ZTE MF283V

The ZTE MF283V is an LTE router based on the Qualcomm MDM9607 SoC. It has one ARM Cortex-A7 application CPU, 256 MiB RAM, 512 MiB SLC NAND, four Gigabit Ethernet ports through a QCA8337 switch, and a 2.4 GHz 802.11n 2T2R RTL8192ES WLAN device connected over SDIO. The LTE modem runs on the MDM9607 Hexagon MSS and uses the retained factory MBA/MPSS firmware.

• OpenWrt PR #24731 — mdm9607: add ZTE MF283V support

The PR provides the baseline MDM9607 target and MF283V support. Additional sysupgrade, native mobile-data, LEDs, buttons, thermal and watchdog work is being developed separately and must not be treated as part of the submitted baseline.

No public firmware images are available. Images must currently be built from the PR source. The tested factory LK authenticates the boot image, so a matching signing key must be supplied at build time.

From the OpenWrt source tree containing PR #24731:

cp target/linux/mdm9607/production.config .config
make defconfig
make -j"$(nproc)" \
  MF283V_SIGNING_KEY=/absolute/path/to/qcom.key \
  MF283V_STRICT_KEY_FINGERPRINT=1

Qualcomm test signing key is known to work with some firmware variants.

Expected files under bin/targets/mdm9607/generic/:

openwrt-mdm9607-generic-zte_mf283v-boot.bin
openwrt-mdm9607-generic-zte_mf283v-squashfs-system.ubi
sha256sums

boot.bin is a complete Android v0/QCDT image sized for the factory boot partition and authenticated by LK. system.ubi contains the SquashFS root and UBIFS overlay seed. They must be installed as a matched pair.

EDL can be forced with the marked test point on the rear side of the PCB, opposite the side with the external connectors. The test point is below a metal shielding cover. To reach it, remove the cover. It is held by an adhesive layer resembling double-sided tape, so warm the cover with hot air while removing it.

1. With power disconnected, short the marked test point to ground.
2. While keeping the test point grounded, apply power.
3. Wait a couple of seconds, then release the test point.

This procedure does not enter EDL reliably on every attempt. If the device does not appear in EDL mode, disconnect power completely and repeat the sequence.

Use qtools and resolve the current Qualcomm EDL serial device instead of assuming that it is always /dev/ttyUSB1.

cd qtools-maks
EDL_PORT=/dev/ttyUSB1

./qdload -t -p "$EDL_PORT" -k 11 -i

# system: erase blocks 0x616..0xfff and write the compact UBI seed
./qwdirect -p "$EDL_PORT" -k 11 -b 616 -c 9ea
./qwdirect -p "$EDL_PORT" -k 11 -b 616 -f o \
  -s ../openwrt/bin/targets/mdm9607/generic/openwrt-mdm9607-generic-zte_mf283v-squashfs-system.ubi

# boot: write the complete authenticated boot-partition image
./qwdirect -p "$EDL_PORT" -k 11 -b 132 -f o \
  -s ../openwrt/bin/targets/mdm9607/generic/openwrt-mdm9607-generic-zte_mf283v-boot.bin

The compact UBI image contains only programmed PEBs. After the full erase, qwdirect can stop advancing its page indicator after the last non-0xff page; it must still report success.

The current development image provides:

• LSUART console at 115200 8N1;
• USB CDC ACM console;
• USB CDC ECM management at device 192.168.7.1/24 and host 192.168.7.2/24;
• four DSA Ethernet ports using the chassis mapping below;
• RTL8192ES using the factory MAC address and calibration data;
• running MSS with /dev/wwan0at0, /dev/wwan0at1 and wwan0.

Standard sysupgrade is not available. Updating only system can leave the kernel and modules inconsistent with boot.

Viewed from outside at the rear panel:

The LAN1/WAN socket changes role through VLAN configuration; it is not a physical PHY mux.

PR #24731 starts the retained factory modem firmware and exposes two AT ports plus the BAM-DMUX network device. A complete native LTE data connection is not part of the PR. Experimental follow-up work uses ModemManager and board-specific BAM-DMUX DPM endpoint setup. No APN, SIM PIN or paid bearer is configured by default.

All offsets and sizes are bytes. Ordinary installation must write only boot and system.

boot and recovery use the QPIC boot-codeword layout. system, modem and the factory recovery filesystems are UBI containers.

The debug UART is exposed on three horizontal round test pads on the PCB side opposite the external connectors. Pad order is GND, RX, TX. The electrical level is 1.8 V, not 3.3 V.

Use a level shifter. Driving the router RX pad from a 3.3 V adapter may damage the device.

Qualcomm EDL is the final recovery path. Keep complete, verified factory partition dumps off the device. If OpenWrt still boots, mf283v-reboot recovery requests the factory LK recovery path and mf283v-reboot bootloader requests LK/fastboot.

• PR #24731 is not merged and no official snapshot contains this target.
• No standard first-install image or accepted sysupgrade image exists.
• Native LTE packet data requires separate experimental integration.
• USB host/OTG and external socket VBUS control are unknown.
• RJ11/voice support is not investigated.
• Button polarity and runtime events are not yet qualified.
• Thermal readings and watchdog expiry are not yet qualified.
• JTAG location and availability are unknown.