Hi,
I've picked a Buffalo WXR18000BE10P from Xianyu (Goofish) recently. https://www.buffalo.jp/product/detail/wxr18000be10p.html
According to press release and DT from stock firmware, it looks like the router has an MT7988AV SoC with 1024MiB of RAM and 256MiB SPI NAND Flash. Teardown from the previous owner also supports this.
Both 10G ports are powered by Marvell CUX3410, which appears to be very similar to Aquantia AQR113C. Unfortunately, NMBM is enabled with UBI in stock firmware.
Holding the AOSS button and power on triggers a TFTP request to server 192.168.11.10 for file WXR18000BE10P-initramfs.bin, from 192.168.11.1; the router boots the image, per my observation.
My work is available at GitHub@infiWang/OpenWrt, buffalo-wxr18000be10p. Currently, I have a TFTP bootable initramfs system, with the exception that the LAN1 (10G) interface does not play well when booted, likely firmware loading related. I'm looking for a U-Boot mod to solve the 10G port firmware issue and scrape NMBM entirely.
Also, my machine looks and acts very suspiciously, so I'd love your feedback! If you own a device or have the tools and knowledge to use UART and dump NAND, let's make this port happen.
"My router's behavior"
My machine came with some weird, broken Chinese OpenWrt fork with no proper support for the hardware, so I flashed it back to stock firmware and started porting OpenWrt. I soon noticed that MAC does not match what is printed on the casing, and the ORGDATA partition stores a weak password.
"10G Port Issue"
Aquantia PHY (and our Marvell one on this machine) needs firmware to work correctly. The PHY can either load from a SPI flash attached to it automatically, or the host needs to upload firmware via MDIO. To save costs, vendors like Buffalo usually take the latter route. I've modified the U-Boot and Linux Aquantia driver to load the firmware. If we load fw in U-Boot and don't reset it during Linux boot, everything works fine. If Linux handles loading, LAN1 would be attached with the Generic C45 driver, and later init_config would fail with -ETIMEDOUT; if we disable the reset pin of the PHY, restart the network service, the Aquantia driver would take over, and everything works fine.
Stock Firmware Bootlog
(WIP) OpenWrt Stock U-Boot Layout Initramfs Bootlog
