Support for Cudy WR3000H

For Developers
41 
root@WR3000H:~#  ls -l /sys/class/net/*/of_node
lrwxrwxrwx    1 root     root             0 Dec 22 20:19 /sys/class/net/eth0/of_node -> ../../../../../firmware/devicetree/base/ethernet@15100000/mac@0
lrwxrwxrwx    1 root     root             0 Dec 22 20:16 /sys/class/net/eth1/of_node -> ../../../../../firmware/devicetree/base/ethernet@15100000/mac@1
root@WR3000H:~# ls -l /sys/class/net/*/phydev/of_node
ls: /sys/class/net/*/phydev/of_node: No such file or directory
root@WR3000H:~# hexdump  /sys/class/net/eth1/phydev/of_node/phy-handle
hexdump: /sys/class/net/eth1/phydev/of_node/phy-handle: No such file or directory
hexdump: /sys/class/net/eth1/phydev/of_node/phy-handle: Bad file descriptor
root@WR3000H:~# hexdump  /sys/class/net/eth1/phys_*
hexdump: /sys/class/net/eth1/phys_port_id: Not supported
hexdump: /sys/class/net/eth1/phys_port_name: Not supported
hexdump: /sys/class/net/eth1/phys_switch_id: Not supported

wan interface sys entries

root@WR3000H:~# ls -la  /sys/class/net/eth1/
drwxr-xr-x    5 root     root             0 Dec 22 19:17 .
drwxr-xr-x    4 root     root             0 Dec 22 19:17 ..
-r--r--r--    1 root     root          4096 Dec 22 20:16 addr_assign_type
-r--r--r--    1 root     root          4096 Dec 22 20:16 addr_len
-r--r--r--    1 root     root          4096 Dec 22 20:15 address
-r--r--r--    1 root     root          4096 Dec 22 20:16 broadcast
-rw-r--r--    1 root     root          4096 Dec 22 20:16 carrier
-r--r--r--    1 root     root          4096 Dec 22 20:16 carrier_changes
-r--r--r--    1 root     root          4096 Dec 22 20:16 carrier_down_count
-r--r--r--    1 root     root          4096 Dec 22 20:16 carrier_up_count
-r--r--r--    1 root     root          4096 Dec 22 20:16 dev_id
-r--r--r--    1 root     root          4096 Dec 22 20:16 dev_port
lrwxrwxrwx    1 root     root             0 Dec 22 20:15 device -> ../../../15100000.ethernet
-r--r--r--    1 root     root          4096 Dec 22 20:16 dormant
-r--r--r--    1 root     root          4096 Dec 22 20:16 duplex
-rw-r--r--    1 root     root          4096 Dec 22 20:16 flags
-rw-r--r--    1 root     root          4096 Dec 22 20:16 gro_flush_timeout
-rw-r--r--    1 root     root          4096 Dec 22 20:16 ifalias
-r--r--r--    1 root     root          4096 Dec 22 20:16 ifindex
-r--r--r--    1 root     root          4096 Dec 22 20:16 iflink
-r--r--r--    1 root     root          4096 Dec 22 20:16 link_mode
-rw-r--r--    1 root     root          4096 Dec 22 20:16 mtu
-r--r--r--    1 root     root          4096 Dec 22 20:16 name_assign_type
-rw-r--r--    1 root     root          4096 Dec 22 20:16 netdev_group
lrwxrwxrwx    1 root     root             0 Dec 22 20:16 of_node -> ../../../../../firmware/devicetree/base/ethernet@15100000/mac@1
-r--r--r--    1 root     root          4096 Dec 22 20:15 operstate
-r--r--r--    1 root     root          4096 Dec 22 20:16 phys_port_id
-r--r--r--    1 root     root          4096 Dec 22 20:16 phys_port_name
-r--r--r--    1 root     root          4096 Dec 22 20:16 phys_switch_id
drwxr-xr-x    2 root     root             0 Dec 22 20:16 power
-rw-r--r--    1 root     root          4096 Dec 22 20:16 proto_down
drwxr-xr-x    4 root     root             0 Dec 22 19:17 queues
-r--r--r--    1 root     root          4096 Dec 22 20:16 speed
drwxr-xr-x    2 root     root             0 Dec 22 20:16 statistics
lrwxrwxrwx    1 root     root             0 Dec 22 20:16 subsystem -> ../../../../../class/net
-rw-r--r--    1 root     root          4096 Dec 22 20:16 threaded
-rw-r--r--    1 root     root          4096 Dec 22 20:16 tx_queue_len
-r--r--r--    1 root     root          4096 Dec 22 20:16 type
-rw-r--r--    1 root     root          4096 Dec 22 20:16 uevent
43

I have Link in ra0 and eth0 corresponding to lan1 and wan.

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UP group default qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 80:af:ca:5f:2f:8d brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.7/24 brd 192.168.0.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::82af:caff:fe5f:2f8d/64 scope link
       valid_lft forever preferred_lft forever
4: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN group default qlen 1000
    link/tunnel6 :: brd ::
5: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN group default qlen 1000
    link/gre 0.0.0.0 brd 0.0.0.0
6: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1462 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
7: erspan0@NONE: <BROADCAST,MULTICAST> mtu 1450 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
8: ra0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UP group default qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet6 fe80::82af:caff:fe5f:2f8c/64 scope link
       valid_lft forever preferred_lft forever
9: ra1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
10: ra2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UNKNOWN group default qlen 1000
    link/ether 82:af:ca:2f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet6 fe80::80af:caff:fe2f:2f8c/64 scope link
       valid_lft forever preferred_lft forever
11: rax0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UNKNOWN group default qlen 1000
    link/ether 82:af:ca:3f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet6 fe80::80af:caff:fe3f:2f8c/64 scope link
       valid_lft forever preferred_lft forever
12: rax1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
13: rax2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UNKNOWN group default qlen 1000
    link/ether 82:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet6 fe80::80af:caff:fe5f:2f8c/64 scope link
       valid_lft forever preferred_lft forever
14: apcli0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 86:af:ca:5f:2f:8d brd ff:ff:ff:ff:ff:ff
15: apclix0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 8a:af:ca:5f:2f:8d brd ff:ff:ff:ff:ff:ff
16: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.1/24 brd 192.168.10.255 scope global br-lan
       valid_lft forever preferred_lft forever
44

ra0/ra1/ra2/rax0/rax1/rax2/apcli0/apclix0 are network devices created by Ralink/Mediatek wifi drivers that to the system looks like an ordinary ethernet since all the wifi processing is done by their os-agnostic drivers - they work on Linux, Windows, wxWorks, BSD...

the wan port is eth1.

1 Like
45

I found a better way to got ttyS0 console and SSH in one step

mkdir /ubifs/; mount -t ubifs /dev/ubi0_2 /ubifs
mv /ubifs/upper/etc/rom_release /ubifs/upper/etc/rom_release.disabled
sync; umount /ubifs; reboot
46

Yeah, I think I miss something. :hot_face:
I am going to leave the project aside for a week to rest and get back ideas and strength (I will not have the laboratory to test). I take this opportunity to wish you all happy holidays.

A new exploration reveals a driver "Realtek RTL8221B PHY" working in mdio-bus 0x06 with gmii combined with nhat

root@WR3000H:/sys/devices/platform/15100000.ethernet# ls -la /sys/devices/platform/15100000*/
/sys/devices/platform/15100000.ethernet/:
drwxr-xr-x    5 root     root             0 Dec 23 10:03 .
drwxr-xr-x   42 root     root             0 Dec 23 10:03 ..
lrwxrwxrwx    1 root     root             0 Dec 23 12:04 driver -> ../../../bus/platform/drivers/mtk_soc_eth
-rw-r--r--    1 root     root          4096 Dec 23 12:04 driver_override
drwxr-xr-x    3 root     root             0 Dec 23 12:04 mdio_bus
-r--r--r--    1 root     root          4096 Dec 23 12:04 modalias
drwxr-xr-x    4 root     root             0 Dec 23 10:03 net
lrwxrwxrwx    1 root     root             0 Dec 23 12:04 of_node -> ../../../firmware/devicetree/base/ethernet@15100000
drwxr-xr-x    2 root     root             0 Dec 23 12:04 power
lrwxrwxrwx    1 root     root             0 Dec 23 12:04 subsystem -> ../../../bus/platform
-rw-r--r--    1 root     root          4096 Dec 23 12:04 uevent

/sys/devices/platform/15100000.hnat/:
drwxr-xr-x    3 root     root             0 Dec 23 10:03 .
drwxr-xr-x   42 root     root             0 Dec 23 10:03 ..
lrwxrwxrwx    1 root     root             0 Dec 23 12:04 driver -> ../../../bus/platform/drivers/mediatek_soc_hnat
-rw-r--r--    1 root     root          4096 Dec 23 12:04 driver_override
-r--r--r--    1 root     root          4096 Dec 23 12:04 modalias
lrwxrwxrwx    1 root     root             0 Dec 23 12:04 of_node -> ../../../firmware/devicetree/base/hnat@15000000
drwxr-xr-x    2 root     root             0 Dec 23 12:04 power
lrwxrwxrwx    1 root     root             0 Dec 23 12:04 subsystem -> ../../../bus/platform
-rw-r--r--    1 root     root          4096 Dec 23 12:04 uevent

root@WR3000H:/sys/devices/platform/15100000.ethernet# ls -la mdio_bus/mdio-bus/
drwxr-xr-x    4 root     root             0 Dec 23 12:06 .
drwxr-xr-x    3 root     root             0 Dec 23 12:04 ..
lrwxrwxrwx    1 root     root             0 Dec 23 12:06 device -> ../../../15100000.ethernet
drwxr-xr-x    3 root     root             0 Dec 23 12:06 mdio-bus:06
lrwxrwxrwx    1 root     root             0 Dec 23 12:06 of_node -> ../../../../../firmware/devicetree/base/ethernet@15100000/mdio-bus
drwxr-xr-x    2 root     root             0 Dec 23 12:06 power
lrwxrwxrwx    1 root     root             0 Dec 23 12:06 subsystem -> ../../../../../class/mdio_bus
-rw-r--r--    1 root     root          4096 Dec 23 12:06 uevent

root@WR3000H:/sys/devices/platform/15100000.ethernet# ls -la mdio_bus/mdio-bus/mdio-bus\:06/
drwxr-xr-x    3 root     root             0 Dec 23 12:06 .
drwxr-xr-x    4 root     root             0 Dec 23 12:06 ..
lrwxrwxrwx    1 root     root             0 Dec 23 12:06 driver -> ../../../../../../bus/mdio_bus/drivers/Realtek RTL8221B PHY
lrwxrwxrwx    1 root     root             0 Dec 23 12:06 of_node -> ../../../../../../firmware/devicetree/base/ethernet@15100000/mdio-bus/phy@1
-r--r--r--    1 root     root          4096 Dec 23 12:06 phy_has_fixups
-r--r--r--    1 root     root          4096 Dec 23 12:06 phy_id
-r--r--r--    1 root     root          4096 Dec 23 12:06 phy_interface
drwxr-xr-x    2 root     root             0 Dec 23 12:06 power
lrwxrwxrwx    1 root     root             0 Dec 23 12:06 subsystem -> ../../../../../../bus/mdio_bus
-rw-r--r--    1 root     root          4096 Dec 23 12:06 uevent

root@WR3000H:/sys/devices/platform/15100000.ethernet# cat mdio_bus/mdio-bus/mdio-bus\:06/phy_*
0
0x001cc849
gmii

root@WR3000H:/sys/devices/platform/15100000.ethernet# gunzip -c /proc/config.gz |grep RTL|grep -v ^#
CONFIG_RTL8221B_PHY=y
CONFIG_USB_RTL8152=y

rtl83xx-phy.h
#define PHY_ID_RTL8221B 0x001cc849

1 Like
47

All variations tested, no success

	//phy1: ethernet-phy@1 {
	//phy6: ethernet-phy@6 {
	//phy26: ethernet-phy@26 {
	phy38: ethernet-phy@38 {
		compatible = "ethernet-phy-ieee802.3-c22";
		//comptabile = "ethernet-phy-ieee802.3-c45";
		//reg = <6>;
		//reg = <0x26>;
		reg = <0x38>;
		phy-mode = "2500base-x";
		phy-is-integrated;
		nvmem-cells = <&phy_calibration>;
		nvmem-cell-names = "phy-cal-data";
	};
48

GAME OVER

Playing with u-boot

echo -e "/dev/ubi0_0\t0x0\t0x20000\t0x20000" > /etc/fw_env.config
fw_printenv

root@OpenWrt:~# fw_printenv
Warning: Bad CRC, using default environment
bootcmd=run distro_bootcmd
bootdelay=2
baudrate=115200
loadaddr=0x0
mtdids=
mtdparts=
bootm_size=0x10000000
eth6addr=02:00:11:22:33:47
ethaddr=02:00:11:22:33:44
fdt_addr_r=0xc00000
ipaddr=192.0.2.1
kernel_addr_r=0x1000000
pxefile_addr_r=0x2000
ramdisk_addr_r=0x2000000
scriptaddr=0x1000
stderr=serial,vidconsole
stdin=serial
stdout=serial,vidconsole

fw_setenv bootcmd

MT7981> printenv
baudrate=115200
bootdelay=2
bootmenu_0=Startup system (Default)=mtkboardboot
bootmenu_1=Upgrade firmware=mtkupgrade fw
bootmenu_2=Upgrade ATF BL2=mtkupgrade bl2
bootmenu_3=Upgrade ATF FIP=mtkupgrade fip
bootmenu_4=Upgrade single image=mtkupgrade simg
bootmenu_5=Load image=mtkload
ethaddr=be:8f:0b:62:d1:c8
fdtcontroladdr=4ffc3a00
ipaddr=192.168.1.112
loadaddr=0x46000000
mtdids=nmbm0=nmbm0
mtdparts=nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),256k(bdinfo),2048k(fip),65536k(ubi)
netmask=255.255.255.0
serverip=192.168.1.88
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000

Input U-Boot's IP address: 192.168.1.112
Input TFTP server's IP address: 192.168.1.88
Input IP netmask: 255.255.255.0
Input file name: cudy.bin

Using ethernet@15100000 device
TFTP from server 192.168.1.88; our IP address is 192.168.1.112
Filename 'cudy.bin'.
Load address: 0x46000000
Loading: ####################################....
done
Bytes transferred = 19795484 (12e0e1c hex)
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK

*** Loaded 19795484 (0x12e0e1c) bytes at 0x46000000 ***

Erasing from 0x0 to 0x12fffff, size 0x1300000 ... OK
Writing from 0x46000000 to 0x0, size 0x12e0e1c ... OK
Verifying from 0x0 to 0x12e0e1b, size 0x12e0e1c ... OK

*** Single image upgrade completed! ***

The router is bricked :dizzy_face:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
F5: 480A 0031
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00ED [010F]
System halt!

Happy new year :partying_face:

49

DEBRICK TO BASIC STOCK

Program to boot https://github.com/981213/mtk_uartboot/releases
mt7981-ram-ddr3-bl2.bin from compile openwrt
cudy-bl2.bin dump from mtd0
cudy-fip.bin dump from mtd4

PS> .\mtk_uartboot.exe -s COM3 -a -p .\mt7981-ram-ddr3-bl2.bin -f .\cudy-fip.bin

MT7981>
tftp ${loadaddr} cudy-bl2.bin
nand erase 0x000000000000 0x000000100000
nand write.e ${loadaddr} 0x000000000000 0x000000100000

tftp ${loadaddr} cudy-fip.bin
nand erase 0x0000003c0000 0x0000005c0000
nand write.e ${loadaddr} 0x0000003c0000 0x0000005c0000

nand erase 0x000000100000 0x000000180000
nand erase 0x000000180000 0x000000380000
nand erase 0x000000380000 0x0000003c0000
nand erase 0x0000005c0000 0x0000045c0000
reset

keep press reset (until all led flash-one led keep-one led keep,one led flash)
-> TFTP recovery.bin(WR3000H-R63-2.2.7-20240906-085755-sysupgrade.bin) (192.168.0.88->192.168.112)

*** Upgrading oem fit Firmware ***

Using ethernet@15100000 device
TFTP from server 192.168.1.88; our IP address is 192.168.1.112
Filename 'recovery.bin'.
Load address: 0x46000000
Loading: ###################################...
done
Bytes transferred = 19664413 (12c0e1d hex)
rsa verify ok
## Copying 'ubi' subimage from FIT image at 46200800 ...
crc32+ Erasing from 0x0 to 0x10bffff, size 0x10c0000 ... OK
Writing from 0x462008a0 to 0x0, size 0x10c0000 ... OK
Verifying from 0x0 to 0x10bffff, size 0x10c0000 ... OK

*** oem fit Firmware upgrade completed! ***

Rebooting ...

resetting ...
1 Like
50

OMG nand erased too much :sweat_smile: instead of size, I use end of partition.
Now the sizes were correct and I got Original firmware from backup

setenv mtdids nmbm0=nmbm0
setenv mtdparts nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),256k(bdinfo),2048k(fip),65536k(ubi)
setenv ethaddr be:8f:0b:62:d1:c8
setenv ipaddr 192.168.1.112
setenv loadaddr 0x46000000
setenv netmask 255.255.255.0
setenv serverip 192.168.1.88
setenv stderr serial@11002000
setenv stdin serial@11002000
setenv stdout serial@11002000


tftp ${loadaddr} cudy-bl2.bin;nand erase 0x000000000000 0x3a2e0;nand write.e ${loadaddr} 0x000000000000 0x3a2e0

tftp ${loadaddr} cudy-ubootenv.bin;nand erase 0x000000100000 0x80000;nand write.e ${loadaddr} 0x000000100000 0x80000

tftp ${loadaddr} cudy-factory.bin;nand erase 0x000000180000 0x20000;nand write.e ${loadaddr} 0x000000180000 0x20000

tftp ${loadaddr} cudy-bdinfo.bin;nand erase 0x000000380000 0x40000;nand write.e ${loadaddr} 0x000000380000 0x40000 

tftp ${loadaddr} cudy-fip.bin;nand erase 0x0000003c0000 0xb0a80;nand write.e ${loadaddr} 0x0000003c0000 0xb0a80

tftp ${loadaddr} cudy-ubi.bin;nand erase 0x0000005c0000 0x4000000;nand write.e ${loadaddr} 0x0000005c0000 0x4000000
2 Likes
51

I order to speed testing I build my own BL2 and FIP to flash into BL and FIP partitions. I can boot from tftp and boot the original firmware too from ubi.

git clone https://github.com/mtk-openwrt/u-boot.git
cd u-boot/
make mt7981_spim_nand_rfb_defconfig
make CROSS_COMPILE=aarch64-linux-gnu-
cd ..

git clone https://github.com/mtk-openwrt/arm-trusted-firmware.git
cd arm-trusted-firmware
make -f Makefile CROSS_COMPILE=aarch64-linux-gnu- PLAT=mt7981 BOOT_DEVICE=spim-nand BOARD_BGA=1 BL33=../u-boot/u-boot.bin OVERRIDE_FIP_BASE=0x3c0000 all fip
cd ..

cp arm-trusted-firmware/build/mt7981/release/fip.bin mt7981.fip
cp arm-trusted-firmware/build/mt7981/release/bl2.img mt7981-bl2.img
mtk_uartboot  -s /dev/ttyUSB0 -a -p mt7981-ram-ddr3-bl2.bin -f mt7981.fip

MT7981>
setenv baudrate 115200
setenv bootdelay 5
setenv bootfile.bl2 mt7981-bl2.img
setenv bootfile.fip mt7981.fip
setenv bootmenu_0 Startup system (Default)=mtkboardboot
setenv bootmenu_1 Upgrade firmware=mtkupgrade fw
setenv bootmenu_2 Upgrade ATF BL2=mtkupgrade bl2
setenv bootmenu_3 Upgrade ATF FIP=mtkupgrade fip
setenv bootmenu_4   Upgrade ATF BL31 only=mtkupgrade bl31
setenv bootmenu_5   Upgrade bootloader only=mtkupgrade bl33
setenv bootmenu_6 Upgrade single image=mtkupgrade simg
setenv bootmenu_7 Load image=mtkload
setenv bootmenu_8 Start Web failsafe=httpd
setenv ethact ethernet@15100000
setenv ethaddr be:8f:0b:62:d1:c8
setenv ipaddr 192.168.1.112
setenv loadaddr 0x46000000
setenv mtdids nmbm0=nmbm0
setenv mtdparts nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),256k(bdinfo),2048k(fip),65536k(ubi)
setenv netmask 255.255.255.0
setenv serverip 192.168.1.88
setenv stderr serial@11002000
setenv stdin serial@11002000
setenv stdout serial@11002000
save

bootmenu -> Upgrade ATF BL2
bootmenu -> Upgrade ATF FIP

52

OMG it was really fun! Now it's working!
I wrote to cudy support and they send me the original DTS https://pastebin.com/ekAe6ZVp I'ts not different from the decompiled version from @zekica but it help me to got more perspective and make leds work properly adn add some gpio.

This issue https://github.com/openwrt/openwrt/issues/15093 put me in the right way to get link up and ethtool proper detection and later to get gmac1 working with it

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000                                                                          [0/91991]
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1504 qdisc mq state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet6 fe80::82af:caff:fe5f:2f8c/64 scope link
       valid_lft forever preferred_lft forever
3: wan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8d brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.207/24 brd 192.168.0.255 scope global wan
       valid_lft forever preferred_lft forever
    inet6 fddf:aaaa:aaaa:0:82af:caff:fe5f:2f8d/64 scope global noprefixroute
       valid_lft forever preferred_lft 604797sec
    inet6 fddf:aaaa:aaaa::93c/128 scope global dynamic noprefixroute
       valid_lft 43187sec preferred_lft 43187sec
    inet6 fe80::82af:caff:fe5f:2f8d/64 scope link
       valid_lft forever preferred_lft forever
4: lan1@lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
5: lan2@lan: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
6: lan3@lan: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
7: lan4@lan: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 80:af:ca:5f:2f:8c brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fddf:aaaa:aaaa:4::1/62 scope global dynamic noprefixroute
       valid_lft 43187sec preferred_lft 43187sec
    inet6 fd68:4664:fb75::1/60 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::82af:caff:fe5f:2f8c/64 scope link
       valid_lft forever preferred_lft forever
root@OpenWrt:~# ping google.es
PING google.es (142.250.185.3): 56 data bytes
64 bytes from 142.250.185.3: seq=0 ttl=118 time=10.309 ms

The DTS that work

&eth {
	pinctrl-names = "default";
	pinctrl-0 = <&mdio_pins>;

	status = "okay";

	gmac0: mac@0 {
		compatible = "mediatek,eth-mac";
		reg = <0>;
		phy-mode = "2500base-x";
		nvmem-cell-names = "mac-address";
		nvmem-cells = <&macaddr_bdinfo_de00 0>;
		label = "lan";

		fixed-link {
			speed = <2500>;
			full-duplex;
			pause;
		};
	};

	gmac1: mac@1 {
		compatible = "mediatek,eth-mac";
		reg = <1>;
		phy-mode = "2500base-x";
		phy-handle = <&phy6>;
		nvmem-cell-names = "mac-address";
		nvmem-cells = <&macaddr_bdinfo_de00 1>;
		label = "wan";
	};

};

&mdio_bus {
	switch: switch@1f {
		compatible = "mediatek,mt7531";
		reg = <31>;
		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
		interrupt-controller;
		#interrupt-cells = <1>;
		interrupt-parent = <&pio>;
		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
	};
	phy6: ethernet-phy@6 {
		compatible = "ethernet-phy-ieee802.3-c22"; // [RTL8221B-VB-CG 2.5Gbps PHY (C22)]
		reg = <6>;
		phy-mode = "2500base-x";
	};

};

&switch {
	ports {
		#address-cells = <1>;
		#size-cells = <0>;

		port@0 {
			reg = <0>;
			label = "lan1";
		};

		port@1 {
			reg = <1>;
			label = "lan2";
		};

		port@2 {
			reg = <2>;
			label = "lan3";
		};

		port@3 {
			reg = <3>;
			label = "lan4";
		};

		port@6 {
			reg = <6>;
			label = "cpu";
			ethernet = <&gmac0>;
			phy-mode = "2500base-x";

			fixed-link {
				speed = <2500>;
				full-duplex;
				pause;
			};
		};
	};
};
1 Like
53

Pull request sent to upstream https://github.com/openwrt/openwrt/pull/17458
Thanks to all, and happy new year.

3 Likes
54

I have a problem trying to do a sysupgrade, somehow is searching the wrong partition.

Could not open mtd device: firmware

root@wrt2:/tmp# sysupgrade -v openwrt-mediatek-filogic-cudy_wr3000h-v1-squashfs-
sysupgrade.bin
verifying sysupgrade tar file integrity
Fri Jan 10 19:13:39 CET 2025 upgrade: Saving config files...
etc/config
…
…

Fri Jan 10 19:13:40 CET 2025 upgrade: Commencing upgrade. Closing all shell sessions.
Fri Jan 10 19:13:40 CET 2025 upgrade: Commencing upgrade. Closing all shell sessions.
Hangup
-ash: can't set tty process group: Not a tty
[1]+  Hangup                     sysupgrade -v openwrt-mediatek-filogic-cudy_wr3000h-v1-squashfs-sysupgrade.bin
root@wrt2:/tmp# Watchdog handover: fd=3
- watchdog -
Watchdog does not have CARDRESET support
[ 9443.353255] mt798x-wmac 18000000.wifi phy0-ap0: left allmulticast mode
[ 9443.359848] mt798x-wmac 18000000.wifi phy0-ap0: left promiscuous mode
[ 9443.366436] br-lan: port 5(phy0-ap0) entered disabled state
[ 9443.454432] br-lan: port 7(phy1-mesh0) entered disabled state
Fri Jan 10 19:13:40 CET 2025 upgrade: Sending TERM to remaining processes ...
Fri Jan 10 19:13:40 CET 2025 upgrade: Sending signal TERM to hostapd (1514)
Fri Jan 10 19:13:40 CET 2025 upgrade: Sending signal TERM to wpa_supplicant (1515)
Fri Jan 10 19:13:40 CET 2025 upgrade: Sending signal TERM to hostapd (1563)
Fri Jan 10 19:13:40 CET 2025 upgrade: Sending signal TERM to wpa_supplicant (1566)
[ 9443.519557] br-lan: port 7(phy1-mesh0) entered blocking state
[ 9443.525341] br-lan: port 7(phy1-mesh0) entered forwarding state
[ 9443.565220] br-lan: port 7(phy1-mesh0) entered disabled state
[ 9443.603275] mt798x-wmac 18000000.wifi phy1-mesh0 (unregistering): left allmulticast mode
[ 9443.611367] mt798x-wmac 18000000.wifi phy1-mesh0 (unregistering): left promiscuous mode
[ 9443.619392] br-lan: port 7(phy1-mesh0) entered disabled state
[ 9443.932993] mt798x-wmac 18000000.wifi phy1-ap0: left allmulticast mode
[ 9443.939531] mt798x-wmac 18000000.wifi phy1-ap0: left promiscuous mode
[ 9443.946024] br-lan: port 6(phy1-ap0) entered disabled state
Fri Jan 10 19:13:44 CET 2025 upgrade: Sending KILL to remaining processes ...
[ 9453.643108] stage2 (4083): drop_caches: 3
Fri Jan 10 19:13:50 CET 2025 upgrade: Switching to ramdisk...
[ 9454.949710] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" stops
[ 9454.962658] UBIFS (ubi0:2): un-mount UBI device 0
Fri Jan 10 18:13:52 UTC 2025 upgrade: Performing system upgrade...
[ 9455.004252] do_stage2 (4083): drop_caches: 3
Could not open mtd device: firmware
Can't open device for writi[ 9455.016397] reboot: Restarting system
ng!
cat: write
REBOOT
55

Add a fix to make sysupgrade works ok with ubi partition in platform.sh

cudy,wr3000h-v1)
		CI_UBIPART="ubi"
		nand_do_upgrade "$1"
		;;
1 Like