The EN751627 EcoNet subtarget consists of the EN7516 DSL SoC and the
(rare) EN7527 xPON SoC.
We currently support pci / wifi, usb and flash, but the EN751221 eth
driver is not portable to this family right now.
Zyxel EX3301-T0 is a wifi router based on the EN7516, it is a DSL SoC
but lacks the DSL port.
Installation instructions:
1. Serial access is required, stop the Zyxel bootloader.
2. Use ATENv3 https://github.com/cjdelisle/ATENv3 to unlock bootloader
3. "ATLD x" on the prompt to start a TFTP server
4. Connect ethernet cable from any lan (yellow) port on modem to a
device.
5. On your device, configure network to 192.168.1.2/30
6. On your device, send TRX file to 192.168.1.1 with name x, i.e.
tftp -p -l ./econet/tclinux -r x 192.168.1.1
7. On modem, you should see a line like this:
"Total 8022324 (0x7A6934) bytes received" note the hex value
8. "ATGU" to enter econet bootloader
9. "flash 80000 80020000 <the hex number without 0x>"
For example: flash 80000 80020000 7A6934
10. "reboot 1" -- start the system
If it boots back into the factory OS, you need to switch OS, from the
ZHAL prompt:
1. "ATCB" -- load data from flash
2. "ATCF 0" -- switch to OS 0
3. "ATBT 1" -- enable flash write
4. "ATSB" -- save data
5. "ATSR 1" -- reboot system
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/22945
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for Huawei HG2821T-U, EPON ONU and home router,
often comes with ISP service.
Specifications
==============
* SoC: Econet EN7526GT
* RAM: 512MiB DDR3L (MT41K256M16TW-107)
* Flash: 256MiB SPI NAND (TC58CVG1S3HRAIG)
* WiFi 2.4GHz: MT7592N
* WiFi 5GHz: MT7612EN
* Ethernet: builtin switch
* LED: Power, Internet, WiFi, USB
* Buttons: Reset
* UART: Serial console (115200 8n1)
* USB: 1 x USB2
* Other: Phone jack, XPON fiber port
!!! BACKUP YOUR ROM !!!
=======================
Please always have your FULL flash image backup before flashing
anything. The vendor firmware varies a lot depending on your ISP and
location. You will have a hard time finding the right regional firmware
if you don't have a backup.
Notes
=====
* Due to the target `econet` being incomplete, WiFi, DSA switch, and
many other features are not supported yet. Do not flash the image unless
you know the consquences or `econet` is declared stable.
* This device, and apparently many other devices of this platform, use
a dual-image layout. OpenWRT (with `econet` target) only uses slot A.
Slot B is not used by OpenWRT, and is applicable for dual-booting to
vendor firmware.
* If you do not use vendor firmware anymore, you can erase and reuse
anything after `configuration_b`, which gives you ~110 MiB free space.
Again, backup your flash first.
Installation
============
Within shell
------------
Note that acquiring the shell access to the vendor firmware can be a bit
tricky depending on the firmware variation. If you can't play with the
vendor firmware, boot to OpenWrt using debricking method below.
0. (Optional) Back up your flash, and / or move the vendor firmware to
slot B
1. Build and then locate the `kernel.bin` and `rootfs.bin` image files
2. Upload `kernel.bin` and `rootfs.bin` to the device (via HTTP or USB
stick), then type:
```
mtd write -f -e KernelA kernel.bin KernelA
mtd erase RootfsA
mtd write -f -r -e AppA rootfs.bin AppA
```
From bootloader
---------------
1. Build and then locate the `kernel.bin` and `rootfs.bin` image files
2. Switch device on and press a key within 3 seconds
3. Upload `kernel.bin` via TFTP as described below
4. Once the transfer has completed successfully, bootloader will give
you the file length in "Total %d (0x%X) bytes received", then type
`flash 200000 80020000 <file length hex>`
5. Upload `rootfs.bin` then flash with
`flash 600000 80020000 <file length hex>`
6. Restart the device to boot into OpenWRT
> [!IMPORTANT]
> Do not try `httpd` in the bootloader. It writes to the wrong address
and will corrupt the flash.
Debricking
==========
1. Build and then locate the `initramfs-kernel.bin` image files
2. Switch device on and press a key within 3 seconds
3. Connect to device via ethernet, set the IP address to `192.168.1.X`,
then upload the image via TFTP
`tftp 192.168.1.1 -m binary -v -c put initramfs-kernel.bin`
The file name can be anything except `tcboot.bin` or `tclinux.bin`,
they will corrupt the flash.
4. Type `jump 80020000` to boot the kernel from memory
Dual boot
=========
Use `en75_chboot` tool to switch between vendor firmware and OpenWrt. If
you are soft-locked, you can also switch the flag in the bootloader:
1. Switch device on and press a key within 3 seconds
2. Select the kernel that you wish to use:
- `memwl 80020000 30ffffff` for `KernelA` (OpenWrt)
- `memwl 80020000 31ffffff` for `KernelB` (Factory)
3. Select the rootfs, which should be the same as the kernel:
- `memwl 80020004 30ffffff` for `RootfsA` (OpenWrt)
- `memwl 80020004 31ffffff` for `RootfsB` (Factory)
3. Commit the data to flash: `flash 1e0000 80020000 8`
4. Restart the device to boot into the selected OS
MAC addresses
=============
`//configuration_a/factory.conf` contains MAC addresses, along with
other pre-configured settings. OpenWrt uses `brmac`, `internetmac`,
`APMAC`, and `APMAC_5G`, while `tr069mac`, `voipmac`, `priprotocolmac`,
and `PONMac` are not used for now.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23131
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Extend the EN7528 PCIe driver to EN751221 with a specific PHY
tuning ritual. Also enable wifi drivers on SmartFiber XP8421-B,
TpLink Archer VR1200V v2 and Zyxel PMG5617GA.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/22208
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add USB host support for EN7528 SoC:
- New phy-en7528-usb driver with U2 slew rate calibration and U3
RX impedance tuning, based on GPL vendor code and the Airoha
AN7581 USB PHY driver
- xHCI LTSSM timing quirk for TD 6.5 compliance (patch 915)
- USB PHY and xHCI DTS nodes with IPPC register mapping
- VBUS power via regulator-fixed for DASAN H660GM-A
- Enable USB, xHCI, PHY, and regulator kernel configs
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22498
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This symbol is selected by CONFIG_BPF, which was already enabled
on generic config-6.12.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22730
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add the unnamed partition between rwfs and reservearea to fully describe
the flash layout.
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22195
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The 2.4 GHz and 5 GHz WiFi eeprom cell references were assigned to the
wrong PCIe slots. Swap them so slot0 (2.4 GHz) uses the eeprom at
0x1c0000 and slot1 (5 GHz) uses the eeprom at 0x40000. Fix the eeprom
cell lengths to match the sizes expected by their respective drivers.
Fixes: be24a13ad5 ("econet: en7528: add PCIe and WiFi support")
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22195
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The DASAN H660GM-A GPON ONT exists in two hardware variants, one
distributed by ISPs and one sold directly by the manufacturer [1].
Split the single DTS into a shared dtsi and per-variant DTS files
with the correct GPIO mappings, flash layout, and LED definitions.
Variant comparison:
Feature | Airtel | Generic
---------------+---------------------------+-------------------------
Supplied by | Airtel Xstream Fiber | Retail
Flash | Micron MT29F2G01ABAGD | Micron MT29F1G01ABAFD
| 256 MB | 128 MB
Known P/N | DPW-G-P-66GMAZ-A3 | DPW:G-P-660GMAY-G0
| (some units unlabelled) | DPW:G-P-660GMAY-G3
WPS LED | Yes | No
WLAN button | No | Yes
USB LED | No | Yes
LAN LEDs | Green only | Green + Amber
[1] https://dasanns.com/en/solution/detail.php?mode=view&cat_no=32&offset=&idx=122
Tested-by: Arif Rahman Hakim <arif2785id@gmail.com>
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22095
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add PCIe controller and PHY support for EN7528 SoC. This includes
a new PCIe PHY driver, EN7528-specific startup in the MediaTek PCIe
controller, and a fix for bogus prefetch window reads on bridges
that do not implement the registers.
Enable WiFi for the DASAN H660GM-A board with MT7603 (2.4 GHz) and
MT7615/MT7663 (5 GHz).
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Enable the Airoha EN7523 GPIO driver for EN7528 and add GPIO
controller nodes to the EN7528 DTSI. Add LED, button and GPIO
definitions for the DASAN H660GM-A board.
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
EN7528 shares the same clock/reset controller as EN7523. Enable
COMMON_CLK_EN7523 and RESET_CONTROLLER for ethernet hardware resets.
Update econet-eth driver and add it as default package.
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
DASAN H660GM-A is a GPON ONT.
Specification:
- SoC: EcoNet EN7528
- RAM: 256 MB
- Flash: 256 MB SPI NAND
- Ethernet: 4x 1GbE
- FXS: 1 port
- GPON: 1 port
- USB: 1x USB 2.0
Install via OEM web UI:
1. Login to the factory web UI with username "superuser"
and password "Dz$!A!r7".
2. Rename the OpenWrt image
openwrt-econet-en7528-dasan_h660gm-a-squashfs-tclinux.trx
to G_ONU_openwrt.bin.
3. Upload the renamed image via the firmware upgrade page
at Maintenance > Firmware Upgrade in the factory web UI.
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The EN7528 SoC uses a little endian MIPS architecture, unlike the big
endian EN751221 family. The tclinux TRX firmware format stores multi-byte
fields in the CPU's native byte order, requiring different header layouts
for each architecture:
- Big endian (EN751221): magic "2RDH", fields in big endian order
- Little endian (EN7528): magic "HDR2", fields in little endian order
Update tclinux-trx.sh to support both endianness variants:
- Add --endian parameter to select byte order (default: be)
- Add --model parameter for optional platform identifier field
- Convert to named parameters for clarity and extensibility
- Use hex32() helper for endian-aware 32-bit field output
Move TRX_ENDIAN configuration to subtarget files, allowing each subtarget
to specify its native byte order:
- en751221.mk: TRX_ENDIAN := be
- en7528.mk: TRX_ENDIAN := le
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Different vendor firmware versions use different BBT table sizes. The
checksum is calculated over the entire table, so the size must match
what the bootloader expects.
The Genexis Platinum-4410 bootloader was compiled with a BBT table
size of 250 entries (MAX_RAW_BAD_BLOCK_SIZE as found in vendor code).
Without this fix, the BBT checksum validation fails:
[ 0.391948] spi-nand spi0.0: Dosilicon SPI NAND was found.
[ 0.397651] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[ 0.407370] en75_bmt: found BMT in block 1023
[ 0.450160] en75_bmt: BBT not found and econet,can-write-factory-bbt is unset, giving up
Add a new DTS property 'econet,bbt-table-size' to configure the BBT
table size. If not specified, defaults to 1000.
After this patch:
[ 0.407021] en75_bmt: found BMT in block 1023
[ 0.449159] en75_bmt: found BBT in block 943
[ 0.453491] en75_bmt: BBT & BMT found
[ 0.457152] en75_bmt: blocks: total: 1024, user: 943, factory_bad: 0, worn: 0 reserve: 81
[ 0.465390] en75_bmt: 117 MiB usable space
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The EN7528 is a little endian dual-core MIPS 1004Kc SoC used in xPON
devices. Unlike the big endian EN751221, EN7528 uses the MIPS GIC
interrupt controller for SMP.
This adds minimal boot support for EN7528:
- New en7528 subtarget with mipsel architecture
- Kernel patches for EN7528 SoC with GIC support
- Timer driver extended to support GIC shared interrupts per CPU
- SPI driver fix for EN7528 chip select handling
- Generic device tree for initial bring-up
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is in preparation for the next update to EcoNet Ethernet driver
which will be using real resets rather than bit-bashing. Patches are
backported up to the current state of clk-next because I intend on
upstreaming these patches soon.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/21545
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Board name was specified incorrectly in the DT, fix.
This bug was introduced in #20580 (31f5fc8fea8931f5) which was
merged last week, and econet is still a mostly experimental target,
so it is considered unnecessary to update SUPPORTED_DEVICES.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/21023
Signed-off-by: Robert Marko <robimarko@gmail.com>
Instead of using the name from /proc/cpuinfo, use board_name from
/lib/functions.sh
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/21023
Signed-off-by: Robert Marko <robimarko@gmail.com>
This is about as simple as it gets, it's able to start up and put
the onboard switch into dumb switch mode and then send untagged
frames which become available on every switch port.
It is out-of-tree to allow for rapid development and it is being
proposed now because even in this state it brings a lot of value
to the EcoNet platform and it is a fairly complex ethernet system
so it will take some time before the driver is in a state that
may be considered for upstreaming.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/20685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
In preparation for the introduction of ethernet, this patch normalizes the
partitions in the devices in DT so that the partition to upgrade will
always be called tclinux, no matter what it is called from the factory.
Also fix a math error in Nokia G240G-E partition table and remove leading
zeros from paritition offsets.
Finally, add NVMEM mac-address entries where they are left by the
factory. In preparation for the introduction of Ethernet and Wifi
support.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/20685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Backport upstream patch to add support for the ESMT F50L1G41LC flash
chip. It is used in multiple Cudy products manufactured starting
November 2025.
Link: https://github.com/openwrt/openwrt/pull/20962
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This device has one USB2.0 port, plus ethernet, 2x wifi, ethernet, xPON
and VoIP.
Installation instructions: (Assuming root shell via SSH or serial)
1. Place OpenWrt TRX file on a USB stick formatted VFAT
2. Plug in the stick to the modem
3. Type: mtd write -f -e tclinux /mnt/usb2_sda1/<name of file>.trx tclinux
At this point, both OpenWrt and the vendor OS will be installed
because the device has space for two operating systems. Switch the OS
to boot to OpenWrt:
1. mtd readflash tmpdata 999999999 0 reservearea
2. echo -n '0' | dd of=./tmpdata bs=1 count=1 seek=397311 conv=notrunc
3. mtd write -f -e reservearea ./tmpdata reservearea
4. reboot
WARNING: While you can install with SSH alone, you need serial to use
OpenWrt on EcoNet devices because the Ethernet driver has not yet been
developed.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/20580
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Nokia G-240G-E is an xPON device with an EN7526G, 256M of
memory and 128M of flash. It has 1 USB2 port as well as phone and
ethernet but no wifi. Flashing instructions are per the typical
process using xmodem in the bootloader. This and other things
are described here: https://openwrt.org/inbox/toh/bt/g-240g-e_1
In addition, a generic image is offered, this image can be loaded
into memory from within the bootloader and launched directly. It
is recommended on the wiki of G-240G-E and other EcoNet devices
to be used for backing up the flash before flashing OpenWRT.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/20338
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The EN751221 has an XHCI that is compatible with MT7621.
While there is setup logic in the vendor code for both
EN751221 and MT7621, but MT7621 does not use it in mainline
or OpenWRT, and it appears to work correctly with EN751221.
Include SCSI / Mass Storage because many EcoNet devices
contain a builtin USB SD-Card reader.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/20050
[Remove usb storage kmod from smartfiber_xp8421-b]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Refresh patches 6.12 for airoha and econet
Fixes: 122135b964 ("airoha: an7581: add support for kernel 6.12")
Fixes: 73d0f92460 ("kernel: Add new platform EcoNet MIPS")
Signed-off-by: Leo Barsky <leobrsky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/20073
Signed-off-by: Robert Marko <robimarko@gmail.com>
The kernel config accidentally contains CONFIG_UBIFS_FS_AUTHENTICATION
which select a number of other unnecessary components, remove them.
The target has at least two subtargets, only one is currently
implemented. Move the Device builds into a file for this subtarget.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/20027
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The TP-Link Archer VR1200v (v2) is a low end DSL modem based on the
EcoNet EN751221 processor platform.
While it does have an unlocked bootloader, the factory upgrade feature
requires a cryptographic signature so flashing from the web UI is not
feasible.
The Archer VR1200v (v2) uses a dual-image layout. I have chosen to reuse
this to support dual-boot between OpenWRT and the factory firmware.
Flashing instructions (from bootloader):
Build and then locate the squashfs-sysupgrade.bin image file
Get the length of that file in hex: printf '%X\n' "$(stat -c%s the-file-squashfs-sysupgrade.bin)"
Connect to device with xmodem capability, e.g. picocom --send-cmd lsx -vv -b 115200 /dev/ttyUSB0
Switch device on and press a key within 3 seconds, you should get to a `bldr>` prompt
Type: xmdm 80020000 <file length hex>
Quickly start xmodem and send the file, in picocom that is ctrl+a ctrl+s <paste-the-file-name> enter If the transfer fails to start, wait 30 seconds to a minute for the bootloader prompt to return and then try the command again.
Once the transfer has completed successfully, type the following flash 80000 80020000 <file length hex>
Type `re` or simply restart the device to boot into OpenWRT
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/19021
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The SmartFiber XP8421-B is a fiber modem which is available for $20 online
and has 512MB of memory, 256MB of SPI NAND flash and 2 USB 2.0 ports in
addition to ethernet, wifi and XPON.
Because EcoNet is not currently producing evaluation boards, the XP8421-B
stands in as a convenient, low cost, off-the-shelf, representitive example
of the capabilities of the EN751221 econet processor. This is also the
example board that is included in the upstream Linux patchset.
The XP8421-B, and apparently many other devices of this platform, use a
dual-image layout. I have chosen to reuse this to support dual-boot between
OpenWRT and the factory firmware. Certain design decisions were made with
the goal of not overwriting data that is used by the factory OS.
This commit also introduces a utility for switching between OS_A and OS_B
which are used for OpenWRT and Factory OS respectively.
Flashing instructions (from bootloader):
Build and then locate the squashfs-tclinux.trx image file
Get the length of that file in hex: printf '%X\n' "$(stat -c%s the-file-squashfs-tclinux.trx)"
Connect to device with xmodem capability, e.g. picocom --send-cmd lsx -vv -b 115200 /dev/ttyUSB0
Switch device on and press a key within 3 seconds
Enter bootloader username and password: telecomadmin nE7jA%5m
Type: xmdm 80020000 <file length hex>
Quickly start xmodem and send the file, in picocom that is ctrl+a ctrl+s <paste-the-file-name> enter If the transfer fails to start, wait 30 seconds to a
minute for the bootloader prompt to return and then try the command again.
Once the transfer has completed successfully, type the following flash 80000 80020000 <file length hex>
Type go or simply restart the device to boot into OpenWRT
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/19021
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
EcoNet EN75xx is a big endian MIPS platform used in XPON (fiber),
DSL, and SIM (3g/4g) applications. Complete GPL vender SDKs exist
for this platform, but are based on Linux 2.6.
The bulk of this submission has already been accepted upstream:
https://patchwork.kernel.org/project/linux-mips/list/?series=960479&state=*
This platform uses a bootloader that is derived from old TrendChip
code. This bootloader implements a frustratingly complex Bad Block
Table which is implemented here in en75_bmt.c
This BMT is not upstreamed because it depends on mtk_bmt framework
which likewise is not upstreamed.
This BMT system rewrites block indexes in flash and if the bootloader
considers it to be corrupted, it will attempt to automatically rebuild
on boot. So without implementing the algorithm, you can't safely use
the disk at all.
Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/19021
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
