Nie jesteś zalogowany. Proszę się zalogować lub zarejestrować.
eko.one.pl → Posty przez stich86
@Leo-PL
next week I should receive MF289F, board is similar to MF286D (except for the modem that is a Qualcomm X55 Cat.20).
Can you help me to build OpenWRT for it?
Currently InitRAMFS of MF286D is booting on MF289F, but without network.
So I think it will necessary to change dts\dtsi for the new HW
Let me know 
Dobra jest taka sytuacja:
- mam D z Playa z wrzucownym Openwrt
- chce cofnąc sie na oryginał i zrobić przejscie na Nordic używajac frameworka . Po to żeby podniosł mi modem
- zakładam, że update modemu na Nordic dojdzie do ostatniej wersji
- przechodzę z powrotem na OpenWrt.Są jakieś "przeciw" zeby to się udało?
you can update modem's module also on OpenWRT (using ABD and AT+FOTACR commands), it's not necessry to use the ZTE Framework
stich86 napisał/a:have you done a "AT+ZRST" after commands?
Probably not , but ZLOCKCELL was all the time ( at update on level B06 ) ,and at that time it was hard reset ( by removing power cable
So on B09 i got Aggregation , on B10 - no aggregation , but on B11 there was again...
doesn't work for me 
don't know if it's related to my BTS...
i'll try to flash Elisa1 and see if it's working
in my case:
AT+ZCAINFO?
+ZCAINFO: 130, 3, 33003, 1850, 20.0;AT+ZCELLINFO?
+ZCELLINFO: 17790240, 130, LTE B3, 1850
OKAT+ZLOCKCELL?:
+ZLOCKCELL: 1850, 130
OK
doing a speedtest only B3 is used
Yes , looks like on Nordic B09 is still ok , but on B10 CA missing as well. ( just now tested B09 and updated to B10).
EDIT:
No , looks like after update to B11 Agregaion still there:admin@(none):~# echo -e -n 'AT+ZLOCKCELL?\r' > /dev/ttyUSB1 && cat /dev/ttyUSB1 AT+ZCELLINFO? +ZCELLINFO: 74619672, 234, LTE B1, 225 OK AT+ZLOCKCELL? +ZLOCKCELL: 225, 234 OK ^[[A^[[A^C admin@(none):~# echo -e -n 'AT+ZCAINFO?\r' > /dev/ttyUSB1 && grep -m1 "ZCAINFO:" /dev/ttyUSB1 +ZCAINFO: 234, 1, 59100, 225, 15.0; 423, 2, 3, 1599, 10.0; admin@(none):~# echo -e -n 'ATI\r' > /dev/ttyUSB1 && cat /dev/ttyUSB1 ATI Manufacturer: ZTE CORPORATION Model: MF286DMODULE Revision: BD_TELIAMF286DV1.0.0B11 SVN: 11 IMEI: 8667540******** +GCAP: +CGSM OK
have you done a "AT+ZRST" after commands?
guys anyone has tried ZLOCKCELL with Nordic B11?
Looks like that when it's enabled, the CA is not honored, while on B02 is working
I was able to switch profile 2 to IMS on MF286 using AT$QCPDPIMSCFGE=2,1, but this changed nothing - probably due to polish carriers not giving a single shit about prepaid SIMs . Tried with nju (Orange) and Play so far, I need to test with T-mobile and Plus.
Ok… but we need to understand what’s inside these profile. On the EFS there are some configurazione but are usually empty.
Also on ELISA1_B06, ZIMSREGSTATUS is bugged. With IMS registered and VoLTE working, it reports always 0 instead of 2
Look what I found here:
https://www.codico.com/de/mpattachment/ … ad/id/753/
Modem from MF286D exposes a lot AT commands from QSDK, as does MV31-W for which this is the AT command reference. Including AT$QCPDPIMSCFGE command, which controls IMS profiles, which may help us configure VoLTE on it. It might be worthy to compare its output across the operator variants. I wonder if I can get that running with any of polish carriers.
i've tried AT$QCPDPIMSCFGE, but only command without "=" or "?" responds ok, not sure that it's fully supported
@stich86, wasn't your mega folder taken down?
Today, at least I found out what was causing QPST to misbehave and cause reset loops. For some reason, "sahara memory dump" was selected in port settings as the default action, with "reset after dump" checkbox ticked, causing reset loops.
SB3.0 still doesn't go through, though for my MF286D modem - MF286A modems at least don't hang in a reboot loop now, and I can try with them.What is the source of commands you used to switch them from 0076 to 9008 mode?
qdload.exe -k12 -q -pX qcommand.exe -pX -c "m 193d100 1" qcommand.exe -pX -c "d 7980001 4"I need to devise the equivalent for the other modem. It is based on MDM9230, so I can try with 'qdload -k8 -q -pX, but not much else.
Hi Leo,
Folder is still up, I’ve reordered all stuff so may be old links are no available anymore. I’m trying to share new link this evening.
Regarding the commands, I got them from one of the docs inside qtools folder where it specified to do this steps to bring modem in 9008 mode.
I think it should work also for other modems, essentially when you write BOOT_MISC to 1 (first command) and the try to write on a protect sector (second command), this trigger the bootloader to switch 9008 mode
Has anyone tried to run 9008 mode over network?
Using "adb reboot edl" on a working modem, the module switch to 9008, then i've tried to run socat on /dev/ttyUSB0 and add port to QPST Server, but unsuccessful
same trick works when using normal diag
i've found another funny thing:
after update Nordic modem from B02 to all other version, here in Italy the IMS service (VoLTE) doesn't register anymore on Vodafone network.
Digging the files into EFS partition, i've found that from B03 there is a user agent set "ZTE MF286D MF286D Nordic_MF286D_B0X" and this prevent IMS registration.
After uploading empty ims_user_agent+ims_user_agent_Subscrition01 and ims_sip_config+ims_sip_config_Subscription01 from B02 EFS, modem was register on IMS and VoLTE works again
Now I've to check if the same problem is present on Elisa modem (where my VoLTE on Vodafone IT never worked)
EDIT: Elisa B06 (modem side) doesn't work with VF IT VoLTE, i've also restored NVRAM from Nordic B02 but IMS doesn't register
stich86 napisał/a:yes because it's not the latest one.. there is anoter IMEI that should be update to 1.0.1B11
B04 is updated to B03?
No, it looks like that it will move from ELISA_FI_MF286DV1.0.1B03 to ELISA_FI_MF286DV1.0.1B11
and the GUI will say MF286D_Elisa1_B11
i've one unit that was updated, but i cannot share the IMEI used because it's from a working one unlocked on TIM network
stich86 napisał/a:i've tried your version leaving the default one for ELISA
ELISA_FI_MF286DV1.0.0B03
But it doesn't find anything
EDIT:
this IMEI 866754042822978 gives update to Elisa1_B06, but "integrate_version_id" should be ELISA_FI_MF286DV1.0.0B04
Nice finding.
But after this update version is set to B03...
nv set cr_version="MF286D_Elisa1_B06" nv set cr_inner_version="CR_ELISAFIMF286DV1.0.1B03" nv set integrate_version="ELISA_FI_MF286DV1.0.1B03" nv set integrate_release_version="ELISA_FI_MF286DV1.0.1B03"Latest Elisa firmware is B11: https://elisa.fi/asiakaspalvelu/aihe/mo … zte-mf286/ - Ohjelmistopäivitykset
yes because it's not the latest one.. there is anoter IMEI that should be update to 1.0.1B11
@stich86 check this: https://gist.github.com/Leo-PL/051a0b2b … 46e4a809cd - I updated it to cover other devices/firmwares as well, but you still need to read correct "integrate_version_id" from NVRAM if it's not covered here. I think the update servers might have changed between versions - some devices use dms.ztems.com, others dmeu.ztems.com.
i've tried your version leaving the default one for ELISA
ELISA_FI_MF286DV1.0.0B03
But it doesn't find anything
EDIT:
this IMEI 866754042822978 gives update to Elisa1_B06, but "integrate_version_id" should be ELISA_FI_MF286DV1.0.0B04
@frutis
Do you script works also for other firmware? Looks like that on ELISA doesn't work
if anyone needs an IMEI to update Nordic up to B11 (with stock firmware), here is it:
nv set imei=866754040397403
it should be applied on each reboot after successful previous update
Try again
ok, got an IMEI that brings update to B05.. let's try
@stich86: You can use this script to find valid IMEI number: https://eko.one.pl/forum/viewtopic.php? … 77#p270077
hi man,
i got this error when running your script
File "firmware.py", line 72
print(f'Model: {model}')
^
SyntaxError: invalid syntax
EDIT: sorry, using python3 works, but each attempt doesn't find anything, is it normal?
python3 firmware.py
Model: MF286D
Firmware: TELIA_MF286DV1.0.0B02
IMEI: 866754043434088Nothing found
@MiG25 do you have a valid IMEI to get Nordic OTA?
Currently with my stock and also one found over internet, the router doesn't find anything.
ATM i've this version:
cr_inner_version=CR_TELIAMF286DV1.0.0B02
wa_version=BD_TELIAMF286DV1.0.0B02
wa_inner_version_tmp=BD_TELIAMF286DV1.0.0B02 [Nov 2 2019 08:08:50]
wa_inner_version=BD_TELIAMF286DV1.0.0B02 [Nov 2 2019 08:08:50]
wa_version_tmp=BD_TELIAMF286DV1.0.0B02
integrate_release_version=TELIA_MF286DV1.0.0B02
integrate_version=TELIA_MF286DV1.0.0B02
guys.. anyone with latest 22.xx has performance issue?
If I enable "Software NAT Offload", traffic between WLAN and WAN is good (I can reach 120-140Mbit/s), but this broke the speed on LAN to WAN. Disabling "Soft NAT Offload" makes LAN speed good but broke WLAN.
There is an issue also with packet steering: https://github.com/openwrt/openwrt/issues/9848
which version of OpenWRT are you using?
thx
And as you can see in @nanni85 log , sometimes renew fail... So it is critical moment, so it is better when it is made onl once a day , instead every 2h....
When i had it on mc801a every 5 min i noticed a wan reconnection app. twice in one hour..., witch was very annoing ,that internet freezes for couple of seconds...EDIT: And since on all our MF286D this time is 7200 (despite different networks , and even countries ) , this value sits somwhere in modem
usally on 4G networks, lease time are short because device can disconnect often while roaming. I undestant that on fixed line this should be different, in this case most ISP give a SIM with a different profile.
Me, and I think also nanni85 are using a SIM that should be used while roaming..
yes it's strange, but on my case each 2h there is renew but IP remains the same
I hope that the original IMEI had survived at the time being. If not, I have one to spare, from its original case. The router board did not survive, it was the parts donor for other board. I'll play with that once I get successful boot. And if it did get overwritten during the previous SB3.0 runs, then loading dummy QCN will be easy.
Regarding the command to dump:qrflash.exe -k12 -s@ -o mf286d_modem.bin -pXI must have missed something, because individual partitions are written to disk anyway.
And, surprise surprise - contents of EFS2 and EFSBAK partitions is the same, though through ADB working modems wouldn't give up the first one, they happily give up the backup. So it turns out, that I actually have proper backups of my modems :-D
@stich86, could you show your partition table? I feel that something is off with mine.
This is what I extracted from partition.mbn from the recovery folder:============================================================ 00 8 000002 ff 01 00 fe LNX 0:SBL 01 6 000004 ff 01 ff fe LNX 0:MIBIB 02 2800 000400 ff 01 00 ff LNX 0:EFS2 03 bb8 00012c ff 01 00 ff LNX 0:TZ 04 bb8 000100 ff 01 00 ff LNX 0:RPM 05 2800 000400 ff 01 00 ff LNX 0:EFSBAK 06 300 000032 ff 01 00 ff LNX 0:aboot 07 3800 000400 ff 01 00 ff LNX 0:boot 08 32 000032 ff 01 00 ff LNX 0:SCRUB 09 11170 0009c4 ff 01 00 ff LNX 0:modem 10 4d4 000100 ff 01 00 ff LNX 0:misc 11 3800 000400 ff 01 00 ff LNX 0:recovery 12 4d4 000100 ff 01 00 ff LNX 0:fota 13 9c00 000400 ff 01 00 ff LNX 0:recoveryfs 14 4e20 0007d0 ff 01 00 ff LNX 0:ZTEFILE 15 21c00 002800 ff 01 00 ff LNX 0:ZTERW 16 ffffffff 00ffff ff 01 00 ff LNX 0:system ============================================================
i'll try to dump this evening, both my MF286D now are installed so i've to unmount one of them to do the flash layout dump
So why "server" is giving different lease times particular modems ( or even the same modem with diferent soft)
or may be as you said the client override that time to speed up the re-connect in case of issue
stich86 napisał/a:MiG25 napisał/a:But lease time still you can check it on OpenWRT ( logread |grep lease )
This lease time is a case of modem - provider only , not the Openwrt or OFWit 7200s with ELISA1B06:
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: started, v1.35.0
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: broadcasting discover
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: broadcasting select for 10.46.95.29, server 10.46.95.XX
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: lease of 10.46.95.XX obtained from 10.46.95.XX, lease time 7200Like i said , for this lease time to provider somehow modem has influence.
With the same SIM card conecting to the same cell id , with mf286d i get lease itme 7200 , and with mc801a i get 86400 , and i'm sure if i update it to B17 i'll get 300 ( i several times reverse soft becouse of this).
Maybe someone have a clue ,how this lease time increase it ?
usually lease time is sent by DHCP server, i don't known if you can force from the DHCP client, but server should win
eko.one.pl → Posty przez stich86
Forum oparte o PunBB, wspierane przez Informer Technologies, Inc