Adding OpenWrt support for Zyxel EX5601-T0

[wirl]

Oh trust me I've read that haha, check out my issues if you're curious what I tried. Too much to repeat here lol

If I was doing something wrong then it would also happen on any other router I try but it only happens on the Zyxel. The others are fine, just not on par with the Zyxel for the rest of the specs. It's why I'm upgrading. More processing power, storage and ram.

There seems to be an issue in the mt7x drivers for many people regarding tx rates and tx power on these all very similar chipsets. I hope it will be fixed eventually.

[Underworld]

Sorry to question that. I have read your issues, hence I was questioning the WDS.
I had issue with my Belkin RT3200 as a WDS client and Zyxel as AP, and recently resolved it by selling the Belkin router However WDS between Zyxel and Cudy WR3000 is working ok, and now same with 2 Zyxels. You may be right about issues with mt76, but it seems they do not affect filogic. You may try new snapshots as I saw changes in wifi-script.
Kind regards
K

[wirl]

Ohh, new scripts. Interesting, thanks for the tip! I'll sync up and rebuild. Can't harm to try. They also merged a nice speed bump for the internal storage recently. Now running at stock Zyxel firmware speeds (twice as fast as it was before).

I did some testing with the wds-client mode, no idea what's different but getting the same results. This is the connection idle:

Then once I start iperf3 or speedtest-go tx goes like this and speeds are seldom above 100mbit/s:

I would love to see what's going on at driver level when it goes all the back down to 6mbit/s and 20mhz channel width. Will hunt for debug flags in the mt7x driver now that I'm recompiling to get the updated wifi scripts.

Thanks again!

[syncVince]

Hello everyone!

I bought this router just yesterday and I'm waiting for it to arrive. In the meantime, I've been reading through some forums to get a better idea of what to do once it's here.
Since I got it from that one NL store, I'm guessing it's gonna be branded Odido (T1). I was wondering if I can still follow the guide over on hack-gpon even though it only mentions the T0 model.

My goal is to flash OpenWRT on the first partition so that I can tinker with it whenever I want, but also install the stock, unbranded firmware on the second partition, which would be used most of the time because I need the VoIP.
I was also wondering if I have to flash the modded firmware linked on the hack-gpon page (V5.70(ACDZ.0)C0) or if I can go with a newer one (like 5.70(ACDZ.3.6)C0), even if that means missing Wireguard, OpenVPN, etc. (I'm fine with that).

That's it. Let me know if I'm posting in the right place or not...
Thanks.

[thehybrid1337]

I don't use VoIP personally but for me everything seems to be working on the version 3.6, I don't see VoIP any reason why that wouldn't be working.
Which firmware you're going to be using is your own choice. I have switched between multiple versions a few times to try them out because in version 3.6 the commands, fwidcheck off and modelcheck off looks like it doesn't matter and i can't flash different firmware. ( in router web page ). Flashing through u-boot console works sitll.

The hack GPON one won't work i think since your zloader will be locked with a pass.

I think using mtk_uartboot to boot an uboot fip. and from that u-boot console you boot openwrt stock initramfs kernel after booting it enter the command : fw_setenv EngDebugFlag 0x1 . i think this should fix your problem. and remove the locked zloader and will allow you to follow further the HACK GPON guide if wanted

[thehybrid1337]

Multi-booting OpenWRT & Zyxel OEM firmware

• I'm posting this just in case so everyone knows how to make it work.
• The how-to instructions that i will be posting here is my own personal method, it's probably not the best or fastest way to flash OpenWRT.
• Try this at your own risk, I am a newbie when it comes to any of this, If you check my previous posts you will see i clearly had no idea what i was doing most of the time and just recently gained some knowledge.
• If anyone has tips for me i'd appreciate it.

This will be part 2 and a continuation of my previous post Adding OpenWrt support for Zyxel EX5601-T0 - #678 by thehybrid1337.
Anyone should still be able to follow even if you didn't use the instructions on part 1.

Most important is :
In my previous post i successfully flashed V570ACDZ36C0.bin using mtkupgrade.
Note : At this moment this is the only firmware on my device, since i had used ubiformat mtd5.mtd6.,mtd7. This means that switching boot partitions will do nothing becaus the other boot partition is empty.

To confirm which ubi partition is being used now enter the following command

cat /proc/cmdline

In my case it is rootubi=ubi so we have to move this firmware to ubi2 and after that flash openwrt on ubi.

If rootubi=ubi here then follow instructions
If rootubi=ubi2 then skip to the part that's about preparing OpenWrt firmware

Screenshot rootubi=ubi

To solve this problem i just Flash the same V570ACDZ36C0.bin again, but this time through the router firmware upgrade page. If you flash firmware through the router page, it automatically writes it to the alternative partition. This is exactly what we want because we cant to keep the 1st ubi partition available to flash OpenWrt on it.

Before flashing the firmware, make sure to enter these 2 commands first there won't be any issues.

zycli fwidcheck off
zycli modelcheck off

After your have flashed the same firmware ( or different maybe ). After the reboot type the following in the serial console or SSH terminal

cat /proc/cmdline

instead of rootubi=ubi, it should print out rootubi=ubi2 now.

Screenshot Rootubi=ubi2

This means we are ready to flash OpenWRT on the other partition.

Preparing the OpenWRT firmware.

If you don't want to bother doing this part yourself, there will be a ready to flash firmware on the end of the post.

If you want to do this part yourself.

We can download the 'sysupgrade' for zyxel ex5601-t0 with the stock layout on the OpenWrt website.
To be able to be compatible to multi-boot with Zyxel's firmware, we need to add 'zyfwinfo' to this sysupgrade we just downloaded.
This is required because 'zloader' checks for this in the firmware and won't boot without it if it fails checksum..
'zyfwinfo' is nothing too crazy or difficult but i found a generator on github with instructions making this proces a lot easier. Thanks @skyscreaper pameruoso/OpenWRT-Zyxel-EX5601-T0: Porting openwrt to Zyxel-EX5601-T0

The only file you'll need is gen_zyfwinfo.sh unless you have an sfp port as WAN.

Make a new folder and move the sysupgrade you've downloaded from the OpenWrt website there, in my case it's 'openwrt-24.10.0-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin'

Run gen_zyfwinfo.sh to generate a zyfwinfo file.

Make another folder in here called "sysupgrade-zyxel_ex5601-t0-stock"
place file 'zyfwinfo' that you've generated . in folder called "sysupgrade-zyxel_ex5601-t0-stock"

Screenshot folder structure

Run the following command to include the zyfwinfo in the firmware.

tar -rf openwrt-24.10.0-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin sysupgrade-zyxel_ex5601-t0-stock

The sysupgrade file is now compatible.

openwrt-24.10.0-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin

I've already made the above one compatible and can confirm it works.

Flashing OpenWRT to Ubi

Restart your router and stop the autoboot.

If you are greeted with (bootflag 1)

> Current bootflag is 1

BOARD_DETECT_BY_GPIO=>result=2
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 9/7, WL threshold: 4096, image sequence number: 138894891
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7fb47690, size 0x100 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
Multiboot clinent version: 2.7

Hit any key to stop autoboot:  5
ZHAL>

It means you are on ubi2 and have to switch partitions first before flashing OpenWRT
Enter the following commands to switch partititon

ATBT 1
ATSW

After this a reboot is required to switch the partitions so

ATSR 

Above command will work, power cycling the router will also work.

Stop the autoboot and this time you will be greeted with ( bootflag 0 )

> Current bootflag is 0

BOARD_DETECT_BY_GPIO=>result=2
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 13/8, WL threshold: 4096, image sequence number: 1309732647
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7fb47690, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
Multiboot clinent version: 2.7

This means we are on the correct partition and ready to flash OpenWRT on it.

I will be using mtkupgrade to flash the firmware via the u-boot console.
To be able to get to U-boot Console.

Enter the following command and stop autoboot.

ATGU

ZHAL> prompt yet again but just repeat the same command.

ATGU

There should be MT796> Prompt.

I will flash the firmware by TFTP like i had done previously before.

Screenshot mtkupgrade

mtkupgrade
2 - Firmware
Run image after upgrading? : Yes
0 - TFTP Client
U_Boots ip:192.168.1.1
TFTP servers ip :192.168.1.254
Subnetmask : 255.255.255.0
file name : openwrt-24.10.0-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin 

If it sucessfully boots up without any zyfwinfo errors and
cat/proc/cmdline showing rootubi=ubi.

Sucessfully flashed OpenWRT on ubi and Zyxel OEM on ubi2.

[skyscreaper]

@thehybrid1337

Thanks to whoever this is,(probably someone active here ) pameruoso/OpenWRT-Zyxel-EX5601-T0: Porting openwrt to Zyxel-EX5601-T0

The only file you'll need is gen_zyfwinfo.sh unless you have an sfp port as WAN.

That is me

[thehybrid1337]

Returning to Odido ISP firmware. (completely stock)

I've decided not to change anything in the Odido firmware and leave it stock.

Thank you very much @lytr for the Odido Firmware files.

t-56.zip

So I didn't make any adjustments to this firmware. If you flash it, the supervisor password will change, you don't have SSH/serial console access.. and the rest as we all know it already.

This is just to prevent Odido from being able to send us an invoice because of a faulty router we've returned, and by faulty i mean different firmware.
In case if you have to return the router back to Odido or if a technician comes to change something on the router you could flash this on one of the partitions.

I assume Odido themselves have also experienced routers that were returned with the wrong firmware on it. So i hope this can also be useful to them.

This doesn't need to be flashed from stock initramfs kernel, though i think it will be less risky. Especially since if you're not on OpenWRT but zyxel's firmware, the partition's are confusing since they get shifted.
In my case, i have Openwrt on Ubi and will flash the odido firmware on Ubi2.

I installed kmod-mtd-rw through the web interface of OpenWRT. You can either do that or download it from kmod-mtd-rw_6.6.73.2021.02.28~e8776739-r1_aarch64_cortex-a53.ipk
You only need the mtd5 files if you are already on stock partition layout..
copy following files to /tmp/

mtd5_kernel
mtd5_rootfs
mtd5_zydefault
mtd5_zyfwinfo

if you downloaded the kmod mtd-rw with the direct link instead of openwrt package installer

Place the following file also in /tmp/

kmod-mtd-rw_6.6.73.2021.02.28~e8776739-r1_aarch64_cortex-a53.ipk 

and run following command after you place the kmod

opkg install /tmp/kmod-mtd-rw_6.6.73.2021.02.28~e8776739-r1_aarch64_cortex-a53.ipk 

Since OpenWrt is running on ubi partition for me which is mtd5, we will have to flash the odido firmware on mtd6/ubi2.

To make the MTD Devices rewritable first we have to enable the kmod.

insmod mtd-rw.ko i_want_a_brick=1

If this is sucessful we continue with flashing.

ubiformat /dev/mtd6
ubiattach -p /dev/mtd6
ubimkvol /dev/ubi1 -n 0 -N kernel -s 3787688
ubimkvol /dev/ubi1 -n 1 -N rootfs -s 42688KiB
ubimkvol /dev/ubi1 -n 2 -N zyfwinfo -s 256
ubimkvol /dev/ubi1 -n 3 -N zydefault -s 55558
ubimkvol /dev/ubi1 -n 4 -N rootfs_data -m
ubiupdatevol /dev/ubi1_0 /tmp/mtd5_kernel
ubiupdatevol /dev/ubi1_1 /tmp/mtd5_rootfs
ubiupdatevol /dev/ubi1_2 /tmp/mtd5_zyfwinfo
ubiupdatevol /dev/ubi1_3 /tmp/mtd5_zydefault

ubidetach -p /dev/mtd6

Your console output should be similair to this :

root@ZyxelWRT:~# insmod mtd-rw.ko i_want_a_brick=1
[ 5952.674410] mtd-rw: mtd0: setting writeable flag
[ 5952.679057] mtd-rw: mtd2: setting writeable flag
[ 5952.683656] mtd-rw: mtd3: setting writeable flag
[ 5952.688417] mtd-rw: mtd4: setting writeable flag
[ 5952.693017] mtd-rw: mtd6: setting writeable flag
root@ZyxelWRT:~# ubiformat /dev/mtd6
ubiformat: mtd6 (nand), size 67108864 bytes (64.0 MiB), 256 eraseblocks of 262144 bytes (256.0 KiB), min. I/O size 4096 bytes
libscan: scanning eraseblock 255 -- 100 % complete  
ubiformat: 256 eraseblocks have valid erase counter, mean value is 7
ubiformat: formatting eraseblock 255 -- 100 % complete  
root@ZyxelWRT:~# ubiattach -p /dev/mtd6
[ 6039.378226] ubi1: default fastmap pool size: 10
[ 6039.382756] ubi1: default fastmap WL pool size: 5
[ 6039.387465] ubi1: attaching mtd6
[ 6039.891751] ubi1: scanning is finished
[ 6039.907782] ubi1: attached mtd6 (name "ubi2", size 64 MiB)
[ 6039.913265] ubi1: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
[ 6039.920132] ubi1: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
[ 6039.926904] ubi1: VID header offset: 4096 (aligned 4096), data offset: 8192
[ 6039.933844] ubi1: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
[ 6039.939833] ubi1: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 6039.947036] ubi1: max/mean erase counter: 10/8, WL threshold: 4096, image sequence number: 905460429
[ 6039.956149] ubi1: available PEBs: 212, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 38
[ 6039.965442] ubi1: background thread "ubi_bgt1d" started, PID 7688
UBI device number 1, total 256 LEBs (65011712 bytes, 62.0 MiB), available 212 LEBs (53837824 bytes, 51.3 MiB), LEB size 253952 bytes (248.0 KiB)
root@ZyxelWRT:~# ubimkvol /dev/ubi1 -n 0 -N kernel -s 3787688
Volume ID 0, size 15 LEBs (3809280 bytes, 3.6 MiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "kernel", alignment 1
root@ZyxelWRT:~# ubimkvol /dev/ubi1 -n 1 -N rootfs -s 42688KiB
[ 6277.366088] block ubiblock1_1: created from ubi1:1(rootfs)
Volume ID 1, size 173 LEBs (43933696 bytes, 41.8 MiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "rootfs", alignment 1
root@ZyxelWRT:~# ubimkvol /dev/ubi1 -n 2 -N zyfwinfo -s 256
Volume ID 2, size 1 LEBs (253952 bytes, 248.0 KiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "zyfwinfo", alignment 1
root@ZyxelWRT:~# ubimkvol /dev/ubi1 -n 3 -N zydefault -s 55558
Volume ID 3, size 1 LEBs (253952 bytes, 248.0 KiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "zydefault", alignment 1
root@ZyxelWRT:~# ubimkvol /dev/ubi1 -n 4 -N rootfs_data -m
Set volume size to 5586944
Volume ID 4, size 22 LEBs (5586944 bytes, 5.3 MiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "rootfs_data", alignment 1
root@ZyxelWRT:~# ubiupdatevol /dev/ubi1_0 /tmp/mtd5_kernel
root@ZyxelWRT:~# ubiupdatevol /dev/ubi1_1 /tmp/mtd5_rootfs
root@ZyxelWRT:~# ubiupdatevol /dev/ubi1_2 /tmp/mtd5_zyfwinfo
root@ZyxelWRT:~# ubiupdatevol /dev/ubi1_3 /tmp/mtd5_zydefault
root@ZyxelWRT:~# ubidetach -p /dev/mtd6
[ 6329.364959] block ubiblock1_1: released
[ 6329.368838] ubi1: detaching mtd6
[ 6329.372606] ubi1: mtd6 is detached
root@ZyxelWRT:~# reboot

It should be successful.
If you want to test it just change the boot partition in zloader.
You can still return to OpenWRT (or other firmware on other partition) by stopping autoboot and changing the boot partition again.

I confirmed it's successfull by changing partitions and entering ATSH command

ZHAL> ATSH
Firmware Version       : V5.70(ACEA.0)T56C_b7_1006
Bootbase Version       : V2.3 | 07/21/2022 10:17:53
Vendor Name            : ZYXEL Communication Corp
Product Model          : EX5601-T1
Serial Number          : 
First MAC Address      : 
Last MAC Address       : 
MAC Address Quantity   : 11
Default Country Code   : 00
Boot Module Debug Flag : 01
RootFS      Checksum   : 0000888c
Kernel      Checksum   : 00006298
Main Feature Bits      : 00
Other Feature Bits     : 
41e23410: 040a000b ffffffff 00000000 00000000
41e23420: ffffffff ffffffff ffffffff
ZHAL>

After booting into this firmware you have to factory reset to return to Odido settings.

EDIT: corrected ubi2 to ubi1
mtd5=ubi0
mtd6=ubi1

[thehybrid1337]

I think i've documented every possible firmware flash ( except ubootmod ) . I hope it doesn't get lost here and maybe someone if they have the time can make it simpler and add it to wiki?

Since now there only seems to be instructions for ubootmod.

I will take a break from OpenWRT for now, I feel like it's going to start get boring for me soon and since i believe i have learned as much as possible without making myself overwhelmed or extremely bored from it i'm happy.

My life consists of just eternally sidequesting, so on to the next random subject i go.

Bye all.

Edit: i actually have one unfinished project that i had set as a goal for myself, I'm going to finish it and post it here first before throwing the router in a dumpster since i can not use it as a wireless access point for my home router since it's got issues as a WAP i've read.

[wirl]

I’m curious if you could reproduce it or not, have you had any time to try?

Thank you.

[Thomas5401]

This is to let you know that Odido has started rolling out new firmware to their T-56's (b10_0122_m). It contains the new BL2, FIP and Zloader, but not the other changes I mentioned in my previous post. This means that mtk_uartboot no longer works. However, since the root password is still obtainable and others have posted back-ups of these and the firmware, it's still possible to go back to the previous versions. This is also a good opportunity to find another way in, with the other upcoming changes in mind. I'm afraid that's way beyond my powers, but perhaps someone else can help here. If so, I'd advise you to back-up everything as described above and connect the T-56 normally, allowing Odido to send you the new firmware. This usually happens overnight in incremental batches over the course of a week, so it might take some time before it's your turn. Bear in mind that BL2, FIP and Zloader are replaced on the first run of the new firmware, so you're still on the old ones after the router reboots for the update. If there's anything I can do (without getting Odido on my back), let me know.

[Dante]

Is it also shipping on new devices or do they always come with the same factory firmware?

[Thomas5401]

As far as I know, the devices that are currently sent out still have b7 firmware. It's possible they will come with b10 pre-installed in the future, but not before they've run out of their current stock.

[skyscreaper]

I think mtkuartboot works at lower level than bl2. Tbh I am not sure if this update will block mtkuartboot

[Dante]

mtk_uartboot's usage says:

-f, --fip <FIP>
          Path to an FIP payload. Use this to start an FIP using MTK BL2 built with UART download support

So I'm guessing Odido/Zyxel can disable this functionality in BL2.

[skyscreaper]

But you can pass a bl2 too … ./mtk_uartboot -p bl2.bin --aarch64 -f bl31-uboot.fip

I m curious to see what will be the result

[thehybrid1337]

I will contact odido today and request them to update mine. I will keep everyone updated.

[Thomas5401]

When I follow the instructions from the wiki, nothing happens when it says "Handshake...". Perhaps I should have been more careful when I said that mtk_uartboot no longer works. What I meant was that if you follow the instructions as they are now, it doesn't work anymore if you're on the new firmware. Hopefully, it will only take a little tweak to make it work again, but it could also be more complicated. I can't tell how difficult it's going to be.

[thehybrid1337]

Honestly, i'm excited to read this and willing to risk it haha. I just hope they can update mine asap.

[skyscreaper]

This is how it was done in the past

Adding OpenWrt support for Zyxel EX5601-T0

mtk_uartboot: mtk_uartboot.exe -s COM3 --aarch64 -p bl2-mt7986-ddr4-ram.bin -f openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip mtk_uartboot - 0.1.1 Using serial port: COM3 Handshake... hw code: 0x7986 hw sub code: 0x8a00 hw ver: 0xca01 sw ver: 0x1 Baud rate set to 460800 sending payload to 0x201000... Checksum: 0xeefd Setting baudrate back to 115200 Jumping to 0x201000 in aarch64... Waiting for BL2. Message below: ================================== NOTICE: BL2:…