Add support for SNR-CPE-W4N-MT

Hi everyone! This thread for discussions and a information exchange about SNR-CPE-W4N-MT router to add official support OpenWRT.

model

General specification:
SoC Type: MediaTek MT7620N (580MHz)
ROM: 8 MB SPI-NOR (W25Q64FV)
RAM: 64 MB DDR (M13S5121632A)
Switch: MediaTek MT7530
Ethernet: 5 ports - 5×100MbE (WAN, LAN1-4)
Wireless 2.4 GHz (RT5390): b/g/n
Buttons: 1 button (RESET)
Bootloader: U-Boot 1.1.3
Power: 12 VDC, 1.0 A

I want to thank @MaxS0niX
for his invaluable help at all stages of development

1 Like

Photos


1 Like
boot.log
U-Boot 1.1.3 (Mar 2 2016 - 14:05:04)

Board: MediaTek APSoC DRAM: 64 MB

enable ephy clock...done. SSC disabled.

MediaTek SPI flash driver, SPI clock: 48MHz

spi device id: ef 40 17 0 0 (40170000)

find flash: W25Q64BV

*** Warning - bad CRC, using default environment

============================================

MediaTek U-Boot Version: 5.0.0.5

--------------------------------------------

ASIC 7620_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Mar 2 2016 Time:14:05:04

============================================

icache: sets:512, ways:4, linesz:32, total:65536

dcache: sets:256, ways:4, linesz:32, total:32768

#### The CPU freq = 580 MHZ ####

estimate memory size = 64 Mbytes

Please choose the operation:

   0: Load system code then write to Flash via Serial.

   1: Load system code to SDRAM via TFTP.

   2: Load system code then write to Flash via TFTP.

   3: Boot system code via Flash (default).

   4: Enter boot command line interface.

   7: Load U-Boot code then write to Flash via Serial.

   9: Load U-Boot code then write to Flash via TFTP.

 0

3: System Boot system code via Flash.

## Checking image at bc050000 ...

   Image Name: SNR-CPE-W4N-MT

   Image Type: MIPS Linux Kernel Image (lzma compressed)

   Data Size: 5663406 Bytes = 5.4 MB

   Load Address: 80000000

   Entry Point: 80247580

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 80247580) ...

## Giving linux memsize in MB, 64

Starting kernel ...



LINUX started...

DetectRAMsequence

MAX memory:[268435456]

RAM size detected:[67108864]

FullviewRAM:[67108864]

Linux version 3.4.111.109 (sfstudio_at_mail.ru@wive-ng.sf.net) (gcc version 4.8.5 (GCC) ) #1 Tue Apr 12 18:55:07 GMT-3 2016

* MediaTek SoC: MT7620N, RevID: 0206, RAM: DDR1, XTAL: 20MHz

CPU/OCP/SYS frequency: 580/193/193 MHz

CPU revision is: 00019650 (MIPS 24KEc)

Determined physical RAM map:

memory: 04000000 @ 00000000 (usable)

Zone PFN ranges:

Normal 0x00000000 -> 0x00004000

Movable zone start PFN for each node

Early memory PFN ranges

0: 0x00000000 -> 0x00004000

Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.

Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes

Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256

Kernel command line: console=ttyS0,57600n8 root=/dev/mtdblock4 rootfstype=squashfs

PID hash table entries: 256 (order: -2, 1024 bytes)

Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

Writing ErrCtl register=00076fdd

Readback ErrCtl register=00076fdd

Memory: 61784k/65536k available (2388k kernel code, 3752k reserved, 493k data, 188k init, 0k highmem)

start_kernel(): bug: interrupts were enabled *very* early, fixing it

NR_IRQS:40

console [ttyS0] enabled

Calibrating delay loop... 385.02 BogoMIPS (lpj=192512)

pid_max: default: 32768 minimum: 301

Mount-cache hash table entries: 512

NET: Registered protocol family 16

bio: create slab <bio-0> at 0

Switching to clocksource MIPS

NET: Registered protocol family 1

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 2048 (order: 2, 16384 bytes)

TCP bind hash table entries: 2048 (order: 1, 8192 bytes)

TCP: Hash tables configured (established 2048 bind 2048)

TCP: reno registered

UDP hash table entries: 256 (order: 0, 4096 bytes)

Load Ralink WDG Timer Module

squashfs: version 4.0 (2009/01/31) Phillip Lougher

msgmni has been set to 120

io scheduler noop registered (default)

Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled

serial8250: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A

Ralink gpio driver initialized

Ralink SPI flash driver, SPI clock: 48MHz

W25Q64BV (ef 40170000) (8192 Kbytes)

Creating 7 MTD partitions on "raspi":

0x000000000000-0x000000030000 : "Bootloader"

0x000000030000-0x000000040000 : "Config"

0x000000040000-0x000000050000 : "Factory"

0x000000050000-0x00000015473a : "Kernel_stub"

0x00000015473a-0x000000780000 : "RootFS_stub"

0x000000780000-0x000000800000 : "RW-FS"

0x000000050000-0x000000780000 : "Kernel_RootFS"

Ralink APSoC Ethernet Driver v3.2.3 (raeth)

raeth: PDMA RX ring 256, PDMA TX ring 512. Max packet size 1536

raeth: NAPI support, weight 32

raeth: Byte Queue Limits (BQL) support

PPP generic driver version 2.4.2

PPP vpn led has gpio 39

PPP MPPE Compression module registered

NET: Registered protocol family 24

PPTP driver version 0.8.5

8021q: 802.1Q VLAN Support v1.8

NET: Registered protocol family 17

Netfilter messages via NETLINK v0.30.

nf_conntrack version 0.5.0 (16384 buckets, 32768 max)

gre: GRE over IPv4 demultiplexor driver

ip_tables: (C) 2000-2006 Netfilter Core Team

TCP: cubic registered

NET: Registered protocol family 10

ip6_tables: (C) 2000-2006 Netfilter Core Team

L2TP core driver, V2.0

PPPoL2TP kernel driver, V2.0

NVRAM: Kernel NVRAM start init.

NVRAM: Particion 0 CRC a5fb0865 OK.

VFS: Mounted root (squashfs filesystem) readonly on device 31:4.

mount /proc file system ok!

mount /sys file system ok!

mount /dev file system ok!

mount /var file system ok!

Freeing unused kernel memory: 188k freed

Build the /dev/console node.

Algorithmics/MIPS FPU Emulator v1.5

INIT Touch mdev.

INIT Mount /tmp/rootfs

INIT Create some persistent nodes in dev.

INIT Init RW particion

Start buttons WDG

INIT RW File system is ok - preparing.

INIT Create start services trees

INIT Start services now

/ # preconfigure >>>>>>>>>>>> NORMAL BOOT <<<<<<<<<<<<<<<

preconfigure Factory mac adresess: F8:F0:82:55:04:5C F8:F0:82:55:04:5B F8:F0:82:AD:EF:DC

SYSLOG Start klogd

SYSLOG Start syslogd local

Password for 'Admin' changed

Restore time to build time or save time.

Tue Apr 12 19:02:00 OMST 2016

raeth: HW IP/TCP/UDP checksum RX/TX offload enabled

raeth: HW VLAN TX offload enabled

raeth: HW Scatter/Gather TX offload enabled

MODULES Loading TV module...

TV_MON Starting membd...

/var/run/rc0.d/S97tv_membd: line 1: timeout: not found

Build config for fist WiFi module.

MT76x2 AP Driver version: 3.0.4.0.P1

>>>>> RECONFIGURE WIFI IF = ra0 <<<<<<<<<<

Ralink HW NAT v2.52.0 Module Enabled, FoE Size: 16384

c0a865ca 8892

MODULES TV module loaded!

* / # help

Built-in commands:

------------------

. : [ [[ alias bg break cd chdir command continue echo eval exec

exit export false fg getopts hash help history jobs kill let

local printf pwd read readonly return set shift source test times

trap true type ulimit umask unalias unset wait
/ # uname -a
Linux Wive-NG-MT 3.4.111.109 #1 Tue Apr 12 18:55:07 GMT-3 2016 mips GNU/Linux
/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Config"
mtd2: 00010000 00010000 "Factory"
mtd3: 0010473a 00010000 "Kernel_stub"
mtd4: 0062b8c6 00010000 "RootFS_stub"
mtd5: 00080000 00010000 "RW-FS"
mtd6: 00730000 00010000 "Kernel_RootFS"
/ #
MT7620 # printenv
bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="F8:F0:82:30:52:11"
ipaddr=192.168.1.1
serverip=192.168.1.131
stdin=serial
stdout=serial
stderr=serial

Environment size: 151/4092 bytes
MT7620 #

LEDs and Buttons:

SYS LED GPIO #38
WPS LED GPIO #39
WLAN LED GPIO #72
RESET BUTTON GPIO #1

Current state of OpenWRT configuration for this device here.

1 Like

Currently, the image upload works over tftp only. Attempts have been made to get native loading to work. But difficulties arose. uImage header of the native firmware is different from OpenWRT:

Start   Size    Value(HEX)  Description
0x00    0x04    27051956    Image Header Magic Number
0x04    0x04    73D35107    Image Header (0x00 : 0x40) CRC32
0x08    0x04    570D1C14    Image Creation Timestamp
0x0C    0x04    00566AAE    File size - 0x40
0x10    0x04    80000000    Data  Load  Address
0x14    0x04    80247580    Entry Point Address
0x18    0x04    49599B6F    (0x40 : EOF) CRC32
0x1c    0x01    0x05        Operating System
0x1d    0x01    0x05        CPU architecture
0x1e    0x01    0x02        Image Type
0x1f    0x01    0x03        Compression Type
0x20    0x20    534E522D4350452D57344E2D4D5400000000000000000000000000000010473A Image Name(SNR-CPE-W4N-MT                 G:)

As can be seen from the table, the size of the entire file, not just the kernel, is located at 0x0C. We changed the header manually and tried to upload via native upload. The download was successful. But it stopped mounting rootfs:

openwrt.log
U-Boot 1.1.3 (Mar  2 2016 - 14:05:04)
 
Board: MediaTek APSoC DRAM: 64 MB
enable ephy clock...done. SSC disabled.
******************************
Software System Reset Occurred
******************************
MediaTek SPI flash driver, SPI clock: 48MHz
spi device id: ef 40 17 0 0 (40170000)
find flash: W25Q64BV
*** Warning - bad CRC, using default environment
 
============================================
MediaTek U-Boot Version: 5.0.0.5
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Mar  2 2016  Time:14:05:04
============================================
icache: sets:512, ways:4, linesz:32, total:65536
dcache: sets:256, ways:4, linesz:32, total:32768
 
 #### The CPU freq = 580 MHZ ####
 estimate memory size = 64 Mbytes
 
Please choose the operation:
   0: Load system code then write to Flash via Serial.
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Enter boot command line interface.
   7: Load U-Boot code then write to Flash via Serial.
   9: Load U-Boot code then write to Flash via TFTP.                          0
 
 
3: System Boot system code via Flash.
## Checking image at bc050000 ...
   Image Name:   SNR-CPE-W4N-MT
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    6816485 Bytes =  6.5 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64
 
Starting kernel ...
 
 
 
OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80000000...
 
[    0.000000] Linux version 5.10.144 (user@debian) (mipsel-openwrt-linux-musl-g                        cc (OpenWrt GCC 11.3.0 r20779+1-c5e167e0d6) 11.3.0, GNU ld (GNU Binutils) 2.37)                         #0 Thu Oct 6 13:58:15 2022
[    0.000000] Board has DDR1
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620N ver:2 eco:6
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is SNR-CPE-W4N (rev.M)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                        es
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs                        2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, lin                        ear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, line                        ar)
[    0.000000] Writing ErrCtl register=00076fd0
[    0.000000] Readback ErrCtl register=00076fd0
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56424K/65536K available (5253K kernel code, 613K rwdata,                         1112K rodata, 1204K init, 209K bss, 9112K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_n                        s: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_i                        dle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 74051                        15902ns
[    0.015564] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087797] pid_max: default: 32768 minimum: 301
[    0.097180] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linea                        r)
[    0.111586] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes,                         linear)
[    0.129552] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE                         build
[    0.148477] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma                        x_idle_ns: 19112604462750000 ns
[    0.167960] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.181550] pinctrl core: initialized pinctrl subsystem
[    0.193033] NET: Registered protocol family 16
[    0.267525] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.278593] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.291168] rt2880_gpio 10000638.gpio: registering 16 gpios
[    0.302179] rt2880_gpio 10000638.gpio: registering 16 irq handlers
[    0.314767] rt2880_gpio 10000688.gpio: registering 1 gpios
[    0.325604] rt2880_gpio 10000688.gpio: registering 1 irq handlers
[    0.347817] clocksource: Switched to clocksource systick
[    0.359701] NET: Registered protocol family 2
[    0.368594] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear                        )
[    0.383682] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096                         bytes, linear)
[    0.400309] TCP established hash table entries: 1024 (order: 0, 4096 bytes, l                        inear)
[    0.415433] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.429438] TCP: Hash tables configured (established 1024 bind 1024)
[    0.442224] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.455136] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.469301] NET: Registered protocol family 1
[    0.477893] PCI: CLS 0 bytes, default 32
[    0.491030] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    0.506092] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.524340] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.535844] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT                        Y) (c) 2001-2006 Red Hat, Inc.
[    0.558847] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.572568] printk: console [ttyS0] disabled
[    0.581077] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud                         = 2500000) is a Palmchip BK-3103
[    0.600721] printk: console [ttyS0] enabled
[    0.600721] printk: console [ttyS0] enabled
[    0.617285] printk: bootconsole [early0] disabled
[    0.617285] printk: bootconsole [early0] disabled
[    0.647514] spi spi0.0: force spi mode3
[    0.656655] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    0.666534] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.679264] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitio                        ns
[    0.693866] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitio                        ns
[    0.709017] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitio                        ns
[    0.723664] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitio                        ns
[    0.738484] Creating 4 MTD partitions on "spi0.0":
[    0.748094] 0x000000000000-0x000000030000 : "Bootloader"
[    0.762048] 0x000000030000-0x000000040000 : "Config"
[    0.773240] 0x000000040000-0x000000140000 : "Factory"
[    0.786474] 0x000000050000-0x000000800000 : "firmware"
[    0.827272] gsw: setting port4 to ephy mode
[    0.835821] mtk_soc_eth 10100000.ethernet: generated random MAC address e2:49                        :da:41:5e:d5
[    0.852163] mtk_soc_eth 10100000.ethernet: no mdio-bus child node found
[    0.865353] mtk_soc_eth 10100000.ethernet: mdio-bus disabled
[    0.876859] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    0.889433] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0                        100000, irq 5
[    0.906608] rt2880_wdt 10000120.watchdog: Initialized
[    0.918082] NET: Registered protocol family 10
[    0.932995] Segment Routing with IPv6
[    0.940524] NET: Registered protocol family 17
[    0.949514] 8021q: 802.1Q VLAN Support v1.8
[    0.960082] /dev/root: Can't open blockdev
[    0.968327] VFS: Cannot open root device "(null)" or unknown-block(0,0): erro                        r -6
[    0.983255] Please append a correct "root=" boot option; here are the availab                        le partitions:
[    0.999922] 1f00             192 mtdblock0
[    0.999928]  (driver?)
[    1.012952] 1f01              64 mtdblock1
[    1.012956]  (driver?)
[    1.025979] 1f02            1024 mtdblock2
[    1.025984]  (driver?)
[    1.039020] 1f03            7872 mtdblock3
[    1.039025]  (driver?)
[    1.052045] Kernel panic - not syncing: VFS: Unable to mount root fs on unkno                        wn-block(0,0)
[    1.068511] Rebooting in 1 seconds..
OpenWRT boot log with the right (kernel only) size in the header
U-Boot 1.1.3 (Mar  2 2016 - 14:05:04)

Board: MediaTek APSoC DRAM: 64 MB
enable ephy clock...done. SSC disabled.
MediaTek SPI flash driver, SPI clock: 48MHz
spi device id: ef 40 17 0 0 (40170000)
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
MediaTek U-Boot Version: 5.0.0.5
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Mar  2 2016  Time:14:05:04
============================================
icache: sets:512, ways:4, linesz:32, total:65536
dcache: sets:256, ways:4, linesz:32, total:32768

 #### The CPU freq = 580 MHZ ####
 estimate memory size = 64 Mbytes

Please choose the operation:
   0: Load system code then write to Flash via Serial.
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Enter boot command line interface.
   7: Load U-Boot code then write to Flash via Serial.
   9: Load U-Boot code then write to Flash via TFTP.                          0


3: System Boot system code via Flash.
## Checking image at bc050000 ...
   Image Name:   SNR-CPE-W4N-MT
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2181242 Bytes =  2.1 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...



OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80000000...

[    0.000000] Linux version 5.10.144 (user@debian) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20779+1-c5e167e0d6) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Thu Oct 6 18:24:46 2022
[    0.000000] Board has DDR1
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620N ver:2 eco:6
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is SNR-CPE-W4N (rev.M)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=000676d9
[    0.000000] Readback ErrCtl register=000676d9
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56424K/65536K available (5253K kernel code, 613K rwdata, 1112K rodata, 1204K init, 209K bss, 9112K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015563] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087806] pid_max: default: 32768 minimum: 301
[    0.097188] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.111594] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.129565] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.148538] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.168023] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.181609] pinctrl core: initialized pinctrl subsystem
[    0.193103] NET: Registered protocol family 16
[    0.267683] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.278756] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.291330] rt2880_gpio 10000638.gpio: registering 16 gpios
[    0.302343] rt2880_gpio 10000638.gpio: registering 16 irq handlers
[    0.314922] rt2880_gpio 10000688.gpio: registering 1 gpios
[    0.325758] rt2880_gpio 10000688.gpio: registering 1 irq handlers
[    0.348005] clocksource: Switched to clocksource systick
[    0.359870] NET: Registered protocol family 2
[    0.368761] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.383859] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.400489] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.415610] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.429619] TCP: Hash tables configured (established 1024 bind 1024)
[    0.442404] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.455319] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.469473] NET: Registered protocol family 1
[    0.478062] PCI: CLS 0 bytes, default 32
[    0.491227] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    0.506289] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.524547] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.536052] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.559064] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.572786] printk: console [ttyS0] disabled
[    0.581299] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    0.600943] printk: console [ttyS0] enabled
[    0.600943] printk: console [ttyS0] enabled
[    0.617504] printk: bootconsole [early0] disabled
[    0.617504] printk: bootconsole [early0] disabled
[    0.647746] spi spi0.0: force spi mode3
[    0.656880] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    0.666759] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.679490] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.694093] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.709230] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.723877] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.738719] Creating 4 MTD partitions on "spi0.0":
[    0.748333] 0x000000000000-0x000000030000 : "Bootloader"
[    0.762279] 0x000000030000-0x000000040000 : "Config"
[    0.773471] 0x000000040000-0x000000140000 : "Factory"
[    0.786725] 0x000000050000-0x000000800000 : "firmware"
[    0.798593] 2 uimage-fw partitions found on MTD device firmware
[    0.810457] Creating 2 MTD partitions on "firmware":
[    0.820372] 0x000000000000-0x0000002148ba : "kernel"
[    0.830265] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    0.849827] 0x0000002148ba-0x0000007b0000 : "rootfs"
[    0.859813] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    0.880252] mtd: device 5 (rootfs) set to be root filesystem
[    0.891724] 1 squashfs-split partitions found on MTD device rootfs
[    0.904079] 0x000000680000-0x0000007b0000 : "rootfs_data"
[    0.942127] gsw: setting port4 to ephy mode
[    0.950696] mtk_soc_eth 10100000.ethernet: generated random MAC address 22:a1:07:ce:2b:44
[    0.967021] mtk_soc_eth 10100000.ethernet: no mdio-bus child node found
[    0.980206] mtk_soc_eth 10100000.ethernet: mdio-bus disabled
[    0.991713] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.004286] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.021460] rt2880_wdt 10000120.watchdog: Initialized
[    1.032899] NET: Registered protocol family 10
[    1.047792] Segment Routing with IPv6
[    1.055318] NET: Registered protocol family 17
[    1.064310] 8021q: 802.1Q VLAN Support v1.8
[    1.086103] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    1.107006] Freeing unused kernel memory: 1204K
[    1.116072] This architecture does not have kernel memory protection.
[    1.128921] Run /sbin/init as init process
[    2.165729] init: Console is alive
[    2.173187] init: - watchdog -
[    3.891935] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.132950] usbcore: registered new interface driver usbfs
[    4.144059] usbcore: registered new interface driver hub
[    4.154761] usbcore: registered new device driver usb
[    4.173078] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    4.190051] ehci-fsl: Freescale EHCI Host controller driver
[    4.203264] ehci-platform: EHCI generic platform driver
[    4.220304] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    4.235186] ohci-platform: OHCI generic platform driver
[    4.252134] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.271130] init: - preinit -
[    6.025788] random: jshn: uninitialized urandom read (4 bytes read)
[    6.293839] random: jshn: uninitialized urandom read (4 bytes read)
[    6.500148] random: jshn: uninitialized urandom read (4 bytes read)
[    7.551464] 8021q: adding VLAN 0 to HW filter on device eth0
[    7.754642] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.912643] jffs2: notice: (405) jffs2_build_xattr_subsystem: complete building xattr subsystem, 7 of xdatum (5 unchecked, 2 orphan) and 8 of xref (2 dead, 0 orphan) found.
[    8.945695] mount_root: switching to jffs2 overlay
[    8.962742] overlayfs: upper fs does not support tmpfile.
[    8.981876] urandom-seed: Seeding with /etc/urandom.seed
[    9.183698] procd: - early -
[    9.189860] procd: - watchdog -
[    9.620498] procd: - watchdog -
[    9.837477] procd: - ubus -
[    9.978314] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.994394] random: ubusd: uninitialized urandom read (4 bytes read)
[   10.007795] random: ubusd: uninitialized urandom read (4 bytes read)
[   10.030347] procd: - init -
Please press Enter to activate this console.
[   11.600571] random: jshn: uninitialized urandom read (4 bytes read)
[   11.658610] random: ubusd: uninitialized urandom read (4 bytes read)
[   11.700558] random: ubus: uninitialized urandom read (4 bytes read)
[   11.985225] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.723792] urngd: jent-rng init failed, err: 2
[   12.755632] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[   12.770815] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[   12.949834] PPP generic driver version 2.4.2
[   12.963522] NET: Registered protocol family 24
[   13.016328] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "Factory"
[   13.030819] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[   13.046302] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected
[   13.184512] kmodloader: done loading kernel modules from /etc/modules.d/*
[   24.900255] random: crng init done
[   24.907046] random: 87 urandom warning(s) missed due to ratelimiting
[   42.419846] 8021q: adding VLAN 0 to HW filter on device eth0
[   42.457941] br-lan: port 1(eth0.1) entered blocking state
[   42.468953] br-lan: port 1(eth0.1) entered disabled state
[   42.480135] device eth0.1 entered promiscuous mode
[   42.489729] device eth0 entered promiscuous mode
[   42.579851] br-lan: port 1(eth0.1) entered blocking state
[   42.590687] br-lan: port 1(eth0.1) entered forwarding state
[   43.470912] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.35.0 (2022-10-06 18:24:46 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r20779+49-c5e167e0d6
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
DTS file
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

#include "mt7620n.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/leds/common.h>


/ {
	compatible = "snr,cpe-w4n-mt", "ralink,mt7620n-soc";
	model = "SNR-CPE-W4N (rev.M)";

	// In config: SNR_CPE_W4N_MT
	// At sticker: SNR-CPE-W4N (rev.M)
	// Maybe have to unit with other revisions

	aliases {
		led-boot = &led_wps;
		led-failsafe = &led_sys;
		led-running = &led_wps;
		led-upgrade = &led_sys;
	};

	leds {
		compatible = "gpio-leds";

		led_sys: sys {
			label = "green:sys";
			color = <LED_COLOR_ID_GREEN>;
			function = LED_FUNCTION_STATUS;
			gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; // GPIO#38
			panic-indicator;
		};

		led_wps: wps {
			label = "green:wps";
			color = <LED_COLOR_ID_GREEN>;
			function = LED_FUNCTION_WPS;
			gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>; // GPIO#39
		};

		wlan {
			label = "green:wlan";
			color = <LED_COLOR_ID_GREEN>;
			function = LED_FUNCTION_WLAN;
			gpios = <&gpio3 0 GPIO_ACTIVE_LOW>; // GPIO#72
		};

	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "Reset Button";
			gpios = <&gpio0 1 GPIO_ACTIVE_HIGH>; // GPIO#1
			linux,code = <KEY_RESTART>;
		};
	};
};

&state_default {
	gpio {
		groups = "i2c", "spi refclk";
		function = "gpio";
	};
};

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <48000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "Bootloader";
				reg = <0x0 0x30000>;
				read-only;
			};

			partition@30000 {
				// How to use?
				label = "Config";
				reg = <0x30000 0x10000>;
			};

			factory: partition@40000 {
				label = "Factory";
				reg = <0x40000 0x100000>;
				read-only;
			};

			partition@50000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x50000 0x7b0000>;
			};
/*
			partition@? {
				label = "uboot-env";
				reg = <0x? 0x?>;
				// Find out where is placing

				//  TODO: change a some parameter in u-boot or
				// setenv a parameter and the save over saveenv.
				// Next make a backup and find where parameter saved.
			};
	*/
		};


	};

};

&gpio0 {
  status = "okay";
};

&gpio1 {
  status = "okay";
};

&gpio3 {
  status = "okay";
};


&ethernet {
	nvmem-cells = <&macaddr_factory_4>;
	nvmem-cells-names = "mac-address";

	mediatek,portmap = "wllll";
	// TODO: see how ports are located
};

&wmac {
	ralink,mtd-eeprom = <&factory 0x0>;
	// Point to address of calibration
};

&factory {
	compatible = "nvmem-cells";

	macaddr_factory_4: macaddr@4 {
		// TODO: see in Factory MAC or MACs
		reg = <0x4 0x6>;
	};

};

Any ideas?

MAC addresses are placed in Factory partition:

WAN		F8:F0:82:55:04:5C	0x2e
LAN		F8:F0:82:55:04:5B	0x28
WLAN	F8:F0:82:AD:EF:DC	0x04

Was trying 2 ways describe it in OpenWRT.
1 way (.dts):

...
      factory: partition@40000 {
        label = "Factory";
        reg = <0x40000 0x100000>;
        read-only;
      }
...

&ethernet {
  nvmem-cells = <&macaddr_factory_28>;
  nvmem-cells-names = "mac-address";

  mediatek,portmap = "wllll";
};

&factory {
  compatible = "nvmem-cells";

  macaddr_factory_4: macaddr@4 {
    reg = <0x4 0x6>;
  };

  macaddr_factory_28: macaddr@28 {
    reg = <0x28 0x6>;
  };

  macaddr_factory_2e: macaddr@2e {
    reg = <0x2e 0x6>;
  };

};

2 way (uci):

// 02-network

snr,cpe-w4n-mt)
    wan_mac=$(mtd_get_mac_binary factory 0x2e)
    label_mac=$(mtd_get_mac_binary factory 0x28)
    ;;

But none of them worked. Help who knows