aio-3399b/ImmortalWrt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mediatek: add Comfast CF-E393AX support

Browse Source 
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.

Oem firmware is a custom openwrt 21.02 snapshot version.

We can gain access via ssh once we remove the root password.

Hardware specification:
  SoC: MediaTek MT7981A 2x A53
  Flash: 128 MB SPI-NAND
  RAM: 256MB DDR3
  Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
            1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976D
  LEDS: 1x (Red, Blue and Green)
  Button: Reset
  UART: 3.3v, 115200n8
  --------------------------
  | Layout |
  | ----------------- |
  | 4 | VCC GND TX RX | <= |
  | ----------------- |
  --------------------------

Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
   and download the
   configuration(http://apipaddress/computer/config.html).

2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
   Enter 'fakeroot' command then decompress the configuration:
   tar -zxf backup.tar.gz

3. Edit 'etc/shadow', update (remove) root password:
   With password =
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   to
   Without password =
   'root::0:99999:7:::'
   'root::0:99999:7:::'

4. Repack 'etc' directory back to a new backup file:
   tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
   Exit fakeroot - 'exit'

6. Upload new configuration via web interface, now you
   can SSH with the following:

   'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.

   Backup the mtd partitions
   - https://openwrt.org/docs/guide-user/installation/generic.backup

7. Copy openwrt factory firmware to the tmp folder to install via ssh:

   'scp -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa \
   *-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
   root@192.168.10.1:/tmp/'

   'sysupgrade -n -F \
   /tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'

8. Once led has stopped flashing - Connect via ssh with the
   default openwrt ip address - 'ssh root@192.168.1.1'

9. SSH copy the openwrt sysupgrade firmware and upgrade
   as per the default instructions.

Signed-off-by: David Bentham <db260179@gmail.com>
This commit is contained in:
David Bentham 2023-11-10 18:50:38 +00:00 committed by Hauke Mehrtens
parent d0bcb496cf
commit d8f4453bf2
5 changed files with 284 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
package/boot/uboot-envtools/files/mediatek_filogic
View File

@ -57,6 +57,9 @@ cmcc,rax3000m)
;;
esac
;;
comfast,cf-e393ax)
ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x80000"
;;
cetron,ct3003|\
netgear,wax220|\
zbtlink,zbt-z8102ax|\

250
target/linux/mediatek/dts/mt7981a-comfast-cf-e393ax.dts Normal file
View File

@ -0,0 +1,250 @@
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
/dts-v1/;
#include "mt7981.dtsi"
/ {
model = "COMFAST CF-E393AX";
compatible = "comfast,cf-e393ax", "mediatek,mt7981";
aliases {
serial0 = &uart0;
led-boot = &led_red;
led-failsafe = &led_red;
led-running = &led_blue;
led-upgrade = &led_green;
};
chosen {
bootargs-override = "console=ttyS0,115200n8";
stdout-path = "serial0:115200n8";
};
memory {
reg = <0 0x40000000 0 0x10000000>; // 256mb
};
gpio-keys {
compatible = "gpio-keys";
reset {
label = "reset";
linux,code = <KEY_RESTART>;
gpios = <&pio 1 GPIO_ACTIVE_LOW>;
};
};
leds {
compatible = "gpio-leds";
led_blue: blue {
label = "blue:status";
gpios = <&pio 8 GPIO_ACTIVE_LOW>;
color = <LED_COLOR_ID_BLUE>;
function = LED_FUNCTION_STATUS;
};
led_red: red {
label = "red:status";
gpios = <&pio 34 GPIO_ACTIVE_LOW>;
color = <LED_COLOR_ID_RED>;
function = LED_FUNCTION_STATUS;
};
led_green: green {
label = "green:status";
gpios = <&pio 35 GPIO_ACTIVE_LOW>;
color = <LED_COLOR_ID_GREEN>;
function = LED_FUNCTION_STATUS;
};
};
};
&eth {
status = "okay";
gmac0: mac@0 {
/* LAN */
compatible = "mediatek,eth-mac";
reg = <0>;
phy-mode = "2500base-x";
nvmem-cells = <&macaddr_factory_e000 0>;
nvmem-cell-names = "mac-address";
fixed-link {
speed = <2500>;
full-duplex;
pause;
};
};
gmac1: mac@1 {
/* WAN */
compatible = "mediatek,eth-mac";
reg = <1>;
phy-mode = "gmii";
phy-handle = <&int_gbe_phy>;
nvmem-cells = <&macaddr_factory_e000 1>;
nvmem-cell-names = "mac-address";
};
};
&mdio_bus {
switch: switch@1f {
compatible = "mediatek,mt7531";
reg = <31>;
interrupt-controller;
#interrupt-cells = <1>;
interrupt-parent = <&pio>;
interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
};
};
&crypto {
status = "okay";
};
&pio {
spi0_flash_pins: spi0-pins {
mux {
function = "spi";
groups = "spi0", "spi0_wp_hold";
};
conf-pu {
pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
drive-strength = <MTK_DRIVE_8mA>;
bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
};
conf-pd {
pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
drive-strength = <MTK_DRIVE_8mA>;
bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
};
};
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_flash_pins>;
cs-gpios = <0>, <0>;
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
#address-cells = <1>;
#size-cells = <0>;
spi_nand: spi_nand@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "spi-nand";
reg = <1>;
spi-max-frequency = <52000000>;
spi-cal-enable;
spi-cal-mode = "read-data";
spi-cal-datalen = <7>;
spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
spi-cal-addrlen = <5>;
spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
spi-tx-bus-width = <4>;
spi-rx-bus-width = <4>;
mediatek,nmbm;
mediatek,bmt-max-ratio = <1>;
mediatek,bmt-max-reserved-blocks = <64>;
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;
partition@0 {
label = "BL2";
reg = <0x00000 0x0100000>;
read-only;
};
partition@100000 {
label = "u-boot-env";
reg = <0x0100000 0x0080000>;
read-only;
};
factory: partition@180000 {
label = "Factory";
reg = <0x180000 0x0200000>;
read-only;
nvmem-layout {
compatible = "fixed-layout";
#address-cells = <1>;
#size-cells = <1>;
eeprom_factory_0: eeprom@0 {
reg = <0x0 0x1000>;
};
macaddr_factory_e000: macaddr@e000 {
compatible = "mac-base";
reg = <0xe000 0x6>;
#nvmem-cell-cells = <1>;
};
};
};
partition@380000 {
label = "FIP";
reg = <0x380000 0x0200000>;
read-only;
};
partition@580000 {
label = "ubi";
reg = <0x580000 0x4000000>;
compatible = "linux,ubi";
};
};
};
};
&switch {
ports {
#address-cells = <1>;
#size-cells = <0>;
port@0 {
reg = <0>;
label = "lan1";
};
port@6 {
reg = <6>;
label = "cpu";
ethernet = <&gmac0>;
phy-mode = "2500base-x";
fixed-link {
speed = <2500>;
full-duplex;
pause;
};
};
};
};
&uart0 {
status = "okay";
};
&watchdog {
status = "okay";
};
&wifi {
status = "okay";
nvmem-cells = <&eeprom_factory_0>;
nvmem-cell-names = "eeprom";
};

3
target/linux/mediatek/filogic/base-files/etc/board.d/02_network
View File

@ -40,6 +40,9 @@ mediatek_setup_interfaces()
zbtlink,zbt-z8103ax)
ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" eth1
;;
comfast,cf-e393ax)
ucidef_set_interfaces_lan_wan "lan1" eth1
;;
glinet,gl-mt2500|\
glinet,gl-mt3000)
ucidef_set_interfaces_lan_wan eth1 eth0

4
target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
View File

@ -57,6 +57,10 @@ case "$board" in
esac
[ "$PHYNBR" = "1" ] && echo "$addr" > /sys${DEVPATH}/macaddress
;;
comfast,cf-e393ax)
addr=$(mtd_get_mac_binary "Factory" 0x8000)
[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
;;
cudy,wr3000-v1)
addr=$(mtd_get_mac_binary bdinfo 0xde00)
# Originally, phy0 is phy1 mac with LA bit set. However, this would conflict

24
target/linux/mediatek/image/filogic.mk
View File

@ -322,6 +322,30 @@ define Device/cmcc_rax3000m
endef
TARGET_DEVICES += cmcc_rax3000m
define Device/comfast_cf-e393ax
DEVICE_VENDOR := Comfast
DEVICE_MODEL := CF-E393AX
DEVICE_DTS := mt7981a-comfast-cf-e393ax
DEVICE_DTS_DIR := ../dts
DEVICE_DTC_FLAGS := --pad 4096
DEVICE_DTS_LOADADDR := 0x43f00000
DEVICE_PACKAGES := kmod-mt7981-firmware mt7981-wo-firmware
KERNEL_LOADADDR := 0x44000000
KERNEL = kernel-bin | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
KERNEL_INITRAMFS = kernel-bin | lzma | \
fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
UBINIZE_OPTS := -E 5
BLOCKSIZE := 128k
PAGESIZE := 2048
IMAGE_SIZE := 65536k
KERNEL_IN_UBI := 1
IMAGES := sysupgrade.bin factory.bin
IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
endef
TARGET_DEVICES += comfast_cf-e393ax
define Device/confiabits_mt7981
DEVICE_VENDOR := Confiabits
DEVICE_MODEL := MT7981