Nie jesteś zalogowany. Proszę się zalogować lub zarejestrować.
eko.one.pl → Posty przez stich86
For watchdog it can be simple : https://eko.one.pl/?p=openwrt-3g#automa … rtpoczenia
watchcat has also LuCi UI, I think it's better and more easy to setup 
But lease time still you can check it on OpenWRT ( logread |grep lease )
This lease time is a case of modem - provider only , not the Openwrt or OFW
it 7200s with ELISA1B06:
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: started, v1.35.0
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: broadcasting discover
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: broadcasting select for 10.46.95.29, server 10.46.95.XX
Tue Jul 5 11:01:27 2022 daemon.notice netifd: wan_4 (4198): udhcpc: lease of 10.46.95.XX obtained from 10.46.95.XX, lease time 7200
EDIT: Just checked , and my MF286D with BD_TELIAMF286DV1.0.0B11 also receives lease time 7200. @stich86 , can ou check how this is in Elisa soft ?
i've removed the stock FW and now running on OpenWRT..
anyway we can use watchcat utility to restart WAN interface
Ok, makes sense - I'll try. First I'll let it finish dumping the current content. This is going to take a few hours, at least.
Do you think it makes sense to use images dumped from working B11 unit (since they are both plain images anyway) or go with the ones from factory package?
If you are able to write full flash with qtools make sense. But you have to erase EFS and load a dummy one to avoid IMEI overlap
Can you share qtools command used to dump? I don’t have too much success
Ok, I managed to dump the first partitions (up to fota) using qtools. It's slow as molasses, but it works. 13 to 16 are ongoing. Since I have the modem in the right mode, what do you suggest to do? I think of erasing "boot" and "recovery", so I can update all the rest via fastboot, or get dump from my working B11 modem and try flashing that from qtools directly.
This is my partition table:
============================================================ 00 0 00000a ff 01 00 00 LNX 0:SBL 01 a 00000a ff 01 ff 00 LNX 0:MIBIB 02 14 00002c ff 01 00 00 LNX 0:EFS2 03 40 00000e ff 01 00 00 LNX 0:TZ 04 4e 00000d ff 01 00 00 LNX 0:RPM 05 5b 00002c ff 01 00 00 LNX 0:EFSBAK 06 87 000004 ff 01 00 00 LNX 0:aboot 07 8b 00003c ff 01 00 00 LNX 0:boot 08 c7 000002 ff 01 00 00 LNX 0:SCRUB 09 c9 00011c ff 01 00 00 LNX 0:modem 10 1e5 000006 ff 01 00 00 LNX 0:misc 11 1eb 00003c ff 01 00 00 LNX 0:recovery 12 227 0006ff 00 ff 01 00 STD 0:fota 13 22d00 00a000 00 ff 01 00 STD 14 2cd00 005700 00 ff 01 00 STD 15 32400 024400 00 ff 01 00 STD 16 56800 029800 00 ff 01 00 STD ============================================================What I see in the output of qrflash looks like ton of ECC errors, at least one per erase block. Too bad that cyrylic output in my console is mangled up on Windows.
When I tried writing partitions only up to U-boot, nothing has changed, likely because in that case SB3.0 process doesn't erase unselected partitions.
Yea erase boot and recovery, leave aboot so it will switch to fastboot mode and you can write all other partitions in this way:
fastboot flash boot mdm9650-boot.img
fastboot flash system mdm9650-sysfs.ubi
fastboot flash modem NON-HLOS.ubi
fastboot flash recovery mdm9650-boot-recovery.img
fastboot flash zterw mdm9650-zterwfs.ubi
fastboot flash recoveryfs mdm-recovery-image-mdm9650.ubi
stich86 napisał/a:@Leo-PL
we got it!
problem is here:
[30] ----fota cookie is [0xffffffff]----
Check your bootloader logs, if the fota cookie is not empty, this stupid module will restart it self each time on recoveryfs.
The only way to resolve this issue is to erase fota partition (/dev/mtd12) so the aboot will start the system on the rootfs instead of recoveryfsLooks like when the modem is on recovery, only way to get prompt on the console is on the ZTE itself and not on the USB adapter
I have this exact value - what is the expected one?
My boot log is here: https://gist.github.com/Leo-PL/c35b7d87 … 952023f3bf
yes it should be 0xffffffff
your looks good, it's booting from the right partition.
If you write only files until aboot, do you get "fastboot_init"?
@Leo-PL
we got it!
problem is here:
[30] ----fota cookie is [0xffffffff]----
Check your bootloader logs, if the fota cookie is not empty, this stupid module will restart it self each time on recoveryfs.
The only way to resolve this issue is to erase fota partition (/dev/mtd12) so the aboot will start the system on the rootfs instead of recoveryfs
Looks like when the modem is on recovery, only way to get prompt on the console is on the ZTE itself and not on the USB adapter 
Just tried those commands - I entered QDL successfully, SB 3.0 went through the same as yesterday, but still nothing written to flash. Mine is FM68<something> - I wasn't able to copy the model when SB3.0 was doing its thing. I haven't figured out how to dump the image with qtools yet, "edl" still doesn't want to cooperate.
Thanks for th heads up on chipset.cfg, I'll look into that.
Edit: my NAND chip is the same model as in the first post, probably like yours.
ok so It cannot be a problem of the flash chip.
May be is just da flag into the NAND that prevent the write
for QTOOLS you should load Emergency BL after modem is in 9008 mode in this way:
qdload.exe -k12 -i -pX
and check if you see P-Table with:
qrflash.exe -k12 -s@ -m -pX
in this mode you can issue commands qr{w}direct
we have done some tests on his modem with qtools, looks like that the modem refues partition.mbn, so it cannot be written..
I finally got the 286D modem to flash, on a fresh laptop with fresh Win7 install, which was a PITA in 2022. But anyway, that qtools incantations were the key, SB3.0 is now going on. BTW. I noticed that it is possible to skip certain partitions, most notably EFS, when you select "Edit". Also, I think I know what failed before. To run qtools, QPST MUST be closed, otherwise it will occupy the serial port, and this is what qtools were complaining about, after all.
But this is still to no avail. After flashing, the modem seems to behave exactly the same as previously. I suspect that charge pump in NAND flash went bust, and thus the memory went read-only ;_;
I've had this happen on a totally different device in the past ;-)At least by using qtools, I can try dumping the flash contents now.
@stich86, where did you get your qtools build? I'm looking for possibly newer one - one on github lacks the chipset support I need - -k12 is invalid chipset code - I wanted to recompile them under Linux.
Edit, nevermind: found this in that fork: https://github.com/Maks-2012/qtools
I’m in contact with a friend that has the same issue. SB3.0 seems to write but then on reboot modem is in the same status as before..
in my qtools package there is loader for k12, it's just a configuration into a file called chipset.cfg that where there are specified the two bootloader files
Do you have a picture of your NAND? This friend has a different one from my modem and another one.
Mine start with FMXXXX, while his is H9XXXX
When you enter 9008 mode with qtools using the commands, can you try to change last one in this way?
qdload.exe -k12 -q -pX
qcommand.exe -pX -c "m 193d100 1"
qcommand.exe -pX -c "d 7980001 4"
Just did the modem delta update on my sis' MF286D this way, without touching stock. I was worried for a while, because broken Wireguard config cut me off for a while, and I thought that my watchdog restarted the modem whlist updating, killing it - but this wasn't the case, the dual-WAN failover did work, and everything's fine.
BTW. Shouldn't the 'AT+FOTACTR=8' be executed after a completed update, not just before next one?
Edit: @frutis, nie masz nic przeciwko, żeby Twój przerobiony skrypt do szukania delt wisiał tu? https://gist.github.com/Leo-PL/051a0b2b … 46e4a809cd
Scaliłem poprzednie przeróbki w jedną całość, teraz da się tym wyszukiwać delty dla całej rodziny, odkomentowując odpowiednią sekcję. Działa dla MF286, MF286A i MF286D - pro forma dodałem też MF283+, choć nic nie znalazłem dla tego modelu pomimo poprawnych danych.
AT+FOTACTR=8 simply delete *.flg files on the /cache dir. it should be done after (or before) a next OTA. Point of view
stich86 napisał/a:I've put all Nordic DELTA and the procedure to update the modem into my MEGA folder:
https://mega.nz/folder/ypgUkKyL#QBWE3kA3WUlw2rq19q9F4Q
Now i'm trying to get also ELISA B06 if I can find the OTA, i'll upload on the share
Is this to upgrade the firmware in the module? Is there a way to upgrade via usb?
Yes or not. You should use ADB to copy files into /cache, then you have to issue AT commands
you can find here latest image.zip and also md5 for Elisa1:
So only proper IMEI gives OTA to Elisa1_B11D (and modem 1.0.1B06) , otherwise is stays on Elisa1_B06 (and modem 1.0.1B01) ?
It looks like that modems from 2021 got this update, new one are stuck on the B06. Don’t know why..
Do you know ,what to do to start update after insrting image.zip in folder /etc_rw/fota/ ? It should be done something ( flag in mtd0 ?) , otherwise on next boot file will be deleted.
I’ve to see the logs. There are some flags applied and removed during the process.
All stuff is processed by a ZTE bin
Yes , but in very baf case even first update can Vary for "prooer" and "not proper" IMEI ,and you already recived one ...
But ofcourse set IMEI first on existing one.
nice catch.. using that IMEI i got this update:
01:02:27 UP>>[update_control.c:628]out version=MF286D_Elisa1_B11D
01:02:27 UP>>[update_control.c:640]inner version=CR_ELISAFIMF286DV1.0.1B09
01:02:27 UP>>[update_control.c:662]inner integrate version=ELISA_FI_MF286DV1.0.1B09
01:02:27 UP>>[update_control.c:651]outer integrate version=ELISA_FI_MF286DV1.0.1B09
01:02:27 UP>>[update_control.c:2449]Oh,yes,Upgrade Successful.
and modem now is updated to 1.0.1B06 (don't understand why they are using all build numbers that doesn't match between GUI, router and modem....)
Tomorrow i'll upload this package, so we have the full update path also for ELISA B11D
yes , nv set should be enough
Ok I got it.. looks like the version is Elisa1_B11D on his modem
I’ll try later to check update
What do you mean for “New ELISA framework”?
All modem here in Italy was converted using TIM2ELISAB02
Try witch his IMEI , perhaps you get same updates....
Can I swap IMEI just on nvram right? I’ve seen that username is passed using the IMEI
Here is uploaded image.zip , with updates Elisa B03 to Elisa1 B06 , and at the same time modem from BD_ELISAFIMF286DMODV1.0.0B03 to BD_ELISAFIMF286DMODV1.0.1B01
https://www.mediafire.com/file/m6bxg5di … 6.zip/file
I did same attempt on the virgin router and the modem stuck at B01… still don’t understand how he got the B06
Only way is to play with Qtools and try to dump the rootFS and modem partition.. better to have all, but EFS cannot be readed..
I've done an update over ZTE framework on a virgin MF286D, bad news.. the framework is using same protocol (Sahara) of QPST to upload firmware on the modem.
On the router there is a daemon called facSvr that is doing all the stuff. So may be with this program is it possible to comunicate also with QPST remote server
Here is the full log: https://mega.nz/file/61RSnLxD#tCrmZ7qhd … Nkihg2D0dE
if anyone is interested
I've put all Nordic DELTA and the procedure to update the modem into my MEGA folder:
https://mega.nz/folder/ypgUkKyL#QBWE3kA3WUlw2rq19q9F4Q
Now i'm trying to get also ELISA B06 if I can find the OTA, i'll upload on the share
stich86 napisał/a:A friend of mine has a modem with ELISA 1.0.1B06
And version of software in GUI ? Maybe B11 , so he receives two OTAs ?
Could you send me his IMEI ( to priv ) , then i'll back to initial Elisa via Framework , use this imei , and try to see , if i get two updates , so i could upload them. Or he could do it him self if he want ( just after OTA download file image.zip is in folder /etc_rw/fota , just connect pendrive ,mount it and copy that file before update starts...)
GUI says B06.. anyway i've another MF286D with original TIM firmware, this evening i'll try to update on ELISA.
Do you know if the "hack" to enabled "telned" works also on "D" version? I mean this one:
No , when i flash with framework to Elisa i get only this one update , with router sets to Elisa1_B06 , and modem is still B01 , but previous digids are changing from 1.0.0 to 1.0.1.
Maybe it is a case of IMEI , since others ,when changing from TIM to Elisa gets two updates , one to B06 ,and second to B11 ( as i recall).
A friend of mine has a modem with ELISA 1.0.1B06
@MiG25 i've tried the file ElisaB03toB06, but i looks like that the modem goes up to B01 and not B06.
Do you have other OTA file?
Zrobiłem aktualizację pakietów (LuCI JS), powinny wyglądać lepiej na motywie OpenWrt2020 (dla mnie ten motyw jest wciąż brzydki i niedopracowany).
@stich86
I did a package update (LuCI JS), they should look better on the OpenWrt2020 theme.
oh thanks man!
i'll update tonight the plugin
You should probably enable IRQ steering in global settings in the "network->interfaces" section in LuCI.
no it wasn't enabled.
I've just enabled the "Software Offloading" on firewall section, with this parameter now I can reach full band for my 4G also on wifi... very strange
eko.one.pl → Posty przez stich86
Forum oparte o PunBB, wspierane przez Informer Technologies, Inc