I have a WR3000H and It appears to be a OpenWRT "with a skin"
Official firmware https://www.cudy.com/pages/download-center/wr3000h-1-0 https://www.cudy.com/products/wr3000h-1-0
There are support for WR3000 and I can see there are a snapshot of WR3000S
The models WR3000H WR3000P and WR3000S are different from vendor firwmare prespective. But have the same chasis.
Boot System log https://pastebin.com/z7QPJqM0
This appears similar to WR3000S, but with 2.5Gbps wan port.
Adding support for this device would probably go something like:
- purchase it
- solder a serial ttl connectors and connect a USB to ttl and try booting wr3000s ramfs image via tftp without touching the flash memory and see what works
- decomplie the binary flattened device tree from their image and see what the difference is with other WR3000 devices
- make a new .dts for it and try building an image
- fix small things: eth interface names, leds...
- make a pull request
3 Likes
Hi all, at this time the WR3000H was disasembled and I conected some wires to serial pins via a USB serial. This is the board for reference. Serial 8N1 115200
1 Like
With the serial connected I got 2 outputs from serial log, one in the normal mode https://pastebin.com/xvNuKM4Y and the other in the TFTP mode https://pastebin.com/nL2a04Li (pressing reset for serveral seconds in power on). I try to upload via tftp the openwrt-mediatek-filogic-cudy_wr3000h-v1-initramfs-kernel.bin file renamed as recovery.bin, but it does nothing. Some hint to enter u-boot command line?
Interesting as the WR3000H is even better than the WR3000S! 
Where did you get such file?
Is my own build from git basically a patch cloning wr3000s stuff and renaming it at this time.
1 Like
Some update with TFTP, I got a u-boot cmd when image failed. Now tryng to boot.
Filename 'recovery.bin'.
Load address: 0x46000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
368.2 KiB/s
done
Bytes transferred = 8418840 (807618 hex)
firmware not support
MT7981>
Ok, Finally I booted with WR3000S kernel and I have shell, full dump https://pastebin.com/rALi1fqj
MT7981> tftp ${loadaddr} openwrt-24.10.0-rc2-mediatek-filogic-cudy_wr3000s-v1-in
Using ethernet@15100000 device
TFTP from server 192.168.1.88; our IP address is 192.168.1.112
Filename 'openwrt-24.10.0-rc2-mediatek-filogic-cudy_wr3000s-v1-initramfs-kernel.
Load address: 0x46000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############################################################
669.9 KiB/s
done
Bytes transferred = 8500240 (81b410 hex)
MT7981> printenv filesize
filesize=81b410
MT7981> bootm ${loadaddr}
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-6.6.63
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000e8
Data Size: 4111386 Bytes = 3.9 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: 83262d5d
Hash algo: sha1
Hash value: 03b1bd3825b57f0f0a51b26d4293b067fd78ef06
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'initrd-1' ramdisk subimage
Description: ARM64 OpenWrt cudy_wr3000s-v1 initrd
Type: RAMDisk Image
Compression: Unknown Compression
Data Start: 0x463ebe40
Data Size: 4363568 Bytes = 4.2 MiB
Architecture: AArch64
OS: Linux
Load Address: unavailable
Entry Point: unavailable
Hash algo: crc32
Hash value: c2032db4
Hash algo: sha1
Hash value: f470d30a81fcb5945b58681ad9743941e9515228
Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its !
## Loading fdt from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt cudy_wr3000s-v1 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x4681547c
Data Size: 23135 Bytes = 22.6 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 88613b79
Hash algo: sha1
Hash value: 9786006bd7cd6ba34eb7b1ba625d74d9ebdb97fd
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x4681547c
Uncompressing Kernel Image
Loading Ramdisk to 4f3d1000, end 4f7fa530 ... OK
Loading Device Tree to 000000004f3c8000, end 000000004f3d0a5e ... OK
Starting kernel ...
BusyBox v1.36.1 (2024-12-03 11:41:08 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 24.10.0-rc2, r28161-ea17e958b9
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~#
I'm not sure what you did when creating your build that made it not boot, but this is good news.
Can you see which ethernet ports work, which don't, do you see phy0 and phy1 in iw list...
The next step would be making the .dts (start with WR3000S one). You'll probably need to disassemble the flattened .dtb used in their firmware. I'll try to extract it.
1 Like
If I'm correct, this should be the decompiled flattened device tree from their build https://gist.github.com/zekica/c4a4a123cb5ebcc7e583d57a43658bd0
1 Like
Also, you might (although I'm not sure what they check when uploading firmware to their web firmware update page, and only if the flash layout is the same) be able to flash their WR3000S build from https://github.com/openwrt/openwrt/pull/16939#issuecomment-2534102651 . That one will have the same features not working as what you get, but might be a way to install your build without serial.
1 Like
Well the ethernet ports work but are displaced, i.e. the logical WAN port (gray cable) is mapped on the physical LAN1 and the physical WAN port does not work (green cable), physical W4321 mapped logically to X321W, where X does not work.
The iw list is as follows https://pastebin.com/zqfj11NE
WiFi should work, but for ethernet, you'll need to patch the .dts, and I don't know how exactly. Maybe someone else can help. I can try making changes blindly when I have time tomorrow, but making 2.5Gbps WAN port work is not trivial.
Good news, you are working great.
X is the 2.5G eth which need a new package to work. WR3000S does not have it. Any clue on the motherboard about the chip?
The previous device tree I posted was not complete. I have found the actual dtb and converted it to dts and updated the github gist.
For making gigabit lan ports work, it should be as simple as changing label = "xxx" values inside the &switch section.
For making the wan port work, I'm not sure... It might be something like this:
- in
ðsection, add (with or without fixed-link section):
gmac1: mac@1 {
compatible = "mediatek,eth-mac";
reg = <1>;
phy-mode = "2500base-x";
phy-handle = <&phy6>
nvmem-cell-names = "mac-address";
nvmem-cells = <&macaddr_bdinfo_de00 1>;
fixed-link {
speed = <2500>;
full-duplex;
pause;
};
};
- then in
&mdio_busadding:
phy6: phy@1 {
compatible = "ethernet-phy-id001c.c849";
reg = <6>;
phy-mode = "2500base-x";
};
- and finally removing
labelfromport@4
2 Likes
Finally my fork works and now I got a workflow, to change dts, to create image and test it via TFTP. Today I'll work making tiny changes to dts and see what changes, fist mapping lan ports correctlyn and later check if wan port go to 2.5base-x. Long run only for learning purposes 
1 Like
Cudy TR3000 in &mdio_bus uses compatible = "ethernet-phy-ieee802.3-c45"; so you may want to try that too.
1 Like
No luck with image signature. I'll continue with the workflow described
1 Like
Try to contact with Cudy asking for the intermediate firmware. Usually they publish them without problem if someone asks.
AFAIK and all the emails I had with cudy support, they not release intermediate signed firmware, if they don't have the official release to build it .