Support for Alcatel HH40V?

For Developers
1

Hi,

I recently stumbled across an old LTE based router from my provider(A1 Austria). I used it around 3 months. Only because my girlfriend spilled some orange juice over it :expressionless:
But, after all this years and some cleaning it still works.

So thought, might there a way to install OpenWrt?

After some googling, I've found out that this device runs already a OpenWrt variant (variant because it was compiled using QSDK).

So it's an ar71xx based board running kernel 3.3.8 and OpenWrt version 12.09-rc1. (Compile date around 2017). So it even was pretty much outdated when they compiled it. SSH is enabled by default and the password is known.

I've found the serial test points and have access to u-boot.

U-Boot 1.1.4-g70c8c5aa-dirty (Jul 14 2017 - 19:35:39)

ap147 - Honey Bee 2.0DRAM:  
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x7, 0x23)
Tap values = (0x15, 0x15, 0x15, 0x15)
------------------------------config goio start!-------------------------------------------
--------------------------------config goio end!-------------------------------------------
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x19
flash size 16MB, sector count = 256
Flash: 16 MB
Power up PLL with outdiv = 0 then switch to 3
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:XX:XX:XX
------------------------------aaaaaaaaaaaaaaaaaaa------------------------------------------
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
-----------------------------delay 1.8s---------------------------------------------------
-----------------------------turn off led---------------------------------------------------
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:XX:XX:XX
------------------------------aaaaaaaaaaaaaaaaaaa------------------------------------------
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
------------------------------aaaaaaaaaaaaaaaaaaa------------------------------------------
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
------------------------------aaaaaaaaaaaaaaaaaaa------------------------------------------
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
------------------------------aaaaaaaaaaaaaaaaaaa------------------------------------------
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
-----------------------------delay 1s---------------------------------------------------
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x811a100
Hit any key to stop autoboot:  2     1     0 
jrd reset = 1, wps = 1
oem_updat_flag = 0x68737173 
ath>

u-boot-env:

bootargs=board= console=ttyS0,115200  mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),14528k(rootfs),1408k(uImage),64k(mib0),64k(ART) rootfstype=squashfs,jffs2 noinitrd
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap147${bc}-jffs2&&erase 0x9f050000 +0xE30000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9fE80000 +$filesize&&cp.b $fileaddr 0x9fE80000 $filesize
ethact=eth0
ipaddr=192.168.1.1
serverip=192.168.1.112
bootcmd=bootm 0x9fe80000
stdin=serial
stdout=serial
stderr=serial

root@hh40:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00100000 00010000 "oem"
mtd3: 00d30000 00010000 "rootfs"
mtd4: 002e0000 00010000 "rootfs_data"
mtd5: 00170000 00010000 "kernel"
mtd6: 00010000 00010000 "art"
mtd7: 00ea0000 00010000 "firmware"

First I've tried myself to compile a newer version of OpenWrt, but it didn't worked out as I liked it. I've adjusted the u-boot-env to fit the new kernel but got kernel panic :

[    0.355566] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.363351] Please append a correct "root=" boot option; here are the available partitions:
[    0.371976] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Could anyone help me with my quest?
Thanks for your time. :slightly_smiling_face:

2

Hi dx3m,

Interested but developer noob. :slight_smile:

  1. what is written in the original dmesg output for VFS?

It cleary has a mount problem - The ORiginal Firmware mmmount block is 31:3

" ```
[ 3.180000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.

source: https://github.com/froonix/HH40V/wiki/dmesg-output

2) is it capable of OpenWRT 21 or what are your plans ?

Cheers BruceOS
3
  1. Upgrading an old OpenWrt (AP147) - #6 by grosjo
    ^^
    -> https://github.com/grosjo/OpenWrt-Kuwfi-CPE830

There is a generic image for the ap147 / QCA9531 rev2 SOC Board
So do we want to start from that ?

4

Hello,

I also have this router and I would like to be able to compile and install OpenWrt on it.
Unfortunately I am a beginner in this field and I don't know where to start.

I managed to get access to the Android modem part with SSH, but not to the router part.
Instruction here: https://github.com/froonix/HH40V/issues/2

I don't know if it's relevant, I also download the stock firmware here: https://alcatelfirmware.com/alcatel-onetouch-hh40v

5

I just received such a router and I have access to the serial console (U-Boot). Looks like the required bits for enabling OpenWrt on this router are available.

Compiling a netboot image right now...

6

Porting OpenWrt is relatively easy, going back to stock isn't.
However, the modem is not going to work: The embedded modem is based on Android and provides an RNDIS interface. However, in order to configure this interface, a custom jsonrpc protocol is used. It looks quite simple, but I don't want to invest that much time into this rather old router.

Edit: Looks like there is an additional AT control port that is supported by the option driver - so getting the modem to work is possible and actually quite easy. I'll polish device support and create a PR once I've figured out how to install it without serial access.

3 Likes
7

I just created a PR at https://github.com/openwrt/openwrt/pull/12351

Installing without opening the case is not exactly easy but I found a method that should work. Once the PR is accepted, I will put the installation instructions to the OpenWrt wiki. For the time being they are on my website: https://www.aboehler.at/doku/doku.php/projects:hh40v

2 Likes
8

Hi @andyboeh ,
i have such a device for testing this image. Can you provide a ready build image for testing (did not find any on you website?)
thanks
Chris

9

I do not provide public binary images. Experience has shown that this leads to more confusion than it serves. Please build from source.

10

HI,
compiled a image from your sources,
its working as expected.
many thanks for you work :slight_smile:
Br
Chris

1 Like
11

Good work!

Maybe SSH access can be achieved as it can be done on the younger brother HH70VB, via a 15-seconds WPS press. Much easier than the configuration backup/restore mod.
See here for info: https://github.com/jamesmacwhite/hh70-ee/wiki/SSH-access

Also, I'm wondering how difficult it would be to adapt this to the HH70VB.
Did you find GPIO assignment from the vendor DTS? (is it even available once you get SSH access?)

12

Unfortunately, it can't. The linked hotplug script is not present on the OEM firmware.

The HH70 is an entirely different platform, based on the ipq4019 SoC. Without the device, nobody can tell whether it's possible to support it or not.

No. On the old ag71xx platform the OEM firmware was based on, there was no device tree. All GPIOs were probed according to the Wiki: https://openwrt.org/docs/techref/hardware/port.gpio

13

I have one, and am willing to try. I can do UART.

1 Like
14

How different is HH41V? I have HH41V and I'm willing to help adding support for it. I'm complete newbie in OpenWRT but I know electronics a bit. I can try to gain access to serial console and bootloader, dump flash and test compiled builds if someone is willing to help.

15

Only you can answer this question by what you already suggested: attach serial console and get a boot log.

16

…and high-res photos of the PCB, ideally with readable chip labels.

1 Like
17

@slh
@andyboeh