Adding support for ZTE MF287+ aka DreiNeo

For Developers
1

I've got yet another very, very cheap ISP branded LTE router: ZTE MF287+. Features:

  • IPQ4018 SoC
  • 256MiB RAM
  • 128MiB NAND (SPI)
  • 2.4G and 5G WiFi (SoC Internal)
  • SPI ZigBee module
  • Cat12 (or 13?) LTE module
  • Battery and charge controller (managed by LTE module)
  • 4 GBit ports
  • 1 RJ11 phone port (managed by LTE module)
  • 1x USB (doesn't work on stock firmware, only for OEM debug)
  • Apart from the blue debug LED on the board, all LEDs are controlled by the LTE module.

I have basic support finished and I'm currently working out the rough edges.

Regarding USB: No power is provided to the port. It seems to be controlled by the LTE module, it is powered for a short period while the LTE module is booting (independently of the IPQ SoC).

Installation without opening the device is possible using an exploit, for now it's only explained on my personal website at https://www.aboehler.at/doku/doku.php/projects:zte_mf28x The information will be added to the device wiki page once the PR is accepted.

PR: https://github.com/openwrt/openwrt/pull/12708

6 Likes
2

Do you have any additional information about the modem, like band and CA support?

3

Unfortunately not. There is no datasheet that I could find, the information is scattered in some forums. Do you know if I can get this information via AT commands from the modem?

4

Not sure. Do you have any response to AT+CLAC? command? Potentially you may see a command with bnd or band in its name.

5

I'll try that on the weekend, when I have access to my spare device.

6

OK, so AT+CLAC? produces an error, but AT+ZNLOCKBAND? works:

+ZNLOCKBAND: 20080800c5,2000004c00000

NB: This response is from a ZTE DreiNeo Pro aka MF287Pro. I won't have access to the MF287+ for another few weeks.

7

is B1 B3 B7 B8 B20 B28 B38

8

Thanks for decoding :slight_smile:

According to Wikipedia, that's every European band currently deployed...

9

To be sure, try AT+ZNLOCKBAND=? then see the max allowed value for the 1st parameter and if it consists of multiple F's write it like this:
AT+ZNLOCKBAND=FFFFFFFFFF
then read again AT+ZNLOCKBAND?

10

The command

just returns OK.

11

Well... it is a proprietary command and they are free to ignore the common syntax )
According to polish forum this is the "maximum" for MF286D:
AT+ZNLOCKBAND=1,0,20080800C5,0 - All
In fact, that is not 100% correct , at least for the latest Telia B12 modem firmware, as B32 is missing from the list.

So if we want to verify that then we need to write something like this:
AT+ZNLOCKBAND=1,0,FFFFFFFFFF,0
and then re-read with AT+ZNLOCKBAND?

12

The LTE module looks very interesting.
In the original documents from "Drei" shows that the device also should support NFC.
Unfortunately, I did not test this function before flashing openwrt. It is maby connected over the LTE module.

13

No, that's a different model: The DreiNeo Pro (or MF287Pro) supports NFC but lacks ZigBee while the DreiNeo (or MF287+) lacks NFC but supports ZigBee (and it has a rechargeable battery that's not present on the Pro). The can be easily distinguished by the NFC logo on the top (or lack thereof).

The Pro has different GPIO assignments, PR for the Pro is here.

1 Like