Adding OpenWrt support for ZTE MF286 3g/4g wifi router

Hello:) im currently trying to add support for subj. Will post progress and help requests here as work progressing. I have plans to add support for board,wifi,FXO (for SIP) and ethernet.
HWINFO
ZTE MF286 4G router is built around Qualcomm QCA9563 soc with 802.11bgn, QCA9882 802.11ac wlan, QCA8337 gigabit switch and pci MDM9230 LTE chip (Sierra .MC7455 analogue?)

qca9563_zte_mf286.dts

// Author: sunnydrake<at>gmail.com

#include "qca956x.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>


/ {

	compatible = "zte,mf286", "qca,qca9563";
	model = "ZTE MF286";
	chosen {
		bootargs = "console=ttyS0,115200n8 mem=128m";
	};
	cpus {
		#address-cells = <1>;
		#size-cells = <0>;

		cpu@0 {
			device_type = "cpu";
			compatible = "mips,mips74Kc";
			clocks = <&pll ATH79_CLK_CPU>;
			reg = <0>;
		};
	};
	memory@0 {
		device_type = "memory";
		reg = <0x0 0x8000000>;
	};
	aliases {
		led-boot = &led_blue;
		led-failsafe = &led_blue;
		led-running = &led_blue;
		led-upgrade = &led_blue;
		label-mac-device = &eth0;
	};
	leds {
		compatible = "gpio-leds";
		led_blue: led_blue {
			label = "blue:near cpu test";
			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
		};

/*		led_power: power {
			label = "1st:power";
			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
			default-state = "on";
		};
		wifi: led_wifi {
			label = "Wifi led blue";
			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
		};
		mdmreset: mdmreset{
			label = "CTRL! Modem reset button";
			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
		}; 
  */

/*		wlan2g {
			label = "white:wlan2g";
			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
			linux,default-trigger = "phy1tpt";
		};

		wlan5g {
			label = "white:wlan5g";
			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
			linux,default-trigger = "phy0tpt";
		};
*/
	};

	keys {
//		compatible = "gpio-keys";
		compatible = "gpio-keys-polled";
		#address-cells = <1>;
		#size-cells = <0>;
		poll-interval = <100>;
/*		wps {
			label = "wps button";
			linux,code = <KEY_WPS_BUTTON>;
			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
			#debounce-interval = <60>;
		};
		reset {
			label = "Reset button";
			linux,code = <KEY_RESTART>;
			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
			#debounce-interval = <60>;
		};

		wlan {
			label = "Wlan button";
			linux,code = <KEY_RFKILL>;
			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
			#debounce-interval = <60>;
		};
*/
	};
};

&spi {
	status = "okay";

	flash_nor: flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <25000000>;

		nor_partitions: partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x000000 0x0a0000>;
				read-only;
			};

			partition@a0000 {
				label = "u-boot-env";
				reg = <0x0a0000 0x020000>;
			};

		};
	};

	flash_nand: flash@1 {
		compatible = "spi-nand";
		reg = <1>;
		spi-max-frequency = <25000000>;

		nand_partitions: partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;
			art:partition@0 {
				label = "art";
				reg = <0x0000000 0x80000>;

			};
			mac:partition@80000 {
				label = "mac";
				reg = <0x80000 0x80000>;
			};	
			nand_rootfs: partition@2000000 {
				label = "rootfs";
				reg = <0x2000000 0x6000000>;
			};
			nand_kernel: partition@1800000 {
				label = "nand_kernel";
			//	reg = <0x7B00000 0x500000>;
				reg = <0x1800000 0x800000>;
			};			

/*			nand_ubi: partition@0 {
				label = "nand_ubi";
				reg = <0x000000 0x8000000>;
			};
*/		};
	};
};

&art {
	compatible = "nvmem-cells";
	#address-cells = <1>;
	#size-cells = <1>;

	macaddr_art_0: macaddr@0 {
		reg = <0x0 0x6>;
	};
	macaddr_art_1: macaddr@0 {
		reg = <0x6 0x6>;
	};
};


&wmac {
	status = "okay";

	mtd-cal-data = <&art 0x1000>;
};



&pcie {
	status = "okay";

//MDM9230
	//QCA9882 ?
	wifi@0,0 {
	    status = "okay";
		compatible = "qcom,ath10k";
//		reg = <0 0 0 0 0>;
		device_type = "pci";
		gpio-controller;
//        qca,no-eeprom;
	};
}; 
&mdio0 {
	status = "okay";
	wanp: ethernet-phy@4 {
		phy-mode = "sgmii";
		reg = <4>;
	};
	lan1: ethernet-phy@5 {
		phy-mode = "sgmii";
		reg = <0x1f>;
	};
};
&eth0 {
	status = "okay";

	nvmem-cells = <&macaddr_art_0>;
	nvmem-cell-names = "mac-address";
//	phy-mode = "sgmii";
	phy-handle = <&wanp>;
//	reg = <4>;
//	pll-data = <0x03000000 0x00000101 0x00001313>;
	gmac-config {
		device = <&gmac>;
		rgmii-enabled = <1>;
	};
};
&mdio1 {
		status = "okay";
		#address-cells = <1>;
		#size-cells = <0>;

		switch0: switch@10 {
			compatible = "qca,qca8337";
			#address-cells = <1>;
			#size-cells = <0>;

			dsa,member = <0 0>;

			reg = <0x1f>;

			ports {
				#address-cells = <1>;
				#size-cells = <0>;

				switch0cpu: port@0 {
					reg = <0>;
					label = "cpu";
					//ethernet = <&gmac0>;
					phy-mode = "rgmii-id";
					fixed-link {
						speed = <1000>;
						full-duplex;
					};
				};

				port@1 {
					reg = <1>;
					label = "sw1";
				};

				port@2 {
					reg = <2>;
					label = "sw2";
				};

				port@3 {
					reg = <3>;
					label = "sw3";
				};

				port@4 {
					reg = <4>;
					label = "sw4";
				};

				port@5 {
					reg = <5>;
					label = "sw5";
				};
			};
		};
};
 
&usb_phy1 {
	status = "okay";
};
&usb0 {
	status = "okay";
    };
&usb1 {
	#address-cells = <1>;
	#size-cells = <0>;
	status = "okay";

	hub_port1: port@1 {
		reg = <1>;
		#trigger-source-cells = <0>;
	};
};

nand.mk


define Device/zte_mf286
  SOC := qca9563
  DEVICE_VENDOR := ZTE
  DEVICE_MODEL := MF286
  BLOCKSIZE := 128k
  PAGESIZE := 2048
  DEVICE_PACKAGES :=  block-mount kmod-usb-storage kmod-usb2
  DEVICE_VARIANT := NOR/NAND
  RAS_BOARD := AP152
  KERNEL := kernel-bin | append-dtb |  lzma | uImage lzma
  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma  
  IMAGES += sysupgrade.bin sysupgrade_ubi.bin
  IMAGE/sysupgrade.bin := append-rootfs | sysupgrade-tar rootfs=$$$@ | append-metadata 
  IMAGE/sysupgrade_ubi.bin := append-ubi | sysupgrade-tar rootfs=$$$@ | append-metadata 
  UBINIZE_OPTS := -E 5
  UBI_OPTS := -m 2048 -p 128KiB -O 2048 -v
  SUPPORTED_DEVICES += zte,mf286
endef
TARGET_DEVICES += zte_mf286

Current problem command swconfig dev switch0 show
cause reboot and panic .. don't know how and where too look for fix :frowning:

root@OpenWrt:/# swconfig dev switch0 show
Global attributes:
.enable_vlan: 0
.ar8xxx_mib_poll_interval: 0
.ar8xxx_mib_type: 0
.enable_mirror_rx: 0
.enable_mirror_tx: 0
.mirror_monitor_port: 0
.mirror_source_port: 0
.arl_age_time: 0
.arl_table: address resolution table
Por[40916.078995] CPU 0 Unable to handle kernel paging request at virtual address 00000010, epc == 804790ec, ra == 80474390
t 0: MAC 1a:c0:3[40916.091141] Oops[#1]:
[40916.094896] CPU: 0 PID: 2548 Comm: swconfig Not tainted 5.10.70 #0
[40916.101268] $ 0   : 00000000 00000001 00000000 00000006
[40916.106679] $ 4   : 00000001 8071db80 82f9db30 83390040
[40916.112081] $ 8   : 00000018 8038e5e4 00000000 8047427c
[40916.117485] $12   : 00000000 fffffffd 807fe1d0 82005722
[40916.122887] $16   : 83390000 8071db80 82f9dbe0 83390048
[40916.128291] $20   : 00000007 807fc7a8 80780000 00000000
[40916.133694] $24   : 82005720 00000002                  
[40916.139096] $28   : 82f9c000 82f9db18 00000000 80474390
[40916.144500] Hi    : 00000000
[40916.147465] Lo    : 00000001
[40916.150463] epc   : 804790ec ar8327_sw_get_eee+0x28/0x44
[40916.155948] ra    : 80474390 swconfig_get_attr+0x114/0x5b8
[40916.161605] Status: 1100d803.KERNEL EXL IE 
[40916.165933] Cause : 00800008 (ExcCode 02)
[40916.170072] BadVA : 00000010
[40916.173038] PrId  : 00019750 (MIPS 74Kc)
[40916.177087] Modules linked in: pppoe ppp_async iptable_nat xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_FLOWOFFLOAD pppox ppp_generic nf_nat nf_flow_table nf_conntrack ipt_REJECT xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG slhc nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables crc_ccitt fuse nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 vfat fat ntfs nls_utf8 nls_iso8859_1 nls_cp437 sha256_generic libsha256 seqiv jitterentropy_rng drbg hmac cmac usb_storage fsl_mph_dr_of ehci_platform ehci_fsl sd_mod scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 phy_ar7100_usb usbcore nls_base usb_common crc32c_generic
[40916.247414] Process swconfig (pid: 2548, threadinfo=cc446cc1, task=d4909c14, tls=77e64dcc)
[40916.255935] Stack : 00000000 82f9dbc4 80780000 00000000 00000000 8037023c 8071db80 00000001
[40916.264581]         00000000 00000000 00000000 82f9dc38 82826e80 00000000 82f9dbc4 8050aee8
[40916.273218]         00000000 00000000 00000000 8019f17c 8071c170 00000000 82f9dc38 00000000
[40916.281856]         82f9db84 81d9e200 807fb664 82f90840 82826e80 82f9dc38 807fc7a8 8050b104
[40916.290502]         80509bb8 81e80000 82f9dbfc 80509298 00000001 82f9dbf4 807fb664 82f91800
[40916.299139]         ...
[40916.301668] Call Trace:
[40916.304193] [<804790ec>] ar8327_sw_get_eee+0x28/0x44
[40916.309315] 
[40916.310852] Code: 10430005  00822021  00001025 <9083000f> 03e00008  acc3000c  03e00008  2402ff86  03e00008 
[40916.320939] 
4:2b:47:7d
Port[40916.322545] ---[ end trace 0abbd39df80bdf15 ]---
 5: MAC 00:25:90[40916.328714] Kernel panic - not syncing: Fatal exception

Did you manage to get anywhere with this?

hello, interested in this as well

I had some moderate success here: https://github.com/Leo-PL/openwrt/tree/zte_mf286

Wi-Fi, Ethernet and modem seem to work, but the Power and WLAN LEDs, for which the mapped GPIOs don't seem to route anywhere - there probably is some pinctrl magic to be done. FXS is handled by modem entirely, as are most of LEDs, so no SIP for you, though. The only LED I got working is the green "test" LED inside the case.
Haven't yet tried installing on flash yet - stay tuned.

1 Like

wow, that's great work, seen you were working on this on one of the Polish forums. Very excited, will try to test this one out after the holidays. Thank YOU!

wow nice i see you working on network switch too.. :slight_smile: I haven't time to push further yet...
Source below for modem says following " PCM/I2S interface for voice "

Another very good lead :i think here some AT commands expose FXO caps and voice data flow.. as it works on 7304

https://source.sierrawireless.com/resources/airprime/minicard/74xx/4117727-airprime-em74xx-mc74xx-at-command-reference/#sthash.RFHlHrpA.dpbs

additional links

Some openwrt stuff on their forum (qmicli for firmware updates and stuff)

Voice handling is done entirely on modem, the same as it was done on MF283+. You can connect an analog telephone and make a call even when router part is in U-boot.
I need to figure out those missing LEDs - at least I know from stock kernel source, that Wi-Fi LED is correct - but it still doesn't work. By any chance, does anyone have U-boot sources?

#!/bin/sh
# Modified from https://gist.github.com/huzhifeng/e3c222e6b780d82967db
echo GPIO LED Test
echo   Usage: $0 [wait time] [gpio start] [gpio end]
echo Example: $0 3s 0 1
echo leave gpio range blank to test all GPIOs.
echo
wait=${1:-"3s"}
for GPIOCHIP in /sys/class/gpio/gpiochip*/ ; do
    BASE=$(cat ${GPIOCHIP}base)
    SIZE=$(cat ${GPIOCHIP}ngpio)
    MAX=$(($BASE+$SIZE-1))
    gpio_end=${3:-$MAX}
    [ -z "$gpio" ] && gpio=${2:-$BASE}
    while [ $gpio -ge $BASE -a $gpio -le $MAX -a $gpio -le $gpio_end ] ; do
        # Save original value if needed
        if [ -d /sys/class/gpio/gpio${gpio} ]; then
            DIRECTION=$(cat /sys/class/gpio/gpio${gpio}/direction)
            UNEXPORT=0
            VALUE=$(cat /sys/class/gpio/gpio$gpio/value)
        else
            echo $gpio > /sys/class/gpio/export
            UNEXPORT=1
            DIRECTION=""
            VALUE=""
        fi
        if [ -d /sys/class/gpio/gpio${gpio} ]; then
            echo out > /sys/class/gpio/gpio$gpio/direction
 
            echo "[gpiochip${BASE}:$gpio:out] = 0"
            echo 0 > /sys/class/gpio/gpio$gpio/value
            sleep $wait
 
            echo "[gpiochip${BASE}:$gpio:out] = 1"
            echo 1 > /sys/class/gpio/gpio$gpio/value
            sleep $wait
 
            # Restore original value
            [ ! -z "$DIRECTION" ] && echo $DIRECTION > /sys/class/gpio/gpio${gpio}/direction
            [ ! -z "$VALUE" ] && echo $VALUE > /sys/class/gpio/gpio${gpio}/value
            [ "$UNEXPORT" -eq 1 ] && echo ${gpio} > /sys/class/gpio/unexport
        else
            echo "[gpiochip${BASE}:${gpio}] = Failed to export"
        fi
 
        gpio=$((gpio+1))
    done
done

I already tested all the available GPIOs, so no luck here. What I've found is that both LEDs are actually routed through modem, for some reason. Maybe some AT command needs to be executed at the modem startup, for this to work.

I tried installing my recent build on flash at https://github.com/Leo-PL/openwrt/commit/12885b6d6764b95c593d367e6a689cc638212b1a, using mtd-concat behind UBI device. However, when booting off of flash, the UBI attach would fail due to duplicate LEB sequence number, like this:

[    1.623437] UBI: auto-attach mtd8
[    1.626930] ubi0: attaching mtd8
[    2.586658] random: fast init done
[    4.152618] ubi0 error: 0x80470fec: two LEBs with same sequence number 134
[    4.159743] eraseblock attaching information dump:
[    4.164685]  ec       0
[    4.167218]  pnum     414
[    4.169917]  lnum     0
[    4.172435]  scrub    0
[    4.174952]  sqnum    134
[    4.177656] Volume identifier header dump:
[    4.181879]  magic     55424921
[    4.185113]  version   1
[    4.187727]  vol_type  1
[    4.190336]  copy_flag 0
[    4.192943]  compat    0
[    4.195552]  vol_id    0
[    4.198166]  lnum      0
[    4.200775]  data_size 0
[    4.203382]  used_ebs  0
[    4.205989]  data_pad  0
[    4.208605]  sqnum     134
[    4.211393]  hdr_crc   733e519d
[    4.214627] Volume identifier header hexdump:
[    4.219460] ubi0 error: 0x80465730: failed to attach mtd8, error -22
[    4.226121] UBI error: cannot attach mtd8
[    4.230870] /dev/root: Can't open blockdev
[    4.235110] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    4.242866] Please append a correct "root=" boot option; here are the available partitions:

I heard on the polish eko.one.pl forum, that UBI and mtd-concat don't like each other. So back to the drawing board, I'll need to debug this, unless someone knows a solution.

Got almost everything working, including modem reset and QMI connectivity. Running from Flash for quite a few days. Flash layout might change though, because 2.5 out of 3MB of kernel partition is occupied as of now, so I'd probably like to increase it. Only puzzle left to figure out is that little pesky WLAN LED.

If testing, PLEASE BE SURE TO BACK UP YOUR STOCK FIRMWARE. I CANNOT STRESS THIS ENOUGH, as stock firmware is NOT publicly available, and customized by mobile carriers.

Also, please note that this is for model MF286 only, not for MF286A/C/DR or any other variants.

I need to test the installation methods not requiring disassembly though - right now I only tested one using TFTP from serial console, which is the way to perform device recovery if anything goes wrong.

You can check the sources here: https://github.com/Leo-PL/openwrt/tree/zte_mf286 - any comments are welcome.

great work mate, stil did not have a chance to test this out, but will report back once I do!

I'd like to add one improvement, but I haven't yet figured out, how to do that with OpenWrt's build system. I'd like to generate a split image, to temporarily flash from within stock firmware, to its kernel and rootfs partitions, which would just be the result of splitting initramfs, so there is no need to do so manully. Any ideas?