User Tools

Site Tools


toh:zte:mf10

ZTE MF10

Small wifi access point with one USB port for plugging a 3G modem.

Forum: https://forum.openwrt.org/viewtopic.php?id=59649

Supported Versions

Not officially supported

There isn't enough RAM to support this router with latest Openwrt versions. Support is possible using an old Openwrt version such as Attitude Adjustment or older release.

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
RT3050 @ 320 MHz 16 MiB 8 MiB 2x 10/100 MBit/s Yes Yes ?

Flash Layout

0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x00120000 : "Kernel" 0x00120000-0x00400000 : "RootFS"

Flash backup

We can backup every partition with this procedure:

  1. Telnet the device at port 4719
  2. Execute this command for "fake" mounting /dev into web server:
    mount --bind /dev /etc_ro/web/

Flash backup made by vk496: zte-mf10-flash_backup.tar.gz

Installation

We can use the "Attitude Adjustment" firmware version from the carambola device openwrt-ramips-rt305x-carambola-squashfs-sysupgrade.bin. Although this firmware is compatible, leds won't work.

OEM installation using the TFTP method

  • Connect the serial TTL cable to interact with uBoot for loading the firmware via tftp.
  • Start a TFTP server in your PC. Copy the openwrt-ramips-rt305x-carambola-squashfs-sysupgrade.bin firmware to the server.
  • Rename the firmware to sysupgrade.bin
  • Set the IP at your pc to 192.168.0.22, and connect the ethernet cable to the router.
  • Power on the router and immediately press the 2 key at the serial console. Say yes for flashing the new firmware. 2: System Load Linux Kernel then write to Flash via TFTP. Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) Please Input new ones /or Ctrl-C to discard Input device IP (192.168.0.1) ==: Input server IP (192.168.0.22) ==: Input Linux Kernel filename () ==:sysupgrade.bin
  • Wait until flash procedure finish and wait for Openwrt. Set a dynamic IP on your computer and telnet Openwrt or browse to http://192.168.1.1 and set a root password.

Installation from the OEM firmware

Serial port adapter not required. You can access to the router via telnet at port 4719, and then flash the OpenWrt firmware.

Thanks to pgid69 who developed this brilliant procedure:

  1. Compile a minimal version of OpenWrt 12.09 for Carambola device. Personnally, I don't include ramzswap, because OpenWrt 12.09 already includes compcache (you just have to enable BUSYBOX_SWAPON first, in order to see and enable compache in submenu utilities)
  2. Split the firmware image in two parts with command dd.
    dd if=openwrt-ramips-rt305x-carambola-squashfs-sysupgrade.bin of=/var/local/tftp-root/kernel bs=1310720 count=1 dd if=openwrt-ramips-rt305x-carambola-squashfs-sysupgrade.bin of=/var/local/tftp-root/rootfs bs=65536 skip=20
    The size of the first part correspond to the size of mtd partition Kernel of the router. You have to check that the size of this MTD partition Kernel is the same on YOUR device (see files /proc/mtd and /proc/partitions) and that the partition RootFS is just after Kernel partition. To check that the split is ok, make "cat kernel rootfs > image" and compute md5sum on image and openwrt-ramips-rt305x-carambola-squashfs-sysupgrade.bin. Of course the results must be the same
  3. From the sources of OpenWrt 12.09, compile a version of busybox, linked with static libraries and that includes a TFTP client or wget or whatever you like to transfer a file. Includes md5sum too because it's useful to check integrity of file transfer.
  4. Transfer busybox with telnet using an expect script. You can find here https://github.com/pgid69/shell_trx a small program I developped to generate the expect script from busybox binary. Read the README and the example where i explain how to make the file transfered have execution right as there is no chmod on the router.
    Transfer is slow and takes a few minutes. When it's done first check the size of busybox and run "./busybox md5sum busybox" to check the transfer is ok.
    I recommend to transfer busybox in ramfs (directory /var for example) because it will be used only to transfer the two parts of the firmware.
  5. Free the maximum of memory on the router (stop wifi, remove unnecessary kernel modules, stop the maximum of processes, unmount useless mounts) and transfer the two parts of the OpenWrt firmware generated at step 2 (with tftp or wget) in ramfs (directory /var for example). Use md5sum to check the transfers are ok.
  6. Eventually remove the version busybox transferred at step 4 to free some additional memory and write the two parts of the OpenWrt firmware with mtd_write.
    mtd_write write /var/kernel Kernel mtd_write -r write /var/rootfs RootFS
    The order is very important : you must overwrite the Kernel partition first and then the RootFS. Note the flag -r on the second command mtd_write to reboot the router. Do not use the flag on the first command.

That's all : OpenWrt is now installed in the router.

After that i finally i made a small patch to OpenWrt 12.09 to add support to specific GPIOs of the ZTE MF10 : in the patch the two leds PPP and WPS are handled, and also the two buttons ON/OFF and WPS. I don't find the GPIO (if they exist) associated to leds POWER and WLAN. WLAN leds is already driven by Wifi kernel module. At the start of OpenWrt the two buttons allows to enter failsafe mode. The patch is here → https://github.com/pgid69/openwrt-12.09-zte-mf10

Hardware

Info

Architecture: MIPS
Vendor: Ralink
Bootloader: U-Boot
System-On-Chip: RT3050F
CPU/Speed MIPS 24K V4.12 / 320 Mhz
Flash-Chip: Macronix 29LV640DBTC-90G
Flash size: 8 MiB
RAM: 16 MiB
Wireless: integrated RT3050 1x1 802.11n 2.4GHz
Ethernet: 10/100 Mbit/s w/ vlan support
USB: Yes
Serial: Yes
JTAG: ?

Photos

Opening the case

Note: This will void your warranty!

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

FIXME

Below the flash chip

GND TX RX VCC

Don't connect VCC!. Configure your UART TTL adapter to 115200,8,N,1.

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

Unknown.

Bootlogs

OEM Bootlog

U-Boot 1.1.3 (Feb 26 2009 - 13:21:58) Board: Ralink APSoC DRAM: 16 MB relocate_code Pointer at: 80fac000 mips_cpu_feq=320000000 flash_protect ON: from 0xBF000000 to 0xBF0202E3 protect on 0 protect on 1 protect on 2 protect on 3 protect on 4 protect on 5 protect on 6 protect on 7 protect on 8 protect on 9 flash_protect ON: from 0xBF030000 to 0xBF03FFFF protect on 10 *** Warning - bad CRC, using default environment ============================================ ZTE UBoot Version: 1.0.1 -------------------------------------------- ASIC 3052_MP2 (Port5<->None) DRAM COMPONENT: 128Mbits DRAM BUS: 16BIT Total memory: 16 MBytes Date:Feb 26 2009 Time:13:21:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 freq = 320000000 MHZ ##### The CPU freq = 320 MHZ #### SDRAM bus set to 16 bit SDRAM size =16 Mbytes PHY0 and PHY1 are used ,and other PHYS are powered down Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bf050000 ... Image Name: Linux Kernel Image Created: 2009-12-10 13:52:52 UTC System Control Status = 0x00400000 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3104704 Bytes = 3 MB Load Address: 80000000 Entry Point: 802d5000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 802d5000) ... ## Giving linux memsize in MB, 16 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #57 Thu Dec 10 08:52:33 EST 2009 The CPU feqenuce set to 320 MHz CPU revision is: 0001964c Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Built 1 zonelists. Total pages: 4064 Kernel command line: console=ttyS1,115200n8 root=/dev/mtdblock4 Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled cause = 9080000c, status = 1100ff00 PID hash table entries: 64 (order: 6, 256 bytes) calculating r4koff... 00138800(1280000) CPU frequency 320.00 MHz Using 160.000 MHz high precision timer. Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 13116k/16384k available (2413k kernel code, 3268k reserved, 483k data, 120k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro io scheduler noop registered (default) FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB Ralink gpio driver initialized spidrv_major = 217 HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A loop: loaded (max 8 devices) rdm_major = 254 GDMA1_MAC_ADRH -- : 0x00000000 GDMA1_MAC_ADRL -- : 0x00000000 Ralink APSoC Ethernet Driver Initilization. v1.60 64 rx/tx descriptors allocated, mtu = 1500! GDMA1_MAC_ADRH -- : 0x00000016 GDMA1_MAC_ADRL -- : 0x0026ed2b PROC INIT OK! PPP generic driver version 2.4.2 PPP BSD Compression module registered NET: Registered protocol family 24 ralink flash device: 0x1000000 at 0xbf000000 Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. Creating 5 MTD partitions on "Ralink SoC physically mapped flash": 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x00140000 : "Kernel" 0x00140000-0x00800000 : "RootFS" block2mtd: version $Revision: 1.1.1.1 $ Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver usbserial drivers/usb/serial/usb-serial.c: USB Serial support registered for generic usbcore: registered new interface driver usbserial_generic drivers/usb/serial/usb-serial.c: USB Serial Driver core drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port) usbcore: registered new interface driver option drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1 usbcore: registered new interface driver usb-pcm drivers/usb/serial/usb-pcm.c: usb to pcm Driver: V2.4.20_uC0_1B12 nf_conntrack version 0.5.0 (128 buckets, 1024 max) GRE over IPv4 tunneling driver ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> drivers/flash/flash_ioctl.c 538 drivers/flash/flash_ioctl.c 390 drivers/flash/flash_ioctl.c 396 drivers/flash/flash_ioctl.c 401 drivers/flash/flash_ioctl.c 415 DDNSPassword=simcard_roam=HT_MpduDensity=5PktAggregate=1CountryRegion=5wan_l2tp_user=l2tp_user 44444e5350617373776f72643d0073696d636172645f726f616d3d0048545f4d70647544656e736974793d3500506b744167677265676174653d3100436f756e747279526567696f6e3d350077616e5f6c3274705f757365723d6c3274705f7573657200 drivers/flash/flash_ioctl.c 440 drivers/flash/flash_ioctl.c 390 drivers/flash/flash_ioctl.c 396 drivers/flash/flash_ioctl.c 401 the [first:ff].[second:ff].[the last but one:ff].[last:ff], return drivers/flash/flash_ioctl.c 390 drivers/flash/flash_ioctl.c 396 drivers/flash/flash_ioctl.c 401 the [first:ff].[second:ff].[the last but one:ff].[last:ff], return drivers/flash/flash_ioctl.c 540 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 120k freed init started: BusyBox v1.12.1 (2009-12-10 08:42:55 EST) starting pid 602, tty '': '/etc_ro/rcS' Algorithmics/MIPS FPU Emulator v1.5 devpts: called with bogus options mount: mounting none on /proc/bus/usb failed: No such file or directory * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ralink_gpio SETPID_CDZERO ralink_gpio statedect_pid.pid=612 ralink_gpio statedect_pid.use=1 RALINK_GPIO_SET_DIR_OUT cpu_to_le32(tmp)=dfbefe internet.sh Password for 'admin' changed /sbin/internet.sh: line 257: wc: not found [: 0: unknown operand lm: no version for "struct_module" found: kernel tainted. config usb otg dwc_otg: version 2.72a 24-JUN-2008 DWC_otg: Core Release: 2.66a DWC_otg: Periodic Transfer Interrupt Enhancement - disabled DWC_otg: Multiprocessor Interrupt Enhancement - disabled DWC_otg: Using DMA mode DWC_otg: Device using Buffer DMA mode dwc_otg lm0: DWC OTG Controller dwc_otg lm0: new USB bus registered, assigned bus number 1 dwc_otg lm0: irq 18, io mem 0x00000000 DWC_otg: Init: Port Power? op_state=1 DWC_otg: Init: Power Port (0) usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected insmod: bridge.ko: module not found insmod: mii.ko: module not found insmod: raeth.ko: module not found phy_tx_ring = 0x009e6000, tx_ring = 0xa09e6000, size: 16 bytes phy_rx_ring = 0x009e7000, rx_ring = 0xa09e7000, size: 16 bytes GDMA1_FWD_CFG = 10000 ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device rmmod: rt2860v2_ap: No such file or directory rmmod: rt2860v2_sta: No such file or directory rt2860v2_ap: module license 'unspecified' taints kernel. 2860 version : 2.0.0.0 (Dec 10 2009) === pAd = c11f8000, size = 84120 === rmmod: nf_nat_pptp: No such file or directory rmmod: nf_conntrack_pptp: No such file or directory rmmod: nf_nat_proto_gre: No such file or directory rmmod: nf_conntrack_proto_gre: No such file or directory RX DESC a0b76000 size = 1024 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 MCS Set = ff 00 00 00 01 The primary RSNIE: c11fbcea, len = 22 0x0000 : 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 0x0010 : 01 00 00 50 f2 02 zhaoyong isRadioOff==0 Main bssid = 00:26:ed:2b:40:24 The UUID Hex string is:2880288028801880a8800026ed2b4024 The UUID ASCII string is:28802880-2880-1880-a880-0026ed2b4024! 0x1300 = 00064380 insmod: 8021q.ko: module not found BusyBox v1.12.1 (2009-12-10 08:42:55 EST) multi-call binary Usage: ifconfig [-a] interface [address] ifconfig: ioctl 0x8913 failed: No such device brctl: bridge br0: No such device or address iptables v1.4.0rc1: can't initialize iptables table `mangle': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. device ra0 entered promiscuous mode ##### restore RT3052 to dump switch ##### switch reg write offset=14, value=5555 switch reg write offset=40, value=1001 switch reg write offset=44, value=1001 switch reg write offset=48, value=1001 switch reg write offset=4c, value=1 switch reg write offset=50, value=2001 switch reg write offset=70, value=ffffffff switch reg write offset=98, value=7f7f switch reg write offset=e4, value=0 device eth2 entered promiscuous mode br0: port 2(eth2) entering learning state br0: port 1(ra0) entering learning state route: ioctl 0x890c failed: No such process route: ioctl 0x890b failed: Invalid argument br0: port 2(eth2) entering disabled state br0: port 1(ra0) entering disabled state br0: port 2(eth2) entering learning state br0: port 1(ra0) entering learning state ifconfig: ioctl 0x8914 failed: Cannot assign requested address ifconfig: ioctl 0x8914 failed: Cannot assign requested address /sbin/lan.sh: line 63: hostname: not found Set: phy[0].reg[0] = 3900 Set: phy[0].reg[0] = 3100 Set: phy[1].reg[0] = 3900 Set: phy[1].reg[0] = 3100 Warning in PHY reset script Warning in PHY reset script Warning in PHY reset script ifconfig: ioctl 0x8913 failed: No such device killall rt2860apd 1>/dev/null 2>&1 iptables -F -t filter 1>/dev/null 2>&1 iptables -D FORWARD -j macipport_filter 1>/dev/null 2>&1 iptables -F macipport_filter 1>/dev/null 2>&1 iptables -D FORWARD -j web_filter 1>/dev/null 2>&1 iptables -F web_filter 1>/dev/null 2>&1 iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -t filter -N web_filter 1>/dev/null 2>&1 iptables -t filter -N macipport_filter 1>/dev/null 2>&1 iptables -t filter -A FORWARD -j web_filter 1>/dev/null 2>&1 iptables -t filter -A FORWARD -j macipport_filter 1>/dev/null 2>&1 iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 1>/dev/null 2>&1 iptables -t filter -F INPUT iptables -t filter -A INPUT -i ppp0 -p tcp --dport 80 -j DROP iptables -t filter -A INPUT -i ppp0 -p icmp -j DROP save index:0 iptables -t nat -D PREROUTING -j port_forward 1>/dev/null 2>&1 iptables -t nat -F port_forward 1>/dev/null 2>&1; iptables -t nat -X port_forward 1>/dev/null 2>&1 iptables -t nat -D PREROUTING -j DMZ 1>/dev/null 2>&1 iptables -t nat -F DMZ 1>/dev/null 2>&1; iptables -t nat -X DMZ 1>/dev/null 2>&1 iptables -t nat -N port_forward 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 1 -j port_forward 1>/dev/null 2>&1 iptables -t nat -N DMZ 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 2 -j DMZ 1>/dev/null 2>&1 iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE ip_table: set wan_name=ppp0 echo 1 > /proc/sys/net/ipv4/ip_forward ntp.sh greenap.sh init ddns.sh route delete 239.255.255.250 1>/dev/null 2>&1 killall wscd 1>/dev/null 2>&1 killall -9 wscd 1>/dev/null 2>&1 iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1 iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1 killall -q klogd killall -q syslogd syslogd -C8 1>/dev/null 2>&1 klogd 1>/dev/null 2>&1 killall -q zebra killall -q ripd webs: Listening for HTTP requests at address 192.168.0.1 SG device open error, it is not a auto setup modem. br0: topology change detected, propagating br0: port 2(eth2) entering forwarding state br0: topology change detected, propagating br0: port 1(ra0) entering forwarding state starting pid 1253, tty '/dev/ttyS1': '/bin/sh' BusyBox v1.12.1 (2009-12-10 08:42:55 EST) built-in shell (ash) Enter 'help' for a list of built-in commands. -> filename:options,path:/var/ppp/options uaUserNameSvr:vodafone,uaPassWordLoc:vodafone filename:wcdma_chat,path:/var/ppp/wcdma_chat uaUserNameSvr:vodafone,uaPassWordLoc:vodafone filename:pap-secrets,path:/var/ppp/pap-secrets uaUserNameSvr:vodafone,uaPassWordLoc:vodafone filename:chap-secrets,path:/var/ppp/chap-secrets uaUserNameSvr:vodafone,uaPassWordLoc:vodafone CreateSoftTimer index 0 success: usTimerID = 4, ucFlag = 1, ulCurInterval = 25, ulNextInterval = 25, procCallBack = 0x00000000, args = 0x00000000. CreateSoftTimer index 1 success: usTimerID = 1, ucFlag = 1, ulCurInterval = 25, ulNextInterval = 25, procCallBack = 0x00000000, args = 0x00000000. fac Server start wait... start accept...... mkdir: cannot create directory '/var/lock': File exists mkdir: cannot create directory '/var/log': File exists


OpenWrt bootlog

TODO


Tags

toh/zte/mf10.txt · Last modified: 2016/04/06 01:39 by danitool