Finding power switch GPIO/ testing all possible GPIO


I'm trying to port Openwrt to this device:

The issue is that they have a GPIO that controls the 3G card power supply. But I can't find which one and how to access it.

1°) Is there a way to know which gpio it is from the factory firmware? It is mounted to /sys/class/gpio/3g_power/ , but I do not have sources.
2°) Is there a way to modify dts so that all pins are availliable as GPIO, and so that I can manually test them one by one, to see if they trigger power supply for 3g?

Thank's a lot in adavance.

Do you have a firmware upgrade image maybe?
If its using DTS you could extract DTB fromt the uImage and convert it back to DTS with DTC

Ok thank's I will try to see if I can get a firmware image from the manufacturer.

Also is there maybe a way to dump uimage from the device itself running their firmware?

(It is based on openwrt 14.04 so it is most probably using dts)

You can try dumping the firmware partition and then use binwalk to inspect it and extract the dtb

If you have a dts based device, then you will have /sys/firmware/devicetree/base/ with all nodes and properties of your used device tree populated...

Here you can read also something like the gpio number... Your gpio should be under gpio-export as in my example.

Example for WDR3600 (ath79):

hexdump /sys/firmware/devicetree/base/gpio-export/gpio_usb2_power/gpios 
0000000 0000 000f 0000 0015 0000 0000

0000 000f = phandle to gpio-controller node
0000 0015 = gpio number in hex (here gpio 21 on gpio controller with phandle 0000 000f)
0000 0000 = active high (0000 0001 = active low)

Output of phandle from gpio controller:

hexdump /sys/firmware/devicetree/base/ahb/apb/gpio@18040000/phandle 
0000000 0000 000f

You can search for all available gpio-controllers with
find /sys/firmware/devicetree/base -name gpio-controller

Example for WDR3600 (ATH79):

find /sys/firmware/devicetree/base -name gpio-controller

This device does have two gpio controllers.

1 Like


Ok I could extract it with

dd if=/dev/mtdblock3 of=/tmp/test3.dump


binwalk -e test3.dump

I get

0             0x0             uImage header, header size: 64 bytes, header CRC: 0x3A30D79, created: Thu Jan 18 00:16:36 2018, image size: 1076996 bytes, Data Address: 0x80000000, Entry Point: 0x80000000, data CRC: 0x6C2D491D, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.10.49"
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3213996 bytes
1077060       0x106F44        Squashfs filesystem, little endian, version 4.0, compression:lzma (non-standard type definition), size: 7511348 bytes,  2031 inodes, blocksize: 262144 bytes, created: Thu Jan 18 00:16:31 2018
8650752       0x840000        JFFS2 filesystem, little endian

And I have a file 40.7z which obviously is the uImage. Now i need to find how to extract dts from it.

You should also have file 40
Simply use device tree compiler.
It has really good --help page that is pretty self explanatory


There is no such folder. Their firmware is based on 14.04 , should there be /sys/firmware/devicetree/base/ on 14.04?

Binwalk didn´t find a dtb...
This is no dts based kernel!

Only the rootfs is based on openwrt i think... Kernel is from vendor!


uname -a
Linux G3 3.10.49 #217 Thu Jan 18 07:16:22 CST 2018 mips GNU/Linux

So is there a way to test all processor pins one by one, to see which one is enabling power for 3g?


If you're suggesting this method:

cd /sys/class/gpio
echo $GPIO > export
echo "out" > gpio$GPIO/direction
echo 0 > gpio$GPIO/value
sleep 1s
echo 1 > gpio$GPIO/value
sleep 1s
echo $GPIO > unexport

I've already tested, but by default only very few pins are available as gpio (6 I believe). And none of them triggers 3g power. I guess some configuration needs to be put in dts so that processors pin are muxed as gpio?

Seems you could not export a gpio that is already exported with gpio-export.

On MY firmware based on 15.05, I can export:

gpio1 gpio2 gpio37 gpio38 gpio39 gpio72

All other refuse to export with my current dts ( ZBT-WA05.dts ), none of theses is the one I'm looking for.

Ok so I got the info form the manufacturer the pin that controls the power supply is H2 (i.e EPHY _LED2 _N _JTMS )

Any idea how to get it available as a GPIO?

It should be GPIO 42
Check page 22 of the datasheet.
But I think you gotta disable JTAG and Switch LED modes so its exposed as GPIO.

Check out page 37 of Programming guide.


Yes the pin multiplexing is not correctly done.

I will try to see if I can do something with that:

I will need a bit of time, I keep you updated.

You can do something like this:

Just the mode needs to be changed

The following might be helpful:

1 Like