Hi OpenWRT community! 
I’d love to see OpenWRT support for the Cudy M1300. It has great hardware but is stuck with limited stock firmware. Would any devs be interested in looking into it?
**Resources: **
https://tinyurl.com/mv7vu8ex (Spec)
https://tinyurl.com/3489wdn4 (Firmware)
*Need help with:
Analyzing firmware & bootloader
Building an OpenWRT image
Unlocking full potential with OpenWRT
If anyone would love to help, please let me know. Thanks in advance! 
Looks similar to the WR1300, but with 1 LAN port only and without USB.
Based on the provided links, I assume you're using revision 2.0?
Did you try to open the device? There might be two screws on the bottom of the device, maybe covered by a rubber ring.
Nah, I did not open the router yet. But yes My device version is 2.0
Ok, for opening the device, there are two screws under the rubber at the bottom:
You should feed the screws if you go around the ring with your finger.
After removing them, you should be able to pull out the device on the top (don't pull to the bottom).
MAC Adresses:
There is one on the label, e.g. xx:xx:xx:xx:xx:1C
LAN (bottom connector) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
WAN (top connector) is label +2, e.g. xx:xx:xx:xx:xx:1E
WLAN (2.4G) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
WLAN (5G) is the same as WAN, e.g. xx:xx:xx:xx:xx:1E
UART is available via the pin holes on the board:
Do NOT connect VCC
Settings: 3.3V, 115200, 8N1
GPIO:
What I understood until now: Cudy will create "intermediate" images to switch to OpenWrt as soon as there is device support in OpenWrt. Looks like someone already asked at the Cudy website:
Problem: I cannot load images to test the device support. There is TFTP recovery when pressing the reset button during boot, but I cannot load the image. It reports the following output:
Bytes transferred = 7577213 (739e7d hex)
NetBootFileXferSize= 00739e7d
R15 firmware check ok
Afterwards, the router boots from flash instead of loading the image. Until now, I didn't find a way to get to the U-Boot console for TFTP loading. Pressing Ctrl+C during the recovery boot just cancels the recovery procedure and boots from flash again.
By your following guidance, I took some photos of that device from inside the board.
Here are these:
and the rest are: https://postimg.cc/gallery/J1Njqnh
These may be useful to others for a number of purposes.
I’m in contact with Cudy to get the intermediate image.
as in the screen shot you posted, the openwrt image have to come 1st, then the transition image's generated by them.
you could however ask them how to break into u-boot.
Yes, that’s what I asked for. Or alternatively have multiple options to provide OpenWrt images which are signed by them and tested by me.
Hope this will be come soon
Some progress by replacing the OEM firmware in the flash:
All my changes are available here (the last commit):
LAN, WAN, WiFi, buttons and LEDs are working. Sysupgrade too. Didn’t do any long term tests until now
There are two strange messages, maybe one of the experienced developers can provide some information regarding them.
During Boot:
[ 1.487375] Creating 7 MTD partitions on "spi0.0":
[ 1.492214] 0x000000000000-0x000000030000 : "u-boot"
[ 1.498891] 0x000000030000-0x000000040000 : "u-boot-env"
[ 1.505471] 0x000000040000-0x000000050000 : "factory"
[ 1.512035] OF: Bad cell count for /palmbus@1e000000/spi@b00/flash@0/partitions
[ 1.519731] 0x000000050000-0x000000fd0000 : "firmware"
[ 1.526226] 2 uimage-fw partitions found on MTD device firmware
[ 1.532209] Creating 2 MTD partitions on "firmware":
[ 1.537161] 0x000000000000-0x00000031f63c : "kernel"
[ 1.542128] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[ 1.551501] 0x00000031f63c-0x000000f80000 : "rootfs"
[ 1.556538] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 1.566799] mtd: setting mtd5 (rootfs) as root device
[ 1.571999] 1 squashfs-split partitions found on MTD device rootfs
[ 1.578169] 0x000000770000-0x000000f80000 : "rootfs_data"
[ 1.584770] 0x000000fd0000-0x000000fe0000 : "debug"
[ 1.591038] 0x000000fe0000-0x000000ff0000 : "backup"
[ 1.597372] 0x000000ff0000-0x000001000000 : "bdinfo"
[ 1.603678] OF: Bad cell count for /palmbus@1e000000/spi@b00/flash@0/partitions
During sysupgrade:
[ 107.227118] ------------[ cut here ]------------
[ 107.231819] WARNING: CPU: 1 PID: 3623 at fs/super.c:695 generic_shutdown_super+0x128/0x16c
[ 107.240093] VFS: Busy inodes after unmount of jffs2 (jffs2)
[ 107.240101] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_inet pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7615e(O) mt7615_common(O) mt7603e(O) mt76_connac_lib(O) mt76(O) mac80211(O) cfg80211(O) slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c hwmon crc_ccitt compat(O) sha512_generic sha256_generic sha1_generic seqiv sha3_generic jitterentropy_rng drbg md5 crypto_hw_eip93 hmac geniv rng des_generic libdes cmac authencesn authenc leds_gpio gpio_button_hotplug(O) crc32c_generic
[ 107.313321] CPU: 1 PID: 3623 Comm: busybox Tainted: G O 6.6.78 #0
[ 107.320788] Stack : 809a1440 80089dec 00000114 00000004 00000000 00000000 837afd1c 80b60000
[ 107.329170] 80a30000 808a62d8 00000000 00000000 00000000 00000001 837afcc8 8188ea40
[ 107.337526] 00000000 00000000 808a62d8 837afc00 ffffefff 00000000 ffffffea 00000000
[ 107.345885] 837afc0c 00000115 809a9000 ffffffff 808a62d8 00000001 837afdc8 80200540
[ 107.354248] 00000009 808af43c 809a1440 7f711b70 00000018 80486874 00000004 80b60004
[ 107.362609] ...
[ 107.365054] Call Trace:
[ 107.367484] [<800079f4>] show_stack+0x28/0xf0
[ 107.371854] [<807a7630>] dump_stack_lvl+0x60/0x80
[ 107.376561] [<8002d9b4>] __warn+0xb0/0xe4
[ 107.380575] [<8002db68>] warn_slowpath_fmt+0x180/0x188
[ 107.385702] [<80200540>] generic_shutdown_super+0x128/0x16c
[ 107.391268] [<804b8978>] kill_mtd_super+0x14/0x30
[ 107.395972] [<802a64ac>] jffs2_kill_sb+0x5c/0x74
[ 107.400575] [<80200744>] deactivate_locked_super+0x4c/0xd8
[ 107.406045] [<80229c00>] cleanup_mnt+0xb0/0x15c
[ 107.410588] [<8004fd44>] task_work_run+0x98/0xdc
[ 107.415192] [<80006f48>] do_notify_resume+0x214/0x24c
[ 107.420234] [<80002c50>] work_notifysig+0x10/0x18
[ 107.424927]
[ 107.426454] ---[ end trace 0000000000000000 ]---
Cudy provided me a signed image for the device to switch to OpenWrt. I was able to flash from OEM 2.2.8-20241015-191740.
Pull request is created, flashing instructions can be found there:
Until the PR is merged, there is an image based on OpenWrt 24.10.0:
Some hints if you want to backup the flash using a raspberry pi (mainly based on https://tomvanveen.eu/flashing-bios-chip-raspberry-pi/).
Hardware setup:
Command to backup the flash
flashrom -p linux_spi:dev=/dev/spidev0.0 -r original.bin
Command for restoring a backup:
flashrom -p linux_spi:dev=/dev/spidev0.0 -w original.bin
