COMFAST CF-E120A v3

CF-E120A right view (image from comfast.com.cn)

The COMFAST CF-E120A is an outdoor 5 GHz wireless CPE. It is based on the Atheros AR9344 SoC, and features two RJ45 10/100 Mbps Ethernet ports with PoE in and a 300 Mbps 5 GHz 802.11b/g/n radio connected to an internal 2T2R 11 dBi atenna.

→ Check this guide on installing OpenWrt (generic explanation). More details for this specific device can be found below.

root@OpenWrt:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00010000 00010000 "u-boot"
mtd1: 00010000 00010000 "art"
mtd2: 007d0000 00010000 "firmware"
mtd3: 00190000 00010000 "kernel"
mtd4: 00640000 00010000 "rootfs"
mtd5: 003f0000 00010000 "rootfs_data"
mtd6: 00010000 00010000 "nvram"

The stock firmware is based on OpenWrt, customized by the manufacturer.

Stock firmware previous to CF-E120AV3-V2.6.0.5

A standard OpenWrt image can be installed from the web interface; just upload the sysupgrade file for the device and flash it.

Note: the router will keep the previous configuration, including the stock password. After flashing, enter failsafe mode to reset it.

Stock firmware CF-E120AV3-V2.6.0.5

Standard OpenWrt images can not be flashed anymore from the web interface. Use one of the alternative methods instead.

The stock firmware has an SSH daemon but the root password is not known, and does not match the web GUI's password. However, the following procedure allows setting it to a known one and gaining SSH access to the device.

  1. Using the stock web GUI, under System → Tools → Export Settings, download a backup of the configuration to your computer
  2. The generated file, called bakup.file [sic], is actually a tar.gz file containing the etc folder and some configuration files
  3. Extract the backup and edit the etc/shadow file
  4. Replace the first line of etc/shadow by root:$1$pjKB26GF$T9mfHI/C6JGX9rQ8CYDPl/:18270:0:99999:7::: to set root password to “openwrt”
  5. Repack the modified etc directory as a tar.gz. file, and rename it to bakup.file
  6. Using the stock web GUI, use System → Tools → Import Settings to upload the modified backup
  7. The device will reboot and the password will be openwrt

Once the device is accessible via SSH:

  1. SSH the device ssh root@192.168.10.1
  2. Use sysupgrade to flash the OpenWrt image sysupgrade -v -n -F /tmp/tmp/openwrt-ath79-generic-comfast_cf-e120a-v3-squashfs-sysupgrade.bin
    1. -v makes the process verbose
    2. -n does not keep any previous configuration
    3. -F forces sysupgrade to proceed even if the image test fails
root@COMFAST:~# sysupgrade -v -n -F /tmp/openwrt-ath79-generic-comfast_cf-e120a-v3-squashfs-sysupgrade.bin 
Invalid image type.
Image check 'platform_check_image' failed but --force given - will update anyway!
Sending TERM to remaining processes ... logd netifd nginx nginx heart_beat ntpd led_control webmgnt dnsmasq sleep ubusd askfirst 
Sending KILL to remaining processes ... askfirst 
Switching to ramdisk...
erase configs...
Do reset configs
Performing system upgrade...
Unlocking firmware ...

Writing from <stdin> to firmware ...     
Upgrade completed
Rebooting system...

The U-boot bootloader of this device contains a recovery HTTP server from which to upload the firmware.

Instructions

  1. Power the device and immediately press the reset button
  2. Keep pressing the reset button for 5~6 seconds, the LEDs will blink during this time
  3. Release reset button, the LEDs will blink very fast for a moment
  4. Manually configure your computer to 192.168.1.X/24 (e.g.: 192.168.1.2/24)
  5. Head to the recovery page at http://192.168.1.1
  6. Upload the appropriate OpenWrt sysupgrade firmware image

P.S. - for Comfast CF-E5 model - 5-6 lights on (not seconds)

You can read the generic OpenWrt instructions here.

Specific values needed for TFTP

Bootloader tftp server IPv4 address 192.168.1.10/24
Bootloader MAC address (special) N/A
Firmware tftp image Latest OpenWrt release sysupgrade image. Note: remane it to “firmware_auto.bin”
TFTP transfer window 1 seconds
TFTP window start approximately 5 seconds after power on

You can read the general OpenWrt upgrading instructions here.

  • Browse to http://192.168.1.1/cgi-bin/luci/admin/system/flashops LuCI's upgrade URL (replace 192.168.1.1 with the router's IP)
  • Upload image file for sysupgrade to LuCI
  • Wait for reboot

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line.

sysupgrade

  • Login as root via SSH on your router, then enter the following commands:
cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
eth1 LAN port In br-lan
eth0 WAN port DHCP
wlan0 WiFi Disabled

The device has a push button, labeled “RST”, and a two-positions slide switch, labeled “STA AP. The push button is used to reset the device, restore it to factory defaults or enter into failsafe mode. The slide switch is meant to change between station or access point using the stock firmware.

Button GPIO port Event
RST 17 reset
Slide switch GPIO port Values Event
STA AP 1 0: AP. 1: STA none

CF-E120A left view (image from comfast.com.cn) CF-E120A side view (image from comfast.com.cn) CF-E120A front view (image from comfast.com.cn)

Backside label:
Insert photo of backside label

Note: This will void your warranty!

Remove the label on the back to uncover the two small screws that hold the case and the mainboard together.

You can use a serial TTL to USB converter to connect to the serial port. The pins are clearly shown on the main board.

→ Check here port.serial for general information about the serial port, serial port cable, etc.

Serial connection parameters
for COMFAST CF-E120A v3
115200, 8N1

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

********************************************* * U-Boot 1.1.4 (Apr 10 2018) * ********************************************* U-Boot for AR9344 DRAM: 64 MB DDR2 16-bit FLASH: Unknown type (using only 16 MB) Please, send request to add support for your FLASH - JEDEC ID: 0x1C7017 CLOCKS: 535/400/200/25 MHz (CPU/RAM/AHB/SPI) ** Warning: bad env CRC, using default, use 'saveenv' to save it in FLASH Link down: eth0 Ethernet mode (duplex/speed): 1/1000 Mbps Using eth1 device ping failed Hit any key to stop autobooting: 0 Booting image at: 0x9F020000


FIRMWARE UPDATE You are going to update firmware on the device. Please, choose file from your local hard drive and click Update firmware button. WARNINGS do not power off the device during update if everything goes well, the device will restart you can upload whatever you want, so be sure that you choose proper firmware image for your device



[ 0.000000] Linux version 4.14.156 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r10775-db8345d8e4)) #0 Sat Nov 30 15:52:33 2019 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc) [ 0.000000] MIPS: machine is COMFAST CF-E120A v3 [ 0.000000] SoC: Atheros AR9344 rev 2 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] On node 0 totalpages: 16384 [ 0.000000] free_area_init_node: node 0, pgdat 804f9f90, node_mem_map 81007a00 [ 0.000000] Normal zone: 128 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 16384 pages, LIFO batch:3 [ 0.000000] random: get_random_bytes called from 0x804fd740 with crng_init=0 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 58336K/65536K available (4025K kernel code, 158K rwdata, 532K rodata, 1228K init, 211K bss, 7200K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 535.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7144898866 ns [ 0.000012] sched_clock: 32 bits at 267MHz, resolution 3ns, wraps every 8027976190ns [ 0.008728] Calibrating delay loop... 266.64 BogoMIPS (lpj=1333248) [ 0.095686] pid_max: default: 32768 minimum: 301 [ 0.101061] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.108458] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.121168] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.132181] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.139087] pinctrl core: initialized pinctrl subsystem [ 0.147728] NET: Registered protocol family 16 [ 0.177698] clocksource: Switched to clocksource MIPS [ 0.184598] NET: Registered protocol family 2 [ 0.190572] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.198427] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.205530] TCP: Hash tables configured (established 1024 bind 1024) [ 0.212797] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.219380] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.226654] NET: Registered protocol family 1 [ 0.231598] PCI: CLS 0 bytes, default 32 [ 0.236271] Crashlog allocated RAM at address 0x3f00000 [ 0.243714] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.256764] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.263330] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.285841] io scheduler noop registered [ 0.290277] io scheduler deadline registered (default) [ 0.298645] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68 [ 0.307539] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.317555] console [ttyS0] disabled [ 0.321655] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A [ 0.331307] console [ttyS0] enabled [ 0.338742] bootconsole [early0] disabled [ 0.357834] m25p80 spi0.0: en25qh64 (8192 Kbytes) [ 0.362669] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.369148] Creating 4 MTD partitions on "spi0.0": [ 0.374027] 0x000000000000-0x000000010000 : "u-boot" [ 0.380064] 0x000000010000-0x000000020000 : "art" [ 0.385718] 0x000000020000-0x0000007f0000 : "firmware" [ 0.395165] 2 uimage-fw partitions found on MTD device firmware [ 0.401248] Creating 2 MTD partitions on "firmware": [ 0.406294] 0x000000000000-0x000000190000 : "kernel" [ 0.412272] 0x000000190000-0x0000007d0000 : "rootfs" [ 0.418231] mtd: device 4 (rootfs) set to be root filesystem [ 0.424024] 1 squashfs-split partitions found on MTD device rootfs [ 0.430377] 0x0000003e0000-0x0000007d0000 : "rootfs_data" [ 0.436741] 0x0000007f0000-0x000000800000 : "nvram" [ 0.444027] libphy: Fixed MDIO Bus: probed [ 0.788825] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe. [ 1.468106] libphy: ag71xx_mdio: probed [ 1.473221] libphy: ar8xxx-mdio: probed [ 1.484365] switch0: Atheros AR8229 rev. 1 switch registered on mdio-bus.0 [ 1.536764] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY] [ 1.546653] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: gmii [ 1.556238] NET: Registered protocol family 10 [ 1.567681] Segment Routing with IPv6 [ 1.571597] NET: Registered protocol family 17 [ 1.576187] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 1.589360] 8021q: 802.1Q VLAN Support v1.8 [ 1.929713] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:1f:00 [uid=004dd042, driver=Generic PHY] [ 1.940479] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii [ 1.947580] hctosys: unable to open rtc device (rtc0) [ 1.958372] VFS: Mounted root (squashfs filesystem) readonly on device 31:4. [ 1.973565] Freeing unused kernel memory: 1228K [ 1.978205] This architecture does not have kernel memory protection. [ 2.557713] random: fast init done [ 2.782687] init: Console is alive [ 2.786414] init: - watchdog - [ 3.626308] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.713317] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.731251] init: - preinit - [ 4.945165] random: jshn: uninitialized urandom read (4 bytes read) [ 5.216056] random: jshn: uninitialized urandom read (4 bytes read) [ 5.359721] random: jshn: uninitialized urandom read (4 bytes read) [ 5.876139] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready [ 8.980232] eth1: link up (100Mbps/Half duplex) [ 8.984878] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready [ 9.119225] mount_root: jffs2 not ready yet, using temporary tmpfs overlay [ 9.155368] urandom-seed: Seed file not found (/etc/urandom.seed) [ 9.366868] eth1: link down [ 9.384213] procd: - early - [ 9.387279] procd: - watchdog - [ 10.053374] procd: - watchdog - [ 10.056949] procd: - ubus - [ 10.144667] urandom_read: 5 callbacks suppressed [ 10.144677] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.235794] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.244087] procd: - init - [ 11.022820] kmodloader: loading kernel modules from /etc/modules.d/* [ 11.178614] urngd: v1.0.0 started. [ 11.201102] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 11.227605] Loading modules backported from Linux version v4.19.85-0-gc63ee2939dc1 [ 11.235370] Backport generated by backports.git v4.19.85-1-0-g8a8be258 [ 11.269625] ip_tables: (C) 2000-2006 Netfilter Core Team [ 11.294845] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 11.438681] xt_time: kernel timezone is -0000 [ 11.549038] random: crng init done [ 11.559448] PPP generic driver version 2.4.2 [ 11.566832] NET: Registered protocol family 24 [ 11.619509] ath: EEPROM regdomain: 0x0 [ 11.619520] ath: EEPROM indicates default country code should be used [ 11.619525] ath: doing EEPROM country->regdmn map search [ 11.619543] ath: country maps to regdmn code: 0x3a [ 11.619550] ath: Country alpha2 being used: US [ 11.619555] ath: Regpair used: 0x3a [ 11.635410] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 11.637530] ieee80211 phy0: Atheros AR9340 Rev:2 mem=0xb8100000, irq=12 [ 11.709270] kmodloader: done loading kernel modules from /etc/modules.d/* [ 56.396325] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 [ 56.443723] jffs2_build_filesystem(): unlocking the mtd device... [ 56.443735] done. [ 56.452038] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 56.719169] br-lan: port 1(eth1) entered blocking state [ 56.732131] br-lan: port 1(eth1) entered disabled state [ 56.737835] device eth1 entered promiscuous mode [ 56.809304] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 56.872148] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 57.939013] eth0: link up (1000Mbps/Full duplex) [ 57.943749] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 58.820338] eth1: link up (100Mbps/Half duplex) [ 58.825006] br-lan: port 1(eth1) entered blocking state [ 58.830365] br-lan: port 1(eth1) entered forwarding state [ 58.899837] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 70.904407] done. [ 70.906415] jffs2: notice: (1245) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 71.131853] overlayfs: upper fs does not support tmpfile.


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 11:13
  • by 127.0.0.1