Zyxel (spharion) 5501(=VMG8546-D70A) + 6501 . Anyone has tried to launch openwrt on that?

Overall seems good devices for lede-based router ...

this 2 devices share the same base firmware and almost same hardware

  • (5501 have WANoE port ... but 6501 have incoming ISDN line port)
  • 4 LAN ports
  • S0-out phone ports
  • ISDN-out
  • 2 USB
  • 2 wifi Antenne
  • VDSL2

what i have currently researched (on 5501 /alternative model name VMG8546-D70A /):
hardware : Lantiq XWAY / VR9 / MIPS 34Kc (info got from dmesg)
RT5392 (chip onboard) / in dmesg driver say RT3662 /
Flash: 64M /chip FL512SA/
RAM : 128M

onboard exist headers :
4pin - RS232 - pinout labeled
second 4-pin - unknown
14pin - Possible JTAG - not labeled

uBoot
variables that show current layout :
mtdids=nor0=spi0.4
mtdparts=mtdparts=spi0.4:512k(uboot_fix),256k(uboot_cfg),10m(data),27136k(images1),27136k(images2)
partition=nor0,0

stock firmware is linux, but too limited (not possible to use full flash space, specific layout ... non-standart configuration way)

how safely can backup existing firmware before any tries with openwrt/lede builds ?

info from uboot:

ROM VER: 1.1.4
CFG 05

U-Boot SPL 2013.04-sphairon4.21.3 (Jan 04 2017 - 08:39:38)
SPL: probing SPI flash
SPL: reading memory controller config
SPL: DDR Echo DLL delay:  20/20
SPL: DDR Write DQS delay: 65/65
SPL: DDR Read DQS delay:  1f/1f
SPL: applying tuned DDR SDRAM settings
SPL: checking U-Boot image
SPL: loading U-Boot to RAM
SPL: decompressing U-Boot with LZO
SPL: jumping to U-Boot


U-Boot 2013.04-sphairon4.21.3 (Jan 04 2017 - 08:39:38) SPHSL550X

Board: Sphairon Speedlink **4501/5501/6501** IAD
SoC:   Lantiq VRX288 v1.2
CPU:   500 MHz
IO:    250 MHz
BUS:   250 MHz
BOOT:  SPI
DRAM:  128 MiB
NAND:  No NAND device found!!!
0 MiB
SPI:   ready
SF:    S25FL512S_256K, page size 256 KiB, total 64 MiB
SF:    S25FL512S_256K, page size 256 KiB, total 64 MiB
Reloc: offset @ 0x07e7c000
In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth
Setting content of image 1 to 3
Setting state of image 1 to 'inactive,working'
Setting content of image 2 to 3
Setting state of image 2 to 'active,working'
Setting state of image 3 to 'not available'
Setting content of image 3 to 0

****************************************************************
* Sphairon type label v2                                       *
* ------------------------------------------------------------ *
* Product name             Speedlink 5501                      *
* Ident number             SL5501                              *
* Base platform            0420                                *
* Flash layout             psmd                                *
* Data partition size                                          *
* Data partition location  1                                   *
* ------------------------------------------------------------ *
****************************************************************
* Flash partition info                                         *
* ------------------------------------------------------------ *
* Used layout              Platform/Service/Data - mirrored    *
* ------------------------------------------------------------ *
*  nor0: uboot_fix           80000 @ 00000000                  *
*  nor0: uboot_cfg           40000 @ 00080000                  *
*  nor0: data               a00000 @ 000c0000                  *
*  nor0: images1           1a80000 @ 00ac0000                  *
*  nor0: images2           1a80000 @ 02540000                  *
****************************************************************

****************************************************************
* Boot info                                                    *
* ------------------------------------------------------------ *
* images1  @ 00000000      kernel#Linux-2.6.32.61-sphairon5    *
* images1  @ 001ba000      rootfs#5.0.10.0.3_r97694_heinzm     *
* images1  @ 00a80000      servfs#1.0.0_r97694_heinzm          *
* images1  @ 01180000      defcfg#1.0.0_r97694_heinzm          *
* images2  @ 00000000      kernel#Linux-2.6.32.61-sphairon5    *
* images2  @ 001ba000      rootfs#5.0.10.0.3_r0_heinzm         *
* images2  @ 00a40000      servfs#1.0.0_r0_heinzm              *
* images2  @ 01180000      defcfg#1.0.0_r0_heinzm              *
* ------------------------------------------------------------ *
* Boot image 1             inactive,working                    *
* Boot image 2             active,working                      *
* Boot count               0                                   *
* Boot try                 2                                   *
****************************************************************
SPHSL550X # ?
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
go      - start application at address 'addr'
gpio    - input/set/clear/toggle gpio pins
help    - print command description/usage
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mdio    - MDIO utility commands
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtd     - MTD sub-system
mtdparts- define flash/nand partitions
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
sas_boot- Sphairon kernel and rootfs loader
sas_controlfile- Sphairon control file execution
sas_erase_data- Erase data partition in flash
sas_erase_etl- Erase ETL in flash
sas_erase_images- Erase images partition in flash
sas_erase_syscfg- Erase sysconfig in flash
sas_erase_uboot_cfg- Erase U-Boot config in flash
sas_etl - Sphairon ETL commands
sas_test_sf- Sphairon test program for SPI flash
sas_upgrade_etl- Update ETL in flash
sas_upgrade_platform- Update kernel and rootfs in flash
sas_upgrade_service- Update servicefs and defconfig in flash
sas_upgrade_uboot- Update U-Boot in flash
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
sspi    - SPI utility command
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
ubi     - ubi commands
version - print monitor, compiler and linker version

SPHSL550X # mtd info
nor0             - NOR flash, 64 MiB
uboot_fix        - NOR flash, 512 KiB
uboot_cfg        - NOR flash, 256 KiB
data             - NOR flash, 10 MiB
images1          - NOR flash, 26.5 MiB
images2          - NOR flash, 26.5 MiB

SPHSL550X # bdinfo
boot_params = 0x87E59F60
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0x00000000
flashsize   = 0x00000000
flashoffset = 0x00000000
ethaddr     = B8:EC:A3:XX:XX:XX
ip_addr     = 192.168.100.1
baudrate    = 115200 bps
SPHSL550X # version

U-Boot 2013.04-sphairon4.21.3 (Jan 04 2017 - 08:39:38) SPHSL550X
mips-sphairon-linux-uclibc-gcc (crosstool-NG 1.18.0 - sphairon-2013.03) 4.7.2
GNU ld (crosstool-NG 1.18.0 - sphairon-2013.03) 2.22

SPHSL550X # mdio list
ltq-mdio:
0 - Lantiq XWAY PEF7071 <--> ltq-eth
1 - Lantiq XWAY PEF7071 <--> ltq-eth
17 - Lantiq XWAY XRX PHY22F v1.4 and later <--> ltq-eth
18 - Lantiq XWAY XRX PHY22F v1.4 and later <--> ltq-eth
19 - Lantiq XWAY XRX PHY11G v1.4 and later <--> ltq-eth

could you kindly explain how have you got the posted "infos from uboot" - via serial i got nothing useful (115200-1N1, sometimes with 1ms TxDelay)

Quite simple - connected - opened terminal on COM port (i use FT4232 driver for usb to serial) 115200 - powered on zyxel - and all is shown.
So - firsty - check your connection:
GND,RX,TX - must be
3,3v - often better leave in the air
RX of one device must be connected to TX of another device ... (and vice versa)

  • 1-N-1 ? sure ? Must be 8(bit)-N(o parity)-1(stop)

JTAG Header on-board is standard

nTRST 1 2 GND
TDI 3 4 GND
TDO 5 6 GND
TMS 7 8 GND
TCK 9 10 GND
nSRST 11 12 (NOT Checked)-key
(NOT Checked)DINT 13 14 VCC

Hello. as a success with the installation of openwrt on this router? we are also trying to flash this router. we using the programmer ch341 made a memory dump. But how to flash on openwrt do not understand. help us with this device.

Currently no any success story ...

What i'm see in your dump - that is not fully readable as "dump"
first 0x800 bytes - is almost equal to u-boot that dumped from /dev/mtd0 (+added first byte).
/ dumps from /dev/mtd devices is not encrypted - therefore suppose that in flash will be also unencrypted /
but further seems somewhat "screwed/scrambled" - too oft sequence
80FFC8AC 80FFCCAC 80FFD0AC 80FFD4AC
80FFD8AC 80FFDCAC 80FFE0AC 80FFE4AC
80FFE8AC 80FFECAC 80FFF0AC 80FFF4AC
and when searching for that in file - dynamic view show that as "broken read of flash" ...
check your dump procedure ... think there was something not as must ...

i'm currently only at research stage ...
as jtag is functional /working with RAM is ok/ - so may try to load code in memory and start it ...

as currently no clear where is connected Flash - so can not currently say how it's must be activated, would be nice so that will be directly accessible from jtag ...

one more bad point - lack of lantiq chip documentation ...

sorry. its was bad dump. this dump tested https://drive.google.com/open?id=14AKIy0pzc5zoJzR-U8yJIrZwB7NzFX-9 and work 100%. if you install openwrt on this router plz do full flash dump and share with us.

So... current progress.
have built U-Boot-RAM for SL5501 ...
dump and tftpput for installed /stock/ firmware and configuration is possible ...
require JTAG and COM port connected, but link is possible only via LAN3 port
flash writing while not tested

cool, you already tried to install openwrt???

openwrt - firstly need to write some device specific code ... think you not ??? or in your mind - all exist already ?
Progress u-boot ... flashing also tested -> seems work ...

strange point with actiwating of Ethernet ports ... can not bring so all of them works simultaneosly ... operational in modes :

  • only 3-rd
  • 1+2+4+WANoE
    ... think second will is more reliable ... as multiple connectors is better as only one ...
1 Like

hello, can you please provide me with a copy of everything you have (uboot, open wrt configuaration / files, etc) to download

Did any of you try it already on the Speedlink 5501? This device is not mentioned in the "supported devices list". Makes me wonder if you got it to work. If so, which Openwrt release did you use?