 9ac1523062
			
		
	
	9ac1523062
	
	
	
		
			
			Comfast CF-E393AX is a dual-band Wi-Fi 6 POE ceiling mount access point.
Oem firmware is a custom openwrt 21.02 snapshot version.
We can gain access via ssh once we remove the root password.
Hardware specification:
  SoC: MediaTek MT7981A 2x A53
  Flash: 128 MB SPI-NAND
  RAM: 256MB DDR3
  Ethernet: 1x 10/100/1000 Mbps built-in PHY (WAN)
            1x 10/100/1000/2500 Mbps MaxLinear GPY211C (LAN)
  Switch: MediaTek MT7531AE
  WiFi: MediaTek MT7976D
  LEDS: 1x (Red, Blue and Green)
  Button: Reset
  UART: 3.3v, 115200n8
  --------------------------
  | Layout |
  | ----------------- |
  | 4 | VCC GND TX RX | <= |
  | ----------------- |
  --------------------------
Gain SSH access:
1. Login into web interface (http://apipaddress/computer/login.html),
   and download the
   configuration(http://apipaddress/computer/config.html).
2. Rename downloaded backup config - 'backup.file to backup.tar.gz',
   Enter 'fakeroot' command then decompress the configuration:
   tar -zxf backup.tar.gz
3. Edit 'etc/shadow', update (remove) root password:
   With password =
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   'root:$1$xf7D0Hfg$5gkjmvgQe4qJbe1fi/VLy1:19362:0:99999:7:::'
   to
   Without password =
   'root::0:99999:7:::'
   'root::0:99999:7:::'
4. Repack 'etc' directory back to a new backup file:
   tar -zcf backup-ssh.tar.gz etc/
5. Rename new config tar.gz file to 'backup-ssh.file'
   Exit fakeroot - 'exit'
6. Upload new configuration via web interface, now you
   can SSH with the following:
   'ssh -vv -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.10.1'.
   Backup the mtd partitions
   - https://openwrt.org/docs/guide-user/installation/generic.backup
7. Copy openwrt factory firmware to the tmp folder to install via ssh:
   'scp -o HostKeyAlgorithms=+ssh-rsa \
   -o PubkeyAcceptedAlgorithms=+ssh-rsa \
   *-mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin \
   root@192.168.10.1:/tmp/'
   'sysupgrade -n -F \
   /tmp/*--mediatek-filogic-comfast_cf-e393ax-squashfs-factory.bin'
8. Once led has stopped flashing - Connect via ssh with the
   default openwrt ip address - 'ssh root@192.168.1.1'
9. SSH copy the openwrt sysupgrade firmware and upgrade
   as per the default instructions.
Signed-off-by: David Bentham <db260179@gmail.com>
(cherry picked from commit d8f4453bf2)
		
	
		
			
				
	
	
		
			251 lines
		
	
	
		
			4.3 KiB
		
	
	
	
		
			Plaintext
		
	
	
	
	
	
			
		
		
	
	
			251 lines
		
	
	
		
			4.3 KiB
		
	
	
	
		
			Plaintext
		
	
	
	
	
	
| // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 | |
| 
 | |
| /dts-v1/;
 | |
| #include "mt7981.dtsi"
 | |
| 
 | |
| / {
 | |
| 	model = "COMFAST CF-E393AX";
 | |
| 	compatible = "comfast,cf-e393ax", "mediatek,mt7981";
 | |
| 
 | |
| 	aliases {
 | |
| 		serial0 = &uart0;
 | |
| 		led-boot = &led_red;
 | |
| 		led-failsafe = &led_red;
 | |
| 		led-running = &led_blue;
 | |
| 		led-upgrade = &led_green;
 | |
| 	};
 | |
| 
 | |
| 	chosen {
 | |
| 		bootargs-override = "console=ttyS0,115200n8";
 | |
| 		stdout-path = "serial0:115200n8";
 | |
| 	};
 | |
| 
 | |
| 	memory {
 | |
| 		reg = <0 0x40000000 0 0x10000000>; // 256mb
 | |
| 	};
 | |
| 
 | |
| 	gpio-keys {
 | |
| 		compatible = "gpio-keys";
 | |
| 
 | |
| 		reset {
 | |
| 			label = "reset";
 | |
| 			linux,code = <KEY_RESTART>;
 | |
| 			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
 | |
| 		};
 | |
| 	};
 | |
| 
 | |
| 	leds {
 | |
| 		compatible = "gpio-leds";
 | |
| 
 | |
| 		led_blue: blue {
 | |
| 			label = "blue:status";
 | |
| 			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
 | |
| 			color = <LED_COLOR_ID_BLUE>;
 | |
| 			function = LED_FUNCTION_STATUS;
 | |
| 		};
 | |
| 
 | |
| 		led_red: red {
 | |
| 			label = "red:status";
 | |
| 			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
 | |
| 			color = <LED_COLOR_ID_RED>;
 | |
| 			function = LED_FUNCTION_STATUS;
 | |
| 		};
 | |
| 
 | |
| 		led_green: green {
 | |
| 			label = "green:status";
 | |
| 			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
 | |
| 			color = <LED_COLOR_ID_GREEN>;
 | |
| 			function = LED_FUNCTION_STATUS;
 | |
| 		};
 | |
| 	};
 | |
| };
 | |
| 
 | |
| ð {
 | |
| 	status = "okay";
 | |
| 
 | |
| 	gmac0: mac@0 {
 | |
| 		/* LAN */
 | |
| 		compatible = "mediatek,eth-mac";
 | |
| 		reg = <0>;
 | |
| 		phy-mode = "2500base-x";
 | |
| 		nvmem-cells = <&macaddr_factory_e000 0>;
 | |
| 		nvmem-cell-names = "mac-address";
 | |
| 
 | |
| 		fixed-link {
 | |
| 			speed = <2500>;
 | |
| 			full-duplex;
 | |
| 			pause;
 | |
| 		};
 | |
| 	};
 | |
| 
 | |
| 	gmac1: mac@1 {
 | |
| 		/* WAN */
 | |
| 		compatible = "mediatek,eth-mac";
 | |
| 		reg = <1>;
 | |
| 		phy-mode = "gmii";
 | |
| 		phy-handle = <&int_gbe_phy>;
 | |
| 		nvmem-cells = <&macaddr_factory_e000 1>;
 | |
| 		nvmem-cell-names = "mac-address";
 | |
| 	};
 | |
| };
 | |
| 
 | |
| &mdio_bus {
 | |
| 	switch: switch@1f {
 | |
| 		compatible = "mediatek,mt7531";
 | |
| 		reg = <31>;
 | |
| 		interrupt-controller;
 | |
| 		#interrupt-cells = <1>;
 | |
| 		interrupt-parent = <&pio>;
 | |
| 		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
 | |
| 		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
 | |
| 	};
 | |
| };
 | |
| 
 | |
| &crypto {
 | |
| 	status = "okay";
 | |
| };
 | |
| 
 | |
| &pio {
 | |
| 	spi0_flash_pins: spi0-pins {
 | |
| 		mux {
 | |
| 			function = "spi";
 | |
| 			groups = "spi0", "spi0_wp_hold";
 | |
| 		};
 | |
| 		conf-pu {
 | |
| 			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
 | |
| 			drive-strength = <MTK_DRIVE_8mA>;
 | |
| 			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
 | |
| 		};
 | |
| 		conf-pd {
 | |
| 			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
 | |
| 			drive-strength = <MTK_DRIVE_8mA>;
 | |
| 			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
 | |
| 		};
 | |
| 	};
 | |
| 
 | |
| };
 | |
| 
 | |
| &spi0 {
 | |
| 	pinctrl-names = "default";
 | |
| 	pinctrl-0 = <&spi0_flash_pins>;
 | |
| 	cs-gpios = <0>, <0>;
 | |
| 	#address-cells = <1>;
 | |
| 	#size-cells = <0>;
 | |
| 	status = "okay";
 | |
| 	#address-cells = <1>;
 | |
| 	#size-cells = <0>;
 | |
| 
 | |
| 	spi_nand: spi_nand@0 {
 | |
| 		#address-cells = <1>;
 | |
| 		#size-cells = <1>;
 | |
| 		compatible = "spi-nand";
 | |
| 		reg = <1>;
 | |
| 		spi-max-frequency = <52000000>;
 | |
| 
 | |
| 		spi-cal-enable;
 | |
| 		spi-cal-mode = "read-data";
 | |
| 		spi-cal-datalen = <7>;
 | |
| 		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
 | |
| 		spi-cal-addrlen = <5>;
 | |
| 		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
 | |
| 
 | |
| 		spi-tx-bus-width = <4>;
 | |
| 		spi-rx-bus-width = <4>;
 | |
| 		mediatek,nmbm;
 | |
| 		mediatek,bmt-max-ratio = <1>;
 | |
| 		mediatek,bmt-max-reserved-blocks = <64>;
 | |
| 
 | |
| 		partitions {
 | |
| 			compatible = "fixed-partitions";
 | |
| 			#address-cells = <1>;
 | |
| 			#size-cells = <1>;
 | |
| 
 | |
| 			partition@0 {
 | |
| 				label = "BL2";
 | |
| 				reg = <0x00000 0x0100000>;
 | |
| 				read-only;
 | |
| 			};
 | |
| 
 | |
| 			partition@100000 {
 | |
| 				label = "u-boot-env";
 | |
| 				reg = <0x0100000 0x0080000>;
 | |
| 				read-only;
 | |
| 			};
 | |
| 
 | |
| 			factory: partition@180000 {
 | |
| 				label = "Factory";
 | |
| 				reg = <0x180000 0x0200000>;
 | |
| 				read-only;
 | |
| 
 | |
| 				nvmem-layout {
 | |
| 					compatible = "fixed-layout";
 | |
| 					#address-cells = <1>;
 | |
| 					#size-cells = <1>;
 | |
| 
 | |
| 					eeprom_factory_0: eeprom@0 {
 | |
| 						reg = <0x0 0x1000>;
 | |
| 					};
 | |
| 
 | |
| 					macaddr_factory_e000: macaddr@e000 {
 | |
| 						compatible = "mac-base";
 | |
| 						reg = <0xe000 0x6>;
 | |
| 						#nvmem-cell-cells = <1>;
 | |
| 					};
 | |
| 				};
 | |
| 			};
 | |
| 
 | |
| 			partition@380000 {
 | |
| 				label = "FIP";
 | |
| 				reg = <0x380000 0x0200000>;
 | |
| 				read-only;
 | |
| 			};
 | |
| 
 | |
| 			partition@580000 {
 | |
| 				label = "ubi";
 | |
| 				reg = <0x580000 0x4000000>;
 | |
| 				compatible = "linux,ubi";
 | |
| 			};
 | |
| 		};
 | |
| 	};
 | |
| };
 | |
| 
 | |
| &switch {
 | |
| 	ports {
 | |
| 		#address-cells = <1>;
 | |
| 		#size-cells = <0>;
 | |
| 
 | |
| 		port@0 {
 | |
| 			reg = <0>;
 | |
| 			label = "lan1";
 | |
| 		};
 | |
| 
 | |
| 		port@6 {
 | |
| 			reg = <6>;
 | |
| 			label = "cpu";
 | |
| 			ethernet = <&gmac0>;
 | |
| 			phy-mode = "2500base-x";
 | |
| 
 | |
| 			fixed-link {
 | |
| 				speed = <2500>;
 | |
| 				full-duplex;
 | |
| 				pause;
 | |
| 			};
 | |
| 		};
 | |
| 	};
 | |
| };
 | |
| 
 | |
| &uart0 {
 | |
| 	status = "okay";
 | |
| };
 | |
| 
 | |
| &watchdog {
 | |
| 	status = "okay";
 | |
| };
 | |
| 
 | |
| &wifi {
 | |
| 	status = "okay";
 | |
| 	nvmem-cells = <&eeprom_factory_0>;
 | |
| 	nvmem-cell-names = "eeprom";
 | |
| };
 | |
| 
 |