I tried it again with the latest 23.05.3, but I get the same error.
It seems, that there is something wrong with the partitions ...
Try mtd erase /dev/mtd9 when the device is detached, then continue with sysupgrade.
1 Like
yeah, that looks much better now.
No more errors when installing and I get the luci-gui to login an configure the router 
Thanks a lot for the help,
kind regards thg
PS: Maybe somebody can add/update these informations to the install-instructions for the mf286d? If needed, I can provide logs etc. to complete this.
1 Like
Yeah, this could probably be documented on the wiki - this is known problem.
Too bad that instruction in the commit message is set in stone, however - maybe sysupgrade handler could be updated to handle that automatically, or to notify the user to mtd erase /dev/mtd9 instead of just deleting old UBI volumes.
Tagging @CHKDSK88 as the author of the support for 286D- what do you think?
1 Like
would adding mtd erase /dev/mtd9 before ubiattach -m 9 in the 6th step help here ?
mtd erase /dev/mtd9
ubiattach -m 9 #it could return error if ubi was attached before or rootfs part was erased before
ubirmvol /dev/ubi0 -N ubi_rootfs #it could return error if rootfs part was erased before
ubirmvol /dev/ubi0 -N ubi_rootfs_data #some devices doesn't have it
I would suggest to add a "ubidetach" before the "sysupgrade" too, so one error message less in the sysupgrade-process. In addition, I do not know, if the "mtd erase" has to be done before "ubirmvol" or afterwards, this would need the "ubidetach" for sure.
And again one more question:
What is the correct way, to restore the backup that was done with "cat /dev/mtd0 > /mnt/zte-mf286d/mtd0", just "dd if=/.../zte-mf286d/mtd0 of /dev/mtd0" for all mtds?
Maybe it would be nice to test the restore, because otherwise the backup is useless. And I can test the upgrade-procedure again ...
Kind regards, thg
you only touched mtd9, if I read the install instruction correctly.
you could make another backup of the mtds and compare them with your pre backup, they should be identical, except for mtd9.
No, it should replace the thing - after erasing the MTD partition there will be no ubifs there to work with, but then the generic sysupgrade code will handle formatting a new ubifs there.
No, don't use dd to do that. Proper way is to use mtd write which will write each erase block once and handle bad blocks for you. Using mtdblock on NAND devices is prone to problems because of bad block handling plus multiple writes per erase block due to externally exposed sector size..
- Place OpenWrt initramfs image for the device on a TFTP in the server's root. This example uses Server IP: 192.168.1.3
- Connect serial console (115200,8n1) to X8 connector.
- Connect TFTP server to RJ-45 port.
- Stop in u-Boot and run u-Boot commands:
setenv serverip 192.168.1.3
setenv ipaddr 192.168.1.72
set fdt_high 0x85000000
tftp openwrt-ipq40xx-generic-zte_mf286d-initramfs-fit-zImage.itb
bootm $loadaddr
- If you want to be able to revert to stock, make backup of original partitions, it's documented on the MF286R page.
- Login via ssh or serial and erase stock UBIFS partition
mtd erase rootfs
- Install image via “sysupgrade -n” (like “sysupgrade -n /tmp/openwrt-ipq40xx-generic-zte_mf286d-squashfs-sysupgrade.bin”; previously wgeting bin). It'll show UBI attach error, but sysupgrade will format a new UBI partition and create volumes for you.
This should be it - changes are only in steps 6 and 7.
I'd be grateful for the test - I can avoid disassembling my units this way ;-]
1 Like
thus restore should work with:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21; do mtd write /mnt/zte-mf286d/mtd$i /dev/mtd$i; done
BTW: For connecting the router when Linux/Busybox is running, you have to use LAN2, WAN/LAN1 is not working, the tftp works with both ports.
regards thg
I really wouldn't write back all mtds, if you had a read error someplace, during backup, you're going to have it written back.
Depending on where it was, resulting, in worst case, in a soft or hard brick.
okay, I want to test, if the backup restores the original firmware. According to the list of partitions I posted for my mf286d earlier, which ones I have to restore?
mtd9: 01d00000 00020000 "rootfs"
mtd10: 01900000 00020000 "data"
mtd20: 0041e000 0001f000 "kernel"
Anything else?
That is, for sure, not my intention ...
not really my area of expertise, compare them with your backups of 9,10 and 20, if they diff, they need to be restored.
I'd start with 9 and 10, if it fails to boot, 20 too, via the initramfs.
update with the end result, and we'll add it to the wiki.
The list of partitions is already different, with the original firmware I had 21, after installation of OpenWrt only 19:
root@OpenWrt:/# cat /proc/mtd
dev: size erasesize name
mtd0: 000a0000 00020000 "fota-flag"
mtd1: 00080000 00020000 "ART"
mtd2: 00080000 00020000 "mac"
mtd3: 000c0000 00020000 "reserved2"
mtd4: 00400000 00020000 "cfg-param"
mtd5: 00400000 00020000 "log"
mtd6: 000a0000 00020000 "oops"
mtd7: 00500000 00020000 "reserved3"
mtd8: 00800000 00020000 "web"
mtd9: 01d00000 00020000 "rootfs"
mtd10: 01900000 00020000 "data"
mtd11: 03200000 00020000 "fota"
mtd12: 00040000 00010000 "0:SBL1"
mtd13: 00020000 00010000 "0:MIBIB"
mtd14: 00060000 00010000 "0:QSEE"
mtd15: 00010000 00010000 "0:CDT"
mtd16: 00010000 00010000 "0:DDRPARAMS"
mtd17: 00010000 00010000 "0:APPSBLENV"
mtd18: 000c0000 00010000 "0:APPSBL"
mtd19: 00050000 00010000 "0:reserved1"
But as suggested I'll make a backup of the current installation and compare it with the original one ...
... okay, nothing I can do fast, the USB-stick is not mounted, nor available as /dev/sda1, dmesg just reports "usb 3-1: new high-speed USB device number 3 using xhci-hcd".
In luci I didn't found a way to configure USB, I can not install any packages because the router has no internet connection and I have no clue, how to configure the LTE/4G-modem with my SIM-card ...
Only rootfs (mtd9) is enough, OpenWrt doesn't touch anything else. And it keeps kernel there as well as another UBI volume.
The two additional volumes on stock are side effect of exposing UBI volumes as another set of MTDs, which is not needed nor done in OpenWrt.
Not the case with MF286[,A,R], which do not use UBI on stock and have different flash layout.
You can just read them off using SSH by calling ssh root@192.168.1.1 cat /dev/mtd<N> > mtd<N>_backup.bin
The same goes for the restore - you can scp the files to /tmp and use mtd write to restore. The initramfs lacks USB storage support by default in order to fit in the image size the U-boot can load directly.
Switch the WAN connection type to "QMI" and use /dev/cdc-wdm0 device, and optionally enter your APN and switch IP type - it should even work without setting the APN assuming it worked on stock FW.
This was a design choice of @CHKDSK88 to use LAN1/WAN port as WAN - now there is a way to define QMI as WAN from first installation using uci-defaults, so I'm thinking about updating all ZTE mobile routers to use that mechanism.
1 Like
Okay, first step, restore of the original ZTE-OpenWrt-firmware was successful:
linux:~ # scp -p /home/user/Downloads/Devel/OpenWrt/zte-mf286d.orig/mtd9 192.168.1.1:/tmp
root@OpenWrt:/# ll /tmp/mtd9
-rw-r--r-- 1 root root 30408704 Apr 22 2024 /tmp/mtd9
root@OpenWrt:/# mtd write /tmp/mtd9 /dev/mtd9
Unlocking /dev/mtd9 ...
Writing from /tmp/mtd9 to /dev/mtd9 ...
root@OpenWrt:/# reboot
[33675.217645] SQUASHFS error: Failed to read block 0x3d32ee: -5
[33675.217702] SQUASHFS error: Unable to read metadata cache entry [3d32ec]
[33675.222394] SQUASHFS error: Unable to read inode 0x11c20f1f
/bin/ash: reboot: I/O error
Reboot on cli didn't worked, so power off/on to restart.
GUI starts and is accessible on standard 192.168.32.1, settings are still there, including statistics, WAN-, LAN- and Wifi-settings.
During boot it shows some errors, like "Command failed: Not found", "sh: bad number", "Error for wireless request "Set ESSID" (8B1A)", "sh: 0: unknown operand" and others, but everything seems to work and I'm unsure if these errors didn't already exist before.
Next step is back to the roots 
1 Like
So finally success, luci is back
(IPQ40xx) # setenv serverip 192.168.1.64
(IPQ40xx) # setenv ipaddr 192.168.1.1
(IPQ40xx) # set fdt_high 0x85000000
(IPQ40xx) # tftp openwrt-23.05.3-ipq40xx-generic-zte_mf286d-initramfs-zImage.itb
MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 up Speed :1000 Full duplex
eth0 PHY4 Down Speed :10 Half duplex
Using eth0 device
TFTP from server 192.168.1.64; our IP address is 192.168.1.1
Filename 'openwrt-23.05.3-ipq40xx-generic-zte_mf286d-initramfs-zImage.itb'.
Load address: 0x84000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###############################################################
done
Bytes transferred = 6639048 (654dc8 hex)
(IPQ40xx) # bootm $loadaddr
## Booting kernel from FIT Image at 84000000 ...
Using 'config@ap.dk04.1-c1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM OpenWrt Linux-5.15.150
...
tarting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 5.15.150 (builder@buildhost) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 24
[ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[ 0.000000] CPU: div instructions available: patching division code
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] OF: fdt: Machine model: ZTE MF286D
...
[ 27.350814] qca8k-ipq4019 c000000.switch wan: configuring for phy/psgmii link mode
[ 31.437364] qca8k-ipq4019 c000000.switch lan2: Link is Up - 1Gbps/Full - flow control rx/tx
[ 31.437458] br-lan: port 1(lan2) entered blocking state
[ 31.444547] br-lan: port 1(lan2) entered forwarding state
[ 31.450458] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
...
BusyBox v1.36.1 (2024-03-22 22:09:42 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 23.05.3, r23809-234f1a2efa
root@OpenWrt:/# ifconfig br-lan
br-lan Link encap:Ethernet HWaddr 10:3C:59:B0:67:B7
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
...
linux:~ # scp -p /srv/tftpboot/openwrt-23.05.3-ipq40xx-generic-zte_mf286d-squashfs-sysupgrade.bin 192.168.1.1:/tmp
root@OpenWrt:/# ls -l /tmp/open*
-rw-r--r-- 1 root root 7025211 Apr 23 2024 /tmp/openwrt-23.05.3-ipq40xx-generic-zte_mf286d-squashfs-sysupgrade.bin
root@OpenWrt:/# mtd erase rootfs
Unlocking rootfs ...
Erasing rootfs ...
root@OpenWrt:/# sysupgrade -n /tmp/openwrt-23.05.3-ipq40xx-generic-zte_mf286d-sq
uashfs-sysupgrade.bin
[ 445.118553] ubi0: attaching mtd9
[ 445.293043] ubi0: scanning is finished
[ 445.293090] ubi0: empty MTD device detected
[ 445.316356] ubi0: attached mtd9 (name "rootfs", size 29 MiB)
[ 445.316413] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 445.321107] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 445.327824] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 445.334649] ubi0: good PEBs: 232, bad PEBs: 0, corrupted PEBs: 0
[ 445.341440] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 445.347687] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2690910022
[ 445.354705] ubi0: available PEBs: 208, total reserved PEBs: 24, PEBs reserved for bad PEB handling: 20
[ 445.364348] ubi0: background thread "ubi_bgt0d" started, PID 2513
UBI device number 0, total 232 LEBs (29458432 bytes, 28.0 MiB), available 208 LEBs (26411008 bytes, 25.1 MiB), LEB size 126976 bytes (124.0 KiB)
Fri Mar 22 22:17:00 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
[ 445.833521] ubi: mtd9 is already attached to ubi0
Watchdog handover: fd=3
- watchdog -
Watchdog did not previously reset the system
Fri Mar 22 22:17:01 UTC 2024 upgrade: Sending TERM to remaining processes ...
Fri Mar 22 22:17:05 UTC 2024 upgrade: Sending KILL to remaining processes ...
[ 456.440030] stage2 (2580): drop_caches: 3
Fri Mar 22 22:17:11 UTC 2024 upgrade: Switching to ramdisk...
Fri Mar 22 22:17:13 UTC 2024 upgrade: Performing system upgrade...
verifying sysupgrade tar file integrity
Volume ID 0, size 24 LEBs (3047424 bytes, 2.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 1, size 32 LEBs (4063232 bytes, 3.8 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 19300352
Volume ID 2, size 152 LEBs (19300352 bytes, 18.4 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy[ 461.874454] reboot: Restarting system
...
...
...
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 5.15.150 (builder@buildhost) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 24
[ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[ 0.000000] CPU: div instructions available: patching division code
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] OF: fdt: Machine model: ZTE MF286D
...
[ 53.997755] br-lan: port 1(lan2) entered blocking state
[ 54.004845] br-lan: port 1(lan2) entered forwarding state
[ 54.010758] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
BusyBox v1.36.1 (2024-03-22 22:09:42 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 23.05.3, r23809-234f1a2efa
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
As far as I see, no errors, now I can begin to configure WAN/Modem, LAN, Wifi and so on ...
Thank for all the help,
kind regards, thg
I was not able to find this setting anywhere in luci, would expect it in Network - Interfaces?
I connected WAN/LAN1 to my network to get internet.
Following this https://openwrt.org/docs/guide-user/network/wan/wwan/modemmanager I installed the ModemManager, but I can not find this either, even not after a reboot.
Everything I was able to do, have been some AT-commands:
root@OpenWrt:/# picocom /dev/ttyUSB2
picocom v3.1
port is : /dev/ttyUSB2
...
ATI
Manufacturer: ZTE CORPORATION
Model: MF286DMODULE
Revision: BD_TELIAMF286DV1.0.0B02
SVN: 01
IMEI: 866754046250820
+GCAP: +CGSM
OK
AT+COPS=?
ERROR
AT+CSQ
+CSQ: 24,99
OK
But most of them, described here https://openwrt.org/docs/guide-user/network/wan/wwan/ltedongle just failed.
So what I'm doing "fundamental" wrong?
Thanks, kind regards thg
Edit:
That's what I found in the logs:
Wed Apr 24 22:22:49 2024 daemon.warn [2058]: <warn> [ttyUSB0/probe] failed to parse QCDM version info command result: -7
Wed Apr 24 22:22:49 2024 daemon.info [2058]: <info> [device /sys/devices/platform/soc/8af8800.usb3/8a00000.dwc3/xhci-hcd.0.auto/usb2/2-1] creating modem with plugin 'zte' and '5' ports
Wed Apr 24 22:22:49 2024 daemon.info [2058]: <info> [base-manager] modem for device '/sys/devices/platform/soc/8af8800.usb3/8a00000.dwc3/xhci-hcd.0.auto/usb2/2-1' successfully created
Wed Apr 24 22:22:51 2024 daemon.warn [2058]: <warn> [modem0] unhandled QMI radio interface '9'
Wed Apr 24 22:22:51 2024 daemon.warn [2058]: <warn> [modem0] unhandled QMI radio interface '9'
Wed Apr 24 22:22:51 2024 daemon.info [2058]: <info> [modem0] state changed (unknown -> locked)
Wed Apr 24 22:22:51 2024 daemon.warn [2058]: <warn> [modem0/sim0] couldn't load IMSI: Couldn't read data from UIM: QMI protocol error (82): 'AccessDenied'
Wed Apr 24 22:22:51 2024 daemon.warn [2058]: <warn> [modem0/sim0] couldn't load operator identifier: Couldn't get home network: QMI protocol error (37): 'UimUninitialized'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0/sim0] couldn't load operator name: Couldn't get home network: QMI protocol error (37): 'UimUninitialized'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0/sim0] couldn't load list of emergency numbers: Failed to parse CRSM query result '+CRSM: 148,8,""'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0/sim0] couldn't load list of preferred networks: Couldn't get preferred networks: QMI protocol error (37): 'UimUninitialized'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0/sim0] couldn't load GID1: Couldn't read data from UIM: QMI protocol error (82): 'AccessDenied'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0/sim0] couldn't load GID2: Couldn't read data from UIM: QMI protocol error (82): 'AccessDenied'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0] couldn't load list of own numbers: Couldn't get MSISDN: QMI protocol error (37): 'UimUninitialized'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0] couldn't load facility locks: QMI message Get Configuration failed: QMI protocol error (94): 'NotSupported'
Wed Apr 24 22:22:52 2024 daemon.warn [2058]: <warn> [modem0] error initializing: Modem is currently locked, cannot fully initialize
Wed Apr 24 22:22:58 2024 daemon.warn odhcpd[1813]: A default route is present but there is no public prefix on lan thus we don't announce a default route by overriding ra_lifetime!
Wed Apr 24 22:23:05 2024 daemon.err uhttpd[1944]: [info] luci: accepted login on /admin/status/logs for root from 192.168.1.64
Create a new thread about it in the using Openwrt sub forum.
3 Likes