unit.

Running 18.06.4, IPv4 throughput between an upstream router on the wan port and a single station on a swtich port, with NAT, is about 250Mb/s. The 2.4Ghz radio is functional, but has very low throughput, less than 10Mb/s. The 5Ghz radio has extremely low transmit strength regardless of power setting, and couldn't be connected to reliably enough for testing on any channel.

How to add tags