Hello valued OpenWRT Community,
i am trying to make OpenWRT run on an Zyxel LTE3302. Initially I thought, the LTE3302 might be closely related to the Zyxel LTE3301 which is supported by OpenWRT. However it turns out that the LTE3302 has a completely different hardware from the LTE3301 in terms of SOC used, flash and so on.
Well then, I thought, challenge accepted - lets port the LTE3302 to make it use OpenWRT.
The device uses a MediaTek MT7620N, a 16M SPI flash, a couple of GPIOs for LEDs/buttons and USB for the internal LTE modem. So far so good. Bootloader is Amit Jboot - not uboot which would be really nice...
This adds a little bit more complexity but still, I thought this should be doable...
So my first try was to desolder the SPI flash, get a backup and try to get uboot running on the device. ... I am speeding things up a little bit here: In the end I haven't been successful to get a running uboot on the device. So yeah, then I need to stay a Jboot...
Luckily Jboot is supported through a loader in OpenWRT. I figured out the the hardware seems to be quite the same as in the DLink DWR-921-c1 in terms of soc, flash, count of buttons, leds and so on. The loader has some sort of crappy html recovery like the Dlink. I was able to create a working firmware of OpenWRT by basically using the definitions from the dlink device combined with some observations and information taken from my flash dump.
This is my local addon to the mt7620.mk file:
define Device/zyxel_lte3302
$(Device/amit_jboot)
SOC := mt7620n
IMAGE_SIZE := 16064k
DEVICE_VENDOR := ZyXEL
DEVICE_MODEL := LTE3302
DLINK_ROM_ID := ZXL6E2431002
DLINK_FAMILY_MEMBER := 0x6E24
DLINK_FIRMWARE_SIZE := 0xFB0000
DEVICE_PACKAGES += kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
endef
TARGET_DEVICES += zyxel_lte3302
using this in combination with a more or less dummy dts and some addings to the leds and network config, i got a firmware image and was able to flash that to the device.
this is the dts i am using:
#include "mt7620n.dtsi"
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/mtd/partitions/uimage.h>
/ {
compatible = "zyxel,lte3302", "ralink,mt7620n-soc";
model = "Zyxel LTE3302-M432";
};
&spi0 {
status = "okay";
flash@0 {
compatible = "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <10000000>;
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;
partition@0 {
label = "jboot";
reg = <0x0 0x10000>;
read-only;
};
partition@10000 {
compatible = "openwrt,uimage", "denx,uimage";
openwrt,ih-magic = <IH_MAGIC_OKLI>;
openwrt,offset = <0x10000>;
label = "firmware";
reg = <0x10000 0xfd0000>;
};
config: partition@ff0000 {
label = "config";
reg = <0xfeffff 0x10000>;
read-only;
};
};
};
};
&ehci {
status = "okay";
};
&ohci {
status = "okay";
};
&state_default {
default {
groups = "spi refclk", "i2c", "ephy", "wled";
function = "gpio";
};
};
I am not really good at writing dts code, to be honest i don't even understand parts of what is there...
But, to my surprise the image was booting, which is really great.
Since I don't already know the correct dts definitions regarding flash, leds, network (mac data) and so on and the original firmware which came with the device was build on kernel 2.6 and has no usable /dev or /sys information my initial goal was to get my OpenWRT image running on the initial ramdisk / initramfs in failsafe mode and then try to poke around and find out things. However I was not able to get the image to work due to some issue with the busybox init...
This is my current bootlog status:
CDG562ZY_0T3 Jboot B1204
JRecovery Version R1.2 2017/05/25 20:17
spi device id: ef 40 18 0 0 (40180000)
SPI FLASH: W25Q128FV 16M
.
...
Starting kernel @80000000...
OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Looking for OpenWrt image... found at 0xbc020000
Decompressing kernel... done!
Starting kernel at 80000000...
[ 0.000000] Linux version 5.15.167 (compile@phoebe) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24106-10cc5fcd00) 12.3.0, GNU ld (GNU Binutils)
2.40.0) #0 Mon Sep 23 12:34:46 2024
[ 0.000000] Board has DDR2
[ 0.000000] Analog PMU set to hw control
[ 0.000000] Digital PMU set to hw control
[ 0.000000] SoC Type: MediaTek MT7620N ver:2 eco:6
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[ 0.000000] MIPS: machine is Zyxel LTE3302-M432
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240
[ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] Writing ErrCtl register=0007fff0
[ 0.000000] Readback ErrCtl register=0007fff0
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 56100K/65536K available (5506K kernel code, 602K rwdata, 1180K rodata, 1216K init, 213K bss, 9436K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] CPU Clock: 580MHz
[ 0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[ 0.000000] systick: enable autosleep mode
[ 0.000000] systick: running - mult: 214748, shift: 32
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[ 0.000002] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[ 0.015556] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[ 0.087773] pid_max: default: 32768 minimum: 301
[ 0.098087] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.112511] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.135534] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.155043] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.168745] pinctrl core: initialized pinctrl subsystem
[ 0.180410] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.212382] rt2880_gpio 10000600.gpio: registering 24 gpios
[ 0.223425] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[ 0.238243] clocksource: Switched to clocksource systick
[ 0.250435] NET: Registered PF_INET protocol family
[ 0.260338] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.275508] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.292277] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.307595] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.322839] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.336857] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.349687] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.362622] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.376909] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.388146] PCI: CLS 0 bytes, default 32
[ 0.396086] rt-timer 10000100.timer: maximum frequency is 1220Hz
[ 0.413285] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[ 0.432802] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.444336] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.467476] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.481369] printk: console [ttyS0] disabled
[ 0.489905] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[ 0.509553] printk: console [ttyS0] enabled
[ 0.509553] printk: console [ttyS0] enabled
[ 0.526120] printk: bootconsole [early0] disabled
[ 0.526120] printk: bootconsole [early0] disabled
[ 0.560634] spi spi0.0: force spi mode3
[ 0.569692] spi-nor spi0.0: w25q128 (16384 Kbytes)
[ 0.579392] 3 fixed-partitions partitions found on MTD device spi0.0
[ 0.592114] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[ 0.606746] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[ 0.621640] Creating 3 MTD partitions on "spi0.0":
[ 0.631238] 0x000000000000-0x000000010000 : "jboot"
[ 0.643897] 0x000000010000-0x000000fe0000 : "firmware"
[ 0.778786] 2 uimage-fw partitions found on MTD device firmware
[ 0.790641] Creating 2 MTD partitions on "firmware":
[ 0.800546] 0x000000000000-0x00000023c38e : "kernel"
[ 0.810441] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[ 0.828468] 0x00000023c38e-0x000000fd0000 : "rootfs"
[ 0.838419] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 0.859947] mtd: setting mtd3 (rootfs) as root device
[ 0.870347] 1 squashfs-split partitions found on MTD device rootfs
[ 0.882709] 0x000000340000-0x000000fd0000 : "rootfs_data"
[ 0.894905] 0x000000feffff-0x000000ffffff : "config"
[ 0.936983] gsw: setting port4 to ephy mode
[ 0.945549] mtk_soc_eth 10100000.ethernet: generated random MAC address 8a:4e:af:28:ec:15
[ 0.961890] mtk_soc_eth 10100000.ethernet: no mdio-bus child node found
[ 0.975072] mtk_soc_eth 10100000.ethernet: mdio-bus disabled
[ 0.986564] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[ 0.999188] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[ 1.016473] rt2880_wdt 10000120.watchdog: Initialized
[ 1.028526] NET: Registered PF_INET6 protocol family
[ 1.045779] Segment Routing with IPv6
[ 1.053274] In-situ OAM (IOAM) with IPv6
[ 1.061303] NET: Registered PF_PACKET protocol family
[ 1.071484] 8021q: 802.1Q VLAN Support v1.8
[ 1.082074] clk: Disabling unused clocks
[ 1.113212] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[ 1.134019] Freeing unused kernel image (initmem) memory: 1216K
[ 1.145848] This architecture does not have kernel memory protection.
[ 1.158709] Run /sbin/init as init process
[ 1.177247] Run /etc/init as init process
[ 1.185653] Run /bin/init as init process
[ 1.193982] Run /bin/sh as init process
[ 1.201891] Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[ 1.230151] Rebooting in 1 seconds..
I went through the whole build process and verified that the initramfs is there and contains the busybox init. I even binwalked the binary to see if it is there. It is definitely there! I tried passing kernel cmdline parameters via the dts but that did not help. I tried changing the dts partition layout also without any luck. I tried to flash the initramfs-kernel image, which succeeds after some modifications using the mkdlinkfw tool. However then the kernel complains that the initramfs is not there or empty... damn...
So, either I figure out, why there the kernel does not find the init binary or I try to get the initramfs working. For both possible solutions I need your community support, cause I have no idea as of why both errors occur. Thanks in advance for looking at and reading through this very long forum post....
I suspect the OpenWRT JBoot loader might not be extracting kernel + initramfs from the flash, but I was not able to find something...
Does anybody have an idea what I can do make the device use the initramfs?
