Cudy AP3000 Indoor AKA Jupiter 2 and OpenWRT: Difference between revisions
mNo edit summary |
mNo edit summary |
||
| Line 1: | Line 1: | ||
= Installing OpenWRT on Cudy AP3000 | =Installing OpenWRT on a Cudy AP3000 (Indoor, AKA the Jupiter 2)= | ||
== Overview == | ==Overview== | ||
How about following the instructions on the OpenWRT.org website for a similar device (with the EXACT same CPU, WiFi, etc.): https://openwrt.org/toh/cudy/tr3000 | |||
Nope. Sadly Cudy doesn't make an InitRAMFS BIN file for the AP3000 (Indoor), even though the file for the AP3000 would work it weren't for their gosh darned 'security feature' of having a signed file. Side note: Is there really an instance where this has helped an end user, or is it about manufacturer control? | |||
== U-Boot Setup and Memory Layout == | Anyway, that's out, so what about a TTY / Serial session? Not a chance. Why? Well: ethernet@15100000 Waiting for PHY auto negotiation to complete......... TIMEOUT ! It appears that the u-boot image is busted in that the Ethernet Interface does NOT work. It shows as 'active', but no link light on a switch and it just doesn't work. Blame this guy: U-Boot 2022.07-rc3 (Sep 01 2023 - 07:34:59 +0000), Build: jenkins-AP3000-19 (well, either he did it, didn't know what he did, or was told to do it, in any instance, is doesn't help the end owner of the device that wants OpenWRT installed) | ||
But there is a solution: TTY / Serial | |||
No details here on what is needed for that as there is plenty of information out there. This website has some pictures: https://eko.one.pl/forum/viewtopic.php?id=24096 Oh, and great spot for the vias to solder in some pins, right? Well good news is that there is lots of space if one solders the pins on the backside of the PCB. | |||
==Hardware Setup== | |||
*Target Device: Cudy AP3000 (MediaTek MT7981 SoC) | |||
*Access: Serial console via FTDI or CH340 USB-UART adapter | |||
*Host OS: Rocky Linux 9 | |||
*Tools used: `sx`, `loadx`, `iminfo`, `bootm`, `LuCI` | |||
==U-Boot Setup and Memory Layout== | |||
From `bdinfo` output: | From `bdinfo` output: | ||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
! Item !! Value | !Item!!Value | ||
|- | |- | ||
| DRAM Start || 0x40000000 | |DRAM Start||0x40000000 | ||
|- | |- | ||
| DRAM Size || 0x20000000 (512 MiB) | |DRAM Size||0x20000000 (512 MiB) | ||
|- | |- | ||
| U-Boot Relocated Addr || ~0x5ff38000 | |U-Boot Relocated Addr||~0x5ff38000 | ||
|- | |- | ||
| Reserved Region || 0x5f7fb170 – 0x5fffffff | |Reserved Region||0x5f7fb170 – 0x5fffffff | ||
|} | |} | ||
=== Safe RAM Load Addresses === | ===Safe RAM Load Addresses=== | ||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
! Label !! Address !! Offset (from 0x40000000) !! Status | !Label!!Address!!Offset (from 0x40000000)!!Status | ||
|- | |- | ||
| Known Good || 0x42000000 || 32 MB || ✅ SAFE | |Known Good||0x42000000||32 MB||✅ SAFE | ||
|- | |- | ||
| Default (`loadaddr`) || 0x46000000 || 96 MB || ✅ OK (tight) | |Default (`loadaddr`)||0x46000000||96 MB||✅ OK (tight) | ||
|- | |- | ||
| High (bad) || 0x48000000 || 128 MB || ❌ Caused crash on decompression | |High (bad)||0x48000000||128 MB||❌ Caused crash on decompression | ||
|} | |} | ||
== Uploading OpenWRT initramfs FIT image == | ==Uploading OpenWRT initramfs FIT image== | ||
=== In U-Boot (via serial) === | ===In U-Boot (via serial)=== | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
setenv bootcmd | setenv bootcmd | ||
| Line 48: | Line 57: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
=== On Host PC === | ===On Host PC=== | ||
Assuming `/dev/ttyUSB0` is your serial device: | Assuming `/dev/ttyUSB0` is your serial device: | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
sx -vv | sx -vv WhatEverNameOfFile.bin < /dev/ttyUSB0 > /dev/ttyUSB0 | ||
</syntaxhighlight> | </syntaxhighlight>...but first download the "InitRAMFS" File from OpenWRT: https://downloads.openwrt.org/releases/24.10.0/targets/mediatek/filogic/ (look for Cudy AP3000, without the 'outdoor' reference, but notice it is the same size file, so probably the same file with a different name) | ||
=== Image Inspection in U-Boot === | ===Image Inspection in U-Boot=== | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
iminfo 0x42000000 | iminfo 0x42000000 | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Result: | Result (partial): | ||
* FIT image detected | |||
* Kernel: LZMA compressed, load/entry address: 0x48000000 | *FIT image detected | ||
* initrd and FDT present and hash-verified | *Kernel: LZMA compressed, load/entry address: 0x48000000 | ||
*initrd and FDT present and hash-verified | |||
== Booting the Image == | ==Booting the Image== | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
bootm 0x42000000 | bootm 0x42000000 | ||
| Line 71: | Line 81: | ||
This succeeded once the image was loaded at `0x42000000` — avoiding the earlier problem of overlapping the kernel decompress target address `0x48000000`. | This succeeded once the image was loaded at `0x42000000` — avoiding the earlier problem of overlapping the kernel decompress target address `0x48000000`. | ||
== Permanent Installation == | ==Permanent Installation== | ||
After booting into OpenWRT RAM (initramfs): | After booting into OpenWRT RAM (initramfs): | ||
# Connect to LuCI via web browser (default IP: 192.168.1.1) | #Connect to LuCI via web browser (default IP: 192.168.1.1) | ||
# Navigate to ''System → Backup / Flash Firmware'' | #Navigate to ''System → Backup / Flash Firmware'' | ||
# Upload the permanent OpenWRT SquashFS image (`*-squashfs-sysupgrade.bin`) | #Upload the permanent OpenWRT SquashFS image (`*-squashfs-sysupgrade.bin`) (see above link, and get the SquashFS File) | ||
# Choose "Do not keep settings" | #Choose "Do not keep settings" | ||
# Flash the image and reboot | #Flash the image and reboot | ||
== Final Result == | ==Final Result== | ||
OpenWRT was permanently installed on flash using the SquashFS image, without requiring a network or TFTP boot. All steps were performed over a serial console with full visibility into memory layout and safe load addresses. | OpenWRT was permanently installed on flash using the SquashFS image, without requiring a network or TFTP boot. All steps were performed over a serial console with full visibility into memory layout and safe load addresses. | ||
== Notes == | ==Notes== | ||
* Always verify the image format (`iminfo`) before booting. | |||
* Do not load images to `0x48000000` if that is also the decompress target. | *Always verify the image format (`iminfo`) before booting. | ||
* To make this repeatable, avoid saving `bootcmd` unless a custom autoboot is configured. | *Do not load images to `0x48000000` if that is also the decompress target. | ||
*To make this repeatable, avoid saving `bootcmd` unless a custom autoboot is configured. | |||
Revision as of 19:24, 25 March 2025
Installing OpenWRT on a Cudy AP3000 (Indoor, AKA the Jupiter 2)
Overview
How about following the instructions on the OpenWRT.org website for a similar device (with the EXACT same CPU, WiFi, etc.): https://openwrt.org/toh/cudy/tr3000
Nope. Sadly Cudy doesn't make an InitRAMFS BIN file for the AP3000 (Indoor), even though the file for the AP3000 would work it weren't for their gosh darned 'security feature' of having a signed file. Side note: Is there really an instance where this has helped an end user, or is it about manufacturer control?
Anyway, that's out, so what about a TTY / Serial session? Not a chance. Why? Well: ethernet@15100000 Waiting for PHY auto negotiation to complete......... TIMEOUT ! It appears that the u-boot image is busted in that the Ethernet Interface does NOT work. It shows as 'active', but no link light on a switch and it just doesn't work. Blame this guy: U-Boot 2022.07-rc3 (Sep 01 2023 - 07:34:59 +0000), Build: jenkins-AP3000-19 (well, either he did it, didn't know what he did, or was told to do it, in any instance, is doesn't help the end owner of the device that wants OpenWRT installed)
But there is a solution: TTY / Serial
No details here on what is needed for that as there is plenty of information out there. This website has some pictures: https://eko.one.pl/forum/viewtopic.php?id=24096 Oh, and great spot for the vias to solder in some pins, right? Well good news is that there is lots of space if one solders the pins on the backside of the PCB.
Hardware Setup
- Target Device: Cudy AP3000 (MediaTek MT7981 SoC)
- Access: Serial console via FTDI or CH340 USB-UART adapter
- Host OS: Rocky Linux 9
- Tools used: `sx`, `loadx`, `iminfo`, `bootm`, `LuCI`
U-Boot Setup and Memory Layout
From `bdinfo` output:
| Item | Value |
|---|---|
| DRAM Start | 0x40000000 |
| DRAM Size | 0x20000000 (512 MiB) |
| U-Boot Relocated Addr | ~0x5ff38000 |
| Reserved Region | 0x5f7fb170 – 0x5fffffff |
Safe RAM Load Addresses
| Label | Address | Offset (from 0x40000000) | Status |
|---|---|---|---|
| Known Good | 0x42000000 | 32 MB | ✅ SAFE |
| Default (`loadaddr`) | 0x46000000 | 96 MB | ✅ OK (tight) |
| High (bad) | 0x48000000 | 128 MB | ❌ Caused crash on decompression |
Uploading OpenWRT initramfs FIT image
In U-Boot (via serial)
setenv bootcmd
setenv bootdelay -1
loadx 0x42000000On Host PC
Assuming `/dev/ttyUSB0` is your serial device:
sx -vv WhatEverNameOfFile.bin < /dev/ttyUSB0 > /dev/ttyUSB0...but first download the "InitRAMFS" File from OpenWRT: https://downloads.openwrt.org/releases/24.10.0/targets/mediatek/filogic/ (look for Cudy AP3000, without the 'outdoor' reference, but notice it is the same size file, so probably the same file with a different name)
Image Inspection in U-Boot
iminfo 0x42000000Result (partial):
- FIT image detected
- Kernel: LZMA compressed, load/entry address: 0x48000000
- initrd and FDT present and hash-verified
Booting the Image
bootm 0x42000000This succeeded once the image was loaded at `0x42000000` — avoiding the earlier problem of overlapping the kernel decompress target address `0x48000000`.
Permanent Installation
After booting into OpenWRT RAM (initramfs):
- Connect to LuCI via web browser (default IP: 192.168.1.1)
- Navigate to System → Backup / Flash Firmware
- Upload the permanent OpenWRT SquashFS image (`*-squashfs-sysupgrade.bin`) (see above link, and get the SquashFS File)
- Choose "Do not keep settings"
- Flash the image and reboot
Final Result
OpenWRT was permanently installed on flash using the SquashFS image, without requiring a network or TFTP boot. All steps were performed over a serial console with full visibility into memory layout and safe load addresses.
Notes
- Always verify the image format (`iminfo`) before booting.
- Do not load images to `0x48000000` if that is also the decompress target.
- To make this repeatable, avoid saving `bootcmd` unless a custom autoboot is configured.