Porting to ZyXEL NWA50AX

Hello, I'm interested in porting OpenWRT to the ZyXEL NWA50AX (after breaking the stock firmware by following their factory reset instructions :/)

I'm a relative newbie when it comes to building for OpenWRT so please don't hound me for silly mistakes :stuck_out_tongue: .

Main SOC: Mediatek MT7621AT
WiFi: Mediatek MT7975DAN/MT7975DN
NAND: 128MB Macronix MX30LF1G28AD-TI
RAM: 128MB Nanya NT5CC128M16JR-EK DDR3 933

Currently, I've been using the externally exposed console header to poke around.

I haven't been able to get as much information however, because ZyXEL decided to replace Busybox with their own custom ZySH which only comes with configuration commands. I have sent for a copy of their open source code, which I hope, like other ZyXEL routers will let me replace the ZySH binary with a symlink to Busybox.

Stock FW flash & boot
U-Boot SPL 2018.09 (Jan 22 2021 - 07:42:43 +0000)
Trying to boot from NAND

Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached


U-Boot 2018.09 (Jan 22 2021 - 07:42:43 +0000)

CPU:   MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 600MHz (1200MT/s), Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM:  256 MiB
NAND:  128 MiB

Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

Loading Environment from NMBM... *** Warning - bad CRC, using default environment

In:    uartlite0@1e000c00
Out:   uartlite0@1e000c00
Err:   uartlite0@1e000c00
Net:   
Warning: eth@1e100000 (eth0) using random MAC address - fa:26:d7:78:e2:6c
eth0: eth@1e100000
Reading from 0x7700000, size 0x20000
Succeeded
Zyxel version:V1.03
gpio: pin 6 (gpio 6) value is 1
gpio: pin 24 (gpio 24) value is 0
gpio: pin 24 (gpio 24) value is 1
Hit any key to stop autoboot:  0 
=> help     
Unknown command 'help' - try 'help'
=> help
Unknown command 'help' - try 'help'
=> ?
?       - alias for 'help'
at      - print OK
atds    - show dual image info
atgo    - boot
athe    - show available commands
atna    - set board IP for tftp
atnf    - set filename for tftp
atns    - set server IP for tftp
atnz    - do firmware update via tftp
atsh    - dump Manufacturer Related Data (MRD)
atsr    - reboot
=> atsh
Vendor name           : Zyxel Communications Corp.
Product model         : NWA50AX
System type           : 10
MAC address           : b8eca3dcxxxx
Default country code  : ed
Boot module debug flag: 0
Hardware version      : Zyxel NWA50AX MT7621
Serial number         : xxx
SNMP MIB level & OID  : xxx
Main feature bit      : 0
Other feature bits    : e1 6b 00 00 00 00 00 00 00 00 88 00 00 00 00 00
                        03 00 00 00 00 00 00 00 00 00 00 00 00 00 
MRD recovery flag     : 0
=> atds
Image0 status           :success
Image1 status           :success
Boot Image              :Image0
=> athe
?       - alias for 'help'
at      - print OK
atds    - show dual image info
atgo    - boot
athe    - show available commands
atna    - set board IP for tftp
atnf    - set filename for tftp
atns    - set server IP for tftp
atnz    - do firmware update via tftp
atsh    - dump Manufacturer Related Data (MRD)
atsr    - reboot
=> atna 192.168.1.3
=> atnf 625ABYW10C0.bin
=> atns 192.168.3.1 
=> atnz
Using eth@1e100000 device
TFTP from server 192.168.3.1; our IP address is 192.168.1.3
Filename '625ABYW10C0.bin'.
Load address: 0x83000000
Loading: ## Warning: gatewayip needed but not set
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########
         8.5 MiB/s
done
Bytes transferred = 28734029 (1b6724d hex)
## Executing script at 83000000
sha256+  
Flashing Bootloader:                    [  skipped!  ]
Flashing u-boot-env:                    [  skipped!  ]
Flashing firmware:                      [    done    ]
Flashing firmware_1:                    [    done    ]
Flashing rootfs_data:                   [  skipped!  ]
Flashing logs:                          [  skipped!  ]
Flashing myzyxel:                       [  skipped!  ]
Flashing bootconfig:                    [  skipped!  ]
Flashing mrd:                           [  skipped!  ]
=> atgo
Loading FIT image at offset 0x180000 to memory 0x83000000, size 0x388d90 ...
Automatic boot of image at addr 0x83000000 ...
## Loading kernel from FIT Image at 83000000 ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  MIPS OpenWrt Linux-4.4.198
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x830000e4
     Data Size:    3692204 Bytes = 3.5 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x81001000
     Entry Point:  0x81001000
     Hash algo:    crc32
     Hash value:   17e52f98
     Hash algo:    sha1
     Hash value:   e5234a83798af59a0f3da667443a705ec30f7bba
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 83000000 ...
   Using 'config@1' configuration
   Trying 'fdt@1' fdt subimage
     Description:  MIPS OpenWrt mt7621-rfb-ax-nmbm device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x833858d4
     Data Size:    12690 Bytes = 12.4 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   22dfdc4b
     Hash algo:    sha1
     Hash value:   1d76e5da661e6d2a8eafb4175232705f43e4132c
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x833858d4
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 8fe67000, end 8fe6d191 ... OK
[    0.000000] Linux version 4.4.198 (jenkins@TWPCNT01055-95) (gcc version 5.4.0 (LEDE GCC 5.4.0 r48+2-a5857a0e) ) #0 SMP Thu Jun 16 17:53:32 UTC 2022
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is MediaTek MT7621 RFB (802.11ax, NAND with NMBM)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] CPU Clock: 1000MHz

Got LINK_CHANGE
Port [0] Copper is up --> Group [0] is up
Start EnterpriseWLAN system daemon....
........................
Got LINK_CHANGE
Port [0] Copper is down --> Group [0] is down
.......................................Applying system configuration file, please wait...
................................................. 
Got LINK_CHANGE
Port [0] Copper is up --> Group [0] is up
ifanme=br0
ifanme=br0
................................EnterpriseWLAN system is configured successfully with startup-config.conf
netopeer-server start

Welcome to NWA50AX

Username: admin
Password: 
Router> reboot
% EnterpriseWLAN is going to reboot!

I tried adding a target for this device using the limited information I do know, however I'm clearly doing something wrong as it doesn't boot.

target/linux/ramips/dts/mt_7621_zyxel_nwa50ax.dts
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

#include "mt7621.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/ {
	compatible = "zyxel,nwa50ax", "mediatek,mt7621-soc";
	model = "ZyXEL NWA50AX";

	//aliases {
	//	led-boot = &led_sys;
	//	led-failsafe = &led_sys;
	//	led-running = &led_sys;
	//	led-upgrade = &led_sys;
	//	label-mac-device = &gmac0;
	//};

	chosen {
		stdout-path = "serial0:115200n8";
		bootargs = "console=ttyS0,115200n8";
	};
/*
	leds {
		compatible = "gpio-leds";

		led_sys: sys {
			label = "blue:sys";
			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
		};
	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
			debounce-interval = <60>;
			linux,code = <KEY_RESTART>;
		};
	};*/
};

&nand {
	status = "okay";

	partitions {
		compatible = "fixed-partitions";
		#address-cells = <1>;
		#size-cells = <1>;

		partition@0 {
			label = "Bootloader";
			reg = <0x0 0x80000>;
			read-only;
		};

		partition@80000 {
			label = "Config";
			reg = <0x80000 0x80000>;
		};

		factory: partition@100000 {
			label = "Factory";
			reg = <0x100000 0x80000>;
			read-only;
		};

		partition@180000 {
			label = "kernel";
			reg = <0x180000 0x400000>;
		};

		ubiconcat0: partition@580000 {
			label = "ubiconcat0";
			reg = <0x580000 0x1c00000>;
		};

		partition@2180000 {
			label = "firmware_backup";
			reg = <0x2180000 0x2000000>;
		};

		partition@4180000 {
			label = "rootfs_data_back";
			reg = <0x4180000 0x80000>;
			read-only;
		};

		partition@4200000 {
			label = "nvram_config";
			reg = <0x4200000 0x80000>;
			read-only;
		};

		ubiconcat1: partition@4280000 {
			label = "ubiconcat1";
			reg = <0x4280000 0x3d00000>;
		};

		/*
		 * last 512 KiB are for the bad block table
		 */
	};
};


&pcie {
	status = "okay";
};

&pcie1 {
	wifi@0,0 {
		compatible = "mediatek,mt76";
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&factory 0x0000>;
	};
};

/*&gmac0 {
	nvmem-cells = <&macaddr_factory_e000>;
	nvmem-cell-names = "mac-address";
};*/

&switch0 {
	ports {
		port@0 {
			status = "okay";
			label = "wan";
			/*nvmem-cells = <&macaddr_factory_e006>;
			nvmem-cell-names = "mac-address";*/
		};
	};
};

&state_default {
	gpio {
		groups = "i2c", "wdt";
		function = "gpio";
	};
};
/*
&factory {
	compatible = "nvmem-cells";
	#address-cells = <1>;
	#size-cells = <1>;

	macaddr_factory_e000: macaddr@e000 {
		reg = <0xe000 0x6>;
	};

	macaddr_factory_e006: macaddr@e006 {
		reg = <0xe006 0x6>;
	};
};
*/
target/linux/ramips/image
define Device/zyxel_nwa50ax
  $(Device/dsa-migration)
  BLOCKSIZE := 128k
  PAGESIZE := 2048
  KERNEL_SIZE := 4096k
  UBINIZE_OPTS := -E 5
  IMAGE_SIZE := 32448k
  DEVICE_VENDOR := ZyXEL
  DEVICE_MODEL := NWA50AX
  DEVICE_PACKAGES := kmod-mt7915e
  KERNEL := $(KERNEL_DTB) | uImage lzma | uimage-padhdr 160
  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata

endef
TARGET_DEVICES += zyxel_nwa50ax
Error
=> atnz
Using eth@1e100000 device
TFTP from server 192.168.3.1; our IP address is 192.168.1.3
Filename 'openwrt-ramips-mt7621-zyxel_nwa50ax-initramfs-kernel.bin'.
Load address: 0x83000000
Loading: ## Warning: gatewayip needed but not set
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #########
         10 MiB/s
done
Bytes transferred = 5849329 (5940f1 hex)
## Executing script at 83000000
Bad header crc
=> atna 192.168.1.3
=> atns 192.168.3.1
=> atnf openwrt-ramips-mt7621-zyxel_nwa50ax-squashfs-sysupgrade.bin
=> atnz
Using eth@1e100000 device
TFTP from server 192.168.3.1; our IP address is 192.168.1.3
Filename 'openwrt-ramips-mt7621-zyxel_nwa50ax-squashfs-sysupgrade.bin'.
Load address: 0x83000000
Loading: ## Warning: gatewayip needed but not set
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##################
         8.7 MiB/s
done
Bytes transferred = 5981237 (5b4435 hex)
## Executing script at 83000000
Wrong image format for "source" command

I've added support for this particular board a while back (see my staging tree), just did not yet came around to push it to master.

https://git.openwrt.org/?p=openwrt/staging/blocktrron.git;a=summary

1 Like

It's great to hear that there's been work on this device, I wasn't aware of it before creating this thread. I did build this and install it on my device, however I wasn't able to get LuCI working (I don't trust myself with the command line for much over the basics) so I wasn't able to test much other than it being able to connect to the network.

Master has LuCI disabled by default, so if you compile yourself you need to enable it manually.

I did try to enable it (opkg install didn't work, wasn't in menuconfig and trying to use the imagebuilder failed installing luci, kmod-mt7915e & uboot-envtools)

Does anyone reckon I should go and make a deviceinfo page for this device as there seems to be at least, some, developer interest

Any device that gets ported by a developer is a device worth buying, often. Except when it's Broadcom :wink:.

I noticed WiFi isn't working on this version? Is this to be expected or is there an issue. I did manually try and enable the mt7621 driver in menuconfig but still no dice

EDIT: It would help to install the right (kmod-mt7915e) driver.

Here are my built images

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.