I can get you what you need if you point me where to look.
If you dump the register state of the gpio block we can configure the pwm.
Use "sys memrl 1FBF0200" and do that until 1FBF02BC.
Make sure the fan is active when running the commands.
It looks like they replaced sys with their own "tcci" binary; sys memrl 1FBF02XX doesn't return anything.
I have:
ls -la /usr/bin/sys
lrwxrwxrwx 1 root root 13 Oct 24 09:01 /usr/bin/sys -> /usr/bin/tcci
root@OpenWrt:/# sys help
[523455.284519] valid subcommands:
[523455.287515] memrl memwl modifybit memwl2
[523455.294608] memrw memww memory memcpy
[523455.301751] fillmem mac onutype bbf247
[523455.308851] onumode qdmainit exmdio autopvc
[523455.315970] wan2lan wlan2lan button sfepcheck
[523455.323080] gdmpDebug gdmpReg gdmpMemory ver
[523455.330205] imginfo voiptest bindshowtask bobcarlibration
[523455.337323] bootflag sifm serdes
tcci help
gives nothing.
Can you recreate the symlink and test it ?
Here's strings on the binary:
sys strings
/lib/ld-linux-aarch64.so.1
libblapi_system.so
__gmon_start_
blapi_system_doSysBBF247
blapi_system_doSysSerdesSel
blapi_system_set_boot_flag_swap
blapi_system_get_current_boot_flag
blapi_system_doSysQdmaInit_int32
blapi_system_doSysBobCarlibration
blapi_system_doSysPONMode
blapi_system_doSysOnuType
blapi_system_doSysMac
blapi_system_check_crcflag
libecnt_lib_dbg.so.1
libblapi_tc_partition.so
libapi_lib_utility.so.1
libcompileoption_bsp.so
libgcc_s.so.1
libc.so.6
strcpy
fopen
strncmp
__isoc99_sscanf
strncpy
__stack_chk_fail
putchar
abort
printf
fgets
strlen
isxdigit
fputs
fclose
strtoul
system
__strncat_chk
atoi
__sprintf_chk
__strcat_chk
strcmp
__libc_start_main
ld-linux-aarch64.so.1
__stack_chk_guard
GLIBC_2.17
#A9A
'A9!
3A9!
version
tcci V1.1.0.0 (Nov 26 2024-09:52:22)
tcci version: %s
/proc/tc3162/tcci_cmd
open /proc/tc3162/tcci_cmd fail
I am dummy!!
mac address must be 12 digits
new mac addr =
%02x:
%02x
MAC addr is not valid!!!!!
sys mac <mac_addr> / sys mac <mac_addr> <-n> / sys mac <mac_addr> <mac_range> / sys mac <mac_addr> <mac_range> <-n>
Bad command!
Usage:sys onutype sfu|hgu
Usage:
write bob data to flash from UX: sys bobcarlibration
read
swap
Usage:
read/swap bootflag: sys bootflag read/swap/checksum
current boot_flag = %d
echo 1 > /proc/sys/kernel/printk
sifm
/proc/tc3162/sifm_info
Bad command!
Usage:sys onuMode auto_mode|gpon|xepon_1g|xepon_asy|xepon_sym|xgpon|xgspon|ng2_10g_sym|ng2_10g_asy|ng2_2g_sym
xepon_sym
xepon_asy
xgspon
xgpon
lan_dscp_mode
lan_payload_size
wan_dscp_mode
wan_payload_size
wan_fastpath
lan_fastpath
xsi_pcie0_fastpath
xsi_pcie1_fastpath
xsi_usb_fastpath
xsi_ether_fastpath
xsi_pon_fastpath
whole_value
parameter %s invalid
Usage:sys qdmainit [para1] [value1] [para2] [value2]...[paraN] [valueN]
parameter:
lan_dscp_mode [0-dram 1-sram]
lan_payload_size [0-2048 1-1024 2-512 3-256]
wan_dscp_mode [0-dram 1-sram]
wan_payload_size [0-2048 1-1024 2-512 3-256]
support blow parameters in arm:
wan_fastpath [0/1 - hwnat fastpath to GDM2(ATM/PTM/PON..)]
lan_fastpath [0/1 - hwnat fastpath to GDM1(GSW)]
xsi_pcie0_fastpath [0/1 - hwnat fastpath to HSGMII PCIE0]
xsi_pcie1_fastpath [0/1 - hwnat fastpath to HSGMII PCIE1]
xsi_usb_fastpath [0/1 - hwnat fastpath to HSGMII USB]
xsi_ether_fastpath [0/1 - hwnat fastpath to HSGMII/XFI ETHER]
xsi_pon_fastpath [0/1 - hwnat fastpath to HSGMII/XFI PON]
whole_value [32bit whole value in hex]
Bad command!
Usage:sys bbf247 enable|disable
enable
disable
auto_mode
xepon_1g
ng2_10g_sym
ng2_10g_asy
GCC: (OpenWrt GCC 10.2.0 r16325-88151b8303) 10.2.0
.shstrtab
.interp
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.data.rel.ro
.dynamic
.got
.data
.comment
sys help returns nothing.
Can you check the kernel log if sys help outputs anything there ?
Sure does... I'll have to make an ugly wrapper to pull the info from dmesg.
[ 506.660858] valid subcommands:
[ 506.660865] memrl memwl modifybit memwlsc
[ 506.660867] memwl2 memrw memww memory
[ 506.660869] memcpy fillmem mac onutype
[ 506.660870] bbf247 onumode qdmainit exmdio
[ 506.660873] autopvc wan2lan wlan2lan button
[ 506.660874] usbeye sfepcheck gdmpDebug gdmpReg
[ 506.660876] gdmpMemory ver imginfo voiptest
[ 506.660878] bindshowtask bobcarlibration bootflag sifm
[ 506.660880] serdes
Other maybe-helpful bits. From /var/log/messages:
2025 Feb 7 10:11:37.2792 info axon_platform_manager: System.ThermalControlBase: Applied fan_id:sunon_w1700k
2025 Feb 7 10:11:37.2792 info axon_platform_manager: System.ThermalControlBase: Applied: uci auto configs: pwm:30, poll:15
From /etc/fan/fan_sunon_w1700k:
# t1~t4, trc, temperature_hysteresis: unit in degC (-128 ~ 127)
# temperature_source: chose one from 'local', 'remote_1', 'remote_2', 'programmable_1', 'programmable_2'
config global 'global'
option rpm_event_threshold '400'
config table 'table1'
option t1 '49'
option t2 '62'
option t3 '65'
option t4 '75'
option trc '85'
option rpm1 '770'
option rpm2 '1000'
option rpm3 '1400'
option rpm4 '2700'
option temperature_source 'local'
option temperature_hysteresis '2'
config table 'table2'
option t1 '77'
option t2 '94'
option t3 '97'
option t4 '103'
option trc '125'
option rpm1 '770'
option rpm2 '1000'
option rpm3 '1400'
option rpm4 '2700'
option temperature_source 'programmable_1'
option temperature_hysteresis '2'
config table 'table3'
option t1 '48'
option t2 '90'
option t3 '92'
option t4 '98'
option trc '125'
option rpm1 '770'
option rpm2 '1000'
option rpm3 '1400'
option rpm4 '2700'
option temperature_source 'programmable_2'
option temperature_hysteresis '2'
1 Like
Does this help?
sys memrl X
[ 1125.180412] <Address> <Value>
[ 1125.180437] 0x1fbf0200 0x10170000
[ 1125.185726]
[ 1125.185726] <Address> <Value>
[ 1125.185755] 0x1fbf0204 0xbfdffef5
[ 1125.191647]
[ 1125.191647] <Address> <Value>
[ 1125.191673] 0x1fbf0208 0x00000000
[ 1125.197103]
[ 1125.197103] <Address> <Value>
[ 1125.197127] 0x1fbf020c 0x00000000
[ 1125.203629]
[ 1125.203629] <Address> <Value>
[ 1125.203656] 0x1fbf0210 0x00000000
[ 1125.209604]
[ 1125.209604] <Address> <Value>
[ 1125.209629] 0x1fbf0214 0xb81a4600
[ 1125.214955]
[ 1125.214955] <Address> <Value>
[ 1125.214984] 0x1fbf0218 0x00000000
[ 1125.221110]
[ 1125.221110] <Address> <Value>
[ 1125.221136] 0x1fbf021c 0x00000000
[ 1125.226447]
[ 1125.226447] <Address> <Value>
[ 1125.226473] 0x1fbf0220 0x45400144
[ 1125.232186]
[ 1125.232186] <Address> <Value>
[ 1125.232212] 0x1fbf0224 0x00000000
[ 1125.237931]
[ 1125.237931] <Address> <Value>
[ 1125.237961] 0x1fbf0228 0x00000003
[ 1125.243295]
[ 1125.243295] <Address> <Value>
[ 1125.243320] 0x1fbf022c 0x00000000
[ 1125.249579]
[ 1125.249579] <Address> <Value>
[ 1125.249605] 0x1fbf0230 0x00000000
[ 1125.254884]
[ 1125.254884] <Address> <Value>
[ 1125.254911] 0x1fbf0234 0x00000000
[ 1125.260576]
[ 1125.260576] <Address> <Value>
[ 1125.260602] 0x1fbf0238 0x00000000
[ 1125.266487]
[ 1125.266487] <Address> <Value>
[ 1125.266512] 0x1fbf023c 0x00ffff00
[ 1125.273143]
[ 1125.273143] <Address> <Value>
[ 1125.273170] 0x1fbf0240 0x00ff00ff
[ 1125.279669]
[ 1125.279669] <Address> <Value>
[ 1125.279695] 0x1fbf0244 0x00000000
[ 1125.285057]
[ 1125.285057] <Address> <Value>
[ 1125.285086] 0x1fbf0248 0x00000000
[ 1125.290762]
[ 1125.290762] <Address> <Value>
[ 1125.290792] 0x1fbf024c 0x00000000
[ 1125.296094]
[ 1125.296094] <Address> <Value>
[ 1125.296119] 0x1fbf0250 0x00000080
[ 1125.302020]
[ 1125.302020] <Address> <Value>
[ 1125.302046] 0x1fbf0254 0x00000000
[ 1125.307779]
[ 1125.307779] <Address> <Value>
[ 1125.307811] 0x1fbf0258 0x00000000
[ 1125.313497]
[ 1125.313497] <Address> <Value>
[ 1125.313524] 0x1fbf025c 0x00000000
[ 1125.319196]
[ 1125.319196] <Address> <Value>
[ 1125.319224] 0x1fbf0260 0x10400000
[ 1125.324518]
[ 1125.324518] <Address> <Value>
[ 1125.324544] 0x1fbf0264 0x00000000
[ 1125.330343]
[ 1125.330343] <Address> <Value>
[ 1125.330372] 0x1fbf0268 0x00000002
[ 1125.335698]
[ 1125.335698] <Address> <Value>
[ 1125.335728] 0x1fbf026c 0xffffffff
[ 1125.341575]
[ 1125.341575] <Address> <Value>
[ 1125.341607] 0x1fbf0270 0x000045ff
[ 1125.348300]
[ 1125.348300] <Address> <Value>
[ 1125.348331] 0x1fbf0274 0xffffffff
[ 1125.355486]
[ 1125.355486] <Address> <Value>
[ 1125.355515] 0x1fbf0278 0x00004800
[ 1125.361207]
[ 1125.361207] <Address> <Value>
[ 1125.361235] 0x1fbf027c 0x00000000
[ 1125.366901]
[ 1125.366901] <Address> <Value>
[ 1125.366930] 0x1fbf0280 0x00000000
[ 1125.373283]
[ 1125.373283] <Address> <Value>
[ 1125.373313] 0x1fbf0284 0x00000000
[ 1125.379484]
[ 1125.379484] <Address> <Value>
[ 1125.379513] 0x1fbf0288 0x00000000
[ 1125.384839]
[ 1125.384839] <Address> <Value>
[ 1125.384868] 0x1fbf028c 0x00000000
[ 1125.390566]
[ 1125.390566] <Address> <Value>
[ 1125.390595] 0x1fbf0290 0x00000000
[ 1125.395907]
[ 1125.395907] <Address> <Value>
[ 1125.395935] 0x1fbf0294 0x00000000
[ 1125.401836]
[ 1125.401836] <Address> <Value>
[ 1125.401866] 0x1fbf0298 0x02020202
[ 1125.407479]
[ 1125.407479] <Address> <Value>
[ 1125.407507] 0x1fbf029c 0x02020202
[ 1125.413185]
[ 1125.413185] <Address> <Value>
[ 1125.413213] 0x1fbf02a0 0x00000000
[ 1125.418792]
[ 1125.418792] <Address> <Value>
[ 1125.418821] 0x1fbf02a4 0x00000000
[ 1125.424178]
[ 1125.424178] <Address> <Value>
[ 1125.424208] 0x1fbf02a8 0x00000000
[ 1125.429998]
[ 1125.429998] <Address> <Value>
[ 1125.430026] 0x1fbf02ac 0x00000000
[ 1125.435313]
[ 1125.435313] <Address> <Value>
[ 1125.435341] 0x1fbf02b0 0x00000000
[ 1125.441687]
[ 1125.441687] <Address> <Value>
[ 1125.441717] 0x1fbf02b4 0x00000000
[ 1125.447082]
[ 1125.447082] <Address> <Value>
[ 1125.447111] 0x1fbf02b8 0x00000000
[ 1125.453127]
[ 1125.453127] <Address> <Value>
[ 1125.453156] 0x1fbf02bc 0x00000000
GPIO 17 is set as output, it is also configured as a pwm output. No other pin is configured as pwm-pin. GPIO17 belongs to gpio index slot 9.
The pwm frequency is the default 125Hz.
dts:
pwm_gpio17_idx9_pins: pwm-gpio17-idx9-pins {
function = "pwm";
pins = "gpio17";
output-enable;
};
now you can use the pwm via:
pinctrl-names = default;|
pinctrl-0 = <&pwm_gpio17_idx10_pins>;|
pwms = <&en7581_pwm 9 4000000 0>;
Happy hacking!!!
4 Likes
I think the fan is not controlled via gpio 17 as one green led is connected to it. They do configure the pwm to that pin though, maybe to lower the intensity. The fan must be controlled some other way.
1 Like
The fan is controlled through a NCT7511Y SMBus/I2C integrated fan controller/temp sensor hub (near the SoC)
Looking around on the board, we also have:
EFR32MG21Zigbee/Matter radio (internal USB?)Airoha AG3352QGPS/GNSS radio for AFC (PPS via internal serial)
which is also supported by both ZHA and Zigbee2Mqtt. it supports both Zigbee and Matter. It was also supported for multiprotocol i.e Zigbee and matter on the same radio.
It is the same chip as Home Assistant Connect ZBT-1.
It will be difficult to add support for it in OpenWrt, but we can do it, using this router as a matter bridge or Zigbee Coordinator (or Zigbee Router using different firmware) it will be a legendary device.
2 Likes
You have to negotiate with the seller. Use Ebay offer feature.
There was one listing of 5 pieces for Usd 75. Someone lucky got that deal.
Wireless works, but 6GHz AP won't kick up. US country code show be fine, but
iwis showingno IR. LuCI shows the AP is disabled and I don't see any kernel logs setting the chip to AP mode.
This happened on my Linksys MX8500. There are rules enforced on the 6Ghz band otherwise it won't come up. WPA3/OWE required. 802.11w Management Frame Protection required. If you set it correctly in Luci, it may magically work.
See: WiFi: mandate WPA3 in >= 6GHz bands · Issue #7553 · openwrt/luci (github.com)
2 Likes
Looks like you were right. The radio appears to come up fine now, but I don't own a 6GHz device to test with.
So at this point, the only components that do not work are:
- 10G ports (WIP)
- LAN ports do not come up on boot... talking with @Ansuel this may be a netifd thing
- Bootlog still suggests that the Wi-Fi fw fails to load from eeprom
[ 9.112665] mt7996e 0000:01:00.0: enabling device (0000 -> 0002)
[ 9.216044] mt7996e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20240809121758a
[ 9.216044]
[ 9.240368] mt7996e 0000:01:00.0: WM Firmware Version: ____000000, Build Time: 20240809121753
[ 9.280006] mt7996e 0000:01:00.0: DSP Firmware Version: ____000000, Build Time: 20240809121650
[ 9.298596] mt7996e 0000:01:00.0: WA Firmware Version: ____000000, Build Time: 20240809121718
[ 9.308716] urngd: v1.0.2 started.
[ 9.557367] mt7996e 0000:01:00.0: eeprom load fail, use default bin
2 Likes
The router has reached my city.
I will try to flash it on both new and used devices.
I think my friend does have Wifi 6 devices so can test it with it.
I wouldn't flash anything atm. I'm just tftpbooting.
can you list the steps to do it?
Also Wifi 6 radio screenshots will be great.