Comfast wr631ax support and potential other devices [Testers needed]

boogie · May 28, 2026, 12:20pm

i have created a pr to support cf-wr631ax device, it works just find since i have been testing for a week.

github.com/openwrt/openwrt

mediatek/filogic: Add support for COMFAST WR631AX and refactor comfast mt7981 devices (#23500)

main ← hbiyik:wr631ax

opened 12:14AM - 24 May 26 UTC

hbiyik

+699 -630

Specification ------------- - SoC : MediaTek MT7981B dual-core ARM Co…rtex-A53 1.3 GHz - RAM : DDR3 256 MiB (Nanya NT5CC128M16JR-EK DDR3-1866 (PC3-14900)) - Flash : SPI-NAND 128 MiB (Winbond 25NO1GVZEIG 2204) - WLAN : MediaTek MT7976CN dual-band WiFi 6 - 2.4 GHz : b/g/n/ax, MU-MIMO (2x 5 dBi antennas) - 5 GHz : a/n/ac/ax, MU-MIMO (3x 5 dBi antennas) - Ethernet : - LAN x3 : 10/100/1000 Mbps (MT7531AE) - WAN x1 : 10/100/1000 Mbps (MT7531AE) - UART : through-hole on PCB - assignment : (GND), (RX), (TX), [VCC] - settings : 115200n8 - Buttons x2 : Reset, Mesh - LEDs x3 : Status (Blue, Green, Red) - Power : 12VDC, 1A Rooting the Stock Firmware: --------------------------- 1. Export config from the device, extract the contents to a folder. (even though the extension is .file it is actually a tar.gz file) 2. Edit the etc/shadow file in the extracted contents and replace the root entry with root:$1$DR6LkFbI$Px8XMlVdssyk2Fwx.2rLg1:19510:0:99999:7::: 3. Compress the new config artifacts to tar.gz and rename the file to .file extension. Load config backup to device via webui. 4. After restart root password is openwrt. Backing up the partitions: -------------------------- 1. root the device 2. backup bl2: ssh root@192.168.0.1 "dd if=/dev/mtd0ro bs=64k" | dd of=mtd0_bl2.bin status=progress 3. backup factory: ssh root@192.168.0.1 "dd if=/dev/mtd2ro bs=64k" | dd of=mtd2_factory.bin status=progress 4. backup fip: ssh root@192.168.0.1 "dd if=/dev/mtd3ro bs=64k" | dd of=mtd3_fip.bin status=progress Flash instructions ------------------ WebUI Method: 1. Install the *squashfs-sysupgrade.bin image using the stock WebUI update page. 2. Press and hold the reset button after reboot to wipe the stock config. SSH Method: 2. Connect via SSH using root:openwrt credentials after rooting. 3. Upload the *squashfs-sysupgrade.bin image. 4. Use the command: sysupgrade -n Return to stock --------------- Flash a stock firmware using the OpenWrt sysupgrade method. Recovery -------- Power on the router while holding the Reset button until the LED flashes 5 times. The U-Boot Flash WebUI will be available at http://192.168.1.1 or Connect UART and use the U-Boot menu to flash the firmware image or boot an OpenWrt initramfs image. OpenWrt U-Boot flash instructions --------------------------------- With Uart: 1. Serve the bin/targets/mediatek/filogic over tftp then go to vendor uboot menu over uart. 2. Update bl2 with openwrt-mediatek-filogic-comfast_cf-wr631ax-ubootmod-preloader.bin BL2 from the menu 3. Update fip with openwrt-mediatek-filogic-comfast_cf-wr631ax-ubootmod-bl31-uboot.fip from the menu 4. Restart the device and go to openwrt uboot and update the rootfs from the menu. Without Uart: 1. Flash ordinary OpenWrt image. 2. Login into the device and backup everything, especially 'Factory' part. 3. Unlock mtd partitions: apk add kmod-mtd-rw insmod mtd-rw i_want_a_brick=1 4. Write new BL2 and FIP: mtd write openwrt-mediatek-filogic-comfast_cf-wr631ax-ubootmod-preloader.bin BL2 mtd write openwrt-mediatek-filogic-comfast_cf-wr631ax-ubootmod-bl31-uboot.fip FIP 5. Set static IP on your PC: ip 192.168.1.254 mask 255.255.255.0 6. Serve OpenWrt initramfs image using TFTP server. 7. Reboot device, wait for TFTP recovery to complete. 8. After OpenWrt has booted, perform sysupgrade. Returning to vendor image from openwrt layout --------------------------------------------- 1. Serve the backups and vendor firmware on the host machine with ip 192.168.1.254. 2. Go to openwrt uboot console tftpboot $loadaddr mtd3_fip.bin run mtd_write_fip tftpboot $loadaddr mtd0_bl2.bin run mtd_write_bl2 3. Reset the device and go to vendor uboot menu 4. Update the firmware with vendor firmare via tftp Debricking ---------- 1. In case of an emergency you can always reach to vendor uboot or openwrt uboot using uart. 2. mtk_uartboot -s /dev/tty[my device] -p bl2-mt7981-bga-ddr3-ram.bin -f fip.bin --aarch64 3. ram file must the specific file, but you can choose in between your mtd3_fip.bin dump for vendor uboot or openwrt-mediatek-filogic-comfast_cf-wr631ax-ubootmod-bl31-uboot.fip for openwrt uboot 4. Keep pressing the reset button on the device and power on, wait until the fip image is fully sent. 5. When finished, connect to uboot over uart and flash bl2, fip, and recover rootfs. MAC Addresses: ---------------------------------------------------------- | Interface | MAC | Source | ---------------|-------------------|---------------------- | LAN | 40:A5:EF:xx:xx:xx | Factory, 0xe000.....| | WLAN 2.4 GHz | 40:A5:EF:xx:xx:xx | Factory, 0x4 | | WLAN 5 GHz | 40:A5:EF:xx:xx:xx | Factory, 0x8000 | ---------------------------------------------------------- Tested with WR631AX: -------------------------------- Factory -> Openwrt -> Openwrt Ubootmod -> Factory image swap scenarios 3 color Led, MESH + RESET Button HW Offload + WED All work fine. Test of impacted devices due to refactoring ----------------------------------------------------- WR632AX, E393AX, XR186 compiled dtbs have been converted back to dts, and verified that after the PR functionally same device trees are generated. Thermal Design: ------------------------ The devices chips are at the bottom of the pcb. Wifi chip has it is own small thermal sink at the bottom. Rest of the chips have no thermal sink at the bottom. At the top of the pcb there is a relatively big thermal chip contacting to the pcb. So the cooling is indirect and passive. Not the best design but it is what it is. In this scenario i have tested the vendor firmware and openwrt firmware to compare to check the thermals. They are the same, so openwrt does not introduce any extra heat. But the device runs hot. 80 ~ 90C in ambient temp of 30C. Openwrt 25.12: <img width="1285" height="414" alt="image" src="https://github.com/user-attachments/assets/5364675f-6e66-441d-bdb3-d593648e4bf2" /> Vendor Firmware 2.7.0.8: <img width="841" height="240" alt="image" src="https://github.com/user-attachments/assets/af476bdc-521a-4d5d-8a69-27b1a2765d44" /> Pictures of Device: --------------------------- <img width="3000" height="4000" alt="PXL_20260526_123237157" src="https://github.com/user-attachments/assets/d00d2a4c-9efa-41e4-a8a3-6cbb400df993" /> <img width="3000" height="4000" alt="PXL_20260521_100825832" src="https://github.com/user-attachments/assets/4df1c2a5-181d-48fe-a338-10e55a74b85d" /> <img width="4000" height="3000" alt="PXL_20260520_130628227" src="https://github.com/user-attachments/assets/94777906-603c-440f-98ef-1c54b94b9c43" /> <img width="4000" height="3000" alt="PXL_20260520_130237196 MP" src="https://github.com/user-attachments/assets/0b8de0f8-7be3-41a4-95f9-3858999bfe0d" />

this PR however is refactoring comfast mt7981 devices a little bit so that adding new devices could be much easier also with ubootmod.

Currently wr632ax, e393ax, e395ax devices are also impacted by this change.

To make sure this PR is doing things correctly i need at the first stage some testers with above devices. Can anyone help to test above 3 devices with the PR?

If this works i think i can add more comfast devices just by looking at the vendor dts from the publicly available comfast vendor firmware which is also openwrt based.