Recently, I needed an LTE backup at a secondary home location with an unreliable primary internet connection. I was somewhat bewildered by the plethora of options available. I saw a weatherized Seriallink SLK-e940 on eBay for a very nice price, so I looked up the details on it. I found (from the help screenshots) that it appeared to run a modified version of OpenWRT. The image the seller provided showed inside the unit a mini-PCIe Quectel EC25-AF LTE modem, which I knew had good Linux support. The price was good even for the modem alone, so I decided to take a chance on it.
I found some information that alleged that Seriallink devices are known to channel routed data through Chinese servers owned by companies connected to North Korean entities—nasty nasty! Even though the information I would be feeding through this unit would be either non-critical or fully encrypted, I still don't like the idea of any of my devices phoning home to the CCP or DPRK, or routing traffic through anywhere abnormal. Although I have the skills to test the device for this, I did not have the time or inclination to do so, nor to keep check on it from time to time to make sure it was "behaving." So, getting standard OpenWRT flashed on the device was quite important to me.
When I received the device in the mail, I hooked it up to a power injector and connected to a laptop ethernet port. I popped a Mint Mobile SIM card in the device, punched in the APN, and restarted the interface. There was no QMI mode support, only PPP. I restarted the interface: connection errors. Hmm. A quick search took me to the manufacturer's website, to a "Company News" page saying:
We are truly sorry that the US version of SLK-E940 may not be able to connect 4G network.
The reason is that to be compatible with 4G modules from different carriers, the AT command of the dialer is incorrect.
Customers who have bought SLK-E940-US must upgrade the latest firmware we offer.
Ok, so I get the latest firmware, and a support file they provided with some updated connection scripts. Flash the device from the web UI, reinsert settings, and bingo, it connects! Great, so at least the hardware is working correctly. But my goodness the customized version of OpenWRT they have on this unit is extremely crippled! No SSH/telnet; no packages; not much of anything but basic 4G/IP gateway functionality.
The hardware
Inside the case, there is a mainboard, with connectors, SIM slot, PoE DC-DC converter circuitry, the Quectel EC25-AF modem in a mini PCIe slot, and a 38 pin DIP module with the label "JS9331_Core_Board v2.0.1" (obviously the brains of the device). I looked up JS9331 and found the module for sale on Aliexpress. The listing there mentioned OpenWRT and even included a pinout! And there is of course a UART serial interface on pins 18 and 19. :-D
OpenWRT
I looked to the OpenWRT table of hardware page, but the JS9331 was nowhere to be found. Further searching took me to details about the JS9331 module: It has a 64MB RAM chip, 16MB flash, and an AR9331 SoC. (AR9331 datasheet is here: https://ruhnet.co/files/ar9331_datasheet.pdf) Interestingly, there is also 2.4GHz 802.11n WiFi, and a U.FL connector (but no WiFi antenna on my unit). I found a GitHub page where someone had evidently compiled OpenWRT for the JS9331, but it was an old version of OpenWRT. But at least that gave me hope that I could in the worst case compile a firmware image for it. There are quite a few devices based on the Atheros 9330/9331 on the OpenWRT ToH, so I decided to just try some of them and see if I could get them to work. I have compiled OpenWRT before, but this time I was hoping to avoid the time and effort (and disk space) of setting up the build system.
So, I downloaded a few sysupgrade firmwares, and went to the web interface firmware upgrade page on the unit. Every firmware image I tried to use was rejected for being incompatible. With the customizations and limitations to the original firmware, this was not a shock. So, off to plan B...
U-boot
I hooked up an oscilloscope to pin 19 on the JS9331 module, just to verify the levels and make sure the pinout was correct. 
Applied power to the unit, and saw normal 3.3V TTL serial data come across the line, so I removed power, connected pins 18 and 19 to a USB to 3.3V UART adapter. I ran Minicom and set the serial port to the standard 115200 baud, 8 bit, no parity, 1 stop bit, and no flow control settings. When I applied power to the unit, I saw a flash of some text and then the familiar U-boot. The unit waited one second, and then booted into the Seriallink firmware. Pressing a key during that one second game me the U-boot prompt:
AP121 (ar9331) U-boot
DRAM: 64 MB Top of RAM usable for U-Boot at: 84000000
Reserving 190k for U-Boot at: 83fd0000
Reserving 192k for malloc() at: 83fa0000
Reserving 44 Bytes for Board Info at: 83f9ffd4
Reserving 36 Bytes for Global Data at: 83f9ffb0
Reserving 128k for boot params() at: 83f7ffb0
Stack Pointer at: 83f7ff98
Now running in RAM - U-Boot at: 83fd0000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16777216, sector count = 4096
Flash: 16 MB
Using default environment
In: serial
Out: serial
Err: serial
*****************************************
* ZhuoTK Technology Co.,Ltd *
* www.zhuotk.com *
*****************************************
U-Boot 1.1.4-g4cf44c46-dirty (Apr 2 2019 - 08:07:56)
Net: ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address : cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0c:a4
eth0 up : cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0c:a4
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot: 0
ar7240> Running printenv showed that the system load location is 0x9f020000 and the default TFTP server address is 192.168.1.110. I started up a TFTP server on my laptop, connected the ethernet cable, set the laptop ethernet port address to 192.168.1.110, and from the
ar7240> tftpboot 0x80000000 openwrt-19.07.6-ar71xx-generic-gl-inet-6416A-v1-squashfs-factory.bin
eth0 link down FAIL
dup 1
speed 1000
Using eth1 device
TFTP from server 192.168.1.110; our IP address is 192.168.1.251
Filename 'openwrt-19.07.6-ar71xx-generic-gl-inet-6416A-v1-squashfs-factory.bin'.
Load address: 0x80000000
Loading: #################################################################
#################################################################
#################################################################
######################################## done
Bytes transferred = 16252704 (F7FF20 hex)
The bin file loaded, and I was presented then again with the U-boot prompt and the notice the data had finished loading of length 0xF7FF20 bytes. Next step, erase the flash of the correct amount to store the new image, starting at the system load location:
ar7240> erase 0x9f020000 +0xF7FF20
Now we write the data from RAM to the flash:
ar7240> cp.b 0x80000000 0x9f020000 0xF7FF20
When it completed, I rebooted and voila! I was greeted with the OpenWRT boot messages and shell prompt. Success!
Now, the part I left out is that I tried several images before finding one close enough that worked. A couple of them booted, but didn't have the correct networking port setup or whatnot. The one I settled on was for the GL.inet 6416A, which had the same amount of flash, and an ethernet port setup that was similar enough to the Seriallink SLK-e940 (it must have LAN on eth1---the eth0 port on the SLK-e940 is not populated with an installed ethernet jack on the board, so although it is accessible through the software, there is no physical connection available.)
Since the OpenWRT install was complete, I was able to then access the web interface and SSH. I connected over SSH and installed packages for WWAN, including QMI mode for the Quectel modem:
opkg update
opkg install usb-modeswitch kmod-mii kmod-usb-net kmod-usb-wdm kmod-usb-net-qmi-wwan uqmi
I used the Luci web interface to set the network settings, but kept the WiFi interface disabled, since there is no antenna connected, and it is not needed for my purposes. After a reboot, I was able to use the web interface to easily configure the QMI LTE connection. It connected very quickly and works great. Mint mobile (a T-Mobile MVNO) not only gives me an IPv4 address (behind CGNAT), but also a full /64 prefix of IPv6 global addresses!
Hopefully this has been of use to someone. If so, please let me know! :-D
Comments
SLK-e940 (EC25-AF)
thank you for the lots of information about this device.
i also wants to know is this version (SLK-e940 -US (EC25-AF) ) of router can be used with this 4g lte (FDD: B1/B2/B3/B4/B5/B7/B8/B28 )bands after update that website mentioned.
because i’m from sri lanka.
in sri lanka that us version supported bands are not working.
please let me know about this.
Add new comment