Comfast ew72 flash via serial

Sorry mods I've been busy the last few days I hope after this thread there should possibly be only one more this week(Xiaomi r3p arrives tomorrow)
So today's issues I've repeatedly tried to flash the Comfast via the GUI and got nowhere so I did a 30-30-30 and managed to get the failsafe firmware page on 192.168.1.1.

I've tried both kernel and sysupgrade firmwares and on both, the device acts like OpenWRT is installed (Lan status led's work no WiFi) but no matter if I use the wan or Lan port I can't seem to get access on any possible IP.
I'm pretty useless with networking but I've tried a scan with nmap and gotten nothing.
Any suggestions please.

This confused me also the files I'm using are around 5mb but the upload screen shows this

Which image exactly have you tried to flash?

The 21.02 stable in all 3 bin variations I'll try with a snapshot in 5 minutes after I've had a smoke

So I tried everything the non invasive way but gave up and went serial when loading the snapshot 21.02 initramfs it seems to hang when uncompressing the kernel image.

Not sure if it's something to do with this.

When the kernal is uncompressing it's writing over files according to the serial logs

so here's a look at the logs each and every time i try anything it hands on the kernel do i need to go to an older version?

U-Boot 2018.09-gbef8015-dirty (Dec 09 2020 - 06:28:07 -0500)

CPU:   MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board
DRAM:  128 MiB
Loading Environment from SPI Flash... SF: Detected mx25l12805 with page size 256 Bytes, erase size 64 KiB, total 16 MiB
*** Warning - bad CRC, using default environment

In:    uartlite0@1e000c00
Out:   uartlite0@1e000c00
Err:   uartlite0@1e000c00
Net:
Warning: eth@1e100000 (eth0) using random MAC address - 5e:69:c8:f8:cf:5b
eth0: eth@1e100000
Hit any key to stop autoboot:  0
Press reset button for at least:
- 3 sec. to run web failsafe mode
- 7 sec. to run U-Boot netconsole

Reset button is pressed for:  0

## Error: button wasn't pressed long enough!
Continuing normal boot...

Using eth@1e100000 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'firmware_auto.bin'.
Load address: 0x80010000
Loading: *
ARP Retry count exceeded; starting again

*** TFTP client failure: -110 ***
*** Operation Aborted! ***

  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Upgrade firmware
     3. Upgrade bootloader
     4. Upgrade bootloader (advanced mode)
     5. Load image
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select

*** Upgrading Firmware ***

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record

Select (enter for default):

Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.10
Input IP netmask: 255.255.255.0
Input file name: initramfs.bin

Using eth@1e100000 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'initramfs.bin'.
Load address: 0x80010000
Loading: T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##
         712.9 KiB/s
done
Bytes transferred = 5000264 (4c4c48 hex)

*** Loaded 5000264 (0x4c4c48) bytes at 0x80010000 ***

SF: Detected mx25l12805 with page size 256 Bytes, erase size 64 KiB, total 16 MiB

Erasing from 0x50000 to 0x51ffff, size 0x4d0000 ... .............................................................................OK
Writting from 0x80010000 to 0x50000, size 0x4c4c48 ... .............................................................OK

*** Firmware upgrade completed! ***

Hit any key to stop firmware bootup:  0
SF: Detected mx25l12805 with page size 256 Bytes, erase size 64 KiB, total 16 MiB
Reading from flash 0x50000 to mem 0x81060000, size 0x4c4c48 ...
## Booting kernel from Legacy Image at 81060000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.188
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5000200 Bytes = 4.8 MiB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
=> help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootmenu- ANSI terminal bootmenu
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
fdt     - flattened device tree utility commands
go      - start application at address 'addr'
gpio    - query and control gpio pins
help    - print command description/usage
httpd   - Start failsafe HTTP server
iminfo  - print header information for application image
itest   - return true/false on integer compare
ledtest - MediaTek gpio led test
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loadx   - load binary file over serial line (xmodem mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtkautoboot- Display MediaTek bootmenu
mtkboardboot- Boot MTK firmware
mtkload - MTK image loading utility
mtkupgrade- MTK firmware/bootloader upgrading utility
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
setexpr - set environment variable as the result of eval expression
setmac  - save new MAC address in FLASH
xx:xx:xx:xx:xx:xx [serial-no] [pin-code]
        - change MAC address stored in FLASH (xx - value in hex format)

sf      - SPI flash sub-system
sleep   - delay execution for some time
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version
=>

No matter what I try it just seems to freeze when it comes to uncompressing anything.

Did the device Wiki page say do this???

You usually boot the kernel firmware if using serial - then use sysupgrade when the system is running.

So I actually bricked it well and truly trying to upgrade uboot now the nor flash is blank and I'm waiting for a eeprom programmer and a 2nd unit to try fix it.
Everything listed on the wiki I tried and failed and me being a idiot carried on trying things out from
my experience flashing other devices.

???

I wouldn't advise upgrading a bootloader on an embedded device unless it's not working.

We live and learn.

I don't tend to learn until i break something sadly i break alot of things and learn very little.

My guess is i somehow damaged the kernel and after repeatedly trying to flash OpenWRT on the device my brain concluded that a uboot with a filename that had "Dirty" in it was the issue.

yep that's something i wont forget now.

I do a fair bit of espressif programming for various projects around my farm so i felt confident playing with a router in serial and with the pandemic im stuck on the farm with no working visa so keeping myself busy with things like this prevents me from going mad.

Anyways the second ew72 i ordered should be here in a few days, what would you recommend? leave it stock till the eeprom programmer comes and get a good known nor data set from it or try flash OpenWRT on it and then take the data off it?
They should be identical apart from the mac address(im sure ill have fun figuring that bit out).

Ok round two and I've already been knocked out new ewuw came this afternoon first I tried upgrading from the GUI and just got error: sett fail so I rebooted checked it was ok GUI worked.
I then held the reset button 5 seconds after powering on and the uboot web interface came up at 192.168.1.1

I then flashed the sysupgrade image which seemed too fast and gave a weird file name and size and rebooted.

I waited 10mins checked both the .10.1 and .1.1 and nothing and now no Comfast firmware working either. I'll post screenshots and try reverting back to stock after I've finished work.
Thankfully this one still has uboot.

So installing the stick drivers via the uboot recovery mode http site I've tried the sysupgrade snapshot image once again and come outside for a smoke.

so i ve been back at it not going near the uboot on this one i hope but still no luck

SF: Detected mx25l12805 with page size 256 Bytes, erase size 64 KiB, total 16 MiB
Reading from flash 0x50000 to mem 0x81060000, size 0x551f9f ...
## Booting kernel from Legacy Image at 81060000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.111
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5578591 Bytes = 5.3 MiB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
=> base print
Base Address: 0x00000000
=> bdinfo
boot_params = 0x87EB1238
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0x00000000
flashsize   = 0x00000000
flashoffset = 0x00000000
ethaddr     = (not set)
IP addr     = 192.168.1.1
baudrate    = 115200 bps
relocaddr   = 0x87FB0000
reloc off   = 0x07DB0000
=> version
U-Boot 2018.09-gbef8015-dirty (Dec 09 2020 - 06:28:07 -0500)

mipsel-openwrt-linux-gcc (LEDE GCC 5.5.0 r239-0b404108) 5.5.0
GNU ld (GNU Binutils) 2.25.1
=> help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootmenu- ANSI terminal bootmenu
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
fdt     - flattened device tree utility commands
go      - start application at address 'addr'
gpio    - query and control gpio pins
help    - print command description/usage
httpd   - Start failsafe HTTP server
iminfo  - print header information for application image
itest   - return true/false on integer compare
ledtest - MediaTek gpio led test
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loadx   - load binary file over serial line (xmodem mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtkautoboot- Display MediaTek bootmenu
mtkboardboot- Boot MTK firmware
mtkload - MTK image loading utility
mtkupgrade- MTK firmware/bootloader upgrading utility
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
setexpr - set environment variable as the result of eval expression
setmac  - save new MAC address in FLASH
xx:xx:xx:xx:xx:xx [serial-no] [pin-code]
        - change MAC address stored in FLASH (xx - value in hex format)

sf      - SPI flash sub-system
sleep   - delay execution for some time
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version

not sure whats going on i think it might be a bad memory address im sending the tftp data too.

This must be a new version which is unknown to OpenWrt. The OpenWrt development for "EW72" is for a completely different system using a QCA9531 chip. There is absolutely no way that can run on MT7621.

There are no Comfast models in the MT7621 directory.

In other words, the hardware that you have is presently unsupported.

1 Like

Thanks that explains why

Discussion continues here: Support for Comfast CF-EW72/MT7621

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.