Hello,
I bought a ZLAN 9809M Din Rail 4G LTE modem Router on AliExpress and I spent quite a bit of time disassembling it and analysing its components.
This device runs on :
- a MediaTek MT7628NN processor ("7628AN ver:1 eco:2" reported in the log),
- with 16 MB flash
- and a SIMCom Wireless Solutions A7670C-MASL 4G Modem.
Using a serial terminal link, I then discovered that it runs an older version of OpenWRT for the HiWiFi HC5661A board (I also managed to get hold of the latest firmware image supplied by the manufacturer).
Boot and Recovery Environment for Embedded Devices
Copyright (C) 2020 HackPascal <hackpascal @ gmail . com>
Build date 2020-10-09 [git-676bfd4]
Version 1.1 (r1286)
DRAM: 128MB
Platform: MediaTek MT7628AN/MT7688AN ver 1, eco 2
Board: HiWiFi HC5661A
Clocks: CPU: 575MHz, Bus: 191MHz, Ref: 40MHz
Flash: Winbond W25Q128 (16MB) on mt7628-spi.0
rt5350-eth: Using MAC address xx:xx:xx:xx:xx:xx
eth0: MediaTek MT7628 built-in 5-port 10/100M switch
Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0
Press any key to interrupt autoboot ... 5
Press any key to interrupt autoboot ... 4
Press any key to interrupt autoboot ... 3
Press any key to interrupt autoboot ... 2
Press any key to interrupt autoboot ... 1
Press any key to interrupt autoboot ... 0
Trying to boot firmware from 0x00050000 in flash bank 0 ...
Reading data into memory ...
U-Boot firmware image header detected.
Image Name: MIPS OpenWrt Linux-5.4.143
Data Size: 2142402 Bytes
Load Address: 80000000
Entry Point: 80000000
Uncompressing data (LZMA) ... done.
Flushing cache ... done.
Starting kernel at 0x80000000...
[ 0.000000] Linux version 5.4.143 (root@ubuntu) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16279-5cc0535800)) #0 Tue Aug 31 22:20:08 2021
[ 0.000000] Board has DDR2
[ 0.000000] Analog PMU set to hw control
[ 0.000000] Digital PMU set to hw control
[ 0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[ 0.000000] MIPS: machine is ZLAN zlan-cat1 (16M flash)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=000396e0
[ 0.000000] Readback ErrCtl register=000396e0
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 121848K/131072K available (5080K kernel code, 203K rwdata, 1156K rodata, 1232K init, 200K bss, 9224K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] intc: using register map from devicetree
[ 0.000000] random: get_random_bytes called from start_kernel+0x358/0x54c with crng_init=0
[ 0.000000] CPU Clock: 580MHz
[ 0.000000] timer_probe: no matching timers found
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[ 0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[ 0.007915] Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
[ 0.046094] pid_max: default: 32768 minimum: 301
[ 0.050972] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.058322] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.072725] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.082598] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.089558] pinctrl core: initialized pinctrl subsystem
[ 0.095992] NET: Registered protocol family 16
[ 0.210852] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[ 0.366219] mt7620-pci 10140000.pcie: PCIE0 no card, disable it(RST&CLK)
[ 0.372969] mt7620-pci: probe of 10140000.pcie failed with error -1
[ 0.405619] usbcore: registered new interface driver usbfs
[ 0.411278] usbcore: registered new interface driver hub
[ 0.416700] usbcore: registered new device driver usb
[ 0.421907] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 0.435884] clocksource: Switched to clocksource MIPS
[ 0.442395] NET: Registered protocol family 2
[ 0.447017] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.455199] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.463699] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.471418] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.478541] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.485113] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.491738] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.499105] NET: Registered protocol family 1
[ 0.503530] PCI: CLS 0 bytes, default 32
[ 0.512309] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.527581] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.533489] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.562241] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.568227] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.574150] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.580117] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[ 0.587724] printk: console [ttyS0] disabled
[ 0.592132] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[ 0.601271] printk: console [ttyS0] enabled
[ 0.601271] printk: console [ttyS0] enabled
[ 0.609688] printk: bootconsole [early0] disabled
[ 0.609688] printk: bootconsole [early0] disabled
[ 0.619980] 10000d00.uart1: ttyS1 at MMIO 0x10000d00 (irq = 29, base_baud = 2500000) is a 16550A
[ 0.630272] spi-mt7621 10000b00.spi: sys_freq: 193333333
[ 0.652869] spi-nor spi0.0: w25q128 (16384 Kbytes)
[ 0.657822] 4 fixed-partitions partitions found on MTD device spi0.0
[ 0.664278] Creating 4 MTD partitions on "spi0.0":
[ 0.669160] 0x000000000000-0x000000030000 : "bootloader"
[ 0.675643] 0x000000030000-0x000000040000 : "config"
[ 0.681821] 0x000000040000-0x000000050000 : "factory"
[ 0.688109] 0x000000050000-0x000001000000 : "firmware"
[ 0.697621] 2 uimage-fw partitions found on MTD device firmware
[ 0.703702] Creating 2 MTD partitions on "firmware":
[ 0.708766] 0x000000000000-0x00000020b102 : "kernel"
[ 0.714865] 0x00000020b102-0x000000fb0000 : "rootfs"
[ 0.720972] mtd: device 5 (rootfs) set to be root filesystem
[ 0.728616] 1 squashfs-split partitions found on MTD device rootfs
[ 0.734971] 0x0000006d0000-0x000000fb0000 : "rootfs_data"
[ 0.742317] libphy: Fixed MDIO Bus: probed
[ 0.758111] rt3050-esw 10110000.esw: link changed 0x00
[ 0.765451] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[ 0.774170] usbcore: registered new interface driver cdc_ether
[ 0.780189] usbcore: registered new interface driver rndis_host
[ 0.786327] usbcore: registered new interface driver cdc_acm
[ 0.792093] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[ 0.800446] usbcore: registered new interface driver usbserial_generic
[ 0.807172] usbserial: USB Serial support registered for generic
[ 0.813354] usbcore: registered new interface driver option
[ 0.819090] usbserial: USB Serial support registered for GSM modem (1-port)
[ 0.828210] NET: Registered protocol family 10
[ 0.838617] Segment Routing with IPv6
[ 0.842582] NET: Registered protocol family 17
[ 0.847193] 8021q: 802.1Q VLAN Support v1.8
[ 0.860324] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[ 0.874566] Freeing unused kernel memory: 1232K
[ 0.879193] This architecture does not have kernel memory protection.
[ 0.885731] Run /sbin/init as init process
[ 1.159899] random: fast init done
[ 1.912839] init: Console is alive
[ 1.916677] init: - watchdog -
[ 3.954588] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 4.267454] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 4.283854] SCSI subsystem initialized
[ 4.293893] ehci-fsl: Freescale EHCI Host controller driver
[ 4.301955] ehci-platform: EHCI generic platform driver
[ 4.317652] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[ 4.324473] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[ 4.329786] ehci-platform 101c0000.ehci: EHCI Host Controller
[ 4.335659] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[ 4.343844] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[ 4.363904] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[ 4.371297] hub 1-0:1.0: USB hub found
[ 4.375624] hub 1-0:1.0: 1 port detected
[ 4.384720] ehci-pci: EHCI PCI platform driver
[ 4.392949] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 4.400864] ohci-platform: OHCI generic platform driver
[ 4.406536] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[ 4.413503] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[ 4.421666] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[ 4.492927] hub 2-0:1.0: USB hub found
[ 4.497265] hub 2-0:1.0: 1 port detected
[ 4.505325] uhci_hcd: USB Universal Host Controller Interface driver
[ 4.522763] usbcore: registered new interface driver usb-storage
[ 4.529857] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.539740] init: - preinit -
[ 6.014872] random: jshn: uninitialized urandom read (4 bytes read)
[ 6.113146] random: jshn: uninitialized urandom read (4 bytes read)
[ 6.414711] random: jshn: uninitialized urandom read (4 bytes read)
[ 7.047177] rt3050-esw 10110000.esw: link changed 0x00
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 7.453404] urandom_read: 2 callbacks suppressed
[ 7.453414] random: procd: uninitialized urandom read (4 bytes read)
[ 11.819707] jffs2: notice: (493) jffs2_build_xattr_subsystem: complete building xattr subsystem, 15 of xdatum (5 unchecked, 8 orphan) and 16 of xref (8 dead, 0 orphan) found.
[ 11.837747] mount_root: switching to jffs2 overlay
[ 11.849272] overlayfs: upper fs does not support tmpfile.
[ 11.861040] urandom-seed: Seeding with /etc/urandom.seed
[ 12.044214] procd: - early -
[ 12.047261] procd: - watchdog -
[ 12.736388] random: jshn: uninitialized urandom read (4 bytes read)
[ 12.832568] procd: - watchdog -
[ 12.839140] procd: - ubus -
Failed to connect to ubus
[ 13.071027] random: ubusd: uninitialized urandom read (4 bytes read)
[ 13.090339] random: ubusd: uninitialized urandom read (4 bytes read)
[ 13.118836] procd: - init -
Please press Enter to activate this console.
[ 16.175195] urngd: v1.0.2 started.
[ 16.247069] kmodloader: loading kernel modules from /etc/modules.d/*
[ 16.552221] NET: Registered protocol family 15
[ 16.570254] Initializing XFRM netlink socket
[ 16.583570] tun: Universal TUN/TAP device driver, 1.6
[ 16.598174] random: crng init done
[ 16.601686] random: 1 urandom warning(s) missed due to ratelimiting
[ 16.776339] cryptodev: driver 1.11 loaded.
[ 16.791517] GACT probability on
[ 16.801249] Mirror/redirect action on
[ 16.839520] u32 classifier
[ 16.842358] input device check on
[ 16.846091] Actions configured
[ 16.927085] usbcore: registered new interface driver cdc_ncm
[ 16.944892] usbcore: registered new interface driver cdc_subset
[ 16.961440] usbcore: registered new interface driver cdc_wdm
[ 16.977017] Loading modules backported from Linux version v5.10.42-0-g65859eca4dff
[ 16.984796] Backport generated by backports.git v5.10.42-1-0-gbee5c545
[ 17.064040] usbcore: registered new interface driver qcserial
[ 17.070029] usbserial: USB Serial support registered for Qualcomm USB modem
[ 17.096835] usbcore: registered new interface driver qmi_wwan
[ 17.217141] xt_time: kernel timezone is -0000
[ 17.229469] usbcore: registered new interface driver cdc_mbim
[ 17.496726] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[ 18.540228] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[ 18.546282] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[ 18.583905] mt76_wmac 10300000.wmac: firmware init done
[ 18.782816] PPP generic driver version 2.4.2
[ 18.797381] NET: Registered protocol family 24
[ 18.816656] kmodloader: done loading kernel modules from /etc/modules.d/*
--whl:device_work_mode
[ 41.440368] br-lan: port 1(eth0.1) entered blocking state
[ 41.445927] br-lan: port 1(eth0.1) entered disabled state
[ 41.451845] device eth0.1 entered promiscuous mode
[ 41.456776] device eth0 entered promiscuous mode
[ 41.515957] br-lan: port 1(eth0.1) entered blocking state
[ 41.521461] br-lan: port 1(eth0.1) entered forwarding state
[ 42.420389] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 48.987873] br-lan: port 2(wlan-zl) entered blocking state
[ 48.993541] br-lan: port 2(wlan-zl) entered disabled state
[ 48.999579] device wlan-zl entered promiscuous mode
[ 57.478366] IPv6: ADDRCONF(NETDEV_CHANGE): wlan-zl: link becomes ready
[ 57.485320] br-lan: port 2(wlan-zl) entered blocking state
[ 57.490950] br-lan: port 2(wlan-zl) entered forwarding state
[ 72.391905] usb 1-1: new high-speed USB device number 2 using ehci-platform
[ 72.552306] usb 1-1: config 1 has an invalid interface number: 5 but max is 4
[ 72.559607] usb 1-1: config 1 has no interface number 3
[ 77.638496] rndis_host 1-1:1.0 usb0: register 'rndis_host' at usb-101c0000.ehci-1, RNDIS device, 66:06:9c:05:d5:ee
[ 77.708751] option 1-1:1.2: GSM modem (1-port) converter detected
[ 77.715396] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0
[ 77.789364] option 1-1:1.4: GSM modem (1-port) converter detected
[ 77.796357] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB1
[ 77.896814] option 1-1:1.5: GSM modem (1-port) converter detected
[ 77.903413] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB2
I then tried to install a recent OpenWRT image for this board (openwrt-23.05.4-ramips-mt76x8-hiwifi_hc5661a-squashfs-sysupgrade.bin), and it works fine except that I lost the usb 4G LTE modem connection.
For your information, here is the list of USB packages present in the original firmware, including an obviously ‘home-made’ one (zl_usb_serial - 1.0):
root@ZLAN:~# opkg list-installed *usb*
kmod-usb-acm - 5.4.143-1
kmod-usb-core - 5.4.143-1
kmod-usb-ehci - 5.4.143-1
kmod-usb-ledtrig-usbport - 5.4.143-1
kmod-usb-net - 5.4.143-1
kmod-usb-net-cdc-ether - 5.4.143-1
kmod-usb-net-cdc-mbim - 5.4.143-1
kmod-usb-net-cdc-ncm - 5.4.143-1
kmod-usb-net-cdc-subset - 5.4.143-1
kmod-usb-net-qmi-wwan - 5.4.143-1
kmod-usb-net-rndis - 5.4.143-1
kmod-usb-ohci - 5.4.143-1
kmod-usb-serial - 5.4.143-1
kmod-usb-serial-option - 5.4.143-1
kmod-usb-serial-qualcomm - 5.4.143-1
kmod-usb-serial-wwan - 5.4.143-1
kmod-usb-storage - 5.4.143-1
kmod-usb-uhci - 5.4.143-1
kmod-usb-wdm - 5.4.143-1
kmod-usb2 - 5.4.143-1
kmod-usb2-pci - 5.4.143-1
libusb-1.0-0 - 1.0.24-4
usb-modeswitch - 2017-12-19-f40f84c2-2
zl_usb_serial - 1.0
Studying the file "/usr/lib/opkg/status", I've noticed that there are two home-made packages :
Package: zl_relay
Version: 1.0
Depends: libc, libuci20130104, libpthread
Status: install user installed
Architecture: mipsel_24kc
Installed-Time: 1630448408
Package: zl_usb_serial
Version: 1.0
Depends: libc, libuci20130104, libpthread
Status: install user installed
Architecture: mipsel_24kc
Installed-Time: 1630448408
Unfortunately, I'm stuck here and I'm not a developer, so could someone help to re-establish this link with the modem and publish the firmware for the community?
Thank you in advance.