OpenWrt support for Zyxel PMG5617GA, first GPON support !?

For Developers
143

the telcos have all but abandoned the original GPON and EPON protocols, and there aren't a lot of use cases where building a 1-2 Gb/s PON makes sense.

In India, 99% of wired broadband (FTTH) still uses GPON technology. and one of the Largest ISP Jiio uses en751221 in their router ( see https://github.com/fawazahmed0/Jio-fiber-Modem/discussions/2)

144

Update re the archer VR1200v.

  • GPL Code (thank you to TP-Link!)
  • Flash dumps
  • Update files (added for completeness)

It's basically the same thing as the EN7526, but as I had feared, they did play with the bootloader, the header on top of the kernel/rootfs is not the same, it's 512 bytes as follows:

001c0000: 03000003 8835f03e 9f2c679f 0642245e  .....5.>.,g..B$^
001c0010: 06da230a 22011719 89101177 8899aabb  ..#."......w....
001c0020: ccddeeff f46f5483 f794464c a3ddfac9  .....oT...FL....
001c0030: 47101b98 0b473502 0006007c 00000000  G....G5....|....
001c0040: 00000000 00000000 00000000 00000000  ................
001c0050: 00000000 55aa55aa f1e2d3c4 e5a66a5e  ....U.U.......j^
001c0060: 4c3d2e1f aa55aa55 80002000 80006530  L=...U.U.. ...e0
001c0070: 01e40000 00000200 0015d9d9 00800000  ................
001c0080: 00f7f66d 00000000 00000000 55aa0100  ...m........U...
001c0090: a5030104 00000001 bbd16dea ffffffff  ..........m.....
001c00d0: 00000000 00000000 00000000 00000000  ................
001c00e0: 00000000 00000000 00000000 00000000  ................
001c00f0: 00000000 00000000 00000000 00000000  ................
001c0100: 00000000 00000000 00000000 00000000  ................
001c0110: 00000000 00000000 00000000 00000000  ................
001c0120: 00000000 00000000 00000000 00000000  ................
001c0130: 00000000 00000000 00000000 00000000  ................
001c0140: 00000000 00000000 00000000 00000000  ................
001c0150: 00000000 00000000 00000000 00000000  ................
001c0160: 00000000 00000000 00000000 00000000  ................
001c0170: 00000000 00000000 00000000 00000000  ................
001c0180: 00000000 00000000 00000000 00000000  ................
001c0190: 00000000 00000000 00000000 00000000  ................
001c01a0: 00000000 00000000 00000000 00000000  ................
001c01b0: 00000000 00000000 00000000 00000000  ................
001c01c0: 00000000 00000000 00000000 00000000  ................
145

xc220-g3v GPL-Code. EN7528

1 Like
146

Maybe it's tpkernel.bin header

147

In fact I was able to reverse engineer the header a couple of days ago and I made an image which boots on the TP-Link. I will update my PR with the code for this soon, but FYI this is the section of script that generates the header:

tplink_hdr() {
    # Version
    printf '03000003\n'

    # signature_1 Almost certainly not necessary, will zero later
    printf '8835f03e9f2c679f0642245e06da230a2201171989101177\n'

    # signature_2 is not present.

    # chip_id Almost certainly unnecessary
    printf '8899aabbccddeeff\n'

    # board_id almost certainly unnecessary
    printf 'f46f5483f794464ca3ddfac947101b98\n'

    # product_id
    printf '0b473502\n'

    # product_ver
    printf '0006007c\n'

    # reserved
    printf '00000000\n'

    # image validation md5 (we're just a kernel/rootfs, so it's zero)
    head -c 16 /dev/zero | to_hex

    # pad
    printf '00000000\n'

    # kernel validation md5 (nobody checks, so we will zero this later)
    printf '55aa55aaf1e2d3c4e5a66a5e4c3d2e1f\n'

    # pad
    printf 'aa55aa55\n'

    # Load address (CONFIG_ZBOOT_LOAD_ADDRESS)
    printf '80020000\n'

    # Entrypoint
    printf '80020000\n'

    # Length of header + kernel + rootfs + padding
    printf '%08x\n' "$total_len"

    # Length of the header
    printf '%08x\n' "$HDRLEN"
    
    # kernel length
    printf '%08x\n' "$kernel_len"

    # Start of the rootfs (technically start of the padding, but the bootloader doesn't care)
    printf '%08x\n' "$header_plus_kernel_len"

    # rootfs length (padded)
    printf '%08x\n' "$padded_rootfs_len"

    # bootloader offset (unused, not present)
    printf '00000000\n'

    # bootloader length (unused, not present)
    printf '00000000\n'

    # Past the end of what is common with the tpLinuxTag.h structure

    # pad
    printf '55aa\n'

    # version number not sure what this is
    printf '0100\n'

    # board id (?)
    printf 'a5030104\n'

    # board id 2 (?)
    printf '00000001\n'

    # crc32 of the content
    trx_crc32

    # 52 bytes of ff
    head -c 52 /dev/zero | to_hex | tr '0' 'f'

    # 256 bytes of zero
    head -c 256 /dev/zero | to_hex

    # 48 bytes of ff
    head -c 48 /dev/zero | to_hex | tr '0' 'f'
}
2 Likes
148

I have a few updates on the project:

  1. TP-Link uses a signed update file, and we of course don't have the signing key so installing from the factory UI is a no-go. There is an SSH and the password is just the password you configure in the UI, but there's a problem getting to a shell, so more is needed there. In any case, it's doubtful the ssh user ("dropbear") will have permission to write an OS to the disk.
  2. In any case, OpenWRT runs perfectly well on the device (EN7513G), and as far as I can tell all of the drivers are the same as the EN7526G.
  3. I was able to fix the write issue with the SPI controller, so we now have NAND read and write.
  4. I began an investigation of Ethernet, and it's a pain as I had imagined.

EN75 Ethernet

Airoha has a driver which supports the eth device in the AN7581, this is similar but not identical to the EN751221 ethernet. As described in the beginning of the patch, the driver consists of 3 main components:

  • The core frame engine (FE) / PPE / PSE
  • A "GDM" component corresponding to each of outgoing peripherals (ETH ports)
  • A "QDMA" (QoS/DMA) component corresponding to each of the data paths between the eth subsystem and the CPU (eth0, eth1, ...)

This all seems very generic like as if the FE is a big switch, but the reality of the code I've seen is more that the FE is configured so that QDMA0 binds to GDM0 which goes to the LAN switch, and QDMA1 binds to GDM1 which goes to the fiber subsystem and the whole FE / PPE / PSE is mostly ignored.

Now the good, the bad, and the ugly:

  • As far as I can tell, the FE/PPE/PSE and the GDM registers are all the same between EN751221 and AN7581.
  • EN751221 only has 2 GDMs, not 4. The Airoha driver doesn't (currently) really use GDM{2,3} but it does a little bit of setup and teardown on them which would need some small updates.
  • Unfortunately, the QDMA subsystem seems to be entirely reinvented for AN7581, probably because it's 10Gb instead of 1Gb. Anyway, there are a lot more registers on the '81 and the register layout is completely reinvented from scratch, nothing lines up.

So any effort to get a good quality ethernet driver will first require bifurcating the QDMA driver from the ethernet driver and then writing QDMA driver for the older chips.

And regarding the effort to get this into OpenWRT, a maintainer suggested I submit it to the Linux kernel. It doesn't feel right sending less than enough to boot to a shell with initramfs, so I'm going to have to send at least intc driver, clocksource driver, and main arch directory upstream. So, wish me luck...

4 Likes
149

I've pushed an update to the pull req which fixes flash support and adds support for TP-Link Archer VR1200v (v2) and a Generic EN751221 / Initramfs image that can be booted from memory for debugging, testing, debricking, or just dumping the flash through hexdump / serial.

Builds are here: https://github.com/cjdelisle/OpenWRT-EN751221-Builds/releases/latest

150

Very nice. So is it only the xPON and Ethernet missing?

151

Missing is: XPON / DSL (depending on SoC), Ethernet, USB, PCIe (wifi), and (bonus) SLIC VoIP.

I think USB and PCIe will be pretty easy :crossed_fingers: and Ethernet will be pretty hard. XPON, DSL, and VoIP are unknowns, but the XPON and (I believe) DSL are internally "plugged in to an ethernet port" so not even worth investigating until Ethernet is done.

152

I found a nice kernel of soc econet en75. I don't know if Arm is easier than Mips but it has a better implementation kernel

153

Nice find, especially useful because it includes a config for EN7580 which would be nice to support in the longer term.

154

I've started a wiki for collecting information about the effort to port mainline Linux to EcoNet SoCs: https://econet-linux.pkt.wiki/

3 Likes
155

Very nice. I guess that's where we can also create and publish .dts files for different router configurations. By the way, there is already a list of chipsets and routers available here: https://wikidevi.wi-cat.ru/EcoNet

1 Like
156

It might be better to just add the DTS files to https://github.com/cjdelisle/openwrt/tree/new-platform-en75 and do builds for the devices. I'm torn about whether to move device pages over, or to just keep them on openwrt.org, thinking the latter is probably better. But SoCs and specific hardware / drivers are ideal candidates to be documented on econet-linux.

157

@alexceltare2 This is still work-in-progress, but I'm building a research lab where I'll be able to host up to 16 modems. So soon, I'll be able to accept EN7516, EN7521, and EN7527 devices to add to my current EN7513, EN7520, EN7526.

If you send me one, I can't promise you any kind of timeline for when I'll get to developing on it, but I will at least be able to set it up and make it available to you via ssh to a tty, plus a command to trigger the power cycle relay. My goal is to have them doing automated testing of each kernel build.

image
image1600×1200 204 KB

8 Likes
158

wow, that is seriously nerdy ...

159

This guy labs. Well done.

1 Like
160

You can thank my wife for the braid in the power lines.

2 Likes
161

Impressive setup. Well done

1 Like
162

Patchset submitted to the kernel guys :crossed_fingers:

If you want to take a look:

https://lore.kernel.org/linux-mips/20250321134633.2155141-1-cjd@cjdns.fr/T/#t
or
https://patchwork.kernel.org/project/linux-mips/list/?series=946267

Depending on how you prefer to read it.

If anyone here is capable / motivated to build a kernel, please let me know and I will put together some testing instructions. Getting a Tested-By line on the mailing list will certainly help build confidence with the kernel devs.

6 Likes