Support for Comfast CF-EW72/MT7621

The fact Comfast won't reply to any of my emails US or China seems to indicate they are trying to pull a fast one.
I've been through all the Comfast FCC listings and there's no mention of a revision and the original filing states that it's only applicable to that exact version.
I'm going to take a look at the Xiaomi routers as I know alot to be Mediatek and see if I can port one over to my device

That is potentially much better hardware than the v1. It has gigabit ports, faster CPU, and twice the RAM. I think the MT7613 will work OK. I'm not sure what the result of bugs of mt76 with the different ac chips was.

The main thing to look for when considering running an existing build for a different model (with the same SoC) is that the flash partitions line up.

1 Like

The bug is just visual I believe I have a xiaomi r3p which says it's limited to 6mbps but I'm getting 100+ when I test via my phone.

Sorry I'm an idiot how would I check the partitions mtkparts? As far as I'm aware this still has fast ethernet and im not sure about the flash size or ram I can't even make out where the ram chips are

Connect serial and let stock firmware boot fully, that boot log should show the partitions.

The ports are wired for gigabit, note there are four wire pairs to each transformer. A gigabit compatible PoE injector has to be used to have a gigabit connection. The MT7621DAT has 128 MB of RAM built in. (the D in the part number) The empty chip site next to the CPU is for another RAM chip. The bootloader log in the other thread said 128 MB DRAM.

For testing go to the snapshots directory to download initramfs images and TFTP and boot them directly from RAM. Don't alter the flash until you're pretty sure the image is going to work.

So I lost the stock Comfast firmware when I tried to load the Qualcomm ew72 image it's currently running on the Mediatek mt7621 v60 openwrt18.06 initramfs image which seems to work minus the WiFi. So if the chip has 128 built in and there's a 128mb nor chip on the board also I'll take a look what's on the toh and see if I can find something similar.

Just for fun I found AP firmware CF-EW72V2-V2.6.0.1.bin.
It looks like LEDE 17.01 based with Mediatek drivers.
Decompiled dts-file:

/dts-v1/;

/ {
	#address-cells = <0x1>;
	#size-cells = <0x1>;
	compatible = "comfast,cf-a560v2", "mediatek,mt7621-soc";
	model = "COMFAST CF-A560V2";

	cpus {

		cpu@0 {
			compatible = "mips,mips1004Kc";
		};

		cpu@1 {
			compatible = "mips,mips1004Kc";
		};
	};

	cpuintc@0 {
		#address-cells = <0x0>;
		#interrupt-cells = <0x1>;
		interrupt-controller;
		compatible = "mti,cpu-interrupt-controller";
	};

	aliases {
		serial0 = "/palmbus@1e000000/uartlite@c00";
	};

	cpuclock@0 {
		#clock-cells = <0x0>;
		compatible = "mtk,mt7621-cpu-clock";
		linux,phandle = <0x15>;
		phandle = <0x15>;
	};

	sysbusclock@0 {
		#clock-cells = <0x0>;
		compatible = "mtk,mt7621-sys-bus-clock";
		linux,phandle = <0x7>;
		phandle = <0x7>;
	};

	apll@0 {
		#clock-cells = <0x0>;
		compatible = "fixed-clock";
		clock-frequency = <0x1017df80>;
		linux,phandle = <0x5>;
		phandle = <0x5>;
	};

	sysclock50M@0 {
		#clock-cells = <0x0>;
		compatible = "fixed-clock";
		clock-frequency = <0x2faf080>;
		linux,phandle = <0x2>;
		phandle = <0x2>;
	};

	sysclock125M@0 {
		#clock-cells = <0x0>;
		compatible = "fixed-clock";
		clock-frequency = <0x7735940>;
		linux,phandle = <0x11>;
		phandle = <0x11>;
	};

	palmbus@1e000000 {
		compatible = "palmbus";
		reg = <0x1e000000 0x100000>;
		ranges = <0x0 0x1e000000 0xfffff>;
		#address-cells = <0x1>;
		#size-cells = <0x1>;

		sysc@0 {
			compatible = "mtk,mt7621-sysc";
			reg = <0x0 0x100>;
		};

		wdt@100 {
			compatible = "mtk,mt7621-wdt";
			reg = <0x100 0x100>;
		};

		gpio@600 {
			#address-cells = <0x1>;
			#size-cells = <0x0>;
			compatible = "mtk,mt7621-gpio";
			reg = <0x600 0x100>;
			interrupt-parent = <0x1>;
			interrupts = <0x0 0xc 0x4>;

			bank@0 {
				reg = <0x0>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
				#gpio-cells = <0x2>;
				linux,phandle = <0x10>;
				phandle = <0x10>;
			};

			bank@1 {
				reg = <0x1>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
				#gpio-cells = <0x2>;
			};

			bank@2 {
				reg = <0x2>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
				#gpio-cells = <0x2>;
			};
		};

		i2c@900 {
			compatible = "mediatek,mt7621-i2c";
			reg = <0x900 0x100>;
			clocks = <0x2>;
			resets = <0x3 0x10>;
			reset-names = "i2c";
			#address-cells = <0x1>;
			#size-cells = <0x0>;
			status = "disabled";
			pinctrl-names = "default";
			pinctrl-0 = <0x4>;
		};

		i2s@a00 {
			compatible = "mediatek,mt7621-i2s";
			reg = <0xa00 0x100>;
			clocks = <0x5>;
			resets = <0x3 0x11>;
			reset-names = "i2s";
			interrupt-parent = <0x1>;
			interrupts = <0x0 0x10 0x4>;
			txdma-req = <0x2>;
			rxdma-req = <0x3>;
			dmas = <0x6 0x4 0x6 0x6>;
			dma-names = "tx", "rx";
			status = "disabled";
		};

		spi@b00 {
			status = "okay";
			compatible = "mediatek,mt7621-spi";
			reg = <0xb00 0x100>;
			clocks = <0x7>;
			resets = <0x3 0x12>;
			reset-names = "spi";
			#address-cells = <0x1>;
			#size-cells = <0x0>;
			pinctrl-names = "default";
			pinctrl-0 = <0x8>;

			m25p80@0 {
				#address-cells = <0x1>;
				#size-cells = <0x1>;
				compatible = "jedec,spi-nor";
				reg = <0x0>;
				spi-max-frequency = <0x989680>;
				m25p,chunked-io = <0x20>;

				partition@0 {
					label = "Bootloader";
					reg = <0x0 0x30000>;
					read-only;
				};

				partition@30000 {
					label = "Config";
					reg = <0x30000 0x10000>;
				};

				partition@50000 {
					label = "factory";
					reg = <0x40000 0x10000>;
					read-only;
					linux,phandle = <0xc>;
					phandle = <0xc>;
				};

				partition@90000 {
					label = "firmware";
					reg = <0x50000 0xfb0000>;
				};
			};
		};

		uartlite@c00 {
			compatible = "mediatek,mt6577-uart", "ns16550a";
			reg = <0xc00 0x100>;
			clocks = <0x2>;
			clock-frequency = <0x2faf080>;
			interrupt-parent = <0x1>;
			interrupts = <0x0 0x1a 0x4>;
			reg-shift = <0x2>;
			reg-io-width = <0x4>;
			no-loopback-test;
		};

		uartfull@d00 {
			compatible = "mediatek,mt6577-uart", "ns16550a";
			reg = <0xd00 0x100>;
			clocks = <0x2>;
			clock-frequency = <0x2faf080>;
			interrupt-parent = <0x1>;
			interrupts = <0x0 0x1b 0x4>;
			reg-shift = <0x2>;
			reg-io-width = <0x4>;
			no-loopback-test;
			status = "okay";
		};

		uartfull@e00 {
			compatible = "mediatek,mt6577-uart", "ns16550a";
			reg = <0xe00 0x100>;
			clocks = <0x2>;
			clock-frequency = <0x2faf080>;
			interrupt-parent = <0x1>;
			interrupts = <0x0 0x1c 0x4>;
			reg-shift = <0x2>;
			reg-io-width = <0x4>;
			no-loopback-test;
			status = "disabled";
		};

		gdma@2800 {
			compatible = "mtk,rt3883-gdma";
			reg = <0x2800 0x800>;
			resets = <0x3 0xe>;
			reset-names = "dma";
			interrupt-parent = <0x1>;
			interrupts = <0x0 0xd 0x4>;
			#dma-cells = <0x1>;
			#dma-channels = <0x10>;
			#dma-requests = <0x10>;
			status = "disabled";
			linux,phandle = <0x6>;
			phandle = <0x6>;
		};

		ecc@3800 {
			compatible = "mediatek,mt7621-ecc";
			reg = <0x3800 0x800>;
			status = "disabled";
			linux,phandle = <0x9>;
			phandle = <0x9>;
		};

		nand@3000 {
			compatible = "mediatek,mt7621-nfc";
			reg = <0x3000 0x800>;
			ecc-engine = <0x9>;
			#address-cells = <0x1>;
			#size-cells = <0x1>;
			pinctrl-names = "default";
			pinctrl-0 = <0xa>;
			status = "disabled";
		};

		memc@5000 {
			compatible = "mtk,mt7621-memc";
			reg = <0x5000 0x1000>;
		};

		hsdma@7000 {
			compatible = "mediatek,mt7621-hsdma";
			reg = <0x7000 0x1000>;
			resets = <0x3 0x5>;
			reset-names = "hsdma";
			interrupt-parent = <0x1>;
			interrupts = <0x0 0xb 0x4>;
			#dma-cells = <0x1>;
			#dma-channels = <0x1>;
			#dma-requests = <0x1>;
			status = "disabled";
		};
	};

	rstctrl {
		compatible = "ralink,rt2880-reset";
		#reset-cells = <0x1>;
		linux,phandle = <0x3>;
		phandle = <0x3>;
	};

	clkctrl {
		compatible = "ralink,rt2880-clock";
		#clock-cells = <0x1>;
		linux,phandle = <0xf>;
		phandle = <0xf>;
	};

	ethsys@1e000000 {
		compatible = "mediatek,mt7621-ethsys", "syscon";
		reg = <0x1e000000 0x8000>;
		linux,phandle = <0xb>;
		phandle = <0xb>;
	};

	raeth@1e100000 {
		compatible = "mediatek,mt7621-eth";
		reg = <0x1e100000 0xe000>;
		interrupt-parent = <0x1>;
		interrupts = <0x0 0x3 0x4>;
		mediatek,ethsys = <0xb>;
		status = "disabled";
	};

	ethernet@1e100000 {
		compatible = "mediatek,mt7621-eth", "syscon";
		reg = <0x1e100000 0xe000>;
		#address-cells = <0x1>;
		#size-cells = <0x0>;
		interrupt-parent = <0x1>;
		interrupts = <0x0 0x3 0x4>;
		mediatek,ethsys = <0xb>;
		status = "okay";
		mtd-mac-address = <0xc 0xe000>;

		mac@0 {
			compatible = "mediatek,eth-mac";
			mtd-mac-address = <0xc 0xe000>;
			reg = <0x0>;
			phy-mode = "rgmii";

			fixed-link {
				speed = <0x3e8>;
				full-duplex;
				pause;
			};
		};

		mac@1 {
			compatible = "mediatek,eth-mac";
			mtd-mac-address = <0xc 0xe000>;
			reg = <0x1>;
			phy-mode = "trgmii";

			fixed-link {
				speed = <0x3e8>;
				full-duplex;
				pause;
			};
		};

		mdio-bus {
			#address-cells = <0x1>;
			#size-cells = <0x0>;
			linux,phandle = <0xd>;
			phandle = <0xd>;

			ethernet-phy@1f {
				reg = <0x1f>;
				phy-mode = "rgmii";
			};
		};
	};

	gsw {
		compatible = "mediatek,mt753x";
		mt7530,direct-phy-access;
		interrupt-parent = <0x1>;
		interrupts = <0x0 0x17 0x4>;
		#address-cells = <0x1>;
		#size-cells = <0x0>;
		mediatek,mdio = <0xd>;
		mediatek,portmap = "wllll";
		mediatek,mcm;
		resets = <0x3 0x2>;
		reset-names = "mcm";

		port@5 {
			compatible = "mediatek,mt753x-port";
			reg = <0x5>;
			phy-mode = "rgmii";

			fixed-link {
				speed = <0x3e8>;
				full-duplex;
			};
		};

		port@6 {
			compatible = "mediatek,mt753x-port";
			reg = <0x6>;
			phy-mode = "trgmii";

			fixed-link {
				speed = <0x3e8>;
				full-duplex;
			};
		};

		mdio-bus {
			#address-cells = <0x1>;
			#size-cells = <0x0>;
		};
	};

	hnat@1e100000 {
		compatible = "mediatek,mtk-hnat_v1";
		reg = <0x1e100000 0x3000>;
		resets = <0xb 0x0>;
		reset-names = "mtketh";
		status = "okay";
		mtketh-wan = "eth1";
		mtketh-ppd = "eth0";
		mtketh-max-gmac = <0x2>;
		mtkfoe-etry-num-cfg = <0x2>;
	};

	sdhci@1e130000 {
		status = "disabled";
		compatible = "mediatek,mt7621-sdhci";
		reg = <0x1e130000 0x4000>;
		interrupt-parent = <0x1>;
		interrupts = <0x0 0x14 0x4>;
	};

	pcie@1e140000 {
		compatible = "mediatek,mt7621-pci";
		reg = <0x1e140000 0x40000>;
		#address-cells = <0x3>;
		#size-cells = <0x2>;
		pinctrl-names = "default";
		pinctrl-0 = <0xe>;
		device_type = "pci";
		bus-range = <0x0 0xff>;
		ranges = <0x2000000 0x0 0x0 0x60000000 0x0 0x10000000 0x1000000 0x0 0x0 0x1e160000 0x0 0x10000>;
		interrupt-parent = <0x1>;
		interrupts = <0x0 0x4 0x4 0x0 0x18 0x4 0x0 0x19 0x4>;
		status = "okay";
		resets = <0x3 0x18 0x3 0x19 0x3 0x1a>;
		reset-names = "pcie0", "pcie1", "pcie2";
		clocks = <0xf 0x18 0xf 0x19 0xf 0x1a>;
		clock-names = "pcie0", "pcie1", "pcie2";
		reset-gpios = <0x10 0x13 0x1>;
		reset-gpio-names = "pcie";

		pcie0 {
			reg = <0x0 0x0 0x0 0x0 0x0>;
			#address-cells = <0x3>;
			#size-cells = <0x2>;
			device_type = "pci";
		};

		pcie1 {
			reg = <0x800 0x0 0x0 0x0 0x0>;
			#address-cells = <0x3>;
			#size-cells = <0x2>;
			device_type = "pci";
		};

		pcie2 {
			reg = <0x1000 0x0 0x0 0x0 0x0>;
			#address-cells = <0x3>;
			#size-cells = <0x2>;
			device_type = "pci";
		};
	};

	usb@1e1c0000 {
		compatible = "mediatek,mt7621-xhci", "mediatek,mt2701-xhci";
		reg = <0x1e1c0000 0x1000 0x1e1d0700 0x100>;
		reg-names = "mac", "ippc";
		interrupt-parent = <0x1>;
		interrupts = <0x0 0x16 0x4>;
		clocks = <0x11 0x11 0x11 0x11>;
		clock-names = "sys_ck", "free_ck", "ahb_ck", "dma_ck";
		phys = <0x12 0x3 0x13 0x4 0x14 0x3>;
		status = "okay";
	};

	usb-phy@1e1d0000 {
		compatible = "mediatek,mt7621-u3phy", "mediatek,mt2701-u3phy";
		#address-cells = <0x1>;
		#size-cells = <0x1>;
		ranges;
		reg = <0x1e1d0000 0x300>;
		status = "okay";

		usb-phy@0x1e1d0800 {
			reg = <0x1e1d0800 0x100>;
			#phy-cells = <0x1>;
			clocks = <0x11>;
			clock-names = "ref";
			linux,phandle = <0x12>;
			phandle = <0x12>;
		};

		usb-phy@0x1e1d0900 {
			reg = <0x1e1d0900 0x700>;
			#phy-cells = <0x1>;
			clocks = <0x11>;
			clock-names = "ref";
			linux,phandle = <0x13>;
			phandle = <0x13>;
		};

		usb-phy@0x1e1d1000 {
			reg = <0x1e1d1000 0x100>;
			#phy-cells = <0x1>;
			clocks = <0x11>;
			clock-names = "ref";
			linux,phandle = <0x14>;
			phandle = <0x14>;
		};
	};

	interrupt-controller@1fbc0000 {
		compatible = "mti,gic";
		reg = <0x1fbc0000 0x2000>;
		interrupt-controller;
		#interrupt-cells = <0x3>;
		mti,reserved-cpu-vectors = <0x7>;
		linux,phandle = <0x1>;
		phandle = <0x1>;

		timer {
			compatible = "mti,gic-timer";
			interrupts = <0x1 0x1 0x0>;
			clocks = <0x15>;
		};
	};

	pinctrl {
		compatible = "mtk,mtkmips-pinmux";
		pinctrl-names = "default";
		pinctrl-0 = <0x16>;

		pinctrl0 {
			linux,phandle = <0x16>;
			phandle = <0x16>;

			gpio {
				mtk,group = "i2c";
				mtk,function = "gpio";
			};

			uart2 {
				mtk,group = "uart2";
				mtk,function = "gpio";
			};

			uart3 {
				mtk,group = "uart3";
				mtk,function = "gpio";
			};

			sdhci {
				mtk,group = "sdhci";
				mtk,function = "gpio";
			};

			jtag {
				mtk,group = "jtag";
				mtk,function = "gpio";
			};
		};

		i2c {
			linux,phandle = <0x4>;
			phandle = <0x4>;

			i2c {
				mtk,group = "i2c";
				mtk,function = "i2c";
			};
		};

		mdio {

			mdio {
				mtk,group = "mdio";
				mtk,function = "mdio";
			};
		};

		nand {
			linux,phandle = <0xa>;
			phandle = <0xa>;

			spi-nand {
				mtk,group = "spi";
				mtk,function = "nand1";
			};

			sdhci-nand {
				mtk,group = "sdhci";
				mtk,function = "nand2";
			};
		};

		pcie {
			linux,phandle = <0xe>;
			phandle = <0xe>;

			pcie {
				mtk,group = "pcie";
				mtk,function = "gpio";
			};
		};

		rgmii1 {

			rgmii1 {
				mtk,group = "rgmii1";
				mtk,function = "rgmii1";
			};
		};

		rgmii2 {

			rgmii2 {
				mtk,group = "rgmii2";
				mtk,function = "rgmii2";
			};
		};

		sdhci {

			sdhci {
				mtk,group = "sdhci";
				mtk,function = "sdhci";
			};
		};

		spi {
			linux,phandle = <0x8>;
			phandle = <0x8>;

			spi {
				mtk,group = "spi";
				mtk,function = "spi";
			};
		};

		uart1 {

			uart1 {
				mtk,group = "uart1";
				mtk,function = "uart1";
			};
		};

		uart2 {

			uart2 {
				mtk,group = "uart2";
				mtk,function = "uart2";
			};
		};

		uart3 {

			uart3 {
				mtk,group = "uart3";
				mtk,function = "uart3";
			};
		};
	};

	crypto@1e004000 {
		status = "okay";
		compatible = "mediatek,mtk-eip93";
		reg = <0x1e004000 0x1000>;
		interrupt-parent = <0x1>;
		interrupts = <0x0 0x13 0x4>;
	};

	chosen {
		bootargs = "console=ttyS0,115200";
	};

	gpio-keys-polled {
		compatible = "gpio-keys-polled";
		#address-cells = <0x1>;
		#size-cells = <0x0>;
		poll-interval = <0x14>;

		reset {
			label = "reset";
			gpios = <0x10 0x12 0x1>;
			linux,code = <0x198>;
		};
	};

	gpio-leds {
		compatible = "gpio-leds";

		wlan {
			label = "comfast:blue:wlan";
			gpios = <0x10 0xf 0x1>;
		};
	};
};
1 Like

Just for fun I love you

I spent all day looking for that firmware btw

Ok it's too late now for me to even try to comprehend this, I tried to cross reference the devwiki and toh and didn't find anything the same with my feeble mind I can't even find my eyeglass to check the PCB over properly.

Morning all
I'm hoping today will be a productive one, I'm planning on flashing the stock firmware Serge kindly found then take any relevant data from the uboot, flash partitions and any environment details. I'll go over the PCB again now I've removed the heatsinks and get any IC information I can and post it all here. Question about drivers though, do I need a exact driver for each of the WiFi chips or are they covered by say mtk 76xxen or mtk 761xben?

Here's what i have so far.
SOC: MTK MT7621DAT
Flash: MX25L12833F
WIFI:

I loaded the stock image back up and everything is working fine it seems only issue i have is i don't have any thermal glue, so the heat-sinks are just floating on TIM for the moment but i have no intention of fitting the AP till i've copied the eeprom for the other device.

So I had a nose around the Mediatek routers but nothing seemed to match well enough and I'm scared of messing up the flash partitions so it's stuck with stock firmware for the moment. I strapped it to a tree in our fields for the moment with Velcro wraps to test it out. I should get the eeprom programmer either this afternoon or tomorrow so I can try re-flash the bricked one I have then I'll play with that.

So I've been trying to read the mx25L12833F nor chip with my ch341a and it seems the programmer doesn't support the chip. I've tried a handful of different software options and none have the option for that specific chip. anyone with some smarts able to tell me where I'm going wrong or do I need to buy another programmer?

Not so bad. You only need update software to support new chips.
Or use software which can be configurable to describe new chip.
Or use opensource software (e.g. flashrom) to add this chip support.
Software usualy read so called jedec-id of chip. And for unknown chips it refuse to work. Current stable openwrt support only these Macronix 128Mbit chips:

        { "mx25l12805d", INFO(0xc22018, 0, 64 * 1024, 256, 0) },
        { "mx25l12855e", INFO(0xc22618, 0, 64 * 1024, 256, 0) },
        { "mx25u12835f", INFO(0xc22538, 0, 64 * 1024, 256,
                         SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },

where 0xc22018, 0xc22618, 0xc22538 are jedec-id (first 0xc2 - vendor, next 2 bytes - type and size).
Bootloader usually report flash id during boot process.

UPDATE.
Current version of flashrom support both mx25l12833f and ch341a

2 Likes

Thanks Serge I'll take a look

Hey Serge where did you see that flashrom supports the mx25l12833f?sorry I've just managed to get it all installed but no luck with that macronix chip it seems.

If I'm not mistaken this description allows to work with any of MX25L12833F/MX25L12835F/MX25L12845E/MX25L12865E/MX25L12873F chips. So you need to select this chip explicitly from supported list.

Hmm not sure what's going on then as the latest version of flashrom only seems to have the 35f and not the 33 on the supported list

I don't have a GUI btw I'm doing this in terminal if that makes a difference qflashrom seems to be discontinued