[solved] Support for Comfast CF-EW72


#1

Comfast CF-EW72 specs:

QCA9531+QCA9886
16MB ROM / 128MB RAM
2x RJ45 ports (WAN/LAN)

Hello,
I'm planning to buy this device as a WDS AP to extend the range of an existing Comfast that has OpenWrt installed already. It is not listed under supported devices, but since the chipset looks pretty common, will I be able to "easily" build a custom rom?

Seems the (already supported) CF-E375AC is based on the QCA9886 too, but has the additional switch chip QCA9337. Can I try to flash that build anyway without bricking? Sorry for asking if that question seems too banal. Thanks for any help.


#2

"Build", no - "develop", maybe (depends on the amount of effort the vendor spent on firmware verification/ authentification and signatures) --> look through the git history for previous commits adding support for new ath79 devices for a general idea.


#3

Thanks. I got the EW72 hardware now and well ... I am trying it do it myself.

The comfast firmwares are based on an older Openwrt (I think 14.07), and I managed to circumvent the unknown root password and got full shell access. So no big problem to get out the GPIOs (/sys/kernel/debug/gpio) and to extract the ART partition to get the MAC locations.

So my first code (ath79) attempt looks like this (based on the code for another existing Comfast ath79 config) :

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
/dts-v1/;

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

#include "qca953x.dtsi"

/ {
	compatible = "comfast,cf-ew72", "qca,qca9531";
	model = "COMFAST CF-EW72";

	aliases {
		serial0 = &uart;
		led-boot = &wan;
		led-failsafe = &wan;
		led-upgrade = &wan;
	};

	leds {
		compatible = "gpio-leds";

		pinctrl-names = "default";
		pinctrl-0 = <&jtag_disable_pins>;

		lan: lan {
			label = "cf-ew72:blue:lan";
			gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
		};

		wan: wan {
			label = "cf-ew72:blue:wan";
			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
		};

		wlan: wlan {
			label = "cf-ew72:blue:wlan";
			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
			linux,default-trigger = "phy0tpt";
		};

	};

	keys {
		compatible = "gpio-keys-polled";
		poll-interval = <20>;

		reset {
			label = "reset";
			linux,code = <KEY_RESTART>;
			gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
			debounce-interval = <60>;
		};
	};
};

&spi {
	status = "okay";
	num-cs = <1>;

	flash@0 {
		compatible = "winbond,w25q128", "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <25000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			uboot: partition@0 {
				label = "u-boot";
				reg = <0x000000 0x010000>;
				read-only;
			};

			art: partition@10000 {
				label = "art";
				reg = <0x010000 0x010000>;
				read-only;
			};

			firmware: partition@20000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x020000 0xfd0000>;
			};

			nvram: partition@ff0000 {
				label = "nvram";
				reg = <0xff0000 0x010000>;
				read-only;
			};
		};
	};
};

&pcie0 {
        status = "okay";
};

&uart {
	status = "okay";
};

&eth0 {
	status = "okay";
	phy-handle = <&swphy4>;
        mtd-mac-address = <&art 0x0>;
};

&eth1 {
	status = "okay";
        mtd-mac-address = <&art 0x1002>;
};

&wmac {
	status = "okay";
        mtd-cal-data = <&art 0x1000>;
        mtd-mac-address = <&art 0x6>;
};

Using UART, running it gets it stuck at (boot loop)

[    0.481293] libphy: Fixed MDIO Bus: probed
[    0.819088] libphy: ag71xx_mdio: probed
[    1.109099] mdio-bus.0:1f: Found an AR934X built-in switch
[    1.114986] libphy: ar7240sw_mdio: probed

This is the output of the genuine firmware at that point:

[    0.820000] libphy: ag71xx_mdio: probed
[    0.830000] eth0: Atheros AG71xx at 0xba000000, irq 5
[    1.390000] ag71xx-mdio.1: Found an AR934X built-in switch
[    1.430000] eth1: Atheros AG71xx at 0xb9000000, irq 4
[    1.990000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[    2.000000] TCP: cubic registered
[    2.000000] NET: Registered protocol family 17
[    2.010000] Bridge firewalling registered

Any help would be appreciated, I have never done this before. Thanks.


#4

I think your last nvram partition is too large. Try making it smaller.


#5

Are you sure that the nvram size is too big? I copied the setting from the binwalked Comfast adaptation of openwrt 14.07, it is "read only" and contains a 1:1 copy of the art partition. Should I rename it to art-backup? Thank you.

Comfast's 14.07:

mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,1536k(kernel),14592k(rootfs),64k(configs),64k(nvram)ro,16128k@0x20000(firmware) rootfstype=squashfs,jffs2 noinitrd

Mine (tested with 18.06 and master):

mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,16192k(firmware),64k(nvram)ro console=ttyS0,115200 rootfstype=squashfs noinitrd

Since it crashes during what seems to be the network hardware setup discovery ... the qca9531 has a 5port switch included, but only 2 port are used in the EW72. Comfast config lines in 02_network from 14.07 are:

cf-ew72)
	ucidef_set_interfaces_lan_wan "eth0" "eth1"
	ucidef_add_switch "switch0" "1" "1"
	ucidef_add_switch_vlan "switch0" "1" "0 1 2 3 4"

I tried different adaptations with ath79/dts and ar71xx/mach versions, but no luck so far.
mine (as a sample):

comfast,cf-ew72)
		ucidef_add_switch "switch0" \
			"0@eth0" "1:wan" "2:lan"


#6

Are you referencing this branch? https://github.com/fall513/openwrt/tree/ar71xx-add-support-for-COMFAST-CF-EW71/EW72


#7

A very big thank you, biangbiangmian. That made the thing.

Also thanks to Comfasts Ding Tengfei for publishing this. That saves me lots of trials ++++++++


#8

I made a ath79/dts version for the CF-EW72. My version solves also the bogus MAC problem I had with the above ar71xx version. The MAC for the ath10k wlan did show as 12:34:45:78:90:12. My version patches the bogus MAC in firmware.bin to the MAC extracted from the caldata/art partition.

Since the CF-EW72 has 8 leds, but only 4 ore used by the official fw, I added a LED for the second WLAN. The 3 remaining GPIO leds can be configured ( rssileds ... ).

diff --git a/target/linux/ath79/base-files/etc/board.d/01_leds b/target/linux/ath79/base-files/etc/board.d/01_leds
index 804f1fca82..3c45ea03be 100755
--- a/target/linux/ath79/base-files/etc/board.d/01_leds
+++ b/target/linux/ath79/base-files/etc/board.d/01_leds
@@ -38,6 +38,15 @@ comfast,cf-e110n-v2)
 	ucidef_set_led_rssi "rssimediumhigh" "RSSIMEDIUMHIGH" "$boardname:green:rssimediumhigh" "wlan0" "51" "100"
 	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "$boardname:green:rssihigh" "wlan0" "76" "100"
 	;;
+comfast,cf-ew72)
+	ucidef_set_led_netdev "lan" "LAN" "$boardname:blue:lan" "eth0"
+	ucidef_set_led_netdev "wan" "WAN" "$boardname:blue:wan" "eth1"
+	ucidef_set_led_wlan "wlan2g" "WLAN2G" "$boardname:blue:wlan" "phy1tpt"
+	ucidef_set_led_wlan "wlan5g" "WLAN5G" "$boardname:blue:wlan" "phy0tpt"
+	ucidef_set_led_default "gpio3" "GPIO3"  "$boardname:blue:gpio3" "none"
+	ucidef_set_led_default "gpio12" "GPIO12"  "$boardname:blue:gpio12" "none"
+	ucidef_set_led_default "gpio16" "GPIO16"  "$boardname:blue:gpio16" "none"
+        ;;
 dlink,dir-859-a1)
 	ucidef_set_led_switch "internet" "WAN" "$boardname:green:internet" "switch0" "0x20"
 	;;
diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
old mode 100644
new mode 100755
index f4741fa3eb..419a6b129d
--- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -153,6 +153,16 @@ case "$FIRMWARE" in
 	;;
 "ath10k/pre-cal-pci-0000:00:00.0.bin")
 	case $board in
+	comfast,cf-ew72)
+		ath10kcal_extract "art" 20480 12064
+		artmac= $(mtd_get_mac_binary art 20486)
+		ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
+			/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
+		ln -sf /lib/firmware/ath10k/QCA9888/hw2.0/firmware-5.bin \
+			/lib/firmware/ath10k/QCA9888/hw2.0/ct-firmware-5.bin
+		macaddr_2bin $artmac | dd of=/lib/firmware/ath10k/QCA9888/hw2.0/firmware-5.bin \
+			conv=notrunc bs=1 seek=789 count=6
+		;;
 	phicomm,k2t)
 		ath10kcal_extract "art" 20480 12064
 		ath10kcal_patch_mac_crc $(k2t_get_mac "5g_mac")
@@ -167,6 +177,7 @@ case "$FIRMWARE" in
 		ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
 			/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
 		;;
+
 	esac
 	;;
 *)
diff --git a/target/linux/ath79/dts/qca9531_comfast_cf-ew72.dts b/target/linux/ath79/dts/qca9531_comfast_cf-ew72.dts
index e69de29bb2..a5603a081b 100755
--- a/target/linux/ath79/dts/qca9531_comfast_cf-ew72.dts
+++ b/target/linux/ath79/dts/qca9531_comfast_cf-ew72.dts
@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "qca953x.dtsi"
+
+/ {
+	compatible = "comfast,cf-ew72", "qca,qca9531";
+	model = "COMFAST CF-EW72";
+
+	aliases {
+		serial0 = &uart;
+		led-boot = &wan;
+		led-failsafe = &wan;
+		led-upgrade = &wan;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&jtag_disable_pins>;
+
+		lan: lan {
+			label = "cf-ew72:blue:lan";
+			gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		wan: wan {
+			label = "cf-ew72:blue:wan";
+			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "cf-ew72:blue:wlan2g";
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5g {
+			label = "cf-ew72:blue:wlan5g";
+			gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
+		};
+
+		gpio3 {
+			label = "cf-ew72:blue:wgpio3";
+			gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+			linux,default-trigger = "heartbeat";
+			default-state = "on";
+		};
+
+		gpio12 {
+			label = "cf-ew72:blue:gpio12";
+			gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		gpio16 {
+			label = "cf-ew72:blue:gpio16";
+			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+	};
+
+	keys {
+		compatible = "gpio-keys"; // -polled
+		// poll-interval = <20>;
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
+			debounce-interval = <60>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+
+		gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		hw_algo = "toggle";
+		hw_margin_ms = <1200>;
+		always-running;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+};
+
+&spi {
+	status = "okay";
+	num-cs = <1>;
+
+	flash@0 {
+		compatible = "winbond,w25q128", "jedec,spi-nor" ;
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			uboot: partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x010000>;
+				read-only;
+			};
+
+			art: partition@10000 {
+				label = "art";
+				reg = <0x010000 0x010000>;
+				read-only;
+			};
+
+			firmware: partition@20000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x020000 0xfd0000>;
+			};
+
+			nvram: partition@ff0000 {
+				label = "nvram";
+				reg = <0xff0000 0x010000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&eth0 {
+	status = "okay";
+	phy-handle = <&swphy4>;
+    mtd-mac-address = <&art 0x0>;
+};
+
+&eth1 {
+	status = "okay";
+    mtd-mac-address = <&art 0x1002>;
+};
+
+&wmac {
+	status = "okay";
+    mtd-cal-data = <&art 0x1000>;
+    mtd-mac-address = <&art 0x6>;
+};
\ No newline at end of file
diff --git a/target/linux/ath79/image/generic.mk b/target/linux/ath79/image/generic.mk
index 889321867a..c8b84648de 100644
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@@ -162,6 +162,15 @@ define Device/comfast_cf-e110n-v2
 endef
 TARGET_DEVICES += comfast_cf-e110n-v2
 
+define Device/comfast_cf-ew72
+  ATH_SOC := qca9531
+  DEVICE_TITLE := COMFAST CF-EW72
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k-ct ath10k-firmware-qca9888-ct \
+                     rssileds -uboot-envtools -swconfig
+  IMAGE_SIZE := 16192k
+endef
+TARGET_DEVICES += comfast_cf-ew72
+
 define Device/devolo_dvl1200e
   ATH_SOC := qca9558
   DEVICE_TITLE := devolo WiFi pro 1200e