ZTE ZXHN H118Na (HW ver 2.3) - Possible OpenWrt flash

For Developers
1

Hello i have the same router like the (picture - inc. wire), is there any way to dump old firmware via pc, if not can i flash the device with OpenWrt software?

Information about motherboard:

ZTE ZXHN H118Na (HW ver 2.3)
		Main board: ZXV10 H108La / ZXHN H118Na
		CPU: Realtek RTL8676S (@450MHz)
		Flash: Winbond W25Q128FVSG (16MB)
		RAM: RTL8676S (int. SDRAM 32MB)
		WLAN: Realtek RTL8192ER (2T2R)

Other info (here)

Edit: I`am very sorry if i'am in the wrong section, please correct me in the right one.
Thanks in advance Martin.

2

RTL8676S = Lexra LX5280 architecture

SoCs of the Lexra Architecture are not supported by OpenWrt since years. If you want OpenWrt support for a device with such a SoC, you have to add it yourself. See below how to do that.

OpenWrt documentation

External sources

Forum discussions

Search the OpenWrt forum for Lexra support status

From Programing for new device - #14 by mk24 :

Lexra is not supported directly by gcc like MIPS, ARM, x86 etc. are. This means that even compiling the first line of C code requires a lot of modification to the system.

Also Realtek does not have good open wifi drivers.

From Building OpenWRT for RTL8196C - #4 by mk24 :

The first big problem is that the Lexra CPU core found in these chips isn't one of the platforms directly selectable in gcc. So these third-party projects use a hacked up old version of gcc. And everything kind of falls apart from there. Also open-source drivers for Realtek wifi chips are limited.

From https://openwrt.org/toh/sagem/livebox.2 :

It is possible to compile software for Lexra processors using the gnu gcc tools for the MIPS-I R3000 processor. This can be done either by writing an exception trap handler for reserved instructions that detects unaligned load and store instructions and emulates their functionality with shifts and aligned loads and stores or else modifying the compiler so that it does not generate lwl, lwr, swl, and swr instructions. With either of those changes, any C code can run on Lexra processors. Advanced hobbyists might even choose to accelerate their critical inner loops by coding them in assembly code using digital signal processing (DSP) instructions that Lexra implemented as extensions to the MIPS-I instruction set.

From Realtek SoC support in OpenWrt:

In terms of lexra (Realtek's reduced mips ISA) support, there is none - nor anyone actively pushing for it (as in providing patches/ pull requests against current master); chances for this to change are non-zero, but extremely low (once you'd have hypothetical lexra arch/ SOC support, there would still be the problem of the wlan drivers and current hostapd/ nl80211, to drive them reliably in AP mode).

[Disclaimer: I can't speak for the LEDE/ OpenWrt developers]
Personally I don't think lexra will 'ever' be supported in LEDE/ OpenWrt (too different from normal mips, no upstream/ toolchain support at all, very low-end devices, the wlan situation (drivers, AP mode reliability, nl80211 support) is difficult). But effectively all it would need, is someone pushing for it - to provide a (long-term-) manageable pull request with lexra support against OpenWrt/ master, kernel 4.14, musl, hostapd/ nl80211 for the wlan drivers and not too many arch specific changes (so it can be reasonably updated with the rest of OpenWrt and not stay behind).

From Can RTL8196C be incorporated into the LEDE? :

Afaik there's no upstream support whatsoever towards OpenWrt/LEDE, which is why Realtek devices aren't supported.

Realtek inherited a reduced mips ISA via Lexra, given that this differs from the normal mips ISA, it is quite a bit harder to support - especially lacking active (or any-) upstream development.

From Can RTL8196C be incorporated into the LEDE? - #4 by hackpascal :

I've ported RTL8196C support to LEDE, without wireless support.
All source codes (SPI driver/ethernet driver) were written myself.
https://github.com/hackpascal/lede-rtl8196c 240 (with branch realtek)

But I probably have no time to develop it later.

From Unsupported Belkin? - #3 by slh

The whole target SOC isn't supported at all (search this forum for 'lexra', if you want more details), neither in OpenWrt, nor upstream linux, binutils, gcc, musl, … Adding support for this arch is of course 'possible', but a lot of work - and once there you'd have to deal with getting the wlan drivers to work in AP mode and using contemporary hotapd version, neither will be easy.

1 Like
3

Thank you very much Sir
This night i will do alot more research, and i hope to manage to wrap something up.

Thank you so much for the links provided , any other help is much appreciated also.

4

Can i ask is why my router is not willing to erase firmware?
I'am trying to use this one : https://remont-aud.net/dump/planshety_i_ehl_knigi/zte/zte_zxhn_h118n_v2_1_shassi_main_board_zxv10_h108la_zxhn_h118na/467-1-0-33216

Logs are here

Manufacturer:ZTE;
ProductClass:ZXHN H118N;
SerialNumber:ZTERH5HG8E03796;
IP:192.168.10.1;
HWVer:V2.2;
SWVer:V2.1.1_Viva6T9;

1970-01-01T00:08:11 [Emergency] reboot msg!reboot for module(upgrade_mgr) msg : upgrade failed:file download error!
1970-01-01T00:00:07 [Error] key domain error table(MultiWD) domain(ViewName)
1970-01-01T00:00:16 [Error] |igmp_proxy_mgr| RegisterToWanc
1970-01-01T00:00:16 [Error] |igmp_proxy_mgr| GetRouteIFInfo Failed
1970-01-01T00:00:17 [Error] |dnsmasq| failed to read /var/tmp/special_resolv.conf
1970-01-01T00:00:20 [Error] |igmp_proxy_mgr| GetRouteIFInfo Failed
1970-01-01T00:00:20 [Error] |dnsmasq| bind interface socket failed

5

Hi All!

I checked the code of realtek SDK 2.5 and I found something very important.
The forums and openwrt informations contains:
"Realtek inherited a reduced mips ISA via Lexra"
Realtek SOC's have lexra core with reduced (crippled) mips funcionality.
The lexra core doesn't support four unaligned instructions:

" It was founded in 1997 and began developing and licensing semiconductor intellectual property cores that implemented the MIPS I architecture, except for the four unaligned load and store (lwl, lwr, swl, swr) instructions. "

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

                      BUT

The Realtek SOC's (rtl8881a, rtl8196e, rtl819xd) support these four unaligned load and store opcodes (lwl, lwr, swl, swr) !

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

target/linux/realtek/rtl8881a/config-3.10
ONFIG_CPU_HAS_ULS=y

target/linux/realtek/rtl819xd/config-3.10
CONFIG_CPU_HAS_ULS=y

target/linux/realtek/rtl8196e/config-3.10
CONFIG_CPU_HAS_ULS=y

target/linux/realtek/files/arch/rlx/kernel/unaligned.c
#ifdef CONFIG_CPU_HAS_ULS
#define LoadW(addr, value, res)
asm volatile (
"1:\tlwl\t%0, (%2)\n"
"2:\tlwr\t%0, 3(%2)\n\t"
"li\t%1, 0\n"
"3:\n\t"
".insn\n\t"
".section\t.fixup,"ax"\n\t"
"4:\tli\t%1, %3\n\t"
"j\t3b\n\t"
".previous\n\t"
".section\t__ex_table,"a"\n\t"
STR(PTR)"\t1b, 4b\n\t"
STR(PTR)"\t2b, 4b\n\t"
".previous"
: "=&r" (value), "=r" (res)
: "r" (addr), "i" (-EFAULT));
#else
#define LoadW(addr, value, res)
asm volatile (
"1:\tlbu\t%0, 0(%2)\n\t"
"lbu\t%1, 1(%2)\n\t"
"sll\t%0, 8\n\t"
"or\t%0, %1\n\t"
"lbu\t%1, 2(%2)\n\t"
"sll\t%0, 8\n\t"
"or\t%0, %1\n\t"
"lbu\t%1, 3(%2)\n\t"
"sll\t%0, 8\n\t"
"or\t%0, %1\n\t"
"li\t%1, 0\n"
"3:\n\t"
".insn\n\t"
".section\t.fixup,"ax"\n\t"
"4:\tli\t%1, %3\n\t"
"j\t3b\n\t"
".previous\n\t"
".section\t__ex_table,"a"\n\t"
STR(PTR)"\t1b, 4b\n\t"
STR(PTR)"\t2b, 4b\n\t"
".previous"
: "=&r" (value), "=&r" (res)
: "r" (addr), "i" (-EFAULT));
#endif

target/linux/realtek/files/arch/rlx/lib/csum_partial.S
#ifdef CONFIG_CPU_HAS_ULS
ulw t1, (src)
#else
#ifdef MIPSEB
lbu t1, 0(src)
lbu t5, 1(src)
sll t1, 8
or t1, t5
lbu t5, 2(src)
sll t1, 8
or t1, t5
lbu t5, 3(src)
sll t1, 8
or t1, t5
#else /* MIPSEL /
lbu t1, 3(src)
lbu t5, 2(src)
sll t1, 8
or t1, t5
lbu t5, 1(src)
sll t1, 8
or t1, t5
lbu t5, 0(src)
sll t1, 8
or t1, t5
#endif
#endif / CONFIG_CPU_HAS_ULS */

target/linux/realtek/files/arch/rlx/lib/memset.S
#ifdef CONFIG_CPU_HAS_ULS
#ifdef MIPSEB
EX(LONG_S_L, a1, (a0), .Lfirst_fixup) /* make word aligned /
#endif
#ifdef MIPSEL
EX(LONG_S_R, a1, (a0), .Lfirst_fixup) / make word aligned */
#endif

    PTR_SUBU        a0, t0                  /* long align ptr */
    PTR_ADDU        a2, t0                  /* correct size */

#else

Conclusion:
The Realtek SOC's (rtl8881a, rtl8196e, rtl819xd)are full MIPS. The instruction set is the same as the mips r3000 and not the r6000.

The MIPS R6000 doesn't support unaligned instruction opcodes.

Best Regards

1 Like
6

are there anything up with this project?

7

I have couple B1s available as well, it'd be nice if someone has time to create the target for it via the R3000 - full MIPS as mentioned above. I don't currently have much time to help but can do at least the actual testing.

8

Any news with Lexra architecture implementation?