Support for Netcomm/ ZTE IFWA-40

For Developers
41

And no changes in ethernet links and/or available TTYs in all the modes?

42

That is correct.

43

Searching for 05c6:9059 linux usb (the USB device ID), I find https://blog.fearcat.in/a?ID=00450-ae52d98d-f657-4eac-a054-724eb90d3424 , which mentions

  • a kernelmodule usb_wwan.ko (Do you have that (loaded)?)
  • another kernel-module option.ko (a driver for serial interfaces) Loaded?
  • Several /dev/ttyUSB* visible. Do you see those?

This link https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick/10 seem helpful too.

44

I’ll have to boot mine and see. Give me awhile.

45

Maybe build a new image, and have it include adb too. (And try 5.15 while you're at it?)

Then also check/post adb devices.

46

Maybe something like this is needed:

echo "05c6 9059" > /sys/bus/usb-serial/drivers/option1/new_id

(maybe you'll need to reload the option module then)

Then you'll (hopefully) see:

/dev/ttyUSB0 --> DIAG
/dev/ttyUSB1 --> AT commands
/dev/ttyUSB2
/dev/ttyUSB3
/dev/cdc-wdm0 --> QMI

47 
root@OpenWrt:~# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
    link/ether ee:2f:45:00:1e:5c brd ff:ff:ff:ff:ff:ff
3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
    link/ether 92:80:ca:48:3e:30 brd ff:ff:ff:ff:ff:ff
4: usb0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 66:85:21:25:68:8f brd ff:ff:ff:ff:ff:ff
5: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 00:03:7f:12:34:56 brd ff:ff:ff:ff:ff:ff
6: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 12:34:56:78:90:12 brd ff:ff:ff:ff:ff:ff
7: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether ee:2f:45:00:1e:5c brd ff:ff:ff:ff:ff:ff

I don't see any tty devices...

root@OpenWrt:~# lsusb -t
/:  Bus 04.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/0p, 5000M
/:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 480M
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 5000M
    |__ Port 1: Dev 2, If 0, Class=, Driver=usb-storage, 5000M
    |__ Port 1: Dev 2, If 1, Class=, Driver=, 5000M
    |__ Port 1: Dev 2, If 2, Class=, Driver=, 5000M
    |__ Port 1: Dev 2, If 3, Class=, Driver=cdc_ether, 5000M
    |__ Port 1: Dev 2, If 4, Class=, Driver=cdc_ether, 5000M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 480M
48 
root@OpenWrt:~# echo "05c6 9059" > /sys/bus/usb-serial/drivers/option1/new_id
-ash: can't create /sys/bus/usb-serial/drivers/option1/new_id: nonexistent directory

Bear with me, I haven't touched this thing in awhile.

49

Try, and post output of:

modprobe option (to see, if already loaded, or loadable)
adb devices
ls -l /dev/tty*
ls -l /dev/cdc*

50

Yeah, I guess I don't have modprobe. It's gonna take me a bit to build a new image from source, my linux vm isn't bootable anymore, let me get that sorted. While I do that, can you make a list of things I should include? I have included everything I could think of but obviously I missed some stuff.

51

do you have insmod ?

52

No. :frowning: It seems I missed a bunch of stuff by focusing on the top level stuff to talk to the card.

53

Ok, I'm back up and running with my linux vm. What should I include? I'm having trouble finding modprobe and insmod in the kernel modules...

1 Like
54

Hello, Thank you for this!
I do have a question, I am able to get to the uboot but after the Kernel loads, I can not get to the root shell and I can not get to the SSH either at port 22 because of the SSH password, do you have any advice on this. Thank you for any help you can provide to me.

Robert

55

Thank you for the response, I can get to uboot but can not get past the kernal loading process, are you able to show me a brief breakdown of how you got the SSH keys and got past the kernal loading screen. My email is rv@rvigroupllc.com if you want to contact me directly. Thank you for all your help.

56

Hi, I started playing with ifwa-40, connected serial console, and I can interact with bootloader, but I’m not able to get serial console root access as I suspect with the firmware I have they have disabled serial console in kernel, the interaction with the system stops with loading kernel……

I’m able to load any initramfs 8 devices jalapeño, but I’m not able to interact with the modem that I want to unlock

Are you able to send me a copy of your original firmware becouse I suspect there is the problem

Thank you
Nico

57

i have made some discovery, if someone can help, maybe we can add support for this device.
I have successfully loaded full Jalapegno initramfs and everithing is working, but modem. it is recognized as usbid but no ttyUSB0 device.
i was able to successfully download the kernel from bootloader loading in memory and tftping it to pc.
if we are looking the mtd:

dev:    size   erasesize  name
mtd0: 00040000 00010000 "0:SBL1"
mtd1: 00020000 00010000 "0:MIBIB"
mtd2: 00060000 00010000 "0:QSEE"
mtd3: 00010000 00010000 "0:CDT"
mtd4: 00010000 00010000 "0:DDRPARAMS"
mtd5: 00010000 00010000 "0:APPSBLENV"
mtd6: 00080000 00010000 "0:APPSBL"
mtd7: 00010000 00010000 "0:ART"
the kernel should reside on mtd6 and rootfs shold be on mtd5
opening up the sysupgrade firmware openwrt you are able to clearly see kernel and rootfs.
extracting the kernel and loading it it works but then hungs due to wrong mtd partition i need help from someone that know how the mtd works becouse i think the veriables are set into the bootloader, in my case:
 bootargs=root=/dev/nfs rw rootfstype=nfs nfsroot=169.254.252.1:/var/nfs/rootfs,nfsvers=3 init=/boot/nfsboot ip=169.254.252.2:169.254.252.1:169.254.252.1:255.255.255.0:my.router:usb0:none

it refers to somekinds of nfs system but i do not understand it, i have seen different machines same bootloader having different boot arguments.

I do not have access to root consoles via tty the dmes hangs after loading kernel as you can see in screenshot above. i need serious help!
58

A little update for who is interested.
i have discovered that the bootloader transmit to serial console at 115200 8n1, when the kernel takes over it reset the serial console to 9600 8n1, that was the reason why after "kernel loading....." i was not able to see anything on the console. if you set 9600 8n1 you will get root acces.
i have olso discovered that IFWA-40 uses a modified version of Openwrt, the system is stored as some kind of initramfs in this USB storage of 3.8 mb on the board. i'm saying this because if you chage root password to get ssh access it will not store it and when you reboot the sysmem you will loose ssh access. originally the ssh root access is authorized with key but putty cannot use those keys becouse they are old. when it will load up also it will take a while and goes to read configurations and web access password from compressed/encrypted config file from one of the mtds, i think mtd7. i have also discovered that ipq-4018 boot from mtd0, then load U-BOOT from mtd6, U-Boot env resides on mtd5. Mtd1 is mtd partition layout, mtd2 is and executable file (it has ELF header), mtd3 has CDT header, not sure waht is it, mtd4 is empty.
looks like the NAND Chip is 8MiB chip so my idea is to rewrite the UBOOT to mtd0 and use the rest of the Chip to run full version of Openwrt with overlay inside the usb stick, but i'm not sure how to do that.

I need help please
Openwrt in initramfs format works fine