1

(3,876 odpowiedzi, napisanych Sprzęt / Hardware)

I got a copy of the ART section from a kind person and my router worked.

2

(3,876 odpowiedzi, napisanych Sprzęt / Hardware)

I found the very first OpenWRT boot log - the initramfs and the driver there detects valid board IDs 20 and 21. Unfortunately, I ran the nand erase.chip command and I have no backups. Is there a chance for my ZTE? The ART partition is completely erased.

3

(3,876 odpowiedzi, napisanych Sprzęt / Hardware)

root@OpenWrt:~# cat /proc/device-tree/model
ZTE MF286D

As far as I understand, no matter what commands I give, OpenWrt will always return the model for which it was compiled

The sticker says:
ZTE 4G Wierless Router
Model: MF286D
WLAN SSID: Three_9A3B8A
WLAN Key:
....


On board info:
WH-1     (some icon)  dydA
7.94V-0 E170968 (some icon) 2323
BER0V0608633C


On 4G modem sticker:
s/n: 753531206236 R6

Photo: https://postimg.cc/v4xC3N5W

4

(3,876 odpowiedzi, napisanych Sprzęt / Hardware)

Hello. My message has been translated into English using Google Translate.

I flashed my ZTE NF286D router via UART to OpenWrt 25 (24 is the same and any custom firmware from here https://dl.eko.one.pl/firmware/ is available for my model).

I encountered a complete lack of WiFi. Research revealed that the driver needs to load data from board-2.bin corresponding to the line bus=ahb,bmi-chip-id=0,bmi-board-id=31,variant=zte,mf286d.

But that's not the problem; I eventually found the ath10k-bdencoder tool. The problem is that the driver is looking for identical strings for both radios. I tried compiling different board-2.bin files. But only the band (2GHz or 5GHz) that strictly matches the line the driver is looking for loads, appears in the system, and works.

Bootlog (password 45454): https://pastebin.com/1qXWxvin

Key point (different a000000 and a800000):

[   15.358988] ath10k_ahb a000000.wifi: failed to fetch board data for bus=ahb,bmi-chip-id=0,bmi-board-id=31,variant=zte,mf286d from ath10k/QCA4019/hw1.0/board-2.bin
[   16.529446] ath10k_ahb a800000.wifi: failed to fetch board data for bus=ahb,bmi-chip-id=0,bmi-board-id=31,variant=zte,mf286d from ath10k/QCA4019/hw1.0/board-2.bin

if 5G available (no 2G wifi):

[ 2328.551961] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[ 2328.552044] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[ 2328.563873] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-14-fcb240f0 api 5 features mfp,peer-flow-ctrl,peer-fixed-rate,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 0cc1593e
[ 2328.611715] ath10k_ahb a000000.wifi: board_file api 2 bmi_id 0:31 crc32 c8791741
[ 2329.872428] ath10k_ahb a000000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[ 2329.872506] ath10k_ahb a000000.wifi: msdu-desc: 2500  skid: 32
[ 2329.919538] ath10k_ahb a000000.wifi: wmi print 'ChipType 1100 ChipTypeID 30 BoardID 15 P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[ 2329.920478] ath10k_ahb a000000.wifi: wmi print 'free: 53428 iram: 20552 sram: 37256'
[ 2330.059417] ath10k_ahb a000000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1
[ 2331.076173] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[ 2331.076255] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[ 2331.088097] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-14-fcb240f0 api 5 features mfp,peer-flow-ctrl,peer-fixed-rate,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 0cc1593e
[ 2331.135586] ath10k_ahb a800000.wifi: board_file api 2 bmi_id 0:31 crc32 c8791741
[ 2332.395112] ath10k_ahb a800000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[ 2332.395192] ath10k_ahb a800000.wifi: msdu-desc: 2500  skid: 32
[ 2332.442293] ath10k_ahb a800000.wifi: wmi print 'ChipType 1100 ChipTypeID 30 BoardID 15 P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[ 2332.443240] ath10k_ahb a800000.wifi: wmi print 'free: 53428 iram: 20552 sram: 37256'
[ 2332.582054] ath10k_ahb a800000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1

then wifi up

[ 2341.291519] ath10k_ahb a800000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[ 2341.291600] ath10k_ahb a800000.wifi: msdu-desc: 2500  skid: 32
[ 2341.338699] ath10k_ahb a800000.wifi: wmi print 'ChipType 1100 ChipTypeID 30 BoardID 15 P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[ 2341.339649] ath10k_ahb a800000.wifi: wmi print 'free: 53428 iram: 20552 sram: 37256'
[ 2341.657106] ath10k_ahb a800000.wifi: rts threshold -1
[ 2341.657761] ath10k_ahb a800000.wifi: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
[ 2341.662821] br-lan: port 4(phy13-ap0) entered blocking state
[ 2341.672178] br-lan: port 4(phy13-ap0) entered disabled state
[ 2341.677966] ath10k_ahb a800000.wifi phy13-ap0: entered allmulticast mode
[ 2341.683930] ath10k_ahb a800000.wifi phy13-ap0: entered promiscuous mode
[ 2341.918287] br-lan: port 4(phy13-ap0) entered blocking state
[ 2341.918361] br-lan: port 4(phy13-ap0) entered forwarding state
root@OpenWrt:/lib/firmware/ath10k/QCA4019/hw1.0# iw dev
phy#13
        Interface phy13-ap0
                ifindex 19
                wdev 0xd00000001
                addr 00:00:00:00:00:02
                ssid OpenWrt_5G
                type AP
                channel 40 (5200 MHz), width: 20 MHz, center1: 5200 MHz
                txpower 23.00 dBm
                multicast TXQ:
                        qsz-byt qsz-pkt flows   drops   marks   overlmt hashcol tx-bytes        tx-packets
                        0       0       0       0       0       0       0       0               0

At the moment I see only one option - rebuild OpenWrt with edited dts
source code OpenWrt (target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4019-mf286d.dts)
Edit qcom,ath10k-calibration-variant set 2g: zte,mf286d,2G 5G: zte,mf286d,5G

&wifi0 {
        status = "okay";
        nvmem-cell-names = "pre-calibration", "mac-address";
        nvmem-cells = <&precal_art_1000>, <&macaddr_config_0 2>;
        qcom,ath10k-calibration-variant = "zte,mf286d";
};

&wifi1 {
        status = "okay";
        nvmem-cell-names = "pre-calibration", "mac-address";
        nvmem-cells = <&precal_art_5000>, <&macaddr_config_0 3>;
        qcom,ath10k-calibration-variant = "zte,mf286d";
};

I didn't make a backup, so I don't have the original firmware-5.bin. I took boarddata_0.bin and boarddata_1.bin from here: https://dl.eko.one.pl/orig/zte_mf286d/NORDIC/B12/

When I flashed the router with mtd9.bin, the WiFi worked, but I couldn't access either root via UART or the webUI. I don't need the official firmware because it doesn't have PPPoE.

I conducted all my experiments with firmware-5.bin that came with OpenWrt.

I don't understand anything about the technical side of the issue, this is the result of two evenings of suffering with ChatGPT.