Huawei AP4050DN

Hardware Questions and Recommendations
1

HI is it possible to install openWRT on the AP4050DN ? I know it's possible on some of the other modes but can't find any info for this model.

2

Depends on the hw inside, but usually, it's not.

3

According to pictures on the FCC website it's based on the IPQ4018 SOC.
Internal-Photos-3095970.pdf

So it's theoretically supportable, there are many devices with this chip on the TOH.
But someone has to do the integration work for the specific device:
https://openwrt.org/docs/guide-developer/add.new.device

4

I have a couple of these and never even considered OpenWRT as a possibility :slight_smile:

The web UI is super slow, would be nice to have something faster but its not clear to me whether its the hardware or software that's the limitation.

But I have to ask @FaisalAhmed why do you want OpenWRT on this device?

5

I'm currently working on a device port for the AP4050DN. Ramboot works fine (incl. ethernet and wifi). However one challenge is that the Huawei-modified u-boot only loads 2 MB (hard-coded value) from flash when booting, however recent kernels are ~3.6 MB in size. And unfortunately there is no loader for the ipq40xx target implemented yet which could be used as a workaround for that.
I'm able to run this u-boot on the AP with just a few modifications, which could be a solution to the problem.
So let's see how it all works out.

6

Hey guys! I have an AP4050DN for experiments. There is a programmer for flash memory. I have the necessary skills. I'm starting to explore the possibility of installing Openwrt. The main goal is to enable roaming on the same type of access points. I've soldered out the flash memory, downloaded the dump, and am studying the structure. I don't have much free time. If you have any suggestions or recommendations, please let us know.

7

binwalk -e -M

capture serial boot log

brek uboot timer and check if it permits netboot (printenv and help commands)

8

Hey guys!

I will post all the materials here - [https://disk.yandex.ru/d/ELRJbA2Ar1M_Qw]

This may not be the most active place to hold such events, please point me to the best place to discuss it.

What's done:

  1. A complete dump of the device's memory has been analyzed, partitions have been identified, and the structure is clear.

  2. I have saved the full download log, it is probably impossible to interrupt the device boot and access the bootloader. I managed to access the downloaded device in the terminal, the login and passwords correspond to the user on the device's web page.

  3. I found the uboot loader-fritz4040.bin, maybe it's from a similar platform. But it is not yet clear which partition to download it to.

  4. I would appreciate some good material describing the process of booting a device from an ipq40xx or similar device. I've looked through a few materials, but I haven't found anything useful. It is unclear to me whether it is possible to boot this system in an insecure mode, without the need to use the first partitions.

  5. While I was messing with the motherboard, I probably burned the PCA9555, as the system is now clearly swearing at the unavailability of the I/O ports at boot and referring to the specified chip. This approach to programming really surprises me. I am buying a new chip, I hope for a successful repair. I'm not discouraged, I have another device to experiment with.

9

Hi,

I have most things working, however there are some nasty details.
You can find my changes to the OpenWrt repo here: https://github.com/Selfnet/openwrt/tree/huawei-ap4050dn-dev

Now the nasty details:

  • The Huawei u-boot has a hardcoded value to only load 2MB into memory initially. However, the kernel used by OpenWrt is ~3.3MB in size. This 2MB limit is not changeable via environment variables or anything else, just binary patching the u-boot code might be an option (however this is of course dangerous).
  • The solution in the ath79 target would be to use its LZMA loader, however, there is no such loader for the ipq40xx target yet, and it would be a lot harder to implement since there is much more to do to even get the console working than in ath79.
  • You can make some small changes to the u-boot code mentioned earlier. The idea would be to use this u-boot as a loader for the actual OpenWrt image. However, I haven't found a way yet to set the baud rate to 9600 baud to match that of the Huawei u-boot. You can find my changes here: https://github.com/CodingMarco/u-boot/tree/huawei_ap4050dn
  • I personally find u-boot development hard. It is often very close to bare-metal programming and EVERYTHING has to be correct for the device to even show one character on the console. For example, the CONFIG_SYS_LOAD_ADDR defined in include/configs/huawei_ap4050dn.h has to match the UBOOT_LOADADDR address specified in huaweicreator.sh which is finally written to the uImage header, just like the CONFIG_SYS_TEXT_BASE.
  • These hacks are already quite hard to do in an experimental/manual setup, and getting this reasonably clean for upstream, incl. getting it into the OpenWrt build system will be much harder.

@locman-kansk but please go ahead, at the moment I don't have much time to work on this. But at some time I'll make this work if you haven't done so because my association where I'm volunteering has 350 AP4050DNs to give a second life to :slight_smile: I just can't promise any timeline.

10

I already have the device, but don't have a Huawei AP management server/device and don't want to be paying per year in lisences

11

Patience, the router itself is distributed in very few countries, it is not like tplink that is in every laundry machine store in the world.

12

Hi guys!

@CodingMarco thank you for your quick response and detailed information, I will study it. I have a question for you, which partition do you download your modified u-boot into? In the APPSBL? The flash structure consists of two parts, with almost identical sections. I realized that this is both the main and backup parts, you can upgrade one shoulder and switch between them. The device contains two APPSBL partitions. Are you loading u-boot into both? Do you also do this by programming flash memory, or do you have another method?

Performed a small reengineering of the device. Using a multimeter, I identified all the connections between the main input and output elements. I drew a diagram. https://disk.yandex.ru/i/x7gbL6yL-7gNhQ

If you find any inconsistencies, write to me or fix it yourself, the source code is very simple in MS Word, it is located in a shared folder, I provided the link earlier.

There are quite a few devices built on IPQ4018 https://github.com/openwrt/openwrt/tree/master/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom

I don't have complete information and confidence, but it seems to me that it is possible to analyze the hardware composition of all devices and find the most similar HW. After that, in accordance with the scheme, adjust the dts file, and you can try to build both the loader and the image.

Express your ideas!!!

13

@FaisalAhmed You do know it can be run in FAT mode? There are two different firmwares available from Huawei if I recall correctly. If you flash the FAT & Cloud version you don't need an AP (you don't need to connect it to their cloud either), but you have to manually manage the settings and updates from the web interface on the WAP.

14

These are my notes from a few months back regarding the boot sequence:

  • 0:APPSBL (Primary) is always booted first. So don't touch it.
    • If 0:APPSBL changed AND 1:APPSBL not changed, boot 1:APPSBL as Secondary
      • Which then starts the FW which copies bootimageA/B to (0/1??):APPSBL to repair it
    • Else print "The normal boot is damaged. update nor boot from image" and copy 0:APPSBL to 1:APPSBL and boot (changed??) (0/1??):APPSBL as Secondary

So I would say as far as you don't modify 0:APPSBL, you can write your u-boot to bootimageA or bootimageB if you want to use it as loader.
If you wanted to completely replace the Huawei u-boot, you may have to write it to multiple of the four partitions to prevent an earlier boot stage to overwrite it again. However, keep in mind that without the Huawei u-boot, the PHY doesn't work (I couldn't figure out, probably some power up sequence is missing as you can't even read the PHY's MDIO registers).

I used both an FT232H based flash programmer with the flashrom tool (hint: A divider >=4 must be used, eg. flashrom -p ft2232_spi:type=232H,divisor=4!) and my OpenWrt ramboot image to write the u-boot to flash.

Btw, here are all my notes (but they are very unstructured): https://pad.hacknang.de/openwrt-huawei-ap4050dn

15

FYI, I started to actively work on this again. You can expect the AP4050DN to be upstream in the next few months (largely thanks to in-person support from one of the OpenWrt maintainers at various hacking events here in Germany) :slight_smile:

16

OpenWrt support for AP4050DN is ready: https://github.com/openwrt/openwrt/commit/cd1b70f6f9ce95eed4284af2bfddab912736c62f

However, only on the main branch (SNAPSHOT) for now. It should be included in upcoming stable releases, but I don’t know when exactly that will be.

17

In roughly 12 months.
You can however create a back port PR, then it'll be in the next minor release of 25.12.

18

Hello!
Downloaded uImage, huawei_ap4050dn-...

Looping reboot

Board Type: 0x148

Welcome To HUAWEI Wlan World

U-Boot 628 (Jul 29 2020 - 18:28:44)

BOOT: Secondary
Press CTRL+T for Full Memory Test in 1 Seconds: 0
Net: Ethernet Mac: 8C-42-6D-0F-EC-60
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Boot Kernel A Address: 0x00
Boot Kernel B Address: 0x00

Start Up time(s) : 2
Image: Current Bootup is A

Press f or F to stop Auto-Boot in 3 seconds: 0
Wrong Image Format for bootm command
ERROR: can't get kernel image!
bootm fail
resetting ...
DRAM: 256 MB
NOR: 64 MB
BOOT: Primary
Start up the normal boot...

Resettinâ–’NOR: 64 MB

19

sorry, crystal ball's offline, we have no idea what you did before you ran into the boot issue ...

20

put it here { dd if=/dev/zero bs=32 count=1 2>/dev/null; \ cat openwrt-ipq40xx-generic-huawei_ap4050dn-initramfs-uImage.itb; \ } > ramboot.bin

...
run ramboot

Loading successfully! ssh root@192.168.1.1

scp -O uImage root@192.168.1.1:/tmp
scp -O openwrt-ipq40xx-generic-huawei_ap4050dn-squashfs-sysupgrade.bin root@192.168.1.1:/tmp

  mtd erase uboot
  mtd write /tmp/uImage uboot
  sysupgrade -n /tmp/openwrt-ipq40xx-generic-huawei_ap4050dn-squashfs-sysupgrade.bin