Huawei AP5030DN

From TechInfoDepot
Jump to navigationJump to search
abgn+ac (AC1750)
Wireless Access Point
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
BrandModelRev Huawei AP5030DN
FCC ID (fcc.io) QISAP5030DN
FCC ID (fcc.report) QISAP5030DN
Type access point
CPU1 checkY Qualcomm Atheros QCA9550
CPU1 Type MIPS 74Kc
CPU1 Speed 720 MHz
Flash1 Chip Brand? Model?
Flash1 Size 32 MiB 33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br /> (SPI NOR)
RAM1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (DDR2)
RAM1 Chip Brand? Model?
ETH chip1 Qualcomm Atheros QCA9550
ETH chip2 Broadcom B50612E
ETH chip3 Marvell 88E1510
Ethernet Port Count 2-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: none specified

Expansion IF types none specified
Power 12 VDC, 2 A
Connector type barrel
Serial Port (UART) yes, (9600 8N1)

Flags:
PoE

Other
3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Radio 1
Chip1 Qualcomm Atheros QCA9550
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 3x3:3
Wireless Standard IEEE 802.11b/g/n
802.11n up to 450 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Chip1 Qualcomm Atheros QCA9880
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 3x3:3
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 1300 Mbps
802.11n up to 450 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.
For a list of all currently documented Marvell chipsets with specifications, see Marvell.
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented Huawei devices with specifications, see Huawei.

450 Mbps - 3SS 2.4GHz 802.11n (40MHz chan.),
1300 Mbps - 3SS 5GHz 802.11ac (80MHz chan.) = AC1750 class

Flashing

Flashing OpenWrt

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
Supported Since Commit
Support started version: 23.05.4
Current supported version: 25.12.2
LAN Comment: Broadcom B50612E GbE PHY, Marvell 88E1510 GbE PHY
WLAN Hardware: Qualcomm Atheros QCA9550, Qualcomm Atheros QCA9880
Installation method(s):
U-Boot TFTP + serial recovery, see git-commit
Install Comment:
use hidden "run ramboot" script
git • >>
ath79: add support for Huawei AP5030DN
Huawei AP5030DN is a dual-band, dual-radio 802.11ac Wave 1 3x3 MIMO
enterprise access point with two Gigabit Ethernet ports and PoE
support.

Hardware highlights:
- CPU: QCA9550 SoC at 720MHz
- RAM: 256MB DDR2
- Flash: 32MB SPI-NOR
- Wi-Fi 2.4GHz: QCA9550-internal radio
- Wi-Fi 5GHz: QCA9880 PCIe WLAN SoC
- Ethernet 1: 10/100/1000 Mbps Ethernet through Broadcom B50612E PHY
- Ethernet 2: 10/100/1000 Mbps Ethernet through Marvell 88E1510 PHY
- PoE: input through Ethernet 1 port
- Standalone 12V/2A power input
- Serial console externally available through RJ45 port
- External watchdog: SGM706 (1.6s timeout)

Serial console:
  9600n8 (9600 baud, no stop bits, no parity, 8 data bits)

MAC addresses:
  Each device has 32 consecutive MAC addresses allocated by
  the vendor, which don't overlap between devices.
  This was confirmed with multiple devices with consecutive
  serial numbers.
  The MAC address range starts with the address on the label.
  To be able to distinguish between the interfaces,
  the following MAC address scheme is used:
    - eth0 = label MAC
    - eth1 = label MAC + 1
    - radio0 (Wi-Fi 5GHz) = label MAC + 2
    - radio1 (Wi-Fi 2.4GHz) = label MAC + 3

Installation:
0. Connect some sort of RJ45-to-USB adapter to "Console" port of the AP

1. Power up the AP

2. At prompt "Press f or F  to stop Auto-Boot in 3 seconds",
   do what they say.
   Log in with default admin password "admin@huawei.com".

3. Boot the OpenWrt initramfs from TFTP using the hidden script
   "run ramboot". Replace IP address as needed:

   > setenv serverip 192.168.1.10
   > setenv ipaddr 192.168.1.1
   > setenv rambootfile
     openwrt-ath79-generic-huawei_ap5030dn-initramfs-kernel.bin
   > saveenv
   > run ramboot

4. Optional but recommended as the factory firmware cannot
   be downloaded publicly:
   Back up contents of "firmware" partition using the web interface or ssh:

   $ ssh root@192.168.1.1 cat /dev/mtd11 > huawei_ap5030dn_fw_backup.bin

5. Run sysupgrade using sysupgrade image. OpenWrt
   shall boot from flash afterwards.

Return to factory firmware (using firmware upgrade package downloaded from
non-public Huawei website):
1. Start a TFTP server in the directory where
   the firmware upgrade package is located

2. Boot to u-boot as described above

3. Install firmware upgrade package and format the config partitions:

   > update system FatAP5X30XN_SOMEVERSION.bin
   > format_fs

Return to factory firmware (from previously created backup):
1. Copy over the firmware partition backup to /tmp,
   for example using scp

2. Use sysupgrade with force to restore the backup:
   sysupgrade -F huawei_ap5030dn_fw_backup.bin

3. Boot AP to U-Boot as described above

Quirks and known issues
-----------------------

- On initial power-up, the Huawei-modified bootloader suspends both
ethernet PHYs (it sets the "Power Down" bit in the MII control
register). Unfortunately, at the time of the initial port, the kernel
driver for the B50612E/BCM54612E PHY behind eth0 doesn't have a resume
callback defined which would clear this bit. This makes the PHY unusable
since it remains suspended forever. This is why the backported kernel
patches in this commit are required which add this callback and for
completeness also a suspend callback.

- The stock firmware has a semi dual boot concept where the primary
kernel uses a squashfs as root partition and the secondary kernel uses
an initramfs. This dual boot concept is circumvented on purpose to gain
more flash space and since the stock firmware's flash layout isn't
compatible with mtdsplit.

- The external watchdog's timeout of 1.6s is very hard to satisfy
during bootup. This is why the GPIO15 pin connected to the watchdog input
is configured directly in the LZMA loader to output the CPU_CLK/4 signal
which keeps the watchdog happy until the wdt-gpio kernel driver takes
over. Because it would also take too long to read the whole kernel image
from flash, the uImage header only includes the loader which then reads
the kernel image from flash after GPIO15 is configured.