Adding OpenWrt support for Zyxel EX5601-T0

[d687r02j8g]

Does anyone in the Netherlands have a t-56 they'd like to sell? PM if so.

[frollic]

There's usually plenty of them at Marktplaats, and there's wifilinks ?

[d687r02j8g]

I'm looking on marketplats but I'm only visiting NL, so will start messaging people closer to my visit, so I can arrange to collect from them in person.

Thought it would be easier if someone here had one spare.

[saladin]

Make sure that the firmware version is not b10_0122 nor b10_0410

Otherwise you may run into the risk that you cannot flash / install OpenWrt onto the router.

Good luck!

[d687r02j8g]

Ah not at all? Including via serial?

[saladin]

Long story!

To make it short; Plz read previous posts above in this thread

[d687r02j8g]

@saladin

b10_0410

Adding OpenWrt support for Zyxel EX5601-T0

0130 is actually older than 0122. The former is 30 January 2024, the latter is 22 January 2025, so you're safe, but be quick. A new firmware is on its way: b10_0410, which includes a new Zloader, BL2 and FIP as well as all the things I mentioned in a previous post: a new supervisor password (stored in an encrypted file), config encrypted differently and no root password in serial output. I don't know when the update will be released. They're probably going to test it more thoroughly since the la…

Thomas5401 mentioned b10_0410. Can't see any mention of it being deployed? Or confirming it's in the wild

@saladin

b10_0122

Adding OpenWrt support for Zyxel EX5601-T0

Well there you have it, that was easy hahaha I tested it on b10 by the way so no one has to worry about anything. The new firmware that's supposedly made to prevent unauthorized access but then they leave this available? I'm sorry Odido for making it this easily available for everyone, atleast you know what to do to prevent this now. It seems serial is no longer needed to unlock zloader and flash openwrt.

thehybrid1337 upgraded to openwrt on b10_0122 from what I can tell from their post?

[thehybrid1337]

@d687r02j8g

thehybrid1337 upgraded to openwrt on b10_0122 from what I can tell from their post?

I'm sorry if I have created confusion.

I have not been able to upgrade to openwrt on b10_0122.

I was referring to the fact that I was able to gain root access on b10_0122.

I had bricked my device that was running on b10_0122 while trying to flash OpenWrt.

I had flashed the old bl2 and FIP, but forgot to flash the old zloader.

As a consequence of this, my device got bricked and i was unable to use mtk_uartboot since they had patched the BROM as well.

I was close to getting mtk_uartboot to work over serial to recover from the brick, but I got the opportunity to swap my bricked device for a working one, and so I did not have the chance to finish what i was doing to get it working in the end.

I also did not want to risk upgrading my new device to b10_0122 to find a way to flash OpenWrt on it since I don't have the money to maybe waste 1 or 2 more routers till I get it working.

[d687r02j8g]

I appreciate your clarification. I probably didn't read correctly. Thank you for your efforts with this device!

Hopefully I'll be able to get my hands on one when I visit nl, and then follow your instructions

[saladin]

Hi @Thomas5401
How is it going about the new firmware: b10_0410, do you have updates?

[Thomas5401]

@saladin b10_0410 has been rolled out. If you leave your Odido T-56 connected overnight as you normally would, it will be upgraded, so be careful. It includes all security measures I mentioned earlier: the config backup can't be decrypted anymore, mtk_uartboot no longer works, the root password isn't visible via serial anymore and the supervisor password has changed and is stored in an encrypted file. The latter also goes for the T-54 and NR5307 so far, so they're clearly upping their game.

[frollic]

@Thomas5401

b10_0410 has been rolled out.

Seems we need to extend the warning on the wiki page.

[vinicentus]

Hi!

I'm having trouble flashing openwrt into the ubi1 partition using mtkupgrade. My goal is to leave the stock firmware on ubi2 untouched. I've tried following this guide from earlier in the thread.
OpenWrt successfully boots the first time, but fails to boot after that.

First I'm flashing OpenWrt into ubi1 using mtkupgrade (see the following post for logs).

Then I reboot, and notice that for some reason the router tries to boot using bootflag 1, where the stock firmware is. I change this to 0 and reboot. (I have collapsed the long logs, click on them to see them.)

Changing boot partition

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0228 [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):60040783
NOTICE:  BL2: Built : 13:14:59, Jul 28 2023
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0x2c
NOTICE:  Page size 4096, Block size 262144, size 536870912
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 2047 [0x1ffc0000]
NOTICE:  First info table with writecount 0 found in block 1920
NOTICE:  Second info table with writecount 0 found in block 1923
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):60040783
NOTICE:  BL31: Built : 13:15:01, Jul 28 2023


U-Boot 2022.01-rc4 (Jul 28 2023 - 13:14:21 +0800)

CPU:   MediaTek MT7986
Model: ZYXEL EX5601-T0
DRAM:  1 GiB

Initializing NMBM ...
spi-nand: spi_nand spi_nand@1: Micron SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 512 MiB, block size: 256 KiB, page size: 4096, OOB size: 256
Could not find a valid device for nmbm0
Signature found at block 2047 [0x1ffc0000]
First info table with writecount 0 found in block 1920
Second info table with writecount 0 found in block 1923
NMBM has been successfully attached 

MMC:   mmc@11230000: 0
Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
Reading 262144 byte(s) at offset 0x00000000
## Booting kernel from Legacy Image at 46000000 ...
   Image Name:   zld-2.6 07/28/2023 13:14:55
   Image Type:   AArch64 U-Boot Standalone Program (gzip compressed)
   Data Size:    22385 Bytes = 21.9 KiB
   Load Address: 41e00200
   Entry Point:  41e003f4
   Verifying Checksum ... OK
   Uncompressing Standalone Program


ZYXEL zloader v2.6.9 (07/28/2023 - 13:14:55)
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7feee0, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7fefe0, size 0x100 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
Current bootflag is 1
BOARD_DETECT_BY_GPIO=>result=0
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7fb46690, size 0x100 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
Multiboot clinent version: 2.9

Hit any key to stop autoboot:  3
ZHAL> help
Invalid command!use ATHE to check the command list!
ZHAL> ATHE
ATER	x,y       erase flash from offset x whith length y
ATRF	x,y,z     read data flash to ram(x=flash offset, y=len, z=ram address)
ATWF	x,y,z     write data from RAM to flash(x=flash offset, y=len, z=ram address)
ATDS	x,y       dump data of spare area in page y of block x
ATUR	[y:]x     upgrade RAS image (x=file name, y=host ip)
ATUB	[y:]x     upgrade ZLD image (x=file name, y=host ip)
ATUD	[y:]x     upgrade ROMD image (x=file name, y=host ip)
ATUM	[y:]x     upgrade ROMFILE image (x=file name, y=host ip)
ATCD	          erase RomD partition
ATCM	          erase ROMFILE partition
ATCR	          erase data partition
ATCMISC	          erase misc partition
ATCMP	x,y,z     compare two memory space x and y with length is z
ATDU	x,y       dump memory or registers(x=ram address, y=length)
ATWW	x,y,z     set memory or registers(x=address, y=value, z=len)
ATRT	[x,y,z,u] ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
ATCB	          copy from FLASH to working buffer
ATSB	          save working buffer to FLASH
ATWM	x         set MAC address in working buffer
ATWZ	x,y,z,u,v set zyxel MAC address, Country code, EngDbgFlag, FeatureBit and MAC number to FLASH
ATSH	          dump manufacturer related data in ROM
ATCO	x         set country code in working buffer
ATSN	x         set serial number to FLASH
ATCK	[x,y,z]   show, write or reset psk, admin and supervisor key
ATBT	x         block0 write enable (1=enable, 0=disable)
ATEN	x[,y]     set BootExtension Debug Flag (y=password)
ATSE	x         show the seed of password generator
ATDC	          disable check model mechanism
ATSR	[x]       system reboot
ATGU	          go back to U-Boot command line mode
ATGO	          boot up whole system
ATLD	x,[y]     load file x to memory address y via TFTP
ATMB	[x,y]     upgrade firmware image by multiboot
ATSW	          swap boot image to another partition (must reboot to make it take effect)
ATLED	[x,y]     set LED (x=led no, y=blink mode(0(off)|1(on)|2(fast)|3(slow))
ATPIO	x,y[,z]   set GPIO (x={s|w|r}, y=pio num, z=write data)
ATD2	[x]       show or write D2 key
ATHE	          show command list
ZHAL> ATBT 1
ZHAL> ATSW
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
ubi0: detaching mtd7
ubi0: mtd7 is detached
zld_swapBootImage: ubi 4
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7fb91310, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Updating volume 'zyfwinfo' from 0x7fb91310, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
ZHAL> ATSR
Reboot after 0 seconds
resetting ...

Now, OpenWrt doesn't boot. It says bootargs in fdt not found. Are bootargs supposed to also be in the FDT, or should they be supplied by u-boot?

After reset

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0228 [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):60040783
NOTICE:  BL2: Built : 13:14:59, Jul 28 2023
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2002MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0x2c
NOTICE:  Page size 4096, Block size 262144, size 536870912
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 2047 [0x1ffc0000]
NOTICE:  First info table with writecount 0 found in block 1920
NOTICE:  Second info table with writecount 0 found in block 1923
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):60040783
NOTICE:  BL31: Built : 13:15:01, Jul 28 2023


U-Boot 2022.01-rc4 (Jul 28 2023 - 13:14:21 +0800)

CPU:   MediaTek MT7986
Model: ZYXEL EX5601-T0
DRAM:  1 GiB

Initializing NMBM ...
spi-nand: spi_nand spi_nand@1: Micron SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 512 MiB, block size: 256 KiB, page size: 4096, OOB size: 256
Could not find a valid device for nmbm0
Signature found at block 2047 [0x1ffc0000]
First info table with writecount 0 found in block 1920
Second info table with writecount 0 found in block 1923
NMBM has been successfully attached 

MMC:   mmc@11230000: 0
Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
Reading 262144 byte(s) at offset 0x00000000
## Booting kernel from Legacy Image at 46000000 ...
   Image Name:   zld-2.6 07/28/2023 13:14:55
   Image Type:   AArch64 U-Boot Standalone Program (gzip compressed)
   Data Size:    22385 Bytes = 21.9 KiB
   Load Address: 41e00200
   Entry Point:  41e003f4
   Verifying Checksum ... OK
   Uncompressing Standalone Program


ZYXEL zloader v2.6.9 (07/28/2023 - 13:14:55)
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7feee0, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7fefe0, size 0x100 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
Current bootflag is 0
BOARD_DETECT_BY_GPIO=>result=0
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7fb46690, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
Multiboot clinent version: 2.9

Hit any key to stop autoboot:  0
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-stock device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x463efe70
     Data Size:    25070 Bytes = 24.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   0b06294f
     Hash algo:    sha1
     Hash value:   edd935c8641f32f7c032bc455a8434a1ade1c4f6
   Verifying Hash Integrity ... crc32+ sha1+ OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
bootargs in fdt not found

!!! Fail to booting kernel !!!
Reset your board! system halt...

This is essentially the same issue as reported earlier in this thread here.

I'm using stock firmware version V5.70(ACDZ.4)C0, (which is a fairly new version, that can be downloaded from here, along with a changelog in pdf vesion).

Any ideas what could help?
As an alternative to flashing into ubi1 only, I could potentially use the ubootmod method. I'm guessing ubootmod changes the partition layout significantly? Is it possible to restore the original firmware from backups easily afterwards?

Post 1/2 since I reached the character limit with the logs.

[vinicentus]

Flashing OpenWrt into ubi1 using mtkupgrade:

logs

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0228 [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):60040783
NOTICE:  BL2: Built : 13:14:59, Jul 28 2023
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0x2c
NOTICE:  Page size 4096, Block size 262144, size 536870912
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 2047 [0x1ffc0000]
NOTICE:  First info table with writecount 0 found in block 1920
NOTICE:  Second info table with writecount 0 found in block 1923
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):60040783
NOTICE:  BL31: Built : 13:15:01, Jul 28 2023


U-Boot 2022.01-rc4 (Jul 28 2023 - 13:14:21 +0800)

CPU:   MediaTek MT7986
Model: ZYXEL EX5601-T0
DRAM:  1 GiB

Initializing NMBM ...
spi-nand: spi_nand spi_nand@1: Micron SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 512 MiB, block size: 256 KiB, page size: 4096, OOB size: 256
Could not find a valid device for nmbm0
Signature found at block 2047 [0x1ffc0000]
First info table with writecount 0 found in block 1920
Second info table with writecount 0 found in block 1923
NMBM has been successfully attached 

MMC:   mmc@11230000: 0
Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
Reading 262144 byte(s) at offset 0x00000000
## Booting kernel from Legacy Image at 46000000 ...
   Image Name:   zld-2.6 07/28/2023 13:14:55
   Image Type:   AArch64 U-Boot Standalone Program (gzip compressed)
   Data Size:    22385 Bytes = 21.9 KiB
   Load Address: 41e00200
   Entry Point:  41e003f4
   Verifying Checksum ... OK
   Uncompressing Standalone Program


ZYXEL zloader v2.6.9 (07/28/2023 - 13:14:55)
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7feee0, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7fefe0, size 0x100 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
Current bootflag is 0
BOARD_DETECT_BY_GPIO=>result=0
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7fb46690, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
Multiboot clinent version: 2.9

Hit any key to stop autoboot:  5
ZHAL> ATGU




ZYXEL zloader v2.6.9 (07/28/2023 - 13:14:55)
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7feea0, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7f7fefa0, size 0x100 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
Current bootflag is 0
BOARD_DETECT_BY_GPIO=>result=0
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'zyfwinfo' to 0x7fb49610, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
Multiboot clinent version: 2.9

Hit any key to stop autoboot:  5
ZHAL> ATGU


MT7986> mtkupgrade

Available parts to be upgraded:
    0 - ATF BL2
    1 - ATF FIP
    2 - Firmware
    3 - Single image

Select a part: 2

*** Upgrading Firmware ***

Run image after upgrading? (Y/n): y

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record

Select (enter for default): 0

Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.254
Input IP netmask: 255.255.255.0
Input file name: openwrt-24.10.2-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade-modified.bin

Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-24.10.2-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade-modified.bin'.
Load address: 0x46000000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ################################################################
	 887.7 KiB/s
done
Bytes transferred = 9523521 (915141 hex)
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK

*** Loaded 9523521 (0x915141) bytes at 0x46000000 ***

ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Updating volume 'kernel' from 0x46000800, size 0x3f65ac ... OK
Updating volume 'rootfs' from 0x463f7000, size 0x51c000 ... OK
Updating volume 'zyfwinfo' from 0x46913400, size 0x100 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached

*** Firmware upgrade completed! ***

ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 38
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.93
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    4127807 Bytes = 3.9 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   f17cd8d8
     Hash algo:    sha1
     Hash value:   28d883d1cf8eb1a7a5f7c11b5646312b32fe9c15
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-stock device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x463efe70
     Data Size:    25070 Bytes = 24.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   0b06294f
     Hash algo:    sha1
     Hash value:   edd935c8641f32f7c032bc455a8434a1ade1c4f6
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x463efe70
   Uncompressing Kernel Image
   Loading Device Tree to 000000007f7f0000, end 000000007f7f91ed ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.93 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28739-d9340319c6) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Mon Jun 23 20:40:36 2025
[    0.000000] Machine model: Zyxel EX5601-T0 (stock layout)
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x000000004fc00000..0x000000004fcfffff (1024 KiB) nomap non-reusable wmcpu-reserved@4fc00000
[    0.000000] OF: reserved mem: 0x000000004fd00000..0x000000004fd3ffff (256 KiB) nomap non-reusable wo-emi@4fd00000
[    0.000000] OF: reserved mem: 0x000000004fd40000..0x000000004fd7ffff (256 KiB) nomap non-reusable wo-emi@4fd40000
[    0.000000] OF: reserved mem: 0x000000004fd80000..0x000000004ffbffff (2304 KiB) nomap non-reusable wo-data@4fd80000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000004fbfffff]
[    0.000000]   node   0: [mem 0x000000004fc00000-0x000000004ffbffff]
[    0.000000]   node   0: [mem 0x000000004ffc0000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 18 pages/cpu s35624 r8192 d29912 u73728
[    0.000000] pcpu-alloc: s35624 r8192 d29912 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: 
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 1MB
[    0.000000] software IO TLB: area num 4.
[    0.000000] software IO TLB: mapped [mem 0x000000007fb00000-0x000000007fc00000] (1MB)
[    0.000000] Memory: 1010408K/1048576K available (9024K kernel code, 1000K rwdata, 1672K rodata, 448K init, 307K bss, 38168K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: 0xffffffc080010080
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000072] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000079] pid_max: default: 32768 minimum: 301
[    0.002154] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.002162] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.003776] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.004166] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.004272] rcu: Hierarchical SRCU implementation.
[    0.004273] rcu: 	Max phase no-delay instances is 1000.
[    0.004601] smp: Bringing up secondary CPUs ...
[    0.004861] Detected VIPT I-cache on CPU1
[    0.004897] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.004925] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.005219] Detected VIPT I-cache on CPU2
[    0.005240] GICv3: CPU2: found redistributor 2 region 0:0x000000000c0c0000
[    0.005253] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.005514] Detected VIPT I-cache on CPU3
[    0.005532] GICv3: CPU3: found redistributor 3 region 0:0x000000000c0e0000
[    0.005541] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.005567] smp: Brought up 1 node, 4 CPUs
[    0.005570] SMP: Total of 4 processors activated.
[    0.005573] CPU features: detected: 32-bit EL0 Support
[    0.005575] CPU features: detected: CRC32 instructions
[    0.005601] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.005604] CPU: All CPU(s) started at EL2
[    0.005606] alternatives: applying system-wide alternatives
[    0.008545] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.008561] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.009457] pinctrl core: initialized pinctrl subsystem
[    0.010399] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.010636] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.010654] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.010670] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.010977] thermal_sys: Registered thermal governor 'fair_share'
[    0.010980] thermal_sys: Registered thermal governor 'bang_bang'
[    0.010982] thermal_sys: Registered thermal governor 'step_wise'
[    0.010983] thermal_sys: Registered thermal governor 'user_space'
[    0.011009] ASID allocator initialised with 65536 entries
[    0.011702] pstore: Using crash dump compression: deflate
[    0.011706] pstore: Registered ramoops as persistent store backend
[    0.011708] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.012685] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
[    0.017479] Modules: 29616 pages in range for non-PLT usage
[    0.017488] Modules: 521136 pages in range for PLT usage
[    0.018422] cryptd: max_cpu_qlen set to 1000
[    0.019284] SCSI subsystem initialized
[    0.019577] libata version 3.00 loaded.
[    0.020602] clocksource: Switched to clocksource arch_sys_counter
[    0.022234] NET: Registered PF_INET protocol family
[    0.022325] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.023541] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.023553] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.023560] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.023597] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear)
[    0.023759] TCP: Hash tables configured (established 8192 bind 8192)
[    0.024015] MPTCP token hash table entries: 1024 (order: 2, 24576 bytes, linear)
[    0.024097] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.024113] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.024263] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.024284] PCI: CLS 0 bytes, default 64
[    0.025253] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.028553] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.028558] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.064547] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.068551] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.071617] printk: console [ttyS0] disabled
[    0.091989] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 116, base_baud = 2500000) is a ST16650V2
[    0.092028] printk: console [ttyS0] enabled
[    0.878357] mtk_rng 1020f000.rng: registered RNG driver
[    0.878589] random: crng init done
[    0.889009] loop: module loaded
[    0.893810] spi-nand spi0.1: Micron SPI NAND was found.
[    0.899033] spi-nand spi0.1: 512 MiB, block size: 256 KiB, page size: 4096, OOB size: 256
[    0.908417] Signature found at block 2047 [0x1ffc0000]
[    0.913565] NMBM management region starts at block 1920 [0x1e000000]
[    0.924024] First info table with writecount 0 found in block 1920
[    0.942441] Second info table with writecount 0 found in block 1923
[    0.948693] NMBM has been successfully attached
[    0.953548] 8 fixed-partitions partitions found on MTD device spi0.1
[    0.959888] Creating 8 MTD partitions on "spi0.1":
[    0.964671] 0x000000000000-0x000000100000 : "BL2"
[    0.970258] 0x000000100000-0x000000180000 : "u-boot-env"
[    0.976146] 0x000000180000-0x000000380000 : "Factory"
[    0.982868] 0x000000380000-0x000000540000 : "FIP"
[    0.988812] 0x000000540000-0x000000580000 : "zloader"
[    0.994259] 0x000000580000-0x000004580000 : "ubi"
[    1.033719] 0x000004580000-0x000008580000 : "ubi2"
[    1.073302] 0x000008580000-0x00001e000000 : "zyubi"
[    3.991702] Maxlinear Ethernet GPY211C mdio-bus:05: Firmware Version: 8.111 (0x886F)
[    4.000867] Maxlinear Ethernet GPY211C mdio-bus:06: Firmware Version: 8.111 (0x886F)
[    4.011240] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081680000, irq 121
[    4.021047] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc081680000, irq 121
[    4.030742] i2c_dev: i2c /dev entries driver
[    4.036299] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    4.044805] NET: Registered PF_INET6 protocol family
[    4.050360] Segment Routing with IPv6
[    4.054074] In-situ OAM (IOAM) with IPv6
[    4.058016] NET: Registered PF_PACKET protocol family
[    4.063076] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    4.076149] 8021q: 802.1Q VLAN Support v1.8
[    4.132433] mt7530-mdio mdio-bus:1f: no interrupt support
[    4.178614] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    4.187494] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    4.198667] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=POLL)
[    4.220844] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=POLL)
[    4.242747] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=POLL)
[    4.254343] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mdio-bus:05] driver [Maxlinear Ethernet GPY211C] (irq=POLL)
[    4.265808] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[    4.272529] DSA: tree 0 setup
[    4.276703] UBI: auto-attach mtd5
[    4.280013] ubi0: default fastmap pool size: 10
[    4.284552] ubi0: default fastmap WL pool size: 5
[    4.289239] ubi0: attaching mtd5
[    4.794553] ubi0: scanning is finished
[    4.810273] ubi0 warning: 0xffffffc0805d8088: cannot reserve enough PEBs for bad PEB handling, reserved 36, need 38
[    4.821104] ubi0: attached mtd5 (name "ubi", size 64 MiB)
[    4.826497] ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
[    4.833358] ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
[    4.840126] ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
[    4.847068] ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
[    4.853057] ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
[    4.860256] ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1693489017
[    4.869364] ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 36
[    4.878566] ubi0: background thread "ubi_bgt0d" started, PID 676
[    4.885891] block ubiblock0_1: created from ubi0:1(rootfs)
[    4.891374] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem
[    4.898400] clk: Disabling unused clocks
[    4.915932] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    4.923228] Freeing unused kernel memory: 448K
[    4.927704] Run /sbin/init as init process
[    4.931797]   with arguments:
[    4.934748]     /sbin/init
[    4.937439]   with environment:
[    4.940563]     HOME=/
[    4.942912]     TERM=linux
[    5.172542] init: Console is alive
[    5.176072] init: - watchdog -
[    5.664828] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.697437] usbcore: registered new interface driver usbfs
[    5.702978] usbcore: registered new interface driver hub
[    5.708303] usbcore: registered new device driver usb
[    5.713915] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    5.725684] xhci-mtk 11200000.usb: xHCI Host Controller
[    5.730981] xhci-mtk 11200000.usb: new USB bus registered, assigned bus number 1
[    5.741431] xhci-mtk 11200000.usb: hcc params 0x01403f99 hci version 0x110 quirks 0x0000000000200010
[    5.750581] xhci-mtk 11200000.usb: irq 125, io mem 0x11200000
[    5.756413] xhci-mtk 11200000.usb: xHCI Host Controller
[    5.761632] xhci-mtk 11200000.usb: new USB bus registered, assigned bus number 2
[    5.769011] xhci-mtk 11200000.usb: Host supports USB 3.2 Enhanced SuperSpeed
[    5.776415] hub 1-0:1.0: USB hub found
[    5.780169] hub 1-0:1.0: 2 ports detected
[    5.784497] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    5.792861] hub 2-0:1.0: USB hub found
[    5.796617] hub 2-0:1.0: 1 port detected
[    5.891570] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.904620] init: - preinit -
[    6.230655] usb 1-2: new high-speed USB device number 2 using xhci-mtk
[    6.235709] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    6.245633] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    6.269622] mt7530-mdio mdio-bus:1f lan1: configuring for phy/2500base-x link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.506488] UBIFS (ubi0:4): default file-system created
[   10.512747] UBIFS (ubi0:4): Mounting in unauthenticated mode
[   10.518458] UBIFS (ubi0:4): background thread "ubifs_bgt0_4" started, PID 854
[   10.710237] UBIFS (ubi0:4): UBIFS: mounted UBI device 0, volume 4, name "rootfs_data"
[   10.718076] UBIFS (ubi0:4): LEB size: 253952 bytes (248 KiB), min./max. I/O unit sizes: 4096 bytes/4096 bytes
[   10.727969] UBIFS (ubi0:4): FS size: 41394176 bytes (39 MiB, 163 LEBs), max 173 LEBs, journal size 2031617 bytes (1 MiB, 8 LEBs)
[   10.739507] UBIFS (ubi0:4): reserved for root: 1955148 bytes (1909 KiB)
[   10.746103] UBIFS (ubi0:4): media format: w5/r0 (latest is w5/r0), UUID 1BC2625D-07C8-407A-AD3C-4DC284A175A1, small LPT model
[   10.761052] mount_root: overlay filesystem has not been fully initialized yet
[   10.768331] mount_root: switching to ubifs overlay
[   10.777159] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[   10.789404] urandom-seed: Seed file not found (/etc/urandom.seed)
[   10.851559] procd: - early -
[   10.854487] procd: - watchdog -
[   11.415928] procd: - watchdog -
[   11.476667] procd: - ubus -
[   11.633694] procd: - init -
Please press Enter to activate this console.
[   11.945868] kmodloader: loading kernel modules from /etc/modules.d/*
[   11.980939] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[   11.995487] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   12.002988] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   12.096574] urngd: v1.0.2 started.
[   12.364378] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823160656a
[   12.364378] 
[   12.584643] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823160721
[   12.692936] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823160840
[   12.799648] mt798x-wmac 18000000.wifi: registering led 'mt76-phy0'
[   12.852008] mt798x-wmac 18000000.wifi: registering led 'mt76-phy1'
[   12.907620] PPP generic driver version 2.4.2
[   12.912758] NET: Registered PF_PPPOX protocol family
[   12.919541] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.953939] mtdblock: MTD device 'Factory' is NAND, please consider using UBI block devices instead.
[   13.060803] mtdblock: MTD device 'Factory' is NAND, please consider using UBI block devices instead.
[   17.757486] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   17.776132] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   17.784603] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   17.786734] mt7530-mdio mdio-bus:1f lan1: configuring for phy/2500base-x link mode
[   17.802395] br-lan: port 1(lan1) entered blocking state
[   17.807612] br-lan: port 1(lan1) entered disabled state
[   17.812859] mt7530-mdio mdio-bus:1f lan1: entered allmulticast mode
[   17.819109] mtk_soc_eth 15100000.ethernet eth0: entered allmulticast mode
[   17.828657] mt7530-mdio mdio-bus:1f lan1: entered promiscuous mode
[   17.846414] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mode
[   17.857163] br-lan: port 2(lan2) entered blocking state
[   17.862471] br-lan: port 2(lan2) entered disabled state
[   17.867749] mt7530-mdio mdio-bus:1f lan2: entered allmulticast mode
[   17.875797] mt7530-mdio mdio-bus:1f lan2: entered promiscuous mode
[   17.891173] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mode
[   17.902298] br-lan: port 3(lan3) entered blocking state
[   17.907533] br-lan: port 3(lan3) entered disabled state
[   17.912850] mt7530-mdio mdio-bus:1f lan3: entered allmulticast mode
[   17.921308] mt7530-mdio mdio-bus:1f lan3: entered promiscuous mode
[   17.936882] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
[   17.947627] br-lan: port 4(lan4) entered blocking state
[   17.952904] br-lan: port 4(lan4) entered disabled state
[   17.958159] mt7530-mdio mdio-bus:1f lan4: entered allmulticast mode
[   17.966528] mt7530-mdio mdio-bus:1f lan4: entered promiscuous mode
[   17.977561] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:06] driver [Maxlinear Ethernet GPY211C] (irq=POLL)
[   17.987852] mtk_soc_eth 15100000.ethernet eth1: configuring for phy/2500base-x link mode
[   22.075653] mt7530-mdio mdio-bus:1f lan3: Link is Up - 1Gbps/Full - flow control rx/tx
[   22.075679] br-lan: port 3(lan3) entered blocking state
[   22.088780] br-lan: port 3(lan3) entered forwarding state
[   51.049658] br-lan: port 3(lan3) entered disabled state
[   51.056045] mt7530-mdio mdio-bus:1f lan1: left allmulticast mode
[   51.062087] mt7530-mdio mdio-bus:1f lan1: left promiscuous mode
[   51.068078] br-lan: port 1(lan1) entered disabled state
[   51.104211] mt7530-mdio mdio-bus:1f lan2: left allmulticast mode
[   51.110215] mt7530-mdio mdio-bus:1f lan2: left promiscuous mode
[   51.116217] br-lan: port 2(lan2) entered disabled state
[   51.200502] mt7530-mdio mdio-bus:1f lan3: left allmulticast mode
[   51.206530] mt7530-mdio mdio-bus:1f lan3: left promiscuous mode
[   51.212491] br-lan: port 3(lan3) entered disabled state
[   51.252406] mt7530-mdio mdio-bus:1f lan3: Link is Down
[   51.263618] mt7530-mdio mdio-bus:1f lan4: left allmulticast mode
[   51.269618] mtk_soc_eth 15100000.ethernet eth0: left allmulticast mode
[   51.276138] mt7530-mdio mdio-bus:1f lan4: left promiscuous mode
[   51.282099] br-lan: port 4(lan4) entered disabled state
[   51.325637] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   55.739083] reboot: Restarting system

[saladin]

@vinicentus

Flashing OpenWrt into ub1 using mtkupgrade:

It seems you have partitions issue, did you try follow this guide here to install OpenWrt from serial ?

[vinicentus]

@saladin

It seems you have partitions issue

What makes you think that it's a partitioning issue? Something particular in the logs?

@saladin

did you try follow this guide here to install OpenWrt from serial ?

No. I only used mtk_uartboot initially in order to boot OpenWrt and do fw_setenv EngDebugFlag 1. After that, I used u-boot's mtkupgrade when trying to flash the image into ubi: I followed this, starting from the point where firmware is modified to include zyfwinfo, then changing bootflag if necessary, and using mtkupgrade. The first part of that post (checking /proc/cmdline) didn't seem relevant, since both ubi and ubi2 had different versions of the stock zyxel firmware, and I assumed I can just check the bootflag instead.

Should I flash Openwrt into ubi like (I think) I did, or should I just go for ubootmod? What is the difference in the resulting partition layout?

[saladin]

@vinicentus

What makes you think that it's a partitioning issue? Something particular in the logs?

in the logs which you posted, I noticed the following:

[    4.885891] block ubiblock0_1: created from ubi0:1(rootfs)
[    4.891374] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem

The above is different from the booting behavior that I know, which

block ubiblock0_3: created from ubi0:3(fit)

@vinicentus

should I just go for ubootmod?

That method is better to follow (if you can), it is the method that all have followed so far and it worked.

[thehybrid1337]

@vinicentus

As an alternative to flashing into ubi1 only, I could potentially use the ubootmod method. I'm guessing ubootmod changes the partition layout significantly? Is it possible to restore the original firmware from backups easily afterwards?

I should check this forum more often, apologies.

• Yes ubootmod changes the partitions significantly.
• Yes it's possible to restore the original firmware. If you've made the mtd backups correctly, then you should be able to restore fairly easily.
• Yes, flashing ubootmod OpenWrt is way more simple than trying to multi-boot.

Anyways, let's try to fix your stock layout OpenWrt.

To be honest, i didn't waste any time analyzing the errors you were getting since i think instead of troubleshooting, we should do a clean install.

I'm assuming you've got access over UART. Boot the stock initramfs kernel on your router.

If you don't know how to; see instructions from my post from some time ago below.

Adding OpenWrt support for Zyxel EX5601-T0

Unfortunately i've wasted a couple hours for nothing since the software i was using to make screenshots and insert text annotations failed while exporting and corrupted the files in the proces... I'm pretty tired and frustrated. So for now I will only post the minimal on how to flash the Zyxel no-brand firmware, should work for everyone with access to uart. Reverting to stock layout/firmware We can not flash the firmware while running ubootmod firmware. First thing we have to do is boot fr…

You can follow the instructions from start till end.
Important thing here is that we ubiformat mtd5/mtd6/mtd7

The only thing that you will probably have to change is "V570ACDZ36C0.bin" from my post to "V570ACDZ4C0.bin" if you intend to do that.

After this you should be on rootubi=ubi on Zyxel's firmware. Since we've formatted the other partitions.

This next post of mine explains the next part of how to get OpenWrt on ubi and Zyxel on ubi2.

Adding OpenWrt support for Zyxel EX5601-T0

Multi-booting OpenWRT & Zyxel OEM firmware I'm posting this just in case so everyone knows how to make it work. The how-to instructions that i will be posting here is my own personal method, it's probably not the best or fastest way to flash OpenWRT. Try this at your own risk, I am a newbie when it comes to any of this, If you check my previous posts you will see i clearly had no idea what i was doing most of the time and just recently gained some knowledge. If anyone has tips for me i'd ap…

I will try to simplify it a little bit.

First run commands in SSH or Serial.

zycli fwidcheck off
zycli modelcheck off

Next choose Firmware upgrade from the web GUI and flash the same file that you're already running. So in your case, you probably have to flash "V570ACDZ4C0.bin"

If everything went okay, the next time your router boots enter command

cat /proc/cmdline/

and below should be output.

This next part about preparing the sysupgrade file and adding the zyfwinfo volume is extremely important, otherwise your OpenWRT will not work! You will have to do this yourself for 24.10.2. Or use the one i prepared for 24.10.0. You can now use mtkupgrade if your bootflag is 0. if it's 1, then switch boot partition, restart and use mtkupgrade to flash openwrt.

Zyfwinfo volume OpenWrt

@thehybrid1337

Preparing the OpenWRT firmware.

If you don't want to bother doing this part yourself, there will be a ready to flash firmware on the end of the post.

If you want to do this part yourself.

We can download the 'sysupgrade' for zyxel ex5601-t0 with the stock layout on the OpenWrt website.
To be able to be compatible to multi-boot with Zyxel's firmware, we need to add 'zyfwinfo' to this sysupgrade we just downloaded.
This is required because 'zloader' checks for this in the firmware and won't boot without it if it fails checksum..
'zyfwinfo' is nothing too crazy or difficult but i found a generator on github with instructions making this proces a lot easier. Thanks @skyscreaper pameruoso/OpenWRT-Zyxel-EX5601-T0: Porting openwrt to Zyxel-EX5601-T0

The only file you'll need is gen_zyfwinfo.sh unless you have an sfp port as WAN.

Make a new folder and move the sysupgrade you've downloaded from the OpenWrt website there, in my case it's 'openwrt-24.10.0-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin'

Run gen_zyfwinfo.sh to generate a zyfwinfo file.

Make another folder in here called "sysupgrade-zyxel_ex5601-t0-stock"
place file 'zyfwinfo' that you've generated . in folder called "sysupgrade-zyxel_ex5601-t0-stock"

Screenshot folder structure

Run the following command to include the zyfwinfo in the firmware.

tar -rf openwrt-24.10.0-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin sysupgrade-zyxel_ex5601-t0-stock

The sysupgrade file is now compatible.

openwrt-24.10.0-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin

I've already made the above one compatible and can confirm it works.

Hope it works out for you.

I'm here for questions.