ZTE ZXHN H188A / H288A

The ZTE ZXHN H188A / H288A is a VDSL2/ADSL2+ dual-band wireless gateway based on the MediaTek/EcoNet EN751627 platform.

This page documents the hardware, serial console, bootloader, flash layout, stock firmware and ongoing OpenWrt development for the device.

The device is not currently supported by an official device image.

However, the EN751627 platform is now present in OpenWrt under the econet target, with existing EN751627 development providing a useful basis for porting the H188A/H288A.

Development discussion:

* OpenWrt forum: Support for the ZTE H188A/H288A * Existing EN751627 OpenWrt work: Zyxel EX3301-T0 / econet target

The immediate development goal is to understand the ZTE bootloader and obtain a repeatable method for loading an OpenWrt initramfs image into RAM without modifying the stock NAND.

At least one documented board is clearly marked:

ZXHN H288AV1.1

Photographs of a WE (Telecom Egypt) H188A, hardware V2.0.2, whose board is marked ZXHN H288AV1.1 (PCB code 44493H288A_171101-A). Photos by Yousef-Mohamed22.

A walkthrough video of about 131 seconds, panning over both sides of the board, is available here.

Major components visible on the PCB include:

* EcoNet EN751627 SoC * MediaTek MT7603EN 2.4 GHz radio * MediaTek MT7612EN 5 GHz radio * HeyangTek HYF1GQ4UDACAE SPI-NAND

Notes on the WE unit above:

• The housing has 4 × LAN (LAN4 doubles as WAN), 1 × DSL (RJ11), 1 × USB and a 12 V / 1.5 A power input.
• There are no phone (FXS) ports on the housing, although the PCB silkscreen has LED footprints for SLIC1 and SLIC2.
• The front LEDs are Power, DSL, Internet, 2.4GHz, 5GHz, WPS and USB.
• The board in this H188A unit is marked as an H288A board.
• Contributed by Yousef-Mohamed22.

An unpopulated four-pin header labelled X1A4 is present on the PCB and is connected to the serial console.

Serial parameters:

Voltage: 3.3 V TTL
Baud:    115200
Data:    8 bits
Parity:  none
Stop:    1

On the WE H188A V2.0.2 unit, the header is four plated through-hole pads in a row. Pin 1 is the square pad, marked 1 on the silkscreen. The four pads also appear on the bottom side of the board, where the square pad is again pin 1. The silkscreen next to the header reads CHECK: X1A4 or Y1A4. The pin order (GND / TX / RX / 3.3 V) has not been measured yet.

TODO: Add confirmed X1A4 pinout photograph and pin order.

The device uses U-Boot / an EcoNet-derived boot environment.

TODO:

* Record complete power-on UART output. * Document boot interruption method. * List available bootloader commands. * Dump the environment. * Determine whether TFTP or another mechanism can load images into RAM. * Determine kernel load/entry addresses. * Document recovery mechanisms.

A major development objective is to boot an OpenWrt initramfs image entirely from RAM before attempting any modifications to NAND.

The device contains a 128 MiB HeyangTek HYF1GQ4UDACAE SPI-NAND device.

Reported NAND geometry:

Manufacturer ID: 0xc9
Device ID:       0x21
Page size:       2048 bytes
OOB size:        64 bytes
Erase block:     128 KiB
Total capacity:  128 MiB

The stock firmware uses a dual-bank layout with separate kernel and root filesystem partitions.

The following layout has been observed in stock firmware logs:

The wifi partition is believed to contain wireless calibration data. Its contents and exact calibration/MAC-address offsets must be verified before creating the final OpenWrt device tree.

The EN751627 provides two PCIe root complexes.

Stock boot logs report both PCIe links active. The board contains:

* MediaTek MT7603EN — 2.4 GHz * MediaTek MT7612EN — 5 GHz

Both chipsets are supported by the Linux/OpenWrt mt76 wireless stack.

Calibration/EEPROM storage locations still need to be determined from the stock flash contents.

The stock firmware identifies an internal EcoNet switch and five Ethernet interfaces.

Further work is required to document:

* CPU/switch topology * Physical port numbering * LAN/WAN port mapping * PHY configuration * VLAN configuration * Current EN751627 Ethernet support in OpenWrt

The device supports ADSL2+ and VDSL2.

The board uses the EcoNet/MediaTek DSL subsystem with an EN7556N line-interface device.

DSL support should be considered separately from the initial OpenWrt device port. Initial OpenWrt development can proceed using Ethernet WAN even if the integrated DSL modem is not yet supported.

The board contains a Silicon Labs SLIC implementation providing 2 × FXS telephone interfaces.

VoIP/FXS support is not required for the initial OpenWrt port.

The EN751627 vendor kernel exposes xHCI, EHCI and OHCI USB controllers.

Vendor boot logs report:

xHCI MMIO: 0x1fb90000
IRQ:       10

Exact USB capabilities exposed by each H188A/H288A hardware revision should be verified from the physical device.

One documented firmware environment uses:

Linux 3.18.21
Buildroot 2015.08.1
SquashFS
JFFS2

Different ISP variants and hardware revisions may use different firmware versions.

Known ISP variants should be documented separately rather than assuming that all H188A/H288A firmware is interchangeable.

Useful material collected during the hardware investigation includes:

* Complete UART boot logs * Stock firmware files * FTP filesystem extraction * High-resolution PCB photographs * Flash/partition information * Detailed hardware analysis

Where possible, important technical information should also be reproduced directly on this wiki page rather than depending solely on external file-hosting services.

* Add high-resolution PCB photographs to the OpenWrt wiki. * Confirm hardware revisions separately. * Add X1A4 UART pinout. * Capture complete bootloader output. * Document bootloader interruption. * Determine RAM-loading/TFTP capability. * Obtain and hash complete NAND backup. * Confirm full MTD layout. * Locate Wi-Fi EEPROM/calibration data. * Locate MAC-address storage. * Create H188A/H288A DTS. * Build EN751627 OpenWrt initramfs image. * RAM-boot OpenWrt without modifying NAND. * Bring up SPI-NAND. * Bring up PCIe. * Bring up MT7603EN. * Bring up MT7612EN. * Bring up Ethernet. * Determine safe installation/recovery procedure. * Investigate DSL support separately. * Investigate FXS/VoIP support separately.

Initial hardware investigation, motherboard photographs, stock firmware information and boot-log analysis were contributed by community members including gizmobo.

Additional EN751627/OpenWrt information and development references were contributed through the OpenWrt community discussion.

Please preserve attribution when incorporating photographs, logs or other material contributed by individual researchers.