Adding support to Comfast CF-EW75

dsouza · December 15, 2022, 9:17am

Pictures confirming the chipsets and the bootlog from UART are helpful.

I just purchased one of this, when I have tiime I will take it apart and share pictures.

By the way, how did you backup the original firmware? Can you share it please?

reydeyes · December 15, 2022, 12:12pm

I will document it maybe tomorrow I will spare some time doing videos and logging.
and for the original firmware, I will also add how to back it up.

dsouza · December 15, 2022, 4:58pm

Below are the internal photos. Confirmed chipsets:

QCA9563-AL3A: SoC + WLAN 2.4 Ghz 2x2
QCA9886: WLAN 5Ghz 2x2
Nanya NT5TU64M16HG-AC: 128MB DRAM DDR2
Macronix 25L12833F: 16Mb Flash (on the backside of the PCB)
MotorComm YT8531SC: Gigabit Ethernet

dsouza · December 15, 2022, 10:14pm

And here are the partitions from the factory firmware:

[    0.344661] 4 ofpart partitions found on MTD device spi0.0
[    0.350338] Creating 4 MTD partitions on "spi0.0":
[    0.355285] 0x000000000000-0x000000040000 : "u-boot"
[    0.361792] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.368758] 0x000000050000-0x000000ff0000 : "firmware"
[    0.417957] 2 uimage-fw partitions found on MTD device firmware
[    0.424082] 0x000000050000-0x0000001a0000 : "kernel"
[    0.430409] 0x0000001a0000-0x000000ff0000 : "rootfs"
[    0.437015] mtd: device 4 (rootfs) set to be root filesystem
[    0.442947] 1 squashfs-split partitions found on MTD device rootfs
[    0.449384] 0x000000820000-0x000000ff0000 : "rootfs_data"
[    0.456468] 0x000000ff0000-0x000001000000 : "art"

Below is the full boot log. The initial part is corrupted, so u-boot log is not fully readable. It looks like UART is correctly initialized only after ttry console is enabled.

Also after boot is complete, it requires a login and password to access console via UART. I tried the default ones (used in the web interface) and it did not work. If anyone knows how the used/password Comfast uses in their UART console please share here.

slh · December 16, 2022, 2:06am

Be aware that support for this PHY has just now being submitted for upstream review this month and is not present in any released linux version (including net-next), yet.

anon4457646 · December 16, 2022, 6:01am

I noticed that there are two versions of this device so maybe this is the difference

reydeyes · December 29, 2022, 4:54pm

In case of failed attempts or bricked device, here is the device's stock firmware.

Steps on how to upload the firmware:

You need to set the static IP address on your PC which is "192.168.1.10" - this specific IP is for the recovery to be detected by the device. make sure you connect the LAN to your PC. and prepare your CMD to ping the "192.168.1.1" so that you will notice the response when the web recovery is ready to access.
NOTE: Sometimes you need to switch browsers to access it. chrome is very picky when it comes to accessing IP.
You need to press the reset button and insert the POE to power the device and wait for 3-4 blinks to halt the device for recovery. And then you'll notice that it will flash a bit and then you can now try to access the web to be sure.
You will now be able to upload the firmware that you want.

The password of the stock firmware is

pogs1233

reydeyes · December 29, 2022, 5:03pm

@dsouza Here is the video on how to get the password of the device. just follow the video. this is where I get the root password of the device when I try to install the OpenWRT.

reydeyes · December 29, 2022, 5:12pm

@dsouza I just remember the password for the admin it is "pogs1233" after you upload the firmware you can try that password. also, the root password would be also "openwrt" I think I had already set the password of this firmware you can try it out I hope it helps.

I cannot get my ew75 now because I already deployed my AP to my business. i will wait for the OpenWRT firmware to be released and try it out.

anon4457646 · December 29, 2022, 10:26pm

is that the password for ssh? or it is just for http

dsouza · December 30, 2022, 1:03am

I tried to install YunCore A782 on my CF-EW75, but it did not boot. I believe this might be due to the fact that mine is CF-EW75v2.

Since I had managed to backup stock firmware via SSH , I quickly restored it back to factory firmware using the firmware recovery mode (power on with reset button pressed).

But factory firmware is really bad (it is based on LEDE 17). At least I was not able to maintain a stable connection of a MacBook Air M1 with the 5Ghz radio. So basically I just threw away my money with this device.

For now I will keep it and hopefully it will get OpenWrt support sometime in the future.

anon4457646 · December 30, 2022, 1:06am

yes this devices are really bad, i have 3 devices and one is ath9k, and that is the worst device ath9k i have.
just bad devices

dsouza · December 30, 2022, 1:10am

BTW, if anyone wants to change the SSH password, the following procedure (from this post) works with this device:

The stock firmware has an SSH daemon but the root password is not known, and does not match the web GUI's password. However, the following procedure allows setting it to a known one and gaining SSH access to the device.

Using the stock web GUI, under System → Tools → Export Settings, download a backup of the configuration to your computer

The generated file, called bakup.file [sic], is actually a tar.gz file containing the etc folder and some configuration files

Extract the backup and edit the etc/shadow file

Replace the first line of etc/shadow by root:$1$pjKB26GF$T9mfHI/C6JGX9rQ8CYDPl/:18270:0:99999:7::: to set root password to “openwrt”

Repack the modified etc directory as a tar.gz. file, and rename it to bakup.file

Using the stock web GUI, use System → Tools → Import Settings to upload the modified backup

The device will reboot and the password will be openwrt

reydeyes · December 30, 2022, 1:12am

Http. The ssh password is "openwrt"

anon4457646 · December 30, 2022, 1:18am

i know that, after the hack, but i'm really mad with this devices, i'm try that to get root access for a different device.
hope i can get the wireless source or something nice

reydeyes · December 30, 2022, 11:02am

Try this firmware that i have.

to access the web login you need to
Static your IP address to 10.0.31.1 and subnet mask to 255.255.224.0
the password of this is pogs1233

reydeyes · January 11, 2023, 7:44am

I was able to boot up my new EW75 with the recent OpenWRT version that I have used before. and this is the SYSTEM LOG:

Wed Jan 11 15:25:29 2023 daemon.notice procd: /etc/rc.d/S96led: setting up led 2Ghz
Wed Jan 11 15:25:29 2023 daemon.notice procd: /etc/rc.d/S96led: setting up led 5Ghz
Wed Jan 11 15:25:29 2023 daemon.notice procd: /etc/rc.d/S96led: setting up led 1
Wed Jan 11 15:25:29 2023 daemon.notice procd: /etc/rc.d/S96led: setting up led 2
Wed Jan 11 15:25:30 2023 kern.info kernel: [   80.648781] br-lan: port 1(eth0) entered blocking state
Wed Jan 11 15:25:30 2023 kern.info kernel: [   80.654190] br-lan: port 1(eth0) entered disabled state
Wed Jan 11 15:25:30 2023 kern.info kernel: [   80.659913] device eth0 entered promiscuous mode
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Interface 'lan' is enabled
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Interface 'lan' is setting up now
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Interface 'lan' is now up
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Interface 'loopback' is enabled
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Interface 'loopback' is setting up now
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Interface 'loopback' is now up
Wed Jan 11 15:25:30 2023 daemon.info procd: - init complete -
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Network device 'lo' link is up
Wed Jan 11 15:25:30 2023 daemon.notice netifd: Interface 'loopback' has link connectivity
Wed Jan 11 15:25:31 2023 daemon.info urandom_seed[2210]: Seed saved (/etc/urandom.seed)
Wed Jan 11 15:25:32 2023 kern.info kernel: [   82.739893] eth0: link up (100Mbps/Full duplex)
Wed Jan 11 15:25:32 2023 kern.info kernel: [   82.744618] br-lan: port 1(eth0) entered blocking state
Wed Jan 11 15:25:32 2023 kern.info kernel: [   82.750060] br-lan: port 1(eth0) entered forwarding state
Wed Jan 11 15:25:32 2023 daemon.notice netifd: Network device 'eth0' link is up
Wed Jan 11 15:25:32 2023 daemon.notice netifd: bridge 'br-lan' link is up
Wed Jan 11 15:25:32 2023 daemon.notice netifd: Interface 'lan' has link connectivity
Wed Jan 11 15:25:34 2023 daemon.notice hostapd: Configuration file: /var/run/hostapd-phy1.conf (phy 2Ghz) --> new PHY
Wed Jan 11 15:25:34 2023 kern.info kernel: [   84.582112] br-lan: port 2(2Ghz) entered blocking state
Wed Jan 11 15:25:34 2023 kern.info kernel: [   84.587522] br-lan: port 2(2Ghz) entered disabled state
Wed Jan 11 15:25:34 2023 kern.info kernel: [   84.593256] device 2Ghz entered promiscuous mode
Wed Jan 11 15:25:34 2023 daemon.notice hostapd: 2Ghz: interface state UNINITIALIZED->COUNTRY_UPDATE
Wed Jan 11 15:25:34 2023 kern.info kernel: [   84.747933] IPv6: ADDRCONF(NETDEV_CHANGE): 2Ghz: link becomes ready
Wed Jan 11 15:25:34 2023 kern.info kernel: [   84.754640] br-lan: port 2(2Ghz) entered blocking state
Wed Jan 11 15:25:34 2023 kern.info kernel: [   84.760087] br-lan: port 2(2Ghz) entered forwarding state
Wed Jan 11 15:25:34 2023 daemon.notice hostapd: 2Ghz: interface state COUNTRY_UPDATE->ENABLED
Wed Jan 11 15:25:34 2023 daemon.notice hostapd: 2Ghz: AP-ENABLED
Wed Jan 11 15:25:34 2023 daemon.notice hostapd: Configuration file: /var/run/hostapd-phy0.conf (phy 5Ghz) --> new PHY
Wed Jan 11 15:25:36 2023 daemon.notice netifd: Wireless device 'radio1' is now up
Wed Jan 11 15:25:37 2023 kern.warn kernel: [   87.385972] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
Wed Jan 11 15:25:37 2023 kern.warn kernel: [   87.393780] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
Wed Jan 11 15:25:37 2023 kern.info kernel: [   87.445386] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
Wed Jan 11 15:25:37 2023 kern.info kernel: [   87.456735] ath10k_pci 0000:00:00.0: wmi print 'free: 114572 iram: 12644 sram: 29508'
Wed Jan 11 15:25:37 2023 kern.info kernel: [   87.775345] ath10k_pci 0000:00:00.0: rts threshold -1
Wed Jan 11 15:25:37 2023 kern.warn kernel: [   87.780919] ath10k_pci 0000:00:00.0: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
Wed Jan 11 15:25:37 2023 daemon.notice netifd: Network device '2Ghz' link is up
Wed Jan 11 15:25:37 2023 kern.info kernel: [   87.807483] br-lan: port 3(5Ghz) entered blocking state
Wed Jan 11 15:25:37 2023 kern.info kernel: [   87.813006] br-lan: port 3(5Ghz) entered disabled state
Wed Jan 11 15:25:37 2023 kern.info kernel: [   87.819038] device 5Ghz entered promiscuous mode
Wed Jan 11 15:25:37 2023 daemon.notice hostapd: 5Ghz: interface state UNINITIALIZED->COUNTRY_UPDATE
Wed Jan 11 15:25:37 2023 daemon.notice hostapd: 5Ghz: interface state COUNTRY_UPDATE->HT_SCAN
Wed Jan 11 15:25:38 2023 kern.info kernel: [   88.373170] IPv6: ADDRCONF(NETDEV_CHANGE): 5Ghz: link becomes ready
Wed Jan 11 15:25:38 2023 kern.info kernel: [   88.379924] br-lan: port 3(5Ghz) entered blocking state
Wed Jan 11 15:25:38 2023 kern.info kernel: [   88.385350] br-lan: port 3(5Ghz) entered forwarding state
Wed Jan 11 15:25:38 2023 kern.info kernel: [   88.391093] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
Wed Jan 11 15:25:38 2023 daemon.notice hostapd: 5Ghz: interface state HT_SCAN->ENABLED
Wed Jan 11 15:25:38 2023 daemon.notice hostapd: 5Ghz: AP-ENABLED
Wed Jan 11 15:25:38 2023 daemon.notice netifd: Wireless device 'radio0' is now up
Wed Jan 11 15:25:38 2023 daemon.notice netifd: Network device '5Ghz' link is up
Wed Jan 11 15:25:48 2023 user.info : luci: failed login on / for root from 10.0.31.1
Wed Jan 11 15:25:51 2023 user.info : luci: accepted login on / for root from 10.0.31.1

Full System Log Link: EW75 System Log

KERNEL LOG

[   54.897177] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x56.
[   54.906945] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   54.913738] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   57.769111] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[   57.778668] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   57.797842] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9888-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 59e741e7
[   58.131145] ath10k_pci 0000:00:00.0: Loading BDF type 0
[   58.141877] ath10k_pci 0000:00:00.0: board_file api 2 bmi_id 0:16 crc32 f228337a
[   59.903364] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   59.911151] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
[   59.962489] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   59.973807] ath10k_pci 0000:00:00.0: wmi print 'free: 114572 iram: 12644 sram: 29508'
[   60.212997] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   60.321471] ath: EEPROM regdomain: 0x0
[   60.321482] ath: EEPROM indicates default country code should be used
[   60.321486] ath: doing EEPROM country->regdmn map search
[   60.321499] ath: country maps to regdmn code: 0x3a
[   60.321505] ath: Country alpha2 being used: US
[   60.321509] ath: Regpair used: 0x3a
[   60.424970] ath: EEPROM regdomain: 0x0
[   60.424983] ath: EEPROM indicates default country code should be used
[   60.424988] ath: doing EEPROM country->regdmn map search
[   60.425002] ath: country maps to regdmn code: 0x3a
[   60.425008] ath: Country alpha2 being used: US
[   60.425012] ath: Regpair used: 0x3a
[   60.435839] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
[   60.437693] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[   60.478692] kmodloader: done loading kernel modules from /etc/modules.d/*
[   80.648781] br-lan: port 1(eth0) entered blocking state
[   80.654190] br-lan: port 1(eth0) entered disabled state
[   80.659913] device eth0 entered promiscuous mode
[   82.739893] eth0: link up (100Mbps/Full duplex)
[   82.744618] br-lan: port 1(eth0) entered blocking state
[   82.750060] br-lan: port 1(eth0) entered forwarding state
[   84.582112] br-lan: port 2(2Ghz) entered blocking state
[   84.587522] br-lan: port 2(2Ghz) entered disabled state
[   84.593256] device 2Ghz entered promiscuous mode
[   84.747933] IPv6: ADDRCONF(NETDEV_CHANGE): 2Ghz: link becomes ready
[   84.754640] br-lan: port 2(2Ghz) entered blocking state
[   84.760087] br-lan: port 2(2Ghz) entered forwarding state
[   87.385972] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   87.393780] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
[   87.445386] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   87.456735] ath10k_pci 0000:00:00.0: wmi print 'free: 114572 iram: 12644 sram: 29508'
[   87.775345] ath10k_pci 0000:00:00.0: rts threshold -1
[   87.780919] ath10k_pci 0000:00:00.0: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
[   87.807483] br-lan: port 3(5Ghz) entered blocking state
[   87.813006] br-lan: port 3(5Ghz) entered disabled state
[   87.819038] device 5Ghz entered promiscuous mode
[   88.373170] IPv6: ADDRCONF(NETDEV_CHANGE): 5Ghz: link becomes ready
[   88.379924] br-lan: port 3(5Ghz) entered blocking state
[   88.385350] br-lan: port 3(5Ghz) entered forwarding state
[   88.391093] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000

Full Kernel Log : EW75 Kernel Log

in my observation, you cannot install the new version 22.03.3 directly. you need to install the firmware that I have configured so that it will boot up.

to access the web interface you need to change your IP and subnet mask to

IP: 10.0.31.1
SUBNET: 255.255.224.0
web: 10.0.31.254
Password: pogs1233

please let me know your thoughts about this @dsouza
And please add this device @pepe2k , @hauke . God Bless you devs.

reydeyes · January 11, 2023, 8:10am

Latest File here : EW75 OpenWRT - 22.03.3

Video: https://youtu.be/3rWAsvJOSz8

dsouza · January 11, 2023, 6:41pm

Thank you @reydeyes!

Would you please share your .config file you used for this build as well as any other change you've made?

This would facilitate others (such myself) to do our own builds, as well as will provide more information to devs so they can add official support to this device.

Thank you.

dsouza · January 23, 2023, 1:36pm

Well, I believe I just destroyed my CF-EW75. I tried to connect it to a POE 802.3af source, and it did not work. Now when I connect it to the supplied POE power brick, it does not turn on anymore.

This unit was so bad with stock firmware that I was not using it. Now then I can literally throw it away.