mirror of
https://github.com/openwrt/openwrt.git
synced 2025-01-10 23:12:48 +00:00
023a8853c8
The ZTE MF287+ is a LTE router used (exclusively?) by the network operator
"3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only
difference is the LTE modem)
Specifications
==============
SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287)
WiFi: 802.11a/b/g/n/ac SoC-integrated
MAC addresses
=============
LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1
Installation
============
Option 1 - TFTP
---------------
TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:
setenv serverip 192.168.1.100
setenv ipaddr 192.168.1.1
tftpboot 0x82000000 openwrt.bin
bootm 0x82000000
From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:
ubiattach -m14
cat /dev/ubi0_0 > /tmp/ubi0_0
cat /dev/ubi0_1 > /tmp/ubi0_1
Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.
Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:
ubirmvol /dev/ubi0 -N ubi_rootfs
ubirmvol /dev/ubi0 -N kernel
Option 2 - From stock firmware
------------------------------
The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.
The exploit will be available at the device wiki page.
Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".
ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".
Complete commands:
cd /tmp
tftp -g -r factory.bin 192.168.0.22
cat /proc/driver/sensor_id
flash_erase /dev/mtd13 0 0
dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072
Afterwards, reboot your device and you should have a working OpenWrt
installation.
Restore Stock
=============
Option 1 - via UART
-------------------
Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.
Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.
ubiattach -m 14
ubirmvol /dev/ubi0 -N kernel
ubirmvol /dev/ubi0 -N rootfs
ubirmvol /dev/ubi0 -N rootfs_data
ubimkvol /dev/ubi0 -N kernel -s $kernel_length
ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1
Option 2 - from within OpenWrt
------------------------------
This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.
Follow the commands from Option 1 to flash back to stock.
LTE Modem
=========
The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.
Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.
Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit f70ee53b08)
134 lines
4.7 KiB
Makefile
134 lines
4.7 KiB
Makefile
include $(TOPDIR)/rules.mk
|
|
include $(INCLUDE_DIR)/version.mk
|
|
|
|
PKG_NAME:=ipq-wifi
|
|
PKG_RELEASE:=1
|
|
|
|
PKG_SOURCE_PROTO:=git
|
|
PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware/qca-wireless.git
|
|
PKG_SOURCE_DATE:=2023-06-03
|
|
PKG_SOURCE_VERSION:=cd9c30ca47b8e5388b770c523a7f6b8b969e2f92
|
|
PKG_MIRROR_HASH:=45e623fcc512b514ade0f22e217275536aa8de4afba7dfdb11696482b8fa71a2
|
|
|
|
PKG_FLAGS:=nonshared
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
|
|
define Build/Compile
|
|
endef
|
|
|
|
# Use ath10k-bdencoder from https://github.com/qca/qca-swiss-army-knife.git
|
|
# to generate the board-* files here.
|
|
#
|
|
# This is intended to be used on an interim basis until device-specific
|
|
# board data for new devices is available through the upstream compilation
|
|
#
|
|
# Please send a mail with your device-specific board files upstream.
|
|
# You can find instructions and examples on the linux-wireless wiki:
|
|
# <https://wireless.wiki.kernel.org/en/users/drivers/ath10k/boardfiles>
|
|
|
|
ALLWIFIBOARDS:= \
|
|
buffalo_wxr-5950ax12 \
|
|
compex_wpq873 \
|
|
dynalink_dl-wrx36 \
|
|
edgecore_eap102 \
|
|
edimax_cax1800 \
|
|
netgear_wax218 \
|
|
prpl_haze \
|
|
qnap_301w \
|
|
redmi_ax6 \
|
|
wallys_dr40x9 \
|
|
xiaomi_ax3600 \
|
|
xiaomi_ax9000 \
|
|
zte_mf287plus \
|
|
zyxel_nbg7815
|
|
|
|
ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
|
|
|
|
define Package/ipq-wifi-default
|
|
SUBMENU:=ath10k Board-Specific Overrides
|
|
SECTION:=firmware
|
|
CATEGORY:=Firmware
|
|
DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x||TARGET_ipq807x)
|
|
TITLE:=Custom Board
|
|
endef
|
|
|
|
define ipq-wifi-install-one-to
|
|
$(INSTALL_DIR) $(2)/lib/firmware/ath10k/$(3)/
|
|
$(INSTALL_DATA) $(1) $(2)/lib/firmware/ath10k/$(3)/board-2.bin
|
|
endef
|
|
|
|
define ipq-wifi-install-ath11-one-to
|
|
$(INSTALL_DIR) $(2)/lib/firmware/ath11k/$(3)/
|
|
$(INSTALL_DATA) $(1) $(2)/lib/firmware/ath11k/$(3)/board-2.bin
|
|
endef
|
|
|
|
define ipq-wifi-install-one
|
|
$(if $(filter $(suffix $(1)),.QCA4019 .qca4019),\
|
|
$(call ipq-wifi-install-one-to,$(1),$(2),QCA4019/hw1.0),\
|
|
$(if $(filter $(suffix $(1)),.QCA9888 .qca9888),\
|
|
$(call ipq-wifi-install-one-to,$(1),$(2),QCA9888/hw2.0),\
|
|
$(if $(filter $(suffix $(1)),.QCA9889 .qca9889),\
|
|
$(call ipq-wifi-install-one-to,$(1),$(2),QCA9887/hw1.0),\
|
|
$(if $(filter $(suffix $(1)),.QCA9984 .qca9984),\
|
|
$(call ipq-wifi-install-one-to,$(1),$(2),QCA9984/hw1.0),\
|
|
$(if $(filter $(suffix $(1)),.QCA99X0 .qca99x0),\
|
|
$(call ipq-wifi-install-one-to,$(1),$(2),QCA99X0/hw2.0),\
|
|
$(if $(filter $(suffix $(1)),.IPQ8074 .ipq8074),\
|
|
$(call ipq-wifi-install-ath11-one-to,$(1),$(2),IPQ8074/hw2.0),\
|
|
$(if $(filter $(suffix $(1)),.QCN9074 .qcn9074),\
|
|
$(call ipq-wifi-install-ath11-one-to,$(1),$(2),QCN9074/hw1.0),\
|
|
$(error Unrecognized board-file suffix '$(suffix $(1))' for '$(1)')\
|
|
)))))))
|
|
|
|
endef
|
|
# Blank line required at end of above define due to foreach context
|
|
|
|
define generate-ipq-wifi-package
|
|
define Package/ipq-wifi-$(1)
|
|
$(call Package/ipq-wifi-default)
|
|
TITLE:=board-2.bin Overrides for $(2)
|
|
CONFLICTS:=$(PREV_BOARD)
|
|
endef
|
|
|
|
define Package/ipq-wifi-$(1)/description
|
|
The $(2) requires board-specific, reference ("cal") data
|
|
that is not yet present in the upstream wireless firmware distribution.
|
|
|
|
This package supplies board-2.bin file(s) that, in the interim,
|
|
overwrite those supplied by the ath10k-firmware-* packages.
|
|
|
|
This is package is only necessary for the $(2).
|
|
|
|
Do not install it for any other device!
|
|
endef
|
|
|
|
define Package/ipq-wifi-$(1)/install-overlay
|
|
$$$$(foreach IPQ_WIFI_BOARD_FILE,$$$$(wildcard $(PKG_BUILD_DIR)/board-$(1).*),\
|
|
$$$$(call ipq-wifi-install-one,$$$$(IPQ_WIFI_BOARD_FILE),$$(1)))
|
|
endef
|
|
|
|
PREV_BOARD+=ipq-wifi-$(1)
|
|
endef
|
|
|
|
# Add board name to ALLWIFIBOARDS
|
|
# Place files in this directory as board-<devicename>.<qca4019|qca9888|qca9889|qca9984|qca99x0|ipq8074>
|
|
# Add $(eval $(call generate-ipq-wifi-package,<devicename>,<display name>))
|
|
|
|
$(eval $(call generate-ipq-wifi-package,buffalo_wxr-5950ax12,Buffalo WXR-5950AX12))
|
|
$(eval $(call generate-ipq-wifi-package,compex_wpq873,Compex WPQ-873))
|
|
$(eval $(call generate-ipq-wifi-package,dynalink_dl-wrx36,Dynalink DL-WRX36))
|
|
$(eval $(call generate-ipq-wifi-package,edgecore_eap102,Edgecore EAP102))
|
|
$(eval $(call generate-ipq-wifi-package,edimax_cax1800,Edimax CAX1800))
|
|
$(eval $(call generate-ipq-wifi-package,netgear_wax218,Netgear WAX218))
|
|
$(eval $(call generate-ipq-wifi-package,qnap_301w,QNAP 301w))
|
|
$(eval $(call generate-ipq-wifi-package,prpl_haze,prpl Haze))
|
|
$(eval $(call generate-ipq-wifi-package,redmi_ax6,Redmi AX6))
|
|
$(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
|
|
$(eval $(call generate-ipq-wifi-package,xiaomi_ax3600,Xiaomi AX3600))
|
|
$(eval $(call generate-ipq-wifi-package,xiaomi_ax9000,Xiaomi AX9000))
|
|
$(eval $(call generate-ipq-wifi-package,zte_mf287plus,ZTE MF287Plus))
|
|
$(eval $(call generate-ipq-wifi-package,zyxel_nbg7815,Zyxel NBG7815))
|
|
|
|
$(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
|