Support for Cudy WR3000H

For Developers
21

The 4 lan ports are working correctly with your sugestions and some tweak in ucidef_set_interfaces_lan_wan https://github.com/openwrt/openwrt/compare/main...juampe:openwrt:WR3000H?diff=unified&w=
But the wan port, as you say, is not trivial, appear as eth1 but not work with the compatible values proposed

root@OpenWrt:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1504 qdisc mq state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet6 fe80::82af:caff:fe5f:2f8c/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8d brd ff:ff:ff:ff:ff:ff
4: lan1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
5: lan2@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
6: lan3@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
7: lan4@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fd3f:c60c:4154::1/60 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::82af:caff:fe5f:2f8c/64 scope link
       valid_lft forever preferred_lft forever


root@OpenWrt:~# dmesg|grep "mdio\|soc_eth"
[    1.782697] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081300000, irq 75
[    1.792644] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc081300000, irq 75
[    1.956607] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.965330] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.976860] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=79)
[    1.999118] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=80)
[    2.021155] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=81)
[    2.043205] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=82)
[    2.054759] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[    2.390759] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    2.399262] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.430204] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
[    5.304474] mt7530-mdio mdio-bus:1f lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[    6.603072] mt7530-mdio mdio-bus:1f lan1: Link is Down
[   16.380219] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   16.401194] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   16.411527] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   16.420429] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
[   16.442155] mt7530-mdio mdio-bus:1f lan1: entered allmulticast mode
[   16.448425] mtk_soc_eth 15100000.ethernet eth0: entered allmulticast mode
[   16.458025] mt7530-mdio mdio-bus:1f lan1: entered promiscuous mode
[   16.477609] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mode
[   16.499342] mt7530-mdio mdio-bus:1f lan2: entered allmulticast mode
[   16.507534] mt7530-mdio mdio-bus:1f lan2: entered promiscuous mode
[   16.523877] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mode
[   16.545207] mt7530-mdio mdio-bus:1f lan3: entered allmulticast mode
[   16.553493] mt7530-mdio mdio-bus:1f lan3: entered promiscuous mode
[   16.569447] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
[   16.590732] mt7530-mdio mdio-bus:1f lan4: entered allmulticast mode
[   16.599316] mt7530-mdio mdio-bus:1f lan4: entered promiscuous mode
[   19.350494] mt7530-mdio mdio-bus:1f lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[  177.404017] mtk_soc_eth 15100000.ethernet eth1: configuring for fixed/2500base-x link mode
[  177.413932] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 2.5Gbps/Full - flow control rx/tx
22

Can you try removing fixed rate for eth1? I'll look into this more.

23

With fixed rate

root@OpenWrt:~# ifconfig eth1 192.168.0.7 up
[   55.104502] mtk_soc_eth 15100000.ethernet eth1: configuring for fixed/2500base-x link mode
[   55.114425] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 2.5Gbps/Full - flow control rx/tx

Without fixed rate

root@OpenWrt:~# ifconfig eth1 192.168.0.7 up
[  872.646013] mtk_soc_eth 15100000.ethernet eth1: validation of 2500base-x with support 00,00000000,00000000,00006280 and advertisement 00,00000000,00000000,0L
[  872.662120] mtk_soc_eth 15100000.ethernet eth1: mtk_open: could not attach PHY: -22
ifconfig: SIOCSIFFLAGS: Invalid argument
24

There may be another option: the WAN port can also be connected via the switch which can explain the fixed rate in their eth1 configuration.

Can you just for testing try adding wan port on the switch? setting reg to different values.

Maybe someone else can help.

25

No luck with same mdio

[    1.961391] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.970522] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.981264] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=79)
[    2.003467] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=80)
[    2.025485] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=81)
[    2.047481] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=82)
[    2.069855] mt7530-mdio mdio-bus:1f wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=83)
[    2.081061] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode


3: lan1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
4: lan2@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
5: lan3@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
6: lan4@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.7/24 brd 192.168.0.255 scope global lan4
       valid_lft forever preferred_lft forever
7: wan@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8d brd ff:ff:ff:ff:ff:ff
26

If you have tried different reg values (ones not used by lan1-lan4) and from 0 to 8 or 9, and none work, then AFAIK the wan port is not connected to the switch.

I'll take a more detailed look in the next few hours and see what the issue with that is.

Can you do a lsmod in their stock rom?

27 
&switch {
	ports {
		#address-cells = <1>;
		#size-cells = <0>;

		port@0 {
			reg = <0>;
			label = "lan1";
		};

		port@1 {
			reg = <1>;
			label = "lan2";
		};

		port@2 {
			reg = <2>;
			label = "lan3";
		};

		port@3 {
			reg = <3>;
			label = "lan4";
		};

		wan: port@4 {
			reg = <4>;
			label = "wan";
			nvmem-cell-names = "mac-address";
			nvmem-cells = <&macaddr_bdinfo_de00 1>;
		};

		port@6 {
			reg = <6>;
			label = "cpu";
			ethernet = <&gmac0>;
			phy-mode = "2500base-x";

			fixed-link {
				speed = <2500>;
				full-duplex;
				pause;
			};
		};
	};
};

Testing with, I think I got a match with reg=<4>, but for some reason wan link is not detected like lan1 (UP vs LOWERLAYERDOWN).

7: wan@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8d brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.7/24 brd 192.168.0.255 scope global wan
       valid_lft forever preferred_lft forever


reg=<4>
[    1.952885] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.961873] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.972638] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=79)
[    1.995138] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=80)
[    2.017183] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=81)
[    2.039232] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=82)
[    2.061550] mt7530-mdio mdio-bus:1f wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=83)


reg=<5>
[    2.067478] mt7530-mdio mdio-bus:1f wan (uninitialized): validation of  with support 00,00000000,00000000,00006000 and advertisement 00,00000000,00000000,00L
[    2.083452] mt7530-mdio mdio-bus:1f wan (uninitialized): failed to connect to PHY: -EINVAL
[    2.091727] mt7530-mdio mdio-bus:1f wan (uninitialized): error -22 setting up PHY for tree 0, switch 0, port 5

reg=<7>
[    1.784457] mt7530-mdio mdio-bus:1f: port /soc/ethernet@15100000/mdio-bus/switch@1f/ports/port@4 index 7 exceeds num_ports (7)
[    1.795897] mt7530-mdio: probe of mdio-bus:1f failed with error -22

The message of "exceeds num ports" i'ts a clue.

28

Can you do a lsmod in their stock rom?

No but i can mount rootfs. I think that the main hardware is enbedded in kernel.
(Keep in mind I'm not familitar with in enbeeded linux, an I have to search where is each thing, and how to handle It :P) [Sure I need to read some additional docs]

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "BL2"
mtd1: 00080000 00020000 "u-boot-env"
mtd2: 00200000 00020000 "Factory"
mtd3: 00040000 00020000 "bdinfo"
mtd4: 00200000 00020000 "FIP"
mtd5: 04000000 00020000 "ubi"

root@OpenWrt:/# mount -o ro /dev/ubiblock0_1  /rootfs/
root@OpenWrt:/rootfs/lib/modules/5.4.246# ls -C -w 160
af_key.ko                  ip_set_hash_netiface.ko    nf_conntrack_h323.ko       nft_log.ko                 xt_CLASSIFY.ko
ah4.ko                     ip_set_hash_netnet.ko      nf_conntrack_irc.ko        nft_meta_bridge.ko         xt_CT.ko
ah6.ko                     ip_set_hash_netport.ko     nf_conntrack_netlink.ko    nft_numgen.ko              xt_DSCP.ko
arc4.ko                    ip_set_hash_netportnet.ko  nf_conntrack_pptp.ko       nft_objref.ko              xt_FLOWOFFLOAD.ko
asn1_decoder.ko            ip_set_list_set.ko         nf_conntrack_sip.ko        nft_quota.ko               xt_HL.ko
authenc.ko                 ip_tables.ko               nf_conntrack_snmp.ko       nft_redir.ko               xt_LOG.ko
cbc.ko                     ip_tunnel.ko               nf_conntrack_tftp.ko       nft_reject.ko              xt_MASQUERADE.ko
conninfra.ko               ipcomp.ko                  nf_defrag_ipv4.ko          nft_reject_bridge.ko       xt_REDIRECT.ko
crc-ccitt.ko               ipcomp6.ko                 nf_defrag_ipv6.ko          nft_reject_inet.ko         xt_TCPMSS.ko
des_generic.ko             ipt_ECN.ko                 nf_dup_netdev.ko           nft_reject_ipv4.ko         xt_comment.ko
echainiv.ko                ipt_REJECT.ko              nf_flow_table.ko           nft_reject_ipv6.ko         xt_connbytes.ko
esp4.ko                    ipt_TRIGGER.ko             nf_flow_table_hw.ko        ppp_async.ko               xt_connlimit.ko
esp6.ko                    ipt_ah.ko                  nf_log_common.ko           ppp_generic.ko             xt_connmark.ko
gpio-button-hotplug.ko     iptable_filter.ko          nf_log_ipv4.ko             ppp_mppe.ko                xt_conntrack.ko
gre.ko                     iptable_mangle.ko          nf_log_ipv6.ko             pppoe.ko                   xt_dscp.ko
hyfi-bridging.ko           iptable_nat.ko             nf_nat.ko                  pppox.ko                   xt_ecn.ko
igmp-snooping.ko           iptable_raw.ko             nf_nat_amanda.ko           pptp.ko                    xt_esp.ko
ip6_tables.ko              ipv6-pass-through.ko       nf_nat_ftp.ko              sha1_generic.ko            xt_helper.ko
ip6_tunnel.ko              l2tp_core.ko               nf_nat_h323.ko             slhc.ko                    xt_hl.ko
ip6_udp_tunnel.ko          l2tp_netlink.ko            nf_nat_irc.ko              ts_bm.ko                   xt_length.ko
ip6t_REJECT.ko             l2tp_ppp.ko                nf_nat_pptp.ko             ts_fsm.ko                  xt_limit.ko
ip6table_filter.ko         leds-gpio.ko               nf_nat_sip.ko              ts_kmp.ko                  xt_mac.ko
ip6table_mangle.ko         libdes.ko                  nf_nat_snmp_basic.ko       tun.ko                     xt_mark.ko
ip_gre.ko                  mcore.ko                   nf_nat_tftp.ko             tunnel4.ko                 xt_multiport.ko
ip_set.ko                  md5.ko                     nf_reject_ipv4.ko          tunnel6.ko                 xt_nat.ko
ip_set_bitmap_ip.ko        mt_wifi.ko                 nf_reject_ipv6.ko          udp_tunnel.ko              xt_policy.ko
ip_set_bitmap_ipmac.ko     mtk_warp.ko                nf_tables.ko               vlan.ko                    xt_recent.ko
ip_set_bitmap_port.ko      mtk_warp_proxy.ko          nf_tables_set.ko           wan_detect.ko              xt_set.ko
ip_set_hash_ip.ko          mtkhnat.ko                 nfnetlink.ko               wireguard.ko               xt_state.ko
ip_set_hash_ipmark.ko      nat46.ko                   nft_counter.ko             x_tables.ko                xt_statistic.ko
ip_set_hash_ipport.ko      nf_conncount.ko            nft_ct.ko                  xfrm4_tunnel.ko            xt_tcpmss.ko
ip_set_hash_ipportip.ko    nf_conntrack.ko            nft_dup_netdev.ko          xfrm6_tunnel.ko            xt_tcpudp.ko
ip_set_hash_ipportnet.ko   nf_conntrack_amanda.ko     nft_fwd_netdev.ko          xfrm_algo.ko               xt_time.ko
ip_set_hash_mac.ko         nf_conntrack_broadcast.ko  nft_hash.ko                xfrm_ipcomp.ko
ip_set_hash_net.ko         nf_conntrack_ftp.ko        nft_limit.ko               xfrm_user.ko
29

So, I looked into what their DTS says, and there are two ethernet devices and one switch.

One ethernet device is for sure connected to the switch port with reg=<6>, and has configured fixed link at 2.5Gbps.

In their DTS, ethernet definition looks like this (excluding parts from common mt7981.dtsi):

	ethernet@15100000 {
		status = "okay";
		lower-mtd-name = "bdinfo";

		mac@0 {
			compatible = "mediatek,eth-mac";
			reg = <0x00>;
			mtd-mac-address = <0x12 0xde00>;
			phy-mode = "2500base-x";

			fixed-link {
				speed = <0x9c4>;
				full-duplex;
				pause;
			};
		};

		mac@1 {
			compatible = "mediatek,eth-mac";
			reg = <0x01>;
			mtd-mac-address = <0x12 0xde00>;
			mtd-mac-address-increment = <0x01>;
			phy-mode = "2500base-x";
			phy-handle = <0x13>;

			fixed-link {
				speed = <0x9c4>;
				full-duplex;
				pause;
			};
		};

		mdio-bus {
			phy@1 {
				compatible = "ethernet-phy-id001c.c849";
				reg = <0x06>;
				phy-mode = "2500base-x";
				phandle = <0x13>;
			};
		};
	};

What's confusing to me is that their old mt7630 switch driver has the following properties:

	gsw@0 {
		compatible = "mediatek,mt753x";
		mediatek,ethsys = <0x0e>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		mediatek,mdio = <0x1e>;
		mediatek,portmap = "wllll";
		mediatek,mdio_master_pinmux = <0x01>;
		reset-gpios = <0x0d 0x27 0x00>;
		interrupt-parent = <0x0d>;
		interrupts = <0x26 0x04>;
		status = "okay";

		port@6 {
			compatible = "mediatek,mt753x-port";
			reg = <0x06>;
			phy-mode = "sgmii";

			fixed-link {
				speed = <0x9c4>;
				full-duplex;
			};
		};
	};

This also lists "w" in mediatek,portmap designating port with index 0 as a wan port, but only reg=<6> defines fixed-link, so AFAIK only port 6 is used as an upstream port. Let's assume that this is just them being lazy and they haven't updated the portmap property.

And since wr3000s DTS enables the lan ports, it means that mac@0 is used for the switch upstream.

That leaves mac@1 and it's linked mdio-bus / phy@1 in the dts above. It should work as a wan port.

So what I would try:

Can you try making the following changes:

  • make &eth { have the following contents:
&eth {
	pinctrl-names = "default";
	pinctrl-0 = <&mdio_pins>;

	status = "okay";

	gmac0: mac@0 {
		compatible = "mediatek,eth-mac";
		reg = <0>;
		phy-mode = "2500base-x";

		nvmem-cell-names = "mac-address";
		nvmem-cells = <&macaddr_bdinfo_de00 0>;

		fixed-link {
			speed = <2500>;
			full-duplex;
			pause;
		};
	};
	gmac1: mac@1 {
		compatible = "mediatek,eth-mac";
		reg = <1>;
		nvmem-cell-names = "mac-address";
		nvmem-cells = <&macaddr_bdinfo_de00 1>;
		phy-mode = "2500base-x";
		phy-handle = <&phy1>;

		fixed-link {
			speed = <2500>;
			full-duplex;
			pause;
		};
	};
};

You can possibly remove the fixed-link section and see if it works.

  • and add the following at the end of &mdio_bus {
	phy1: ethernet-phy@1 {
		compatible = "ethernet-phy-ieee802.3-c22";
		reg = <6>;
		phy-mode = "2500base-x";
		phy-is-integrated;
		nvmem-cells = <&phy_calibration>;
		nvmem-cell-names = "phy-cal-data";
	};

you may also take a look at target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7981.dtsi and see if there are any other properties that need to be added to ethernet-phy.

I would also take a look at &mdio_bus { from mt7981b-openwrt-one.dts trying the properties (but keeping reg=<6>).

1 Like
30

Changes proposed appplied does not work, but I got some clues
phy1 whith fixed-link

root@OpenWrt:~# ifconfig eth1 192.168.0.7 up
[   37.384639] mtk_soc_eth 15100000.ethernet eth1: configuring for fixed/2500base-x link mode
[   37.394556] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 2.5Gbps/Full - flow control rx/tx

phy1 without fixed-link

root@OpenWrt:~# ifconfig eth1 192.168.0.7 up
[   41.609929] mtk_soc_eth 15100000.ethernet eth1: validation of  with support 00,00000000,00000000,00006000 and advertisement 00,00000000,00000000,00000000 faL
[   41.625165] mtk_soc_eth 15100000.ethernet eth1: mtk_open: could not attach PHY: -22

I'll try phy1 variations, I already tested some of commented without success

	phy1: ethernet-phy@1 {
		compatible = "ethernet-phy-ieee802.3-c22";
		//compatible = "ethernet-phy-id001c.c849";
		reg = <6>;
		interrupt-controller;
		interrupt-parent = <&pio>;
		// interrupts = <38 IRQ_TYPE_EDGE_FALLING>;
		// reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
		// reset-assert-us = <10000>;
		// reset-deassert-us = <20000>;
		phy-is-integrated;

		phy-mode = "2500base-x";
		full-duplex;
		pause;
		
		nvmem-cells = <&phy_calibration>;
		nvmem-cell-names = "phy-cal-data";
	};

In some point I decided to start the original firmware and test links with the console (no shell available, only logs).

A clue is that Wan port is related to "port38".
38 maybe a register like a switch in 31?

[  110.620752] gmac: port38 linkdown
[  110.721610] mtk_soc_eth 15100000.ethernet eth1: Link is Down
[  110.752088] mtk_soc_eth 15100000.ethernet eth1: configuring for fixed/2500base-x link mode
[  110.760853] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 2.5Gbps/Full - flow control rx/tx
[  110.769580] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[  150.870770] gmac: port38 linkup
[  438.519544] mt753x gsw@0: Port 1 Link is Down
[  438.523999] gmac: port1 linkdown
[  442.678685] mt753x gsw@0: Port 1 Link is Up - 1Gbps/Full
[  442.684093] gmac: port1 linkup
[  444.584811] mt753x gsw@0: Port 1 Link is Down
[  444.589266] gmac: port1 linkdown
[  447.779808] mt753x gsw@0: Port 2 Link is Up - 1Gbps/Full
[  447.785223] gmac: port2 linkup
[  450.472890] mt753x gsw@0: Port 2 Link is Down
[  450.477354] gmac: port2 linkdown
[  453.696021] mt753x gsw@0: Port 0 Link is Up - 1Gbps/Full
[  453.701426] gmac: port0 linkup
[  457.610084] mt753x gsw@0: Port 0 Link is Down
[  457.616939] gmac: port0 linkdown
[  462.236968] mt753x gsw@0: Port 3 Link is Up - 1Gbps/Full
[  462.242382] gmac: port3 linkup
[  472.289098] mt753x gsw@0: Port 3 Link is Down
[  472.293557] gmac: port3 linkdown
[  475.462579] mt753x gsw@0: Port 0 Link is Up - 1Gbps/Full
[  475.467988] gmac: port0 linkup
[  480.098232] gmac: port38 linkdown
[  480.166954] mtk_soc_eth 15100000.ethernet eth1: Link is Down
[  480.183200] mtk_soc_eth 15100000.ethernet eth1: configuring for fixed/2500base-x link mode
[  480.194381] mtk_soc_eth 15100000.ethernet eth1: Link is Up - 2.5Gbps/Full - flow control rx/tx
[  487.232154] gmac: port38 linkup
31

First, let me say that I can't figure out how the 2.5G WAN port is connected. Second, I haven't made such big changes to device trees - the most I did was convert from eeprom to nvmem-cells and changed indexes of already existing devices to match new hardware revisions. Maybe someone else can help.

But in the mean time, I have a suggestion:

This error validation of with support, mtk_open: could not attach PHY: -22 is probably an indication of wrong phy index . Can you try installing mii-tool and trying: mii-tool -v -p 0 eth1 then changing the index to see which one works, but I'm not sure if any will work.

Can you try changing mdio_bus definition to:

phy6: ethernet-phy@6 {
		compatible = "ethernet-phy-ieee802.3-c22";
		reg = <6>;
		phy-mode = "2500base-x";
	};

and then try changing reg = <6> and @6 to 38?

1 Like
32

A walkthough into the firmware (to someone need it in the future)

binwalk WR3000H-R63-2.2.7-20240906-085755-sysupgrade.bin
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
511733        0x7CEF5         CRC32 polynomial table, little endian
560494        0x88D6E         LZO compressed data
604921        0x93AF9         Flattened device tree, size: 7664 bytes, version: 17
2099200       0x200800        Flattened device tree, size: 17696044 bytes, version: 17
2099360       0x2008A0        UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000

Extract data
binwalk -e WR3000H-R63-2.2.7-20240906-085755-sysupgrade.bin

How much skip
604921-560494=44427
dd if=88D6E.lzo of=device-tree1.dtb bs=1 count=7664 skip=44427

How much skip
2099200-604921=1494279
1494279+44427=1538706
dd if=88D6E.lzo of=device-tree2.dtb bs=1 count=17696044 skip=1538706

Decompile

dtc -s -I dtb device-tree1.dtb  -O dts -o device-tree1.dts
dtc -s -I dtb device-tree2.dtb  -O dts -o device-tree2.dts

WR3000H 2.2.7 DTS https://pastebin.com/dQ2stQk7
The second DTS is a blob with the initramfs

/dts-v1/;

/ {
        description = "R63";
        timestamp = <0x66d96b32>;

        images {

                ubi {
                        arch = "arm";
                        compression = "none";
                        data = <BLOB.........>
                        description = "kernel-rootfs image";
                        type = "firmware";

                        hash@1 {
                                algo = "crc32";
                                value = <0x8473a65b>;
                        };
                };
        };
};
33

To extract the actual DTB, you need to search for it inside the UBI image. I have attached it as a github gist in a previous comment.

.

1 Like
34

OK I got shell in original, booting with first with own WRT image :wink:

root@OpenWrt:~# mkdir /ubifs
root@OpenWrt:~# mount -t ubifs /dev/ubi0_2 /ubifs
[   42.214954] UBIFS (ubi0:2): Mounting in unauthenticated mode
[   42.220747] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 3157
[   42.246485] UBIFS (ubi0:2): recovery needed
[   42.339123] UBIFS (ubi0:2): recovery completed
[   42.343634] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[   42.351479] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   42.361387] UBIFS (ubi0:2): FS size: 44568576 bytes (42 MiB, 351 LEBs), max 361 LEBs, journal size 2285568 bytes (2 MiB, 18 LEBs)
[   42.373029] UBIFS (ubi0:2): reserved for root: 2105083 bytes (2055 KiB)
[   42.379637] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID B8339FA6-A12E-40B5-9BB0-73BBBB0021E6, small LPT model
root@OpenWrt:~# echo "ttyS0::askfirst:/bin/ash --login" >> /ubifs/upper/etc/inittab
root@OpenWrt:~# cat /ubifs/upper/etc/inittab
::sysinit:/etc/init.d/rcS S boot
::shutdown:/etc/init.d/rcS K shutdown
ttyS0::askfirst:/bin/ash --login
root@OpenWrt:~# sync
root@OpenWrt:~# umount /ubifs
[  373.805858] UBIFS (ubi0:2): un-mount UBI device 0
[  373.810604] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" stops
root@OpenWrt:~# reboot

Let's dive in :stuck_out_tongue:

BusyBox v1.33.2 (2024-09-05 16:26:26 CST) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02-SNAPSHOT, 2.2.7
 -----------------------------------------------------
root@WR3000H:/# id
uid=0(root) gid=0(root)
35

Now inside cudy I can check that /sys/firmware/devicetree/base has the same structure as your gist

The modules related with mediatek

root@WR3000H:/sys/firmware/devicetree/base# lsmod |grep mt
conninfra             167936  1 mt_wifi
mt_wifi             10264576  5 mtk_warp_proxy
mtk_warp              368640  1 mtk_warp_proxy
mtk_warp_proxy         16384  0
mtkhnat               196608  2 mt_wifi,mtk_warp
36

From live original firmware phyl 0 as reference

root@WR3000H:~# for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
 22;do mii_mgr -g -p 0 -r $i;done
Get: phy[0].reg[0] = 1040
Get: phy[0].reg[1] = 7949
Get: phy[0].reg[2] = 03a2
Get: phy[0].reg[3] = 9461
Get: phy[0].reg[4] = 0de1
Get: phy[0].reg[5] = 0000
Get: phy[0].reg[6] = 0004
Get: phy[0].reg[7] = 2801
Get: phy[0].reg[8] = 0000
Get: phy[0].reg[9] = 0200
Get: phy[0].reg[10] = 0000
Get: phy[0].reg[11] = 0000
Get: phy[0].reg[12] = 0048
Get: phy[0].reg[13] = 0000
Get: phy[0].reg[14] = 0000
Get: phy[0].reg[15] = 0000
Get: phy[0].reg[16] = 3000
Get: phy[0].reg[17] = 00b0
Get: phy[0].reg[18] = 000a
Get: phy[0].reg[19] = 0000
Get: phy[0].reg[20] = 1040
Get: phy[0].reg[21] = 7949
Get: phy[0].reg[22] = 03a2

Checking phy 6 (1,2,3,4,5 all zeros)

root@WR3000H:~# for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
 22;do mii_mgr -g -p 6 -r $i;done
Get: phy[6].reg[0] = 1040
Get: phy[6].reg[1] = 79ad
Get: phy[6].reg[2] = 001c
Get: phy[6].reg[3] = c849
Get: phy[6].reg[4] = 1de1
Get: phy[6].reg[5] = c5e1
Get: phy[6].reg[6] = 006d
Get: phy[6].reg[7] = 2001
Get: phy[6].reg[8] = 6801
Get: phy[6].reg[9] = 0200
Get: phy[6].reg[10] = 0023
Get: phy[6].reg[11] = 0000
Get: phy[6].reg[12] = f3f0
Get: phy[6].reg[13] = 0000
Get: phy[6].reg[14] = 0000
Get: phy[6].reg[15] = 0400
Get: phy[6].reg[16] = 0f00
Get: phy[6].reg[17] = 0f00
Get: phy[6].reg[18] = 019a
Get: phy[6].reg[19] = 0831
Get: phy[6].reg[20] = 1040
Get: phy[6].reg[21] = 79ad
Get: phy[6].reg[22] = 001c
37

With own image phy6: ethernet-phy@6 not work, and 38 neither

mii-tool drops kernel exceptions in eth0 and eth1

[  174.375824] Call trace:
[  174.378258]  swphy_read_reg+0x28/0x178
[  174.381997]  phylink_mii_ioctl+0x284/0x2d8
[  174.386083]  mtk_do_ioctl+0x20/0x30
...
No MII transceiver present!.

For lan port mii works

root@OpenWrt:~# mii-tool -v -p 0 lan1
using the specified MII index 0.
lan1: negotiated 1000baseT-FD flow-control, link ok
  product info: vendor 00:e8:a5, model 4 rev 1
  basic mode:   autonegotiation enabled
  basic status: autonegotiation complete, link ok
  capabilities: 1000baseT-FD 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD
  advertising:  1000baseT-FD 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control
  link partner: 1000baseT-FD 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control
38

Diferential clues, about how many interrupts uses earch fw

root@WR3000H:/proc# cat interrupts
           CPU0       CPU1
  3:     222630     136425     GICv3  30 Level     arch_timer
  7:       2495      52461     GICv3 237 Level     0000:00:00.0
  9:       1852          0     GICv3 243 Level     ccif_wo_isr
 11:          0          0     GICv3 142 Level     wdt_bark
 12:      21628          0     GICv3 155 Level     ttyS0
 56:          2          0   mt-eint  38 Level     gsw@0
 75:      38190          0     GICv3 221 Level     15100000.ethernet
 80:      22365          2     GICv3 229 Level     15100000.ethernet
 81:          0          0     GICv3 230 Level     15100000.ethernet
 87:     691827          0     GICv3 172 Level     1100a000.spi
 88:          0          0     GICv3 173 Level     1100b000.spi
 89:         27          0     GICv3 205 Level     xhci-hcd:usb1
IPI0:     39493     376918       Rescheduling interrupts
IPI1:       346      25628       Function call interrupts
IPI2:         0          0       CPU stop interrupts
IPI3:         0          0       CPU stop (for crash dump) interrupts
IPI4:         0          0       Timer broadcast interrupts
IPI5:         0          2       IRQ work interrupts
IPI6:         0          0       CPU wake-up interrupts
Err:          0


root@OpenWrt:/etc/config# cat /proc/interrupts
           CPU0       CPU1
 11:       7719       9165     GICv3  30 Level     arch_timer
 15:          0          0   mt-eint   0 Edge      gpio-keys
 16:          0          0   mt-eint   1 Edge      gpio-keys
 53:          3          0   mt-eint  38 Level     mt7530
 72:        574          0     GICv3 155 Level     ttyS0
 73:       9202          0     GICv3 172 Level     1100a000.spi
 76:        638          0     GICv3 229 Level     15100000.ethernet
 77:       1521          0     GICv3 230 Level     15100000.ethernet
 78:          0          0     GICv3 142 Level     wdt_bark
 79:          3          0    mt7530   0 Edge      mt7530-0:00
 80:          0          0    mt7530   1 Edge      mt7530-0:01
 81:          0          0    mt7530   2 Edge      mt7530-0:02
 82:          0          0    mt7530   3 Edge      mt7530-0:03
 83:          0          0     GICv3 148 Level     10320000.crypto
 84:          0          0     GICv3 149 Level     10320000.crypto
 85:          0          0     GICv3 150 Level     10320000.crypto
 86:          0          0     GICv3 151 Level     10320000.crypto
 87:        691          0     GICv3 245 Level     mt7915e
IPI0:       974       1146       Rescheduling interrupts
IPI1:      3863       9029       Function call interrupts
IPI2:         0          0       CPU stop interrupts
IPI3:         0          0       CPU stop (for crash dump) interrupts
IPI4:         0          0       Timer broadcast interrupts
IPI5:         0          0       IRQ work interrupts
IPI6:         0          0       CPU wake-up interrupts
Err:          0
1 Like
39

Can you see in their vendor firmware what network interfaces are available, are they called wan, lan, eth0, eth1?

What's the output of the following commands?

ls -l /sys/class/net/*/of_node
ls -l /sys/class/net/*/phydev/of_node
hexdump  /sys/class/net/**nameofwandev**/phydev/of_node/phy-handle

I still don't have a good idea on how wan port is connected.

1 Like
40

Can you try with ethernet-phy@26 ? 38 is 0x26.

And also try:

comptabile = "ethernet-phy-ieee802.3-c45";
1 Like