Adding support for KuWfi AP1200F (AC dualband) Outdoor Access Point

Double-G · April 23, 2025, 8:36pm

Hello,

I just bought a KuWfi AP1200F Outdoor Access Point. It is featured as dual frequency AC-class device with 300 Mbps on 2.4 GHz and 866 Mbps on 5 GHz.
The interesting thig is, that it is

an outdoor device with water proof enclosure
PoE-powered but can also be powered with 12V DC.
comes with a 2nd Ethernet-Port.

It is based on Ralink APSoC with MT7628, comes with 64 MB DRAM and 8 MB SPI Flash.
The flash chip seems to be a Winbond 25Q64JVSIQ, 2440.

This should be supportey by OpenWRT according to [OpenWrt Wiki] MediaTek / Ralink, using 24kec-driver.

See [KuWFi 1200Mbps 2.4G&5.8G AP Repeater Mode 100Mbps RJ45 Outdoor Access Point with SMA Antenna](https://kuwfi.com/products/kuwfi-1200mbps-24g58g-ap-repeater-mode-
100mbps-rj45-outdoor-access-point-with-sma-antenna).

Unfortunately KuWfi refuses to provide the firmware image, a changelog or the root-password for the telnet-server listening on the device.

I opened the case by removing two screws hidden under the sticker and by removing the two brass holder at the antenna connectors.
Luckily I found the serial port and got access to U-Boot.
The serial-port-settings are 57600,8N1, no flow-control and make sure to use a 3.3 volt adaptor.


[04020D09][04020C0F][88890000][23244647][00232446]
DU Setting Cal Done


U-Boot 1.1.3 (Feb 14 2023 - 14:57:41)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83f9c000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Feb 14 2023  Time:14:57:41
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Press press reset button for more than 2 seconds to run web failsafe mode

Reset button is pressed for:  0 second(s)

Catution: Reset button wasn't pressed or not long enough!
Continuing normal boot...


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3

You choosed 3
                                                                              0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    6518975 Bytes =  6.2 MB
   Load Address: 80000000
   Entry Point:  802c9c80
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802c9c80) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0

KuWFi-AP1200F login:
KuWFi-AP1200F login:
KuWFi-AP1200F login: root
Password:
Login incorrect
KuWFi-AP1200F login: root
Password:
Login incorrect

KuWFi-AP1200F login: root
Password:
Login incorrect
KuWFi-AP1200F login:


(powercycle)
[04020D09][04020C0F][88890000][23244647][00232446]
DU Setting Cal Done


U-Boot 1.1.3 (Feb 14 2023 - 14:57:41)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83f9c000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Feb 14 2023  Time:14:57:41
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Press press reset button for more than 2 seconds to run web failsafe mode

Reset button is pressed for:  0 second(s)

Catution: Reset button wasn't pressed or not long enough!
Continuing normal boot...


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3                                                                                                                                                                         0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    6518975 Bytes =  6.2 MB
   Load Address: 80000000
   Entry Point:  802c9c80
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802c9c80) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0

[04020D09][04020C0F][88890000][23244647][00232446]
DU Setting Cal Done


U-Boot 1.1.3 (Feb 14 2023 - 14:57:41)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83f9c000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Feb 14 2023  Time:14:57:41
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Press press reset button for more than 2 seconds to run web failsafe mode

Reset button is pressed for:  0 second(s)

Catution: Reset button wasn't pressed or not long enough!
Continuing normal boot...


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3

You choosed 4
                                                                                                                                                                                   0


4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Feb 14 2023 - 14:57:41)
MT7628 # ls
Unknown command 'ls' - try 'help'
MT7628 # help
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
spi     - spi command
tftpboot- boot image via network using TFTP protocol
version - print monitor version
MT7628 # printenv
bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=192.168.0.100
serverip=192.168.0.23
stdin=serial
stdout=serial
stderr=serial
BootType=3

Environment size: 163/4092 bytes
MT7628 # ▒
[04020D09][04020C0F][88890000][24254748][00242547]
DU Setting Cal Done


U-Boot 1.1.3 (Feb 14 2023 - 14:57:41)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83f9c000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Feb 14 2023  Time:14:57:41
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Press press reset button for more than 2 seconds to run web failsafe mode

Reset button is pressed for:  0 second(s)

Catution: Reset button wasn't pressed or not long enough!
Continuing normal boot...


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3                                                                                                                                                                         0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    6518975 Bytes =  6.2 MB
   Load Address: 80000000
   Entry Point:  802c9c80
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802c9c80) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0

KuWFi-AP1200F login: ▒▒▒

Any idea how to get root access to it?
My best try would be to boot a somewhat generic openwrt-image taken from Index of /releases/24.10.0/targets/ramips/mt76x8/ over tftp.
Can I connect a ch34a-flash-programmer to the winbond chip?

some pictures:

Thanks to feedback from this thread we now know that this device is also known as Yuncore AP1200F, BUT the KuWfi-edition has only 4 MB instead of 8 MB flash.

Double-G · April 23, 2025, 8:58pm

I could boot an OpenWRT-Image until the watchdog restarted the device, see yourself:

okay I tried to boot the file openwrt-24.10.0-ramips-mt76x8-cudy_tr1200-v1-initramfs-kernel.bin

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3

You choosed 1
                                                                                                                                                                                   0


1: System Load Linux to SDRAM via TFTP.
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.0.100) ==:192.168.0.100
        Input server IP (192.168.0.23) ==:192.168.0.23
        Input Linux Kernel filename (openwrt-24.10.0-ramips-mt76x8-cudy_tr1200-v1-initramfs-kernel.bin) ==:openwrt-24.10.0-ramips-mt76x8-cudy_tr1200-v1-initramfs-kernel.bin

 NetTxPacket = 0x83FE8780

 KSEG1ADDR(NetTxPacket) = 0xA3FE8780

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
TFTP from server 192.168.0.23; our IP address is 192.168.0.100
Filename 'openwrt-24.10.0-ramips-mt76x8-cudy_tr1200-v1-initramfs-kernel.bin'.

 TIMEOUT_COUNT=10,Load address: 0x82000000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (00:e0:4c:68:00:7b)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################
done
Bytes transferred = 6113135 (5d476f hex)
LoadAddr=82000000 NetBootFileXferSize= 005d476f
Automatic boot of image at addr 0x82000000 ...
## Booting image at 82000000 ...
   Image Name:   MIPS OpenWrt Linux-6.6.73
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    6113071 Bytes =  5.8 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... ▒▒▒▒▒▒▒▒▒▒▒▒~▒▒▒~▒▒▒▒▒▒▒ffx▒▒▒▒f▒▒xf▒▒f▒▒f▒▒▒▒▒x▒▒xf▒xfx~f▒▒▒▒f▒▒▒▒▒`▒▒▒xfx▒▒▒▒▒xf▒▒▒▒▒▒▒▒▒▒▒▒▒x▒x▒▒▒~~▒▒fxf▒▒▒▒▒▒~f▒▒▒▒▒fx~f▒~f▒▒f▒▒~▒x▒xf▒▒▒f▒▒▒▒▒▒▒▒x▒▒▒~~▒▒fxf▒▒▒▒▒▒~f▒▒▒▒▒fx~f▒~f▒▒f▒▒~▒x▒xf▒▒▒f▒▒▒▒▒▒▒▒▒x`▒▒▒~▒▒~~▒▒fxf▒▒▒▒▒▒~f▒▒▒▒▒fx~f▒~f▒▒f▒▒~▒x▒xf▒▒▒f▒▒▒▒▒▒▒▒f▒▒▒~▒▒fxf▒▒▒xf▒▒f▒▒xf▒xfx▒▒▒▒~▒▒▒▒f▒▒▒▒▒f▒▒~▒▒▒▒▒▒▒fx怘▒▒▒▒▒▒x▒▒▒▒~▒▒f▒▒`▒▒~▒▒▒▒▒▒f▒▒~`f▒▒~x▒▒f▒▒▒fx怘▒▒▒▒▒▒▒f▒▒x▒~▒▒▒▒▒ff▒▒~~~`f▒▒▒~▒f▒▒▒▒▒f▒▒▒▒▒f▒▒x▒▒▒f▒▒fx▒f▒ff~`▒▒xf▒▒▒▒▒▒▒▒▒▒f▒▒▒f▒▒▒[    1.993405] printk: console [ttyS0] enabled
[    1.993405] printk: console [ttyS0] enabled
[    2.001849] printk: bootconsole [early0] disabled
[    2.001849] printk: bootconsole [early0] disabled
[    2.028527] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    2.037264] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    2.042582] 7 fixed-partitions partitions found on MTD device spi0.0
[    2.049140] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.056658] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.064565] Creating 7 MTD partitions on "spi0.0":
[    2.069514] 0x000000000000-0x000000030000 : "u-boot"
[    2.077831] 0x000000030000-0x000000040000 : "u-boot-env"
[    2.084307] 0x000000040000-0x000000050000 : "factory"
[    2.090658] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.098476] 0x000000050000-0x000000fd0000 : "firmware"
[    2.103776] mtd: partition "firmware" extends beyond the end of device "spi0.0" -- size truncated to 0x7b0000
[    2.117178] 0x000000fd0000-0x000000fe0000 : "debug"
[    2.122244] mtd: partition "debug" is out of reach -- disabled
[    2.130176] 0x0000000fe000-0x00000010e000 : "backup"
[    2.139699] 0x000000ff0000-0x000001000000 : "bdinfo"
[    2.144779] mtd: partition "bdinfo" is out of reach -- disabled
[    2.170068] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.209784] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized
[    2.217809] mtk_soc_eth 10100000.ethernet: generated random MAC address 2e:8d:00:56:a3:5c
[    2.227221] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    2.239573] NET: Registered PF_INET6 protocol family
[    3.173474] Segment Routing with IPv6
[    3.177356] In-situ OAM (IOAM) with IPv6
[    3.181711] NET: Registered PF_PACKET protocol family
[    3.186889] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    3.200448] 8021q: 802.1Q VLAN Support v1.8
[    3.231997] gpio-export gpio_export: 1 gpio(s) exported
[    3.241432] clk: Disabling unused clocks
[    9.850279] Freeing unused kernel image (initmem) memory: 5136K
[    9.856326] This architecture does not have kernel memory protection.
[    9.862924] Run /init as init process
[   10.777398] init: Console is alive
[   10.781604] init: - watchdog -
[   10.811263] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[   10.836210] usbcore: registered new interface driver usbfs
[   10.841993] usbcore: registered new interface driver hub
[   10.847632] usbcore: registered new device driver usb
[   10.857104] gpio_button_hotplug: loading out-of-tree module taints kernel.
[   10.889004] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[   10.895872] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[   10.901204] ehci-platform 101c0000.ehci: EHCI Host Controller
[   10.907082] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[   10.915294] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[   10.949613] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[   10.957618] hub 1-0:1.0: USB hub found
[   10.962743] hub 1-0:1.0: 1 port detected
[   10.978857] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[   10.985891] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[   10.994133] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[   11.075474] hub 2-0:1.0: USB hub found
[   11.080148] hub 2-0:1.0: 1 port detected
[   11.093687] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[   11.112018] init: - preinit -

[   13.919412] random: crng init done
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   18.827808] procd: - early -
[   18.831303] procd: - watchdog -
[   19.525766] procd: - watchdog -
[   19.529768] procd: - ubus -
4[   19.591077] procd: - init -
Please press Enter to activate this console.

login[509]: root login on 'ttyS0'


BusyBox v1.36.1 (2025-02-03 23:09:37 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 24.10.0, r28427-6df0e3d02a
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@(none):~# [   20.690541] kmodloader: loading kernel modules from /etc/modules.d/*

root@(none):~#
root@(none):~# [   21.629449] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   21.637080] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   21.883521] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[   21.920499] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   21.926550] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   21.969386] mt76_wmac 10300000.wmac: firmware init done
[   22.140677] mt76_wmac 10300000.wmac: registering led 'mt76-phy0'
[   22.201852] mt7615e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   22.270587] mt7615e 0000:01:00.0: registering led 'mt76-phy1'
[   22.498022] PPP generic driver version 2.4.2
[   22.521726] NET: Registered PF_PPPOX protocol family
[   22.557372] kmodloader: done loading kernel modules from /etc/modules.d/*
[   24.061428] mt7615e 0000:01:00.0: mediatek/mt7663pr2h.bin not found, switching to mediatek/mt7663pr2h_rebb.bin
[   24.122016] mt7615e 0000:01:00.0: HW/SW Version: 0x65322d31, Build Time: 2009041715da1a1
[   24.122016]
[   24.182441] mt7615e 0000:01:00.0: N9 Firmware Version: 7663mp1827, Build Time: 20200904171623
[   24.191204] mt7615e 0000:01:00.0: Region number: 0x3
[   24.196251] mt7615e 0000:01:00.0: Parsing tailer Region: 0
[   24.262472] mt7615e 0000:01:00.0: Region 0, override_addr = 0x00112c00
[   24.269147] mt7615e 0000:01:00.0: Parsing tailer Region: 1
[   24.310147] mt7615e 0000:01:00.0: Parsing tailer Region: 2
[   24.316097] mt7615e 0000:01:00.0: override_addr = 0x00112c00, option = 3
[   24.451894] urngd: v1.0.2 started.

root@(none):~# cat /proc/cpuinfo
system type             : MediaTek MT7628AN ver:1 eco:2
machine                 : Cudy TR1200 v1
processor               : 0
cpu model               : MIPS 24KEc V5.5
BogoMIPS                : 385.84
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_intr_bit perf mm_full
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

root@OpenWrt:~# dmesg
[    0.000000] Linux version 6.6.73 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28427-6df0e3d02a) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Mon Feb  3 23:09:37 2025
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Cudy TR1200 v1
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=0006612d
[    0.000000] Readback ErrCtl register=0006612d
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 53152K/65536K available (4974K kernel code, 588K rwdata, 812K rodata, 5136K init, 201K bss, 12384K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000002] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015466] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087657] pid_max: default: 32768 minimum: 301
[    0.105623] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.120001] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.146151] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[    0.172701] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.192113] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.205600] pinctrl core: initialized pinctrl subsystem
[    0.220027] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.232618] thermal_sys: Registered thermal governor 'step_wise'
[    0.236306] /pinctrl: Fixed dependency cycle(s) with /pinctrl/pinctrl0
[    0.525903] PCI host bridge to bus 0000:00
[    0.533948] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.547485] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    0.561072] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.576786] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[    0.588610] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.600985] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    0.613456] pci 0000:00:00.0: supports D1
[    0.621257] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.634733] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.650835] pci 0000:01:00.0: [14c3:7663] type 00 class 0x000280
[    0.662693] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    0.676923] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    0.691198] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    0.705600] pci 0000:01:00.0: supports D1 D2
[    0.713907] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.727042] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    0.756854] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.769872] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.782943] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.795986] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.809751] pci 0000:00:00.0: BAR 9: assigned [mem 0x20000000-0x201fffff pref]
[    0.824025] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.837455] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    0.852776] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    0.868084] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    0.883392] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.893156] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff pref]
[    0.909364] clocksource: Switched to clocksource MIPS
[    0.932991] NET: Registered PF_INET protocol family
[    0.942966] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.959275] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.975966] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.991211] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    1.006355] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    1.020302] TCP: Hash tables configured (established 1024 bind 1024)
[    1.033052] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    1.045941] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    1.060950] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    1.072206] PCI: CLS 0 bytes, default 32
[    1.842001] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    1.855384] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.866846] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.894755] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    1.911223] mt7621_gpio 10000600.gpio: registering 32 gpios
[    1.922626] mt7621_gpio 10000600.gpio: registering 32 gpios
[    1.934090] mt7621_gpio 10000600.gpio: registering 32 gpios
[    1.945980] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    1.966789] printk: console [ttyS0] disabled
[    1.975966] 10000c00.uart0: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    1.993405] printk: console [ttyS0] enabled
[    2.001849] printk: bootconsole [early0] disabled
[    2.028527] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    2.037264] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    2.042582] 7 fixed-partitions partitions found on MTD device spi0.0
[    2.049140] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.056658] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.064565] Creating 7 MTD partitions on "spi0.0":
[    2.069514] 0x000000000000-0x000000030000 : "u-boot"
[    2.077831] 0x000000030000-0x000000040000 : "u-boot-env"
[    2.084307] 0x000000040000-0x000000050000 : "factory"
[    2.090658] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.098476] 0x000000050000-0x000000fd0000 : "firmware"
[    2.103776] mtd: partition "firmware" extends beyond the end of device "spi0.0" -- size truncated to 0x7b0000
[    2.117178] 0x000000fd0000-0x000000fe0000 : "debug"
[    2.122244] mtd: partition "debug" is out of reach -- disabled
[    2.130176] 0x0000000fe000-0x00000010e000 : "backup"
[    2.139699] 0x000000ff0000-0x000001000000 : "bdinfo"
[    2.144779] mtd: partition "bdinfo" is out of reach -- disabled
[    2.170068] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.209784] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized
[    2.217809] mtk_soc_eth 10100000.ethernet: generated random MAC address 2e:8d:00:56:a3:5c
[    2.227221] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    2.239573] NET: Registered PF_INET6 protocol family
[    3.173474] Segment Routing with IPv6
[    3.177356] In-situ OAM (IOAM) with IPv6
[    3.181711] NET: Registered PF_PACKET protocol family
[    3.186889] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    3.200448] 8021q: 802.1Q VLAN Support v1.8
[    3.231997] gpio-export gpio_export: 1 gpio(s) exported
[    3.241432] clk: Disabling unused clocks
[    9.850279] Freeing unused kernel image (initmem) memory: 5136K
[    9.856326] This architecture does not have kernel memory protection.
[    9.862924] Run /init as init process
[    9.866644]   with arguments:
[    9.866653]     /init
[    9.866662]   with environment:
[    9.866670]     HOME=/
[    9.866679]     TERM=linux
[   10.777398] init: Console is alive
[   10.781604] init: - watchdog -
[   10.811263] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[   10.836210] usbcore: registered new interface driver usbfs
[   10.841993] usbcore: registered new interface driver hub
[   10.847632] usbcore: registered new device driver usb
[   10.857104] gpio_button_hotplug: loading out-of-tree module taints kernel.
[   10.889004] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[   10.895872] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[   10.901204] ehci-platform 101c0000.ehci: EHCI Host Controller
[   10.907082] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[   10.915294] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[   10.949613] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[   10.957618] hub 1-0:1.0: USB hub found
[   10.962743] hub 1-0:1.0: 1 port detected
[   10.978857] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[   10.985891] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[   10.994133] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[   11.075474] hub 2-0:1.0: USB hub found
[   11.080148] hub 2-0:1.0: 1 port detected
[   11.093687] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[   11.112018] init: - preinit -
[   13.919412] random: crng init done
[   18.827808] procd: - early -
[   18.831303] procd: - watchdog -
[   19.525766] procd: - watchdog -
[   19.529768] procd: - ubus -
[   19.591077] procd: - init -
[   20.690541] kmodloader: loading kernel modules from /etc/modules.d/*
[   21.629449] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   21.637080] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   21.883521] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[   21.920499] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   21.926550] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   21.969386] mt76_wmac 10300000.wmac: firmware init done
[   22.140677] mt76_wmac 10300000.wmac: registering led 'mt76-phy0'
[   22.148822] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   22.201852] mt7615e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   22.270587] mt7615e 0000:01:00.0: registering led 'mt76-phy1'
[   22.278491] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
[   22.278536] ieee80211 phy1: copying sband (band 1) due to VHT EXT NSS BW flag
[   22.498022] PPP generic driver version 2.4.2
[   22.521726] NET: Registered PF_PPPOX protocol family
[   22.557372] kmodloader: done loading kernel modules from /etc/modules.d/*
[   24.061428] mt7615e 0000:01:00.0: mediatek/mt7663pr2h.bin not found, switching to mediatek/mt7663pr2h_rebb.bin
[   24.122016] mt7615e 0000:01:00.0: HW/SW Version: 0x65322d31, Build Time: 2009041715da1a1
[   24.122016]
[   24.182441] mt7615e 0000:01:00.0: N9 Firmware Version: 7663mp1827, Build Time: 20200904171623
[   24.191204] mt7615e 0000:01:00.0: Region number: 0x3
[   24.196251] mt7615e 0000:01:00.0: Parsing tailer Region: 0
[   24.262472] mt7615e 0000:01:00.0: Region 0, override_addr = 0x00112c00
[   24.269147] mt7615e 0000:01:00.0: Parsing tailer Region: 1
[   24.310147] mt7615e 0000:01:00.0: Parsing tailer Region: 2
[   24.316097] mt7615e 0000:01:00.0: override_addr = 0x00112c00, option = 3
[   24.451894] urngd: v1.0.2 started.
root@OpenWrt:~# [   51.293605] br-lan: port 1(eth0.1) entered blocking state
[   51.299209] br-lan: port 1(eth0.1) entered disabled state
[   51.304816] eth0.1: entered allmulticast mode
[   51.309269] mtk_soc_eth 10100000.ethernet eth0: entered allmulticast mode
[   51.316620] eth0.1: entered promiscuous mode
[   51.321045] mtk_soc_eth 10100000.ethernet eth0: entered promiscuous mode
lspci
-ash: lspci: not found
root@OpenWrt:~# cat /proc/
1/     OpenWrt:~# cat /proc/sys/kernel/▒▒▒▒▒▒▒怞▒x8xx`8▒8~▒▒▒88x8▒8`▒▒▒xx8▒8888

slh · April 24, 2025, 12:52am

You are mixing up bits and bytes here, this device has 8 MByte flash and 64 MByte RAM, while stated minimum system requirements for >24.10.x are 16/128. While that does not make supporting this device impossible, it's not a great starting position for new device support - and mt7628 is very much on the low end (slow and not-great WLAN) to begin with...

tl;dr: not impossible, but not a good choice either.

andyboeh · April 24, 2025, 6:46am

Judging from the case design, this looks suspiciously like a rebranded YunCore device. Several of those are already supported.

There are also supported KuWFi devices, but not all of them are Yuncore (the N650 is not a Yuncore device).

Double-G · April 24, 2025, 9:00pm

You seem right, this devices looks exactly like the KuWfi and has a similar specification except that it comes with 16 instead of 8 MB flash, which is the weakpoint of my KuWfi

andyboeh · April 25, 2025, 5:19am

The Yuncore AP1200F comes with 8MB flash according to their website.

Anyway, it's not yet supported, but several other Yuncore devices are. Looking and learning from the other Yuncore devices should give you a head start.

Double-G · May 8, 2025, 3:51pm

Okay, I took the image from the Yunicore M300 (openwrt-24.10.0-ramips-mt76x8-yuncore_m300) which works fine and does not reboot due to the watchdog not rebooting as e.g. the asus rt ac1200 did.

LAN and 2.4 GHz wifi are working fine, but I can't get the 5GHz wifi running.
on the asus-image it worked:

[   22.009586] mt7615e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   22.072867] mt7615e 0000:01:00.0: registering led 'mt76-phy1'
[   23.929211] mt7615e 0000:01:00.0: mediatek/mt7663pr2h.bin not found, switching to mediatek/mt7663pr2h_rebb.bin
[   24.020146] mt7615e 0000:01:00.0: HW/SW Version: 0x65322d31, Build Time: 2009041715da1a1
[   24.110275] mt7615e 0000:01:00.0: N9 Firmware Version: 7663mp1827, Build Time: 20200904171623
[   24.127306] mt7615e 0000:01:00.0: Region number: 0x3
[   24.137145] mt7615e 0000:01:00.0: Parsing tailer Region: 0
[   24.200203] mt7615e 0000:01:00.0: Region 0, override_addr = 0x00112c00
[   24.213220] mt7615e 0000:01:00.0: Parsing tailer Region: 1
[   24.267924] mt7615e 0000:01:00.0: Parsing tailer Region: 2
[   24.317486] mt7615e 0000:01:00.0: override_addr = 0x00112c00, option = 3

I installed the following packages, but unfortunately it did not trigger the MT7615e-driver.

kmod-mt76-connac
kmod-mt76-core
kmod-mt7603
kmod-mt7615-common
kmod-mt7615e
kmod-mt7663-firmware-ap

Any Idea which packages are missing to get the 5GHz wifi working?

andyboeh · May 8, 2025, 4:36pm

Usually, you cannot get WiFi working on foreign firmware files because the location of the required EEPROM data is embedded in the DTS. You need to come up with your own device-specific DTS to make it fully working. The same is true for the partition layout itself - please create a device-specific image. You can gather a lot of the required information from the OEM boot log.

Double-G · May 10, 2025, 9:38pm

Thanks for the hint.
Unfortunately the original stock-firmware was locked and I couldn't get root access, so I have to guess.

Well I know that 5Ghz-Wifi (phy1) works when using e.g. the asus rt-ac1200-v2-image, so I took some things from it and just tried.

target/linux/ramips/image/mt76x8.mk: added the following lines

define Device/yuncore_1200f
  IMAGE_SIZE := 7872k
  DEVICE_VENDOR := Yuncore
  DEVICE_MODEL := 1200F
  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7663-firmware-ap
endef
TARGET_DEVICES += yuncore_1200f

Created the new file target/linux/ramips/dts/mt7628an_yuncore_1200f.dts, contents:

#include "mt7628an.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/leds/common.h>

/ {
	compatible = "yuncore,1200f", "mediatek,mt7628an-soc";
	model = "Yuncore 1200F";

	chosen {
		bootargs = "console=ttyS0,57600";
	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
	};

	aliases {
		label-mac = &ethernet;
		led-boot = &led_indicator;
		led-failsafe = &led_indicator;
		led-running = &led_indicator;
		led-upgrade = &led_indicator;
	};

	leds {
		compatible = "gpio-leds";

		led_indicator: indicator {
			function = LED_FUNCTION_INDICATOR;
			color = <LED_COLOR_ID_RED>;
			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
		};

		lan {
			function = LED_FUNCTION_LAN;
			color = <LED_COLOR_ID_GREEN>;
			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
		};

		wan {
			function = LED_FUNCTION_WAN;
			color = <LED_COLOR_ID_GREEN>;
			gpios = <&gpio 39 GPIO_ACTIVE_LOW>;
		};
	};

	watchdog {
		compatible = "linux,wdt-gpio";
		gpios = <&gpio 37 GPIO_ACTIVE_HIGH>;
		hw_algo = "toggle";
		hw_margin_ms = <20000>;
		always-running;
	};
};

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <10000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x0 0x30000>;
				read-only;
			};

			partition@30000 {
				label = "u-boot-env";
				reg = <0x30000 0x10000>;
				read-only;
			};

			partition@40000 {
				label = "factory";
				reg = <0x40000 0x10000>;
				read-only;

				nvmem-layout {
					compatible = "fixed-layout";
					#address-cells = <1>;
					#size-cells = <1>;

					eeprom_factory_0: eeprom@0 {
						reg = <0x0 0x400>;
					};

					macaddr_factory_4: macaddr@4 {
						reg = <0x4 0x6>;
					};
				};
			};

			partition@50000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x50000 0x7b0000>;
			};
		};
	};
};

&ethernet {
	nvmem-cells = <&macaddr_factory_4>;
	nvmem-cell-names = "mac-address";
};

&esw {
	mediatek,portmap = <0x3e>;
};

&wmac {
	status = "okay";

	nvmem-cells = <&eeprom_factory_0>;
	nvmem-cell-names = "eeprom";
};

&state_default {
	gpio {
		groups = "pwm1", "pwm0", "uart2", "uart1", "i2c", "refclk",
			 "perst", "wdt", "sdmode", "i2s", "spi cs1", "spis",
			 "gpio", "p0led_an", "p1led_an", "p2led_an", "p3led_an",
			 "p4led_an", "wled_kn", "p0led_kn", "p1led_kn",
			 "p2led_kn", "p3led_kn", "p4led_kn";
		function = "gpio";
	};

	wlan {
		groups = "wled_an";
		function = "wled_an";
	};
};

&pcie {
        status = "okay";
};

&pcie0 {
        mt76@0,0 {
                compatible = "mediatek,mt76";
                reg = <0x0000 0 0 0 0>;
                ieee80211-freq-limit = <5000000 6000000>;

                led {
                        led-sources = <2>;
                        led-active-low;
                };
        };
};

I took the last two options (eeprom_factory_8000 and pcie0) from asus-rtac1200-v2.

As you see I have no real clue what I'm doing, but... I could built an image that boots and that has 2Ghz as well as 5Ghz working.
The only problem is that there is no mac-address for phy1 (5GHz), so openwrt creates a random mac instead.
Oh an well... the LEDs do not work properly yet.

andyboeh · May 11, 2025, 8:22pm

The boot log is very often clearly visible on serial console during boot, though some vendors hide this. You will save yourself a lot of guesswork if you get that.

The following alternative approach usually works, but is more "fun": Create a full dump of the flash (e.g. from an initramfs version; you should do that anyway before trying to flash anything) and analyze the file with binwalk and a hex editor. You should be able to find the locations of the MAC address(es) and the EEPROM file(s) with relative ease.

It is also possible that the boot loader tells you the partition map if you have a closer look at the environment variables and the available commands.

Double-G · May 11, 2025, 8:45pm

update:

found the macs in the eeprom:
/dev/mtd2 0x4
9c:e5:49:60:2a:64

root@OpenWrt:~# get_mac_binary /dev/mtd2 0x8004
9c:e5:49:60:2a:66

added to DTS-file:

                        partition@40000 {
                                label = "factory";
                                reg = <0x40000 0x10000>;
                                read-only;

                                nvmem-layout {
                                        compatible = "fixed-layout";
                                        #address-cells = <1>;
                                        #size-cells = <1>;

                                        eeprom_factory_0: eeprom@0 {
                                                reg = <0x0 0x400>;
                                        };

                                        macaddr_factory_4: macaddr@4 {
                                                reg = <0x4 0x6>;
                                        };
                                        eeprom_factory_8000: eeprom@8000 {
                                                reg = <0x8000 0x600>;
                                        };

                                        macaddr_factory_8004: macaddr@8004 {
                                                reg = <0x8004 0x6>;
                                        };
                                };
                        };

and


&pcie0 {
        mt76@0,0 {
                compatible = "mediatek,mt76";
                reg = <0x0000 0 0 0 0>;
                ieee80211-freq-limit = <5000000 6000000>;
                nvmem-cells = <&eeprom_factory_8000>, <&macaddr_factory_8004>;
                nvmem-cell-names = "eeprom", "mac-address";

                led {
                        led-sources = <2>;
                        led-active-low;
                };
        };
};

Also had to edit target/linux/ramips/mt76x8/base-files/etc/board.d,
file 01_leds

yuncore,1200f)
        ucidef_set_led_switch "lan" "lan" "green:lan" "switch0" "0xf"
        ucidef_set_led_switch "wan" "wan" "green:wan" "switch0" "0x10"
        ;;

and file 02_network in order to get the wan and lan-port working:

        yuncore,1200f)
                ucidef_add_switch "switch0" \
                        "3:lan" "4:wan" "6@eth0"
                ;;

Double-G · May 11, 2025, 9:01pm

one bug remains:
lan and wifi0 both have the same mac: 9C:E5:49:60:2A:64
while wifi1 (5ghz) has 9C:E5:49:60:2A:66.

I need to edit the DTS in a way that wifi0 is eth0 + 1. Any idea how to do that?

LEDs aren't completely right yet, but I'm close to it.

Regards

andyboeh · May 12, 2025, 5:09pm

There is an easy way to do this in the dts:

                nvmem-cells = <&eeprom_factory_8000>, <&macaddr_factory_8004 1>;

Add " 1" to the nvmem-cellsline, IIRC this increments the MAC +1.