Hi! I need your help.
Yesterday I installed OpenWrt on my modem and everything works great. However the modem goes into sleep mode after about every 3 minutes - power LED is blinking - I have to press the WPS button to wake it up.
I could not find the relevant setting in the interface. Can you help me?
That's weird. I don't own a MF286R myself, but blinking power LED seems to me more like an ongoing modem firmware update, at least from what I've observed on MF286[,A,D]. Maybe you could post a video of this happening?
Turkcell B02 and T-Mobile B03 firmware have something like sleep mode. The modem enters that mode after a period of inactivity on its web interface. Even if I am working on the serial console, it "sleeps".
I did not see this in Postemobile B10 and B12 firmware. But now I can't boot OpenWrt 
[ 0.346780] printk: console [ttyS0] enabled
[ 0.346780] printk: console [ttyS0] enabled
[ 0.355842] printk: bootconsole [early0] disabled
[ 0.355842] printk: bootconsole [early0] disabled
[ 0.382257] spi-nand spi0.1: GigaDevice SPI NAND was found.
[ 0.388031] spi-nand spi0.1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[ 0.398845] 6 fixed-partitions partitions found on MTD device (null)
[ 0.405501] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[ 0.412385] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[ 0.419929] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[ 0.426832] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[ 0.434406] Creating 6 MTD partitions on "(null)":
[ 0.439364] 0x000000000000-0x0000000a0000 : "fota-flag"
[ 0.448902] 0x0000000a0000-0x000000120000 : "art"
[ 0.456204] 0x000000120000-0x0000001a0000 : "mac"
[ 0.463580] 0x0000001a0000-0x000001800000 : "ubiconcat0"
[ 0.500452] 0x000001800000-0x000001c00000 : "kernel"
[ 0.512701] 0x000001c00000-0x000008000000 : "ubiconcat1"
[ 0.659362] spi-nor spi0.0: gd25q16 (2048 Kbytes)
[ 0.664321] 3 fixed-partitions partitions found on MTD device spi0.0
[ 0.670884] Creating 3 MTD partitions on "spi0.0":
[ 0.675863] 0x000000000000-0x0000000a0000 : "u-boot"
[ 0.682755] 0x0000000a0000-0x0000000c0000 : "u-boot-env"
[ 0.689170] 0x0000000c0000-0x000000200000 : "reserved1"
[ 0.698249] Concatenating MTD devices:
[ 0.702198] (0): "ubiconcat0"
[ 0.705259] (1): "ubiconcat1"
[ 0.708323] into device "ubi-concat"
[ 0.712056] 1 fixed-partitions partitions found on MTD device ubi-concat
[ 0.718971] Creating 1 MTD partitions on "ubi-concat":
[ 0.724298] 0x000000000000-0x000007a60000 : "ubi"
[ 1.425862] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[ 2.083353] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[ 2.094631] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[ 2.103343] NET: Registered protocol family 10
[ 2.115439] Segment Routing with IPv6
[ 2.119347] NET: Registered protocol family 17
[ 2.124074] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 2.137468] 8021q: 802.1Q VLAN Support v1.8
[ 2.145761] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[ 2.152132] MEM 0x0000000012000000..0x0000000013ffffff
[ 2.157529] IO 0x0000000000000000..0x0000000000000000
[ 2.163091] PCI host bridge to bus 0000:00
[ 2.167336] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[ 2.174468] pci_bus 0000:00: root bus resource [io 0x0000]
[ 2.180223] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 2.187244] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 2.195492] pci 0000:00:00.0: [168c:0056] type 00 class 0x028000
[ 2.201733] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[ 2.208884] pci 0000:00:00.0: PME# supported from D0 D3hot
[ 2.215807] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[ 2.222713] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[ 2.235191] UBI: auto-attach mtd9
[ 2.238646] ubi0: attaching mtd9
[ 4.932686] ubi0: scanning is finished
[ 4.970553] ubi0: attached mtd9 (name "ubi", size 122 MiB)
[ 4.976279] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 4.983395] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 4.990398] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 4.997595] ubi0: good PEBs: 977, bad PEBs: 2, corrupted PEBs: 0
[ 5.003802] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[ 5.011259] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 799738486
[ 5.020605] ubi0: available PEBs: 0, total reserved PEBs: 977, PEBs reserved for bad PEB handling: 18
[ 5.030227] ubi0: background thread "ubi_bgt0d" started, PID 348
[ 5.039317] block ubiblock0_0: created from ubi0:0(rootfs)
[ 5.045043] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[ 5.075104] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[ 5.089334] Freeing unused kernel memory: 1244K
[ 5.094043] This architecture does not have kernel memory protection.
[ 5.100698] Run /sbin/init as init process
[ 5.904815] init: Console is alive
[ 5.908758] init: - watchdog -
[ 7.520620] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 7.659852] usbcore: registered new interface driver usbfs
[ 7.665655] usbcore: registered new interface driver hub
[ 7.671213] usbcore: registered new device driver usb
[ 7.685570] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 7.695317] fsl-ehci: Freescale EHCI Host controller driver
[ 7.703218] ehci-platform: EHCI generic platform driver
[ 7.708948] ehci-platform 1b000000.usb: EHCI Host Controller
[ 7.714879] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1
[ 7.723113] ehci-platform 1b000000.usb: irq 13, io mem 0x1b000000
[ 7.751882] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00
[ 7.759071] hub 1-0:1.0: USB hub found
[ 7.763764] hub 1-0:1.0: 1 port detected
[ 7.768573] ehci-platform 1b400000.usb: EHCI Host Controller
[ 7.774504] ehci-platform 1b400000.usb: new USB bus registered, assigned bus number 2
[ 7.782758] ehci-platform 1b400000.usb: irq 14, io mem 0x1b400000
[ 7.811870] ehci-platform 1b400000.usb: USB 2.0 started, EHCI 1.00
[ 7.819034] hub 2-0:1.0: USB hub found
[ 7.823736] hub 2-0:1.0: 1 port detected
[ 7.831111] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 7.849063] init: - preinit -
[ 8.763069] usb 1-1: new high-speed USB device number 2 using ehci-platform
[ 8.980461] random: procd: uninitialized urandom read (4 bytes read)
[ 9.249821] random: jshn: uninitialized urandom read (4 bytes read)
[ 9.331523] random: jshn: uninitialized urandom read (4 bytes read)
[ 10.796130] eth0: link up (1000Mbps/Full duplex)
[ 10.800929] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 10.819764] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 15.166737] UBIFS (ubi0:1): Mounting in unauthenticated mode
[ 15.182496] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 494
[ 15.353800] UBIFS (ubi0:1): recovery needed
[ 15.652180] UBIFS (ubi0:1): recovery completed
[ 15.656868] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[ 15.664983] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 15.675231] UBIFS (ubi0:1): FS size: 115294208 bytes (109 MiB, 908 LEBs), journal size 5713920 bytes (5 MiB, 45 LEBs)
[ 15.686185] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB)
[ 15.693025] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID B5E9FD4B-B3FE-4324-84DB-5CFBB078BA91, small LPT model
[ 15.713201] mount_root: overlay filesystem has not been fully initialized yet
[ 15.726624] mount_root: switching to ubifs overlay
[ 15.752247] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 15.890362] eth0: link down
[ 15.911714] procd: - early -
[ 15.916244] procd: - watchdog -
[ 16.756693] procd: - watchdog -
[ 16.923795] procd: - ubus -
[ 17.352039] random: ubusd: uninitialized urandom read (4 bytes read)
[ 17.361179] random: ubusd: uninitialized urandom read (4 bytes read)
[ 17.385073] random: ubusd: uninitialized urandom read (4 bytes read)
[ 17.415658] procd: - init -
Please press Enter to activate this console.
[ 18.807334] random: jshn: uninitialized urandom read (4 bytes read)
[ 18.859179] random: ubusd: uninitialized urandom read (4 bytes read)
[ 18.871509] random: ubus: uninitialized urandom read (4 bytes read)
[ 19.473354] kmodloader: loading kernel modules from /etc/modules.d/*
[ 19.953646] urngd: v1.0.2 started.
[ 20.002582] cdc_acm 1-1:1.2: ttyACM0: USB ACM device
[ 20.022244] usbcore: registered new interface driver cdc_acm
[ 20.028113] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[ 20.072295] usbcore: registered new interface driver cdc_wdm
[ 20.096910] Loading modules backported from Linux version v5.15.92-0-ge515b9902f5f
[ 20.104782] Backport generated by backports.git v5.15.92-1-0-gdfe0f60c
[ 20.202559] usbcore: registered new interface driver usbserial_generic
[ 20.209374] usbserial: USB Serial support registered for generic
[ 20.253645] cdc_ether 1-1:1.6 usb0: register 'cdc_ether' at usb-1b000000.usb-1, ZTE CDC Ethernet Device, 1a:5a:00:9d:40:d8
[ 20.265311] usbcore: registered new interface driver cdc_ether
[ 20.294690] usbcore: registered new interface driver cdc_ncm
[ 20.351918] random: crng init done
[ 20.355447] random: 28 urandom warning(s) missed due to ratelimiting
[ 20.443393] usbcore: registered new interface driver huawei_cdc_ncm
[ 20.604007] PPP generic driver version 2.4.2
[ 20.623124] NET: Registered protocol family 24
[ 20.653211] rndis_host 1-1:1.0 usb1: register 'rndis_host' at usb-1b000000.usb-1, ZTE RNDIS device, be:63:4e:94:fd:85
[ 20.664450] usbcore: registered new interface driver rndis_host
[ 20.792576] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x56.
[ 20.802010] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[ 20.808772] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[ 23.503492] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[ 23.513060] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[ 23.532240] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9888-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 59e741e7
[ 23.873911] ath10k_pci 0000:00:00.0: Loading BDF type 0
[ 23.881253] ath10k_pci 0000:00:00.0: failed to fetch board data for bus=pci,bmi-chip-id=0,bmi-board-id=31 from ath10k/QCA9888/hw2.0/board-2.bin
[ 24.318083] ath10k_pci 0000:00:00.0: failed to fetch board-2.bin or board.bin from ath10k/QCA9888/hw2.0
[ 24.327843] ath10k_pci 0000:00:00.0: failed to fetch board file: -12
[ 24.352083] ath10k_pci 0000:00:00.0: could not probe fw (-12)
[ 24.410325] usbcore: registered new interface driver option
[ 24.416237] usbserial: USB Serial support registered for GSM modem (1-port)
[ 24.482049] Data bus error, epc == 8033539c, ra == 820a2cf4
[ 24.487818] Oops[#1]:
[ 24.490168] CPU: 0 PID: 742 Comm: kmodloader Not tainted 5.10.176 #0
[ 24.496720] $ 0 : 00000000 00000001 deadc0de 00014000
[ 24.502130] $ 4 : b81143fc 000143fc 82001c14 00000004
[ 24.507533] $ 8 : 00000000 8039ae7c ffffffff ffffffff
[ 24.512936] $12 : ffffffff 00000020 00000000 ffffffff
[ 24.518340] $16 : 81f2c080 00000018 81b8bb44 81b8bb48
[ 24.523742] $20 : 81b8bf43 80000003 00010000 00014000
[ 24.529145] $24 : 00000000 8045d890
[ 24.534548] $28 : 81b8a000 81b8bad0 00031018 820a2cf4
[ 24.539951] Hi : 00004b5c
[ 24.542917] Lo : 4e910000
[ 24.545886] epc : 8033539c 0x8033539c
[ 24.549857] ra : 820a2cf4 0x820a2cf4 [ath9k_hw@7cee0de1+0x54ec0]
[ 24.556321] Status: 1100dc03 KERNEL EXL IE
[ 24.560649] Cause : 4080801c (ExcCode 07)
[ 24.564780] PrId : 00019750 (MIPS 74Kc)
[ 24.568828] Modules linked in: ath9k(+) ath9k_common pppoe ppp_async option nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet ath9k_hw ath10k_pci ath10k_core ath usb_wwan rndis_host pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211 huawei_cdc_ncm cfg80211 cdc_ncm cdc_ether usbserial usbnet slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_ipv6 nf_log_ipv4 nf_log_common nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c hwmon crc_ccitt compat cdc_wdm cdc_acm sha256_generic libsha256 seqiv jitterentropy_rng drbg hmac cmac fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug phy_ar7100_usb usbcore nls_base usb_common mii crc32c_generic
[ 24.651446] Process kmodloader (pid: 742, threadinfo=bf02531a, task=7955bb43, tls=77eacdf0)
[ 24.660060] Stack : 00000005 00000003 00000dc0 00000000 81b8baec 00000000 00000220 000003ff
[ 24.668696] 81e71000 00008000 81f2c080 81f2c0a8 820a0000 81b8bbb4 820d0000 820a3e14
[ 24.677334] 00000000 81f2c080 00020000 00007000 ffffffe0 81f2c5b8 81f2c0a8 820d1f50
[ 24.685972] 80c98e4c 00000000 80c02d00 00000cc0 000186a0 ffffffff 81f2c080 820d0558
[ 24.694609] 99999999 00008000 00000100 81f2c0a8 00000000 81b8bbb4 820d0000 82095348
[ 24.703247] ...
[ 24.705774] Call Trace:
[ 24.705826] [<820a0000>] 0x820a0000 [ath9k_hw@7cee0de1+0x54ec0]
[ 24.714460] [<820a3e14>] 0x820a3e14 [ath9k_hw@7cee0de1+0x54ec0]
[ 24.720601] [<82095348>] 0x82095348 [ath9k_hw@7cee0de1+0x54ec0]
[ 24.726721] [<82086cd4>] 0x82086cd4 [ath9k_hw@7cee0de1+0x54ec0]
[ 24.732844] [<80416d68>] 0x80416d68
[ 24.736461] [<800a0000>] 0x800a0000
[ 24.740070] [<82002864>] 0x82002864 [ath9k@827bab61+0x192b0]
[ 24.745911] [<82004948>] 0x82004948 [ath9k@827bab61+0x192b0]
[ 24.751749] [<800c44e4>] 0x800c44e4
[ 24.755364] [<82010090>] 0x82010090 [ath9k@827bab61+0x192b0]
[ 24.761204] [<8023f8a0>] 0x8023f8a0
[ 24.764811] [<8039fdc0>] 0x8039fdc0
[ 24.768417] [<80241f80>] 0x80241f80
[ 24.772026] [<80414d9c>] 0x80414d9c
[ 24.775629] [<804129d8>] 0x804129d8
[ 24.779237] [<80413508>] 0x80413508
[ 24.782838] [<804150d8>] 0x804150d8
[ 24.786440] [<80384bb8>] 0x80384bb8
[ 24.790036] [<80413518>] 0x80413518
[ 24.793638] [<80413594>] 0x80413594
[ 24.797247] [<80413518>] 0x80413518
[ 24.800841] [<80410564>] 0x80410564
[ 24.804458] [<80411c7c>] 0x80411c7c
[ 24.808068] [<800ebd40>] 0x800ebd40
[ 24.811667] [<80413d78>] 0x80413d78
[ 24.815270] [<8201f000>] 0x8201f000 [ath9k@827bab61+0x192b0]
[ 24.821111] [<8201f018>] 0x8201f018 [ath9k@827bab61+0x192b0]
[ 24.826952] [<80060970>] 0x80060970
[ 24.830553] [<800ea170>] 0x800ea170
[ 24.834154] [<801a4164>] 0x801a4164
[ 24.837772] [<800ea190>] 0x800ea190
[ 24.841369] [<800ec150>] 0x800ec150
[ 24.844979] [<8006e1ac>] 0x8006e1ac
[ 24.848590]
[ 24.850128] Code: 0000000f 8c820000 0000000f <03e00008> 00000000 0000000f 94820000 3042ffff 0000000f
[ 24.860208]
[ 24.861794] ---[ end trace 196c38740f66603d ]---
[ 24.866581] Kernel panic - not syncing: Fatal exception
[ 24.871979] Rebooting in 1 seconds..
so flash it again.
I tried to flash it but it doesn't work. Both initramfs and sysupgrade inside failsafe give the same result.
Do you have a backup of your flash? This data abort comes from ath9k, I've seen this all too many times with broken calibration data, which also fails to load for ath10k.
Sorry, I forgot to take a backup on the first installation. But I can run any of the ZTE firmware if it helps
does the wifi work, if you do ?
That's odd. Make sure you back up the "caldata" MTD partition before proceeding further. This is unique to the device, and cannot be recreated once it's gone, and stealing one from other device is likely to degrade Wi-Fi performance, or exceed the regulatory limits.
Then, ensure, you're flashing the right image. This behaviour could be observed if you flash a MF286 image instead of MF286A or MF286R (they differ only modem-wise) or vice-versa, because the flash layout differs between the two families.
Thanks. I've made a full backup.
Images should be the correct ones. These are the commands I used:
setenv serverip 192.168.0.22
setenv ipaddr 192.168.0.1
tftpboot 0x81000000 openwrt-22.03.5-ath79-nand-zte_mf286r-initramfs-kernel.bin
bootm 0x81000000
scp -O openwrt-22.03.5-ath79-nand-zte_mf286r-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
sysupgrade -n /tmp/openwrt-22.03.5-ath79-nand-zte_mf286r-squashfs-sysupgrade.bin
Then maybe you do have some crazy variant like a MF286A with flash layout left from MF286, that was discovered recently. Do you have a boot log from stock firmware, and could post it somewhere?
I still wonder about this stock flash layout, though. ZTE firmware is known to be messy.
I don't understand this stuff
But the same OpenWrt image worked before. Then I erased the kernel and installed the root_uImage of the T-Mobile firmware using the TFTP Recovery method. Could I have messed up something with that?
Okay, I just noticed the boot log on pastebin. The flash layout definitely matches MF286R. If the unit works and has right MAC, then I see no reason for OpenWrt not to work. I can validate the contents of ART partition if you'd like.
Of course, please
By the way I tried to build images without ath9k and ath10k kernel drivers, and it worked! But wireless is gone
I checked the file and it was empty indeed. How the Wi-Fi works on stock FW without it, I have no idea. But maybe you can dump the earlier partitions from the NAND, that would be - the fota_flag partition. Maybe the partition layout is different and comes from the early MF286. You can also try dumping mac - this is likely to have some data.
Okay, I'm attaching them from the OpenWrt interface and my backups - hope they contain some helpful data 
I inspected the files and I have some bad news: The MAC address is there properly, so it looks like the flash layout matches. But the ART partition is empty. Only thing that comes to my mind is that the stock FW has some default calibration data, that actually allows the Wi-Fi to work there. Or some calibration data was stored there to rootfs. I doubt you could overwrite this by accident just by installing OpenWrt, unless you erased the whole flash while trying to restore somehow. But then the MAC would not survive - I'm pretty sure that it would be gone too. Does the MAC match what's on the label?
You can upload stock FW backup, specifically the roots, maybe I can dig out the default calibratiion data.
Does also the 2.4GHz part work on stock FW?
