Comfast cf-e391ax

For Developers
1

Hi everyone,

I received a few days ago a COMFAST CF-E391AX AP. I've been using OpenWrt for a few years, but I have never ported it to a new device, and I’m not sure whether I am on the right track.
I am worried about missing something that could lead me to brick my device. I would be grateful if someone more experienced than I am could help me solve this challenge.

Here is an overview of what I've done so far:

Hardware

E391AX is close to the supported E393AX but with a different hardware. It has 256MB RAM, 128MB flash, 2 ethernets (1G and 2.5G, both being POE ports), WiFI 6 support with 4 antennas.
Specification says: MT7981BA + MT7976CN + GPY211 + YT8531SC-CA

/proc/cpuinfo 
processor	: 0
model name	: ARMv8 Processor rev 4 (v8l)
BogoMIPS	: 26.00
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer	: 0x41
CPU architecture: 8
CPU variant	: 0x0
CPU part	: 0xd03
CPU revision	: 4

processor	: 1
model name	: ARMv8 Processor rev 4 (v8l)
BogoMIPS	: 26.00
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer	: 0x41
CPU architecture: 8
CPU variant	: 0x0
CPU part	: 0xd03
CPU revision	: 4
/proc/device-tree/compatible 
comfast,cf-e391axmediatek,mt7981-spim-snand-2500wan-rfb
free -h 
              total        used        free      shared  buff/cache   available
Mem:         231040       95564      119492         180       15984      121552
cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 08000000 00020000 "spi0.0"
mtd1: 00100000 00020000 "BL2"
mtd2: 00080000 00020000 "u-boot-env"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "FIP"
mtd5: 04000000 00020000 "ubi"

Software

I have rooted the AP using the method described here.
The OS is an old tweaked OpenWrt.

cat /etc/openwrt_release 
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='21.02-SNAPSHOT'
DISTRIB_REVISION='r0-db9b53a'
DISTRIB_TARGET='mediatek/mt7981'
DISTRIB_ARCH='aarch64_cortex-a53'
DISTRIB_DESCRIPTION='OpenWrt 21.02-SNAPSHOT r0-db9b53a'
DISTRIB_TAINTS='no-all busybox'

I have copied the 5 MTD and extracted the DTS.

DTS 
/dts-v1/;

/ {
	compatible = "comfast,cf-e391ax", "mediatek,mt7981-spim-snand-2500wan-rfb";
	interrupt-parent = <0x01>;
	#address-cells = <0x02>;
	#size-cells = <0x02>;
	model = "COMFAST CF-E391AX";

	cpus {
		#address-cells = <0x01>;
		#size-cells = <0x00>;

		cpu@0 {
			device_type = "cpu";
			compatible = "arm,cortex-a53";
			enable-method = "psci";
			reg = <0x00>;
		};

		cpu@1 {
			device_type = "cpu";
			compatible = "arm,cortex-a53";
			enable-method = "psci";
			reg = <0x01>;
		};
	};

	pwm@10048000 {
		compatible = "mediatek,mt7981-pwm";
		reg = <0x00 0x10048000 0x00 0x1000>;
		#pwm-cells = <0x02>;
		clocks = <0x02 0x0d 0x02 0x0c 0x02 0x0e 0x02 0x0f 0x02 0x10>;
		clock-names = "top", "main", "pwm1", "pwm2", "pwm3";
	};

	thermal-zones {

		cpu-thermal {
			polling-delay-passive = <0x3e8>;
			polling-delay = <0x3e8>;
			thermal-sensors = <0x03 0x00>;
		};
	};

	thermal@1100c800 {
		#thermal-sensor-cells = <0x01>;
		compatible = "mediatek,mt7981-thermal";
		reg = <0x00 0x1100c800 0x00 0x800>;
		interrupts = <0x00 0x8a 0x04>;
		clocks = <0x02 0x1c 0x02 0x2f 0x02 0x30>;
		clock-names = "therm", "auxadc", "adc_32k";
		mediatek,auxadc = <0x04>;
		mediatek,apmixedsys = <0x05>;
		nvmem-cells = <0x06>;
		nvmem-cell-names = "calibration-data";
		phandle = <0x03>;
	};

	adc@1100d000 {
		compatible = "mediatek,mt7981-auxadc", "mediatek,mt7622-auxadc";
		reg = <0x00 0x1100d000 0x00 0x1000>;
		clocks = <0x02 0x2f 0x02 0x30>;
		clock-names = "main", "32k";
		#io-channel-cells = <0x01>;
		phandle = <0x04>;
	};

	wed@15010000 {
		compatible = "mediatek,wed";
		wed_num = <0x02>;
		pci_slot_map = <0x00 0x01>;
		reg = <0x00 0x15010000 0x00 0x1000 0x00 0x15011000 0x00 0x1000>;
		interrupt-parent = <0x01>;
		interrupts = <0x00 0xcd 0x04 0x00 0xce 0x04>;
		dy_txbm_enable = "true";
		dy_txbm_budget = <0x08>;
		txbm_init_sz = <0x08>;
		txbm_max_sz = <0x20>;
		status = "okay";
	};

	wdma@15104800 {
		compatible = "mediatek,wed-wdma";
		reg = <0x00 0x15104800 0x00 0x400 0x00 0x15104c00 0x00 0x400>;
	};

	ap2woccif@151A5000 {
		compatible = "mediatek,ap2woccif";
		reg = <0x00 0x151a5000 0x00 0x1000 0x00 0x151ad000 0x00 0x1000>;
		interrupt-parent = <0x01>;
		interrupts = <0x00 0xd3 0x04 0x00 0xd4 0x04>;
	};

	wocpu0_ilm@151E0000 {
		compatible = "mediatek,wocpu0_ilm";
		reg = <0x00 0x151e0000 0x00 0x8000>;
	};

	wocpu_dlm@151E8000 {
		compatible = "mediatek,wocpu_dlm";
		reg = <0x00 0x151e8000 0x00 0x2000 0x00 0x151f8000 0x00 0x2000>;
		resets = <0x07 0x00>;
		reset-names = "wocpu_rst";
	};

	wocpu_boot@15194000 {
		compatible = "mediatek,wocpu_boot";
		reg = <0x00 0x15194000 0x00 0x1000>;
	};

	reserved-memory {
		#address-cells = <0x02>;
		#size-cells = <0x02>;
		ranges;

		secmon@43000000 {
			reg = <0x00 0x43000000 0x00 0x30000>;
			no-map;
		};

		wmcpu-reserved@47C80000 {
			compatible = "mediatek,wmcpu-reserved";
			no-map;
			reg = <0x00 0x47c80000 0x00 0x100000>;
			phandle = <0x15>;
		};

		wocpu0_emi@47D80000 {
			compatible = "mediatek,wocpu0_emi";
			no-map;
			reg = <0x00 0x47d80000 0x00 0x40000>;
			shared = <0x00>;
		};

		wocpu_data@47DC0000 {
			compatible = "mediatek,wocpu_data";
			no-map;
			reg = <0x00 0x47dc0000 0x00 0x240000>;
			shared = <0x01>;
		};
	};

	psci {
		compatible = "arm,psci-0.2";
		method = "smc";
	};

	oscillator@0 {
		compatible = "fixed-clock";
		#clock-cells = <0x00>;
		clock-frequency = <0x2625a00>;
		clock-output-names = "clkxtal";
		phandle = <0x1b>;
	};

	infracfg_ao@10001000 {
		compatible = "mediatek,mt7981-infracfg_ao", "syscon";
		reg = <0x00 0x10001000 0x00 0x68>;
		#clock-cells = <0x01>;
		phandle = <0x02>;
	};

	infracfg@10001040 {
		compatible = "mediatek,mt7981-infracfg", "syscon";
		reg = <0x00 0x10001068 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x09>;
	};

	topckgen@1001B000 {
		compatible = "mediatek,mt7981-topckgen", "syscon";
		reg = <0x00 0x1001b000 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x08>;
	};

	apmixedsys@1001E000 {
		compatible = "mediatek,mt7981-apmixedsys", "syscon";
		reg = <0x00 0x1001e000 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x05>;
	};

	dummy_system_clk {
		compatible = "fixed-clock";
		clock-frequency = <0x2625a00>;
		#clock-cells = <0x00>;
		phandle = <0x17>;
	};

	dummy_gpt_clk {
		compatible = "fixed-clock";
		clock-frequency = <0x1312d00>;
		#clock-cells = <0x00>;
	};

	timer {
		compatible = "arm,armv8-timer";
		interrupt-parent = <0x01>;
		clock-frequency = <0xc65d40>;
		interrupts = <0x01 0x0d 0x08 0x01 0x0e 0x08 0x01 0x0b 0x08 0x01 0x0a 0x08>;
	};

	watchdog@1001c000 {
		compatible = "mediatek,mt7622-wdt", "mediatek,mt6589-wdt";
		reg = <0x00 0x1001c000 0x00 0x1000>;
		interrupts = <0x00 0x6e 0x04>;
		#reset-cells = <0x01>;
		status = "okay";
	};

	interrupt-controller@c000000 {
		compatible = "arm,gic-v3";
		#interrupt-cells = <0x03>;
		interrupt-parent = <0x01>;
		interrupt-controller;
		reg = <0x00 0xc000000 0x00 0x40000 0x00 0xc080000 0x00 0x200000>;
		interrupts = <0x01 0x09 0x04>;
		phandle = <0x01>;
	};

	trng@1020f000 {
		compatible = "mediatek,mt7981-rng";
	};

	serial@11002000 {
		compatible = "mediatek,mt6577-uart";
		reg = <0x00 0x11002000 0x00 0x400>;
		interrupts = <0x00 0x7b 0x04>;
		clocks = <0x02 0x1e>;
		assigned-clocks = <0x08 0x50 0x02 0x00>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		status = "okay";
	};

	serial@11003000 {
		compatible = "mediatek,mt6577-uart";
		reg = <0x00 0x11003000 0x00 0x400>;
		interrupts = <0x00 0x7c 0x04>;
		clocks = <0x02 0x1f>;
		assigned-clocks = <0x08 0x50 0x02 0x01>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		status = "disabled";
	};

	serial@11004000 {
		compatible = "mediatek,mt6577-uart";
		reg = <0x00 0x11004000 0x00 0x400>;
		interrupts = <0x00 0x7d 0x04>;
		clocks = <0x02 0x20>;
		assigned-clocks = <0x08 0x50 0x02 0x02>;
		assigned-clock-parents = <0x08 0x00 0x09 0x01>;
		status = "disabled";
	};

	i2c@11007000 {
		compatible = "mediatek,mt7981-i2c";
		reg = <0x00 0x11007000 0x00 0x1000 0x00 0x10217080 0x00 0x80>;
		interrupts = <0x00 0x88 0x04>;
		clock-div = <0x01>;
		clocks = <0x02 0x1d 0x02 0x19>;
		clock-names = "main", "dma";
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		status = "disabled";
	};

	pcie@11280000 {
		compatible = "mediatek,mt7981-pcie", "mediatek,mt7986-pcie";
		device_type = "pci";
		reg = <0x00 0x11280000 0x00 0x4000>;
		reg-names = "pcie-mac";
		#address-cells = <0x03>;
		#size-cells = <0x02>;
		interrupts = <0x00 0xa8 0x04>;
		bus-range = <0x00 0xff>;
		ranges = <0x82000000 0x00 0x20000000 0x00 0x20000000 0x00 0x10000000>;
		status = "disabled";
		clocks = <0x02 0x38 0x02 0x39 0x02 0x3a 0x02 0x3b>;
		phys = <0x0a 0x02>;
		phy-names = "pcie-phy";
		#interrupt-cells = <0x01>;
		interrupt-map-mask = <0x00 0x00 0x00 0x07>;
		interrupt-map = <0x00 0x00 0x00 0x01 0x0b 0x00 0x00 0x00 0x00 0x02 0x0b 0x01 0x00 0x00 0x00 0x03 0x0b 0x02 0x00 0x00 0x00 0x04 0x0b 0x03>;

		interrupt-controller {
			interrupt-controller;
			#address-cells = <0x00>;
			#interrupt-cells = <0x01>;
			phandle = <0x0b>;
		};
	};

	crypto@10320000 {
		compatible = "inside-secure,safexcel-eip97";
		reg = <0x00 0x10320000 0x00 0x40000>;
		interrupts = <0x00 0x74 0x04 0x00 0x75 0x04 0x00 0x76 0x04 0x00 0x77 0x04>;
		interrupt-names = "ring0", "ring1", "ring2", "ring3";
		clocks = <0x08 0x42>;
		clock-names = "top_eip97_ck";
		assigned-clocks = <0x08 0x63>;
		assigned-clock-parents = <0x08 0x15>;
	};

	pinctrl@11d00000 {
		compatible = "mediatek,mt7981-pinctrl";
		reg = <0x00 0x11d00000 0x00 0x1000 0x00 0x11c00000 0x00 0x1000 0x00 0x11c10000 0x00 0x1000 0x00 0x11d20000 0x00 0x1000 0x00 0x11e00000 0x00 0x1000 0x00 0x11e20000 0x00 0x1000 0x00 0x11f00000 0x00 0x1000 0x00 0x11f10000 0x00 0x1000 0x00 0x1000b000 0x00 0x1000>;
		reg-names = "gpio_base", "iocfg_rt_base", "iocfg_rm_base", "iocfg_rb_base", "iocfg_lb_base", "iocfg_bl_base", "iocfg_tm_base", "iocfg_tl_base", "eint";
		gpio-controller;
		#gpio-cells = <0x02>;
		gpio-ranges = <0x0c 0x00 0x00 0x38>;
		interrupt-controller;
		interrupts = <0x00 0xe1 0x04>;
		interrupt-parent = <0x01>;
		#interrupt-cells = <0x02>;
		phandle = <0x0c>;

		i2c-pins-g0 {

			mux {
				function = "i2c";
				groups = "i2c0_0";
			};
		};

		pcm-pins-g0 {

			mux {
				function = "pcm";
				groups = "pcm";
			};
		};

		pwm0-pin-g0 {

			mux {
				function = "pwm";
				groups = "pwm0_0";
			};
		};

		pwm1-pin-g0 {

			mux {
				function = "pwm";
				groups = "pwm1_0";
			};
		};

		pwm2-pin {

			mux {
				function = "pwm";
				groups = "pwm2";
			};
		};

		spi0-pins {
			phandle = <0x13>;

			mux {
				function = "spi";
				groups = "spi0", "spi0_wp_hold";
			};

			conf-pu {
				pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
				drive-strength = <0x08>;
				bias-pull-up = <0x67>;
			};

			conf-pd {
				pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
				drive-strength = <0x08>;
				bias-pull-down = <0x67>;
			};
		};

		spi1-pins {
			phandle = <0x14>;

			mux {
				function = "spi";
				groups = "spi1_1";
			};
		};

		uart1-pins-g1 {

			mux {
				function = "uart";
				groups = "uart1_1";
			};
		};

		uart2-pins-g1 {

			mux {
				function = "uart";
				groups = "uart2_1";
			};
		};
	};

	syscon@15000000 {
		#address-cells = <0x01>;
		#size-cells = <0x01>;
		compatible = "mediatek,mt7981-ethsys", "syscon";
		reg = <0x00 0x15000000 0x00 0x1000>;
		#clock-cells = <0x01>;
		#reset-cells = <0x01>;
		phandle = <0x0d>;

		reset-controller {
			compatible = "ti,syscon-reset";
			#reset-cells = <0x01>;
			ti,reset-bits = <0x34 0x04 0x34 0x04 0x34 0x04 0x28>;
			phandle = <0x07>;
		};
	};

	ethernet@15100000 {
		compatible = "mediatek,mt7981-eth";
		reg = <0x00 0x15100000 0x00 0x80000>;
		interrupts = <0x00 0xc4 0x04 0x00 0xc5 0x04 0x00 0xc6 0x04 0x00 0xc7 0x04>;
		clocks = <0x0d 0x00 0x0d 0x01 0x0d 0x02 0x0d 0x03 0x0e 0x00 0x0e 0x01 0x0e 0x02 0x0e 0x03 0x0f 0x00 0x0f 0x01 0x0f 0x02 0x0f 0x03>;
		clock-names = "fe", "gp2", "gp1", "wocpu0", "sgmii_tx250m", "sgmii_rx250m", "sgmii_cdr_ref", "sgmii_cdr_fb", "sgmii2_tx250m", "sgmii2_rx250m", "sgmii2_cdr_ref", "sgmii2_cdr_fb";
		assigned-clocks = <0x08 0x60 0x08 0x61>;
		assigned-clock-parents = <0x08 0x1b 0x08 0x22>;
		mediatek,ethsys = <0x0d>;
		mediatek,sgmiisys = <0x0e 0x0f>;
		mediatek,infracfg = <0x10>;
		#reset-cells = <0x01>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		status = "okay";

		mac@0 {
			compatible = "mediatek,eth-mac";
			reg = <0x00>;
			phy-mode = "sgmii";
			phy-handle = <0x11>;
		};

		mac@1 {
			compatible = "mediatek,eth-mac";
			reg = <0x01>;
			phy-mode = "2500base-x";
			phy-handle = <0x12>;
		};

		mdio-bus {
			#address-cells = <0x01>;
			#size-cells = <0x00>;

			phy@5 {
				compatible = "ethernet-phy-id67c9.de10";
				reg = <0x05>;
				reset-gpios = <0x0c 0x0e 0x01>;
				reset-assert-us = <0x258>;
				reset-deassert-us = <0x4e20>;
				phandle = <0x12>;
			};

			phy@3 {
				compatible = "ethernet-phy-id4f51.e91a";
				reg = <0x03>;
				reset-gpios = <0x0c 0x27 0x01>;
				reset-assert-us = <0x2710>;
				reset-deassert-us = <0xc350>;
				phandle = <0x11>;
			};
		};
	};

	hnat@15000000 {
		compatible = "mediatek,mtk-hnat_v4";
		reg = <0x00 0x15100000 0x00 0x80000>;
		resets = <0x0d 0x00>;
		reset-names = "mtketh";
		status = "okay";
		mtketh-wan = "eth1";
		mtketh-lan = "eth0";
		mtketh-max-gmac = <0x02>;
	};

	syscon@10060000 {
		compatible = "mediatek,mt7981-sgmiisys_0", "syscon";
		reg = <0x00 0x10060000 0x00 0x1000>;
		pn_swap;
		#clock-cells = <0x01>;
		phandle = <0x0e>;
	};

	syscon@10070000 {
		compatible = "mediatek,mt7981-sgmiisys_1", "syscon";
		reg = <0x00 0x10070000 0x00 0x1000>;
		#clock-cells = <0x01>;
		phandle = <0x0f>;
	};

	topmisc@11d10000 {
		compatible = "mediatek,mt7981-topmisc", "syscon";
		reg = <0x00 0x11d10000 0x00 0x10000>;
		#clock-cells = <0x01>;
		phandle = <0x10>;
	};

	snfi@11005000 {
		compatible = "mediatek,mt7986-snand";
		reg = <0x00 0x11005000 0x00 0x1000 0x00 0x11006000 0x00 0x1000>;
		reg-names = "nfi", "ecc";
		interrupts = <0x00 0x79 0x04>;
		clocks = <0x02 0x24 0x02 0x23 0x02 0x25>;
		clock-names = "pad_clk", "nfi_clk", "nfi_hclk";
		assigned-clocks = <0x08 0x4d 0x08 0x4c>;
		assigned-clock-parents = <0x08 0x06 0x08 0x06>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		status = "disabled";
	};

	mmc@11230000 {
		compatible = "mediatek,mt7986-mmc", "mediatek,mt7981-mmc";
		reg = <0x00 0x11230000 0x00 0x1000 0x00 0x11c20000 0x00 0x1000>;
		interrupts = <0x00 0x8f 0x04>;
		clocks = <0x08 0x33 0x08 0x34 0x02 0x2b>;
		assigned-clocks = <0x08 0x54 0x08 0x55>;
		assigned-clock-parents = <0x08 0x02 0x08 0x1c>;
		clock-names = "source", "hclk", "source_cg";
		status = "disabled";
	};

	wbsys@18000000 {
		compatible = "mediatek,wbsys";
		reg = <0x00 0x18000000 0x00 0x1000000>;
		interrupts = <0x00 0xd5 0x04 0x00 0xd6 0x04 0x00 0xd7 0x04 0x00 0xd8 0x04>;
		chip_id = <0x7981>;
	};

	wed_pcie@10003000 {
		compatible = "mediatek,wed_pcie";
		reg = <0x00 0x10003000 0x00 0x10>;
	};

	spi@1100a000 {
		compatible = "mediatek,ipm-spi-quad";
		reg = <0x00 0x1100a000 0x00 0x100>;
		interrupts = <0x00 0x8c 0x04>;
		clocks = <0x08 0x02 0x08 0x4e 0x02 0x26 0x02 0x28>;
		clock-names = "parent-clk", "sel-clk", "spi-clk", "spi-hclk";
		status = "okay";
		pinctrl-names = "default";
		pinctrl-0 = <0x13>;

		spi_nand@0 {
			#address-cells = <0x01>;
			#size-cells = <0x01>;
			compatible = "spi-nand";
			reg = <0x00>;
			spi-max-frequency = <0x3197500>;
			spi-tx-buswidth = <0x04>;
			spi-rx-buswidth = <0x04>;
			phandle = <0x1c>;
		};
	};

	spi@1100b000 {
		compatible = "mediatek,ipm-spi-single";
		reg = <0x00 0x1100b000 0x00 0x100>;
		interrupts = <0x00 0x8d 0x04>;
		clocks = <0x08 0x02 0x08 0x4f 0x02 0x27 0x02 0x29>;
		clock-names = "parent-clk", "sel-clk", "spi-clk", "spi-hclk";
		status = "disabled";
		pinctrl-names = "default";
		pinctrl-0 = <0x14>;
	};

	spi@11009000 {
		compatible = "mediatek,ipm-spi-quad";
		reg = <0x00 0x11009000 0x00 0x100>;
		interrupts = <0x00 0x8e 0x04>;
		clocks = <0x08 0x02 0x08 0x4e 0x02 0x21 0x02 0x22>;
		clock-names = "parent-clk", "sel-clk", "spi-clk", "spi-hclk";
		status = "disabled";
	};

	consys@10000000 {
		compatible = "mediatek,mt7981-consys";
		reg = <0x00 0x10000000 0x00 0x8600000>;
		memory-region = <0x15>;
	};

	xhci@11200000 {
		compatible = "mediatek,mt7986-xhci", "mediatek,mtk-xhci";
		reg = <0x00 0x11200000 0x00 0x2e00 0x00 0x11203e00 0x00 0x100>;
		reg-names = "mac", "ippc";
		interrupts = <0x00 0xad 0x04>;
		phys = <0x16 0x03 0x0a 0x04>;
		clocks = <0x17 0x17 0x17 0x17 0x17>;
		clock-names = "sys_ck", "xhci_ck", "ref_ck", "mcu_ck", "dma_ck";
		#address-cells = <0x02>;
		#size-cells = <0x02>;
		mediatek,u3p-dis-msk = <0x00>;
		status = "okay";
	};

	usb-phy@11e10000 {
		compatible = "mediatek,mt7986", "mediatek,generic-tphy-v2";
		#address-cells = <0x02>;
		#size-cells = <0x02>;
		ranges;
		status = "okay";

		usb-phy@11e10000 {
			reg = <0x00 0x11e10000 0x00 0x700>;
			clocks = <0x17>;
			clock-names = "ref";
			#phy-cells = <0x01>;
			status = "okay";
			phandle = <0x16>;
		};

		usb-phy@11e10700 {
			reg = <0x00 0x11e10700 0x00 0x900>;
			clocks = <0x17>;
			clock-names = "ref";
			#phy-cells = <0x01>;
			mediatek,syscon-type = <0x10 0x218 0x00>;
			nvmem-cells = <0x18 0x19 0x1a>;
			nvmem-cell-names = "intr", "rx_imp", "tx_imp";
			status = "okay";
			phandle = <0x0a>;
		};
	};

	regulator-3p3v {
		compatible = "regulator-fixed";
		regulator-name = "fixed-3.3V";
		regulator-min-microvolt = <0x325aa0>;
		regulator-max-microvolt = <0x325aa0>;
		regulator-boot-on;
		regulator-always-on;
	};

	clkitg {
		compatible = "simple-bus";

		bring-up {
			compatible = "mediatek,clk-bring-up";
			clocks = <0x05 0x00 0x05 0x01 0x05 0x02 0x05 0x03 0x05 0x04 0x05 0x05 0x05 0x06 0x05 0x07 0x09 0x00 0x1b 0x09 0x02 0x09 0x03 0x09 0x04 0x1b 0x09 0x06 0x09 0x07 0x1b 0x1b 0x1b 0x1b 0x09 0x0c 0x09 0x0d 0x09 0x0e 0x09 0x0f 0x09 0x10 0x09 0x11 0x1b 0x1b 0x1b 0x1b 0x1b 0x09 0x17 0x09 0x18 0x09 0x1a 0x09 0x1b 0x09 0x1c 0x09 0x1d 0x09 0x1e 0x09 0x1f 0x09 0x20 0x09 0x21 0x1b 0x09 0x23 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x0b 0x1b 0x1b 0x1b 0x1b 0x02 0x11 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x17 0x1b 0x02 0x19 0x02 0x1a 0x02 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x2a 0x02 0x2b 0x02 0x2c 0x02 0x2d 0x02 0x2e 0x1b 0x1b 0x02 0x31 0x02 0x32 0x02 0x33 0x02 0x34 0x02 0x35 0x02 0x36 0x02 0x37 0x1b 0x1b 0x1b 0x08 0x01 0x1b 0x08 0x05 0x08 0x06 0x08 0x07 0x08 0x04 0x08 0x09 0x08 0x0c 0x08 0x0f 0x08 0x10 0x08 0x12 0x08 0x14 0x08 0x15 0x08 0x16 0x08 0x17 0x08 0x19 0x08 0x1a 0x1b 0x08 0x1d 0x08 0x1e 0x08 0x21 0x1b 0x08 0x24 0x08 0x25 0x1b 0x08 0x29 0x08 0x26 0x08 0x2b 0x08 0x2a 0x1b 0x08 0x31 0x1b 0x1b 0x1b 0x08 0x56 0x08 0x37 0x08 0x3d 0x08 0x3e 0x08 0x3f 0x08 0x45 0x08 0x41 0x08 0x46 0x08 0x47 0x08 0x48 0x08 0x49 0x08 0x4a 0x08 0x3a 0x1b 0x1b 0x1b 0x1b 0x08 0x52 0x1b 0x1b 0x1b 0x08 0x56 0x08 0x57 0x08 0x58 0x08 0x59 0x08 0x5a 0x08 0x5b 0x08 0x5c 0x08 0x5d 0x08 0x5e 0x08 0x5f 0x1b 0x1b 0x08 0x62 0x08 0x5e 0x1b 0x08 0x64 0x08 0x56 0x08 0x69 0x08 0x6a 0x08 0x6b 0x08 0x6c>;
			clock-names = "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "60", "61", "62", "63", "64", "65", "66", "67", "68", "69", "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "100", "101", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "115", "116", "117", "118", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "132", "133", "134", "135", "136", "137", "138", "139", "140", "141", "142", "143", "144", "145", "146", "147", "148", "149", "150", "151", "152", "153", "154", "155", "156", "157", "158", "159", "160", "161", "162", "163", "164", "165", "166", "167", "168", "169", "170", "171", "172", "173", "174", "175", "176", "177", "178", "179", "180", "181", "182", "183";
		};
	};

	efuse@11f20000 {
		compatible = "mediatek,efuse";
		reg = <0x00 0x11f20000 0x00 0x1000>;
		#address-cells = <0x01>;
		#size-cells = <0x01>;

		calib@274 {
			reg = <0x274 0x0c>;
			phandle = <0x06>;
		};

		calib@8dc {
			reg = <0x8dc 0x10>;
		};

		usb3-rx-imp@8c8 {
			reg = <0x8c8 0x01>;
			bits = <0x00 0x05>;
			phandle = <0x19>;
		};

		usb3-tx-imp@8c8 {
			reg = <0x8c8 0x02>;
			bits = <0x05 0x05>;
			phandle = <0x1a>;
		};

		usb3-intr@8c9 {
			reg = <0x8c9 0x01>;
			bits = <0x02 0x06>;
			phandle = <0x18>;
		};
	};

	audio-controller@11210000 {
		compatible = "mediatek,mt79xx-audio";
		reg = <0x00 0x11210000 0x00 0x9000>;
		interrupts = <0x00 0x6a 0x04>;
		clocks = <0x02 0x12 0x02 0x13 0x02 0x14 0x02 0x15 0x02 0x16 0x08 0x65>;
		clock-names = "aud_bus_ck", "aud_26m_ck", "aud_l_ck", "aud_aud_ck", "aud_eg2_ck", "aud_sel";
		assigned-clocks = <0x08 0x65 0x08 0x66 0x08 0x67 0x08 0x68>;
		assigned-clock-parents = <0x08 0x10 0x08 0x12 0x08 0x10 0x08 0x12>;
		status = "disabled";
	};

	ice_debug {
		compatible = "mediatek,mt7981-ice_debug", "mediatek,mt2701-ice_debug";
		clocks = <0x02 0x18>;
		clock-names = "ice_dbg";
	};

	chosen {
		u-boot,bootconf = "config-1";
		u-boot,version = "2023.10-rc4";
		bootargs = "console=ttyS0,115200n1 loglevel=8  \t\t\t\tearlycon=uart8250,mmio32,0x11002000";
	};

	memory {
		device_type = "memory";
		reg = <0x00 0x40000000 0x00 0x10000000>;
	};

	nmbm_spim_nand {
		compatible = "generic,nmbm";
		#address-cells = <0x01>;
		#size-cells = <0x01>;
		lower-mtd-device = <0x1c>;
		forced-create;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <0x01>;
			#size-cells = <0x01>;

			partition@0 {
				label = "BL2";
				reg = <0x00 0x100000>;
				read-only;
			};

			partition@100000 {
				label = "u-boot-env";
				reg = <0x100000 0x80000>;
			};

			partition@180000 {
				label = "Factory";
				reg = <0x180000 0x200000>;
			};

			partition@380000 {
				label = "FIP";
				reg = <0x380000 0x200000>;
			};

			partition@580000 {
				label = "ubi";
				reg = <0x580000 0x4000000>;
			};
		};
	};

	gpio-leds {
		compatible = "gpio-leds";

		red_led {
			label = "comfast:red:led";
			gpios = <0x0c 0x22 0x01>;
		};

		green_led {
			label = "comfast:green:led";
			gpios = <0x0c 0x23 0x01>;
		};

		blue_led {
			label = "comfast:blue:led";
			gpios = <0x0c 0x08 0x01>;
		};
	};

	gpio-keys {
		compatible = "gpio-keys";

		wps {
			label = "wps";
			linux,code = <0x211>;
			gpios = <0x0c 0x00 0x01>;
		};

		reset {
			label = "reset";
			linux,code = <0x198>;
			gpios = <0x0c 0x01 0x01>;
		};
	};
};

I have added the DTS in the device tree (in openwrt/target/linux/mediatek/dts ) and added an entry in the makefile (openwrt/target/linux/mediatek/image/filogic.mk).

filogic.mk 
define Device/comfast_cf-e391ax
  DEVICE_VENDOR := COMFAST
  DEVICE_MODEL := CF-E391AX
  DEVICE_DTS := mt7981ba-comfast-cf-e391ax
  DEVICE_DTS_DIR := ../dts
  DEVICE_DTC_FLAGS := --pad 4096
  DEVICE_DTS_LOADADDR := 0x43f00000
  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
  KERNEL_LOADADDR := 0x44000000
  KERNEL = kernel-bin | lzma | \
	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
  KERNEL_INITRAMFS = kernel-bin | lzma | \
	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
  UBINIZE_OPTS := -E 5
  BLOCKSIZE := 128k
  PAGESIZE := 2048
  IMAGE_SIZE := 65536k
  KERNEL_IN_UBI := 1
  IMAGES := sysupgrade.bin factory.bin
  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
endef
TARGET_DEVICES += comfast_cf-e391ax

Based on theses instructions, I have created a custom .config file and I'm currently trying to build an image (struggling with my podman instance at the moment).

.config 
CONFIG_TARGET_mediatek=y
CONFIG_TARGET_mediatek_filogic=y
CONFIG_TARGET_MULTI_PROFILE=y
CONFIG_TARGET_DEVICE_mediatek_filogic_DEVICE_comfast_cf-e391ax=y
CONFIG_TARGET_DEVICE_PACKAGES_mediatek_filogic_DEVICE_comfast_cf-e391ax="
CONFIG_ALL_KMODS=y
CONFIG_ALL_NONSHARED=y
CONFIG_DEVEL=y
CONFIG_TARGET_PER_DEVICE_ROOTFS=y
CONFIG_AUTOREMOVE=y
CONFIG_BUILDBOT=y
CONFIG_COLLECT_KERNEL_DEBUG=y
CONFIG_IB=y
CONFIG_IMAGEOPT=y
CONFIG_JSON_CYCLONEDX_SBOM=y
CONFIG_KERNEL_BUILD_DOMAIN="buildhost"
CONFIG_KERNEL_BUILD_USER="builder"
# CONFIG_KERNEL_KALLSYMS is not set
CONFIG_MAKE_TOOLCHAIN=y
CONFIG_PACKAGE_attendedsysupgrade-common=y
CONFIG_PACKAGE_cgi-io=y
CONFIG_PACKAGE_libiwinfo=y
CONFIG_PACKAGE_libiwinfo-data=y
CONFIG_PACKAGE_liblucihttp=y
CONFIG_PACKAGE_liblucihttp-ucode=y
CONFIG_PACKAGE_luci=y
CONFIG_PACKAGE_luci-app-attendedsysupgrade=y
CONFIG_PACKAGE_luci-app-firewall=y
CONFIG_PACKAGE_luci-app-package-manager=y
CONFIG_PACKAGE_luci-base=y
CONFIG_PACKAGE_luci-lib-uqr=y
CONFIG_PACKAGE_luci-light=y
CONFIG_PACKAGE_luci-mod-admin-full=y
CONFIG_PACKAGE_luci-mod-network=y
CONFIG_PACKAGE_luci-mod-status=y
CONFIG_PACKAGE_luci-mod-system=y
CONFIG_PACKAGE_luci-proto-ipv6=y
CONFIG_PACKAGE_luci-proto-ppp=y
CONFIG_PACKAGE_luci-ssl=y
CONFIG_PACKAGE_luci-theme-bootstrap=y
CONFIG_PACKAGE_owut=y
CONFIG_PACKAGE_px5g-mbedtls=y
CONFIG_PACKAGE_rpcd=y
CONFIG_PACKAGE_rpcd-mod-file=y
CONFIG_PACKAGE_rpcd-mod-iwinfo=y
CONFIG_PACKAGE_rpcd-mod-luci=y
CONFIG_PACKAGE_rpcd-mod-rpcsys=y
CONFIG_PACKAGE_rpcd-mod-rrdns=y
CONFIG_PACKAGE_rpcd-mod-ucode=y
CONFIG_PACKAGE_ucode-mod-html=y
CONFIG_PACKAGE_ucode-mod-log=y
CONFIG_PACKAGE_ucode-mod-math=y
CONFIG_PACKAGE_ucode-mod-uclient=y
CONFIG_PACKAGE_uhttpd=y
CONFIG_PACKAGE_uhttpd-mod-ubus=y
CONFIG_REPRODUCIBLE_DEBUG_INFO=y
CONFIG_SDK=y
CONFIG_SDK_LLVM_BPF=y
CONFIG_TARGET_ALL_PROFILES=y
CONFIG_VERSIONOPT=y
CONFIG_VERSION_BUG_URL=""
CONFIG_VERSION_CODE=""
CONFIG_VERSION_DIST="OpenWrt"
CONFIG_VERSION_FILENAMES=y
CONFIG_VERSION_FIRMWARE_URL=""
CONFIG_VERSION_HOME_URL=""
CONFIG_VERSION_HWREV=""
CONFIG_VERSION_MANUFACTURER=""
CONFIG_VERSION_MANUFACTURER_URL=""
CONFIG_VERSION_NUMBER=""
CONFIG_VERSION_PRODUCT=""
CONFIG_VERSION_REPO="https://downloads.openwrt.org/releases/25.12.2"
CONFIG_VERSION_SUPPORT_URL=""

Questions

  • is the .config file ok?
  • is it alright to use the DTS without any modification?
  • is there any way to test the builded image in non destructive way (in memory)?
2

if in doubt, you can delete your .config file and make menuconfig and selecting your device from the menu to ensure it's "clean"

You should not use the factory DTS file without modification, but rather, create a new DTS specifically (or adapt an existing one) for this device. Based on what I'm reading, a good place to start is taking a look at the Comfast CF-E393AX DTS file. This may "just work", but if not, you can adapt it for your device, likely the changes needed are probably mostly the networking sections, such as &eth, &mdio_bus, etc.

Yes, you can set up a TFTP server and use bootm (load image into memory) from U-boot console.

For example, this is for the Comfast CF-E593AX (also based on MT7981) which I'm working on and explanation of this one-liner:

setenv serverip 192.168.1.60; setenv ipaddr 192.168.1.1; tftpboot 0x46000000 openwrt-mediatek-filogic-comfast_cf-e593ax-initramfs-kernel.bin; bootm

TFTP server to use is 192.168.1.60. Device IP is set to 192.168.1.1. Filename is openwrt-mediatek-filogic-comfast_cf-e593ax-initramfs-kernel.bin located at the root. You can easily adapt it for your use.

3

First of all, thank you very much taking time to read and answer my post!

About the .config file, I'm really unsure about which values should be selected to make a fully working firmware. Very few values are ticked by default, while the filogik config file used to compile distributed firmwares (such as this one) seems to tick almost everything...
The .configfile I provided earlier is actually a modification of the filogik one, removing other targets. Is it overkill?

About the DTS, I checked the Comfast CF-E393AX DTS file, which seems quite different from the factory DTS, but it may just be layout. What's wrong about using the factory DTS?

About TFTP, I understand I have to access UART pins, right? Is there any way to enter uboot over IP rather than serial?

4

The best way is a new/clean .config

So you have a minimal set of options for testing.

The factory DTS is bloated, outdated or other things.
The " Comfast CF-E393AX DTS" includes some other files

The resulting DTB may or may not equal to your ventor DTS.
you can decompile the DTB with dtc (please read the man-page or help)

Some factory DTS may have dts nodes which are not in upstream kernel.

I don't know the board.
but serial is essential for for new board support, you need the messeges for error if the kernel does not boot correctly and your ssh/dropbear daemon will not start ...

5

For a clean .config file, delete the existing one, run make menuconfig and just have the device selected for Target, Subtarget and Target Profile. That'll create a minimal image for your device. This assumes DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware is all you need in your filogic.mk modifications. Additional package should be added there if other default packages are needed.

As noted by @ElektromAn, other files are included in the CF-E393AX DTS file. which greatly reduces the resulting DTS for your device.

Yes, it is highly probable you will need UART access in order to interrupt the Uboot process and run your own image without writing to the NAND. I will even say definitely needed, and is the only way you can run an image without potential changes to the currently installed firmware.

6

Alright, I'm creating a brand new DTS following OpenWrt conventions as much as possible, copying as much as possible from cf-e393AX.

I'm already facing differences between the mt7981b.dtsi and my stock DTS.
Indeed, the cf-e391AX has a crypto:

		compatible = "inside-secure,safexcel-eip97";
		reg = <0x00 0x10320000 0x00 0x40000>;

while mt7981b.dtsi doesn't seem to have any crypto, which I don't understand because e393AX has a crypto entry:

&crypto {
    status = "okay";
};

Where is it described?

7

The upstream mt7981b.dtsi file doesn't include crypto, but a patch exists within Openwrt repo to add it.

Personally, rather than keeping track of all the patches, I typically take a look at my build_dir on the build host. In this case, the mt7981b.dtsi file with all patches applied is located in ./build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_filogic/linux-6.12.80/arch/arm64/boot/dts/mediatek/mt7981b.dtsi within your build root directory.

1 Like
8

now it's get messy :wink:

the decribed patch form @who_what8 is a modification from "uptream".

The driver is upstream

9

I followed @who_what8 advice and compiled OpenWrt for cf-e393ax, then retrieved the patched ˋmt7981b.dtsi` file from the build directory.

I created a new DTS including this DTSI, with very little difference with cf-e393ax (mainly Ethernet wiring) and successfully compiled.
I expect to flash my device today or tomorrow.

10

Hi, Comfast are very lazy when adding new devices, so usually its a case of copy and paste an existing comfast, as per the 393ax. then just changing the number.

Tweaking the ethernet and gpio numbers - I did e593ax recently, had a new phy Airoha AN8801SB and no switch.

Make sure to have serial access and boot from the u-boot tftp boot via the initramfs image first - DO NOT blindly upgrade an untested firmware image, best to test your changes to make sure it works first as initramfs doesn’t make any changes to the flash chip!

Hope this helps?

My source code of changes, been doing some mediatek patches (you can get an idea on adding devices based on my commits) - https://github.com/db260179/openwrt/tree/openwrt-25.12-mtk-stable

11

Crystal clear.
Just a question about how to access uart pins as I have yet to open my device: I read that on the cf-e393ax one can solder wires on the rear face of the soc to avoid removing the heatsink, is there a picture of this anywhere?

12

Time to be brave, each device will have the uart markings of tx,rx,gnd and 5v pins on the board - comfast usually puts them under the heatsink.

You will need to investigate on your device i’m afraid, part of the openwrt hacking.

13

Did you create a branch for the CF-E593AX? I have a PR open and we can do a comparison.

Let's move the CF-E593AX talk to:

This is for you to find out since you are the only one in this thread with the device. Thankfully, Comfast devices are not difficult to open.

14

For the record, UART pins are labelled on the board, just had to solder pins. I will upload a picture once I'm done with uboot and DTS.