ZTE MF283+ is a dual-antenna LTE category 4 router, based on Ralink
RT3352 SoC, and built-in ZTE P685M PCIe MiniCard LTE modem.
Hardware highlighs:
- CPU: MIPS24KEc at 400MHz,
- RAM: 64MB DDR2,
- Flash: 16MB SPI,
- Ethernet: 4 10/100M port switch with VLAN support,
- Wireless: Dual-stream 802.11n (RT2860), with two internal antennas,
- WWAN: Built-in ZTE P685M modem, with two internal antennas and two
switching SMA connectors for external antennas,
- FXS: Single ATA, with two connectors marked PHONE1 and PHONE2,
internally wired in parallel by 0-Ohm resistors, handled entirely by
internal WWAN modem.
- USB: internal miniPCIe slot for modem,
unpopulated USB A connector on PCB.
- SIM slot for the WWAN modem.
- UART connector for the console (unpopulated) at 3.3V,
pinout: 1: VCC, 2: TXD, 3: RXD, 4: GND,
settings: 57600-8-N-1.
- LEDs: Power (fixed), WLAN, WWAN (RGB),
phone (bicolor, controlled by modem), Signal,
4 link/act LEDs for LAN1-4.
- Buttons: WPS, reset.
Installation:
As the modem is, for most of the time, provided by carriers, there is no
possibility to flash through web interface, only built-in FOTA update
and TFTP recovery are supported.
There are two installation methods:
(1) Using serial console and initramfs-kernel - recommended, as it
allows you to back up original firmware, or
(2) Using TFTP recovery - does not require disassembly.
(1) Using serial console:
To install OpenWrt, one needs to disassemble the
router and flash it via TFTP by using serial console:
- Locate unpopulated 4-pin header on the top of the board, near buttons.
- Connect UART adapter to the connector. Use 3.3V voltage level only,
omit VCC connection. Pin 1 (VCC) is marked by square pad.
- Put your initramfs-kernel image in TFTP server directory.
- Power-up the device.
- Press "1" to load initramfs image to RAM.
- Enter IP address chosen for the device (defaults to 192.168.0.1).
- Enter TFTP server IP address (defaults to 192.168.0.22).
- Enter image filename as put inside TFTP server - something short,
like firmware.bin is recommended.
- Hit enter to load the image. U-boot will store above values in
persistent environment for next installation.
- If you ever might want to return to vendor firmware,
BACK UP CONTENTS OF YOUR FLASH NOW.
For this router, commonly used by mobile networks,
plain vendor images are not officially available.
To do so, copy contents of each /dev/mtd[0-3], "firmware" - mtd3 being the
most important, and copy them over network to your PC. But in case
anything goes wrong, PLEASE do back up ALL OF THEM.
- From under OpenWrt just booted, load the sysupgrade image to tmpfs,
and execute sysupgrade.
(2) Using TFTP recovery
- Set your host IP to 192.168.0.22 - for example using:
sudo ip addr add 192.168.0.22/24 dev <interface>
- Set up a TFTP server on your machine
- Put the sysupgrade image in TFTP server root named as 'root_uImage'
(no quotes), for example using tftpd:
cp openwrt-ramips-rt305x-zte_mf283plus-squashfs-sysupgrade.bin /srv/tftp/root_uImage
- Power on the router holding BOTH Reset and WPS buttons held for around
5 seconds, until after WWAN and Signal LEDs blink.
- Wait for OpenWrt to start booting up, this should take around a
minute.
Return to original firmware:
Here, again there are two possibilities are possible, just like for
installation:
(1) Using initramfs-kernel image and serial console
(2) Using TFTP recovery
(1) Using initramfs-kernel image and serial console
- Boot OpenWrt initramfs-kernel image via TFTP the same as for
installation.
- Copy over the backed up "firmware.bin" image of "mtd3" to /tmp/
- Use "mtd write /tmp/firmware.bin /dev/mtd3", where firmware.bin is
your backup taken before OpenWrt installation, and /dev/mtd3 is the
"firmware" partition.
(2) Using TFTP recovery
- Follow the same steps as for installation, but replacing 'root_uImage'
with firmware backup you took during installation, or by vendor
firmware obtained elsewhere.
A few quirks of the device, noted from my instance:
- Wired and wireless MAC addresses written in flash are the same,
despite being in separate locations.
- Power LED is hardwired to 3.3V, so there is no status LED per se, and
WLAN LED is controlled by WLAN driver, so I had to hijack 3G/4G LED
for status - original firmware also does this in bootup.
- FXS subsystem and its LED is controlled by the
modem, so it work independently of OpenWrt.
Tested to work even before OpenWrt booted.
I managed to open up modem's shell via ADB,
and found from its kernel logs, that FXS and its LED is indeed controlled
by modem.
- While finding LEDs, I had no GPL source drop from ZTE, so I had to probe for
each and every one of them manually, so this might not be complete -
it looks like bicolor LED is used for FXS, possibly to support
dual-ported variant in other device sharing the PCB.
- Flash performance is very low, despite enabling 50MHz clock and fast
read command, due to using 4k sectors throughout the target. I decided
to keep it at the moment, to avoid breaking existing devices - I
identified one potentially affected, should this be limited to under
4MB of Flash. The difference between sysupgrade durations is whopping
3min vs 8min, so this is worth pursuing.
In vendor firmware, WWAN LED behaviour is as follows, citing the manual:
- red - no registration,
- green - 3G,
- blue - 4G.
Blinking indicates activity, so netdev trigger mapped from wwan0 to blue:wwan
looks reasonable at the moment, for full replacement, a script similar to
"rssileds" would need to be developed.
Behaviour of "Signal LED" in vendor firmware is as follows:
- Off - no signal,
- Blinking - poor coverage
- Solid - good coverage.
A few more details on the built-in LTE modem:
Modem is not fully supported upstream in Linux - only two CDC ports
(DIAG and one for QMI) probe. I sent patches upstream to add required device
IDs for full support.
The mapping of USB functions is as follows:
- CDC (QCDM) - dedicated to comunicating with proprietary Qualcomm tools.
- CDC (PCUI) - not supported by upstream 'option' driver yet. Patch
submitted upstream.
- CDC (Modem) - Exactly the same as above
- QMI - A patch is sent upstream to add device ID, with that in place,
uqmi did connect successfully, once I selected correct PDP context
type for my SIM (IPv4-only, not default IPv4v6).
- ADB - self-explanatory, one can access the ADB shell with a device ID
added to 51-android.rules like so:
SUBSYSTEM!="usb", GOTO="android_usb_rules_end"
LABEL="android_usb_rules_begin"
SUBSYSTEM=="usb", ATTR{idVendor}=="19d2", ATTR{idProduct}=="1275", ENV{adb_user}="yes"
ENV{adb_user}=="yes", MODE="0660", GROUP="plugdev", TAG+="uaccess"
LABEL="android_usb_rules_end"
While not really needed in OpenWrt, it might come useful if one decides to
move the modem to their PC to hack it further, insides seem to be pretty
interesting. ADB also works well from within OpenWrt without that. O
course it isn't needed for normal operation, so I left it out of
DEVICE_PACKAGES.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
[remove kmod-usb-ledtrig-usbport, take merged upstream patches]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 59d065c9f8)
[Manually remove no longer needed patches for modem]
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
While we mostly use the ucidef_set_led_* functions directly in 01_leds
we still have the set_wifi_led function in parallel for several old
devices. This is not only inconsistent with the other definitions,
it also links to the wlan0 interface instead of using a phy trigger
which would be independent of the interface name (and is used for
all newer devices anyway). Apart from that, the standard names
"wifi" and "wifi-led" are not very helpful in a world with different
radio bands either.
Thus, this patch removes the set_wifi_led function and puts the
relevant commands into the cases explicitly. This makes the
mechanism used more evident and will hopefully lead to some future
improvements or at least prevent some copy-pasting of the old
setups.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
In ramips, it's not common to use an alias for specifying the WiFi
LED; actually only one device uses this mechanism (TL-WR841N v14).
Particularly since the WiFi LEDs are typically distinguished between
2.4G and 5G etc. it is also not very useful for this target.
Thus, this patch removes the setup lines for this mechanism and
converts the TL-WR841N v14 to the normal setup.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Like in the previous patch for ath79 target, this will remove the
"devicename" from LED labels in ramips as well.
The devicename is removed in DTS files and 01_leds, consolidation
of definitions into DTSI files is done where (easily) possible,
and migration scripts are updated.
For the latter, all existing definitions were actually just
devicename migrations anyway. Therefore, those are removed and
a common migration file is created in target base-files. This is
actually another example of how the devicename removal makes things
easier.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This patch adds a trigger for the WAN LED and enhances support for
the WiFi LED by enabling activity indication.
This is based on bug report feedback (see reference below).
While at it, update the LED node names in DTS file.
Fixes: FS#732
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Device specification:
SoC: RT5350
CPU Frequency: 360 MHz
Flash Chip: Macronix MX25L6406E (8192 KiB)
RAM: Winbond W9825G6JH-6 (32768 KiB)
5x 10/100 Mbps Ethernet (4x LAN, 1x WAN)
1x external antenna
UART (J1) header on PCB (57800 8n1)
Wireless: SoC-intergated: 2.4GHz 802.11bgn
USB: None
8x LED, 2x button
Flash instruction:
Configure PC with static IP 192.168.99.8/24 and start TFTP server.
Rename "openwrt-ramips-rt305x-zyxel_keenetic-lite-b-squashfs-sysupgrade.bin"
to "rt305x_firmware.bin" and place it in TFTP server directory.
Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed until power LED start blinking.
Router will download file from TFTP server, write it to flash and reboot.
Signed-off-by: Sergei Burakov <senior.anonymous@ya.ru>
Olimex RT5350F-OLinuXino devices do not have a default MAC address, and there is
nothing at the 0x4 offset in the factory partition. Using a local address, which
is randomly generated by the kernel, would be a better choice.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
ramips images now relies on explicit switch setup for proper failsafe
functionality. Remove default cases where it relies on vlan setup in
dts and add switch setup for devices affected.
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
Commit 8f6334eb94 ("ramips: explicitly disable built-in switch when needed")
did not fix rt288x and rt3883 devices. This patch deals with them.
While at it, consolidate duplicate cases in interface setup.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
previously we rely on the failsafe setup in preinit scripts to disable
built-in switch implicitly for single-port devices. This doesn't work
anymore due to preinit script removal.
this patch explicitly disable built-in switch for needed devices.
Fixes: a8d62a4eb1 ("ramips: remove set_preinit_iface script")
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
This uses the flash locations instead of eth0 MAC address to
calculate MAC address increments for WAN.
The change will make the MAC address setup of a particular device
more obvious and removes the dependency of 02_network on the eth0
initialization.
This removes the wan_mac setup for the following devices as they
do not set up a MAC address for ethernet in the first place:
- asiarf,awapn2403
- belkin,f7c027
- dlink,dir-615-d
- mofinetwork,mofi3500-3gn
- prolink,pwh2004
- ralink,v22rw-2x2
- unbranded,wr512-3gn-4m
- unbranded,wr512-3gn-8m
While at it, make some DT node labels consistent with the label
property.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This replaces all uses of $(cat /sys/class/ieee80211/phyX/macaddress)
by retrieval from the proper flash locations. This will make
02_network independent of WiFi setup again.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
So far, MAC address assignment in ramips has contained a default
case, which defined wan_mac = eth0 + 1 for _every_ device not
having an explicit case there.
This is not desirable, as many device supporters will just not
care or know about this definition, so another MAC address will be
introduced by accident. In some cases the wan_mac is assigned
although it is not needed, in other cases even addresses not
dedicated to the device will be used (e.g. wan_mac actually is
eth0 - 1, but during support nobody cared, so eth0 + 1 is used now,
which might actually belong to another device ...).
Thus, in this PR the former default case is converted to an
explicit case. This one comprises all devices not being accounted
for by other cases, reduced by those not having wan at all.
The big number of entries for this node might be another indication
that many of them wouldn't actually be there if there hadn't been
default wan_mac setup.
In exchange, the current "do nothing" case can be removed, as it
will be the new default case.
The devices being put in the newly created explicit case were
determined as follows:
1. Create a list of all devices based on the DTS files.
2. Remove all devices already having an explicit entry setting
their address.
3. Remove all devices that only have lan set up in the first part
of 02_network:
mt7620:
- alfa-network,tube-e4g
- asus,rp-n53
- buffalo,wmr-300
- comfast,cf-wr800n
- edimax,ew-7476rpc
- edimax,ew-7478ac
- elecom,wrh-300cr
- hnet,c108
- kimax,u25awf-h1
- kimax,u35wf
- kingston,mlw221
- kingston,mlwg2
- microduino,microwrt
- netgear,ex2700
- netgear,ex3700
- netgear,wn3000rp-v3
- planex,cs-qr10
- planex,mzk-ex300np
- planex,mzk-ex750np
- ravpower,wd03
- sercomm,na930
- yukai,bocco
- zbtlink,zbt-cpe102
- zte,q7
mt7621:
- gnubee,gb-pc1
- gnubee,gb-pc2
- linksys,re6500
- mikrotik,rbm11g
- netgear,ex6150
- thunder,timecloud
- tplink,re350-v1
- tplink,re650-v1
mt76x8:
- alfa-network,awusfree1
- d-team,pbr-d1
- glinet,vixmini
- vocore,vocore2-lite
- tama,w06
- tplink,tl-mr3020-v3
- tplink,tl-wa801nd-v5
- tplink,tl-wr802n-v4
- tplink,tl-wr902ac-v3
- vocore,vocore2
- widora,neo-16m
- widora,neo-32m
rt288x:
- buffalo,wli-tx4-ag300n
- dlink,dap-1522-a1
rt305x:
- allnet,all0256n-4m
- allnet,all0256n-8m
- allnet,all5002
- allnet,all5003
- alphanetworks,asl26555-16m
- alphanetworks,asl26555-8m
- asus,wl-330n
- aximcom,mr-102n
- dlink,dcs-930
- easyacc,wizard-8800
- hame,mpr-a2
- hootoo,ht-tm02
- huawei,d105
- intenso,memory2move
- planex,mzk-dp150n
- rt305x dlink,dcs-930l-b1
- sparklan,wcr-150gn
- tenda,3g150b
- tenda,3g300m
- tenda,w150m
- trendnet,tew-638apb-v2
- unbranded,a5-v11
- vocore,vocore-16m
- vocore,vocore-8m
- wansview,ncs601w
- zorlik,zl5900v2
rt3883:
- loewe,wmdr-143n
- omnima,hpm
4. Put the remaining devices in the new case.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
While most of the target's contents are split into subtargets, the
base-files are maintained for the target as a whole.
However, OpenWrt already implements a mechanism that will use (and
even prefer) files in the subtargets' directories. This can be
exploited to make several scripts subtarget-specific and thus save
some space.
In certain cases, keeping files in parent (=target) base-files was
more convenient, and thus no splitting was performed for those.
Note that this will increase overall code lines, but reduce code
per subtarget.
base-files ipk size reduction:
master (mt7621) 60958 B
split (mt7620) 46358 B (- 14.3 kiB)
split (mt7621) 48759 B (- 11.9 kiB)
split (mt76x8) 44948 B (- 15.6 kiB)
split (rt288x) 43508 B (- 17.0 kiB)
split (rt305x) 45616 B (- 15.0 kiB)
split (rt3883) 44176 B (- 16.4 kiB)
Run-tested on:
GL.iNet GL-MT300N-V2 (mt76x8)
D-Link DWR-116 (mt7620)
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
