Adding OpenWrt support for Zyxel EX5601-T0

For Developers
325

@walterav, Thank you for your helpful comment.

I've come to the conclusion that my serial to usb device is faulty. It became really hot after connecting it, so I trashed it.

As you were saying, the CH341 programmer would've been a very nice candidate, if it wasn't using 5v. So I've modified mine too.

I've connected it to my Windows PC and Mac, and they both ran fine. :slight_smile:

I've added some documentation for future reference, which might help future hobbyists to upgrade their Zyxel EX5601-T0/T1 to a firmware that's actually able to fit their needs. It's not to replace previous documentation, it's only an addition. :slight_smile:

Note: First of all, be sure to only gather OpenWRT files from the same OpenWRT version.

  • connect RJ45 cable between 1gbit port of EX5601-T0/T1
  • Set computer IP to 192.168.1.254/255.255.255.0

preparation mtk_uartboot

Note: Make sure you allow port 69 and/or the application in the firewall rules, or disable the firewall temporarily.
Note2: Make sure you test the TFTP service with a TFTP client, to make sure the service actually works (you'll thank me later)

Gathering files

Create a new folder with the following files:

  • zyxel_ex5601-t0-ubootmod-bl31-uboot.fip
  • zyxel_ex5601-t0-ubootmod-initramfs-factory.ubi
  • zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
  • zyxel_ex5601-t0-ubootmod-preloader.bin
  • zyxel_ex5601-t0-ubootmod-squashfs-sysupgrade.itb

You can find these files here:

And:

Once downloaded, rename all the filenames by removing the version number (example: openwrt-mediatek-filogic*-ubootmod-initramfs-recovery.itb)

Connecting the Serial/uart to router:

  • Pin 1 (3.3v) on router - no need to connect

  • Pin 2 (Tx) on router goes to Rx on your Serial device

  • Pin 3 (Rx) on router goes to Tx on your Serial device

  • Pin 4 (notch) on router

  • Pin 5 (gnd) on router goes to ground on your Serial device

  • rename openwrt-23.05.4-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip to openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip

  • Put bl2-mt7986-ddr4-ram.bin and openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip inside the same directory as mtk_uartboot(.exe)

  • Run mtk_uartboot.exe --serial COM6 --aarch64 -p bl2-mt7986-ddr4-ram.bin -f openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip

Note: COM6 is the name my serial device has under Windows, /dev/tty.wchusbserial14310 was the device name under MacOS and /dev/ttyUSB0 under Debian. These device names might be different for you.

You should see the message "Handshake...", after which you can power on the EX5601-T0/T1

Now mtk_uartboot should be able to push the files (payload) from its root directory to the router. The pushed bootloader will be started on the router.

Using serial port: COM6
Handshake...
hw code: 0x7986
hw sub code: 0x8a00
hw ver: 0xca01
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0xeefd
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:14, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0x101369 @ 0x40400000 ...
==================================

After this, it should bring you back to the prompt

Serial connection - baud rate 115200

  • Now you need to connect to the router via the serial interface, using a terminal (screen/putty/minicom/etc).
    • If the file hasn't been found yet:
    • You might want to check if the local firewall has actually been disabled,
    • Also check if the filename openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb has correctly been set.

Note: The bootloader will retry until you've fixed it:

Loading: *
TFTP error: 'File not found' (1)
Not retrying...
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb'.
Load address: 0x46000000

You'll be able to see if it's booting the openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb file over TFTP

Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################################
         2.8 MiB/s
done
Bytes transferred = 7301992 (6f6b68 hex)
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.162
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    3779836 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   b736c825
     Hash algo:    sha1
     Hash value:   2fc05ba58e3317134cc541a2cd331f7e54ae5060
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-ubootmod initrd
     Type:         RAMDisk Image
     Compression:  uncompressed
     Data Start:   0x4639af2c
     Data Size:    3495464 Bytes = 3.3 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   ba5afe98
     Hash algo:    sha1
     Hash value:   a8eb27d4ca1d75d96edcba7defd0bccc038f89fb
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-ubootmod device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x466f0668
     Data Size:    24510 Bytes = 23.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   d42eebfd
     Hash algo:    sha1
     Hash value:   4055351dc417adf07e5c178392e57f52660d9921
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x466f0668
Working FDT set to 466f0668
   Uncompressing Kernel Image to 48000000
   Loading Ramdisk to 7e4a2000, end 7e7f7628 ... OK
   Loading Device Tree to 000000007e499000, end 000000007e4a1fbd ... OK
Working FDT set to 7e499000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS

Starting kernel ...

It is booting from RAM now. :slight_smile:

Once it's done booting the openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb image, you'll be able to connect via SSH, web and SCP.

I also recommend scp for copying the files to the /tmp dir on the router:

Navigate to the folder with the previously downloaded files
scp ./* root@192.168.1.1:/tmp

You should be seeing this via terminal, after copying:

root@OpenWrt:/tmp# ls
TZ
dhcp.leases
dnsmasq.d
etc
hosts
kmod-mtd-rw_5.15.162+git-20160214-2_aarch64_cortex-a53.ipk
lib
lock
log
luci-indexcache.bf4fbbcc.json
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-factory.ubi
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-preloader.bin
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-squashfs-sysupgrade.itb
resolv.conf
resolv.conf.d
run
shm
state
sysinfo
tmp

From this point, we'll be able to start installing OpenWRT onto the flash.

I found @bezeria 's post (Adding OpenWrt support for Zyxel EX5601-T0 - #305 by bezeria) very helpful.

4 Likes