Saturday, 21 December 2013

Mini USB Portable 3G/4G router - rt5350f

Introduction

Mini USB Portable 3G/4G WiFi Hotspot IEEE 802.11b/g/n 150Mbps Wireless Router - search on ebay


This hardware seems to be exactly the same like (firmware is different ):
  • HAME A5 Mini
  • HAME A15
Upgrade with default firmware via WEB interface is not possible. Upgrade from u-boot (tftp) is not  working too  - because of broken ethernet configuration. Upgrade from u-boot via serial (kermit) will end with bricked router too ( verified).

Below you will find the way how to bring new working u-boot and openwrt firmware at once.

Basic device parameters:

  • SoC RT5350
  • MIPS CPU
  • Clock 360 MHz
  • 4 MByte Flash (GD25Q32) 
  • 16 MByte RAM (EM639165TS-6G)
  • USB Host 2.0
  • 10/100 Ethernet switch
  • 802.11n interface
  • I2C
  • Uart
  • Reset button
  • 2 LEDs
  • Micro usb as power source

GPIO description:


  • GPIO0 - Reset Button
  • GPIO1 - I2C_SD
  • GPIO2 - I2C_SCLK
  • GPIO7 - USB Power
  • GPIO12 - USB Root Hub Power
  • GPIO13 - Unknown, but seems to be used in bootloader
  • GPIO17 - Red Power LED
  • GPIO20 - Blue System LED

Bootloader

Default u-boot bootloader is broken - ethernet is not fully initialized, and it seems that it is protected against starting other firmware than oryginal one.
Do not try to upgrade this bootloader from bootloader menu - you will brick your device  !

To load openwrt firmware new bootloader is needed - I am using - uboot128.img taken from JiapengLi

Openwrt firmware

Default firmware cannot accept openwrt images so at the beggining (after u-boot upgrade) we will load minimal openwrt firmware firmware.img .

Upgrade procedure

Verification
Check twice if it is router we are talking about:

  • Take a look on photos of PCB
  • Check MDT structure by call "cat /proc/mtd", has to be like below:
cat /proc/mtd
dev:    size   erasesize  name

mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00117a6d 00010000 "Kernel"
mtd5: 00298593 00010000 "RootFS"
mtd6: 003b0000 00010000 "Kernel_RootFS"
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader" 
Think twice :)

First step

  • Reset router to default settings
  • Connect to router via telnet and login with default user name (admin) and password (admin)
  • Now  you can upgrade router via FTP or USB

Upgrade via FTP 

  • Release memory by commands:  
killall udhcpd
killall dnsmasq
killall nvram_daemon
rmmod ehci_hcd
rmmod ohci_hcd
ifconfig ra0 down
rmmod rt2860v2_ap

  • probably you will be disconnected after last command, so login via telnet again. 
  • Verify free memory by calling free, check if you have more than  3500 free memory 

# free              total         used         free       shared      buffers  Mem:        12884         9180         3704            0          532 Swap:            0            0            0Total:        12884         9180         3704
  •  Resize TMP, and start proftp server
mount -o remount,size=4M tmpfs /tmp
proftpd.sh server 192.168.100.1 192.168.100.1 21 10
proftpd
  • Connect to router via ftp and copy uboot128.img and firmware.img to /tmp directory on router
  • ! Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write  /tmp/uboot128.img Bootloader
  • You should see on console 
#Unlocking Bootloader ...
#Writing from /tmp/uboot128.img to Bootloader ...  [w]
  • ! Upgrade firmware - do not reset router during this operation!
mtd_write write /tmp/firmware.img Kernel_RootFS
  • You should see on console  
#Unlocking Kernel_RootFS ...
#Writing from /tmp/firmware.img to Kernel_RootFS ...  [w]
  • Reboot router :), enjoy new u-boot with working ethernet and openwrt firmware. Now you can use standard openwrt upgrade procedure. 
reboot 
  • Router will set IP address to 192.168.100.1 , you can login via telnet or ssh 

Upgrade via USB

  • Prepare usb stick, format it with fat filesystem, and copy  uboot128.img and firmware.img 
  • Conect usb stick to router and mount it by:
mount /dev/sda1 /mnt
  • Wait a few seconds and verify  if you see files
ls /mnt 
  • You should see content, do not go further if you do not see files ! 
uboot128.img firmware.img
  • ! Upgrade uboot - be careful, do not reset router during and after this operation !
mtd_write write  /mnt/uboot128.img Bootloader
  • You should see on console 
#Unlocking Bootloader ...
#Writing from /mnt/uboot128.img to Bootloader ...  [w]
  • ! Upgrade firmware - do not reset router during this operation!
mtd_write write /mnt/firmware.img Kernel_RootFS
  • You should see on console  
#Unlocking Kernel_RootFS ...
#Writing from /mnt/firmware.img to Kernel_RootFS ...  [w]
  • Reboot router :), enjoy new u-boot with working ethernet and openwrt firmware. Now you can use standard openwrt upgrade procedure. 
reboot
  • Router will set IP address to 192.168.100.1 , you can login via telnet or ssh 
 Connect UART

In order to have access to bootloader (u-boot) menu and functions we have to connect serial port to the router board. Pads are quite large so soldering is relatively easy.

Serial port parameters:

  • Speed: 57600
  • Data Bits: 8
  • Parity: None
  • Stop Bits: 1
!   One problem has to be fixed - when you will connect adapter to RX in router and power on system will hangs. To fix it temporary you have first power on router and next quickly connect RX cable.  To fix this issue permamently you have connect  router RX and adapter TX by resistor (470 ohm - 1k ohm).

Solder three thin wires to the router GND, TX, RX and connect:
  • Router GND to adapter GND,
  • Router RX via 470 ohm resistor to adapter TX,
  • Router TX to adapter RX.

Router pads description

To test connection:

  1. Connect USB adapter to PC
  2. Start terminal and connect to port with proper parameters (putty http://www.putty.org/ or TeraTerm Pro http://www.ayera.com/teraterm/ )
  3. Power on router - you shoud see bootloader logs

USB to TTL UART converters

My recomendation is to use:
  • CP2102
  • FT232
  • CH340
CP2102 based adapter

and avoid if possible prolific PL2303 because of unstability ( maybe there are plenty of clones  and prolific is not guilty - hard to say).

Program SPI flash

When you failed with u-boot upgrade you can program SPI flash without desoldering it.
You need to connect thin wires to MISO, MOSI, CLK, CS, VCC and GND. I recomend to desolder VCC pin and lift it little bit, you will solder it again after programming. Disconnecting VCC prevent and distrubances from SoC or other components.

SPI flash pinout
Wires connected to SPI flash,
lifted VCC pin at the right corner soldered after programming.

I have used simple programmer made of


But you can use any SPI programmer which supports GigaDevice GD25Q32 or flash you currently have.

Upgrade RAM

You can upgrade RAM by desoldering SDRAM chip and soldering chip with  32 MB. It is required to have  4M x 16bit x 4 (otherwise you would need to recompile bootloader) taken from old laptop memory PC133 SO-DIMM. It can be by example:

  • Winbond W9825G6JH-6
  • Samsung K4S561632C-TC
  • Samsung K4S561632E
  • Micron  mT48LC16m16A2 
  • EtronTech EM63A165
  • ESMT M12L2561616A
According to Boot strapping description pins: 
  • EPHY_LED3_N 
  • EPHY_LDE2_N
are used to determine SDRAM size:
  • 0,0: 2 MB/8 MB (default) 
  • 0,1: 8 MB/16 MB 
  • 1,0: 16 MB/32 MB, 32 MB*2 
  • 1,1: 32 MB 
In order to set memory to 32MB you have to add 4.7k resistor (or just shorten)

Location of resistor pads to pull-up EPHY_LDE2_N


Links

https://openwrt.org/
http://lnxpps.de/openwrt/hame-mpra5/
https://github.com/Squonk42/OpenWrt-RT5350
https://github.com/JiapengLi/OpenWrt-RT5350
http://eko.one.pl/?p=openwrt-gpio2

Photos



PCB top side


PCB bottom side

Opened case
How to open case


Router case

Desoldered CPU, vias visible, from anton.rad 

27 comments:

  1. Hello,
    I need a little help here …
    I purchased the same router and when it came I plugged it to the computer and tried to set it as a wireless client.
    The moment I hit submit button the router died and now the only signs of life are the two red and blue diodes that burn constantly and nothing.
    Do you have any ideas how to bring it back to life?

    ReplyDelete
  2. Hi,

    you have oryginal firmware ?
    Could you try to connect to it via telnet, what is the result ?

    ReplyDelete
  3. Hello,

    I found your address in openwrt forum. I hope you can help me a little.
    I also have one of these HAME MPR-A1 clones and want to run openwrt. I have a 32MB Version and I assume that I need to update u-boot.... fine. Which firmware should I use to ensure a proper working, because all currently available images only support 16MB. Yes I'm willing to compile a version by myself, but for this I would need additional help. I hope you can help.
    Did you compile provided version+patch from https://github.com/JiapengLi/OpenWrt-HiLink-HLK-RM04 ?
    Anything else or a different approach?

    The description here says, that the image shall be written via "mtd_write write /mnt/firmware.img Kernel_RootFS". My router does not provide Kernel_RootFS. How can I solve this?

    Hope you can help.

    ReplyDelete
    Replies
    1. Hi Martin,


      1. Regarding u-boot, probably ( I do not hav 32M version) you should use https://github.com/JiapengLi/OpenWrt-RT5350/blob/master/u-boot/uboot256.img

      2. Regarding firmware I will release today or tomorrow memory independent images, so you can use them.

      3. I have used path you mentioned + many little changes espetially fixes in packages. Some important for me was broken by default. I have additional scripts to generate many images at once.

      4. Regarding missing Kernel_RootFS, could you send me result of "cat /proc/mtd" ?

      Delete
    2. Thanks,

      @1-3: please give me private message, when you release newer version. I can give repsonse when it works.

      @4: see below:
      # cat /proc/mtd
      dev: size erasesize name
      mtd0: 00400000 00010000 "ALL"
      mtd1: 00030000 00010000 "Bootloader"
      mtd2: 00010000 00010000 "Config"
      mtd3: 00010000 00010000 "Factory"
      mtd4: 003b0000 00010000 "Kernel"
      # free
      total used free shared buffers
      Mem: 28584 17128 11456 0 0
      Swap: 0 0 0
      Total: 28584 17128 11456
      # mount
      rootfs on / type rootfs (rw)
      proc on /proc type proc (rw)
      none on /var type ramfs (rw)
      none on /etc type ramfs (rw)
      none on /tmp type ramfs (rw)
      none on /media type ramfs (rw)
      none on /sys type sysfs (rw)
      none on /dev/pts type devpts (rw)
      none on /proc/bus/usb type usbfs (rw)



      Delete
    3. Hi Martin images released. Working with 16 and 32m versions.

      Delete
    4. Please give me a hint about writing to Kernel_RootFS. I assume "mtd_write write /mnt/firmware.img Kernel_RootFS" won' work. Any idea?

      Delete
    5. Hi Martin,
      looking on you /proc/mtd
      and assuming that you have 4MB flash !

      I would try "mtd_write write /mnt/firmware.img Kernel"

      Remember to upgrade uboot first (256 version).

      Eventually you will have to say hello to USB2uart adapter and solder three wires.

      BTW. you have plenty of ram, so you do not have to kill processes by killall.

      Delete
    6. ...I did it. I also assumed to overwrite just Kernel. Even when size does not fit. I flashed your mini.bin and after reboot the system led became red. Wifi seemed to be off. Connecting via cable to 192.168.100.1 works like a charm. Here is the output:
      _______ ________ __
      | |.-----.-----.-----.| | | |.----.| |_
      | - || _ | -__| || | | || _|| _|
      |_______|| __|_____|__|__||________||__| |____|
      |__| W I R E L E S S F R E E D O M
      -----------------------------------------------------
      BARRIER BREAKER (Bleeding Edge, r35407) - RT5350F
      -----------------------------------------------------
      -- Cooked by pratanczuk --
      -- --
      -- my-embedded.blogspot.com --
      -----------------------------------------------------
      root@OpenWrt:/# cat /proc/mtd
      dev: size erasesize name
      mtd0: 00030000 00010000 "u-boot"
      mtd1: 00010000 00010000 "u-boot-env"
      mtd2: 00010000 00010000 "factory"
      mtd3: 000e0000 00010000 "kernel"
      mtd4: 002d0000 00010000 "rootfs"
      mtd5: 00220000 00010000 "rootfs_data"
      mtd6: 003b0000 00010000 "firmware"
      root@OpenWrt:/# free
      total used free shared buffers
      Mem: 13576 10120 3456 0 680
      -/+ buffers: 9440 4136
      Swap: 0 0


      So thanks for your help! According to "free" it only has access to 16MB RAM. I read somewhere that there is a mis-configuration, that can't be solved without soldering. Probably you must set a fixed size of RAM for image creation.

      Best regards,
      Martin

      Delete
    7. Hi Martin,

      great :).

      Regarding RAM you have flashed:
      https://code.google.com/p/rcc/source/browse/trunk/projects/rt5350_mini_router/img_32/mini.bin

      or

      this https://code.google.com/p/rcc/source/browse/trunk/projects/rt5350_mini_router/img/mini.bin

      ?

      Can you provide photos of box, and PCB ?

      I will update manual how to upgrade 32meg version.

      can you send me your email to pawel.ratanczuk at gmail ?

      Delete
  4. I'm an idiot. I took the wrong file for 16MB version!!!

    Here is the correct welcome screen:
    _______ ________ __
    | |.-----.-----.-----.| | | |.----.| |_
    | - || _ | -__| || | | || _|| _|
    |_______|| __|_____|__|__||________||__| |____|
    |__| W I R E L E S S F R E E D O M
    -----------------------------------------------------
    BARRIER BREAKER (Bleeding Edge, r35407) - RT5350F
    -----------------------------------------------------
    -- Cooked by pratanczuk --
    -- --
    -- my-embedded.blogspot.com --
    -----------------------------------------------------
    root@OpenWrt:/# free
    total used free shared buffers
    Mem: 29820 10232 19588 0 612
    -/+ buffers: 9620 20200
    Swap: 0 0 0

    ReplyDelete
  5. Hi,

    Thanks for the tutorial. I was able to flash my router to openwrt successfully. However, afterwards I attempted enable ssh via a passwd command, and now I'm not longer able to access the router.

    I'm still able to ping it at 192.168.100.1. When attempting to telnet back in, I get the expected "login fail" since telnet is now disabled. However, I'm not able to SSH into it.

    I attempted to do a failsafe recovery, but that didn't work either. Not sure why.

    Any ideas what's going on? Thanks

    qh

    ReplyDelete
    Replies
    1. Hi,

      I do not include ssh in to images, in order to reduce size, so ... look for solder and usb to uart adapter.

      Delete
    2. ouch...

      How about the failsafe recovery? Why isn't it working?

      Do you know if its recoverable via TFTP? Thanks

      Delete
    3. I do not see other ways thn solder uart to usb adapter

      Delete
  6. Hi
    I want to upgrade my A15 router to Openwrt.
    The problem is, there's no proftpd & proftpd.sh on /bin or /sbin
    How do I upload uboot128.img firmware.img files to /tmp
    Also tried with USB Flash as well, but the router didn't recognize /dev/sda1
    Please advice :)

    ReplyDelete
  7. I do not have access to A15.
    According to information there: https://forum.openwrt.org/viewtopic.php?id=37002&p=24

    Upgrade procedure should be the same like in mentioned mini router.
    One issue is still open - how to download image. I have read that A15 has no ftp server nor Mass Storage support. So maybe you can check if is there in any ftp, tftp server or client or meybe wget is available.

    ReplyDelete
  8. Hi! I have the same device and before I try to hack the firmware I would like to address an other problem.
    The signal strength is pathetic. Do you think it would be possible to add an antenna extension to the board or enhance it in any way ? Please answer in layman's terms, as I'm quite a noob when it comes to hardware. :-)

    ReplyDelete
  9. Is it still possible to use your instruction if mtd show a little bit different structure?

    # cat /proc/mtd
    dev: size erasesize name
    mtd0: 00400000 00010000 "ALL"
    mtd1: 00030000 00010000 "Bootloader"
    mtd2: 00010000 00010000 "Config"
    mtd3: 00010000 00010000 "Factory"
    mtd4: 000c61a0 00010000 "Kernel"
    mtd5: 002e9e60 00010000 "RootFS"
    mtd6: 003b0000 00010000 "Kernel_RootFS"

    ReplyDelete
  10. hi,

    seems to be OK, but no warranty as usual ;)

    ReplyDelete
  11. Thanks! Can you make a simple description of your firmwares - what is inside of every one?

    ReplyDelete
  12. How can I install packages? I need 3g dongle working? Can you post your patches to openwrt trunk? I want to compile by myself

    ReplyDelete
  13. @Nop & Dimitar

    I have published imagebuilder and scripts used to generate images. So you can take alook what is in images, you can modify scripts and ad own packages. I have not include opkg to save space.

    There you have latest image builder:
    https://code.google.com/p/rcc/source/browse/trunk/projects/rt5350_mini_router/OpenWrt-ImageBuilder-ramips_rt305x-for-linux-x86_64.tar.bz2

    decompress it under ubuntu, run ./generate_all.sh


    To change configuration modify ./image_builder_rt5350.sh and content of "Files" directory.

    ReplyDelete
  14. I compiled openwrt, but I don't like the results with just 16MB ram. Ordered a 32MB chip and will try the ram upgrade.

    Did you made a backup of you original firmware on the 16Mb Ram Device?
    If you did can you upload it somewhere?

    ReplyDelete
  15. I have the same CPU / Flash on a Tenda A6 router. However, I cant seem to telnet into the device. (telnet 192.168.2.1 results in an error : "Connection Refused") I can access the device using the web console http://192.168.2.1
    Any advice on how I can connect via telnet ?

    ReplyDelete
    Replies
    1. Maybe there isn't telnet service on your device?

      Delete
  16. Dimitar,

    Yes, that is what I am being led to believe.
    In a situation like this (i.e.no telnet ) do you have any recommendations on how I can flash it with an image of my choosing ?

    ReplyDelete