ZyXEL T-56

From TechInfoDepot
Jump to navigationJump to search
abgn+ac+ax (AX3600)
wireless router
Wikipedia ZyXEL
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Partial Support
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
BrandModelRev ZyXEL T-56
FCC ID (fcc.io) none specified
FCC ID (fcc.report) none specified
Type wireless router
CPU1 checkY MediaTek MT7986A
CPU1 Type ARM Cortex-A53
CPU1 Speed 2.0 GHz ( 4 cores ) 64-bit
Flash1 Chip Micron Model?
Flash1 Size 512 MiB 536,870,912 B <br />4,194,304 Kib <br />524,288 KiB <br />4,096 Mib <br />0.5 GiB <br /> (SPI NAND)
RAM1 Size 1 GiB 1,024 MiB <br />1,073,741,824 B <br />8,388,608 Kib <br />1,048,576 KiB <br />8,192 Mib <br /> (DDR4)
RAM1 Chip Brand? Model?
ETH chip1 MediaTek MT7986A
ETH chip2 MaxLinear GPY211B
ETH chip3 MaxLinear GPY211B
Switch MediaTek MT7986A
RJ11 Ports (VOIP/POTS) 2
Ethernet Port Count 1-2.5GbE-WAN
3-1GbE x 1-2.5GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab/3bz

802dot11 OUI: none specified

Stock bootloader U-Boot
Expansion IF types USB 3.0
USB ports 1
USB Hub Compatible Untested
Power 12 VDC, 3 A
Connector type barrel
Serial Port (UART) yes, 3.3V TTL, (115200 8N1)
JTAG Port no

Flags:
Wifi6

Other

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1353 additional devices
of which 99 are ZyXEL devices
Default login user: admin
Default login password: blank
admin:blank credentials used by 379 additional devices
of which 11 are ZyXEL devices

3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Radio 1
Chip1 MediaTek MT7976
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 4x4:4
Wireless Standard IEEE 802.11b/g/n/ax
802.11ax up to 1148 Mbps
802.11n up to 600 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Chip1 MediaTek MT7976
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 4x4:4
Wireless Standard IEEE 802.11a/n/ac/ax
802.11ax up to 2402 Mbps
802.11ac up to 1733 Mbps
802.11n up to 600 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz

For a list of all currently documented MaxLinear (Intel) chipsets with specifications, see MaxLinear (Intel).
For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.

For a list of all currently documented ZyXEL devices with specifications, see ZyXEL.

2402 Mbps - 4SS 5GHz 802.11ax (80MHz chan.)
1148 Mbps - 4SS 2.4GHz 802.11ax (40MHz chan.) = AX3600 class

Overview

The Zyxel T-56 is an ISP (Odido and Hyperoptic) branded EX5601-T1, which is the same as the T0 version, without the SFP+ port.

Links of Interest

Firmware OEM Stock URL_url

Flashing

Flashing OpenWrt

Target: mediatek
Subtarget: filogic
Package architecture: aarch64_cortex-a53
Supported Since Commit
Support started version: 23.05.0
Current supported version: 24.10.5
Unsupported Functions:
VoIP ports
LAN Hardware: MediaTek MT7531A
LAN Comment: 2x MaxLinear GPY211B 2.5Gbe Phy
WLAN Hardware: MediaTek MT7986A, MediaTek MT7976AN, MediaTek MT7976GN
WLAN Comment: WiFi6 802.11ax 5 GHz 4x4 + 2.4GHz 4x4
Installation method(s):
U-Boot TFTP + serial recovery
Install Comment:
Do NOT use 2.5Gbit ports during flashing. Once OpenWRT has been installed, you'll be able to use the 2.5Gbit ports.
Recovery Comment:
U-Boot TFTP + serial recovery
Comment:
The T-56 is an ISP (Odido) branded EX5601-T1. The EX5601 installation instruction doesn't work here.
git • >>
mediatek: add support for Zyxel EX5601-T0 router
Zyxel EX5601-T0 specifics
--------------
The operator specific firmware running on the Zyxel branded
EX5601-T0 includes  U-Boot modifications affecting the OpenWrt
installation.

Partition Table
| dev  | size     | erasesize | name          |
| ---- | -------- | --------- | ------------- |
| mtd0 | 20000000 | 00040000  | "spi0.1"      |
| mtd1 | 00100000 | 00040000  | "BL2"         |
| mtd2 | 00080000 | 00040000  | "u-boot-env"  |
| mtd3 | 00200000 | 00040000  | "Factory"     |
| mtd4 | 001c0000 | 00040000  | "FIP"         |
| mtd5 | 00040000 | 00040000  | "zloader"     |
| mtd6 | 04000000 | 00040000  | "ubi"         |
| mtd7 | 04000000 | 00040000  | "ubi2"        |
| mtd8 | 15a80000 | 00040000  | "zyubi"       |

The router boots BL2 which than loads FIP (u-boot).
U-boot has hardcoded a command to always launch Zloader "mtd read zloader 0x46000000" and than "bootm". Bootargs are deactivated.
Zloader is the zyxel booloader which allow to dual-boot ubi or ubi2, by default access to zloader is blocked.
Too zloader checks that the firmware contains a particolar file called zyfwinfo.
Additional details regarding Zloader can be found here:
https://hack-gpon.github.io/zyxel/
https://forum.openwrt.org/t/adding-openwrt-support-for-zyxel-ex5601-t0/155914

Hardware
--------
SOC: MediaTek MT7986a
CPU: 4 core cortex-a53 (2000MHz)
RAM: 1GB DDR4
FLASH: 512MB SPI-NAND (Micron xxx)
WIFI: Wifi6 Mediatek MT7976 802.11ax 5 GHz 4x4 + 2.4GHZ 4x4
ETH: MediaTek MT7531 Switch + SoC
3 x builtin 1G phy (lan1, lan2, lan3)
1 x MaxLinear GPY211B 2.5 N-Base-T phy5 (lan4)
1 x MaxLinear GPY211B 2.5Gbit xor SFP/N-Base-T phy6 (wan)
USB: 1 x USB 3.2 Enhanced SuperSpeed port
UART: 3V3 115200 8N1 (Pinout: GND KEY RX TX VCC)
VOIP: 2 FXS ports for analog phones

MAC Address Table
-----------------
eth0/lan    Factory 0x002a
eth1/wan    Factory 0x0024
wifi 2.4Ghz Factory 0x0004
wifi 5Ghz   Factory 0x0004 + 1

Serial console (UART)
---------------------
+-------+-------+-------+-------+-------+
| +3.3V |  RX   |  TX   |  KEY  |  GND  |
+---+---+-------+-------+-------+-------+
    |
    +--- Don't connect

Installation
------------
Keep in mind that openwrt can only run on the UBI partition, the openwrt firmware is not able to understand the zloader bootargs.
The procedure allows restoring the UBI partition with the Zyxel firmware and retains all the OEM functionalities.

1. Unlock Zloader (this will allow to swap manually between partitions UBI and UBI2):
- Attach a usb-ttl adapter to your computer and boot the router.
- While the router is booting at some point you will read the following: `Please press Enter to activate this console.`
- As soon as you read that press enter, type root and than press enter again (just do it, don't care about the logs scrolling).
- Most likely the router is still printing the boot log, leave it boot until it stops.
- If everything went ok you should have full root access "root@EX5601-T0:/#".
- Type the following command and press enter: "fw_setenv EngDebugFlag 0x1".
- Reboot the router.
- As soon as you read `Hit any key to stop autoboot:` press Enter.
- If everything went ok you should have the following prompt: "ZHAL>".
- You have successfully unlocked zloader access, this procedure must be done only once.

2. Check the current active partition:
- Boot the router and repeat the steps above to gain root access.
- Type the following command to check the current active image: "cat /proc/cmdline".
- If `rootubi=ubi` it means that the active partition is `mtd6`
- If `rootubi=ubi2` it means that the active partition is `mtd7`
- As mentioned earlier we need to flash openwrt into ubi/mtd6 and never overwrite ubi2/mtd7 to be able to fully roll-back.
- To activate and boot from mtd7 (ubi2) enter into ZHAL> command prompt and type the following commands:
atbt 1  # unlock write
atsw    # swap boot partition
atsr    # reboot the router
- After rebooting check again with "cat /proc/cmdline" that you are correctly booting from mtd7/ubi2
- If yes proceed with the installation guide. If not probably you don't have a firmware into ubi2 or you did something wrong.

3. Flashing:
- Download the sysupgrade file for the router from openwrt, than we need to add the zyfwinfo file into the sysupgrade tar.
Zloader only checks for the magic (which is a fixed value 'EXYZ') and the crc of the file itself (256bytes).
I created a script to create a valid zyfwinfo file but you can use anything that does exactly the same:
https://raw.githubusercontent.com/pameruoso/OpenWRT-Zyxel-EX5601-T0/main/gen_zyfwinfo.sh
- Add the zyfwinfo file into the sysupgrade tar.
- Enter via telnet or ssh into the router with admin credentials
- Enter the following commands to disable the firmware and model checks
"zycli fwidcheck off" and "zycli modelcheck off"
- Open the router web interface and in the update firmware page select the "restore default settings option"
- Select the sysupgrade file and click on upload.
- The router will flash and reboot itself into openwrt from UBI

4. Restoring and going back to Zyxel firmware.
- Use the ZHAL> command line to manually swap the boot parition to UBI2 with the following:
atbt 1  # unlock write
atsw    # swap boot partition
atsr    # reboot the router
- You will boot again the Zyxel firmware you have into UBI2 and you can flash the zyxel firmware to overwrite the UBI partition and openwrt.

Working features
----------------
3 gbit lan ports
Wifi
Zyxel partitioning for coexistance with Zloader and dual boot.
WAN SFP port (only after exporting pins 57 and 10. gpiobase411)
leds
reset button
serial interface
usb port
lan ethernet 2.5 gbit port (autosense)
wan ethernet 2.5 gbit port (autosense)

Not working
----------------
voip (missing drivers or proper zyxel platform software)

Swapping the wan ethernet/sfp xor port
----------------
The way to swap the wan port between sfp and ethernet is the following:
export the pins 57 and 10.
Pin 57 is used to probe if an sfp is present.
If pin 57 value is 0 it means that an sfp is present into the cage (cat /sys/class/gpio/gpio468/value).
If pin 57 value is 1 it means that no sfp is inserted into the cage.
In conclusion by default both 57 an 10 pins are by default 1, which means that the active port is the ethernet one.
After inserting an SFP pin 57 will become 0 and you have to manually change the value of pin 10 to 0 too.
This is totally scriptable of course.

Leds description
------------
All the leds are working out of the box but the leds managed by the 2 maxlinear phy (phy 5 lan, phy6 wan).
To activate the phy5 led (rj45 ethernet port led on the back of the router) you have to use mdio-tools.
To activate the phy6 led (led on the front of the router for 2.5gbit link) you have to use mdio-tools.
Example:
Set lan5 led to fast blink on 2500/1000, slow blink on 10/100:
mdio mdio-bus mmd 5:30 raw 0x0001 0x33FC

Set wan 2.5gbit led to constant on when wan is 2.5gbit:
mdio mdio-bus mmd 6:30 raw 0x0001 0x0080

Pictures

Retail Images