mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-28 17:48:58 +00:00
9ac1523062
Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.
Oem firmware is a custom openwrt 21.02 snapshot version.
We can gain access via ssh once we remove the root password.
Hardware specification:
SoC: MediaTek MT7981A 2x A53
Flash: 128 MB SPI-NAND
RAM: 256MB DDR3
Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976D
LEDS: 1x (Red, Blue and Green)
Button: Reset
UART: 3.3v, 115200n8
--------------------------
| Layout |
| ----------------- |
| 4 | VCC GND TX RX | <= |
| ----------------- |
--------------------------
Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
and download the
configuration(http://apipaddress/computer/config.html).
2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
Enter 'fakeroot' command then decompress the configuration:
tar -zxf backup.tar.gz
3. Edit 'etc/shadow', update (remove) root password:
With password =
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
to
Without password =
'root::0:99999:7:::'
'root::0:99999:7:::'
4. Repack 'etc' directory back to a new backup file:
tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
Exit fakeroot - 'exit'
6. Upload new configuration via web interface, now you
can SSH with the following:
'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.
Backup the mtd partitions
- https://openwrt.org/docs/guide-user/installation/generic.backup
7. Copy openwrt factory firmware to the tmp folder to install via ssh:
'scp -o HostKeyAlgorithms=+ssh-rsa \
-o PubkeyAcceptedAlgorithms=+ssh-rsa \
*-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
root@192.168.10.1:/tmp/'
'sysupgrade -n -F \
/tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'
8. Once led has stopped flashing - Connect via ssh with the
default openwrt ip address - 'ssh root@192.168.1.1'
9. SSH copy the openwrt sysupgrade firmware and upgrade
as per the default instructions.
Signed-off-by: David Bentham <db260179@gmail.com>
(cherry picked from commit d8f4453bf2
)
251 lines
4.3 KiB
Plaintext
251 lines
4.3 KiB
Plaintext
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
|
|
|
|
/dts-v1/;
|
|
#include "mt7981.dtsi"
|
|
|
|
/ {
|
|
model = "COMFAST CF-E393AX";
|
|
compatible = "comfast,cf-e393ax", "mediatek,mt7981";
|
|
|
|
aliases {
|
|
serial0 = &uart0;
|
|
led-boot = &led_red;
|
|
led-failsafe = &led_red;
|
|
led-running = &led_blue;
|
|
led-upgrade = &led_green;
|
|
};
|
|
|
|
chosen {
|
|
bootargs-override = "console=ttyS0,115200n8";
|
|
stdout-path = "serial0:115200n8";
|
|
};
|
|
|
|
memory {
|
|
reg = <0 0x40000000 0 0x10000000>; // 256mb
|
|
};
|
|
|
|
gpio-keys {
|
|
compatible = "gpio-keys";
|
|
|
|
reset {
|
|
label = "reset";
|
|
linux,code = <KEY_RESTART>;
|
|
gpios = <&pio 1 GPIO_ACTIVE_LOW>;
|
|
};
|
|
};
|
|
|
|
leds {
|
|
compatible = "gpio-leds";
|
|
|
|
led_blue: blue {
|
|
label = "blue:status";
|
|
gpios = <&pio 8 GPIO_ACTIVE_LOW>;
|
|
color = <LED_COLOR_ID_BLUE>;
|
|
function = LED_FUNCTION_STATUS;
|
|
};
|
|
|
|
led_red: red {
|
|
label = "red:status";
|
|
gpios = <&pio 34 GPIO_ACTIVE_LOW>;
|
|
color = <LED_COLOR_ID_RED>;
|
|
function = LED_FUNCTION_STATUS;
|
|
};
|
|
|
|
led_green: green {
|
|
label = "green:status";
|
|
gpios = <&pio 35 GPIO_ACTIVE_LOW>;
|
|
color = <LED_COLOR_ID_GREEN>;
|
|
function = LED_FUNCTION_STATUS;
|
|
};
|
|
};
|
|
};
|
|
|
|
ð {
|
|
status = "okay";
|
|
|
|
gmac0: mac@0 {
|
|
/* LAN */
|
|
compatible = "mediatek,eth-mac";
|
|
reg = <0>;
|
|
phy-mode = "2500base-x";
|
|
nvmem-cells = <&macaddr_factory_e000 0>;
|
|
nvmem-cell-names = "mac-address";
|
|
|
|
fixed-link {
|
|
speed = <2500>;
|
|
full-duplex;
|
|
pause;
|
|
};
|
|
};
|
|
|
|
gmac1: mac@1 {
|
|
/* WAN */
|
|
compatible = "mediatek,eth-mac";
|
|
reg = <1>;
|
|
phy-mode = "gmii";
|
|
phy-handle = <&int_gbe_phy>;
|
|
nvmem-cells = <&macaddr_factory_e000 1>;
|
|
nvmem-cell-names = "mac-address";
|
|
};
|
|
};
|
|
|
|
&mdio_bus {
|
|
switch: switch@1f {
|
|
compatible = "mediatek,mt7531";
|
|
reg = <31>;
|
|
interrupt-controller;
|
|
#interrupt-cells = <1>;
|
|
interrupt-parent = <&pio>;
|
|
interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
|
|
reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
|
|
};
|
|
};
|
|
|
|
&crypto {
|
|
status = "okay";
|
|
};
|
|
|
|
&pio {
|
|
spi0_flash_pins: spi0-pins {
|
|
mux {
|
|
function = "spi";
|
|
groups = "spi0", "spi0_wp_hold";
|
|
};
|
|
conf-pu {
|
|
pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
|
|
drive-strength = <MTK_DRIVE_8mA>;
|
|
bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
|
|
};
|
|
conf-pd {
|
|
pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
|
|
drive-strength = <MTK_DRIVE_8mA>;
|
|
bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
&spi0 {
|
|
pinctrl-names = "default";
|
|
pinctrl-0 = <&spi0_flash_pins>;
|
|
cs-gpios = <0>, <0>;
|
|
#address-cells = <1>;
|
|
#size-cells = <0>;
|
|
status = "okay";
|
|
#address-cells = <1>;
|
|
#size-cells = <0>;
|
|
|
|
spi_nand: spi_nand@0 {
|
|
#address-cells = <1>;
|
|
#size-cells = <1>;
|
|
compatible = "spi-nand";
|
|
reg = <1>;
|
|
spi-max-frequency = <52000000>;
|
|
|
|
spi-cal-enable;
|
|
spi-cal-mode = "read-data";
|
|
spi-cal-datalen = <7>;
|
|
spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
|
|
spi-cal-addrlen = <5>;
|
|
spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
|
|
|
|
spi-tx-bus-width = <4>;
|
|
spi-rx-bus-width = <4>;
|
|
mediatek,nmbm;
|
|
mediatek,bmt-max-ratio = <1>;
|
|
mediatek,bmt-max-reserved-blocks = <64>;
|
|
|
|
partitions {
|
|
compatible = "fixed-partitions";
|
|
#address-cells = <1>;
|
|
#size-cells = <1>;
|
|
|
|
partition@0 {
|
|
label = "BL2";
|
|
reg = <0x00000 0x0100000>;
|
|
read-only;
|
|
};
|
|
|
|
partition@100000 {
|
|
label = "u-boot-env";
|
|
reg = <0x0100000 0x0080000>;
|
|
read-only;
|
|
};
|
|
|
|
factory: partition@180000 {
|
|
label = "Factory";
|
|
reg = <0x180000 0x0200000>;
|
|
read-only;
|
|
|
|
nvmem-layout {
|
|
compatible = "fixed-layout";
|
|
#address-cells = <1>;
|
|
#size-cells = <1>;
|
|
|
|
eeprom_factory_0: eeprom@0 {
|
|
reg = <0x0 0x1000>;
|
|
};
|
|
|
|
macaddr_factory_e000: macaddr@e000 {
|
|
compatible = "mac-base";
|
|
reg = <0xe000 0x6>;
|
|
#nvmem-cell-cells = <1>;
|
|
};
|
|
};
|
|
};
|
|
|
|
partition@380000 {
|
|
label = "FIP";
|
|
reg = <0x380000 0x0200000>;
|
|
read-only;
|
|
};
|
|
|
|
partition@580000 {
|
|
label = "ubi";
|
|
reg = <0x580000 0x4000000>;
|
|
compatible = "linux,ubi";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
&switch {
|
|
ports {
|
|
#address-cells = <1>;
|
|
#size-cells = <0>;
|
|
|
|
port@0 {
|
|
reg = <0>;
|
|
label = "lan1";
|
|
};
|
|
|
|
port@6 {
|
|
reg = <6>;
|
|
label = "cpu";
|
|
ethernet = <&gmac0>;
|
|
phy-mode = "2500base-x";
|
|
|
|
fixed-link {
|
|
speed = <2500>;
|
|
full-duplex;
|
|
pause;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
&uart0 {
|
|
status = "okay";
|
|
};
|
|
|
|
&watchdog {
|
|
status = "okay";
|
|
};
|
|
|
|
&wifi {
|
|
status = "okay";
|
|
nvmem-cells = <&eeprom_factory_0>;
|
|
nvmem-cell-names = "eeprom";
|
|
};
|
|
|