Adding OpenWrt support for ZTE MF286 3g/4g wifi router

sunnydrake · October 10, 2021, 8:08am

Hello:) im currently trying to add support for subj. Will post progress and help requests here as work progressing. I have plans to add support for board,wifi,FXO (for SIP) and ethernet.
HWINFO
ZTE MF286 4G router is built around Qualcomm QCA9563 soc with 802.11bgn, QCA9882 802.11ac wlan, QCA8337 gigabit switch and pci MDM9230 LTE chip (Sierra .MC7455 analogue?)

qca9563_zte_mf286.dts

// Author: sunnydrake<at>gmail.com

#include "qca956x.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>


/ {

	compatible = "zte,mf286", "qca,qca9563";
	model = "ZTE MF286";
	chosen {
		bootargs = "console=ttyS0,115200n8 mem=128m";
	};
	cpus {
		#address-cells = <1>;
		#size-cells = <0>;

		cpu@0 {
			device_type = "cpu";
			compatible = "mips,mips74Kc";
			clocks = <&pll ATH79_CLK_CPU>;
			reg = <0>;
		};
	};
	memory@0 {
		device_type = "memory";
		reg = <0x0 0x8000000>;
	};
	aliases {
		led-boot = &led_blue;
		led-failsafe = &led_blue;
		led-running = &led_blue;
		led-upgrade = &led_blue;
		label-mac-device = &eth0;
	};
	leds {
		compatible = "gpio-leds";
		led_blue: led_blue {
			label = "blue:near cpu test";
			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
		};

/*		led_power: power {
			label = "1st:power";
			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
			default-state = "on";
		};
		wifi: led_wifi {
			label = "Wifi led blue";
			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
		};
		mdmreset: mdmreset{
			label = "CTRL! Modem reset button";
			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
		}; 
  */

/*		wlan2g {
			label = "white:wlan2g";
			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
			linux,default-trigger = "phy1tpt";
		};

		wlan5g {
			label = "white:wlan5g";
			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
			linux,default-trigger = "phy0tpt";
		};
*/
	};

	keys {
//		compatible = "gpio-keys";
		compatible = "gpio-keys-polled";
		#address-cells = <1>;
		#size-cells = <0>;
		poll-interval = <100>;
/*		wps {
			label = "wps button";
			linux,code = <KEY_WPS_BUTTON>;
			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
			#debounce-interval = <60>;
		};
		reset {
			label = "Reset button";
			linux,code = <KEY_RESTART>;
			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
			#debounce-interval = <60>;
		};

		wlan {
			label = "Wlan button";
			linux,code = <KEY_RFKILL>;
			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
			#debounce-interval = <60>;
		};
*/
	};
};

&spi {
	status = "okay";

	flash_nor: flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <25000000>;

		nor_partitions: partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x000000 0x0a0000>;
				read-only;
			};

			partition@a0000 {
				label = "u-boot-env";
				reg = <0x0a0000 0x020000>;
			};

		};
	};

	flash_nand: flash@1 {
		compatible = "spi-nand";
		reg = <1>;
		spi-max-frequency = <25000000>;

		nand_partitions: partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;
			art:partition@0 {
				label = "art";
				reg = <0x0000000 0x80000>;

			};
			mac:partition@80000 {
				label = "mac";
				reg = <0x80000 0x80000>;
			};	
			nand_rootfs: partition@2000000 {
				label = "rootfs";
				reg = <0x2000000 0x6000000>;
			};
			nand_kernel: partition@1800000 {
				label = "nand_kernel";
			//	reg = <0x7B00000 0x500000>;
				reg = <0x1800000 0x800000>;
			};			

/*			nand_ubi: partition@0 {
				label = "nand_ubi";
				reg = <0x000000 0x8000000>;
			};
*/		};
	};
};

&art {
	compatible = "nvmem-cells";
	#address-cells = <1>;
	#size-cells = <1>;

	macaddr_art_0: macaddr@0 {
		reg = <0x0 0x6>;
	};
	macaddr_art_1: macaddr@0 {
		reg = <0x6 0x6>;
	};
};


&wmac {
	status = "okay";

	mtd-cal-data = <&art 0x1000>;
};



&pcie {
	status = "okay";

//MDM9230
	//QCA9882 ?
	wifi@0,0 {
	    status = "okay";
		compatible = "qcom,ath10k";
//		reg = <0 0 0 0 0>;
		device_type = "pci";
		gpio-controller;
//        qca,no-eeprom;
	};
}; 
&mdio0 {
	status = "okay";
	wanp: ethernet-phy@4 {
		phy-mode = "sgmii";
		reg = <4>;
	};
	lan1: ethernet-phy@5 {
		phy-mode = "sgmii";
		reg = <0x1f>;
	};
};
&eth0 {
	status = "okay";

	nvmem-cells = <&macaddr_art_0>;
	nvmem-cell-names = "mac-address";
//	phy-mode = "sgmii";
	phy-handle = <&wanp>;
//	reg = <4>;
//	pll-data = <0x03000000 0x00000101 0x00001313>;
	gmac-config {
		device = <&gmac>;
		rgmii-enabled = <1>;
	};
};
&mdio1 {
		status = "okay";
		#address-cells = <1>;
		#size-cells = <0>;

		switch0: switch@10 {
			compatible = "qca,qca8337";
			#address-cells = <1>;
			#size-cells = <0>;

			dsa,member = <0 0>;

			reg = <0x1f>;

			ports {
				#address-cells = <1>;
				#size-cells = <0>;

				switch0cpu: port@0 {
					reg = <0>;
					label = "cpu";
					//ethernet = <&gmac0>;
					phy-mode = "rgmii-id";
					fixed-link {
						speed = <1000>;
						full-duplex;
					};
				};

				port@1 {
					reg = <1>;
					label = "sw1";
				};

				port@2 {
					reg = <2>;
					label = "sw2";
				};

				port@3 {
					reg = <3>;
					label = "sw3";
				};

				port@4 {
					reg = <4>;
					label = "sw4";
				};

				port@5 {
					reg = <5>;
					label = "sw5";
				};
			};
		};
};
 
&usb_phy1 {
	status = "okay";
};
&usb0 {
	status = "okay";
    };
&usb1 {
	#address-cells = <1>;
	#size-cells = <0>;
	status = "okay";

	hub_port1: port@1 {
		reg = <1>;
		#trigger-source-cells = <0>;
	};
};

nand.mk


define Device/zte_mf286
  SOC := qca9563
  DEVICE_VENDOR := ZTE
  DEVICE_MODEL := MF286
  BLOCKSIZE := 128k
  PAGESIZE := 2048
  DEVICE_PACKAGES :=  block-mount kmod-usb-storage kmod-usb2
  DEVICE_VARIANT := NOR/NAND
  RAS_BOARD := AP152
  KERNEL := kernel-bin | append-dtb |  lzma | uImage lzma
  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma  
  IMAGES += sysupgrade.bin sysupgrade_ubi.bin
  IMAGE/sysupgrade.bin := append-rootfs | sysupgrade-tar rootfs=$$$@ | append-metadata 
  IMAGE/sysupgrade_ubi.bin := append-ubi | sysupgrade-tar rootfs=$$$@ | append-metadata 
  UBINIZE_OPTS := -E 5
  UBI_OPTS := -m 2048 -p 128KiB -O 2048 -v
  SUPPORTED_DEVICES += zte,mf286
endef
TARGET_DEVICES += zte_mf286

sunnydrake · October 10, 2021, 8:09am

Current problem command swconfig dev switch0 show
cause reboot and panic .. don't know how and where too look for fix

root@OpenWrt:/# swconfig dev switch0 show
Global attributes:
.enable_vlan: 0
.ar8xxx_mib_poll_interval: 0
.ar8xxx_mib_type: 0
.enable_mirror_rx: 0
.enable_mirror_tx: 0
.mirror_monitor_port: 0
.mirror_source_port: 0
.arl_age_time: 0
.arl_table: address resolution table
Por[40916.078995] CPU 0 Unable to handle kernel paging request at virtual address 00000010, epc == 804790ec, ra == 80474390
t 0: MAC 1a:c0:3[40916.091141] Oops[#1]:
[40916.094896] CPU: 0 PID: 2548 Comm: swconfig Not tainted 5.10.70 #0
[40916.101268] $ 0   : 00000000 00000001 00000000 00000006
[40916.106679] $ 4   : 00000001 8071db80 82f9db30 83390040
[40916.112081] $ 8   : 00000018 8038e5e4 00000000 8047427c
[40916.117485] $12   : 00000000 fffffffd 807fe1d0 82005722
[40916.122887] $16   : 83390000 8071db80 82f9dbe0 83390048
[40916.128291] $20   : 00000007 807fc7a8 80780000 00000000
[40916.133694] $24   : 82005720 00000002                  
[40916.139096] $28   : 82f9c000 82f9db18 00000000 80474390
[40916.144500] Hi    : 00000000
[40916.147465] Lo    : 00000001
[40916.150463] epc   : 804790ec ar8327_sw_get_eee+0x28/0x44
[40916.155948] ra    : 80474390 swconfig_get_attr+0x114/0x5b8
[40916.161605] Status: 1100d803.KERNEL EXL IE 
[40916.165933] Cause : 00800008 (ExcCode 02)
[40916.170072] BadVA : 00000010
[40916.173038] PrId  : 00019750 (MIPS 74Kc)
[40916.177087] Modules linked in: pppoe ppp_async iptable_nat xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_FLOWOFFLOAD pppox ppp_generic nf_nat nf_flow_table nf_conntrack ipt_REJECT xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG slhc nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables crc_ccitt fuse nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 vfat fat ntfs nls_utf8 nls_iso8859_1 nls_cp437 sha256_generic libsha256 seqiv jitterentropy_rng drbg hmac cmac usb_storage fsl_mph_dr_of ehci_platform ehci_fsl sd_mod scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 phy_ar7100_usb usbcore nls_base usb_common crc32c_generic
[40916.247414] Process swconfig (pid: 2548, threadinfo=cc446cc1, task=d4909c14, tls=77e64dcc)
[40916.255935] Stack : 00000000 82f9dbc4 80780000 00000000 00000000 8037023c 8071db80 00000001
[40916.264581]         00000000 00000000 00000000 82f9dc38 82826e80 00000000 82f9dbc4 8050aee8
[40916.273218]         00000000 00000000 00000000 8019f17c 8071c170 00000000 82f9dc38 00000000
[40916.281856]         82f9db84 81d9e200 807fb664 82f90840 82826e80 82f9dc38 807fc7a8 8050b104
[40916.290502]         80509bb8 81e80000 82f9dbfc 80509298 00000001 82f9dbf4 807fb664 82f91800
[40916.299139]         ...
[40916.301668] Call Trace:
[40916.304193] [<804790ec>] ar8327_sw_get_eee+0x28/0x44
[40916.309315] 
[40916.310852] Code: 10430005  00822021  00001025 <9083000f> 03e00008  acc3000c  03e00008  2402ff86  03e00008 
[40916.320939] 
4:2b:47:7d
Port[40916.322545] ---[ end trace 0abbd39df80bdf15 ]---
 5: MAC 00:25:90[40916.328714] Kernel panic - not syncing: Fatal exception

gandi69 · November 27, 2021, 9:41pm

Did you manage to get anywhere with this?

wangan · December 15, 2021, 8:17pm

hello, interested in this as well

Leo-PL · December 29, 2021, 5:32pm

I had some moderate success here: https://github.com/Leo-PL/openwrt/tree/zte_mf286

Wi-Fi, Ethernet and modem seem to work, but the Power and WLAN LEDs, for which the mapped GPIOs don't seem to route anywhere - there probably is some pinctrl magic to be done. FXS is handled by modem entirely, as are most of LEDs, so no SIP for you, though. The only LED I got working is the green "test" LED inside the case.
Haven't yet tried installing on flash yet - stay tuned.

wangan · December 29, 2021, 6:46pm

wow, that's great work, seen you were working on this on one of the Polish forums. Very excited, will try to test this one out after the holidays. Thank YOU!

sunnydrake · December 29, 2021, 6:46pm

wow nice i see you working on network switch too.. I haven't time to push further yet...
Source below for modem says following " PCM/I2S interface for voice "

Another very good lead :i think here some AT commands expose FXO caps and voice data flow.. as it works on 7304

https://source.sierrawireless.com/resources/airprime/minicard/74xx/4117727-airprime-em74xx-mc74xx-at-command-reference/#sthash.RFHlHrpA.dpbs

additional links

Some openwrt stuff on their forum (qmicli for firmware updates and stuff)

Leo-PL · December 29, 2021, 9:50pm

Voice handling is done entirely on modem, the same as it was done on MF283+. You can connect an analog telephone and make a call even when router part is in U-boot.
I need to figure out those missing LEDs - at least I know from stock kernel source, that Wi-Fi LED is correct - but it still doesn't work. By any chance, does anyone have U-boot sources?

sunnydrake · January 2, 2022, 9:15pm

#!/bin/sh
# Modified from https://gist.github.com/huzhifeng/e3c222e6b780d82967db
echo GPIO LED Test
echo   Usage: $0 [wait time] [gpio start] [gpio end]
echo Example: $0 3s 0 1
echo leave gpio range blank to test all GPIOs.
echo
wait=${1:-"3s"}
for GPIOCHIP in /sys/class/gpio/gpiochip*/ ; do
    BASE=$(cat ${GPIOCHIP}base)
    SIZE=$(cat ${GPIOCHIP}ngpio)
    MAX=$(($BASE+$SIZE-1))
    gpio_end=${3:-$MAX}
    [ -z "$gpio" ] && gpio=${2:-$BASE}
    while [ $gpio -ge $BASE -a $gpio -le $MAX -a $gpio -le $gpio_end ] ; do
        # Save original value if needed
        if [ -d /sys/class/gpio/gpio${gpio} ]; then
            DIRECTION=$(cat /sys/class/gpio/gpio${gpio}/direction)
            UNEXPORT=0
            VALUE=$(cat /sys/class/gpio/gpio$gpio/value)
        else
            echo $gpio > /sys/class/gpio/export
            UNEXPORT=1
            DIRECTION=""
            VALUE=""
        fi
        if [ -d /sys/class/gpio/gpio${gpio} ]; then
            echo out > /sys/class/gpio/gpio$gpio/direction
 
            echo "[gpiochip${BASE}:$gpio:out] = 0"
            echo 0 > /sys/class/gpio/gpio$gpio/value
            sleep $wait
 
            echo "[gpiochip${BASE}:$gpio:out] = 1"
            echo 1 > /sys/class/gpio/gpio$gpio/value
            sleep $wait
 
            # Restore original value
            [ ! -z "$DIRECTION" ] && echo $DIRECTION > /sys/class/gpio/gpio${gpio}/direction
            [ ! -z "$VALUE" ] && echo $VALUE > /sys/class/gpio/gpio${gpio}/value
            [ "$UNEXPORT" -eq 1 ] && echo ${gpio} > /sys/class/gpio/unexport
        else
            echo "[gpiochip${BASE}:${gpio}] = Failed to export"
        fi
 
        gpio=$((gpio+1))
    done
done

Leo-PL · January 3, 2022, 12:08am

I already tested all the available GPIOs, so no luck here. What I've found is that both LEDs are actually routed through modem, for some reason. Maybe some AT command needs to be executed at the modem startup, for this to work.

Leo-PL · January 3, 2022, 10:29pm

I tried installing my recent build on flash at https://github.com/Leo-PL/openwrt/commit/12885b6d6764b95c593d367e6a689cc638212b1a, using mtd-concat behind UBI device. However, when booting off of flash, the UBI attach would fail due to duplicate LEB sequence number, like this:

[    1.623437] UBI: auto-attach mtd8
[    1.626930] ubi0: attaching mtd8
[    2.586658] random: fast init done
[    4.152618] ubi0 error: 0x80470fec: two LEBs with same sequence number 134
[    4.159743] eraseblock attaching information dump:
[    4.164685]  ec       0
[    4.167218]  pnum     414
[    4.169917]  lnum     0
[    4.172435]  scrub    0
[    4.174952]  sqnum    134
[    4.177656] Volume identifier header dump:
[    4.181879]  magic     55424921
[    4.185113]  version   1
[    4.187727]  vol_type  1
[    4.190336]  copy_flag 0
[    4.192943]  compat    0
[    4.195552]  vol_id    0
[    4.198166]  lnum      0
[    4.200775]  data_size 0
[    4.203382]  used_ebs  0
[    4.205989]  data_pad  0
[    4.208605]  sqnum     134
[    4.211393]  hdr_crc   733e519d
[    4.214627] Volume identifier header hexdump:
[    4.219460] ubi0 error: 0x80465730: failed to attach mtd8, error -22
[    4.226121] UBI error: cannot attach mtd8
[    4.230870] /dev/root: Can't open blockdev
[    4.235110] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    4.242866] Please append a correct "root=" boot option; here are the available partitions:

I heard on the polish eko.one.pl forum, that UBI and mtd-concat don't like each other. So back to the drawing board, I'll need to debug this, unless someone knows a solution.

Leo-PL · January 11, 2022, 12:18am

Got almost everything working, including modem reset and QMI connectivity. Running from Flash for quite a few days. Flash layout might change though, because 2.5 out of 3MB of kernel partition is occupied as of now, so I'd probably like to increase it. Only puzzle left to figure out is that little pesky WLAN LED.

If testing, PLEASE BE SURE TO BACK UP YOUR STOCK FIRMWARE. I CANNOT STRESS THIS ENOUGH, as stock firmware is NOT publicly available, and customized by mobile carriers.

Also, please note that this is for model MF286 only, not for MF286A/C/DR or any other variants.

I need to test the installation methods not requiring disassembly though - right now I only tested one using TFTP from serial console, which is the way to perform device recovery if anything goes wrong.

You can check the sources here: https://github.com/Leo-PL/openwrt/tree/zte_mf286 - any comments are welcome.

wangan · January 11, 2022, 8:07am

great work mate, stil did not have a chance to test this out, but will report back once I do!

Leo-PL · January 18, 2022, 11:43pm

I'd like to add one improvement, but I haven't yet figured out, how to do that with OpenWrt's build system. I'd like to generate a split image, to temporarily flash from within stock firmware, to its kernel and rootfs partitions, which would just be the result of splitting initramfs, so there is no need to do so manully. Any ideas?

Leo-PL · February 2, 2022, 1:14am

Allright, here it goes:

github.com/openwrt/openwrt

ath79: support ZTE MF286

openwrt:master ← Leo-PL:zte_mf286

opened 01:20AM - 01 Feb 22 UTC

Leo-PL

+330 -0

ZTE MF286 is an indoor LTE category 6 CPE router with simultaneous dual-band 80…2.11ac plus 802.11n Wi-Fi radios and quad-port gigabit Ethernet switch, FXS and external USB 2.0 port. Hardware highlights: - CPU: QCA9563 SoC at 775MHz, - RAM: 128MB DDR2, - NOR Flash: MX25L1606E 2MB SPI Flash, for U-boot only, - NAND Flash: GD5F1G04UBYIG 128MB SPI NAND-Flash, for all other data, - Wi-Fi 5GHz: QCA9882 2x2 MIMO 802.11ac radio, - WI-Fi 2.4GHz: QCA9563 3x3 MIMO 802.11n radio, - Switch: QCA8337v2 4-port gigabit Ethernet, with single SGMII CPU port, - WWAN: MDM9230-based category 6 internal LTE modem in extended mini-PCIE form factor, with 3 internal antennas and 2 external antenna connections, single mini-SIM slot. Modem model identified as MF270, - FXS: one external ATA port (handled entirely by modem part) with two physical connections in parallel, - USB: Single external USB 2.0 port, - Switches: power switch, WPS, Wi-Fi and reset buttons, - LEDs: Wi-Fi, Test (internal). Rest of LEDs (Phone, WWAN, Battery, Signal state) handled entirely by modem. 4 link status LEDs handled by the switch on the backside. - Battery: 3Ah 1-cell Li-Ion replaceable battery, with charging and monitoring handled by modem. - Label MAC device: eth0 Console connection: connector X2 is the console port, with the following pinout, starting from pin 1, which is the topmost pin when the board is upright: - VCC (3.3V). Do not use unless you need to source power for the converer from it. - TX - RX - GND Default port configuration in U-boot as well as in stock firmware is 115200-8-N-1. Installation: Due to different flash layout from stock firmware, sysupgrade from within stock firmware is impossible, despite it's based on QSDK which itself is based on OpenWrt. STEP 0: Stock firmware update: As installing OpenWrt cuts you off from official firmware updates for the modem part, it is recommended to update the stock firmware to latest version before installation, to have built-in modem at the latest firmware version. STEP 1: gaining root shell: Method 1: This works if busybox has telnetd compiled in the binary. If this does not work, try method 2. Using well-known exploit to start telnetd on your router - works only if Busybox on stock firmware has telnetd included: - Open stock firmware web interface - Navigate to "URL filtering" section by going to "Advanced settings", then "Firewall" and finally "URL filter". - Add an entry ending with "&&telnetd&&", for example "http://hostname/&&telnetd&&". - telnetd will immediately listen on port 4719. - After connecting to telnetd use "admin/admin" as credentials. Method 2: This works if busybox does not have telnetd compiled in. Notably, this is the case in DNA.fi firmware. If this does not work, try method 3. - Set IP of your computer to 192.168.1.22. - Have a TFTP server running at that address - Download MIPS build of busybox including telnetd, for example from: https://busybox.net/downloads/binaries/1.21.1/busybox-mips and put it in it's root directory. Rename it as "telnetd". - As previously, login to router's web UI and navigate to "URL filtering" - Using "Inspect" feature, extend "maxlength" property of the input field named "addURLFilter", so it looks like this: <input type="text" name="addURLFilter" id="addURLFilter" maxlength="332" class="required form-control"> - Stay on the page - do not navigate anywhere - Enter "http://aa&zte_debug.sh 192.168.1.22 telnetd" as a filter. - Save the settings. This will download the telnetd binary over tftp and execute it. You should be able to log in at port 23, using "admin/admin" as credentials. Method 3: If the above doesn't work, use the serial console - it exposes root shell directly without need for login. Some stock firmwares, notably one from finnish DNA operator lack telnetd in their builds. STEP 2: Backing up original software: As the stock firmware may be customized by the carrier and is not officially available in the Internet, IT IS IMPERATIVE to back up the stock firmware, if you ever plan to returning to stock firmware. Method 1: after booting OpenWrt initramfs image via TFTP: PLEASE NOTE: YOU CANNOT DO THIS IF USING INTERMEDIATE FIRMWARE FOR INSTALLATION. - Dump stock firmware located on stock kernel and ubi partitions: ssh root@192.168.1.1: cat /dev/mtd4 > mtd4_kernel.bin ssh root@192.168.1.1: cat /dev/mtd8 > mtd8_ubi.bin And keep them in a safe place, should a restore be needed in future. Method 2: using stock firmware: - Connect an external USB drive formatted with FAT or ext4 to the USB port. - The drive will be auto-mounted to /var/usb_disk - Check the flash layout of the device: cat /proc/mtd It should show the following: mtd0: 00080000 00010000 "uboot" mtd1: 00020000 00010000 "uboot-env" mtd2: 00140000 00020000 "fota-flag" mtd3: 00140000 00020000 "caldata" mtd4: 00140000 00020000 "mac" mtd5: 00600000 00020000 "cfg-param" mtd6: 00140000 00020000 "oops" mtd7: 00800000 00020000 "web" mtd8: 00300000 00020000 "kernel" mtd9: 01f00000 00020000 "rootfs" mtd10: 01900000 00020000 "data" mtd11: 03200000 00020000 "fota" Differences might indicate that this is NOT a vanilla MF286 device but one of its later derivatives. - Copy over all MTD partitions, for example by executing the following: for i in 0 1 2 3 4 5 6 7 8 9 10 11; do cat /dev/mtd$i > \ /var/usb_disk/mtd$i; done - If the count of MTD partitions is different, this might indicate that this is not a standard MF286 device, but one of its later derivatives. - (optionally) rename the files according to MTD partition names from /proc/mtd - Unmount the filesystem: umount /var/usb_disk; sync and then remove the drive. - Store the files in safe place if you ever plan to return to stock firmware. This is especially important, because stock firmware for this device is not available officially, and is usually customized by the mobile providers. STEP 3: Booting initramfs image: Method 1: using serial console (RECOMMENDED): - Have TFTP server running, exposing the OpenWrt initramfs image, and set your computer's IP address as 192.168.1.22. This is the default expected by U-boot. You may wish to change that, and alter later commands accordingly. - Connect the serial console if you haven't done so already, - Interrupt boot sequence by pressing any key in U-boot when prompted - Use the following commands to boot OpenWrt initramfs through TFTP: setenv serverip 192.168.1.22 setenv ipaddr 192.168.1.1 tftpboot 0x81000000 openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin bootm 0x81000000 (Replace server IP and router IP as needed). There is no emergency TFTP boot sequence triggered by buttons, contrary to MF283+. - When OpenWrt initramfs finishes booting, proceed to actual installation. Method 2: using initramfs image as temporary boot kernel This exploits the fact, that kernel and rootfs MTD devices are consecutive on NAND flash, so from within stock image, an initramfs can be written to this area and booted by U-boot on next reboot, because it uses "nboot" command which isn't limited by kernel partition size. - Download the initramfs-kernel.bin image - Split the image into two parts on 3MB partition size boundary, which is the size of kernel partition. Pad the output of second file to eraseblock size: dd if=openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin \ bs=128k count=24 \ of=openwrt-ath79-zte_mf286-intermediate-kernel.bin dd if=openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin \ bs=128k skip=24 conv=sync \ of=openwrt-ath79-zte_mf286-intermediate-rootfs.bin - Copy over /usr/bin/flash_eraseall and /usr/bin/nandwrite utilities to /tmp. This is CRITICAL for installation, as erasing rootfs will cut you off from those tools on flash! - After backing up the previous MTD contents, write the images to the respective MTD devices: /tmp/flash_eraseall /dev/<kernel-mtd> /tmp/nandwrite /dev/<kernel-mtd> \ /var/usb_disk/openwrt-ath79-zte_mf286-intermediate-kernel.bin /tmp/flash_eraseall /dev/<kernel-mtd> /tmp/nandwrite /dev/<rootfs-mtd> \ /var/usb_disk/openwrt-ath79-zte_mf286-intermediate-rootfs.bin - Ensure that no bad blocks were present on the devices while writing. If they were present, you may need to vary the split between kernel and rootfs parts, so U-boot reads a valid uImage after skipping the bad blocks. If it fails, you will be left with method 3 (below). - If write is OK, reboot the device, it will reboot to OpenWrt initramfs: reboot -f - After rebooting, SSH into the device and use sysupgrade to perform proper installation. Method 3: using built-in TFTP recovery (LAST RESORT): - With that method, ensure you have complete backup of system's NAND flash first. It involves deliberately erasing the kernel. - Download "-initramfs-kernel.bin" image for the device. - Prepare the recovery image by prepending 8MB of zeroes to the image, and name it root_uImage: dd if=/dev/zero of=padding.bin bs=8M count=1 cat padding.bin openwrt-ath79-nand-zte_mf286-initramfs-kernel.bin > root_uImage - Set up a TFTP server at 192.0.0.1/8. Router will use random address from that range. - Put the previously generated "root_uImage" into TFTP server root directory. - Deliberately erase "kernel" partition" using stock firmware after taking backup. THIS IS POINT OF NO RETURN. - Restart the device. U-boot will attempt flashing the recovery initramfs image, which will let you perform actual installation using sysupgrade. This might take a considerable time, sometimes the router doesn't establish Ethernet link properly right after booting. Be patient. - After U-boot finishes flashing, the LEDs of switch ports will all light up. At this moment, perform power-on reset, and wait for OpenWrt initramfs to finish booting. Then proceed to actual installation. STEP 4: Actual installation: - scp the sysupgrade image to the device: scp openwrt-ath79-nand-zte_mf286-squashfs-sysupgrade.bin \ root@192.168.1.1:/tmp/ - ssh into the device and execute sysupgrade: sysupgrade -n /tmp/openwrt-ath79-nand-zte_mf286-squashfs-sysupgrade.bin - Wait for router to reboot to full OpenWrt. STEP 5: WAN connection establishment Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so, please put the following entries in /etc/config/network, replacing the specific configuration entries with one needed for your ISP: config interface 'wan' option proto 'qmi' option device '/dev/cdc-wdm0' option auth '<auth>' # As required, usually 'none' option pincode '<pin>' # If required by SIM option apn '<apn>' # As required by ISP option pdptype '<pdp>' # Typically 'ipv4', or 'ipv4v6' or 'ipv6' For example, the following works for most polish ISPs config interface 'wan' option proto 'qmi' option device '/dev/cdc-wdm0' option auth 'none' option apn 'internet' option pdptype 'ipv4' If you have build with LuCI, installing luci-proto-qmi helps with this task. Restoring the stock firmware: Preparation: If you took your backup using stock firmware, you will need to reassemble the partitions into images to be restored onto the flash. The layout might differ from ISP to ISP, this example is based on generic stock firmware. The only partitions you really care about are "web", "kernel", and "rootfs". For easy padding and possibly restoring configuration, you can concatenate most of them into images written into "ubi" meta-partition in OpenWrt. To do so, execute something like: cat mtd5_cfg-param.bin mtd6-oops.bin mtd7-web.bin mtd9-rootfs.bin > \ mtd8-ubi_restore.bin You can skip the "fota" partition altogether, it is used only for stock firmware update purposes and can be overwritten safely anyway. The same is true for "data" partition which on my device was found to be unused at all. Restoring mtd5_cfg-param.bin will restore the stock firmware configuration you had before. Method 1: Using initramfs: - Boot to initramfs as in step 3: - Completely detach ubi0 partition using ubidetach /dev/ubi0_0 - Look up the kernel and ubi partitions in /proc/mtd - Copy over the stock kernel image using scp to /tmp - Erase kernel and restore stock kernel: (scp mtd4_kernel.bin root@192.168.1.1:/tmp/) mtd write <kernel_mtd> mtd4_kernel.bin rm mtd4_kernel.bin - Copy over the stock partition backups one-by-one using scp to /tmp, and restore them individually. Otherwise you might run out of space in tmpfs: (scp mtd3_ubiconcat0.bin root@192.168.1.1:/tmp/) mtd write <ubiconcat0_mtd> mtd3_ubiconcat0.bin rm mtd3_ubiconcat0.bin (scp mtd5_ubiconcat1.bin root@192.168.1.1:/tmp/) mtd write <ubiconcat1_mtd> mtd5_ubiconcat1.bin rm mtd5_ubiconcat1.bin - If the write was correct, force a device reboot with reboot -f Method 2: Using live OpenWrt system (NOT RECOMMENDED): - Prepare a USB flash drive contatining MTD backup files - Ensure you have kmod-usb-storage and filesystem driver installed for your drive - Mount your flash drive mkdir /tmp/usb mount /dev/sda1 /tmp/usb - Remount your UBI volume at /overlay to R/O mount -o remount,ro /overlay - Write back the kernel and ubi partitions from USB drive cd /tmp/usb mtd write mtd4_kernel.bin /dev/<kernel_mtd> mtd write mtd8_ubi.bin /dev/<kernel_ubi> - If everything went well, force a device reboot with reboot -f Last image may be truncated a bit due to lack of space in RAM, but this will happen over "fota" MTD partition which may be safely erased after reboot anyway. Method 3: using built-in TFTP recovery (LAST RESORT): - Assemble a recovery rootfs image from backup of stock partitions by concatenating "web", "kernel", "rootfs" images dumped from the device, as "root_uImage" - Use it in place of "root_uImage" recovery initramfs image as in the TFTP pre-installation method. Quirks and known issues - Kernel partition size is increased to 4MB compared to stock 3MB, to accomodate future kernel updates - at this moment OpenWrt 5.10 kernel image is at 2.5MB which is dangerously close to the limit. This has no effect on booting the system - but keep that in mind when reassembling an image to restore stock firmware. - uqmi seems to be unable to change APN manually, so please use the one you used before in stock firmware first. If you need to change it, please use protocok '3g' to establish connection once, or use the following command to change APN (and optionally IP type) manually: echo -ne 'AT+CGDCONT=1,"IP","<apn>' > /dev/ttyUSB0 - The only usable LED as a "system LED" is the green debug LED hidden inside the case. All other LEDs are controlled by modem, on which the router part has some influence only on Wi-Fi LED. - Wi-Fi LED currently doesn't work while under OpenWrt, despite having correct GPIO mapping. All other LEDs are controlled by modem, including this one in stock firmware. GPIO19, mapped there only acts as a gate, while the actual signal source seems to be 5GHz Wi-Fi radio, however it seems it is not the LED exposed by ath10k as ath10k-phy0. - GPIO5 used for modem reset is a suicide switch, causing a hardware reset of whole board, not only the modem. It is attached to gpio-restart driver, to restart the modem on reboot as well, to ensure QMI connectivity after reboot, which tends to fail otherwise. - Modem, as in MF283+, exposes root shell over ADB - while not needed for OpenWrt operation at all - have fun lurking around. - MAC address shift for 5GHz Wi-Fi used in stock firmware is 0x320000000000, which is impossible to encode in the device tree, so I took the liberty of using MAC address increment of 1 for it, to ensure different BSSID for both Wi-Fi interfaces. Signed-off-by: Lech Perczak <lech.perczak@gmail.com>

Wi-Fi LED still ain't working, but it's better to have the support now than not have it at all.
Kernel partition size was increased to 4MB in the end, so you'll have to reinstall from scratch.

Leo-PL · February 5, 2022, 4:18pm

And support for MF286 and MF286D got merged today. MF286A in progress

faloyeh · February 11, 2022, 6:04pm

Any chance to get MF286R eventually added too? Thanks

Leo-PL · February 11, 2022, 6:26pm

I don't have the device. If you'd like to help, please provide full boot logs and output of cat /sys/kernel/debug/usb/devices from vendor firmware, and at best, full flash dump. Be prepared to do some testing.

faloyeh · February 11, 2022, 6:58pm

Sure, let me try to get you the requested details.. I guess I should be able to make that happen based on your pull request details (#5019).

Thanks for your interest and prompt reply!

Leo-PL · February 11, 2022, 9:22pm

Please read on here: https://github.com/Leo-PL/openwrt/tree/zte_mf286a - IIRC the hardware of MF286R is the same as MF286A, not "old" MF286, modulo the internal modem card.
MF286A support is ready, just waiting to get some final tests done, before I open PR for that one - it might support both variants by same image if all goes well. I'm a bit worried by the modem, as it is Marvell-based - no idea what custom protocol is in use internally over USB with it - pretty sure it's not QMI.