Adding OpenWrt support for ZTE ZXHN F680 AC1750?

Hello
Fiber router of Jazztel, Virgin Telco, MasMóvil, Yoigo etc...
Good candidate, isn't it?

ZTE ZXHN F680 AC1750 Specs:

  • Wireless: 802.11a/b/g/n/ac. 2.4GHz/450Mbps. 5GHz/1300Mbps.
  • CPU & Ethernet: Marvell 88F6660-A0 dual core 800MHz/1GHz.
  • RAM: SKhynix H5TQ2G63FFA PBC 256MB.
  • Flash: Micron 29F1G08ABAEA 128MB.
  • Wireless 2.4GHz: Atheros AR9381-AL1A Wi-Fi N 3T3R 450Mbps.
  • Wireless Amplifier 2.4GHz: 3 x SiGe 2620T
  • Wireless 5GHz: Qualcomm QCA9880-BR4A Wi-Fi AC 3T3R 1300Mbps.
  • Wireless Amplifier 5GHz: 3x Skywords 5003L1

The 88F6660 is a Marvell Avanta-LP SoC, currently not supported in OpenWrt and kernel mainline. However there is some work in progress with Marvell Avanta SoCs in the Doozan forum, see:

Debian on Action Tech SG200 and MI424WR-rev-I

BTW Avanta and Avanta-LP might be totally different SoCs.

Does it come with a functional U-Boot?

Regards.

1 Like

Hi @danitool
I don't know, one of these days I'll open one to see if it has a serial port to see the boot. But what would be the importance of it being U-Boot, if that Marvell is not supported?

hi
Avanta = CPU: Feroceon 88FR131 ARMv5TE from its dtsi .
Avanta-LP cortex a9.

but 88F6660 and hole Avanta-LP is cast away from mainline and uboot.
plus no sources from zte .

it seems praticaly like ** armada375** minus some details.
fs is YAFFS2 .
no dtsi/fdt found .
here is some intersting :
NAND: 128 MiB
MMC: MRVL_MMC: 0
MTD_ENV=2
PCI-e 0: (bus 0) Root Complex Interface, Detected Link X1, GEN 1.1
PCI-e 1: (bus 1) Root Complex Interface, Detected Link X1, GEN 1.1

Board configuration:
EEPROM/Dip Switch: DIP-Switch
Ethernet Switch port 6 on MAC0 [CPU Port], 2G Speed
Ethernet Switch port 4 on MAC1, 1G Speed
4xGE-PHY Module on 4 Switch ports
PON ETH SERDES on P2P MAC
TDM/SLIC: TDM2C

SERDES configuration:
Lane #0: PCIe0
Lane #1: PCIe1
Lane #2: SATA-0
Lane #3: USB3
mvBoardLedMatrixInit---
Net: egiga0 [PRIME]

if you want boot log or adding info ask.

briz.br

1 Like

It uses U-boot for sure, but it might be crippled by ZTE. It is important if you wanted to test experimental Openwrt builds for this device (e.g using RAM firmwares).

Might be possible to build a very basic firmware using the target mvebu, using a dts only with the required stuff to be able to boot. That would be an start point.

anyne with more experience willing to take a look at:
https://gfiber.googlesource.com/uboot/armada/+/refs/heads/master/board/mv_ebu/alp/

Hi
This is the serial output:

> BootROM - 1.51
> Booting from NAND flash
> 
> General initialization - Version: 1.0.0
> High speed PHY - Version: 1.0.0 (COM-PHY-V20)
> USB2 UTMI PHY initialized succesfully
> USB2 UTMI PHY initialized succesfully
> High speed PHY - Ended Successfully
> 
> DDR3 Training Sequence - Ver 5.7.1
> 
> DDR3 Training Sequence - Run DDR3 at 533 Mhz
> 
> ########### LOG LEVEL 1 (D-UNIT SETUP)###########
> 
> Static D-UNIT Setup:
> 0x00001400 = 0x7B005040
> 0x00001404 = 0x36300820
> 0x00001408 = 0x33137772
> 0x0000140C = 0x384019D5
> 0x00001410 = 0x16000001
> 0x00001414 = 0x00000700
> 0x00001418 = 0x00000000
> 0x0000141C = 0x00000000
> 0x00001420 = 0x00000000
> 0x00001424 = 0x0060F3FF
> 0x00001428 = 0x000D6720
> 0x00001454 = 0x00000000
> 0x00001474 = 0x0000030C
> 0x0000142C = 0x028C50C3
> 0x0000147C = 0x0000B571
> 0x00001494 = 0x00330000
> 0x00001498 = 0x00000000
> 0x0000149C = 0x00000001
> 0x000014A0 = 0x00000001
> 0x000014A8 = 0x00000000
> 0x000014C0 = 0x19242DDB
> 0x000014C4 = 0x092424C9
> 0x000014C8 = 0x05142091
> 0x000014CC = 0xBD090008
> 0x000017C8 = 0x05140001
> 0x00001504 = 0x1FFFFFF1
> 0x00001520 = 0x0B4012C0
> 0x00001538 = 0x00000007
> 0x0000153C = 0x00000007
> 0x000015D0 = 0x00000630
> 0x000015D4 = 0x00000004
> 0x000015D8 = 0x00000408
> 0x000015DC = 0x00000000
> 0x000015E0 = 0x00000001
> 0x000015EC = 0xF8000025
> 0x00001700 = 0x20000000
> 0x00001704 = 0x0018C01E
> 0x00001708 = 0x0F7F007F
> 0x0000170C = 0x00000000
> 0x00001710 = 0x00FF3C1F
> 0x00020184 = 0x0FFFFFE0
> 0x00020180 = 0x00000000
> 0x0002018C = 0x0FFFFFE4
> 0x00020188 = 0x10000000
> 0x00020220 = 0x00000E0E
> DDR3 Training Sequence - Run without PBS.
> Cuurrent frequency is: 100MHz
> Cuurrent frequency is: 533MHz
> DDR3 - Write Leveling - Starting HW WL procedure
> DDR3 - Write Leveling - Write Leveling Cs - 0 Results:
> DDR3 - Write Leveling - PUP: 0, Phase: 0, Delay: 05
> DDR3 - Write Leveling - PUP: 1, Phase: 0, Delay: 05
> DDR3 - Write Leveling - HW WL Ended Successfully
> DDR3 - Read Leveling - Starting HW RL procedure
> DDR3 - Read Leveling - Results for CS - 0
> DDR3 - Read Leveling - PUP: 0, Phase: 2, Delay: 19
> DDR3 - Read Leveling - PUP: 1, Phase: 2, Delay: 18
> DDR3 - Read Leveling - Read Sample Delay: 07
> DDR3 - Read Leveling - Read Ready Delay: 0B
> DDR3 - Read Leveling - HW RL Ended Successfully
> DDR3 - Write Leveling Hi-Freq Supplement - Starting
> DDR3 - Write Leveling Hi-Freq Supplement - SW Override Enabled
> COUNT = 0
> DATA PUP:
> 04030201 08070605 0C0B0A09 100F0E0D
> 14131211 18171615 1C1B1A19 201F1E1D
> 24232221 28272625 2C2B2A29 302F2E2D
> 34333231 38373635 3C3B3A39 403F3E3D
> 44434241 48474645 4C4B4A49 504F4E4D
> 54535251 58575655 5C5B5A59 605F5E5D
> 64636261 68676665 6C6B6A69 706F6E6D
> 74737271 78777675 7C7B7A79 807F7E7D
> CS: 0 PUP: 0
> Actual Data = 21
> Expected Data = 21
> uiError = 00
> uiErrorN = 00
> 
> CS: 0 PUP: 1
> Actual Data = 22
> Expected Data = 22
> uiError = 00
> uiErrorN = 00
> COUNT = 1
> DATA PUP:
> 04030201 08070605 0C0B0A09 100F0E0D
> 14131211 18171615 1C1B1A19 201F1E1D
> 24232221 28272625 2C2B2A29 302F2E2D
> 34333231 38373635 3C3B3A39 403F3E3D
> 44434241 48474645 4C4B4A49 504F4E4D
> 54535251 58575655 5C5B5A59 605F5E5D
> 64636261 68676665 6C6B6A69 706F6E6D
> 74737271 78777675 7C7B7A79 807F7E7D
> CS: 0 PUP: 0
> Actual Data = 21
> Expected Data = 21
> uiError = 00
> uiErrorN = 00
> 
> CS: 0 PUP: 1
> Actual Data = 22
> Expected Data = 22
> uiError = 00
> uiErrorN = 00
> DDR3 - Write Leveling Hi-Freq Supplement - Ended Successfully
> 
> ########## LOG LEVEL 3(Windows margins per-DQ) ##########
> DDR3 - RX  CS: 0
> 
>  DATA RESULTS:
> 
> BYTE:0
>   DQ's        LOW       HIGH       WIN-SIZE
> ============================================
> DQ[ 0]     0x05       0x1C       0x18
> DQ[ 1]     0x05       0x1D       0x19
> DQ[ 2]     0x05       0x1D       0x19
> DQ[ 3]     0x05       0x1C       0x18
> DQ[ 4]     0x05       0x1C       0x18
> DQ[ 5]     0x05       0x1B       0x17
> DQ[ 6]     0x05       0x1D       0x19
> DQ[ 7]     0x05       0x1C       0x18
> 
> BYTE:1
>   DQ's        LOW       HIGH       WIN-SIZE
> ============================================
> DQ[ 8]     0x04       0x1E       0x1B
> DQ[ 9]     0x04       0x1E       0x1B
> DQ[10]     0x04       0x1E       0x1B
> DQ[11]     0x04       0x1E       0x1B
> DQ[12]     0x04       0x1E       0x1B
> DQ[13]     0x04       0x1E       0x1B
> DQ[14]     0x04       0x1E       0x1B
> DQ[15]     0x04       0x1E       0x1B
> 
> 
> ############ LOG LEVEL 2(Windows margins) ############
> DDR3 - DQS RX - Set Dqs Centralization Results - CS: 0
> 
> DQS    LOW     HIGH     WIN-SIZE      Set
> ==============================================
> 0     0x05      0x1B      0x16       0x10
> 1     0x04      0x1F      0x1B       0x11
> 
> ########## LOG LEVEL 3(Windows margins per-DQ) ##########
> DDR3 - TX  CS: 0
> 
>  DATA RESULTS:
> 
> BYTE:0
>   DQ's        LOW       HIGH       WIN-SIZE
> ============================================
> DQ[ 0]      0x00        0x19        0x19
> DQ[ 1]      0x00        0x19        0x19
> DQ[ 2]      0x00        0x19        0x19
> DQ[ 3]      0x00        0x19        0x19
> DQ[ 4]      0x00        0x19        0x19
> DQ[ 5]      0x00        0x19        0x19
> DQ[ 6]      0x00        0x19        0x19
> DQ[ 7]      0x00        0x19        0x19
> 
> BYTE:1
>   DQ's        LOW       HIGH       WIN-SIZE
> ============================================
> DQ[ 8]      0x00        0x1A        0x1A
> DQ[ 9]      0x00        0x1A        0x1A
> DQ[10]      0x00        0x1A        0x1A
> DQ[11]      0x00        0x1A        0x1A
> DQ[12]      0x00        0x1A        0x1A
> DQ[13]      0x00        0x1A        0x1A
> DQ[14]      0x00        0x1A        0x1A
> DQ[15]      0x00        0x1A        0x1A
> 
> 
> ############ LOG LEVEL 2(Windows margins) ############
> DDR3 - DQS TX - Set Dqs Centralization Results - CS: 0
> 
> DQS    LOW     HIGH     WIN-SIZE      Set
> ==============================================
> 0     0x00      0x19      0x19       0x0C
> 1     0x00      0x1A      0x1A       0x0D
> DDR3 Training Sequence - Ended Successfully
> BootROM: Image checksum verification PASSED
> 
> 
> U-Boot 2013.01 (Jun 16 2016 - 14:23:08)
> 
> Board: zte-88F6660
> SoC:   MV88F6660 Rev A0
>        running 2 CPUs
> CPU:   ARM Cortex A9 MPCore (Rev 1) LE
>        CPU 0
>        CPU    @ 800 [MHz]
>        L2     @ 400 [MHz]
>        TClock @ 200 [MHz]
>        DDR    @ 534 [MHz]
>        DDR 16Bit Width, FastPath Memory Access, DLB Enabled
> DRAM:  256 MiB
> 
> Map:   Code:            0x0fbf8000:0x0fcb023c
>        BSS:             0x0fcef920
>        Stack:           0x0f6f7f20
>        Heap:            0x0f6f8000:0x0fbf8000
> 
> NAND:  128 MiB
> MMC:   MRVL_MMC: 0
> MTD_ENV=2
> PCI-e 0: (bus 0) Root Complex Interface, Detected Link X1, GEN 1.1
> PCI-e 1: (bus 1) Root Complex Interface, Detected Link X1, GEN 1.1
> 
> Board configuration:
>         EEPROM/Dip Switch: DIP-Switch
>         Ethernet Switch port 6 on MAC0 [CPU Port], 2G Speed
>         Ethernet Switch port 4 on MAC1, 1G Speed
>         4xGE-PHY Module on 4 Switch ports
>         PON ETH SERDES on P2P MAC
>         TDM/SLIC: TDM2C
> 
> SERDES configuration:
>         Lane #0: PCIe0
>         Lane #1: PCIe1
>         Lane #2: SATA-0
>         Lane #3: USB3
> mvBoardLedMatrixInit---
> Net:   egiga0 [PRIME]
> Hit any key to stop autoboot:  0
> =>
> => ?
> ?       - alias for 'help'
> SatR    - Sample At Reset sub-system
> 
> active_units- print active units on board
> amp_boot- amp_boot - boot an AMP group
> 
> amp_config- Fully config an AMP group
> 
> amp_printenv- amp_printenv - print only AMP env variables
> 
> amp_verify- Verfiy AMP configuration
> 
> base    - print or set address offset
> bdinfo  - print Board Info structure
> boardConfig- Board Configuration sub-system
> boot    - boot default, i.e., run 'bootcmd'
> bootd   - boot default, i.e., run 'bootcmd'
> bootelf - Boot from an ELF image in memory
> bootm   - boot application image from memory
> bootp   - boot image via network using BOOTP/TFTP protocol
> bootvx  - Boot vxWorks from an ELF image
> bubt    - bubt  - Burn an image on the Boot Nand Flash.
> 
> chpart  - change active partition
> cmp     - memory compare
> coninfo - print console devices and information
> cp      - memory copy
> crc32   - checksum calculation
> date    - get/set/reset date & time
> ddrPhyRead- ddrPhyRead - Read DDR PHY register
> 
> ddrPhyWrite- ddrPhyWrite - Write DDR PHY register
> 
> dhcp    - boot image via network using DHCP/TFTP protocol
> dma     - dma   - Perform DMA using the XOR engine
> 
> downver - upgrade software version from TFTP server
> echo    - echo args to console
> editenv - edit environment variable
> eeprom  - EEPROM sub-system
> env     - environment handling commands
> ext2load- load binary file from a Ext2 filesystem
> ext2ls  - list files in a directory (default /)
> ext4load- load binary file from a Ext4 filesystem
> ext4ls  - list files in a directory (default /)
> ext4write- create a file in the root directory
> fatinfo - print information about filesystem
> fatload - load binary file from a dos filesystem
> fatls   - list files in a directory (default /)
> fsinfo  - print information about filesystems
> fsload  - load binary file from a filesystem image
> go      - start application at address 'addr'
> help    - print command description/usage
> i2c     - I2C sub-system
> iminfo  - print header information for application image
> imxtract- extract a part of a multi-image
> ir      - ir    - reading and changing MV internal register values.
> 
> itest   - return true/false on integer compare
> loadb   - load binary file over serial line (kermit mode)
> loads   - load S-Record file over serial line
> loadx   - load binary file over serial line (xmodem mode)
> loady   - load binary file over serial line (ymodem mode)
> loop    - infinite loop on address range
> ls      - list files in a directory (default /)
> map     - map   - Display address decode windows
> 
> md      - memory display
> me      - me    - PCIe master enable
> 
> mm      - memory modify (auto-incrementing address)
> mmc     - MMC sub system
> mmcinfo - display MMC info
> mp      - mp    - map PCIe BAR
> 
> mtddebug- mtddebug operate
> mtdparts- define flash/nand partitions
> mtest   - simple RAM read/write test
> mw      - memory write (fill)
> nand    - NAND sub-system
> nboot   - boot from NAND device
> nfs     - boot image via network using NFS protocol
> nm      - memory modify (constant address)
> pci     - list and access PCI Configuration Space
> pciePhyRead- phyRead    - Read PCI-E Phy register
> 
> pciePhyWrite- pciePhyWrite      - Write PCI-E Phy register
> 
> phyRead - phyRead       - Read Phy register
> 
> phyWrite- phyWrite      - Write Phy register
> 
> ping    - send ICMP ECHO_REQUEST to network host
> printenv- print environment variables
> rcvr    - rcvr  - Start recovery process (with TFTP server)
> 
> reset   - Perform RESET of the CPU
> resetenv- resetenv      - Erase environment sector to reset all variables to default.
> 
> run     - run commands in an environment variable
> saveenv - save environment variables to persistent storage
> se      - se    - PCIe Slave enable
> 
> setenv  - set environment variables
> sg      - sg    - scanning the PHYs status
> 
> sleep   - delay execution for some time
> source  - run script from memory
> sp      - scan and detect all devices on PCI-e interface
> switchCountersRead- switchCntPrint      - Read switch port counters.
> 
> switchPhyRegRead- - Read switch register
> 
> switchPhyRegWrite- - Write switch register
> 
> switchRegRead- switchRegRead    - Read switch register
> 
> switchRegWrite- switchRegWrite  - Write switch register
> 
> temp    - temp  - Display the device temperature.
> 
> tempCmd0- tempCmd - This command allocated for monitor extinction
> 
> tempCmd1- tempCmd - This command allocated for monitor extinction
> 
> tempCmd2- tempCmd - This command allocated for monitor extinction
> 
> tempCmd3- tempCmd - This command allocated for monitor extinction
> 
> tftpboot- boot image via network using TFTP protocol
> training- training      - prints the results of the DDR3 Training.
> 
> ts_report- ts_report    - report touch screen coordinate
> 
> ts_test - ts_test       - test touch screen
> 
> ubi     - ubi commands
> ubifsload- load file from an UBIFS filesystem
> ubifsls - list files in a directory
> ubifsmount- mount UBIFS volume
> ubifsumount- unmount UBIFS volume
> version - print monitor, compiler and linker version
> whoAmI  - - reading CPU ID
> 
> =>

Nice, looks like the tftpboot command is available, then you should be able to run RAM firmwares.

Yes but ...
Who can compile a valid firmware for this router? I do not have enough knowledge, the only thing I can do is the necessary tests.

what toolchain ?
what target?
need a base dtsi or fdt ?
introduce new platform/family (avanta_lp = 6660 ,6650 ,6601) or ....?

@briz your questions are chinese for me... sorry.
Are you talking about something like this?

yes .
toolchain ?

=> whoAmI
cpu #: 0=> version

U-Boot 2013.01 (Jun 16 2016 - 14:23:08)
arm-marvell-linux-uclibcgnueabi-gcc (Linaro GCC branch-4.6.4. Marvell GCC 201301-1645.aee66e26) 4.6.4 20120731 (prerelease)
GNU ld (Linaro GCC branch-4.6.4. Marvell GCC 201301-1645.aee66e26) 2.22.0.20120801

to my understanding , to make linux firmware image you need a toolchain (openwrt or original Marvell GCC) and target.
target is Board: zte-88F6660 wich is part of alp(family:avanta_lp) ;wich include(SOC : 88f6660 ,88f6650 ,88f6610); part of marvell EBU.
target hardware description file is dts witch include dtsi wich is soc hardware description file.
to make it clear :
2 files :dtsi +dts are feed to toolchain result in firmware.
its possible to use those of armada a375 a38x and edit them ??
the nearist source code i can find(detail soc attributs) is in previous link.
but maybe this board is post using device tree(dt) or fdt (flat device tree).
anyway will need creat some patches to add support to this family/soc/board to openwrt.
br

Thanks @briz and thanks @danitool
I see that all the components involved have to fit together like a puzzle, and I don't have the knowledge to carry it out, as I said before. At this point, I can only help by testing, but someone else has to be the one to compile the test firmwares. It is a pity because the router is very worth it.

i may say this zte is better than average crap used in my country.
plus there is a minipcie connector inside.
and Ethernet Switch port 6 on MAC0 [CPU Port], 2G Speed.

I'm 8086k from doozan. As far as I know, ZTE zxhn F660 is using Marvell 88f6560 SoC which is an ARM9 single core CPU. I do some work on the kernel for MI424WR rev i to make it support F660. Now only PCI-E is not working. It seemed like ZTE have done something to the uboot. I have uploaded the project to github.

I am also interested in this device.

ZTE ZXHN F680 is not the same as ZTE ZXHN F660, but they are very similar and it could work. The only similar firmware I found was that of the Turris Omnia, so I loaded it into memory and started it, but it didn't work. If you or someone in the forum has the knowledge to compile a firmware for the ZTE ZXHN F680, I will be a beta tester with pleasure.

The work is much more than just compile it. I would like to see the whole bootlog of it. To create a DTS for 88f6660 is a extremely hard challenge. I guess ZTE doesn't provide the GPL code for this device either. But if the stock firmware uses newer kernel versions, this will be possible.