COMFAST CF-E120A v3
The COMFAST CF-E120A is an outdoor 5 GHz wireless CPE. It is based on the Atheros AR9344 SoC, and features two RJ45 10/100 Mbps Ethernet ports with PoE in and a 300 Mbps 5 GHz 802.11b/g/n radio connected to an internal 2T2R 11 dBi atenna.
Supported Versions
Hardware Highlights
Installation
→ Check this guide on installing OpenWrt (generic explanation). More details for this specific device can be found below.
Flash Layout
root@OpenWrt:~# cat /proc/mtd dev: size erasesize name mtd0: 00010000 00010000 "u-boot" mtd1: 00010000 00010000 "art" mtd2: 007d0000 00010000 "firmware" mtd3: 00190000 00010000 "kernel" mtd4: 00640000 00010000 "rootfs" mtd5: 003f0000 00010000 "rootfs_data" mtd6: 00010000 00010000 "nvram"
From the stock firmware web GUI
The stock firmware is based on OpenWrt, customized by the manufacturer.
Stock firmware previous to CF-E120AV3-V2.6.0.5
A standard OpenWrt image can be installed from the web interface; just upload the sysupgrade file for the device and flash it.
Note: the router will keep the previous configuration, including the stock password. After flashing, enter failsafe mode to reset it.
Stock firmware CF-E120AV3-V2.6.0.5
Standard OpenWrt images can not be flashed anymore from the web interface. Use one of the alternative methods instead.
From the stock firmware CLI
The stock firmware has an SSH daemon but the root password is not known, and does not match the web GUI's password. However, the following procedure allows setting it to a known one and gaining SSH access to the device.
- Using the stock web GUI, under
System → Tools → Export Settings, download a backup of the configuration to your computer - The generated file, called
bakup.file[sic], is actually atar.gzfile containing theetcfolder and some configuration files - Extract the backup and edit the
etc/shadowfile - Replace the first line of
etc/shadowbyroot:$1$pjKB26GF$T9mfHI/C6JGX9rQ8CYDPl/:18270:0:99999:7:::to set root password to “openwrt” - Repack the modified
etcdirectory as atar.gz.file, and rename it tobakup.file - Using the stock web GUI, use
System → Tools → Import Settingsto upload the modified backup - The device will reboot and the password will be
openwrt
Once the device is accessible via SSH:
- SSH the device
ssh root@192.168.10.1 - Download the appropriate sysupgrade file
cd /tmp; wget http://downloads.openwrt.org/snapshots/targets/ath79/generic/openwrt-ath79-generic-comfast_cf-e120a-v3-squashfs-sysupgrade.bin - Use sysupgrade to flash the OpenWrt image
sysupgrade -v -n -F /tmp/tmp/openwrt-ath79-generic-comfast_cf-e120a-v3-squashfs-sysupgrade.bin-vmakes the process verbose-ndoes not keep any previous configuration-Fforces sysupgrade to proceed even if the image test fails
root@COMFAST:~# sysupgrade -v -n -F /tmp/openwrt-ath79-generic-comfast_cf-e120a-v3-squashfs-sysupgrade.bin Invalid image type. Image check 'platform_check_image' failed but --force given - will update anyway! Sending TERM to remaining processes ... logd netifd nginx nginx heart_beat ntpd led_control webmgnt dnsmasq sleep ubusd askfirst Sending KILL to remaining processes ... askfirst Switching to ramdisk... erase configs... Do reset configs Performing system upgrade... Unlocking firmware ... Writing from <stdin> to firmware ... Upgrade completed Rebooting system...
From U-Boot via recovery web page
The U-boot bootloader of this device contains a recovery HTTP server from which to upload the firmware.
Instructions
- Power the device and immediately press the reset button
- Keep pressing the reset button for 5~6 seconds, the LEDs will blink during this time
- Release reset button, the LEDs will blink very fast for a moment
- Manually configure your computer to 192.168.1.X/24 (e.g.: 192.168.1.2/24)
- Head to the recovery page at http://192.168.1.1
- Upload the appropriate OpenWrt sysupgrade firmware image
P.S. - for Comfast CF-E5 model - 5-6 lights on (not seconds)
From U-Boot via TFTP
You can read the generic OpenWrt instructions here.
Specific values needed for TFTP
| Bootloader tftp server IPv4 address | 192.168.1.10/24 |
|---|---|
| Bootloader MAC address (special) | N/A |
| Firmware tftp image | Latest OpenWrt release sysupgrade image. Note: remane it to “firmware_auto.bin” |
| TFTP transfer window | 1 seconds |
| TFTP window start | approximately 5 seconds after power on |
Upgrading OpenWrt
You can read the general OpenWrt upgrading instructions here.
LuCI web upgrade process
- Browse to
http://192.168.1.1/cgi-bin/luci/admin/system/flashopsLuCI's upgrade URL (replace 192.168.1.1 with the router's IP) - Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line.
sysupgrade
- Login as root via SSH on your router, then enter the following commands:
cd /tmp wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
Debricking
Failsafe mode
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Network interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN & WiFi | 192.168.1.1/24 |
| eth1 | LAN port | In br-lan |
| eth0 | WAN port | DHCP |
| wlan0 | WiFi | Disabled |
Buttons
The device has a push button, labeled “RST”, and a two-positions slide switch, labeled “STA AP. The push button is used to reset the device, restore it to factory defaults or enter into failsafe mode. The slide switch is meant to change between station or access point using the stock firmware.
| Button | GPIO port | Event |
|---|---|---|
| RST | 17 | reset |
| Slide switch | GPIO port | Values | Event |
|---|---|---|---|
| STA AP | 1 | 0: AP. 1: STA | none |
Hardware
Info
Photos
Backside label:
Insert photo of backside label
Opening the case
Note: This will void your warranty!
Remove the label on the back to uncover the two small screws that hold the case and the mainboard together.
Serial
You can use a serial TTL to USB converter to connect to the serial port. The pins are clearly shown on the main board.
→ Check here port.serial for general information about the serial port, serial port cable, etc.
| Serial connection parameters for COMFAST CF-E120A v3 | 115200, 8N1 |
|---|
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port
Bootlogs
U-Boot (bootloader)
********************************************* * U-Boot 1.1.4 (Apr 10 2018) * ********************************************* U-Boot for AR9344 DRAM: 64 MB DDR2 16-bit FLASH: Unknown type (using only 16 MB) Please, send request to add support for your FLASH - JEDEC ID: 0x1C7017 CLOCKS: 535/400/200/25 MHz (CPU/RAM/AHB/SPI) ** Warning: bad env CRC, using default, use 'saveenv' to save it in FLASH Link down: eth0 Ethernet mode (duplex/speed): 1/1000 Mbps Using eth1 device ping failed Hit any key to stop autobooting: 0 Booting image at: 0x9F020000
U-Boot HTTP recovery
FIRMWARE UPDATE You are going to update firmware on the device. Please, choose file from your local hard drive and click Update firmware button. WARNINGS do not power off the device during update if everything goes well, the device will restart you can upload whatever you want, so be sure that you choose proper firmware image for your device
OEM (stock firmware) bootlog
OpenWrt bootlog
[ 0.000000] Linux version 4.14.156 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r10775-db8345d8e4)) #0 Sat Nov 30 15:52:33 2019 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc) [ 0.000000] MIPS: machine is COMFAST CF-E120A v3 [ 0.000000] SoC: Atheros AR9344 rev 2 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] On node 0 totalpages: 16384 [ 0.000000] free_area_init_node: node 0, pgdat 804f9f90, node_mem_map 81007a00 [ 0.000000] Normal zone: 128 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 16384 pages, LIFO batch:3 [ 0.000000] random: get_random_bytes called from 0x804fd740 with crng_init=0 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 58336K/65536K available (4025K kernel code, 158K rwdata, 532K rodata, 1228K init, 211K bss, 7200K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 535.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7144898866 ns [ 0.000012] sched_clock: 32 bits at 267MHz, resolution 3ns, wraps every 8027976190ns [ 0.008728] Calibrating delay loop... 266.64 BogoMIPS (lpj=1333248) [ 0.095686] pid_max: default: 32768 minimum: 301 [ 0.101061] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.108458] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.121168] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.132181] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.139087] pinctrl core: initialized pinctrl subsystem [ 0.147728] NET: Registered protocol family 16 [ 0.177698] clocksource: Switched to clocksource MIPS [ 0.184598] NET: Registered protocol family 2 [ 0.190572] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.198427] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.205530] TCP: Hash tables configured (established 1024 bind 1024) [ 0.212797] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.219380] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.226654] NET: Registered protocol family 1 [ 0.231598] PCI: CLS 0 bytes, default 32 [ 0.236271] Crashlog allocated RAM at address 0x3f00000 [ 0.243714] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.256764] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.263330] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.285841] io scheduler noop registered [ 0.290277] io scheduler deadline registered (default) [ 0.298645] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68 [ 0.307539] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.317555] console [ttyS0] disabled [ 0.321655] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A [ 0.331307] console [ttyS0] enabled [ 0.338742] bootconsole [early0] disabled [ 0.357834] m25p80 spi0.0: en25qh64 (8192 Kbytes) [ 0.362669] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.369148] Creating 4 MTD partitions on "spi0.0": [ 0.374027] 0x000000000000-0x000000010000 : "u-boot" [ 0.380064] 0x000000010000-0x000000020000 : "art" [ 0.385718] 0x000000020000-0x0000007f0000 : "firmware" [ 0.395165] 2 uimage-fw partitions found on MTD device firmware [ 0.401248] Creating 2 MTD partitions on "firmware": [ 0.406294] 0x000000000000-0x000000190000 : "kernel" [ 0.412272] 0x000000190000-0x0000007d0000 : "rootfs" [ 0.418231] mtd: device 4 (rootfs) set to be root filesystem [ 0.424024] 1 squashfs-split partitions found on MTD device rootfs [ 0.430377] 0x0000003e0000-0x0000007d0000 : "rootfs_data" [ 0.436741] 0x0000007f0000-0x000000800000 : "nvram" [ 0.444027] libphy: Fixed MDIO Bus: probed [ 0.788825] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe. [ 1.468106] libphy: ag71xx_mdio: probed [ 1.473221] libphy: ar8xxx-mdio: probed [ 1.484365] switch0: Atheros AR8229 rev. 1 switch registered on mdio-bus.0 [ 1.536764] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY] [ 1.546653] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: gmii [ 1.556238] NET: Registered protocol family 10 [ 1.567681] Segment Routing with IPv6 [ 1.571597] NET: Registered protocol family 17 [ 1.576187] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 1.589360] 8021q: 802.1Q VLAN Support v1.8 [ 1.929713] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:1f:00 [uid=004dd042, driver=Generic PHY] [ 1.940479] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii [ 1.947580] hctosys: unable to open rtc device (rtc0) [ 1.958372] VFS: Mounted root (squashfs filesystem) readonly on device 31:4. [ 1.973565] Freeing unused kernel memory: 1228K [ 1.978205] This architecture does not have kernel memory protection. [ 2.557713] random: fast init done [ 2.782687] init: Console is alive [ 2.786414] init: - watchdog - [ 3.626308] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.713317] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.731251] init: - preinit - [ 4.945165] random: jshn: uninitialized urandom read (4 bytes read) [ 5.216056] random: jshn: uninitialized urandom read (4 bytes read) [ 5.359721] random: jshn: uninitialized urandom read (4 bytes read) [ 5.876139] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready [ 8.980232] eth1: link up (100Mbps/Half duplex) [ 8.984878] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready [ 9.119225] mount_root: jffs2 not ready yet, using temporary tmpfs overlay [ 9.155368] urandom-seed: Seed file not found (/etc/urandom.seed) [ 9.366868] eth1: link down [ 9.384213] procd: - early - [ 9.387279] procd: - watchdog - [ 10.053374] procd: - watchdog - [ 10.056949] procd: - ubus - [ 10.144667] urandom_read: 5 callbacks suppressed [ 10.144677] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.235794] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.244087] procd: - init - [ 11.022820] kmodloader: loading kernel modules from /etc/modules.d/* [ 11.178614] urngd: v1.0.0 started. [ 11.201102] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 11.227605] Loading modules backported from Linux version v4.19.85-0-gc63ee2939dc1 [ 11.235370] Backport generated by backports.git v4.19.85-1-0-g8a8be258 [ 11.269625] ip_tables: (C) 2000-2006 Netfilter Core Team [ 11.294845] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 11.438681] xt_time: kernel timezone is -0000 [ 11.549038] random: crng init done [ 11.559448] PPP generic driver version 2.4.2 [ 11.566832] NET: Registered protocol family 24 [ 11.619509] ath: EEPROM regdomain: 0x0 [ 11.619520] ath: EEPROM indicates default country code should be used [ 11.619525] ath: doing EEPROM country->regdmn map search [ 11.619543] ath: country maps to regdmn code: 0x3a [ 11.619550] ath: Country alpha2 being used: US [ 11.619555] ath: Regpair used: 0x3a [ 11.635410] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 11.637530] ieee80211 phy0: Atheros AR9340 Rev:2 mem=0xb8100000, irq=12 [ 11.709270] kmodloader: done loading kernel modules from /etc/modules.d/* [ 56.396325] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 [ 56.443723] jffs2_build_filesystem(): unlocking the mtd device... [ 56.443735] done. [ 56.452038] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 56.719169] br-lan: port 1(eth1) entered blocking state [ 56.732131] br-lan: port 1(eth1) entered disabled state [ 56.737835] device eth1 entered promiscuous mode [ 56.809304] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 56.872148] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 57.939013] eth0: link up (1000Mbps/Full duplex) [ 57.943749] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 58.820338] eth1: link up (100Mbps/Half duplex) [ 58.825006] br-lan: port 1(eth1) entered blocking state [ 58.830365] br-lan: port 1(eth1) entered forwarding state [ 58.899837] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 70.904407] done. [ 70.906415] jffs2: notice: (1245) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 71.131853] overlayfs: upper fs does not support tmpfile.