This is an old revision of the document!
ZTE MF286R
ZTE MF286 is a wireless LTE router, capable of connecting to LTE networks at 300Mbps using carrier aggegation. It has tri-band 2.4GHz Wi-Fi 4 and dual-band 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls, and a battery slot on the back for a 3Ah battery. It is commonly used by some european ISPs for FWA(Fixed Wireless Access) services, by Windtre on Italy, Turkcell on Turkey, and more. Some models do not include battery or phone ports, as well as corresponding LEDs on the front.
Getting started with a new Device Page
- This is an empty template that suggests the information that should be present on a well-constructed Device Page. This means, that you have to fill it with life and information.
- There are several “fixme” tags with text on a light background (like this text) throughout this template. As you fill in the page, remove those tags so that people can judge its completeness.
- When there are no more “fixme” tags left, delete this one too, along with the
<WRAP>that encloses it.
Keep the articles modular
- Please include only model specific information, omit bla,bla and put everything generic into separate articles
- If you have no time to write certain stuff, link to docs
- base-system should lead the way, do not explain this again
- DO NOT provide a complete howto here! Instead groom the general documentation.
Supported Versions
Experimental Versions
None at this time.
Hardware Highlights
| Model | Version | SoC | CPU MHz | CPU Cores | Flash MB | RAM MB | WLAN Hardware | WLAN2.4 | WLAN5.0 | 100M ports | Gbit ports | Modem | USB |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MF286R | Qualcomm Atheros QCA9563 | 775 | 1 | 2, 128NAND | 128 | QCA9563; QCA9886 | b/g/n | a/n/ac | - | LTE | 1x 2.0 |
Installation
→ Install OpenWrt (generic explanation)
Please add the installation procedure here.
Flash Layout
Find out flash layout, then add the flash layout table here (copy, paste, modify the example).
Please check out the article Flash layout. It contains examples and explanations that describe how to document the flash layout.
OEM installation using the TFTP method
Specific values needed for tftp
Enter values for “FILL-IN” below
| Bootloader tftp server IPv4 address | FILL-IN |
|---|---|
| Bootloader MAC address (special) | FILL-IN |
| Firmware tftp image | Latest OpenWrt release (NOTE: Name must contain “tftp”) |
| TFTP transfer window | FILL-IN seconds |
| TFTP window start | approximately FILL-IN seconds after power on |
| TFTP client required IP address | FILL-IN |
Upgrading OpenWrt
These are generic instructions. Update with your router's specifics.
LuCI Web Upgrade Process
- Browse to
http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/LuCI Upgrade URL - Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There are two command line methods for upgrading:
sysupgrademtd
Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
sysupgrade
- Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
mtd
If sysupgrade does not support this router, use mtd.
- Login as root via SSH on 192.168.1.1, then enter the following commands:
cd /tmp wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc mtd write /tmp/xxx.abc linux && reboot
Debricking
Failsafe mode
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Please fill in real values for this device, then remove the EXAMPLEs
Network interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | EXAMPLE LAN & WiFi | EXAMPLE 192.168.1.1/24 |
| vlan0 (eth0.0) | EXAMPLE LAN ports (1 to 4) | EXAMPLE None |
| vlan1 (eth0.1) | EXAMPLE WAN port | EXAMPLE DHCP |
| wl0 | EXAMPLE WiFi | EXAMPLE Disabled |
Switch Ports (for VLANs)
Please fill in real values for this device, then remove the EXAMPLEs
Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.
| Port | Switch port |
|---|---|
| Internet (WAN) | EXAMPLE 4 |
| LAN 1 | EXAMPLE 3 |
| LAN 2 | EXAMPLE 2 |
| LAN 3 | EXAMPLE 1 |
| LAN 4 | EXAMPLE 0 |
Buttons
→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.
Please fill in real values for this device, then remove the EXAMPLEs
The ZTE MF286R has the following buttons:
| BUTTON | Event |
|---|---|
| EXAMPLE Reset | reset |
| EXAMPLE Secure Easy Setup | ses |
| EXAMPLE No buttons at all. | - |
Hardware
Info
- This table is automatically generated, once the correct filters for Brand and Model are set.
- If you see “Nothing.” instead of a table, please edit this section and adjust the filters with the proper Brand and Model. Just try, it's easy.
- If you still don't see a table here, or a table filled with '¿': Is there already a Techdata page available for ZTE MF286R ? If not: Create one.
- If you see a table with the desired device data, everything is OK and you can delete this text and the
<WRAP>that encloses it. - If it still doesn't work: Don't panic, calm down, take a deep breath and contact a wiki admin (tmomas) for help.
---- datatemplatelist dttpllist ---- template: meta:template_datatemplatelist cols : Brand, Model, Versions, Device Type, Availability, Supported Since Commit_git, Supported since Rel, Supported current Rel, Unsupported, Bootloader, CPU, Target, CPU MHz, Flash MBs, RAM MB, Switch, Ethernet 100M ports_, Ethernet Gbit ports_, Comments network ports_, Modem, VLAN, WLAN 2.4GHz, WLAN 5.0GHz, WLAN Hardwares, WLAN Comments_, Detachable Antennas_, USB ports_, SATA ports_, Comments USB SATA ports_, Serial, JTAG, LED count, Button count, Power supply, Device Techdata_pageid, Forum topic URL_url, wikidevi URL_url, OEM Device Homepage URL_url, Firmware OEM Stock URL_url, Firmware OpenWrt Install URL_url, Firmware OpenWrt Upgrade URL_url, Comments_ filter : Brand=ZTE filter : Model=MF286R filter : Versions=
Photos
Front:
Insert photo of front of the casing
Back:
Insert photo of back of the casing
Backside label:
Insert photo of backside label
Opening the case
Note: This will void your warranty!
Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...
- To remove the cover and open the device, do a/b/c
Main PCB:
Insert photo of PCB
Serial
→ port.serial general information about the serial port, serial port cable, etc.
The serial console connections are identical to the ZTE MF286D.
| Serial connection parameters for ZTE MF286R @@Version@@ | 115200, 8N1, 3.3V |
|---|
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port
Bootloader mods
None so far.
Hardware mods
None so far.
Bootlogs
OEM bootlog
COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE
OpenWrt bootlog
U-Boot 1.1.4 (May 13 2021 - 05:37:00) ap152 - Dragonfly 1.0DRAM: sri ath_ddr_initial_config(278): (ddr2 init) ath_sys_frequency: cpu 775 ddr 650 ahb 258 Tap values = (0x10, 0x10, 0x10, 0x10) 128 MB Top of RAM usable for U-Boot at: 88000000 Reserving 659k for U-Boot at: 87f58000 Reserving 192k for malloc() at: 87f28000 Reserving 44 Bytes for Board Info at: 87f27fd4 Reserving 36 Bytes for Global Data at: 87f27fb0 Reserving 128k for boot params() at: 87f07fb0 Stack Pointer at: 87f07f98 Now running in RAM - U-Boot at: 87f58000 Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x15 flash size 2MB, sector count = 32 Flash: 2 MB *** Warning - bad CRC, using default environment Power up PLL with outdiv = 0 then switch to 3 In: serial Out: serial Err: serial Net: ath_gmac_enet_initialize... No valid address in Flash. Using fixed address ath_gmac_enet_initialize: reset mask:c02200 athr_mgmt_init (MDC/MDIO config)::done Dragonfly ----> S17 PHY * athrs17_reg_init: complete Max resets limit reached exiting... athr_gmac_sgmii_setup SGMII done : cfg1 0x80000000 cfg2 0x7114 eth0: 00:03:7f:ff:ff:ff ath_gmac_phy_setup eth0 up eth0 Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014 Qualcomm Atheros Inc. ath_spi_nand_ecc: furture feat = 0x10 ath_spi_nand_ecc: middle feat = 0x10 zte ath_spi_nand_read_id 0xc8d1 zte ath_spi_nand_read_id 0xc8d1c8 zte debug gd 128 oob ====== NAND Parameters ====== sc addr = 0x87fa6d10 page(write size) = 0x800 (erase size) block = 0x20000 Setting 0x181162c0 to 0x4b962100 Uaztemain: enter into ! ZTE_InitFotaFlashPara: nand_curr_device=0 zte_getHandOffState: read data=0x20 from 0x0 Hit any key to stop autoboot: 2 ... 1 ... 0 Loading from device 0: ath-spi-nand (offset 0x1800000) Image Name: MIPS OpenWrt Linux-5.10.138 Created: 2022-09-03 2:55:34 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 2435565 Bytes = 2.3 MB Load Address: 80060000 Entry Point: 80060000 ath_spi_nand_page_read :status=0x1 ## Booting image at 81000000 ... Image Name: MIPS OpenWrt Linux-5.10.138 Created: 2022-09-03 2:55:34 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 2435565 Bytes = 2.3 MB Load Address: 80060000 Entry Point: 80060000 Verifying Checksum at 0x81000040 ...OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 80060000) ... ## Giving linux memsize in bytes, 134217728 Starting kernel ... [ 0.000000] Linux version 5.10.138 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19685-512e76967f) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Sat Sep 3 02:55:34 2022 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc) [ 0.000000] MIPS: machine is ZTE MF286R [ 0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 120572K/131072K available (6346K kernel code, 599K rwdata, 784K rodata, 1220K init, 214K bss, 10500K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 775.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns [ 0.000008] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns [ 0.008282] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216) [ 0.074810] pid_max: default: 32768 minimum: 301 [ 0.079805] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.087520] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.097694] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build [ 0.108427] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.118833] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 0.126103] pinctrl core: initialized pinctrl subsystem [ 0.135610] NET: Registered protocol family 16 [ 0.140935] thermal_sys: Registered thermal governor 'step_wise' [ 0.192114] clocksource: Switched to clocksource MIPS [ 0.204961] NET: Registered protocol family 2 [ 0.209762] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.218153] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 0.227070] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.235171] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.242614] TCP: Hash tables configured (established 1024 bind 1024) [ 0.249435] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.256373] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.264013] NET: Registered protocol family 1 [ 0.268632] PCI: CLS 0 bytes, default 32 [ 0.278586] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 0.289034] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.295234] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.307254] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252) [ 0.317547] pinctrl-single 1804002c.pinmux: 544 pins, size 68 [ 0.324676] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.333519] printk: console [ttyS0] disabled [ 0.338085] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A [ 0.347228] printk: console [ttyS0] enabled [ 0.347228] printk: console [ttyS0] enabled [ 0.356294] printk: bootconsole [early0] disabled [ 0.356294] printk: bootconsole [early0] disabled [ 0.382759] spi-nand spi0.1: GigaDevice SPI NAND was found. [ 0.388533] spi-nand spi0.1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128 [ 0.399376] 6 fixed-partitions partitions found on MTD device (null) [ 0.405988] Creating 6 MTD partitions on "(null)": [ 0.410944] 0x000000000000-0x0000000a0000 : "fota-flag" [ 0.418233] 0x0000000a0000-0x000000120000 : "art" [ 0.425556] 0x000000120000-0x0000001a0000 : "mac" [ 0.432901] 0x0000001a0000-0x000001800000 : "ubiconcat0" [ 0.469314] 0x000001800000-0x000001c00000 : "kernel" [ 0.481371] 0x000001c00000-0x000008000000 : "ubiconcat1" [ 0.627165] spi-nor spi0.0: gd25q16 (2048 Kbytes) [ 0.632074] 3 fixed-partitions partitions found on MTD device spi0.0 [ 0.638669] Creating 3 MTD partitions on "spi0.0": [ 0.643646] 0x000000000000-0x0000000a0000 : "u-boot" [ 0.650519] 0x0000000a0000-0x0000000c0000 : "u-boot-env" [ 0.657012] 0x0000000c0000-0x000000200000 : "reserved1" [ 0.666148] Concatenating MTD devices: [ 0.670033] (0): "ubiconcat0" [ 0.673143] (1): "ubiconcat1" [ 0.676202] into device "ubi-concat" [ 0.679918] 1 fixed-partitions partitions found on MTD device ubi-concat [ 0.686856] Creating 1 MTD partitions on "ubi-concat": [ 0.692187] 0x000000000000-0x000007a60000 : "ubi" [ 1.386364] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0 [ 2.043633] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316] [ 2.054918] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii [ 2.063482] NET: Registered protocol family 10 [ 2.075060] Segment Routing with IPv6 [ 2.078954] NET: Registered protocol family 17 [ 2.083694] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 2.097085] 8021q: 802.1Q VLAN Support v1.8 [ 2.105380] PCI host bridge /ahb/pcie-controller@18250000 ranges: [ 2.111703] MEM 0x0000000012000000..0x0000000013ffffff [ 2.117152] IO 0x0000000000000000..0x0000000000000000 [ 2.122733] PCI host bridge to bus 0000:00 [ 2.126974] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff] [ 2.134102] pci_bus 0000:00: root bus resource [io 0x0000] [ 2.139859] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 2.146878] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 2.155118] pci 0000:00:00.0: [168c:0056] type 00 class 0x028000 [ 2.161352] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit] [ 2.168500] pci 0000:00:00.0: PME# supported from D0 D3hot [ 2.175356] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 2.182255] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit] [ 2.193512] UBI: auto-attach mtd9 [ 2.196962] ubi0: attaching mtd9 [ 4.974978] ubi0: scanning is finished [ 5.013862] ubi0: attached mtd9 (name "ubi", size 122 MiB) [ 5.019542] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 5.026680] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 5.033707] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 5.040890] ubi0: good PEBs: 977, bad PEBs: 2, corrupted PEBs: 0 [ 5.047100] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128 [ 5.054571] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1798954104 [ 5.064007] ubi0: available PEBs: 0, total reserved PEBs: 977, PEBs reserved for bad PEB handling: 18 [ 5.073630] ubi0: background thread "ubi_bgt0d" started, PID 334 [ 5.082803] block ubiblock0_0: created from ubi0:0(rootfs) [ 5.088480] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem [ 5.119195] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 5.133277] Freeing unused kernel memory: 1220K [ 5.137954] This architecture does not have kernel memory protection. [ 5.144638] Run /sbin/init as init process [ 5.964212] init: Console is alive [ 5.968162] init: - watchdog - [ 7.605099] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 7.746631] usbcore: registered new interface driver usbfs [ 7.752430] usbcore: registered new interface driver hub [ 7.758003] usbcore: registered new device driver usb [ 7.772889] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 7.782348] ehci-fsl: Freescale EHCI Host controller driver [ 7.789628] ehci-platform: EHCI generic platform driver [ 7.795421] ehci-platform 1b000000.usb: EHCI Host Controller [ 7.801308] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1 [ 7.809577] ehci-platform 1b000000.usb: irq 13, io mem 0x1b000000 [ 7.842154] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00 [ 7.849386] hub 1-0:1.0: USB hub found [ 7.854045] hub 1-0:1.0: 1 port detected [ 7.858929] ehci-platform 1b400000.usb: EHCI Host Controller [ 7.864842] ehci-platform 1b400000.usb: new USB bus registered, assigned bus number 2 [ 7.873069] ehci-platform 1b400000.usb: irq 14, io mem 0x1b400000 [ 7.902136] ehci-platform 1b400000.usb: USB 2.0 started, EHCI 1.00 [ 7.909335] hub 2-0:1.0: USB hub found [ 7.914033] hub 2-0:1.0: 1 port detected [ 7.921445] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 7.939391] init: - preinit - [ 8.489622] usb 1-1: new high-speed USB device number 2 using ehci-platform [ 8.962381] random: procd: uninitialized urandom read (4 bytes read) [ 9.383690] random: jshn: uninitialized urandom read (4 bytes read) [ 9.465312] random: jshn: uninitialized urandom read (4 bytes read) [ 10.919708] eth0: link up (1000Mbps/Full duplex) [ 10.930560] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 10.943680] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 15.305273] UBIFS (ubi0:1): Mounting in unauthenticated mode [ 15.322744] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 480 [ 15.499105] UBIFS (ubi0:1): recovery needed [ 15.920900] UBIFS (ubi0:1): recovery completed [ 15.925624] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data" [ 15.933728] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 15.943982] UBIFS (ubi0:1): FS size: 115294208 bytes (109 MiB, 908 LEBs), journal size 5713920 bytes (5 MiB, 45 LEBs) [ 15.954943] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB) [ 15.961774] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 09DDE122-9F2F-4923-9B45-1D1E6DFE7048, small LPT model [ 16.007875] mount_root: switching to ubifs overlay [ 16.052629] urandom-seed: Seeding with /etc/urandom.seed [ 16.289832] eth0: link down [ 16.330213] procd: - early - [ 16.333599] procd: - watchdog - [ 17.190938] procd: - watchdog - [ 17.217383] procd: - ubus - [ 17.427085] random: ubusd: uninitialized urandom read (4 bytes read) [ 17.442997] random: ubusd: uninitialized urandom read (4 bytes read) [ 17.462351] random: ubusd: uninitialized urandom read (4 bytes read) [ 17.479242] procd: - init - Please press Enter to activate this console. [ 19.409083] random: jshn: uninitialized urandom read (4 bytes read) [ 19.441117] random: ubusd: uninitialized urandom read (4 bytes read) [ 19.462489] random: ubus: uninitialized urandom read (4 bytes read) [ 20.580254] urngd: v1.0.2 started. [ 20.859036] random: crng init done [ 20.862614] random: 28 urandom warning(s) missed due to ratelimiting [ 21.022527] kmodloader: loading kernel modules from /etc/modules.d/* [ 21.249828] GACT probability on [ 21.254815] Mirror/redirect action on [ 21.277469] u32 classifier [ 21.280281] input device check on [ 21.284101] Actions configured [ 21.339741] cdc_acm 1-1:1.2: ttyACM0: USB ACM device [ 21.345612] usbcore: registered new interface driver cdc_acm [ 21.351460] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters [ 21.383573] usbcore: registered new interface driver cdc_wdm [ 21.393810] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064 [ 21.401636] Backport generated by backports.git v5.15.58-1-0-g42a95ce7 [ 21.509515] usbcore: registered new interface driver usbserial_generic [ 21.516395] usbserial: USB Serial support registered for generic [ 21.616416] xt_time: kernel timezone is -0000 [ 21.635745] cdc_ether 1-1:1.6 usb0: register 'cdc_ether' at usb-1b000000.usb-1, ZTE CDC Ethernet Device, b2:5e:c8:ab:0b:c1 [ 21.647431] usbcore: registered new interface driver cdc_ether [ 21.674865] usbcore: registered new interface driver cdc_ncm [ 21.748302] usbcore: registered new interface driver huawei_cdc_ncm [ 21.994810] PPP generic driver version 2.4.2 [ 22.061821] NET: Registered protocol family 24 [ 22.077698] usbcore: registered new interface driver qmi_wwan [ 22.089633] rndis_host 1-1:1.0 usb1: register 'rndis_host' at usb-1b000000.usb-1, ZTE RNDIS device, de:ff:ff:85:f0:87 [ 22.100868] usbcore: registered new interface driver rndis_host [ 22.219955] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x56. [ 22.243891] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002) [ 22.250668] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0 [ 24.884750] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000 [ 24.894319] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 24.913500] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9888-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 59e741e7 [ 25.255918] ath10k_pci 0000:00:00.0: Loading BDF type 0 [ 25.264804] ath10k_pci 0000:00:00.0: board_file api 2 bmi_id 0:16 crc32 f228337a [ 27.036946] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16 peers: 48 tid: 96 [ 27.044733] ath10k_pci 0000:00:00.0: msdu-desc: 2500 skid: 32 [ 27.094718] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186 msdu-desc: 2500 sw-crypt: 0 ct-sta: 0' [ 27.106033] ath10k_pci 0000:00:00.0: wmi print 'free: 114572 iram: 12644 sram: 29508' [ 27.342184] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1 [ 27.523885] usbcore: registered new interface driver option [ 27.529718] usbserial: USB Serial support registered for GSM modem (1-port) [ 27.605204] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2 [ 27.651381] kmodloader: done loading kernel modules from /etc/modules.d/* [ 48.804622] eth0: link up (1000Mbps/Full duplex) [ 48.809430] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 48.832668] br-lan: port 1(eth0.1) entered blocking state [ 48.838260] br-lan: port 1(eth0.1) entered disabled state [ 48.844278] device eth0.1 entered promiscuous mode [ 48.849234] device eth0 entered promiscuous mode [ 48.877628] br-lan: port 1(eth0.1) entered blocking state [ 48.883257] br-lan: port 1(eth0.1) entered forwarding state [ 49.852457] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
Notes
Space for additional notes, links to forum threads or other resources.
- ...
Quirks and known issues
- It was observed, that CH340-based USB-UART converters output garbage during U-boot phase of system boot. At least CP2102 is known to work properly.
- Kernel partition size is increased to 4MB compared to stock 3MB, to accomodate future kernel updates, at this moment OpenWrt 5.10 kernel image is at 2.5MB which is dangerously close to the limit. This has no effect on booting the system - but keep that in mind when reassembling an image to restore stock firmware.
- uqmi seems to be unable to change APN manually, so please use the one you used before in stock firmware first. If you need to change it, please use protocok '3g' to establish connection once, or use the following command to change APN (and optionally IP type) manually:
echo -ne 'AT+CGDCONT=1,"IP","<apn>' > /dev/ttyUSB0
- The only usable LED as a “system LED” is the blue debug LED hidden inside the case. All other LEDs are controlled by modem, on which the router part has some influence only on Wi-Fi LED.
- Wi-Fi LED currently doesn't work while under OpenWrt, despite having correct GPIO mapping. All other LEDs are controlled by modem, including this one in stock firmware. GPIO19, mapped there only acts as a gate, while the actual signal source seems to be 5GHz Wi-Fi radio, however it seems it is not the LED exposed by ath10k as ath10k-phy0.
- GPIO5 used for modem reset is a suicide switch, causing a hardware reset of whole board, not only the modem. It is attached to gpio-restart driver, to restart the modem on reboot as well, to ensure LTE connectivity after reboot, which tends to fail otherwise.
- Modem, as in MF283+, exposes root shell over ADB - while not needed for OpenWrt operation at all - have fun lurking around. The same modem module is used as in older MF286.
Tags
Add tags below, then remove this fixme.