ipq4019: add support for ZTE MF287+ aka DreiNeo #12708
Conversation
github-actions
bot
added
core packages
andyboeh
force-pushed
the
zte_mf287plus
branch
3 times, most recently
from
463dcf3
to
b379e60
Compare
andyboeh
force-pushed
the
zte_mf287plus
branch
4 times, most recently
from
ebf1808
to
f3e8f4e
Compare
|
@hauke You approved my PR for the MF282, this device is very similar although the target is different - any chance it can be added to 23.05? |
Some ZTE devices require the gpio-restart driver to support restarting the LTE modem along with OpenWrt Signed-off-by: Andreas Böhler <dev@aboehler.at>
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator "3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only difference is the LTE modem) Specifications ============== SoC: IPQ4018 RAM: 256MiB Flash: 8MiB SPI-NOR + 128MiB SPI-NAND LAN: 4x GBit LAN LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287) WiFi: 802.11a/b/g/n/ac SoC-integrated MAC addresses ============= LAN: from config + 2 WiFi 1: from config WiFi 2: from config + 1 Installation ============ Option 1 - TFTP --------------- TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing: setenv serverip 192.168.1.100 setenv ipaddr 192.168.1.1 tftpboot 0x82000000 openwrt.bin bootm 0x82000000 From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download: ubiattach -m14 cat /dev/ubi0_0 > /tmp/ubi0_0 cat /dev/ubi0_1 > /tmp/ubi0_1 Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save. Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first: ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N kernel Option 2 - From stock firmware ------------------------------ The installation from stock requires an exploit first. The exploit consists of a backup file that forces the firmware to download telnetd via TFTP from 192.168.0.22 and run it. Once exploited, you can connect via telnet and login as admin:admin. The exploit will be available at the device wiki page. Once inside the stock firmware, you can transfer the -factory.bin file to /tmp by using "scp" from the stock frmware or "tftp". ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write access - you need to read from one file in /proc. Once done, you need to erase the UBI partition and flash OpenWrt. Before performing the operation, make sure that mtd13 is the partition labelled "rootfs" by calling "cat /proc/mtd". Complete commands: cd /tmp tftp -g -r factory.bin 192.168.0.22 cat /proc/driver/sensor_id flash_erase /dev/mtd13 0 0 dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072 Afterwards, reboot your device and you should have a working OpenWrt installation. Restore Stock ============= Option 1 - via UART ------------------- Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp. Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes. ubiattach -m 14 ubirmvol /dev/ubi0 -N kernel ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N rootfs_data ubimkvol /dev/ubi0 -N kernel -s $kernel_length ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0 ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1 Option 2 - from within OpenWrt ------------------------------ This option requires to flash an initramfs version first so that access to the flash is possible. This can be achieved by sysupgrading to the recovery.bin version and rebooting. Once rebooted, you are again in a default OpenWrt installation, but no partition is mounted. Follow the commands from Option 1 to flash back to stock. LTE Modem ========= The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management. Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface. Signed-off-by: Andreas Böhler <dev@aboehler.at>
|
Please create a new pull request with the backport to the 23.05 branch to get it integrated into the 23.05 release. |
|
Funktioniert OpenWRT jetzt auch auf dem ZTE MF282 ? Wenn ja währe super wenns da eine .bin (mit GUI:-)) File gäbe bekomm das anders nicht zum laufen |
|
This comment refers to an entirely different device and is in German. Please ask your question in the OpenWrt Forum at https://forum.openwrt.org For the sake of completeness: Bitte stell diese Frage im OpenWrt Forum und auf Englisch, du beziehst dich hier auf einen anderen Router. |
Thanks for the answer and its completeness :-) I thought you had a working .bin file for me because you wrote on your homepage that you were using such a router. Since the router is an exclusive 3 product, I would ask it in German because probably not many 3 routers will appear in English-speaking countries |
This issue tracker as well as the OpenWrt forum in general are English-speaking. I find it rude if people don't post in English, no matter what the question is. You will get an answer to your question including links to binary builds once you ask in the OpenWrt forum - this issue refers to an entirely different device and has been closed several weeks ago. It's simply the wrong spot. Edit: That would be the MF282 thread: https://forum.openwrt.org/t/adding-openwrt-support-for-zte-mf282-aka-3-huitube/157177 |
|
Hier besser als das komische LTE Forum und von dem der Thread https://www.aboehler.at/doku/doku.php/projects:zte_mf28x#restore_stock |
|
@KittyBua This thread, the issue tracker and the OpenWrt forum are all English-speaking. Obviously, you didn't even read my previous comment which stated:
That said: You are linking to my private website. While this is OK, I did not do it for a simple reason: This page will be deleted soon. The content will be migrated where it belongs: To the OpenWrt forum. |
|
OK No Problem P.s. can you add this Skript in openwrt this Work on my 297 and 287+ good https://miononno.it/files/zte-mf297d/v1.0.min.js https://youtu.be/ZhV8nfW2ywI?si=UaDWCuSfNmO2iAaA OK thanks 👍 No Problemo all good Good day |
|
I hate it to repeat myself, but: this issue was about adding support for OpenWrt to a specific device. It was closed months ago. If you have feature requests, please post to the OpenWrt forum in the "Feature Requests" category. |
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator "3". The MF287 (i.e. non-plus 3Neo) is also supported. The only difference is the LTE modem.
Specifications
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
Option 1 - TFTP
TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download:
ubiattach -m14
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd13 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
Option 1 - via UART
Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 14
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management.
Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface.
A note on board files: A patch for qca-wireless has been sent to the mailing list.