Adding OpenWrt support for Zyxel EX5601-T0

For Developers
84

Ok here is a little update @daniel

Given that we have the pin mapping from the zyxel script let me summarize what I understand from that code:

GPIO LIST (gpio base 411)
10 - 421 LOW FOR SFP, HIGH FOR 2.5 PHY
23 - 434 AE_RX_LOS_3V3
26 - 437 AE_TX_DIS_3V3
28 - 439 AE TX_FAULT_3V3
57 - 468 AE_MOD_ABS_1V8

When the SFP is not inserted the pins are configured this way:

421 = 1 GPIO_ACTIVE_LOW 
434 = 1 GPIO_ACTIVE_LOW 
437 = 0 GPIO_ACTIVE_HIGH 
439 = 1 GPIO_ACTIVE_LOW 
468 = 1 GPIO_ACTIVE_LOW

When the SFP is inserted:

421 = 0 GPIO_ACTIVE_HIGH
434 = 0 GPIO_ACTIVE_HIGH
437 = 0 GPIO_ACTIVE_HIGH
439 = 1 GPIO_ACTIVE_LOW
468 = 0 GPIO_ACTIVE_HIGH

I've been reading around some examples (bpi-r3 forum) of how SFP are wired into the DTS so this is my test:
Added the i2c bus and the pins taken directly from the zyxel oem DTS:

&i2c0 {
	pinctrl-names = "default";
	pinctrl-0 = <&i2c_pins>;
	status = "okay";
};

&pio {
	i2c_pins: i2c-pins-3-4 {
		mux {
			function = "i2c";
			groups = "i2c";
		};
	};

Added the sfp definition with pins configured for no sfp present (is this correct?):

	sfp: sfp {
		compatible = "sff,sfp";
		i2c-bus = <&i2c0>;
		los-gpios = <&pio 23 GPIO_ACTIVE_LOW>;
		mod-def0-gpios = <&pio 57 GPIO_ACTIVE_LOW>;
		tx-disable-gpios = <&pio 26 GPIO_ACTIVE_HIGH>;
		tx-fault-gpios = <&pio 28 GPIO_ACTIVE_LOW>;
		maximum-power-milliwatt = <3000>;
	};

Added into the &eth > gmac1 the following (sfp=&sfp), is this the right spot?:

	gmac1: mac@1 {
		compatible = "mediatek,eth-mac";
		reg = <1>;
		phy-mode = "2500base-x";
		phy = <&phy6>;
		sfp = <&sfp>;

		nvmem-cells = <&macaddr_factory_0024>;
		nvmem-cell-names = "mac-address";
	};

After compiling and booting here are my tests:

  1. Boot the router without SFP
  2. moving the wan port into the bridge (just to see if the phy is activated and works):
root@OpenWrt:/# [   80.339117] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:06] driver [Maxlinear Ethernet GPY211B] (irq=POLL)
[   80.349294] mtk_soc_eth 15100000.ethernet eth1: configuring for phy/2500base-x link mode
[   80.359834] br-lan: port 5(eth1) entered blocking state
[   80.365064] br-lan: port 5(eth1) entered disabled state
[   80.370450] device eth1 entered promiscuous mode

This seems ok but the wan port is not working, if I plug the cable i see no traffic.
3. I decide to insert the sfp and see if any logs show anything:

root@OpenWrt:/# [  217.427828] sfp sfp: please wait, module slow to respond
[  262.818272] sfp sfp: module HUAWEI           MA5671A          rev 0000 sn 032VRJ10K6004724 dc 190514
[  262.848193] hwmon hwmon2: temp1_input not attached to any thermal zone

Good, the sfp is recognized but no traffic is received:

root@OpenWrt:/# ethtool -m eth1
        Identifier                                : 0x03 (SFP)
        Extended identifier                       : 0x04 (GBIC/SFP defined by 2-wire interface ID)
        Connector                                 : 0x01 (SC)
        Transceiver codes                         : 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00
        Transceiver type                          : Ethernet: 1000BASE-LX
        Encoding                                  : 0x03 (NRZ)
        BR, Nominal                               : 1200MBd
        Rate identifier                           : 0x00 (unspecified)
        Length (SMF,km)                           : 20km
        Length (SMF)                              : 20000m
        Length (50um)                             : 0m
        Length (62.5um)                           : 0m
        Length (Copper)                           : 0m
        Length (OM3)                              : 0m
        Laser wavelength                          : 1310nm
        Vendor name                               : HUAWEI
        Vendor OUI                                : 00:00:00
        Vendor PN                                 : MA5671A
        Vendor rev                                : 0000
        Option values                             : 0x00 0x1a
        Option                                    : RX_LOS implemented
        Option                                    : TX_FAULT implemented
        Option                                    : TX_DISABLE implemented
        BR margin, max                            : 0%
        BR margin, min                            : 0%
        Vendor SN                                 : 032VRJ10K6004724
        Date code                                 : 190514
        Optical diagnostics support               : Yes
        Laser bias current                        : 6.332 mA
        Laser output power                        : 0.0001 mW / -40.00 dBm
        Receiver signal average optical power     : 0.0001 mW / -40.00 dBm
        Module temperature                        : 40.74 degrees C / 105.33 degrees F
        Module voltage                            : 3.3671 V
        Alarm/warning flags implemented           : Yes
        Laser bias current high alarm             : Off
        Laser bias current low alarm              : Off
        Laser bias current high warning           : Off
        Laser bias current low warning            : Off
        Laser output power high alarm             : Off
        Laser output power low alarm              : On
        Laser output power high warning           : Off
        Laser output power low warning            : On
        Module temperature high alarm             : Off
        Module temperature low alarm              : Off
        Module temperature high warning           : Off
        Module temperature low warning            : Off
        Module voltage high alarm                 : Off
        Module voltage low alarm                  : Off
        Module voltage high warning               : Off
        Module voltage low warning                : Off
        Laser rx power high alarm                 : Off
        Laser rx power low alarm                  : On
        Laser rx power high warning               : Off
        Laser rx power low warning                : On
        Laser bias current high alarm threshold   : 90.000 mA
        Laser bias current low alarm threshold    : 0.000 mA
        Laser bias current high warning threshold : 70.000 mA
        Laser bias current low warning threshold  : 0.000 mA
        Laser output power high alarm threshold   : 3.9810 mW / 6.00 dBm
        Laser output power low alarm threshold    : 0.8912 mW / -0.50 dBm
        Laser output power high warning threshold : 3.1622 mW / 5.00 dBm
        Laser output power low warning threshold  : 1.1220 mW / 0.50 dBm
        Module temperature high alarm threshold   : 95.00 degrees C / 203.00 degrees F
        Module temperature low alarm threshold    : -50.00 degrees C / -58.00 degrees F
        Module temperature high warning threshold : 90.00 degrees C / 194.00 degrees F
        Module temperature low warning threshold  : -45.00 degrees C / -49.00 degrees F
        Module voltage high alarm threshold       : 3.6000 V
        Module voltage low alarm threshold        : 3.0000 V
        Module voltage high warning threshold     : 3.5000 V
        Module voltage low warning threshold      : 3.1000 V
        Laser rx power high alarm threshold       : 0.2511 mW / -6.00 dBm
        Laser rx power low alarm threshold        : 0.0013 mW / -28.86 dBm
        Laser rx power high warning threshold     : 0.1995 mW / -7.00 dBm
        Laser rx power low warning threshold      : 0.0016 mW / -27.96 dBm

Second test:

  1. boot the router with the sfp inserted immediately:
    During the bootlog i read the following:
   33.378282] sfp sfp: module HUAWEI           MA5671A          rev 0000 sn 032VRJ10K6004724 dc 190514
[   33.387598] mtk_soc_eth 15100000.ethernet eth1: switched to inband/2500base-x link mode
[   33.408187] hwmon hwmon2: temp1_input not attached to any thermal zone

Ethtool shows same infos like previous test
2. Try to move the eth1 port into the bridge and see if there is any traffic:

root@OpenWrt:/# [   77.456152] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:06] driver [Maxlinear Ethernet GPY211B] (irq=POLL)
[   77.466341] mtk_soc_eth 15100000.ethernet eth1: configuring for inband/2500base-x link mode
[   77.477152] br-lan: port 5(eth1) entered blocking state
[   77.482403] br-lan: port 5(eth1) entered disabled state
[   77.487777] device eth1 entered promiscuous mode
[   77.527641] ------------[ cut here ]------------
[   77.532259] called from state NOLINK
[   77.535839] WARNING: CPU: 1 PID: 478 at phy_start+0x98/0xb0
[   77.541403] Modules linked in: xt_connlimit pppoe ppp_async option nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet nf_conncount xt_state xt_helper xt_conntrack xt_connmark xt_connbytes wireguard usb_wwan rndis_host qmi_wwan pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7915e mt76_connac_lib mt76 mac80211 libchacha20poly1305 iptable_mangle iptable_filter ipt_REJECT ip_tables chacha_neon cfg80211 cdc_ncm cdc_ether xt_time xt_tcpudp xt_recent xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG x_tables usbserial usbnet usblp spi_gpio spi_bitbang slhc sfp poly1305_neon nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mdio_netlink mdio_i2c libcurve25519_generic libcrc32c libchacha
[   77.541550]  hwmon hso crc_ccitt compat cdc_wdm cdc_acm crypto_safexcel i2c_mux_gpio i2c_mux ip6_gre ip_gre gre nat46 sit ip6_tunnel tunnel6 snd_rawmidi snd_seq_device snd_pcm_oss snd_mixer_oss snd_hwdep snd_compress ntfs br2684 atm sha1_generic md5 des_generic libdes usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug exfat gpio_cascade mux_gpio mux_core usbcore usb_common mii
[   77.671196] CPU: 1 PID: 478 Comm: kworker/u8:4 Not tainted 5.15.107 #0
[   77.677703] Hardware name: Zyxel EX5601-T0 (DT)
[   77.682215] Workqueue: events_power_efficient 0xffffffc000b122a0
[   77.688222] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   77.695162] pc : phy_start+0x98/0xb0
[   77.698722] lr : phy_start+0x98/0xb0
[   77.702281] sp : ffffffc00bd43d20
[   77.705579] x29: ffffffc00bd43d20 x28: 0000000000000000 x27: ffffff8000fa0b40
[   77.712694] x26: ffffff8003f27174 x25: ffffff8000007105 x24: ffffff8000008ab0
[   77.719811] x23: 0000000000000000 x22: ffffff8000007100 x21: ffffff800000c000
[   77.726927] x20: ffffff80009e7490 x19: ffffff80009e7000 x18: ffffffc00b1ea460
[   77.734043] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000390
[   77.741158] x14: 0000000000000130 x13: ffffffc00bd43a48 x12: ffffffc00b242460
[   77.748274] x11: fffffffffffe4f68 x10: ffffffc00b242460 x9 : 0000000000000000
[   77.755389] x8 : ffffffc00b1ea410 x7 : ffffffc00b1ea460 x6 : 0000000000000001
[   77.762505] x5 : ffffff803fd936f8 x4 : 0000000000000000 x3 : 0000000000000027
[   77.769620] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000018
[   77.776736] Call trace:
[   77.779167]  phy_start+0x98/0xb0
[   77.782381]  phylink_sfp_module_start+0x44/0x4c
[   77.786895]  sfp_module_start+0x30/0x44
[   77.790716]  0xffffffc000b10614
[   77.793844]  0xffffffc000b122dc
[   77.796972]  process_one_work+0x210/0x3b0
[   77.800967]  worker_thread+0x170/0x4d0
[   77.804699]  kthread+0x11c/0x130
[   77.807915]  ret_from_fork+0x10/0x20
[   77.811476] ---[ end trace 55e1587ab3afeed3 ]---

To mee it seems that the phy crashed...or some panic from the phy which doesn't know what to do

The big missing point here is pin 10 that should manage swapping between sfp and phy ethernet. I can't really find any examples on the internet on where to put that to allow swapping...

adding @bmork in case you have experience with this.

PS. when booting the zyxel firmware i see 2 additional pins that are not documented into /sys/class/gpio:

436 == ??? value 1
464 == ??? value 1

I don't know what they do and how they are exported given that are not preset into the script.

Thank you

85

Don't know much about this....

But I believe most devices with combined RJ45 and SFP ports have connections like mac -> phy -> sfp, leaving the management of RJ45 vs SFP slot up to the phy driver. Not sure if your hardware configuration is currently supported. A mac can be connected to either a phy or sfp slot, but maybe not both?

This should be easy to fix. But there are probably more ways to do that than I can imagine. It's wise to seek guidance from the phylib and sfp driver maintainers on netdev before putting too much effort into it.

1 Like
86

Ok adding here additional details regarding the pins... probably this can be useful for SDA SCL i2c dts declaration:

MT7986> pinmux list
| Device                        | Driver                        | Parent
| pinctrl@1001f000              | mt7986_pinctrl                | root_driver
MT7986> pinmux status -a
--------------------------
pinctrl@1001f000:
SYS_WATCH : Aux Func.1
WF2G_LED  : Aux Func.1
WF5G_LED  : Aux Func.1
I2C_SCL   : Aux Func.1
I2C_SDA   : Aux Func.1
GPIO_0    : Aux Func.0
GPIO_1    : Aux Func.0
GPIO_2    : Aux Func.0
GPIO_3    : Aux Func.0
GPIO_4    : Aux Func.1
GPIO_5    : Aux Func.0
GPIO_6    : Aux Func.1
GPIO_7    : Aux Func.0
GPIO_8    : Aux Func.0
GPIO_9    : Aux Func.0
GPIO_10   : Aux Func.0
GPIO_11   : Aux Func.0
GPIO_12   : Aux Func.0
GPIO_13   : Aux Func.0
GPIO_14   : Aux Func.0
GPIO_15   : Aux Func.0
PWM0      : Aux Func.1
PWM1      : Aux Func.1
SPI0_CLK  : Aux Func.0
SPI0_MOSI : Aux Func.0
SPI0_MISO : Aux Func.1
SPI0_CS   : Aux Func.0
SPI0_HOLD : Aux Func.1
SPI0_WP   : Aux Func.0
SPI1_CLK  : Aux Func.1
SPI1_MOSI : Aux Func.1
SPI1_MISO : Aux Func.1
SPI1_CS   : Aux Func.1
SPI2_CLK  : Aux Func.1
SPI2_MOSI : Aux Func.1
SPI2_MISO : Aux Func.1
SPI2_CS   : Aux Func.1
SPI2_HOLD : Aux Func.1
SPI2_WP   : Aux Func.1
UART0_RXD : Aux Func.1
UART0_TXD : Aux Func.1
PCIE_PERE : Aux Func.1
UART1_RXD : Aux Func.1
UART1_TXD : Aux Func.1
UART1_CTS : Aux Func.1
UART1_RTS : Aux Func.1
UART2_RXD : Aux Func.1
UART2_TXD : Aux Func.1
UART2_CTS : Aux Func.1
UART2_RTS : Aux Func.1
EMMC_DATA : Aux Func.0
EMMC_DATA : Aux Func.0
EMMC_DATA : Aux Func.1
EMMC_DATA : Aux Func.1
EMMC_DATA : Aux Func.1
EMMC_DATA : Aux Func.1
EMMC_DATA : Aux Func.1
EMMC_DATA : Aux Func.0
EMMC_CMD  : Aux Func.1
EMMC_CK   : Aux Func.1
EMMC_DSL  : Aux Func.1
EMMC_RSTB : Aux Func.1
PCM_DTX   : Aux Func.1
PCM_DRX   : Aux Func.1
PCM_CLK   : Aux Func.1
PCM_FS    : Aux Func.1
MT7531_IN : Aux Func.1
SMI_MDC   : Aux Func.1
SMI_MDIO  : Aux Func.1
WF0_DIG_R : Aux Func.1
WF0_CBA_R : Aux Func.1
WF0_XO_RE : Aux Func.1
WF0_TOP_C : Aux Func.1
WF0_TOP_D : Aux Func.1
WF0_HB1   : Aux Func.3
WF0_HB2   : Aux Func.3
WF0_HB3   : Aux Func.3
WF0_HB4   : Aux Func.3
WF0_HB0   : Aux Func.3
WF0_HB0_B : Aux Func.1
WF0_HB5   : Aux Func.3
WF0_HB6   : Aux Func.1
WF0_HB7   : Aux Func.1
WF0_HB8   : Aux Func.1
WF0_HB9   : Aux Func.1
WF0_HB10  : Aux Func.1
WF1_DIG_R : Aux Func.1
WF1_CBA_R : Aux Func.1
WF1_XO_RE : Aux Func.1
WF1_TOP_C : Aux Func.1
WF1_TOP_D : Aux Func.1
WF1_HB1   : Aux Func.2
WF1_HB2   : Aux Func.2
WF1_HB3   : Aux Func.2
WF1_HB4   : Aux Func.2
WF1_HB0   : Aux Func.2
WF1_HB0_B : Aux Func.1
WF1_HB5   : Aux Func.2
WF1_HB6   : Aux Func.1
WF1_HB7   : Aux Func.1
WF1_HB8   : Aux Func.1
MT7986>
1 Like
87

I bricked my Zyxel by overwriting the first few bytes of mtdblock0.

I located the nand in the rear of the router.
The model is MT29F4G01ABAFD (4096+256OOB).
Would anyone be able to create a nand dump with OOB?

88

Thanks to @skyscreaper we were able to flash a new BL2 and a new FIP via sNANDER, but from the log it crashes here:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 021A [010F]
Jump to BL

NOTICE:  BL2: v2.7(release):v2.4-rc0-2957-g753934848
NOTICE:  BL2: Built : 09:52:34, Jul  7 2023
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0x2c
NOTICE:  Page size 4096, Block size 262144, size 536870912
NOTICE:  Initializing NMBM ...
NOTICE:  NMBM management region starts at block 1920 [0x1e000000]
NOTICE:  Bad block 15 [0x003c0000]
NOTICE:  Bad block 17 [0x00440000]
NOTICE:  NMBM has been initialized in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.7(release):v2.4-rc0-2957-g753934848
NOTICE:  BL31: Built : 09:52:34, Jul  7 2023

I am not allowed to write on the uart and no uboot shell appears

89

I fork git repo to add the normal u-boot support to this router.
https://github.com/ftp21/openwrt-ex5601-t0-ubootmod/tree/ubootmod
I can compile the build and the BL31 starts (the Bl2 does not start despite the correct settings as DDR4)
When I try to flash the sysupgrade, however, I receive this error:

Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-squashfs-sysupgrade.itb'.
Load address: 0x46000000
Loading: ##T ###############################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############################################################
         1.1 MiB/s
done
Bytes transferred = 17109813 (1051335 hex)

## Checking Image at 46000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-5.15.120
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x46001000
     Data Size:    12058632 Bytes = 11.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   3253dec3
     Hash algo:    sha1
     Hash value:   05f1418e86a2838263418088e3f23053322e7244
    Image 1 (fdt-1)
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-ubootmod device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46b82000
     Data Size:    24439 Bytes = 23.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   19c59ed6
     Hash algo:    sha1
     Hash value:   b6c79cb8f6275d410621a12df4c8b222a4c868a0
    Image 2 (rootfs-1)
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-ubootmod rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x46b88000
     Data Size:    5017600 Bytes = 4.8 MiB
     Hash algo:    crc32
     Hash value:   ba00613d
     Hash algo:    sha1
     Hash value:   009d787d308a8105a5b32ce81841ae32c30c556e
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt zyxel_ex5601-t0-ubootmod
     Kernel:       kernel-1
     FDT:          fdt-1
     Loadables:    rootfs-1
## Checking hash(es) for FIT Image at 46000000 ...
   Hash(es) for Image 0 (kernel-1): crc32+ sha1+
   Hash(es) for Image 1 (fdt-1): crc32+ sha1+
   Hash(es) for Image 2 (rootfs-1): crc32+ sha1+
Remove UBI volume fit (id 2)
Creating dynamic volume fit of size 17109813
17109813 bytes written to volume fit
Press ENTER to return to menu

        ( ( ( OpenWrt ) ) )       U-Boot 2023.04-OpenWrt-r23586-9a30af9bd6 (Jul 19 2023 - 09:10:01 +0000)

      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from NAND.
      4. Boot recovery system from NAND.
      5. Load production system via TFTP then write to NAND.
      6. Load recovery system via TFTP then write to NAND.
      7. Load BL31+U-Boot FIP via TFTP then write to NAND.
      8. Load BL2 preloader via TFTP then write to NAND.
      9. Reboot.
      a. Reset all settings to factory defaults.
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC to quit
No size specified -> Using max size (17268736)
Read 17268736 bytes from volume fit to 0000000046000000

## Checking Image at 46000000 ...
   FIT image found
Bad FIT image format!


EX5601> ubi read 0x46000000 fit
No size specified -> Using max size (17268736)
Read 17268736 bytes from volume fit to 0000000046000000
EX5601> iminfo

## Checking Image at 46000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-5.15.120
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x46001000
     Data Size:    12058632 Bytes = 11.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   3253dec3
     Hash algo:    sha1
     Hash value:   05f1418e86a2838263418088e3f23053322e7244
    Image 1 (fdt-1)
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-ubootmod device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46b82000
     Data Size:    24439 Bytes = 23.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   19c59ed6
     Hash algo:    sha1
     Hash value:   b6c79cb8f6275d410621a12df4c8b222a4c868a0
    Image 2 (rootfs-1)
     Description:  ARM64 OpenWrt zyxel_ex5601-t0-ubootmod rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x46b88000
     Data Size:    5017600 Bytes = 4.8 MiB
     Hash algo:    crc32
     Hash value:   ba00613d
     Hash algo:    sha1
     Hash value:   009d787d308a8105a5b32ce81841ae32c30c556e
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt zyxel_ex5601-t0-ubootmod
     Kernel:       kernel-1
     FDT:          fdt-1
     Loadables:    rootfs-1
## Checking hash(es) for FIT Image at 46000000 ...
   Hash(es) for Image 0 (kernel-1): crc32 error!
Bad hash value for 'hash-1' hash node in 'kernel-1' image node
Bad hash in FIT image!
EX5601>

----UPDATE---
BL2 solved by setting NAND_TYPE to spim:4k+256

90

Pull request for standard Uboot
https://github.com/openwrt/openwrt/pull/13143

1 Like
91

I own this device from a vendor, but seems i have a newer bootloader or somehow it's better protected using the serial cable, I can see the router booting like discribed in gpon.org.

Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level

then a bit later i get "Please press Enter to activate this console."

root (enter)

Then i see invalid login between the boot log and it continues

However it always asks for a password, perhaps you guys have more ideas!

Edit it seems this is the "Zyxel EX5601-T1" now you might wonder what is the difference? it seems the sfp module is not soldered on the board.

92

Can you please post full bootlog and picture of the device?

thanks

1 Like
93

@ftp21

Tagging you as you used an hardware flasher!

My device is vendor locked and the gpon trick using serial connection/webui is not working. Only way I can join the journey with all of you is to hardware flash around the restrictions.

I will pm you my boot log and images, perhaps you can help me replacing the bootloader?

Best Regards,

1 Like
94

With the help of @ftp21 I was able to flash the nand to openwrt bootloader. And it's running openwrt now!
Thanks for the efforts @ftp21!

2 Likes
95

Yes, the issue seems to be there. there is a phylink with both a phy-handle and a SFP. this causes some issues with opts callbacks.
Probably the way to go is create a custom PHY driver to handle this special case.

Yes but I've yet to see such a case where the PHY is in charge of switching the port.

I got some pictures of the HW from a friend (While I'm waiting to buy it).
The MUX chip is a DIO3350

It is used to mux the TX and RX pair between the MAC and the two PHY nothing fancy in the middle.

Since we now have the support for the mainline uboot what if we crete two overlays to configure the PHY and the SFP detection is run on the bootloader?
We will have to reboot using hotplug events in case a SFP is inserted or removed but this could make the whole process more complete while we try to contact the mainline devs. (I always had no luck with mailing list even here on openwrt)

In theory we could also hotswap the overlays in runtime but I'm not sure how the kernel will handle such change in ethenet section...

The other solution on a out of tree fork is to have the fixed-link and simply use the gpio.
But this to me is a no go if I want to use a 1000base device instead of the 2500base hardcoded one.

97

I've got the router, while we are waiting for the upstream processes about:

I've started to look into the DTSO to provide a basic switch functionality between the SFP and the RJ45.
I've started to poke around uboot, and I have a few questions:

  1. is it possible to use tftpboot + bootm and manually provide an DTS? I'm not sure how to to this on mtk but on some devices is possible by manually processing the device tree with the fdt command.
  2. is it possible to boot an u-boot binary with the same method above to test the patched u-boot from knwon working one?
  3. how are uboot configuration related to board files? What if I want to add a custom myboard.c to provide additional functionality?

@daniel I'm not sure if Maxime (mainline guy) CC you on his RFC about PHY numbering.

We have seen that the PCB also has a footprint for a zigbee chip.
So some changes might be needed if such variant is discovered in the wild.
I also dumped the SPI bus communication between the SOC and the SLIC IC. Maybe we could do a simple reply attack to start to understand how it work.

Some reverse I've done for the GPIOs can be found here:

I'll have to see if I still have the wiki account to properly create a page over there.
I used to have one before the LEDE/Openwrt fork.

98

I have some small update about this:
While I still cannot find a way to use the fdt command, but I've found a way to build a my-board.c file.
I'm not 100% sure it is running on boot.

I also have found a way to boot u-boot via OEM u-boot using tftp, it is probably not the best way but:

MT7986> tftpboot u-boot.bin #this is taken from the build_dir
MT7986> go 0x46000000

Another big question now is the following error: Warning: ethernet@15100000 (eth0) using random MAC address - 3e:a1:90:40:51:aa. Now this should be possible to solve by passing an nvram cell to the eth driver so what I've done is to add the nodes to the u-boot dts:

&eth {
       mediatek,switch = "mt7531";
       mediatek,gmac-id = <0>;
       reset-gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
       phy-mode = "sgmii";
       status = "okay";

+      nvmem-cells = <&macaddr_factory_002a>;
+      nvmem-cell-names = "mac-address";

       fixed-link {
                       speed = <1000>;
                       full-duplex;
       };
};
...
...
               partitions {
                       compatible = "fixed-partitions";
                       #address-cells = <1>;
                       #size-cells = <1>;

                       partition@0 {
                               label = "bl2";
                               reg = <0x0 0x100000>;
                       };

                       partition@100000 {
                               label = "u-boot-env";
                               reg = <0x0100000 0x0080000>;
                       };

-                     partition@180000 {
+                     factory: partition@180000 {
                               label = "factory";
                               reg = <0x180000 0x0200000>;
                       };

                       partition@380000 {
                               label = "fip";
                               reg = <0x380000 0x0200000>;
                       };

                       partition@540000 {
                               label = "zloader";
                               reg = <0x540000 0x0040000>;
                               read-only;
                       };
                       partition@580000 {
                               label = "ubi";
                               reg = <0x580000 0x1da80000>;
                       };
               };
...
...
+&factory {
+       #address-cells = <1>;
+       #size-cells = <1>;
+
+       macaddr_factory_0004: macaddr@0004 {
+               reg = <0x0004 0x6>;
+       };
+
+       macaddr_factory_0024: macaddr@0024 {
+               reg = <0x0024 0x6>;
+       };
+
+       macaddr_factory_002a: macaddr@002a {
+               reg = <0x002a 0x6>;
+       };
+};

Unfortunatly this didnt seem to have solved the issue.
In fact I'm probably missing something to have it working, I have to find a proper way to print debug stuff.
But I have a find a way to properly enable debug yet.

Another thing that seems to be broken is the GPIO_HOG feature by launching gpio status:

EX5601>gpio status
Bank mt7986_pinctrl:
mt7986_pinctrl5: output: 1 [x] ethernet@15100000.reset-gpios
mt7986_pinctrl12: output: 1 [x] red_pwr.gpios
mt7986_pinctrl13: output: 0 [x] green_pwr.gpios
mt7986_pinctrl21: input: 1 [x] reset.gpios
EX5601>

What I've done to try to enable the gpios as inputs was to do, probably its not the right syntax?

+&gpio {
+       sfp_presence {
+               gpio-hog;
+               input;
+               gpios = <57 GPIO_ACTIVE_LOW>;
+       };
+
+       sfp_mux {
+               gpio-hog;
+               output-low;
+               gpios = <10 GPIO_ACTIVE_LOW>;
+       };
+};

I probably have to add a label so it can be picked up from the custom board.c file.
I need the two gpios to be working so that I can load the correct DTO during boot.

If you guys have any suggestion I will accept them :rofl:

You can find the full patch here:u-boot DTS

99

Hi guys,
can anybody help me getting openwrt on this router? Apparently I have the same device ( Zyxel EX5601-T1 / t-mobile branding) as of YummyHamster, has no sfp module onboard and it behaves the same on booting, requests a password upon interrupting the boot process.

100

Can you capture the full bootlog and post it on something like pastebin? So we can see if the message is really missing or not.

Anyway see if you can access via ssh or telnet with admin user to disable the firmware check and flash the Zyxel rooted firmware you can find on hack-gpon/Zyxel.

101

hi there,
I have the same problem as you had. Vendor locked (t-mob) and none of the tricks are working so far. May I ask you the process you followed to get openwrt on ?

102

You can do it with a rasberry pi and a flash clip, if you like to go this route I can send you more info.

  1. We create a backup of all partitions using flash clip.
  2. We flash the new firmware using the flash clip.

This is the only method for now getting branded t-mobile device to work.

103

ok this seems like a dead end for me. I don’t have the gear for flashing, just a usbttl adapter for serial comm. I guess buying a RPi defeats the purpose ( financially). A side question, since you are using this wifi6 device: does it have a good wireless coverage ? The plan is to replace my R7800 devices.

Edit;
on other thoughts, can you post the process steps (incl commands) ? I might be able to lend a RPi or a GPIO board around here. ( I guess the GPIO part is important)

104

Hi I am also interested in getting openwrt on the EX5601-T1 device. Vendor locked tmobile can you send more info thanks!