Hi everyone
I got a ZTE MF253L (A board with a 4G Modem preinstalled focused on Brazilian market) a time ago but got no luck finding any way to make it work beyond the carrier firmware
I got all the boot log from TTL (57600, 8N1), but got no way to interact with the shell and I couldn't (for now) remove the shielding on the main and modem boards, getting that the board is a Ralink, with 16MB Flash 64MB RAM and a ZTE MF270 Modem
Is there any way that I could make it work with OpenWRT?
There are the boot logs that I got from the device:
U-Boot 1.1.3 (Sep 10 2013 - 09:09:59)
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83580000
spi_wait_nsec: 3c
spi device id: ef 40 18 0 0 (40180000)
find flash: W25Q128BV
raspi_read: from:60000 len:1000
.raspi_read: from:60000 len:1000
.============================================
Ralink UBoot Version: 3.6.0.0
--------------------------------------------
ASIC 3352_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: DDR2
DRAM_SIZE: 512 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 64 MBytes
Flash component: SPI Flash
FLASH_SIZE: 16 MB
Date:Sep 10 2013 Time:09:09:59
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 400 MHZ ####
estimate memory size =64 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 3
0
Uaztemain: enter into !
ZTE_InitFotaFlashPara RbBlkSize = 65536
raspi_read: from:5fffb len:1
.ZTE_FOTA:ZTE_GetFotaUpdateFlag flag value = -1 at 0x5fffb !
Uaztemain: no need to update ''
3: System Boot system code via Flash.
## Booting image at bc080000 ...
raspi_read: from:80000 len:40
. Image Name: Linux Kernel Image
Created: 2014-04-02 3:44:20 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1236894 Bytes = 1.2 MB
Load Address: 80000000
Entry Point: 80388000
raspi_read: from:80040 len:12df9e
................... Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80388000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.21 (lihj@cpe-Lenovo-Product) (gcc version 3.4.2) #3 Wed Apr 2 11:44:16 CST 2014
The CPU frequency set to 400 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = c0808000, status = 11000000
PID hash table entries: 256 (order: 8, 1024 bytes)
calculating r4koff... 00186a00(1600000)
CPU frequency 400.00 MHz
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61012k/65536k available (2762k kernel code, 4460k reserved, 849k data, 132k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
deice id : ef 40 18 0 0 (40180000)
W25Q128BV(ef 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 9 MTD partitions on "raspi":
0x00000000-0x01000000 : "ALL"
0x00000000-0x00060000 : "Bootloader"
0x00060000-0x00070000 : "Config"
0x00070000-0x00080000 : "Factory"
0x00080000-0x001e0000 : "Kernel"
0x001e0000-0x00980000 : "RootFS"
0x00980000-0x00c00000 : "Web"
0x00c00000-0x00e80000 : "Data"
0x00e80000-0x01000000 : "JFFS2"
RT3xxx EHCI/OHCI init.
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
fuse init (API version 7.8)
io scheduler noop registered (default)
zhaoxg add for MF253 gpio init
Ralink gpio driver initialized
Enable Ralink GDMA Controller Module
GDMA IP Version=2
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.8 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
nbd: registered device at major 43
rdm_major = 253
Ralink APSoC Ethernet Driver Initilization. v2.1 256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x00009ca9
MAC_ADRL -- : 0xe461fbcf
PROC INIT OK!
IMQ starting with 2 devices...
IMQ driver loaded successfully.
Hooking IMQ after NAT on PREROUTING.
Hooking IMQ before NAT on POSTROUTING.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.1
block2mtd: version $Revision: 1.1.1.1 $
usbmon: debugfs is not available
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: Product: Ralink EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.21 ehci_hcd
usb usb1: SerialNumber: rt3xxx
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
116x: driver isp116x-hcd, 03 Nov 2005
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: Product: RT3xxx OHCI Controller
usb usb2: Manufacturer: Linux 2.6.21 ohci_hcd
usb usb2: SerialNumber: rt3xxx-ohci
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
usbcore: registered new interface driver usb-pcm
drivers/usb/serial/usb-pcm.c: USB Driver for GSM modems: V2.4.20_uC0_1B12
nf_conntrack version 0.5.0 (512 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
ip6_queue: failed to register queue handler
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
init started: BusyBox v1.12.1 (2014-04-02 11:37:34 CST)
starting pid 665, tty '': '/etc_ro/rcS'
Algorithmics/MIPS FPU Emulator v1.5
usb 1-2: new high speed USB device using rt3xxx-ehci and address 2
usb 1-2: Product: ZTE WCDMA Technologies MSM
usb 1-2: Manufacturer: ZTE,Incorporated
usb 1-2: SerialNumber: ZM8620ZTED000000
usb 1-2: configuration #1 chosen from 1 choice
zhaoyong modetype=LTE
find modem i:46 MF270
modem name: MF270
option 1-2:1.0: GSM modem (1-port) converter detected
usb 1-2: GSM modem (1-port) converter now attached to ttyUSB0
find modem i:46 MF270
modem name: MF270
option 1-2:1.1: GSM modem (1-port) converter detected
usb 1-2: GSM modem (1-port) converter now attached to ttyUSB1
find modem i:46 MF270
modem name: MF270
option 1-2:1.2: don't support this interface.
scsi0 : SCSI emulation for USB Mass Storage devices
find modem i:46 MF270
modem name: MF270
option 1-2:1.4: don't support this interface.
JFFS2 notice: (782) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
Load cfg new driver...
cfg init, drivers/cfg/cfg_param.c 567
WPS_SSID=[REDACTED]
5750535f535349443d52656d696c696120536361
cfg init end, drivers/cfg/cfg_param.c 625
cfg init, drivers/cfg/cfg_param.c 567
TESTBITSIGNINFO=0000
544553544249545349474e494e464f3d30303030
cfg init end, drivers/cfg/cfg_param.c 625
cfg init, drivers/cfg/cfg_param.c 567
0000000000000000000000000000000000000000
cfg init end, drivers/cfg/cfg_param.c 625
cfg init, drivers/cfg/cfg_param.c 567
0000000000000000000000000000000000000000
cfg init end, drivers/cfg/cfg_param.c 625
Welcome to
_______ _______ ___ __ ____ _ _ ___
| ___ \| __ || | |__|| \ | || | / /
| |___| || |__| || |__ __ | \| || |/ /
| _ /| _ || || || |\ || \
|__|register irq
\__\|__| |__||______||__||_| \____||_|\___\
=System Architecture Department=
zhaoyong open gpio success
state_detect mairegister irq
n result: 0 readbitmf283: 1
cdc_ether 1-2:1.2: ZTE Ethernet Device: claiming interface 2
usb 1-2: bad CDC descriptors
usb0: register 'cdc_ether' at usb-rt3xxx-2, ZTE Ethernet Device, 0a:46:9c:fa:90:c3
usbcore: registered new interface driver cdc_ether
rmmod: zte_demand_dial: No such file or directory
Create_Data_Thread_result SUCCESS!
data begin to rcv msg from queue 0.
FOTA >> [update_control.c: 1819][LOW: COMM] Updademand_module_init with current_gateway=[192.168.1.1] OK!
te Control has been launched. [Apr 2 2014: 11:41:00]
FOTA >> [update_control.c: 1822][LOW: COMM] sleep 15s waitting for modem ready
cfg save index:0 cfg
killall: zte_router: no process killed
killall: port_detect: no process killed
Password for 'admin' changed
rmmod: ralink_wdt: No such file or directory
rmmod: cls: No such file or directory
rmmod: hw_nat: No such file or directory
rmmod: raeth: No such file or directory
insmod: bridge.ko: module not found
insmod: mii.ko: module not found
insmod: raeth.ko: module not found
phy_tx_ring = 0x034b3000, tx_ring = 0xa34b3000
phy_rx_ring0 = 0x034b4000, rx_ring0 = 0xa34b4000
MAC_ADRH -- : 0x00009ca9
MAC_ADRL -- : 0xe461fbcf
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = C0710000
##### disable 1st wireless interface #####
rmmod: rt2860v2_ap_net: No such file or directory
rmmod: rt2860v2_ap: No such file or directory
rmmod: rt2860v2_ap_util: No such file or directory
rmmod: rt2860v2_sta_net: No such file or directory
rmmod: rt2860v2_sta: No such file or directory
rmmod: rt2860v2_sta_util: No such file or directory
add NasId1 for wifi driver config
insmod: rt2860v2_ap_util.ko: module not found
rt2860v2_ap: module license 'unspecified' taints kernel.
=== pAd = c077e000, size = 526088 ===
<-- RTMPAllocAdapterBlock, Status=0
insmod: rt2860v2_ap_net.ko: module not found
cfg save index:0 cfg
scsi 0:0:0:0: Direct-Access ZTE MMC Storage 2.31 PQ: 0 ANSI: 2
sd 0:0:0:0: Attached scsi removable disk sda
USB device(capacity=0), dev name sda!
rmmod: nf_nat_pptp: No such file or directory
rmmod: nf_conntrack_pptp: No such file or directory
rmmod: nf_nat_proto_gre: No such file or directory
rmmod: nf_conntrack_proto_gre: No such file or directory
RX DESC a3675000 size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff ff 00 00 00
SYNC - BBP R4 to 20MHz.l
state_detect close all led.
Main bssid = 9c:a9:e4:61:fb:cf
<==== rt28xx_init, Status=0
0x1300 = 00064380
vconfig: ioctl error for rem: Invalid argument
vconfig: ioctl error for rem: Invalid argument
rmmod: 8021q: No such file or directory
insmod: 8021q.ko: module not found
BusyBox v1.12.1 (2014-04-02 11:37:34 CST) multi-call binary
Usage: ifconfig [-a] interface [address]
ifconfig: ioctl 0x8913 failed: No such device
brctl: bridge br0: No such device or address
device ra0 entered promiscuous mode
##### restore Ralink ESW to dump switch #####
switch reg write offset=14, value=5555
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1001
switch reg write offset=4c, value=1
switch reg write offset=50, value=2001
switch reg write offset=70, value=ffffffff
switch reg write offset=98, value=7f7f
switch reg write offset=e4, value=7f
done.
device eth2 entered promiscuous mode
cfg save index:0 cfg
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
route: ioctl 0x890c failed: No such process
route: ioctl 0x890b failed: Invalid argument
cfg save index:0 cfg
br0: port 2(eth2) entering disabled state
br0: port 1(ra0) entering disabled state
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
route: ioctl 0x890c failed: No such process
route: ioctl 0x890b failed: Invalid argument
ifconfig: ioctl 0x8914 failed: Cannot assign requested address
ifconfig: ioctl 0x8914 failed: Cannot assign requested address
cfg save index:0 cfg
br0: topology change detected, propagating
br0: port 2(eth2) entering forwarding state
br0: topology change detected, propagating
br0: port 1(ra0) entering forwarding state
cfg save index:0 cfg
cfg save index:0 cfg
cfg save index:0 cfg
cfg save index:0 cfg
cfg save index:0 cfg
cfg save index:0 cfg
/sbin/lan.sh: /sbin/static_ip_init.sh: line 1: /!static_ip_init.sh: not found
the mac_ip_list is null
cfg save index:0 cfg
killall: udhcpd: no process killed
Set: phy[0].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
* daemon not running. starting it now on port 8888 *
* daemon started successfully *
Set: phy[0].reg[0] = 3100
Set: phy[4].reg[0] = 3100
Set: phy[1].reg[0] = 3100
Set: phy[2].reg[0] = 3100
Set: phy[3].reg[0] = 3100
ifconfig: ioctl 0x8913 failed: No such device
cfg save index:0 cfg
into ipv6_br0_conf.sh
start radvd config set
killall: radvd: no process killed
end radvd config set
killall: pppoecd: no process killed
killall: udhcpc: no process killed
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
rmmod: turbo_nat: No such file or directory
start init turbonat 20130710:
1) support passive and active ftp;
2) fix downloading multi-files at the sametime;
3) fix ftp upload problem;
4) add support for skip ports list=[+21+53+69+80+443+500+1723+4500+5060+];
5) skip dns port;
6) fix softlock up problem;
7) log switch=[0]
MAX_ENTRY_NUM=[512], hash size=[1024]
init turbonat done
not chinamobile
ip6tables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
Syslogd Start...
FOTA >> [update_control.c: 1881][HIGH: COMM] after adb shell rm -rf /cache/zte_fota/delta/
not enter 29A
start wlan-server --------------------->
cmd_buf = iwpriv ra0 set MaxStaNum=32
FOTA >> [update_control.c: 1887][HIGH: COMM] after adb shell rm -f /cache/root_uImage.mld /cache/delta.package
unzip: can't open /cache/image.zip, /cache/image.zip.zip, /cache/image.zip.ZIP
FOTA >> [update_control.c: 1890][HIGH: COMM] after adb shell unzip /cache/image.zip -d /cache/
FOTA >> [update_control.c: 1601][LOW: COMM] enter check_last_state.
FOTA >> [update_control.c: 1655][LOW: COMM] enter check_cpe_update_result.
opms_wan_ifname=...
iptables -t nat -A POSTROUTING -o usb0 -j MASQUERADE
1 KB/s (143 bytes in 0.112s)
1 KB/s (141 bytes in 0.110s)
cfg save index:0 cfg
killall: miniupnpd: no process killed
1 KB/s (141 bytes in 0.078s)
iptables: No chain/target/match by that name
iptables v1.4.0rc1: Couldn't find target `MINIUPNPD'
Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables v1.4.0rc1: Couldn't find target `MINIUPNPD'
Try `iptables -h' or 'iptables --help' for more information.
1 KB/s (142 bytes in 0.074s)
=========pRes->aucParas=
===========iptables: No chain/target/match by that name
normal mode!
dnsmasq: failed to create listening socket: Address already in use
ussd[2227]: ussd.c, 114 ussd check Modem state wrong !
2 KB/s (139 bytes in 0.049s)
2 KB/s (138 bytes in 0.065s)
===>>Parse_CRSM_Res<<===
1 KB/s (152 bytes in 0.099s)
goahead main. defined _ZTE_CFG_
DB: Registering database table <users>
DB: Registering database table <groups>
DB: Registering database table <access>
UM: Loading User Configuration from file <umconfig.txt>
DB: About to read data file <./umconfig.txt>
DB: Failed to stat persistent data file.
webs: Listening for HTTP requests at address 192.168.1.1
5 KB/s (156 bytes in 0.029s)
===>>Parse_CRSM_Res<<===
===>>Parse_CRSM_Res<<===
thread monitor start!
watchdog:len=1
Parse_Cpbs_Rsp tPara.usedEntries is 1 tPara.totalEntries is 50.
2 KB/s (285 bytes in 0.111s)
ussd[2227]: ussd.c, 109 ussd check Modem state success!
ussd[2227]: ussd.c, 127 ussd_init:Create ussd module's message queue ok
ussd[2227]: ussd.c, 85 ussd begin to get msg 0 from queue...
/var/miniupnpd.conf already exist!
cfg save index:0 tr069
Parse_Cpbs_Rsp tPara.usedEntries is 1 tPara.totalEntries is 50.
startsmbfilepwent_internal: file /etc/smbpasswd did not exist. File successfully created.
Added user admin.
starting pid 2342, tty '/dev/ttyS1': '/bin/sh'
BusyBox v1.12.1 (2014-04-02 11:37:34 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# 58 KB/s (8192 bytes in 0.136s)
rmmod: nf_conntrack_sip: No such file or directory
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
FOTA >> [update_cfg save index:0 update_control
control.c: 1467][LOW: COMM] enter uc_set_update_state.
FOTA >> [update_control.c: 1468][MID: COMM] fsm turn from 0 to 0.
FOTA >> [update_control.c: 851][LOW: COMM] enter uc_recv_msg_from_dm.
FOTA >> [update_control.c: 893][HIGH: COMM] create message queue successful.
FOTA >> [update_control.c: 898][MID: COMM] Start recv msg.
