OpenWrt 15.05.1 on Wi-Next Naawigo Mini N

Recently I’ve come around an old access point that I completely forgot about.
It’s a Wi-Next Naawigo Mini N that, years ago, I put in a closet bacause it had a locked firmware that made it useless.

Naawigo Mini N frontNaawigo Mini N rear

When I saw it again I tought it could be of some use if only I could manage to flash OpenWrt on it.
Well, I took it apart and discovered something very interesting:

Naawigo Mini N board frontNaawigo Mini N board front without MiniPCI cardNaawigo Mini N board rearNaawigo Mini N MiniPCI wireless card WLE200NX

A quick visit to Google Search and Google Images revealed that this board is a common Compex WPE72, already supported by OpenWrt!
I also learnt that its stock firmware is based on a customized OpenWrt distribution by Wi-Next.

Prerequisites

Technical Specifications

System-on-a-Chip:

Model: Atheros AR7240
CPU: MIPS 24Kc @400MHz

RAM:

Model: Etrontec EM6AA160TSB-5G
Capacity: 32MB @200MHz

Flash:

Model: Macronix MX25L6405D
Capacity: 8MB

Ethernet NIC:

Model: Integrated
Protocol: Fast Ethernet

Wireless NIC:

Model: Compex WLE200NX (Dual Band 2×2 MIMO 802.11n Module)
Chipset: Atheros AR9280
Protocol: 802.11abgn

I/O:

RJ45 connectors: 2x 100Mbps Ethernet
MiniPCI slot: 1x 9.2mm

Procedure

Firmware upgrade

Set this static IP on your PC ethernet interface:

  • Address: 192.168.168.2
  • Mask: 255.255.255.0

Leave all the other fields blank.
Then:

  1. Turn off the Naawigo
  2. Connect the ethernet cable to the Naawigo LAN port
  3. Take a PIN and start pressing the reset button
  4. Power on the Naawigo
  5. As soon as the diagnostic LED starts blinking, release the reset button

The device bootloader is now on recovery mode. You should be able to ping the 192.168.168.1 address (otherwise, repeat the previous steps).

Open your terminal and upload the firmware file with these commands:

$ tftp 192.168.168.1
tftp> binary
tftp> trace
tftp> put openwrt-15.05.1-ar71xx-generic-wpe72-squashfs-8M-factory.img

When the device diagnostic LED start blinking slowly you can reboot your device.
OpenWrt will boot and respond at 192.168.1.1!

You can change the root password issuing the passwd command via telnet:

telnet 192.168.1.1
root$ passwd

You can now access OpenWrt web configuration page or SSH terminal.

OpenWrt Kernel log

[    0.000000] Linux version 3.18.23 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r47269) ) #1 Sun Jan 31 18:39:35 CET 2016
[    0.000000] MyLoader: sysp=20021107, boardp=20021103, parts=03110220
[    0.000000] MyLoader: id=11f6:0672, sub_id=11f6:0672
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR7240 rev 2
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x01ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x01ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x01ffffff]
[    0.000000] On node 0 totalpages: 8192
[    0.000000] free_area_init_node: node 0, pgdat 803762b0, node_mem_map 81000000
[    0.000000]   Normal zone: 64 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 8192 pages, LIFO batch:0
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  board=WPE72 ethaddr=00:80:48:75:dd:c3 console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 28324K/32768K available (2586K kernel code, 128K rwdata, 540K rodata, 256K init, 193K bss, 4444K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:5.000MHz
[    0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100000] NET: Registered protocol family 16
[    0.100000] MIPS: machine is Compex WPE72
[    1.540000] registering PCI controller with io_map_base unset
[    1.560000] PCI host bridge to bus 0000:00
[    1.560000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    1.570000] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.570000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.580000] pci 0000:00:00.0: [168c:002a] type 00 class 0x028000
[    1.580000] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x0000ffff 64bit]
[    1.580000] pci 0000:00:00.0: supports D1
[    1.580000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.580000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    1.580000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[    1.580000] pci 0000:00:00.0: using irq 40 for pin 1
[    1.590000] Switched to clocksource MIPS
[    1.590000] NET: Registered protocol family 2
[    1.600000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    1.600000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.610000] TCP: Hash tables configured (established 1024 bind 1024)
[    1.620000] TCP: reno registered
[    1.620000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.630000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.630000] NET: Registered protocol family 1
[    1.640000] PCI: CLS 0 bytes, default 32
[    1.640000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    1.670000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.670000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.680000] msgmni has been set to 55
[    1.690000] io scheduler noop registered
[    1.690000] io scheduler deadline registered (default)
[    1.700000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    1.710000] console [ttyS0] disabled
[    1.730000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 12500000) is a 16550A
[    1.740000] console [ttyS0] enabled
[    1.750000] bootconsole [early0] disabled
[    1.760000] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    1.760000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    1.770000] spi0.0: searching for MyLoader partition table at offset 0x10000
[    1.770000] spi0.0: searching for MyLoader partition table at offset 0x20000
[    1.770000] 3 MyLoader partitions found on MTD device spi0.0
[    1.770000] Creating 3 MTD partitions on "spi0.0":
[    1.780000] 0x000000000000-0x000000020000 : "myloader"
[    1.790000] 0x000000020000-0x000000030000 : "partition_table"
[    1.790000] 0x000000030000-0x000000400000 : "firmware"
[    1.810000] 2 lzma-fw partitions found on MTD device firmware
[    1.820000] 0x000000030000-0x000000150000 : "kernel"
[    1.820000] 0x000000150000-0x000000400000 : "rootfs"
[    1.830000] mtd: device 4 (rootfs) set to be root filesystem
[    1.830000] 1 squashfs-split partitions found on MTD device rootfs
[    1.840000] 0x000000380000-0x000000400000 : "rootfs_data"
[    1.880000] libphy: ag71xx_mdio: probed
[    2.470000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:04 [uid=004dd041, driver=Generic PHY]
[    2.480000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    3.070000] ag71xx-mdio.0: Found an AR7240/AR9330 built-in switch
[    3.110000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    3.120000] TCP: cubic registered
[    3.120000] NET: Registered protocol family 17
[    3.120000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    3.140000] Bridge firewalling registered
[    3.140000] 8021q: 802.1Q VLAN Support v1.8
[    3.160000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    3.160000] Freeing unused kernel memory: 256K (80390000 - 803d0000)
[    4.510000] init: Console is alive
[    4.510000] init: - watchdog -
[    6.140000] usbcore: registered new interface driver usbfs
[    6.140000] usbcore: registered new interface driver hub
[    6.150000] usbcore: registered new device driver usb
[    6.160000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    6.170000] ehci-platform: EHCI generic platform driver
[    6.180000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    6.190000] ohci-platform: OHCI generic platform driver
[    6.190000] ohci-platform ohci-platform: Generic Platform OHCI controller
[    6.200000] ohci-platform ohci-platform: new USB bus registered, assigned bus number 1
[    6.210000] ohci-platform ohci-platform: irq 3, io mem 0x1b000000
[    6.270000] hub 1-0:1.0: USB hub found
[    6.270000] hub 1-0:1.0: 1 port detected
[    6.610000] init: - preinit -
[    7.310000] random: mktemp urandom read with 11 bits of entropy available
[    8.860000] eth1: link up (1000Mbps/Full duplex)
[   10.650000] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[   10.700000] eth1: link down
[   10.710000] procd: - early -
[   10.720000] procd: - watchdog -
[   11.630000] procd: - ubus -
[   12.640000] procd: - init -
[   13.600000] NET: Registered protocol family 10
[   13.620000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.640000] Loading modules backported from Linux version master-2015-03-09-0-g141f155
[   13.650000] Backport generated by backports.git backports-20150129-0-gdd4a670
[   13.660000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.680000] nf_conntrack version 0.5.0 (446 buckets, 1784 max)
[   13.730000] xt_time: kernel timezone is -0000
[   13.770000] cfg80211: Calling CRDA to update world regulatory domain
[   13.800000] cfg80211: World regulatory domain updated:
[   13.800000] cfg80211:  DFS Master region: unset
[   13.810000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   13.820000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   13.820000] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz, 92000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[   13.830000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   13.840000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[   13.850000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   13.860000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   13.870000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   13.880000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   13.960000] PPP generic driver version 2.4.2
[   13.970000] NET: Registered protocol family 24
[   14.450000] ath: EEPROM regdomain: 0x0
[   14.450000] ath: EEPROM indicates default country code should be used
[   14.450000] ath: doing EEPROM country->regdmn map search
[   14.450000] ath: country maps to regdmn code: 0x3a
[   14.450000] ath: Country alpha2 being used: US
[   14.450000] ath: Regpair used: 0x3a
[   14.470000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   14.480000] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xb0000000, irq=40
[   14.490000] cfg80211: Calling CRDA for country: US
[   14.490000] cfg80211: Regulatory domain changed to country: US
[   14.500000] cfg80211:  DFS Master region: FCC
[   14.500000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   14.510000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[   14.520000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2300 mBm), (N/A)
[   14.530000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2300 mBm), (0 s)
[   14.540000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2300 mBm), (0 s)
[   14.550000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[   14.550000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[   24.640000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   24.640000] jffs2_build_filesystem(): unlocking the mtd device... done.
[   24.650000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[   27.490000] jffs2: notice: (966) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   28.220000] device eth1 entered promiscuous mode
[   28.230000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   28.300000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   30.340000] eth1: link up (1000Mbps/Full duplex)
[   30.340000] br-lan: port 1(eth1) entered forwarding state
[   30.350000] br-lan: port 1(eth1) entered forwarding state
[   30.520000] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   32.350000] br-lan: port 1(eth1) entered forwarding state
[   62.840000] eth1: link down
[   62.840000] br-lan: port 1(eth1) entered disabled state
[   64.520000] eth0: link up (100Mbps/Full duplex)
[   64.520000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   75.740000] random: nonblocking pool is initialized

Original firmware

This device comes with a fancy custom distribution of OpenWrt: N.A.A.W.IGO Black Mirto (Revision 5e5b6e0).
Being based on OpenWrt, it inherits its filesafe mode. It could be triggered pressing repeatedly the reset button after the power on. It could be identified by the diagnostic LED blinking faster then ususal

Once in failsafe mode, you can access the system terminal via telnet at 192.168.1.1.

welcome screen

 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------


BusyBox v1.19.3 (2012-06-26 13:55:24 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______      _______      _______      ________
 |    |  |    |   _   |    |   _   |    |  |  |  |
 |       | __ |       | __ |       | __ |  |  |  | __
 |__|____||__||___|___||__||___|___||__||________||__|
  __  _______                 __  _
 |__||     __|.-----.     .-.'  `; `-._  __  _
 |  ||    |  ||  _  |    (_,         .-:'  `; `-._
 |__||_______||_____|  ,'o"(        (_,           )
                      (__,-'      ,'o"(            )>
                         (       (__,-'            )
                          `-'._.--._(             )
                             |||  |||`-'._.--._.-'
 Pure Mesh, Pure NAAW. ________________ |||  ||| _____
 BLACK MIRTO (Revision 5e5b6e0) -------------------------

root@(none):/#

Change root password

mount_root
passwd

It’s now possible to access the stock web interface using this new password.

Partition table

root@(none):/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "myloader"
mtd1: 00010000 00010000 "partition_table"
mtd2: 000e0000 00010000 "kernel"
mtd3: 006f0000 00010000 "rootfs"
mtd4: 003a0000 00010000 "rootfs_data"

Links:

  1. Compex WP72 on OpenWrt wiki

Tags: , , , ,

Rispondi

Questo sito usa Akismet per ridurre lo spam. Scopri come i tuoi dati vengono elaborati.