root@flybox:/# which dropbear
[ 81.890000] SQUASHFS error: Unable to read metadata cache entry [a35ed6]
[ 81.890000] SQUASHFS error: Unable to read inode 0x27ae1eb7
root@flybox:/# p.�9�ɽ�����
#!/bin/sh /etc/rc.common
# Copyright (C) 2006-2010 OpenWrt.org
# Copyright (C) 2006 Carlos Sobrinho
START=50
STOP=50
SERVICE_USE_PID=1
NAME=dropbear
PROG=/usr/sbin/dropbear
PIDCOUNT=0
EXTRA_COMMANDS="killclients"
EXTRA_HELP=" killclients Kill ${NAME} processes except servers and yourself"
dropbear_start()
{
append_ports()
{
local ifname="$1"
local port="$2"
grep -qs "^ *$ifname:" /proc/net/dev || {
append args "-p $port"
return
}
for addr in $(
ifconfig "$ifname" | sed -ne '
/addr: *fe[89ab][0-9a-f]:/d
s/.* addr: *\([0-9a-f:\.]*\).*/\1/p
'
); do
append args "-p $addr:$port"
done
}
local section="$1"
# check if section is enabled (default)
local enabled
config_get_bool enabled "${section}" enable 1
[ "${enabled}" -eq 0 ] && return 1
# verbose parameter
local verbosed
config_get_bool verbosed "${section}" verbose 0
# increase pid file count to handle multiple instances correctly
PIDCOUNT="$(( ${PIDCOUNT} + 1))"
# prepare parameters (initialise with pid file)
local pid_file="/var/run/${NAME}.${PIDCOUNT}.pid"
local args="-P $pid_file"
local val
# A) password authentication
config_get_bool val "${section}" PasswordAuth 1
[ "${val}" -eq 0 ] && append args "-s"
# B) listen interface and port
local port
local interface
config_get interface "${section}" Interface
config_get interface "${interface}" ifname "$interface"
config_get port "${section}" Port 22
append_ports "$interface" "$port"
# C) banner file
config_get val "${section}" BannerFile
[ -f "${val}" ] && append args "-b ${val}"
# D) gatewayports
config_get_bool val "${section}" GatewayPorts 0
[ "${val}" -eq 1 ] && append args "-a"
# E) root password authentication
config_get_bool val "${section}" RootPasswordAuth 1
[ "${val}" -eq 0 ] && append args "-g"
# F) root login
config_get_bool val "${section}" RootLogin 1
[ "${val}" -eq 0 ] && append args "-w"
# G) host keys
config_get val "${section}" rsakeyfile
[ -f "${val}" ] && append args "-r ${val}"
config_get val "${section}" dsskeyfile
[ -f "${val}" ] && append args "-d ${val}"
# execute program and return its exit code
[ "${verbosed}" -ne 0 ] && echo "${initscript}: section ${section} starting ${PROG} ${args}"
SERVICE_PID_FILE="$pid_file" service_start ${PROG} ${args}
}
keygen()
{
for keytype in rsa dss; do
# check for keys
key=dropbear/dropbear_${keytype}_host_key
[ -f /tmp/$key -o -s /etc/$key ] || {
# generate missing keys
mkdir -p /tmp/dropbear
[ -x /usr/bin/dropbearkey ] && {
/usr/bin/dropbearkey -t $keytype -f /tmp/$key 2>&- >&- && exec /etc/rc.common "$initscript" start
} &
exit 0
}
done
lock /tmp/.switch2jffs
mkdir -p /etc/dropbear
mv /tmp/dropbear/dropbear_* /etc/dropbear/
lock -u /tmp/.switch2jffs
chown root /etc/dropbear
chmod 0700 /etc/dropbear
}
start()
{
echo "dropbear_start" > /dev/kmsg
[ -s /etc/dropbear/dropbear_rsa_host_key -a \
-s /etc/dropbear/dropbear_dss_host_key ] || keygen
include /lib/network
scan_interfaces
config_load "${NAME}"
config_foreach dropbear_start dropbear
echo "dropbear_start_end" > /dev/kmsg
}
stop()
{
echo "dropbear_stop" > /dev/kmsg
local pid_file pid_files
pid_files=`ls /var/run/${NAME}.*.pid 2>/dev/null`
[ -z "$pid_files" ] && return 1
for pid_file in $pid_files; do
SERVICE_PID_FILE="$pid_file" service_stop ${PROG} && {
rm -f ${pid_file}
}
done
}
killclients()
{
local ignore=''
local server
local pid
# if this script is run from inside a client session, then ignore that session
pid="$$"
while [ "${pid}" -ne 0 ]
do
# get parent process id
pid=`cut -d ' ' -f 4 "/proc/${pid}/stat"`
[ "${pid}" -eq 0 ] && break
# check if client connection
grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" && {
append ignore "${pid}"
break
}
done
# get all server pids that should be ignored
for server in `cat /var/run/${NAME}.*.pid`
do
append ignore "${server}"
done
# get all running pids and kill client connections
local skip
for pid in `pidof "${NAME}"`
do
# check if correct program, otherwise process next pid
grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" || {
continue
}
# check if pid should be ignored (servers, ourself)
skip=0
for server in ${ignore}
do
if [ "${pid}" == "${server}" ]
then
skip=1
break
fi
done
[ "${skip}" -ne 0 ] && continue
# kill process
echo "${initscript}: Killing ${pid}..."
kill -KILL ${pid}
done
}
when i try:
./serio.py -s update.bin -d /tmp/update.sh -p /dev/ttyUSB0 -b 115200
i get:
$sudo ./serio.py -s update.bin -d /tmp/update.sh -p /dev/ttyUSB0 -b 115200
ERROR: No module named 'serial'
that's not an openwrt issue, but I guess you need pyserial ?
learner981:
module
thank you, i have downloaded pyserial and now serio is working but it is very very slow.
Yes, it is, image transfer time is probably 10-15 mins
Imagine BBSes in the 80ies running at 300bps, you're at 115200.
i have added a pull request:
main ← learner8094:main
opened 04:48AM - 26 Jun 25 UTC
ath79: add support for TCL HH41V
The TCL HH41V is a CAT4 LTE router used by var… ious ISPs.
Specifications
==============
SoC: QCA9531 650MHz
RAM: 128MiB
Flash: 32MiB SPI NOR
LAN: 1x 10/100MBit
WAN: 1x 10/100MBit
LTE: MDM9207 USB 2.0 (rndis configuration)
WiFi: 802.11n (SoC integrated)
it is almost the same as HH40v with a telephone port
the content of this file: qca9531_tcl_hh41v.dts is the same as you added just with name of device changed.
i think the mac address of eth0 may be different because the port is not working
how to i get the proper mac adress of that port to adjust that file? and what other changes i have to do? i hope that you can help. thank you.
learner981:
added a pull request:
it's not following the template, nor does it contain any install how to.
i have added the installation methode.
which template?
i have followed this:
committed 05:32PM - 23 Apr 23 UTC
The Alcatel HH40V is a CAT4 LTE router used by various ISPs.
Specifications
===… ===========
SoC: QCA9531 650MHz
RAM: 128MiB
Flash: 32MiB SPI NOR
LAN: 1x 10/100MBit
WAN: 1x 10/100MBit
LTE: MDM9607 USB 2.0 (rndis configuration)
WiFi: 802.11n (SoC integrated)
MAC address assignment
======================
There are three MAC addresses stored in the flash ROM, the assignment
follows stock. The MAC on the label is the WiFi MAC address.
Installation (TFTP)
===================
1. Connect serial console
2. Configure static IP to 192.168.1.112
3. Put OpenWrt factory.bin file as firmware-system.bin
4. Press Power + WPS and plug in power
5. Keep buttons pressed until TFTP requests are visible
6. Wait for the system to finish flashing and wait for reboot
7. Bootup will fail as the kernel offset is wrong
8. Run "setenv bootcmd bootm 0x9f150000"
9. Reset board and enjoy OpenWrt
Installation (without UART)
===========================
Installation without UART is a bit tricky and requires several steps too
long for the commit message. Basic steps:
1. Create configure backup
2. Patch backup file to enable SSH
3. Login via SSH and configure the new bootcmd
3. Flash OpenWrt factory.bin image manually (sysupgrade doesn't work)
More detailed instructions will be provided on the Wiki page.
Tested by: Christian Heuff <christian@heuff.at>
Signed-off-by: Andreas Böhler <dev@aboehler.at>
I thought it didn't work on the 41V ?
i have tested it with 3 modems and it worked, the modem that did not work with it i think the problem is in that modem: there may be something corrupted in its system.
in the original firmware:, the art partition shows:
root@(none):/# cat /dev/mtd6 |hexdump
0000000 9c4f cfd5 06c1 9c4f cfd8 fe3a ffff ffff
0000010 ffff ffff ffff ffff ffff ffff ffff ffff
*
0001000 0202 9c4f cfb3 ea02 0000 0000 0000 0000
0001010 0000 0000 0000 0000 0000 0000 0000 1f00
0001020 3302 0000 0000 0400 0400 4d04 0300 08ff
the Mac adresses:
root@flybox:/# ifconfig
ath0 Link encap:Ethernet HWaddr 9C:4F:CF:B3:EA:02
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:39 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
br-lan Link encap:Ethernet HWaddr 9C:4F:CF:D8:FE:3A
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::9e4f:cfff:fed8:fe3a/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9522 errors:0 dropped:0 overruns:0 frame:0
TX packets:10818 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1646522 (1.5 MiB) TX bytes:4371764 (4.1 MiB)
eth0 Link encap:Ethernet HWaddr 9C:4F:CF:D5:06:C1
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:4
eth1 Link encap:Ethernet HWaddr 9C:4F:CF:D8:FE:3A
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9522 errors:0 dropped:0 overruns:0 frame:0
TX packets:10813 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1779830 (1.6 MiB) TX bytes:4371226 (4.1 MiB)
Interrupt:5
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:4178 errors:0 dropped:0 overruns:0 frame:0
TX packets:4178 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:240264 (234.6 KiB) TX bytes:240264 (234.6 KiB)
usb0 Link encap:Ethernet HWaddr D6:C2:4A:61:BF:EC
inet addr:192.168.225.111 Bcast:192.168.225.255 Mask:255.255.255.0
inet6 addr: fe80::d4c2:4aff:fe61:bfec/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3039 errors:0 dropped:0 overruns:0 frame:0
TX packets:3973 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:429754 (419.6 KiB) TX bytes:551568 (538.6 KiB)
wifi0 Link encap:UNSPEC HWaddr 9C-4F-CF-B3-EA-02-00-93-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:17 errors:0 dropped:0 overruns:0 frame:0
TX packets:10186 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:2699
RX bytes:3926 (3.8 KiB) TX bytes:2690742 (2.5 MiB)
Interrupt:47 Memory:b8100000-b8120000
so there are 3 adresses, but in the file: qca9531_alcatel_hh40v.dts there are just 2 MAC adresses? why is this?
ð0 {
status = "okay";
nvmem-cells = <&macaddr_art_0>;
nvmem-cell-names = "mac-address";
phy-handle = <&swphy4>;
};
ð1 {
compatible = "qca,qca9530-eth", "syscon", "simple-mfd";
nvmem-cells = <&macaddr_art_6>;
nvmem-cell-names = "mac-address";
};
&wmac {
status = "okay";
nvmem-cells = <&cal_art_1000>;
nvmem-cell-names = "calibration";
};
IIRC, the ath9k (or ath10k?) driver automatically extracts the Mac address from the ART partition, hence there is no need to manually override the Mac address.
thank you.
for the image of hhv40 it worked with me on hh41v with the version 24.10.1 and the modem is worknig with it, but with version 24.10.2 and the snapshot: the rndis modem is not giving the internet connection.
edit: even when i go back to 24.10.1 i does not give the internet to the wifi connected devices nor to the lan port. i made restart the configuration but the same problem. when i ping openwrt.org from the router it has access to internet but not the connected devices. what can cause this problem?
i think the problem may be in the gateway
edit:
the problem is solved by adding the wan interface to the wan firewall zone
the hh40v firmware is working well with hh41v.
and to let the lan2/wan port working and gives ip adress: eth0 should be added to br-lan and wan6 should be deleted.
we can generate a version from the download page with this uc-defaults to run in the first boot:
uci -q batch << 'EOF'
set network.wan.device='usb0'
delete network.wan6
add_list network.br_lan.ports='eth0'
delete wireless.@wifi-device [0].disabled
delete wireless.@wifi-iface [0].disabled
commit network
commit wireless
EOF
this pr adds this device to openwrt:
main ← devopnem:main
opened 07:43AM - 10 Jun 26 UTC
The Alcatel HH41V is hardware-identical to the HH40V, sharing the same PCB, flas… h layout, radios, and peripherals. Add the HH41V compatible string to allow the same firmware image to boot on both device models.
and this pr adds an app that comunicate with the internal modem like the oem original firmware:
master ← devopnem:feat/luci-app-hh4xmodem
opened 09:31AM - 17 Jun 26 UTC
### Description
New LuCI application to monitor and control the MDM9207 modem f… ound in HH40V and HH41V routers.
Features:
- Dashboard: signal quality, network registration, data usage, device info, LAN/router status — all in one view
- SMS: show and delete messages
- Call Log: view recent call history
- USSD: send USSD codes and view responses (requires sms-tool)
- Connect/Disconnect: manual modem connection control
- Reboot: restart modem from dashboard
- SIM PIN/PUK: unlock, enable/disable, and change PIN
- NCK SIM Unlock: unlock network-locked SIMs
- Monthly Usage Plan: configurable billing day and data limit
- Factory Reset: reset modem to factory defaults
- Firmware Update Check: check for new firmware versions via FOTA
- Clear Usage / Clear Call Log: reset counters
Communication with the modem uses the pack protocol over TCP (192.168.225.1:2016) for most features, with a fallback to serial AT via sms-tool for USSD. All backend logic runs inside rpcd as a ucode plugin.
Why this approach is better than AT Commands
1. Speed — Batch Protocol vs. Serial AT
AT commands are sequential — one command, one response, one at a time. Querying 20 modem parameters (network info + signal + SMS + call log) requires 20 round-trips over a serial line at 115200 baud, taking 8–12 seconds.
The pack protocol bundles multiple queries into a single TCP request and returns all results in one JSON response. Our hh4xmodem-pack helper retrieves 15+ data points in under 2 seconds — a 5–6× speedup.
2. Clean Parsing vs. String Hacking
AT responses are unstructured text: +CSQ: 15,99, +CREG: 0,1, etc. Every app reinvents fragile regex parsing. The pack protocol returns structured JSON — no parsing, no edge cases, no locale-dependent issues.
3. Reliability — TCP vs. Serial
The MDM9207 exposes its management interface over TCP (192.168.225.1:2016). Serial AT over /dev/ttyUSB2 is:
- Slow (115200 baud)
- Fragile (AT interleaving, modem busy, DCD drops)
- Single-client (two processes can't share the port)
TCP is reliable, fast, and multi-client safe.
4. Direct Modem Integration via RPC
We bypass the shell entirely. The ucode backend (hh4xmodem.uc) runs inside rpcd, opens a TCP socket to the modem via ucode-mod-socket, and returns data directly to LuCI. No scripts, no pipes, no temporary files, no popen().
5. Clean Architecture
LuCI View (JS) → rpcd (ucode) → TCP socket → modem core_app
Each layer is thin, testable, and replaceable. Adding a new API endpoint takes one line in the backend.
This is an initial submission — no prior package exists.
###Screenshot
<img width="1467" height="640" alt="hh4x" src="https://github.com/user-attachments/assets/c0bca11e-a695-41c5-85cb-0ee30d299049" />
### Maintainer
@devopnem
---
## Tested on
**OpenWrt version:** OpenWrt 25.12.4
**LuCI version:** LuCI openwrt-25.12 branch
**Web browser(s):** librewolf 151.0.1-2
---
## Checklist
- [x] This PR is not from my *main* or *master* branch, but a *separate* branch.
- [x] Each commit has a valid `Signed-off-by: Devon Openheim <devopenm@proton.me>` row.
- [x] Each commit and PR title has a valid `<package name>: title` first line subject for packages.
- [ ] Incremented any `PKG_VERSION` in the Makefile. (N/A — initial package, no prior version)