I bought a dirt-cheap, no-name wifi “3g” AP on ebay, in hopes I could get OpenWRT working on it and perhaps use it in some of my projects. I decided to take a look inside. It opens easily, has UART pins clearly marked (and working). The board is marked as revision 2.1, has 32MB RAM and integrated 1800mAh Li-Ion battery. It seems to a MPR-A1 clone. Unfortunately, the firmware is in Chinese. Fortunately, it turns out the internet has already successfully ported OpenWRT on it, although the official wiki is not exactly verbose.

The [openwrt forum -> https://forum.openwrt.org/viewtopic.php?id=37002] has some patches available. It seems only the right GPIOs had to be configured for the device, as the support for the chip is already in the up-stream. When searching around the OpenWRT download sites, I noticed [image for the MPR-A1 -> http://downloads.openwrt.org/barrier_breaker/14.07/ramips/rt305x/openwrt-ramips-rt305x-mpr-a1-squashfs-sysupgrade.bin]. I flashed it and it seems to kinda work, see the next paragraphs.

The hardware

The case opens easily, and the PCB is clearly marked with revision, some test points and most importantly the UART pinout.

The SoC is RT5350F, memory is EM63A165TS-6G, a 32MB 166MHz SDRAM and a Winbond 25032BVS1G, which may be a 4MB ROM (I would welcome a datasheet if you have one!).

The device also contains a 1800mAh battery (and it does NOT work without it!). I expected it to be pretty poor, but it really surprised me at the first glance! I plugged it into my Turnigy charger and made some discharge curves ad 100mA, 200mA and 500mA (I would expect this to be the approximate current drawn from the device when powered on and possibly with a USB device plugged in). In all three instances, the capacity was slightly over 1800mAh (around 10-50mAh). Here are the data.

Power consumption

When I had it working together with my 3G dongle (Huawei E173), I quickly measured the power consumpsion (when powered from battery). The results are:

I didn’t really tried to be precise here, but the current consumption was pretty steady and varied by at most 20mA during usage at a given state. I could see big drops/rises only when the modem or router changed power saving modes.

The ebay seller advertises 12h wifi and 4h 3G. I haven’t really measured it with the chinese firmware, so it may be that OpenWRT lacks some powersaving features. It still is not bad, I imagine it can be handy.

Flashing the device

I managed to find the firmware upgrade option, but had no luck with it. To see what’s going on I soldered the UART pins and used a cheap PL2303-based usb converter. The UART parameters are 57600n8, I used screen (screen /dev/ttyUSB1 57600) to make a connection.

The device uses U-Boot and is able to flash from network, although the process is a bit non-standard.

You first have to setup a TFTP server and put a file called Kernal.bin to the root (notice the “a” letter, it’s not a typo!), and setup your IP address to 10.10.10.123. If you turn on the router while having the button pressed, it will read the file and update its firmware (I highly recommend NOT to do this on battery power!). You don’t even need the serial console for this.

Other option is to use the U-Boot console and specify your own ip addresses and file name, although it seems it still is not possible the run the U-boot in server mode and push the firmware image as client.

This approach has the advantage that it works even if the current firmware is not working, as long as the bootloader is not corrupted.

Setting up OpenWRT

After flashing OpenWRT, the device boots up, and uses DHCP to set up its Ethernet connection, the WiFi is down by default. Although the device responds to ping requests, all TCP ports are closed. After a short investigation, it seems that the integrated Ethernet is thought to be a WAN connection, and OpenWRT blocks all incoming connections on this interface.

Here is the part when you need the serial console. To allow ssh and http on the WAN, put this rule into /etc/config/firewall and reload firewall rules ( fw3 reload ):

config rule
	option src              wan
	option dest_port        22
	option target           ACCEPT
	option proto            tcp

(and the same for http, just replace 22 with 80)

Everything works then, including Wifi and USB. Be warned though, that the space is very limited, and after installing the 3G stuff I was left with around 80kB free space on flash.