The ZTE MF287 Pro is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF287+, but the hardware layout
and partition layout have changed quite a bit.
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12
WiFi: 802.11a/b/g/n/ac SoC-integrated
USB: 1x 2.0
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m17
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd17 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 17
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Other Notes
===========
Contrary to the stock firmware, the USB port on the back can be used.
There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit edfe91372a)
Commit e978072baaca ("Do prune_association only after the STA is
authorized") causes issues when an STA roams from one interface to
another interface on the same PHY. The mt7915 driver is not able to
handle this properly. While the commits fixes a DoS, there are other
devices and drivers with the same limitation, so revert to the orginal
behavior for now, until we have a better solution in place.
Fixes: #13156
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
(cherry picked from commit 324673914d)
This brings the 23.05 branch into parity with the main.
kmod-sfp was in the main branch profile but not the 23.05 version.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
The kernel FSL_ENETC_QOS option is only a compile time
option, it does not result in a separate module being built.
Set it to 'y' to resolve a warning from the kernel compile:
.config:2654:warning: symbol value 'm' invalid for FSL_ENETC_QOS
Signed-off-by: Mathew McBride <matt@traverse.com.au>
Fixes: c3151b6f04 ("armvirt: 64: add support for other SystemReady-compatible vendors")
(cherry picked from commit 7770d08e2b)
This MDIO driver was already being built, but not installed due
to being selected by the ThunderX Ethernet driver.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 0018b33531)
The initial armv8 module incorrectly labelled the Thunder(v1) as
supporting the ThunderX2, when they have different drivers.
Add kmod-octeon-tx2 to support the newer devices.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 7c5bdff9c4)
kmod-bcmgenet is needed for Ethernet support on the
Raspberry Pi 4.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 911ee97774)
These are used by common Broadcom SoC's like
the BCM2711 (RPi4) and iProc network processor.
Tested on the RPi4B using the Raspberry Pi
UEFI+ACPI firmware[1].
Signed-off-by: Mathew McBride <matt@traverse.com.au>
[1] - https://github.com/pftf/RPi4
(cherry picked from commit 27ca83c627)
When comparing the generated OpenWrt .config to the Linux arm64
defconfig, I noticed these SATA controllers were not included.
As they may be used as a boot drive, they should be built into
the kernel.
CONFIG_SATA_MVEBU is for Marvell platforms.
CONFIG_SATA_QORIQ is for NXP Layerscape.
CONFIG_SATA_SIL24 is for Arm's Juno development board, see Linux
kernel commit d7c38ff1cd86 ("arm64: defconfig: Add Juno SATA
controller").
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 9cb173e9f1)
This turns on various PCI related options which are enabled
in the Linux kernel arch/arm64/configs/defconfig but not
yet in the OpenWrt config.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 15d3536c9d)
This is part of an effort to reduce differences between
the OpenWrt armsr/armv8 config and Linux arm64 defconfig.
This enables CONFIG_ARCH_BCM and downstream
CONFIG_ARCH_BCM2835 (= BCM2711 like Raspberry Pi 4)
and CONFIG_ARCH_BCM_IPROC (Broadcom iProc packet processors).
The broadband specific SoC's (ARCH_BCMBCA) are left out
as it is assumed these will not be doing EFI boot.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.5/5.15 version of commit df23eed179)
Renesas markets several embedded Arm64 SoCs in the
RZ series (RZ/G, RZ/V), so should be enabled in
a general purpose target.
Automotive (R-Car) SoC's are not enabled by this change.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 1ff4f4df23)
A review of the generated OpenWrt kernel .config
vs the Linux arm64 defconfig showed that this
option was not being enabled, as it is disabled
in OpenWrt's generic config.
ACPI_BUTTON is needed to report and respond to
power button events, so it should be enabled.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit c4c60e4b19)
To bring the armsr/armv8 kernel configuration closer to the Linux
arm64 defconfig, synchronize options related to CPU features
(especially more recent Armv8.X variants), scheduler, EFI vars,
CMA and scheduler options.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version commit 22e0c7be47)
x86/64 enables support for KVM so I can't see a reason why
not on armsr/armv8 as well.
Arm CPU errata workaround items related to virtualization
are also enabled by this change.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit e505873e65)
CONFIG_ARM_PMU (Arm Performance Monitor Unit) is a requirement
to use KVM (virtualization) from Linux 5.11+, as the virtualised
guest has virtualized PMU access.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(cherry picked from commit 76d4a7c84a)
To reduce differences with the Linux arm64 defconfig,
sync the enabled erratum items with defconfig.
There are still some options not selected due to
CONFIG_KVM or other options not enabled in OpenWrt
by default.
Signed-off-by: Mathew McBride <matt@traverse.com.au>
(23.05/5.15 version of commit 5c4239ac3f)
Support for PF_XDP sockets monitoring interface used by the ss tool.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 06e64f9b36)
The ide-drive option was renamed to ide-hd in qemu 6.0.
With this change qemu is starting again on Debian 12.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 497012ab4e)
This compiles the CONFIG_PTP_1588_CLOCK support into the kernel binary
and activates the drivers for KVM and VMware which allow syncing the
host time with the VM when OpenWrt is running in a VM. With this change
the CONFIG_HYPERV_UTILS driver is now build into the kernel, because it
depends on the PTP framework being compiled in. CONFIG_HYPERV_UTILS was
build as a module, but not packages before.
Fixes: #13277
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 54d470ed0e)
This activates PCI Express ASPM control in Linux. Without this option it
is completely controlled by the BIOS, now Linux will take over and apply
some workarounds if needed.
Fixes: #13248
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit ff71035751)
Add u-boot env config for Xiaomi mi-mini for using fw_printenv and fw_setenv on this board
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
(cherry picked from commit a87bc138cf)
Sets status indications led color on Xiaomi mi-mini router as other Xiaomi routers
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
(cherry picked from commit 54e5e396c5)
It seems that the Meraki bootloader does not respect the kernel ARM booting
specification[1] that requires that address where DTB is located needs to
be 64-bit aligned and often places the DTB on a non 64-bit aligned address
and then kernel fails to find the DTB magic and fails to boot.
Even worse, there is no prints until early printk is enabled and then its
visible that kernel is trying to find the ATAG-s as DTB was not found or
is invalid.
Unifi 6 devices had the same issue and it can be solved by passing the
load adress as part of the FIT image.
It seems that the vendor was aware of the issue and is always relocating
the DTB to 0x89000000, so lets just do the same.
Now that booting is reliable, reenable default images for the Meraki MR33
and MR74 devices.
Reviewed-by: Lech Perczak lech.perczak@gmail.com
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit f1c80445bd)
ipq40xx was converted to DSA and swconfig is not being included at all in
the default packages so there is no need to drop it from device packages.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit bb4a25860f)
MR33 and MR74 share pretty much everything in the image recipe, so lets
extract a common recipe to avoid duplication.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 9e9dc1890c)
This updates the Intel iwlwifi firmware for AX200 and AX210 from version
66 to version 72. Version 72 is the latest version supported by iwlwifi
from kernel 6.1.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 00ce1c0587)
This reverts commit ec6bcda8e4.
patchelf 0.18.0 requires GCC 8, it does not compile using GCC 7 any
more. Downgrade to patchelf 0.17.2 which still supports GCC 7.
Downgrade patchelf to 0.17.2 only in the OpenWrt 23.05 branch and
require GCC 8 in the master branch.
Ubuntu 18.04 uses GCC 7 by default.
Fixes: #13102
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Rename two patches which were only accepted in Linux 6.2, but were
marked as if they were accepted in Linux 6.1.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 42e14d3ed8)
the Marvell 10G PHY driver is no way specific to ARM SystemReady
systems, it frequently occurs on SFP+ copper modules and is useful on
many targets.
Hence it been added to package/kernel/linux/modules/netdevices and we
can remove the now redundant target-specific module.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c524a76f4c)
Instead of reading only a single 4kiB page, read the first 128kiB to
determine the size of an uImage.FIT using 'imsz' or 'imszb'.
This will be needed once we add more Device Tree Overlays, which may
happen for the BPi-R3 mini.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3c2f7bb555)
A dependency of the MT7988 MMC host controller on the SoC's RTC clock
being running has been discovered. Mark RTC clock as critical to fix
MMC host on MT7988.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 0454691960)
This has been a part of modified upstream patch but got lost on major
kernel bump to 5.15, so bring it back.
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
[Add patch for kernel 6.1 too]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5e6bab661a)
Add support for the SKBPRIO queuing discipline. This is subtly
different than prio as it also drops packets from the lower priority
flows.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
(cherry picked from commit 8fba9afda5)
return ubnt_rocket-m and ubnt_powerbridge-m back to ath79-generic
They have enough RAM-ressources to not be considered as tiny.
This reverts the commit f4415f7635 partially
Signed-off-by: Felix Baumann <felix.bau@gmx.de>
(cherry picked from commit 9e86a96af5)
Add the __extension__ mark before #include_next in strings.h
to avoid a compiler error when -pedantic is enabled.
This has been done for all other headers in the past.
Signed-off-by: Matthias Van Parys <matthias.vanparys@softathome.com>
(cherry picked from commit 2425d6df12)
colrm is already built, package just isn't generated.
colrm can be used to remove columns from file/stdin.
Use cases vary, personally I needed it because I build openwrt
natively - and wolfssl configure script wants either colrm, or cut
but busybox's cut isn't accepted.
Built: x86_64, latest git
Tested: x86_64, latest git
Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
(cherry picked from commit e21b4c9636)