ZTE MF283plus

The ZTE MF283+ is a router with four Fast Ethernet ports, WIFI4 wireless, integrated LTE Cat 4 modem in mPCIE slot, USB 2.0 port and 2xRJ11 for fixed phone connections.

A computer with an ethernet adapter
One ethernet cable
USB-to-serial adapter
ZTE MF283+
The OpenWrt installation images for this device (from table above)
An TFTP client

Since there is no original firmware publicily available, it's recommendable to make a backup before installing OpenWrt. You don't really need this step since it was already done.

As the modem is, for most of the time, provided by carriers, there is no possibility to flash through web interface, only built-in FOTA update and TFTP recovery are supported.

There are two installation methods:

Using serial console and initramfs-kernel (recommended), as it allows you to back up original firmware, or
Using TFTP recovery - does not require disassembly.

Please note that to write the SPI flash, which means all data on the SPI flash will be overwritten! Meaning stock firmware, bootloader, settings and everything will be gone! So make sure you got the proper files ready before you start as it's vital that you flash the new firmware before you restart your device as it would otherwise get soft-bricked.

Make sure to secure and safe place your backup firmware as we need to return to original firmware! Otherwise it would get lost!

Using serial console

To install OpenWrt, one needs to disassemble the router and flash it via TFTP by using serial console:

Locate unpopulated 4-pin header on the top of the board, near buttons.
Connect UART adapter to the connector. Use 3.3V voltage level only, omit VCC connection. Pin 1 (VCC) is marked by square pad.
Put your initramfs-kernel image in TFTP server directory.
Power-up the device.
Press “1” to load initramfs image to RAM.
Enter IP address chosen for the device (defaults to 192.168.0.1).
Enter TFTP server IP address (defaults to 192.168.0.22).
Enter image filename as put inside TFTP server - something short, like firmware.bin is recommended.
Hit enter to load the image. U-boot will store above values in persistent environment for next installation.
If you ever might want to return to vendor firmware, BACK UP CONTENTS OF YOUR FLASH NOW. For this router, commonly used by mobile networks, plain vendor images are not officially available. To do so, copy contents of each /dev/mtd[0-3], “firmware” - mtd3 being the most important, and copy them over network to your PC. But in case anything goes wrong, PLEASE do back up ALL OF THEM.
From under OpenWrt just booted, load the sysupgrade image to tmpfs, and execute sysupgrade.
After flashing OpenWrt, you can reach the OpenWrt via Ethernet by using the SSH to set your password or browse to http://192.168.1.1 if LuCI is installed.

Using TFTP recovery

Set your host IP to 192.168.0.22 - for example using: sudo ip addr add 192.168.0.22/24 dev <interface>
Set up a TFTP server on your machine
Put the sysupgrade image in TFTP server root named as 'root_uImage' (no quotes), for example using tftpd: cp openwrt-ramips-rt305x-zte_mf283plus-squashfs-sysupgrade.bin /srv/tftp/root_uImage
Power on the router holding BOTH Reset and WPS buttons held for around 5 seconds, until after WWAN and Signal LEDs blink.
Wait for OpenWrt to start booting up, this should take around a minute.
After flashing OpenWrt, you can reach the OpenWrt via Ethernet by using the SSH to set your password or browse to http://192.168.1.1 if LuCI is installed.

OEM flash layout

This is the layout as is when OEM vendor firmware.

dmesg from around boot time:

MX25L25635E(c2 2019c220) (32768 Kbytes)
mtd .name = raspi, .size = 0x02000000 (32M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 10 MTD partitions on "raspi":
0x00000000-0x02000000 : "ALL"
0x00000000-0x00050000 : "Bootloader"
0x00050000-0x00060000 : "fota-flag"
0x00060000-0x00070000 : "Config"
0x00070000-0x00080000 : "Factory"
0x00080000-0x00280000 : "Kernel"
0x00280000-0x00e80000 : "RootFS"
0x00e80000-0x01180000 : "Web"
0x01180000-0x01d80000 : "Data"
0x01d80000-0x02000000 : "JFFS2"

OpenWrt flash layout

This is the layout as is when OpenWrt 23.05.5 is installed.

dmesg from around boot time:

[    0.675939] spi spi0.0: force spi mode3
[    0.686230] spi-nor spi0.0: mx25l25635e (32768 Kbytes)
[    0.696759] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.709562] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.724203] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.739625] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.754317] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.769529] Creating 4 MTD partitions on "spi0.0":
[    0.779206] 0x000000000000-0x000000060000 : "u-boot"
[    0.796461] 0x000000060000-0x000000070000 : "u-boot-env"
[    0.809781] 0x000000070000-0x000000080000 : "factory"
[    0.826709] 0x000000080000-0x000001000000 : "firmware"
[    0.840874] 2 uimage-fw partitions found on MTD device firmware
[    0.852768] Creating 2 MTD partitions on "firmware":
[    0.862705] 0x000000000000-0x0000001a86b7 : "kernel"
[    0.872615] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    0.894847] 0x0000001a86b7-0x000000f80000 : "rootfs"
[    0.904877] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    0.927594] mtd: setting mtd5 (rootfs) as root device
[    0.937942] 1 squashfs-split partitions found on MTD device rootfs
[    0.950346] 0x000000500000-0x000000f80000 : "rootfs_data"

→ generic.flashing.tftp

Specific values needed for tftp

Bootloader tftp device IPv4 address	192.168.0.1
Bootloader MAC address (special)	N/A
Firmware tftp image	root_uImage
TFTP transfer window	10 seconds
TFTP window start	5 seconds after power on
TFTP client required IP address	192.168.0.22

Browse to http://192.168.1.1/cgi-bin/luci/admin/system/flash LuCI Upgrade URL
Upload image file for sysupgrade to LuCI
Wait for reboot

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line.

Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

sysupgrade

Login as root via SSH on 192.168.1.1, then enter the following commands:

cd /tmp
wget https://downloads.openwrt.org/releases/24.10.0/targets/ramips/rt305x/openwrt-24.10.0-ramips-rt305x-zte_mf283plus-squashfs-sysupgrade.bin
sysupgrade /tmp/openwrt-24.10.0-ramips-rt305x-zte_mf283plus-squashfs-sysupgrade.bin

→ generic.uninstall

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

Here, again there are two possibilities are possible, just like for installation:

Using initramfs-kernel image and serial console
Using TFTP recovery

To return the original firmware, one needs to disassemble the router and flash it via TFTP by using serial console:

Boot OpenWrt initramfs-kernel image via TFTP the same as for installation.
Copy over the backed up “firmware.bin” image of “mtd3” to /tmp/
Use “mtd write /tmp/firmware.bin /dev/mtd3”, where firmware.bin is your backup taken before OpenWrt installation, and /dev/mtd3 is the “firmware” partition.

Follow the same steps as for installation, but replacing 'root_uImage'with firmware backup you took during installation, or by vendor firmware obtained elsewhere.

→ generic.debrick

The easiest way is reflash firmware via using TFTP recovery.

→ failsafe_and_factory_reset

Without serial access, failsafe mode could be triggered by pressing the RESET button on the device shortly after powering it on during a pre-defined 2-4 second window.

The MF283+ is built-in ZTE P685M Mini PCIe LTE modem cellular card. These are usually distinguishable by having built-in antenna and also having 2 detachable antennas for cellular reception.

There already is a section about WWAN aka 3G/4G/LTE/5G and similar in the main Wiki. But if you (like me) are new to WWANs (Wireless Wide Area Networks), it can be a bit confusing.

First you need to install the drivers. In LuCI go to System ⇒ Software and press the “Update list” button. Then search for qmi and install these 2 packages: kmod-usb-net-qmi-wwan and uqmi. And yes, the first is an USB package, even though you have a miniPCIe card.

Alternatively, using the SSH or serial console to install these all packages, do the following:

opkg update
opkg install kmod-usb-net-qmi-wwan uqmi luci-proto-qmi kmod-usb-serial-option picocom

Reboot your router.

After a reboot, your modem should be detected. Check that by going to System ⇒ System Log and search for “qmi”. You should see something like this:

[   30.155137] qmi_wwan 1-2:1.3: cdc-wdm0: USB WDM device
[   30.167868] qmi_wwan 1-2:1.3 wwan0: register 'qmi_wwan' at [...]
[   30.189258] usbcore: registered new interface driver qmi_wwan

That means your modem was recognized by OpenWrt and you can continue with installing the package luci-proto-qmi.

If your modem is not correctly detected by OpenWrt, the installation will fail with a “missing dependencies: wwan” type of error.

Next go to Network ⇒ Interfaces and hit the “Add new Interface” button at the bottom. Give it a name, for this example I'll use “WWAN”. As protocol, you should be able to select the new protocol “QMI cellular”. Hit the “Create Interface” button, it will open the “General Settings” tab of the interface configuration:

Modem device: there should be only one, select that
APN: A quick Google search for “APN YourProvider” should give you the answer
PIN: You should know that, the PIN for your SIM card
Authentication type: Follow your provider's instructions
PDP Type: That's really up to you, IPv4 and/or IPv6

If your provider provides AP-information for both IPv6 and IPv4, you need to choose IPv4, for some reason. This will also give you an IPv6 prefix, if IPv6 is available.

Then switch to the “Firewall Settings” tab at the top and select the firewall-zone “WAN”. Hit “Save”. Back in the Interface list, apply the pending changes.

To test your connection, go to Network ⇒ Diagnostics, hit “IPv4 Ping” and wait a bit. In the output you should see something like 5 packets transmitted, 5 packets received, 0% packet loss near the bottom. If that's the case you're good to go, as far as LTE is concerned. For other configurations, please check the wiki.

Under Network ⇒ Interfaces you now have 2 additional interfaces “wwan” and “wwan0”. That's OK, ignore the “wwan0” interface, it's only used to get and display your IPv4 address.

The default network configuration is:

Interface Name	Description	Default configuration
br-lan	LAN & WiFi	192.168.1.1/24
eth0	LAN ports (1 to 4)	bridged
wlan0	WiFi	bridged (disabled)

br-lan/wan: physical PCB connection LAN 2-4: physical LAN ports on router LAN 1/WAN: physical Internet port on router

Ralink RT305x-ESW (MF283+)

Port	Switch port	Mode
LAN 1	0	Internet (WAN)
LAN 2	1	lan
LAN 3	2	lan
LAN 4	3	lan
n/a	6t	to CPU

LuCI Web interface (Network ⇒ Switch):

The complete network configuration is:

# path: /etc/config/network
# LAN1 = WAN
 
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'
 
config globals 'globals'
 
config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'
 
config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.254.254'
	option netmask '255.255.255.0'
	option ip6assign '60'
 
config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'
 
config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '6t 1 2 3'
	option description 'br-lan'
 
config switch_vlan
	option device 'switch0'
	option ports '6t 0'
	option vlan '2'
	option description 'wan'
 
config interface 'wan'
	option proto 'dhcp'
	option device 'eth0.2'
 
config interface 'wan6'
	option proto 'dhcpv6'
	option device 'eth0.2'
	option reqaddress 'try'
	option reqprefix 'auto'
	option ip6assign '64'

→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The ZTE MF283plus has the following buttons:

BUTTON	Event
Reset	Reset to default settings
WPS	Wi-Fi Protected Setup

Front:

Top:

Back:

Backside label:

Note: This will void your warranty!

Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...

To remove the cover and open the device, do a/b/c

Main PCB:

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Serial connection parameters for ZTE MF283plus	57600, 8N1, 3.3V

Note: A hardware bug in ZTE MF283+ of this board causes an incompatibility with some USB-to-serial adapters. If an affected serial adapter is connected to the board, the serial console will be show the output garbage and the following errors will be seen in the dmesg log:

[   18.715624] ttyS ttyS0: 25 input overrun(s)
[   21.768002] ttyS ttyS0: 6 input overrun(s)
[   36.347204] ttyS ttyS0: 11 input overrun(s)

USB-to-serial chipsets known to cause this include:

Prolific PL2303
WCH CH340G

USB-to-serial chipsets that have been used successfully:

Silicon Labs CP210x
FTDI FT232

USB-to-serial chipsets that have been doesn't work:

WCH CH340N

U-Boot 1.1.3 (Dec 31 2015 - 20:13:58) Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83580000 spi_wait_nsec: 3c spi device id: c2 20 19 c2 20 (2019c220) find flash: MX25L25635E raspi_read: from:60000 len:1000 .raspi_read: from:60000 len:1000 .============================================ Ralink UBoot Version: 3.6.0.0 -------------------------------------------- ASIC 3352_MP (Port5<->None) DRAM_CONF_FROM: Boot-Strapping DRAM_TYPE: DDR2 DRAM_SIZE: 512 Mbits DRAM_WIDTH: 16 bits DRAM_TOTAL_WIDTH: 16 bits TOTAL_MEMORY_SIZE: 64 MBytes Flash component: SPI Flash FLASH_SIZE: 32 MB Date:Dec 31 2015 Time:20:13:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 400 MHZ #### estimate memory size =64 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 0 zhao.wl set tsp module reset: gpio 28 start ! zhao.wl set tsp module reset gpio 28 end ! FOTA ver: MF253S-v1.0 Uaztemain: enter into ! ZTE_InitFotaFlashPara RbBlkSize = 65536 raspi_read: from:50000 len:1 .ZTE_FOTA:ZTE_GetFotaUpdateFlag flag value = -1 at 0x50000 ! Uaztemain: no need to update '' 3: System Boot system code via Flash. ## Booting image at bc080000 ... raspi_read: from:80000 len:40 . Image Name: Linux Kernel Image Created: 2016-09-06 9:33:04 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1216519 Bytes = 1.2 MB Load Address: 80000000 Entry Point: 80379000 raspi_read: from:80040 len:129007 ................... Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80379000) ... ## Giving linux memsize in MB, 64 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.21 (lidonggui@scl_xa240_204) (gcc version 3.4.2) #3 Tue Sep 6 17:33:01 CST 2016 The CPU frequency set to 400 MHz CPU revision is: 0001964c Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Built 1 zonelists. Total pages: 16256 Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock6 Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled cause = c080802c, status = 11000000 PID hash table entries: 256 (order: 8, 1024 bytes) calculating r4koff... 00186a00(1600000) CPU frequency 400.00 MHz Using 200.000 MHz high precision timer. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61092k/65536k available (2721k kernel code, 4388k reserved, 830k data, 128k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb deice id : c2 20 19 c2 20 (2019c220) Time: MIPS clocksource has been installed. MX25L25635E(c2 2019c220) (32768 Kbytes) mtd .name = raspi, .size = 0x02000000 (32M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 10 MTD partitions on "raspi": 0x00000000-0x02000000 : "ALL" 0x00000000-0x00050000 : "Bootloader" 0x00050000-0x00060000 : "fota-flag" 0x00060000-0x00070000 : "Config" 0x00070000-0x00080000 : "Factory" 0x00080000-0x00280000 : "Kernel" 0x00280000-0x00e80000 : "RootFS" 0x00e80000-0x01180000 : "Web" 0x01180000-0x01d80000 : "Data" 0x01d80000-0x02000000 : "JFFS2" NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered RT3xxx EHCI/OHCI init. squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. fuse init (API version 7.8) io scheduler noop registered (default) Ralink gpio driver initialized Enable Ralink GDMA Controller Module GDMA IP Version=2 HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: 1.8 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A loop: loaded (max 8 devices) nbd: registered device at major 43 rdm_major = 253 Ralink APSoC Ethernet Driver Initilization. v2.1 256 rx/tx descriptors allocated, mtu = 1500! MAC_ADRH -- : 0x0000f8df MAC_ADRL -- : 0xa87bf09a PROC INIT OK! IMQ starting with 2 devices... IMQ driver loaded successfully. Hooking IMQ after NAT on PREROUTING. Hooking IMQ before NAT on POSTROUTING. PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V0.17 PPTP driver version 0.8.1 block2mtd: version $Revision: 1.1.1.1 $ usbmon: debugfs is not available rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb1: Product: Ralink EHCI Host Controller usb usb1: Manufacturer: Linux 2.6.21 ehci_hcd usb usb1: SerialNumber: rt3xxx usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected 116x: driver isp116x-hcd, 03 Nov 2005 rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 usb usb2: Product: RT3xxx OHCI Controller usb usb2: Manufacturer: Linux 2.6.21 ohci_hcd usb usb2: SerialNumber: rt3xxx-ohci usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new interface driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver usbserial drivers/usb/serial/usb-serial.c: USB Serial support registered for generic usbcore: registered new interface driver usbserial_generic drivers/usb/serial/usb-serial.c: USB Serial Driver core drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port) usbcore: registered new interface driver option drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1 usbcore: registered new interface driver usb-pcm drivers/usb/serial/usb-pcm.c: USB Driver for GSM modems: V2.4.20_uC0_1B12 nf_conntrack version 0.5.0 (512 buckets, 4096 max) ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone ipt_time loading TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team ip6_queue: failed to register queue handler NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 128k freed init started: BusyBox v1.12.1 (2016-09-06 17:28:39 CST) starting pid 666, tty '': '/etc_ro/rcS' Algorithmics/MIPS FPU Emulator v1.5 JFFS2 notice: (787) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. Load cfg new driver... cfg init, drivers/cfg/cfg_param.c 547 WPS_SSID=simcard_ro 5750535f535349443d0073696d636172645f726f cfg init end, drivers/cfg/cfg_param.c 606 cfg init, drivers/cfg/cfg_param.c 547 TESTBITSIGNINFO=0000 544553544249545349474e494e464f3d30303030 cfg init end, drivers/cfg/cfg_param.c 606 Welcome to _______ _______ ___ __ ____ _ _ ___ | ___ \| __ || | |__|| \ | || | / / | |___| || |__| || |__ __ | \| || |/ / | _ /| _ || || || |\ || \ |__|register irq \__\|__| |__||______||__||_| \____||_|\___\ =System Architecture Department= zhaoyong open gpio success state_detect mairegister irq n result: 0 readregister irq bitmf283: 0 register irq usbcore: registered new interface driver cdc_ether FOTA >> [update_control.c: 2266][LOW: COMM] Update Control has been launched. [Sep 6 2016: 17:29:58] FOTA >> [update_control.c: 2269][LOW: COMM] sleep 20s waitting for modem ready Create_Data_Thread_result SUCCESS! data begin to rcv msg from queue 0. cfg save index:0 killall: zte_router: no process killed killall: port_detect: no process killed Password for 'admin' changed rmmod: ralink_wdt: No such file or directory rmmod: cls: No such file or directory rmmod: hw_nat: No such file or directory rmmod: raeth: No such file or directory insmod: bridge.ko: module not found insmod: mii.ko: module not found insmod: raeth.ko: module not found phy_tx_ring = 0x0342d000, tx_ring = 0xa342d000 phy_rx_ring0 = 0x0342e000, rx_ring0 = 0xa342e000 MAC_ADRH -- : 0x0000f8df MAC_ADRL -- : 0xa87bf09a RT305x_ESW: Link Status Changed CDMA_CSG_CFG = 81000007 GDMA1_FWD_CFG = C0710000 usb 1-2: new high speed USB device using rt3xxx-ehci and address 2 ##### disable 1st wireless interface ##### rmmod: rt2860v2_ap_net: No such file or directory rmmod: rt2860v2_ap: No such file or directory rmmod: rt2860v2_ap_util: No such file or directory rmmod: rt2860v2_sta_net: No such file or directory rmmod: rt2860v2_sta: No such file or directory rmmod: rt2860v2_sta_util: No such file or directory usb 1-2: Product: ZTE Technologies MSM usb 1-2: Manufacturer: ZTE,Incorporated usb 1-2: SerialNumber: P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0 usb 1-2: configuration #1 chosen from 1 choice add NasId1 for wifi driver config zhaoyong modetype=LTE find modem i:42 MF270 modem name: MF270 option 1-2:1.0: GSM modem (1-port) converter detected usb 1-2: GSM modem (1-port) converter now attached to ttyUSB0 find modem i:42 MF270 modem name: MF270 option 1-2:1.1: GSM modem (1-port) converter detected usb 1-2: GSM modem (1-port) converter now attached to ttyUSB1 find modem i:42 MF270 modem name: MF270 option 1-2:1.2: GSM modem (1-port) converter detected usb 1-2: GSM modem (1-port) converter now attached to ttyUSB3 find modem i:42 MF270 modem name: MF270 option 1-2:1.3: don't support this interface. cdc_ether 1-2:1.3: ZTE Ethernet Device: claiming interface 3 usb 1-2: bad CDC descriptors usb0: register 'cdc_ether' at usb-rt3xxx-2, ZTE Ethernet Device, 3e:74:af:8d:e7:b1 find modem i:42 MF270 modem name: MF270 option 1-2:1.4: don't support this interface. insmod: rt2860v2_ap_util.ko: module not found rt2860v2_ap: module license 'unspecified' taints kernel. === pAd = c07d5000, size = 562272 === <-- RTMPAllocAdapterBlock, Status=0 insmod: rt2860v2_ap_net.ko: module not found cfg save index:0 rmmod: nf_nat_pptp: No such file or directory rmmod: nf_conntrack_pptp: No such file or directory rmmod: nf_nat_proto_gre: No such file or directory rmmod: nf_conntrack_proto_gre: No such file or directory RX DESC a3b95000 size = 4096 <-- RTMPAllocTxRxRingMemory, Status=0 Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff ff 00 00 00 SYNC - BBP R4 to 20MHz.l state_detect close all led. Main bssid = f8:df:a8:7b:f0:9a <==== rt28xx_init, Status=0 0x1300 = 00064380 vconfig: ioctl error for rem: Invalid argument vconfig: ioctl error for rem: Invalid argument rmmod: 8021q: No such file or directory insmod: 8021q.ko: module not found BusyBox v1.12.1 (2016-09-06 17:28:39 CST) multi-call binary Usage: ifconfig [-a] interface [address] ifconfig: ioctl 0x8913 failed: No such device brctl: bridge br0: No such device or address device ra0 entered promiscuous mode ##### restore Ralink ESW to dump switch ##### switch reg write offset=14, value=5555 switch reg write offset=40, value=1001 switch reg write offset=44, value=1001 switch reg write offset=48, value=1001 switch reg write offset=4c, value=1 switch reg write offset=50, value=2001 switch reg write offset=70, value=ffffffff switch reg write offset=98, value=7f7f switch reg write offset=e4, value=7f done. device eth2 entered promiscuous mode cfg save index:0 br0: port 2(eth2) entering learning state br0: port 1(ra0) entering learning state route: ioctl 0x890c failed: No such process route: ioctl 0x890b failed: Invalid argument cfg save index:0 br0: port 2(eth2) entering disabled state br0: port 1(ra0) entering disabled state br0: port 2(eth2) entering learning state br0: port 1(ra0) entering learning state route: ioctl 0x890c failed: No such process route: ioctl 0x890b failed: Invalid argument ifconfig: ioctl 0x8914 failed: Cannot assign requested address ifconfig: ioctl 0x8914 failed: Cannot assign requested address cfg save index:0 cfg save index:0 br0: topology change detected, propagating br0: port 2(eth2) entering forwarding state br0: topology change detected, propagating br0: port 1(ra0) entering forwarding state cfg save index:0 cfg save index:0 cfg save index:0 cfg save index:0 cfg save index:0 /sbin/lan.sh: /sbin/static_ip_init.sh: line 1: /!static_ip_init.sh: not found cfg save index:0 mac_ip_bind function is disabled cfg save index:0 killall: udhcpd: no process killed Set: phy[0].reg[0] = 3900 Set: phy[4].reg[0] = 3900 Set: phy[1].reg[0] = 3900 Set: phy[2].reg[0] = 3900 Set: phy[3].reg[0] = 3900 Set: phy[0].reg[0] = 3100 Set: phy[4].reg[0] = 3100 Set: phy[1].reg[0] = 3100 Set: phy[2].reg[0] = 3100 Set: phy[3].reg[0] = 3100 ifconfig: ioctl 0x8913 failed: No such device cfg save index:0 into ipv6_br0_conf.sh start radvd config set killall: radvd: no process killed end radvd config set killall: pppoecd: no process killed killall: udhcpc: no process killed iptables: No chain/target/match by that name iptables: No chain/target/match by that name ip6tables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name rmmod: turbo_nat: No such file or directory start init turbonat 20140926: 1) fix ftp upload problem; 2) add support for skip ports list=[+21+22+23+25+53+69+110+115+123+443+500+1352+1723+1990+1991+1992+1993+1994+1995+1996+1997+1998+4500+5060+]; 3) fix softlock up problem; 4) fix rmmod cdc_ether issue, support FTP and HTTP; 5) log switch=[0] MAX_ENTRY_NUM=[512], hash size=[1024] init turbonat done not chinamobile opms_wan_ifname=... Syslogd Start... iptables -t nat -A POSTROUTING -o usb0 -j MASQUERADE iptables: No chain/target/match by that name rmmod: nf_conntrack_sip: No such file or directory iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables v1.4.0rc1: Couldn't find target `time_limit_filter' Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables v1.4.0rc1: Couldn't find target `white_list_filter' Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name ************start dos_attack_defender.sh***************** iptables: No chain/target/match by that name iptables v1.4.0rc1: Couldn't find target `dosattack_filter' Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name ************end dos_attack_defender.sh***************** * daemon not running. starting it now on port 8888 * * daemon started successfully * start wlan-server ---------------------> not enter 29A 1 KB/s (148 bytes in 0.126s) 2 KB/s (146 bytes in 0.054s) 2 KB/s (146 bytes in 0.055s) ===>>Parse_CRSM_Res<<=== FOTA >> [update_control.c: 2335][HIGH: COMM] after adb shell rm -rf /cache/zte_fota/delta/ /etc_ro/rcS: line 50: zte_tcm: not found dnsmasq: failed to create listening socket: Address already in use 0 KB/s (147 bytes in 0.174s) ===>>Parse_CRSM_Res<<=== normal mode! =========pRes->aucParas= ===========/etc_ro/rcS: line 58: samba.sh: not found /etc_ro/rcS: line 59: mksmbpasswd.sh: not found /etc_ro/rcS: line 65: fullshare: not found 1 KB/s (144 bytes in 0.074s) FOTA >> [update_control.c: 2341][HIGH: COMM] after adb shell rm -f /cache/root_uImage.mld /cache/delta.package /cache/cpe_postprocessing.sh 1 KB/s (143 bytes in 0.079s) ===>>Parse_CRSM_Res<<=== unzip: can't open /cache/image.zip, /cache/image.zip.zip, /cache/image.zip.ZIP FOTA >> [update_control.c: 2344][HIGH: COMM] after adb shell unzip -o /cache/image.zip -d /cache/ FOTA >> [update_control.c: 1972][LOW: COMM] enter check_last_state. FOTA >> [update_control.c: 2033][LOW: COMM] enter check_cpe_update_result. starting pid 2334, tty '/dev/ttyS1': '/bin/sh' 1 KB/s (150 bytes in 0.081s) 1 KB/s (154 bytes in 0.113s) ===>>Parse_CRSM_Res<<=== ===>>Parse_CRSM_Res<<=== thread monitor start! watchdog:len=1 goahead main. defined _ZTE_CFG_ DB: Registering database table <users> DB: Registering database table <groups> DB: Registering database table <access> UM: Loading User Configuration from file <umconfig.txt> DB: About to read data file <./umconfig.txt> DB: Failed to stat persistent data file. webs: Listening for HTTP requests at address 192.168.254.254 BusyBox v1.12.1 (2016-09-06 17:28:39 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. # Parse_Cpbs_Rsp tPara.usedEntries is 7 tPara.totalEntries is 250. 8 KB/s (285 bytes in 0.031s) udhcpc (v1.12.1) started deconfig case deconfig cfg save index:0 case deconfig over step=0 Sending select for 100.96.61.79... Lease of 100.96.61.79 obtained, lease time 7200 bound case renew bound ####################Turbonat Receive NETDEV_DOWN CMD######################## interface:usb0, ip:100.96.61.79, NETMASK:255.255.255.224 router:100.96.61.80 dns:124.6.181.25 124.6.181.26 deleting routers route: ioctl 0x890c failed: No such process ipv4 dns_mode:auto ipv6_dns_mode: Parse_Cpbs_Rsp tPara.usedEntries is 7 tPara.totalEntries is 250. case renew bound over rmmod: zte_check_privateip: No such file or directory FOTA >> [update_control.c: 2195][LOW: COMM] net link recv add@/module/zte_check_privateip zte_check_privateip_module_init register start... zte_check_privateip_module_init dev[usb0], ip[100.96.61.79] 80 KB/s (8192 bytes in 0.099s) WPAPSKWPA2PSK FOTA >> [update_control.c: 1838]cfg save index:0 [LOW: COMM] enter uc_set_update_state. FOTA >> [update_control.c: 1839][MID: COMM] fsm turn from 0 to 0. FOTA >> [update_control.c: 1107][LOW: COMM] enter uc_recv_msg_from_dm. FOTA >> [update_control.c: 1149][HIGH: COMM] create message queue successful. FOTA >> [update_control.c: 1154][MID: COMM] Start recv msg.

U-Boot 1.1.3 (Dec 31 2015 - 20:13:58) Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83580000 spi_wait_nsec: 3c spi device id: c2 20 19 c2 20 (2019c220) find flash: MX25L25635E raspi_read: from:60000 len:1000 .raspi_read: from:60000 len:1000 .============================================ Ralink UBoot Version: 3.6.0.0 -------------------------------------------- ASIC 3352_MP (Port5<->None) DRAM_CONF_FROM: Boot-Strapping DRAM_TYPE: DDR2 DRAM_SIZE: 512 Mbits DRAM_WIDTH: 16 bits DRAM_TOTAL_WIDTH: 16 bits TOTAL_MEMORY_SIZE: 64 MBytes Flash component: SPI Flash FLASH_SIZE: 32 MB Date:Dec 31 2015 Time:20:13:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 400 MHZ #### estimate memory size =64 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 0 zhao.wl set tsp module reset: gpio 28 start ! zhao.wl set tsp module reset gpio 28 end ! FOTA ver: MF253S-v1.0 Uaztemain: enter into ! ZTE_InitFotaFlashPara RbBlkSize = 65536 raspi_read: from:50000 len:1 .ZTE_FOTA:ZTE_GetFotaUpdateFlag flag value = -1 at 0x50000 ! Uaztemain: no need to update '' 3: System Boot system code via Flash. ## Booting image at bc080000 ... raspi_read: from:80000 len:40 . Image Name: MIPS OpenWrt Linux-5.15.167 Created: 2024-09-23 12:34:46 UTC Image Type: MIPS Linux Kernel Image (uncompressed) Data Size: 1739562 Bytes = 1.7 MB Load Address: 80000000 Entry Point: 80000000 raspi_read: from:80040 len:1a8b2a ........................... Verifying Checksum ... OK OK No initrd ## Transferring control to Linux (at address 80000000) ... ## Giving linux memsize in MB, 64 Starting kernel ... OpenWrt kernel loader for MIPS based SoC Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org> Decompressing kernel... done! Starting kernel at 80000000... [ 0.000000] Linux version 5.15.167 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24106-10cc5fcd00) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Sep 23 12:34:46 2024 [ 0.000000] SoC Type: Ralink RT3352 id:1 rev:6 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001964c (MIPS 24KEc) [ 0.000000] MIPS: machine is ZTE MF283+ [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear) [ 0.000000] Writing ErrCtl register=0006fd7f [ 0.000000] Readback ErrCtl register=0006fd7f [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 58036K/65536K available (4281K kernel code, 568K rwdata, 624K rodata, 1172K init, 206K bss, 7500K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 256 [ 0.000000] CPU Clock: 400MHz [ 0.000000] timer_probe: no matching timers found [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000003] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.015743] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104) [ 0.107938] pid_max: default: 32768 minimum: 301 [ 0.118543] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.132978] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.162968] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.182408] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 0.195873] pinctrl core: initialized pinctrl subsystem [ 0.209412] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.253661] rt2880_gpio 10000600.gpio: registering 24 gpios [ 0.264750] rt2880_gpio 10000600.gpio: registering 24 irq handlers [ 0.278124] rt2880_gpio 10000638.gpio: registering 16 gpios [ 0.294346] clocksource: Switched to clocksource MIPS [ 0.308052] NET: Registered PF_INET protocol family [ 0.318249] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.334761] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.351519] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.366791] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.381894] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.395795] TCP: Hash tables configured (established 1024 bind 1024) [ 0.408678] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.421665] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.436206] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.448045] rt-timer 10000100.timer: maximum frequency is 4069Hz [ 0.470535] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.494664] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.506194] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.528651] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252) [ 0.548432] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.569405] printk: console [ttyS0] disabled [ 0.578024] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103 [ 0.597645] printk: console [ttyS0] enabled [ 0.597645] printk: console [ttyS0] enabled [ 0.614090] printk: bootconsole [early0] disabled [ 0.614090] printk: bootconsole [early0] disabled [ 0.679668] spi spi0.0: force spi mode3 [ 0.689979] spi-nor spi0.0: mx25l25635e (32768 Kbytes) [ 0.700511] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.713318] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions [ 0.727966] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions [ 0.743377] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions [ 0.758067] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions [ 0.773273] Creating 4 MTD partitions on "spi0.0": [ 0.782949] 0x000000000000-0x000000060000 : "u-boot" [ 0.800285] 0x000000060000-0x000000070000 : "u-boot-env" [ 0.813493] 0x000000070000-0x000000080000 : "factory" [ 0.830625] 0x000000080000-0x000001000000 : "firmware" [ 0.844094] 2 uimage-fw partitions found on MTD device firmware [ 0.856019] Creating 2 MTD partitions on "firmware": [ 0.865944] 0x000000000000-0x0000001a8b6a : "kernel" [ 0.875835] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only [ 0.898778] 0x0000001a8b6a-0x000000f80000 : "rootfs" [ 0.908765] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only [ 0.929698] mtd: setting mtd5 (rootfs) as root device [ 0.941950] 1 squashfs-split partitions found on MTD device rootfs [ 0.954415] 0x000000500000-0x000000f80000 : "rootfs_data" [ 1.011263] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized [ 1.028494] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5 [ 1.046526] rt2880_wdt 10000120.watchdog: Initialized [ 1.060205] NET: Registered PF_INET6 protocol family [ 1.085840] Segment Routing with IPv6 [ 1.093393] In-situ OAM (IOAM) with IPv6 [ 1.101615] NET: Registered PF_PACKET protocol family [ 1.112019] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 1.138469] 8021q: 802.1Q VLAN Support v1.8 [ 1.150991] clk: Disabling unused clocks [ 1.178710] VFS: Mounted root (squashfs filesystem) readonly on device 31:5. [ 1.203385] Freeing unused kernel image (initmem) memory: 1172K [ 1.215239] This architecture does not have kernel memory protection. [ 1.228069] Run /sbin/init as init process [ 2.980182] rt3050-esw 10110000.esw: port 1 link up [ 4.532636] init: Console is alive [ 4.540639] init: - watchdog - [ 7.692150] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 8.591859] usbcore: registered new interface driver usbfs [ 8.603100] usbcore: registered new interface driver hub [ 8.613977] usbcore: registered new device driver usb [ 8.643246] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 8.659517] fsl-ehci: Freescale EHCI Host controller driver [ 8.675781] ehci-platform: EHCI generic platform driver [ 8.697396] phy phy-usbphy.0: remote usb device wakeup disabled [ 8.709224] phy phy-usbphy.0: UTMI 16bit 30MHz [ 8.718094] ehci-platform 101c0000.ehci: EHCI Host Controller [ 8.729606] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1 [ 8.745602] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000 [ 8.784474] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00 [ 8.799510] hub 1-0:1.0: USB hub found [ 8.809031] hub 1-0:1.0: 2 ports detected [ 8.832311] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 8.849245] ohci-platform: OHCI generic platform driver [ 8.860651] ohci-platform 101c1000.ohci: Generic Platform OHCI controller [ 8.874437] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2 [ 8.890544] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000 [ 8.970816] hub 2-0:1.0: USB hub found [ 8.980286] hub 2-0:1.0: 2 ports detected [ 9.009151] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 9.035432] init: - preinit - [ 9.104674] usb 1-2: new high-speed USB device number 2 using ehci-platform [ 12.116350] random: jshn: uninitialized urandom read (4 bytes read) [ 12.310372] random: jshn: uninitialized urandom read (4 bytes read) [ 12.543756] random: jshn: uninitialized urandom read (4 bytes read) [ 14.480059] rt3050-esw 10110000.esw: port 1 link down [ 14.632416] 8021q: adding VLAN 0 to HW filter on device eth0 Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 15.709519] random: procd: uninitialized urandom read (4 bytes read) [ 16.268422] rt3050-esw 10110000.esw: port 1 link up [ 16.278308] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 16.292040] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready [ 19.042664] jffs2: notice: (296) jffs2_build_xattr_subsystem: complete building xattr subsystem, 6 of xdatum (0 unchecked, 1 orphan) and 7 of xref (1 dead, 0 orphan) found. [ 19.077826] mount_root: switching to jffs2 overlay [ 19.106420] overlayfs: upper fs does not support tmpfile. [ 19.133524] urandom-seed: Seeding with /etc/urandom.seed [ 19.537521] procd: - early - [ 19.543884] procd: - watchdog - [ 21.806265] procd: - watchdog - [ 23.075793] procd: - ubus - [ 25.132898] random: ubusd: uninitialized urandom read (4 bytes read) [ 25.160796] random: ubusd: uninitialized urandom read (4 bytes read) [ 25.549793] random: ubusd: uninitialized urandom read (4 bytes read) [ 25.576884] procd: - init - Please press Enter to activate this console. [ 27.405665] random: jshn: uninitialized urandom read (4 bytes read) [ 27.451406] random: ubusd: uninitialized urandom read (4 bytes read) [ 27.464981] random: ubus: uninitialized urandom read (4 bytes read) [ 28.588613] kmodloader: loading kernel modules from /etc/modules.d/* [ 29.481055] usbcore: registered new interface driver cdc_wdm [ 29.515727] Loading modules backported from Linux version v6.1.110-0-g5f55cad62cc9d [ 29.531074] Backport generated by backports.git v6.1.110-1-0-g965f73fc [ 29.661273] usbcore: registered new interface driver usbserial_generic [ 29.674667] usbserial: USB Serial support registered for generic [ 30.089641] PPP generic driver version 2.4.2 [ 30.126350] NET: Registered PF_PPPOX protocol family [ 30.155137] qmi_wwan 1-2:1.3: cdc-wdm0: USB WDM device [ 30.167868] qmi_wwan 1-2:1.3 wwan0: register 'qmi_wwan' at usb-101c0000.ehci-2, WWAN/QMI device, 2a:10:d3:84:39:74 [ 30.189258] usbcore: registered new interface driver qmi_wwan [ 30.399080] usbcore: registered new interface driver option [ 30.410636] usbserial: USB Serial support registered for GSM modem (1-port) [ 30.426217] option 1-2:1.0: GSM modem (1-port) converter detected [ 30.439286] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB0 [ 30.454467] option 1-2:1.1: GSM modem (1-port) converter detected [ 30.467606] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB1 [ 30.482527] option 1-2:1.2: GSM modem (1-port) converter detected [ 30.495731] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB2 [ 30.874545] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "factory" [ 30.888986] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 3352, rev 0200 detected [ 30.904486] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 000c detected [ 31.055177] kmodloader: done loading kernel modules from /etc/modules.d/* [ 38.926569] urngd: v1.0.2 started. [ 45.834818] random: crng init done [ 45.841597] random: 40 urandom warning(s) missed due to ratelimiting [ 69.938321] rt3050-esw 10110000.esw: port 1 link down [ 71.992655] rt3050-esw 10110000.esw: port 1 link up [ 92.969848] 8021q: adding VLAN 0 to HW filter on device eth0 [ 93.025925] br-lan: port 1(eth0.1) entered blocking state [ 93.036780] br-lan: port 1(eth0.1) entered disabled state [ 93.048250] device eth0.1 entered promiscuous mode [ 93.057934] device eth0 entered promiscuous mode [ 93.168513] br-lan: port 1(eth0.1) entered blocking state [ 93.179375] br-lan: port 1(eth0.1) entered forwarding state [ 93.975323] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready BusyBox v1.36.1 (2024-09-23 12:34:46 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt 23.05.5, r24106-10cc5fcd00 ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/#

In OpenWrt 22.03.0 and later versions (including snapshots releases), while the router is running for several days or weeks, Wifi suddenly stops working. SSID is being broadcasted, clients are disconnected and not able to re-connect. Restarting Wifi service does not fix the issue. Also reports of random reboots. Only a full router reboot fixes the issue. This seems to be an issue with the driver.

OpenWrt 23.05.2 fails to boot on ZTE MF283+. This later fixed with OpenWrt 23.05.3 and properly fixed in snapshots releases.

Powered by 12V 1.5A DC power adapter. The size of the plug is believed to be 2.1 x 5.5mm as used on other ZTE routers. The MF283+ may suffer same issue as witnessed with some 3rd party replacement power adapters for MF283+. Ensure the replacement power adapter is ideally fitted with the fork/prong sprung style plug. This will prevent momentary loss of power when the plug/cable is disturbed.

Space for additional notes, links to forum threads or other resources.

...

How to add tags

ramips, RT3352, 16flash, 64RAM, 4port, fastethernet, vlan, USB, LTE, 1SIM, wlan, 802.11bgn, MIPS

ramips rt3352 16flash 64RAM 4port fastethernet vlan usb lte 1SIM wlan 802.11bgn mips

ZTE MF283plus

Supported Versions

Hardware Highlights

Installation

Requirements

Flashing via TFTP

Using serial console

Using TFTP recovery

Flash Layout

OEM flash layout

OpenWrt flash layout

OEM installation using the TFTP method

Specific values needed for tftp

Upgrading OpenWrt

LuCI Web Upgrade Process

Terminal Upgrade Process

sysupgrade

Go back to original firmware

Using serial console

Using TFTP recovery

Debricking

Failsafe mode

Basic configuration

LTE configuration using LuCI

Specific Configuration

Interfaces

Switch Ports (for VLANs)

Ralink RT305x-ESW (MF283+)

Buttons

Hardware

Info

Photos

Opening the case

Serial

Bootlogs

OEM bootlog

OpenWrt bootlog

Known issues and nonfunctional builds

Notes

Tags