Public/ZTE_ZXHN_F670L
1
0
Fork 0
Code Issues Pull requests Projects Releases 9 Packages Wiki Activity Actions
9 releases 9 tags
  • v0.2.7 62e2191454

    F670L OpenWrt - English default + 5GHz firmware built-in Stable

    gitops released this 2026-10-31 01:43:22 +00:00 | 1 commits to main since this release

    v0.2.7 makes English the factory default: option lang 'en' is now baked directly into the luci base config (feeds/luci luci-base root/etc/config/luci), so LuCI is English on every boot regardless of browser - no runtime script needed. This replaces the flaky uci-defaults approach.

    Image 13,490,079 B (0xCDD79F), sha b1e7682ae1ac3a8dfaaad5de205e5a69c571fd575b08ea426256a46e3a5a0837. Bootable size, and retains the 5 GHz firmware (mt7663pr2h.bin baked in via kmod-mt7663-firmware-ap). Also: no auto-failsafe, LAN lan1-3 + wan.

    Deploy:

    tftp 0x43000000 openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xCDD79F
reset

    After boot: English LuCI at http://192.168.1.1, and dmesg | grep mt76 should show the 5 GHz firmware loaded (phy1 on a real channel in iwinfo).

    Also attached: bootloader-mod-final3.bin (recommended size-agnostic bootloader) and HANDOVER.md.

    Known remaining: random MACs; LAN port LEDs not yet mapped.

    Downloads
  • v0.2.6 62e2191454

    F670L OpenWrt - 5GHz firmware BAKED IN (bootable + 5G) Stable

    gitops released this 2026-10-31 01:38:40 +00:00 | 1 commits to main since this release

    The proper 5 GHz fix: mt7663pr2h.bin is now baked into the image via the kmod-mt7663-firmware-ap package (no runtime loader, no separate firmware blob flash). The kmod-mt7916-firmware (unused WiFi-6 blobs) was disabled in .config.

    Image is 13,486,975 B (0xCDCB7F) - bootable (below the ~13.6 MB early-boot ceiling) and contains the 5 GHz firmware, so it should boot and bring up 5 GHz (MT7613BE) on first probe. sha256 52f3dedfe95330dbffd3400ba481b0861d2eebb8e3cbe1e8fc5ee6d90f980049.

    Also includes: English LuCI (lang en), no auto-failsafe, LAN lan1-3 + wan.

    Deploy (single kernel flash, no blob step):

    tftp 0x43000000 openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xCDCB7F
reset

    After boot: dmesg | grep mt76 should show firmware loaded (no 'not found') and iwinfo phy1 on a real 5 GHz channel.

    Note: an earlier v0.2.5 used a runtime firmware loader from NAND (now superseded) - ignore it. MT7916 blobs may still linger (stale rootfs); harmless wasted space, image still boots. Also attached bootloader-mod-final3.bin (recommended, size-agnostic) and HANDOVER.md.

    Known remaining: random MACs (board EEPROM MAC not yet wired in); LAN port LEDs not yet mapped.

    Downloads
  • v0.2.5 62e2191454

    F670L OpenWrt - 5GHz via runtime firmware (v0.2.4 + loader) Stable

    gitops released this 2026-10-31 01:02:17 +00:00 | 1 commits to main since this release

    Adds working 5 GHz (MT7613BE) WITHOUT growing the bootable initramfs (which caused the early-boot hang).

    The MT7663 firmware is now stored RAW on NAND at absolute 0x4780000 (kernel2/mtd7 offset 0xd80000). A boot uci-defaults script (98-5ghz-fw) reads it into /lib/firmware/mediatek/mt7663pr2h.bin and reloads mt7615e before the wireless config comes up, so phy1 initialises with firmware.

    Two artifacts to flash:

    • mt7663pr2h.bin - the 5 GHz firmware blob, nand write to 0x4780000 (0x4401E bytes).
    • openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage - v0.2.5 kernel (13,634,551 B / 0xD00BF7), sha 7b7cebdda64d0d1f19686199e2fba3b51896ad2750d58daa27b6e911ae446ad3.

    Also includes: English LuCI (option lang 'en'), no auto-failsafe, LAN lan1-3 + wan, bootable size.

    Flash:

    tftp 0x43000000 mt7663pr2h.bin
nand erase 0x4780000 0x20000
nand write 0x43000000 0x4780000 0x4401E

tftp 0x43000000 openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xD00BF7
reset

    After boot phy1 (5 GHz) should show a real channel + Tx power and a visible SSID.

    Also attached: bootloader-mod-final3.bin (size-agnostic bootloader - recommended, avoids the truncation-on-bigger-image hang) and HANDOVER.md.

    Known remaining: radios use random MACs (board EEPROM MAC not yet wired in).

    Downloads
  • v0.2.4 62e2191454

    F670L OpenWrt - clean bootable build, English LuCI (recommended) Stable

    gitops released this 2026-10-30 17:23:10 +00:00 | 1 commits to main since this release

    Clean rebuild of the recommended bootable image. This is the one to flash if the device must simply boot.

    What it contains:

    • no auto-failsafe (WPS key disabled in DTS)
    • LAN on lan1-3 + wan (02_network f670l case)
    • English LuCI (uci-defaults 99-luci-en sets luci.main.lang=en each boot)
    • Bootable size (13,635,551 B), same memory footprint as the proven v0.2.2 - does NOT force firmware into the size-limited rescue initramfs.

    Note on 5 GHz: the MT7663 firmware is deliberately kept out of the initramfs (bundling it grows the image past the early-boot limit and hangs Starting kernel, as seen in v0.2.3). 5 GHz is 2-plane/2.4 GHz only in this build until the firmware is delivered via a persistent rootfs (separate bring-up).

    Artifacts:

    • openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage - 13,635,551 B (0xD00FDF), sha256 e625951157db63e157997006876505522b965a20b8c23383130ab74e350aa99b.
    • bootloader-mod-final3.bin - size-agnostic bootloader (reads full 32 MiB slot so any image size boots).
    • HANDOVER.md.

    Deploy (raw kernel, size-agnostic bootloader):

    tftp 0x43000000 openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xD00FDF
reset

    After boot: English LuCI at http://192.168.1.1, LAN up, 2.4 GHz. If on bootloader-mod-final2 (specific-size), you would need to match the size; final3 is size-agnostic.

    Downloads
  • v0.2.3 62e2191454

    F670L OpenWrt - 5GHz (MT7613BE) firmware included Stable

    gitops released this 2026-10-30 16:38:58 +00:00 | 1 commits to main since this release

    Update to v0.2.2: adds the MediaTek 5 GHz (MT7613BE/MT7663) firmware so the radio actually transmits/scans.

    The 5 GHz phy1 was probing but had no firmware (mt7663pr2h.bin missing, mt7663pr2h_rebb.bin fallback also missing), so it showed Channel 0 / 0 dBm and could not beacon or scan. This build ships /lib/firmware/mediatek/mt7663pr2h.bin (+ the _rebb fallback) in the initramfs (verified present in the built vmlinux-initramfs).

    Keeps all prior fixes (no auto-failsafe, LAN on lan1-3 + wan, English LuCI via uci-defaults).

    Artifacts:

    • openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage — 13,793,439 B (0xD2789F), sha256 74a273b4ca4e898c15bff16359ea62a7100561a6346b86532b015c3963ccc74a.
    • bootloader-mod-final2.bin — unchanged, re-attached.
    • HANDOVER.md.

    Deploy (bootloader unchanged; just update the raw kernel):

    tftp 0x43000000 openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xD2789F   # = 13,793,439 B
reset

    After boot, iwinfo/dmesg on phy1 should show a real channel + Tx power, and 5 GHz SSIDs become visible.

    Note: both radios still use random MACs (board EEPROM MAC not yet wired into OpenWrt) - a separate bring-up item.

    Downloads
  • v0.2.2 62e2191454

    F670L OpenWrt - English LuCI (v0.2.1 + lang=en) Stable

    gitops released this 2026-10-30 15:47:14 +00:00 | 1 commits to main since this release

    Update to v0.2.1: forces LuCI UI language to English on every boot.

    A uci-defaults script (99-luci-en) in the image runs uci set luci.main.lang=en at each boot, so LuCI is English even on the initramfs (no persistent overlay needed). All v0.2.1 fixes are included (no auto-failsafe, LAN on lan1-3 + wan, LuCI).

    Artifacts:

    • openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage — rebuilt kernel, sha256 2f0d01709b37b531bc1bf6ea4b34db05e793863f5595a648c8b4d1f9188b0139, 13,632,727 B (0xD004D7).
    • bootloader-mod-final2.bin — unchanged v0.2.0 bootloader, re-attached.
    • HANDOVER.md.

    Deploy (bootloader unchanged; just update the raw kernel):

    tftp 0x43000000 openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xD004D7   # = 13,632,727 B (use tftp-reported size)
reset

    After boot: normal boot, LAN 192.168.1.1, LuCI at http://192.168.1.1 in English.

    Downloads
  • v0.2.1 62e2191454

    F670L bring-up fixes: no auto-failsafe + LAN up + LuCI Stable

    gitops released this 2026-10-30 15:35:09 +00:00 | 1 commits to main since this release

    Update to v0.2.0 with two OpenWrt board bring-up fixes (knight v0.2.1 image).

    The v0.2.0 bootloader (bootloader-mod-final2.bin) stays the same; this is a rebuilt initramfs with the fixes below.

    What's fixed (vs v0.2.0):

    1. Auto-failsafe: the WPS key GPIO (gpio1 line 4, active-low) reads as permanently "pressed", so OpenWrt entered failsafe every boot. The key-wps node is disabled in the board DTS. Failsafe is still reachable via the console f key.
    2. LAN bring-up: 02_network now has a zte,zxhn-f670l case -> LAN bridge on lan1 lan2 lan3, WAN on wan (previously it fell to the default lan4 which does not exist, so the NIC was misconfigured). LuCI is confirmed included (luci, uhttpd).

    Artifacts:

    • openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage — the rebuilt, fixed OpenWrt kernel (sha256 fb809a263f29e61bf9064899298a9a71998a1df70f6459abed37d92baa829478).
    • bootloader-mod-final2.bin — the v0.2.0 patched bootloader, re-attached for a complete deploy.
    • HANDOVER.md — full procedure and notes.

    Deploy (no bootloader change needed if v0.2.0 already installed; just update the raw kernel):

    tftp 0x43000000 openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xD00B6F   # = 13,634,415 bytes (use the size tftp reports)
reset

    Fresh install (also write the bootloader): see v0.2.0 release notes.

    CAUTION: the bootloader write (0x0-0x180000) remains the one permanent-brick-risk operation. See HANDOVER.md §9.

    Downloads
  • v0.2.0 09d261a2b2

    Persistent OpenWrt boot Stable

    gitops released this 2026-10-30 14:54:32 +00:00 | 2 commits to main since this release

    Persistent OpenWrt boot on the ZTE ZXHN F670L (ZX279128S).

    The vendor fsload whole-flash JFFS2 loader cannot reconstruct the large incompressible OpenWrt 0uImage on-device (corrupt from ~chunk 33 regardless of inode/compression/isolation; byte-perfect offline). This release therefore boots the kernel from a RAW NAND copy via a patched bootloader, bypassing fsload.

    Artifacts

    • bootloader-mod-final2.bin — patched bootloader: default bootcmd does setenv bootargs console=ttyAMA0,115200n8; nand read 0x43000000 0x3a00000 0xcfeb8f; bootm 0x43000000; and the fsload_skip_bad_offset flood is NOP'd. Install at NAND offset 0x0.
    • openwrt-f670l-initramfs.uImage — OpenWrt kernel (13,626,255 B), written RAW to NAND 0x3a00000.
    • f670l-flash — on-device partition/flash tool.
    • HANDOVER.md — full procedure, RE notes, and caveats.

    Install

    tftp 0x43000000 openwrt-f670l-initramfs.uImage
nand erase 0x3a00000 0x2000000
nand write 0x43000000 0x3a00000 0xcfeb8f
tftp 0x44000000 bootloader-mod-final2.bin
nand erase 0x0 0x180000
nand write 0x44000000 0x0 0x180000
# power-cycle -> OpenWrt boots automatically

    CAUTION: the bootloader write (0x0-0x180000) is the one operation with permanent brick risk if done wrong; there is no backup U-Boot copy. See HANDOVER.md §9.

    Downloads
  • v0.1.0 ca6230578f

    v0.1.0 Stable

    gitops released this 2026-10-28 14:53:35 +00:00 | 14 commits to main since this release

    F670L OpenWrt port v0.1.0 — ZTE ZXHN F670L (Sanechips ZX279128S) GPON ONT.

    Reverse-engineered the F670L boot/update model (slot = version header + little-endian ZTE JFFS2 with kernel file '0uImage', boot selected by NVRAM BootImageNum) and built a working OpenWrt image + a guarded flash tool.

    Assets

    • openwrt-f670l-slot.bin — OpenWrt Linux 6.18.55 + LuCI WebUI packed as a valid F670L slot (inactive kernel1 target)
    • openwrt-sanechips-generic-zte_zxhn-f670l-squashfs-sysupgrade.bin — sysupgrade image
    • openwrt-sanechips-generic-zte_zxhn-f670l-initramfs.uImage — RAM-boot/rescue
    • f670l-flash — static ARM tool (info / boot / write-slot / read-slot)

    Verified on-device

    SMP (dual A9), SPI-NAND 256MiB, 4x GbE, MT7603E (2.4G) + MT7663 (5G) radios.
    USB is disabled on this SoC family (probing it resets the watchdog).

    Key facts (F670L-FLASH-RE.md)

    • slots: kernel1 @0x01a00000, kernel2 @0x03a00000, 32MiB each
    • boot: BootImageNum @0x00200000 (0=kernel1, 1=kernel2)
    • kernel: '0uImage' inside LE ZTE JFFS2, zlib compr=6, load 0x40008000
    Downloads