As of now, this document covers an E970 labelled as T-Mobile web'n'walk Box IV. Please upgrade the document in case other devices differ.
Please note that this is work-in-progress, currently support for this device isn't even in trunk yet!
|Broadcom BMIPS3300 V2.9@240MHz||32MiB||4MiB||4 x 100MBit||No||Yes||?|
Additionally, the device has a built-in 3G modem. Drivers are available in OpenWrt.
The modem can also be accessed independently via a USB 2.0 device port (router is disabled while USB is connected). Info from lsusb:
ID 12d1:1003 Huawei Technologies Co., Ltd. E220 HSDPA Modem / E230/E270/E870 HSDPA/HSUPA Modem
This device uses CFE as boot loader. For generic info about flash layouts, see Flash Layout.
|Huawei E970 Flash Layout|
|Layer0||Physically mapped flash – total: 4096KiB|
|Layer1||mtd0 cfe 256KiB||mtd1 linux 3712KiB||mtd5 factory 64KiB||mtd4 nvram 64KiB|
|description||boot loader||kernel||read-only part||writeable part||factory data, see below||cfe configuration|
Sizes of kernel, mtd2 and mtd3 depend on the actual image being used (which kernel modules and packages are installed, …).
Note that this device has an additional partition called factory, located right in front of the nvram partition. It contains device-specific data such as MAC addresses and serial numbers, and is used by CFE to perform a factory reset. If this partition gets corrupt, on factory reset CFE will set a default MAC address which is the same for all devices (00:90:4c:c0:85:59)!
If that happens, restore the factory partition from a backup. If you don't have a backup, you'll have to restore this info manually after every factory reset (from the sticker on the case):
nvram set il0macaddr=00:1E:10:xx:yy:zz # (your MAC address) nvram set et0macaddr=00:1E:10:xx:yy:zz # (usually the same MAC address) nvram set serno=<your_serial_number> nvram commit
- Browse to your router, login as admin
- Go to Advanced Settings/System/Upgrade software
- Select the openwrt-.bin for E970 and click Upgrade
- Wait for it to reboot
- Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.
- Telnet to your router, login with username=admin, password=admin
- If your OEM firmware doesn't have telnet opened, try a firmware upgrade/downgrade
- How to backup mtdblock:
- 1. Save mtdblocks to ramfs /tmp:
# cat /proc/mtd dev: size erasesize name mtd0: 00040000 00010000 "cfe" mtd1: 00340000 00010000 "linux" mtd2: 00281f40 00010000 "rootfs" mtd3: 00060000 00010000 "resource" mtd4: 00010000 00010000 "factory" mtd5: 00010000 00002000 "nvram" # cat /dev/mtd/0 > /tmp/3w/0.jpg cat /dev/mtd/1 > /tmp/3w/1.jpg cat /dev/mtd/2 > /tmp/3w/2.jpg cat /dev/mtd/3 > /tmp/3w/3.jpg cat /dev/mtd/4 > /tmp/3w/4.jpg cat /dev/mtd/5 > /tmp/3w/5.jpg
- 2. Download mtd blocks(download from a browser or a download manager):
http://192.168.1.1/0.jpg ... http://192.168.1.1/5.jpg
- 3. Rename files:
0.jpg to cfe.bin ... 5.jpg to nvram.bin
- [TODO: describe how to flash openwrt]
(Work-in-progress – currently TFTP upgrade seems not to be possible with the version of CFE used by this device)
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
- Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
- Upload image file for sysupgrade to LuCI
- Wait for reboot
- Login as root via SSH on 192.168.1.1
- Use the following commands to upgrade.
cd /tmp/ wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure 3G connection, etc.
The default network configuration is:
|Interface Name||Description||Default configuration|
|br-lan||LAN & WiFi||192.168.1.1/24|
|vlan0 (eth0.0)||LAN ports 1 to 3||None|
|vlan1 (eth0.1)||LAN port 0||DHCP(?)|
Numbers 0-3 are the 4 LAN ports, with port 0 being the one next to the external 3G antenna connector and port 3 the one next to the telephone connector. Switch port 4 is unconnected, and 5 is the internal connection to the router itself.
→ hardware.button on howto use and configure the hardware button(s).
There are two buttons:
- Factory reset: connected to GPIO 6
- On/Off: implemented in hardware, not usable for user-defined events
|System-On-Chip: Broadcom BCM5354|
|CPU/Speed 3300 V2.9@240MHz|
|Flash-Chip: Spansion S29GL032A|
|Flash size: 4 MiB|
|RAM-Chip: Hynix HY5DU561622ETP|
|RAM: 32 MiB|
|Wireless: Broadcom BCM5354 integrated 2.4ghz 802.11bg|
|Ethernet: Broadcom 44xx/47xx 10/100BaseT Ethernet w/ vlan support|
|Internet: 3G HSDPA/HSUPA, 2.5G GPRS/EDGE, wired (via LAN port)|
|USB: v2.0 (internal only, used by modem)|
|JTAG: Probably, not tested|
Note: This will void your warranty!
- Remove the four rubber pads, then unscrew
Photo of MAIN PCB
Photo of MODEM PCB
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Photo of PCB with markings
- you could read about bootloader in general
- as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!
- Board Connector photo:
- Board Connector Pinout
|1 :||Modem Vcc||9 :||Modem Vcc|
|2 :||GND||10 :||GND|
|3 :||USB host D-||11 :||*UNK|
|4 :||USB host D+||12 :||Modem LED Signal Red|
|5 :||Modem antenna SW||13 :||Modem LED Signal Green|
|6 :||LED Power/Power on Signal||14 :||Modem LED Mode Green|
|7 :||*UNK||15 :||Modem LED Mode Blue|
|8 :||*UNK||16 :||Power on/off Button|
For some Help with the Tags, please have a look here: tags
toh/huawei/e970.txt · Last modified: 2013/04/13 10:33 (external edit)