Adding OpenWrt support for ZTE MF286 3g/4g wifi router

Could you post full boot log from power-on somewhere?
I'm very puzzled because that last part with selecting operation by numbers reeks of Ralink/Mediatek U-boot.

https://pastebin.com/APpYKu1F the full log.

hi, please is there any hope for me? i have uploaded the boot log.

On boot press "2" and see what happen (maybe there is a hidden option)

This is mediatek MT7621, This model is different than mf286a/r (ath79) and mf286d/f (ipq40xx)

thanks, i will try that

And I'm having a big WTF moment right now after seeing internal photos at https://fccid.io/SRQ-MF286C, showing QCA9563 on that black PCB. Maybe there are two different versions of MF286C around - about that I wouldn't be surprised at all, given the history of ZTE routers.

@mf286c this is kind-of bad news for you, because existing images won't work. You need to dump the flash from original FW, or boot an initramfs from a similar MT7621 device to get started. Then, porting will be mostly poking and prodding with a multimeter, and writing a device tree - extracting one from stock FW will help greatly.

Thanks. You are correct. The mf286c above is different from mine. I will upload some internal photo from mine or send them to you.

Pressing "2" or any other number (apart from the stated ones ) makes the router to restart the booting process from the begining. No hidden access.

The fail safe boot key worked but no luck on the password reset since i dont know how to enter the command for the reset.

1 Like

Bro @Leo-PL i had flash my zte mf286 with openwrt firmware but the WiFi 5 Ghz not show up, can you help me how to actived ?
or any one can help me ? Thanks

This my Kernel Log : https://pastebin.com/2Ru2WDSC
This My System Log : https://pastebin.com/YswGsUQF

I presume this is MF286R. Another crazy variant with swapped Wi-Fi chip? I've seen at least one MF286A with flash layout like plain MF286 in the wild. ZTE naming is CRAZY!

Could you install ath10k-firmware-qca9888-ct, ath10k-firmware-qca988x-ct and ensure kmod-ath10k-pci is installed?
I don't see the probe of anything ath10k related on PCI bus.
Pro forma, please also dump ART partition so I can take a look at it, and check if it isn't corrupted.

@mf286c found something: https://fccid.io/SRQ-MF286C3 - this is your device. Seriously, what the folks at ZTE were thinking with naming their devices?

Looking at the internal photos (https://fccid.io/SRQ-MF286C3/Internal-Photos/Internal-Photos-5611291) looks like run-off-the-mill MT7621 device booting from NAND. Port should be doable, but you're probably on your own, unless you can find someone else with this device and some embedded development skills to do the port.
Anyway, getting the full flash dump would be the first step towards getting the device supported.

1 Like

Hello @Leo-PL do you know anyone wo has tired changing the Radio Module to a 5G Module with the ZTE MF286D :slight_smile: Thank You

I don't. However a friend attempted adding MF286D modem to MF286A, and to avoid troubles with LED controller, he had to isolate the I2C lines inside mPCIe connector, going towards the LED controller onboard. You may need to isolate all vendor-specific pins on both sides. In general, you're on your own.

1 Like

Yes I wasn't able to get my fibocom fm350 or Quectel rm500u-cn working.

Are you still interested in making it work?

Yes, both are on my to do list.

What's your router model?
Was the modem recognized as a USB device the last time you checked?
I can build an image for you to test.

Does this branch support mf286c?
I have a mf286c and I want to try the firmware on it.

As I've written on Github - it doesn't, but hardware looks similar with MF286A on the router side.

If you can get the boot log from serial console, and your hardware is MF286C, not MF286C3, then maybe there is a chance.

How can I get the boot log from the serial console?
I need the names of the tools and links. Thanks

You'll need a generic 3.3V USB-serial adapter, but I recommend against CH340G-based ones. Something like this: https://www.aliexpress.com/item/1859102520.html or https://pl.aliexpress.com/item/4000932704515.html - you can use CP2102, FT232* or PL2303. CH340G couldn't keep up with MF286A's U-boot.
And some female-to-female Dupont cables and goldpin connector. No need to solder them, you can hold the cables inside pads. A PH0 screwdriver and some flat plastic thing (like a guitar pick) would come handy in opening the case.

1 Like