├── asset ├── edl_point.jpg └── edl_win_port.jpg ├── enter_edl_brick.md ├── broken_ipa.md ├── README.md ├── hwrev.md ├── cacombo.md ├── fs.md ├── edl.md └── LICENSE /asset/edl_point.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/stich86/ZTE-MC7010/HEAD/asset/edl_point.jpg -------------------------------------------------------------------------------- /asset/edl_win_port.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/stich86/ZTE-MC7010/HEAD/asset/edl_win_port.jpg -------------------------------------------------------------------------------- /enter_edl_brick.md: -------------------------------------------------------------------------------- 1 | # Enter 'Emergency Download Mode' (EDL) if your unit is bricked 2 | 3 | In case of soft bricked unit (usually ZTE device with VID/PID *19d2:0076*) or fully bricked (no sign of life, just **POWER** led on), there is another way to enter the CPE into ***EDL Mode***. 4 | 5 | Remove the two screws on the bottom of the CPE, slide down the internal part (using a spudger or a flat screw driver to leverage). 6 | When you got out the internal part, in the below image, you can see the points for **EDL BOOT POINT** (red square). 7 | 8 | On some units, they may be slightly covered by the radiator: 9 | 10 | EDL Boot Point 11 | 12 | ## 13 | Use a paperclip or tweezer to short these two points, keep them shorted and attach USB-C cable to the CPE. 14 | You should see into *Device Manager* (Windows) or `lsusb` (Linux) a device in ***EDL Mode***: 15 | - For Windows users, you will have this COM port: 16 | 17 | Qualcomm EDL COM 18 | 19 | 20 | - For Linux users you will have this output: 21 | ``` 22 | Bus 004 Device 032: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode) 23 | ``` 24 | 25 | Remove the paperclip/tweezer and use **QFIL** or **edl** to flash firmware back into CPE. 26 | -------------------------------------------------------------------------------- /broken_ipa.md: -------------------------------------------------------------------------------- 1 | 2 | # Fix broken IPA acceleration after repack 3 | 4 | After some tests on new ZTE units (like **MC888** or **MC889**), I've found that when these are put in Router mode (using repacked firmware), the packet acceleration (**IPA**) is broken, and all traffic is software accelerated. 5 | 6 | This issue seems related to a permission problem when the `mount-copybind` script should mount the `IPACM_cfg.xml` file from the filesystem `/etc_rw`. The script checks if the `stat` of the files are the same, and if not, it overwrites the default configuration into `/etc_rw`. This causes `ipacm` to read the wrong LAN address and break the acceleration. 7 | 8 | In the `/etc/data/ipa` directory, there is the stock Qualcomm configuration using the standard subnet `192.168.225.0/24`, while ZTE uses its custom scripts and binaries to avoid using `/` as Read-Write. When you extract the `rootfs` UBI volume, even with the `-k` flag of `ubireader` or the `--preserve` flag of `ubidump`, the `IPACM_cfg.xml` file in `/etc/data/ipa` gets incorrect permissions. This file should be owned by the `radio` user and group, with permissions set to `755`. 9 | 10 | So before repacking the `rootfs`, be sure to change the ownership and permissions of this file using these commands: 11 | 12 | ``` 13 | chown 1001:1001 PATHetc/data/ipa/IPACM_cfg.xml 14 | chmod 755 /etc/data/ipa/IPACM_cfg.xml 15 | 16 | ``` 17 | Please note that **UID\GID 1001** are the user `radio` on the CPE 18 | 19 | I want to give a big thanks to my friend [@awvarez](https://github.com/avwarez) who helped me find and fix this problem :) 20 | 21 | ## Update on 18/08/2024 22 | It seems that the ubireader tool, in some cases, doesn’t preserve file ownership (I encountered many issues when repacking a **ZTE MC888 Ultra/MC888A Ultra**). I recommend using the latest version of [nlitsme's ubidump](https://github.com/nlitsme/ubidump/) 23 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # This is a repository with all informations about ZTE MC7010 (Outdoor 5G CPE) family 2 | 3 | The [MC7010](https://ztedevices.com/en-gl/mc70102/) CPE is a 4G/5G outdoor unit produced by ZTE with these specs: 4 | 5 | - Network support: 5G SA/NSA Sub-6G/mmWave + 4G LTE Networks TDD/FDD 6 | - Chipset: Qualcomm 5G SDX55M Platform 7 | - CPU: 1x Cortex A7 up to 1.4GHz 8 | - RAM: 256MB 9 | - NAND: 512MB 10 | - LED: Power, Network, LAN, Signal RSSI (three leds) 11 | - 4G LTE Cat: 20 12 | - 5G Specs: 13 | - Max Speed: download up to 3.8Gbps, upload up to 331Mbps 14 | - Bandwidth: Sub-6G@100Mhz, mmWave@800Mhz 15 | - Modulation: Sub-6G DL/UL 256QAM, mmWave DL/UL 64QAM 16 | - Dual Mode: Bridge or Router, there is no embedded Wi-Fi 17 | - Network connectivity: 2.5GbE interface with PoE 802.3af/at (bundled injector) 18 | - Other connectivity: 19 | - USB Type-C with CDROM+RNDIS emulation. It's also used for diagnostic and firmware flashing 20 | - BLE: Used with *"Installer Helper App"* ([Android](https://play.google.com/store/apps/details?id=com.zte.fwainstallwizard&hl=it&gl=US&pli=1)/[iOS](https://apps.apple.com/tr/app/install-helper/id1541447686)) to point the CPE when installed outside 21 | - GPS: Some HW revs has also embedded GPS used by ISP to lock device connection on a specific location, it can be disabled. Doesn't seems to work on 7010D revs from my test 22 | - Dock or Wall-Kit: based on the hardware version, you will have also a dock to use the unit inside 23 | 24 | # Useful Stuff 25 | 26 | - [Hardware Revision](hwrev.md) 27 | - [Partition & Filesystem Info](fs.md) 28 | - [LTE/NR5G CA Combos](cacombo.md) 29 | - [Play with EDL tools and partitions](edl.md) 30 | - [Enter 'Emergency Download Mode' (EDL) if your unit is bricked](enter_edl_brick.md) 31 | - [Fix broken IPA acceleration before repack](broken_ipa.md) 32 | 33 | ⚠️ Certain links in this repo will lead to other repositories which are not under my control. 34 | You accept that I have no control over and accepts no liability in respect of materials, products or services available externally of this repo. ⚠️ 35 | 36 | Any help is really appreciated, feel free to open a PR to fix or add informations 😊 37 | -------------------------------------------------------------------------------- /hwrev.md: -------------------------------------------------------------------------------- 1 | # HW revisions (currently known) 2 | There are five different hardware revisions available on the market; some others may also be available, but I've never seen them on my own 😊 3 | 4 | | HW Revision | Description | mmWave Support | GPS Support | 5 | |---------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|----------------| 6 | | MC7010 (w/mmWave) | These units are sold in various markets (like Italy, by Fastweb/Linkem). They support 5G mmWave and sub-6GHz, but they only support TDD LTE bands. They actually miss HW on the board, so there is no way to use them with FDD bands. Crossflashing firmware is not possible. | ✅ | Not Known | 7 | | MC7010 (Plain Unit) | These units are sold in various markets by ISPs or directly by **ZTE**. The most commonly found are from *Elisa, Telenor, DNA, Play, TIM Italy, 3 Austria*. Their firmware can be exchanged between them. Flashing firmware from **MC7010Ds** on plain **MC7010s** units is not possible, otherwise you will get **"NO SERVICE"**. | ❌ | ✅ | 8 | | MC7010 (China Unit) | These units are sold only in the Chinese market (but they're easily found on AliExpress). It is not currently known whether the firmware can be replaced with the firmware from other versions. Their firmware doesn't work on plain **MC7010** units, but plain's firmware works on them. | ❌ | ✅ | 9 | | MC7010CA | These units are sold in the Mexican or Canadian markets. The most commonly found are from Telus, Roger and Telcel. Their firmware can be exchanged between them, other firmware from Plain/China/D units will give you **"NO SERVICE"**. | ❌ | ✅ | 10 | | MC7010D | These units are sold in various markets, only by ISPs. The most commonly found are from *Vodafone Italy, WINDTRE Italy, Orange Poland, H3G UK, Yettel BG*. Their firmware can be exchanged between them. Flashing the firmware from plain **MC7010s** on **MC7010D** units is not possible, otherwise you will get **"NO SERVICE"**. | ❌ | ❌ | 11 | 12 | All other variants can be found on the [ZTE ECCN](https://www.zte.com.cn/global/about/eccn.html) site 13 | -------------------------------------------------------------------------------- /cacombo.md: -------------------------------------------------------------------------------- 1 | # LTE/NR5G CA Combo 2 | Here is a list of links to the most common firmwares' LTE/NR CA Combos: 3 | 4 | | Device | Firmware | Capabilities | 5 | |----------|--------------------|---------------------------------------------------------------------------------------| 6 | | MC7010 | Elisa B17 | [LTE](https://uecapability.smartphonecombo.it/view/?id=3d81b4da-e65f-4e1c-8785-ba7d671851f1) / [5G](https://uecapability.smartphonecombo.it/view/?id=0ea6852b-1e16-4a60-83f5-189e3ee9b4cc) | 7 | | MC7010 | DNA B12 | [LTE](https://uecapability.smartphonecombo.it/view/?id=3988f1ab-2aa9-4cb3-8345-549fc973f611) / [5G](https://uecapability.smartphonecombo.it/view/?id=fc321d89-459b-4638-9240-fe1e829f6d45) | 8 | | MC7010 | H3G Austria B07 | [LTE](https://uecapability.smartphonecombo.it/view/?id=6921825c-dd86-4474-867b-6cd24f3c5072) / [5G](https://uecapability.smartphonecombo.it/view/?id=9b705119-74ea-4055-b4fb-485846097e63) | 9 | | MC7010 | Telenor B06 | [LTE](https://uecapability.smartphonecombo.it/view/?id=e37d97a6-75fb-4722-b28e-e7c333cd11ac) / [5G](https://uecapability.smartphonecombo.it/view/?id=a3fff076-92ca-4b61-8b6c-9ac43ed8901f) | 10 | | MC7010 | Telenor B12 | [LTE](https://uecapability.smartphonecombo.it/view/multi/?id=e0c5d205-a819-448d-9012-e12e221c265e) / [5G](https://uecapability.smartphonecombo.it/view/multi/?id=5ae1b51d-bf7d-4ec5-9b5b-c29403069658) | 11 | | MC7010 | China V2 B12 | [LTE / 5G](https://uecapability.smartphonecombo.it/view/multi/?id=14e8c18e-b6f2-47de-acd2-cbc9bae3e5db) | 12 | | MC7010D | Vodafone Italy B09 | [LTE](https://uecapability.smartphonecombo.it/view/?id=075420aa-369c-426f-9b66-d098421a2e67) / [5G](https://uecapability.smartphonecombo.it/view/?id=e2ba5ea6-c543-4b6b-852f-9dd3036a1a20) | 13 | | MC7010D | WIND Italy B03 | [LTE](https://uecapability.smartphonecombo.it/view/?id=0f9a07af-0a55-4a3a-81f2-4d0c65cfcb00) / [5G](https://uecapability.smartphonecombo.it/view/?id=b0983dba-8622-4a81-a2b0-bd3adee04735) | 14 | | MC7010D | H3G UK B09 | [LTE](https://uecapability.smartphonecombo.it/view/?id=3f6fd35d-971a-4b79-be24-e8db5c0e5ebe) / [5G](https://uecapability.smartphonecombo.it/view/?id=7441f517-ef84-437e-9c10-2341ff61b6fc) | 15 | | MC7010D | H3G UK B10 | [LTE](https://uecapability.smartphonecombo.it/view/multi/?id=d3ae2171-b88c-46e4-b641-f6c4c47e3894) / [5G](https://uecapability.smartphonecombo.it/view/multi/?id=3bb37aaf-e741-417d-80f7-1954c15c8d8a) | 16 | | MC7010CA | TELUS B01 | [LTE](https://uecapability.smartphonecombo.it/view/?id=c17826c9-29da-4c81-9074-6fb078f122e9) / [5G](https://uecapability.smartphonecombo.it/view/?id=34732bf3-ed5f-4caf-908e-75e6f8af00bd) | 17 | | MC7010CA | ROGERS B03 | [LTE](https://uecapability.smartphonecombo.it/view/multi/?id=39e1d206-2311-40fd-ac81-0560b04896e9) / [5G](https://uecapability.smartphonecombo.it/view/multi/?id=728eb4e7-012e-443d-8dd0-9e1e8e5606a5) | 18 | 19 | 20 | Special thanks to @1alessandro1 for the combo extraction 21 | -------------------------------------------------------------------------------- /fs.md: -------------------------------------------------------------------------------- 1 | # Partition Layout & Filesystem Information 2 | 3 | Here is the partition layout together with filesystem information about all MC7010 units: 4 | 5 | ***MC7010-7010CA-7010(mmWave)-7010(China)*** 6 | | Dev | Size | Erase Size | Name | 7 | |--------|----------|------------|---------------| 8 | | mtd0 | 00280000 | 00040000 | "sbl" | 9 | | mtd1 | 00280000 | 00040000 | "mibib" | 10 | | mtd2 | 00b00000 | 00040000 | "efs2" | 11 | | mtd3 | 00600000 | 00040000 | "efs2bak" | 12 | | mtd4 | 001c0000 | 00040000 | "tz" | 13 | | mtd5 | 00100000 | 00040000 | "tz_devcfg" | 14 | | mtd6 | 00180000 | 00040000 | "ddr" | 15 | | mtd7 | 00100000 | 00040000 | "apdp" | 16 | | mtd8 | 00100000 | 00040000 | "xbl_config" | 17 | | mtd9 | 00100000 | 00040000 | "multi_image" | 18 | | mtd10 | 00100000 | 00040000 | "aop" | 19 | | mtd11 | 00100000 | 00040000 | "qhee" | 20 | | mtd12 | 00100000 | 00040000 | "abl" | 21 | | mtd13 | 00280000 | 00040000 | "uefi" | 22 | | mtd14 | 00180000 | 00040000 | "toolsfv" | 23 | | mtd15 | 00180000 | 00040000 | "loader_sti" | 24 | | mtd16 | 00d00000 | 00040000 | "boot" | 25 | | mtd17 | 00100000 | 00040000 | "scrub" | 26 | | mtd18 | 06640000 | 00040000 | "modem" | 27 | | mtd19 | 001c0000 | 00040000 | "misc" | 28 | | mtd20 | 00180000 | 00040000 | "devinfo" | 29 | | mtd21 | 00d00000 | 00040000 | "recovery" | 30 | | mtd22 | 001c0000 | 00040000 | "fota" | 31 | | mtd23 | 02b00000 | 00040000 | "recoveryfs" | 32 | | mtd24 | 00100000 | 00040000 | "sec" | 33 | | mtd25 | 08700000 | 00040000 | "zterw" | 34 | | mtd26 | 0a100000 | 00040000 | "system" | 35 | 36 | ***MC7010D*** 37 | | Dev | Size | Erase Size | Name | 38 | |--------|----------|------------|---------------| 39 | | mtd0 | 00280000 | 00040000 | "sbl" | 40 | | mtd1 | 00280000 | 00040000 | "mibib" | 41 | | mtd2 | 00b00000 | 00040000 | "efs2" | 42 | | mtd3 | 00600000 | 00040000 | "efs2bak" | 43 | | mtd4 | 001c0000 | 00040000 | "tz" | 44 | | mtd5 | 00100000 | 00040000 | "tz_devcfg" | 45 | | mtd6 | 00180000 | 00040000 | "ddr" | 46 | | mtd7 | 00100000 | 00040000 | "apdp" | 47 | | mtd8 | 00100000 | 00040000 | "multi_image" | 48 | | mtd9 | 00100000 | 00040000 | "aop" | 49 | | mtd10 | 00100000 | 00040000 | "qhee" | 50 | | mtd11 | 00100000 | 00040000 | "abl" | 51 | | mtd12 | 00280000 | 00040000 | "uefi" | 52 | | mtd13 | 00180000 | 00040000 | "toolsfv" | 53 | | mtd14 | 00180000 | 00040000 | "loader_sti" | 54 | | mtd15 | 00d00000 | 00040000 | "boot" | 55 | | mtd16 | 00100000 | 00040000 | "scrub" | 56 | | mtd17 | 06640000 | 00040000 | "modem" | 57 | | mtd18 | 001c0000 | 00040000 | "misc" | 58 | | mtd19 | 00180000 | 00040000 | "devinfo" | 59 | | mtd20 | 00d00000 | 00040000 | "recovery" | 60 | | mtd21 | 001c0000 | 00040000 | "fota" | 61 | | mtd22 | 02b00000 | 00040000 | "recoveryfs" | 62 | | mtd23: | 00100000 | 00040000 | "sec" | 63 | | mtd24: | 08680000 | 00040000 | "zterw" | 64 | | mtd25: | 000c0000 | 00040000 | "ipa_fw" | 65 | | mtd26: | 00100000 | 00040000 | "usb_qti" | 66 | | mtd27: | 0a0c0000 | 00040000 | "system" | 67 | 68 | The most important partitions that usually need to be swapped between different firmwares are: ***efs2, uefi, modem, boot and system***: 69 | 70 | | Partition Name | Description | 71 | |----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| 72 | | **efs2** | Contains all baseband configuration (IMEI, BB settings and so on). Be careful and make a backup of the whole partition using Qualcomm Tool (QPST to backup as QCN file). | 73 | | **uefi** | Contains the [RexOS](https://en.wikipedia.org/wiki/REX_OS) system that is loaded by the baseband. It will read all DSP firmwares from the modem partition (AKA NON-HLOS) to initialize all radio stuff. | 74 | | **modem** | Contains all DSP firmwares loaded by UEFI. | 75 | | **boot** | It's the Linux Kernel used by the AP processor to load embedded drivers and start everything from Root FS | 76 | | **zterw** | It's used by Root FS to store all settings that should be persistent across reboots. When you factory reset the CPE, by using either the physical or WebUI button, the volumes inside this ***UBI*** will be formatted. | 77 | | **system** | It's the Linux Root FS where all binaries are stored and ran at boot after kernel startup. | 78 | 79 | **system** & **modem** partitions are created using ***UBIFS*** on top of an ***UBI*** image layout. Both can be accessed in read-write mode after having enabled SSH or TELNET on a stock unit, so changes on the filesystem are possible. 80 | 81 | **system** contains 2 volumes: 82 | 83 | | Volume Name | Description | 84 | |-------------|----------------------------------------------------------------------------------------------------------| 85 | | ***rootfs*** | Contains all Linux and ZTE executables, it can modified to add sshd/telnetd and other tools | 86 | | ***zte_data*** | Contains EFS default configuration used after the device has been reset; web server pages; default AND custom parameters used by ZTE binaries, like admin password, IP, CPE mode and so on | 87 | 88 | These two volumes can be extracted using [ubidump](https://github.com/nlitsme/ubidump) and [ubireader](https://github.com/onekey-sec/ubi_reader) tools, here is a little break down on how to extract and repack them: 89 | 90 | ⚠️ *Run all commands as **root** because there are some special files (like /dev directory) that need to be created* ⚠️ 91 | 92 | - Install the *ubireader* and *ubidump* tools (see the link above for a how-to guide) 93 | - Copy the **sdxprairie-sysfs.ubi** file into a directory, then run `ubidump --savedir . --preserve sdxprairie-sysfs.ubi` 94 | - This will create two folders, with path `{rootfs|ztedata}` 95 | - Run `ubireader_display_info sdxprairie-sysfs.ubi | grep Sequence` again on **sdxprairie-sysfs.ubi** and take note of the big number after the string (called *ID_FROM_UBI_DISPLAY_INFO* from now on), this is to be used when ***UBI*** image is repacked. 96 | - All modifications are to be done inside the {rootfs|ztedata} folders (like changing password hash, adding scripts, adding tools and so on) 97 | - Re-create the two ***UBIFS*** with these commands: 98 | - **rootfs**: `/usr/sbin/mkfs.ubifs -m 4096 -e 253952 -c 2146 -x lzo -f 8 -k r5 -p 1 -l 4 -F -r rootfs rootfs_vol.ubifs` 99 | - **ztedata**: `/usr/sbin/mkfs.ubifs -m 4096 -e 253952 -c 68 -x lzo -f 8 -k r5 -p 1 -l 4 -F -r ztedata ztedata_vol.ubifs` 100 | 101 | Little known fact: During my testing, I attempted to understand why ***UBIFS*** would get corrupted when changing any files after flashing it in ***EDL Mode*** instead of ***fastboot***. After researching ***UBI*** manpages, I used the `-F` flag to prevent this issue. For more information, you can visit this [link](http://www.linux-mtd.infradead.org/faq/ubifs.html#L_free_space_fixup) 102 | - Now create a file called **ubi.ini** with this content: 103 | 104 | ``` 105 | [rootfs] 106 | mode = ubi 107 | image = rootfs_vol.ubifs 108 | vol_type = dynamic 109 | vol_id = 0 110 | vol_name = rootfs 111 | vol_alignment = 1 112 | vol_size = 141705216 113 | 114 | [ztedata] 115 | mode = ubi 116 | image = ztedata_vol.ubifs 117 | vol_type = dynamic 118 | vol_flags = autoresize 119 | vol_id = 1 120 | vol_name = ztedata 121 | vol_alignment = 1 122 | vol_size = 8888320 123 | ``` 124 | - Finally create the new **sdxprairie-sysfs.ubi** using `/usr/sbin/ubinize -p 262144 -m 4096 -O 4096 -s 4096 -x 1 -Q ID_FROM_UBI_DISPLAY_INFO -o mod_sdxprairie-sysfs.ubi ubi.ini` 125 | - This file now can be replaced in your QFIL package and flashed on the unit 126 | 127 | If you want to modify ***rootfs\ztedata*** without having to use QFIL to flash the firmware every time, [erasing the boot partiton](edl.md#force-cpe-to-boot-in-fastboot) is possible, so the **abl** (Android Boot Loader) will automatically start in ***fastboot mode***, making it possible to boot your own kernel or to flash other partitions without needing to put the CPE in ***EDL mode***. For instance, to reflash the system partition (when you are on ***fastboot mode***), simply run these commands: 128 | 129 | ``` 130 | fastboot erase system 131 | fastboot flash system mod_sdxprairie-sysfs.ubi 132 | ``` 133 | 134 | When finished, boot the kernel with the command: `fastboot boot sdxprairie-boot.img`. 135 | 136 | If everything is fine, just reboot the unit and permanently flash the kernel with the command: `fastboot flash boot sdxprairie-boot.img` and then `fastboot boot sdxprairie-boot.img`. 137 | 138 | # Important notes about update capabilities 139 | 140 | If you make any changes to the **rootfs** or **ztedata** folders, any **dFOTA** (Delta Firmware Over The Air) update from **ZTE** will fail. This is because, during the process, all data is binary patched. Before applying the patch, the system compares the CRC of the old file with the new one. If even a single file doesn't match, the update will stop and won't proceed. To preserve the update capability, you need to repack the firmware as it is, apply the updates, dump it again, and then repack the updated version with your modifications. 141 | -------------------------------------------------------------------------------- /edl.md: -------------------------------------------------------------------------------- 1 | # Steps to put CPE in EDL Mode (on Linux) and play with partitions 2 | 3 | Before starting, be sure you have [Bjoern Kerler's EDL tools](https://github.com/bkerler/edl) and sg3-utils already installed on your machine. 4 | 5 | Please use this [prog_firehose.mbn](https://github.com/bkerler/Loaders/blob/a83850577f32faaf4694cda8f00666e0d9d34654/qualcomm/model_generic/sdx55/0000000000000000_d9357db88795b5a8_fhprg.bin) as loader to interact with the CPE. 6 | 7 | ⚠️ All commands must be run as ***root*** to avoid any issues with permissions ⚠️ 8 | 9 | Connect the CPE to your PC using a USB-C cable, it's important to use the CPE's PoE adapter during all the procedure to avoid issues with boot. The following output (or similar) should be visible in `dmesg`: 10 | 11 | ``` 12 | [3005700.308747] usb 1-1: new high-speed USB device number 94 using xhci_hcd 13 | [3005700.459171] usb 1-1: New USB device found, idVendor=19d2, idProduct=1225, bcdDevice=56.47 14 | [3005700.459174] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 15 | [3005700.459175] usb 1-1: Product: ZTE Mobile Broadband 16 | [3005700.459176] usb 1-1: Manufacturer: ZTE,Incorporated 17 | [3005700.459176] usb 1-1: SerialNumber: MF9910ZTED000000 18 | [3005700.462119] usb-storage 1-1:1.0: USB Mass Storage device detected 19 | [3005700.462354] usb-storage 1-1:1.0: Quirks match for vid 19d2 pid 1225: 1 20 | [3005700.462449] scsi host9: usb-storage 1-1:1.0 21 | [3005701.132721] usb 1-1: reset high-speed USB device number 94 using xhci_hcd 22 | [3005703.281522] usb 1-1: USB disconnect, device number 94 23 | [3005704.004472] usb 1-1: new high-speed USB device number 95 using xhci_hcd 24 | [3005704.155441] usb 1-1: New USB device found, idVendor=19d2, idProduct=1405, bcdDevice=56.47 25 | [3005704.155444] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 26 | [3005704.155444] usb 1-1: Product: ZTE Mobile Broadband 27 | [3005704.155445] usb 1-1: Manufacturer: ZTE,Incorporated 28 | [3005704.155446] usb 1-1: SerialNumber: MF9930ZTED000000 29 | [3005704.160609] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-0000:00:14.0-1, ZTE CDC Ethernet Device, XX:XX:XX:XX:XX:XX 30 | [3005704.161074] usb-storage 1-1:1.2: USB Mass Storage device detected 31 | [3005704.161327] scsi host9: usb-storage 1-1:1.2 32 | [3005705.189101] scsi 9:0:0:0: CD-ROM ZTE USB SCSI CD-ROM 2.31 PQ: 0 ANSI: 2 33 | [3005705.189573] sr 9:0:0:0: Power-on or device reset occurred 34 | [3005705.190636] sr 9:0:0:0: [sr1] scsi-1 drive 35 | [3005705.191124] sr 9:0:0:0: Attached scsi CD-ROM sr0 36 | [3005705.191239] sr 9:0:0:0: Attached scsi generic sg0 type 5 37 | ``` 38 | 39 | Now the CPE has to be switched from *CDROM+RNDIS* to *3 TTY MODE (Diag, Modem, NMEA)*. Doing so is accomplished using this command: 40 | 41 | `sg_raw -n /dev/sg0 99 00 00 00 00 00` 42 | 43 | In the provided example ***sg0*** was used because no other CDROM is installed, just check the `dmesg` to see which ***sgX*** is created when the CPE is connected to your PC. After executing it, the CPE will switch to DIAG mode and create three ***ttyUSBX*** ports: check the `dmesg` again to see how they are numbered. 44 | 45 | Here is an example of successful switch: 46 | 47 | ``` 48 | [3005998.581911] usb 1-1: USB disconnect, device number 95 49 | [3005998.581939] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-0000:00:14.0-1, ZTE CDC Ethernet Device 50 | [3005999.216024] usb 1-1: new high-speed USB device number 96 using xhci_hcd 51 | [3005999.366790] usb 1-1: New USB device found, idVendor=19d2, idProduct=0016, bcdDevice=56.47 52 | [3005999.366794] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 53 | [3005999.366795] usb 1-1: Product: ZTE Mobile Broadband 54 | [3005999.366796] usb 1-1: Manufacturer: ZTE,Incorporated 55 | [3005999.373256] option 1-1:1.0: GSM modem (1-port) converter detected 56 | [3005999.373318] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0 57 | [3005999.373389] option 1-1:1.1: GSM modem (1-port) converter detected 58 | [3005999.373439] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB1 59 | [3005999.373506] option 1-1:1.2: GSM modem (1-port) converter detected 60 | [3005999.373560] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB2 61 | ``` 62 | 63 | Now the CPE can be switched to ***EDL mode***, this is needed to use the aforementioned **edl** tools by Bjoern Kerler. 64 | Run this command: 65 | 66 | `qc_diag.py cmd 4b650100` 67 | 68 | Use `lsusb` to check the following entry is available: 69 | 70 | ``` 71 | lsusb | grep 9008 72 | Bus 004 Device 032: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode) 73 | ``` 74 | 75 | If everything worked, the CPE is now in ***EDL mode*** :-) 76 | 77 | # Let's play with the edl tools 78 | 79 | With the CPE in ***EDL mode***, edl commands can be used to check, dump, erase or write partitions. 80 | 81 | Run this command to show the current layout of the firmware's partitions: 82 | 83 | `edl printgpt --memory=NAND --loader=/path/to/prog_firehose.mbn` 84 | 85 | Output example: 86 | 87 | ``` 88 | Qualcomm Sahara / Firehose Client V3.61 (c) B.Kerler 2018-2023. 89 | main - Using loader /home/user/prog_firehose.mbn ... 90 | main - Waiting for the device 91 | main - Device detected :) 92 | sahara - Protocol version: 2, Version supported: 1 93 | main - Mode detected: sahara 94 | sahara - 95 | ------------------------ 96 | HWID: 0x000cf0e100000000 (MSM_ID:0x000cf0e1,OEM_ID:0x0000,MODEL_ID:0x0000) 97 | CPU detected: "SDX55M:CD90-PH809" 98 | PK_HASH: 0x?????????????????????????000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 99 | Serial: 0x????????? 100 | 101 | sahara - Protocol version: 2, Version supported: 1 102 | sahara - Uploading loader /home/user/prog_firehose.mbn ... 103 | sahara - 32-Bit mode detected. 104 | sahara - Firehose mode detected, uploading... 105 | sahara - Loader successfully uploaded. 106 | main - Trying to connect to firehose loader ... 107 | firehose - INFO: Binary build date: Jan 25 2021 @ 18:29:21 108 | firehose - INFO: Binary build date: Jan 25 2021 @ 18:29:21 109 | firehose - INFO: Chip serial num: 0 (0x0) 110 | firehose - INFO: Supported Functions (15): 111 | firehose - INFO: program 112 | firehose - INFO: read 113 | firehose - INFO: nop 114 | firehose - INFO: patch 115 | firehose - INFO: configure 116 | firehose - INFO: setbootablestoragedrive 117 | firehose - INFO: erase 118 | firehose - INFO: power 119 | firehose - INFO: firmwarewrite 120 | firehose - INFO: getstorageinfo 121 | firehose - INFO: benchmark 122 | firehose - INFO: emmc 123 | firehose - INFO: ufs 124 | firehose - INFO: fixgpt 125 | firehose - INFO: getsha256digest 126 | firehose - INFO: End of supported functions 15 127 | firehose 128 | firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes 129 | firehose 130 | firehose - [LIB]: Couldn't detect TargetName 131 | firehose - TargetName=Unknown 132 | firehose - MemoryName=nand 133 | firehose - Version=1 134 | firehose - Trying to read first storage sector... 135 | firehose - Running configure... 136 | firehose - Storage report: 137 | firehose - total_blocks:2048 138 | firehose - block_size:262144 139 | firehose - page_size:4096 140 | firehose - num_physical:1 141 | firehose - manufacturer_id:44 142 | firehose - serial_num:0 143 | firehose - fw_version: 144 | firehose - mem_type:NAND 145 | firehose - prod_name: 146 | firehose_client - Supported functions: 147 | ----------------- 148 | program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest 149 | firehose - Nand storage detected. 150 | firehose - Scanning for partition table ... 151 | Progress: |██████████| 100.0% Scanning (Sector 0x400 of 0x400, ) 0.00 MB/s 152 | firehose - Found partition table at sector 640 :) 153 | oneplus 154 | oneplus - [LIB]: No module named 'qrcode' 155 | firehose - Nand storage detected. 156 | firehose - Scanning for partition table ... 157 | 158 | Parsing Lun 0: 159 | Name Offset Length Attr Flash 160 | ------------------------------------------------------------- 161 | sbl 00000000 00280000 0xff/0x1/0x0 0 162 | mibib 00280000 00280000 0xff/0x1/0xff 0 163 | efs2 00500000 00B00000 0xff/0x1/0xff 0 164 | efs2bak 01000000 00600000 0xff/0x1/0xff 0 165 | tz 01600000 001C0000 0xff/0x1/0x0 0 166 | tz_devcfg 017C0000 00100000 0xff/0x1/0x0 0 167 | ddr 018C0000 00180000 0xff/0x1/0xff 0 168 | apdp 01A40000 00100000 0xff/0x1/0x0 0 169 | multi_image 01B40000 00100000 0xff/0x1/0x0 0 170 | aop 01C40000 00100000 0xff/0x1/0x0 0 171 | qhee 01D40000 00100000 0xff/0x1/0x0 0 172 | abl 01E40000 00100000 0xff/0x1/0x0 0 173 | uefi 01F40000 00280000 0xff/0x1/0x0 0 174 | toolsfv 021C0000 00180000 0xff/0x1/0x0 0 175 | loader_sti 02340000 00180000 0xff/0x1/0x0 0 176 | boot 024C0000 00D00000 0xff/0x1/0x0 0 177 | scrub 031C0000 00100000 0xff/0x1/0x0 0 178 | modem 032C0000 06640000 0xff/0x1/0x0 0 179 | misc 09900000 001C0000 0xff/0x1/0x0 0 180 | devinfo 09AC0000 00180000 0xff/0x1/0x0 0 181 | recovery 09C40000 00D00000 0xff/0x1/0x0 0 182 | fota 0A940000 001C0000 0xff/0x1/0x0 0 183 | recoveryfs 0AB00000 02B00000 0xff/0x1/0x0 0 184 | sec 0D600000 00100000 0xff/0x1/0x0 0 185 | zterw 0D700000 08680000 0xff/0x1/0x0 0 186 | ipa_fw 15D80000 000C0000 0xff/0x1/0x0 0 187 | usb_qti 15E40000 00100000 0xff/0x1/0x0 0 188 | system 15F40000 0A0C0000 0xff/0x1/0x0 0 189 | ``` 190 | 191 | ## Reading, erasing and writing partitions 192 | 193 | Each time a partition is modified using EDL, re-writing the **SBL** *(secondary boot loader)* and partition layout (used re-calculate all CRCs) is necessary. To do this, this command can be used (use **SBL1+P-Layout** based on your QFIL package): 194 | 195 | ⚠️ **IF SBL1 AND PARTITONS LAYOUT ARE ERASED, YOUR UNIT WILL ALWAYS BOOT IN EDL MODE** ⚠️ 196 | 197 | Erase SBL1+Partition-Layout using this command: 198 | ``` 199 | edl es 0 639 --memory=NAND --sectorsize=4096 --loader=/path/to/prog_firehose.mbn 200 | edl es 640 1279 --memory=NAND --sectorsize=4096 --loader=/path/to/prog_firehose.mbn 201 | ``` 202 | 203 | Write back SBL1+Partition-Layout using this command: 204 | ``` 205 | edl ws 640 partition_complete_p4K_b256K.mbn --memory=NAND --sectorsize=4096 --loader=/path/to/prog_firehose.mbn 206 | edl ws 0 sbl1.mbn --memory=NAND --sectorsize=4096 --loader=/path/to/prog_firehose.mbn 207 | ``` 208 | 209 | Read a single partition using this command: 210 | ``` 211 | edl r system test_system.bin --memory=NAND --loader=/path/to/prog_firehose.mbn 212 | ``` 213 | 214 | Erase a single partition using this command: 215 | ``` 216 | edl e system --memory=NAND --loader=/path/to/prog_firehose.mbn 217 | ``` 218 | 219 | Write a single partition using this command: 220 | ``` 221 | edl w system system.bin --memory=NAND --loader=/path/to/prog_firehose.mbn 222 | ``` 223 | 224 | Make a backup of an entire partition using this command: 225 | ``` 226 | mkdir dump_dir 227 | edl rl dump_dir --memory=NAND --loader=/path/to/prog_firehose.mbn 228 | ``` 229 | These files cannot be rewritten as is, they need to be refectored. 230 | 231 | Reset the unit, making it boot back to normal mode, using this command: 232 | ``` 233 | edl reset --resetmode=reset --loader=/path/to/prog_firehose.mbn 234 | ``` 235 | 236 | In case the unit is stuck in DIAG mode (3 TTY), use these commands to get it out: 237 | ``` 238 | qc_diag.py cmd 4baa000000 239 | qc_diag.py cmd 290200 240 | ``` 241 | 242 | # Force CPE to boot in FASTBOOT 243 | 244 | Use these commands to erase `boot` partition and make CPE boots into ***fastboot*** mode 245 | 246 | ``` 247 | edl e boot --memory=NAND --loader=/path/to/prog_firehose.mbn 248 | edl reset --resetmode=reset --loader=/path/to/prog_firehose.mbn 249 | ``` 250 | 251 | As discussed in the [Partition Layout & Filesystem Information](fs.md) page, [erasing](edl.md#force-cpe-to-boot-in-fastboot) just the ***boot*** partition, so ***fastboot*** can be used to erase and write partitions and also to avoid rewriting **SBL1** each time, is preferred. 252 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Mozilla Public License Version 2.0 2 | ================================== 3 | 4 | 1. Definitions 5 | -------------- 6 | 7 | 1.1. "Contributor" 8 | means each individual or legal entity that creates, contributes to 9 | the creation of, or owns Covered Software. 10 | 11 | 1.2. "Contributor Version" 12 | means the combination of the Contributions of others (if any) used 13 | by a Contributor and that particular Contributor's Contribution. 14 | 15 | 1.3. "Contribution" 16 | means Covered Software of a particular Contributor. 17 | 18 | 1.4. "Covered Software" 19 | means Source Code Form to which the initial Contributor has attached 20 | the notice in Exhibit A, the Executable Form of such Source Code 21 | Form, and Modifications of such Source Code Form, in each case 22 | including portions thereof. 23 | 24 | 1.5. "Incompatible With Secondary Licenses" 25 | means 26 | 27 | (a) that the initial Contributor has attached the notice described 28 | in Exhibit B to the Covered Software; or 29 | 30 | (b) that the Covered Software was made available under the terms of 31 | version 1.1 or earlier of the License, but not also under the 32 | terms of a Secondary License. 33 | 34 | 1.6. "Executable Form" 35 | means any form of the work other than Source Code Form. 36 | 37 | 1.7. "Larger Work" 38 | means a work that combines Covered Software with other material, in 39 | a separate file or files, that is not Covered Software. 40 | 41 | 1.8. "License" 42 | means this document. 43 | 44 | 1.9. "Licensable" 45 | means having the right to grant, to the maximum extent possible, 46 | whether at the time of the initial grant or subsequently, any and 47 | all of the rights conveyed by this License. 48 | 49 | 1.10. "Modifications" 50 | means any of the following: 51 | 52 | (a) any file in Source Code Form that results from an addition to, 53 | deletion from, or modification of the contents of Covered 54 | Software; or 55 | 56 | (b) any new file in Source Code Form that contains any Covered 57 | Software. 58 | 59 | 1.11. "Patent Claims" of a Contributor 60 | means any patent claim(s), including without limitation, method, 61 | process, and apparatus claims, in any patent Licensable by such 62 | Contributor that would be infringed, but for the grant of the 63 | License, by the making, using, selling, offering for sale, having 64 | made, import, or transfer of either its Contributions or its 65 | Contributor Version. 66 | 67 | 1.12. "Secondary License" 68 | means either the GNU General Public License, Version 2.0, the GNU 69 | Lesser General Public License, Version 2.1, the GNU Affero General 70 | Public License, Version 3.0, or any later versions of those 71 | licenses. 72 | 73 | 1.13. "Source Code Form" 74 | means the form of the work preferred for making modifications. 75 | 76 | 1.14. "You" (or "Your") 77 | means an individual or a legal entity exercising rights under this 78 | License. For legal entities, "You" includes any entity that 79 | controls, is controlled by, or is under common control with You. For 80 | purposes of this definition, "control" means (a) the power, direct 81 | or indirect, to cause the direction or management of such entity, 82 | whether by contract or otherwise, or (b) ownership of more than 83 | fifty percent (50%) of the outstanding shares or beneficial 84 | ownership of such entity. 85 | 86 | 2. License Grants and Conditions 87 | -------------------------------- 88 | 89 | 2.1. Grants 90 | 91 | Each Contributor hereby grants You a world-wide, royalty-free, 92 | non-exclusive license: 93 | 94 | (a) under intellectual property rights (other than patent or trademark) 95 | Licensable by such Contributor to use, reproduce, make available, 96 | modify, display, perform, distribute, and otherwise exploit its 97 | Contributions, either on an unmodified basis, with Modifications, or 98 | as part of a Larger Work; and 99 | 100 | (b) under Patent Claims of such Contributor to make, use, sell, offer 101 | for sale, have made, import, and otherwise transfer either its 102 | Contributions or its Contributor Version. 103 | 104 | 2.2. Effective Date 105 | 106 | The licenses granted in Section 2.1 with respect to any Contribution 107 | become effective for each Contribution on the date the Contributor first 108 | distributes such Contribution. 109 | 110 | 2.3. Limitations on Grant Scope 111 | 112 | The licenses granted in this Section 2 are the only rights granted under 113 | this License. No additional rights or licenses will be implied from the 114 | distribution or licensing of Covered Software under this License. 115 | Notwithstanding Section 2.1(b) above, no patent license is granted by a 116 | Contributor: 117 | 118 | (a) for any code that a Contributor has removed from Covered Software; 119 | or 120 | 121 | (b) for infringements caused by: (i) Your and any other third party's 122 | modifications of Covered Software, or (ii) the combination of its 123 | Contributions with other software (except as part of its Contributor 124 | Version); or 125 | 126 | (c) under Patent Claims infringed by Covered Software in the absence of 127 | its Contributions. 128 | 129 | This License does not grant any rights in the trademarks, service marks, 130 | or logos of any Contributor (except as may be necessary to comply with 131 | the notice requirements in Section 3.4). 132 | 133 | 2.4. Subsequent Licenses 134 | 135 | No Contributor makes additional grants as a result of Your choice to 136 | distribute the Covered Software under a subsequent version of this 137 | License (see Section 10.2) or under the terms of a Secondary License (if 138 | permitted under the terms of Section 3.3). 139 | 140 | 2.5. Representation 141 | 142 | Each Contributor represents that the Contributor believes its 143 | Contributions are its original creation(s) or it has sufficient rights 144 | to grant the rights to its Contributions conveyed by this License. 145 | 146 | 2.6. Fair Use 147 | 148 | This License is not intended to limit any rights You have under 149 | applicable copyright doctrines of fair use, fair dealing, or other 150 | equivalents. 151 | 152 | 2.7. Conditions 153 | 154 | Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted 155 | in Section 2.1. 156 | 157 | 3. Responsibilities 158 | ------------------- 159 | 160 | 3.1. Distribution of Source Form 161 | 162 | All distribution of Covered Software in Source Code Form, including any 163 | Modifications that You create or to which You contribute, must be under 164 | the terms of this License. You must inform recipients that the Source 165 | Code Form of the Covered Software is governed by the terms of this 166 | License, and how they can obtain a copy of this License. You may not 167 | attempt to alter or restrict the recipients' rights in the Source Code 168 | Form. 169 | 170 | 3.2. Distribution of Executable Form 171 | 172 | If You distribute Covered Software in Executable Form then: 173 | 174 | (a) such Covered Software must also be made available in Source Code 175 | Form, as described in Section 3.1, and You must inform recipients of 176 | the Executable Form how they can obtain a copy of such Source Code 177 | Form by reasonable means in a timely manner, at a charge no more 178 | than the cost of distribution to the recipient; and 179 | 180 | (b) You may distribute such Executable Form under the terms of this 181 | License, or sublicense it under different terms, provided that the 182 | license for the Executable Form does not attempt to limit or alter 183 | the recipients' rights in the Source Code Form under this License. 184 | 185 | 3.3. Distribution of a Larger Work 186 | 187 | You may create and distribute a Larger Work under terms of Your choice, 188 | provided that You also comply with the requirements of this License for 189 | the Covered Software. If the Larger Work is a combination of Covered 190 | Software with a work governed by one or more Secondary Licenses, and the 191 | Covered Software is not Incompatible With Secondary Licenses, this 192 | License permits You to additionally distribute such Covered Software 193 | under the terms of such Secondary License(s), so that the recipient of 194 | the Larger Work may, at their option, further distribute the Covered 195 | Software under the terms of either this License or such Secondary 196 | License(s). 197 | 198 | 3.4. Notices 199 | 200 | You may not remove or alter the substance of any license notices 201 | (including copyright notices, patent notices, disclaimers of warranty, 202 | or limitations of liability) contained within the Source Code Form of 203 | the Covered Software, except that You may alter any license notices to 204 | the extent required to remedy known factual inaccuracies. 205 | 206 | 3.5. Application of Additional Terms 207 | 208 | You may choose to offer, and to charge a fee for, warranty, support, 209 | indemnity or liability obligations to one or more recipients of Covered 210 | Software. However, You may do so only on Your own behalf, and not on 211 | behalf of any Contributor. You must make it absolutely clear that any 212 | such warranty, support, indemnity, or liability obligation is offered by 213 | You alone, and You hereby agree to indemnify every Contributor for any 214 | liability incurred by such Contributor as a result of warranty, support, 215 | indemnity or liability terms You offer. You may include additional 216 | disclaimers of warranty and limitations of liability specific to any 217 | jurisdiction. 218 | 219 | 4. Inability to Comply Due to Statute or Regulation 220 | --------------------------------------------------- 221 | 222 | If it is impossible for You to comply with any of the terms of this 223 | License with respect to some or all of the Covered Software due to 224 | statute, judicial order, or regulation then You must: (a) comply with 225 | the terms of this License to the maximum extent possible; and (b) 226 | describe the limitations and the code they affect. Such description must 227 | be placed in a text file included with all distributions of the Covered 228 | Software under this License. Except to the extent prohibited by statute 229 | or regulation, such description must be sufficiently detailed for a 230 | recipient of ordinary skill to be able to understand it. 231 | 232 | 5. Termination 233 | -------------- 234 | 235 | 5.1. The rights granted under this License will terminate automatically 236 | if You fail to comply with any of its terms. However, if You become 237 | compliant, then the rights granted under this License from a particular 238 | Contributor are reinstated (a) provisionally, unless and until such 239 | Contributor explicitly and finally terminates Your grants, and (b) on an 240 | ongoing basis, if such Contributor fails to notify You of the 241 | non-compliance by some reasonable means prior to 60 days after You have 242 | come back into compliance. Moreover, Your grants from a particular 243 | Contributor are reinstated on an ongoing basis if such Contributor 244 | notifies You of the non-compliance by some reasonable means, this is the 245 | first time You have received notice of non-compliance with this License 246 | from such Contributor, and You become compliant prior to 30 days after 247 | Your receipt of the notice. 248 | 249 | 5.2. If You initiate litigation against any entity by asserting a patent 250 | infringement claim (excluding declaratory judgment actions, 251 | counter-claims, and cross-claims) alleging that a Contributor Version 252 | directly or indirectly infringes any patent, then the rights granted to 253 | You by any and all Contributors for the Covered Software under Section 254 | 2.1 of this License shall terminate. 255 | 256 | 5.3. In the event of termination under Sections 5.1 or 5.2 above, all 257 | end user license agreements (excluding distributors and resellers) which 258 | have been validly granted by You or Your distributors under this License 259 | prior to termination shall survive termination. 260 | 261 | ************************************************************************ 262 | * * 263 | * 6. Disclaimer of Warranty * 264 | * ------------------------- * 265 | * * 266 | * Covered Software is provided under this License on an "as is" * 267 | * basis, without warranty of any kind, either expressed, implied, or * 268 | * statutory, including, without limitation, warranties that the * 269 | * Covered Software is free of defects, merchantable, fit for a * 270 | * particular purpose or non-infringing. The entire risk as to the * 271 | * quality and performance of the Covered Software is with You. * 272 | * Should any Covered Software prove defective in any respect, You * 273 | * (not any Contributor) assume the cost of any necessary servicing, * 274 | * repair, or correction. This disclaimer of warranty constitutes an * 275 | * essential part of this License. No use of any Covered Software is * 276 | * authorized under this License except under this disclaimer. * 277 | * * 278 | ************************************************************************ 279 | 280 | ************************************************************************ 281 | * * 282 | * 7. Limitation of Liability * 283 | * -------------------------- * 284 | * * 285 | * Under no circumstances and under no legal theory, whether tort * 286 | * (including negligence), contract, or otherwise, shall any * 287 | * Contributor, or anyone who distributes Covered Software as * 288 | * permitted above, be liable to You for any direct, indirect, * 289 | * special, incidental, or consequential damages of any character * 290 | * including, without limitation, damages for lost profits, loss of * 291 | * goodwill, work stoppage, computer failure or malfunction, or any * 292 | * and all other commercial damages or losses, even if such party * 293 | * shall have been informed of the possibility of such damages. This * 294 | * limitation of liability shall not apply to liability for death or * 295 | * personal injury resulting from such party's negligence to the * 296 | * extent applicable law prohibits such limitation. Some * 297 | * jurisdictions do not allow the exclusion or limitation of * 298 | * incidental or consequential damages, so this exclusion and * 299 | * limitation may not apply to You. * 300 | * * 301 | ************************************************************************ 302 | 303 | 8. Litigation 304 | ------------- 305 | 306 | Any litigation relating to this License may be brought only in the 307 | courts of a jurisdiction where the defendant maintains its principal 308 | place of business and such litigation shall be governed by laws of that 309 | jurisdiction, without reference to its conflict-of-law provisions. 310 | Nothing in this Section shall prevent a party's ability to bring 311 | cross-claims or counter-claims. 312 | 313 | 9. Miscellaneous 314 | ---------------- 315 | 316 | This License represents the complete agreement concerning the subject 317 | matter hereof. If any provision of this License is held to be 318 | unenforceable, such provision shall be reformed only to the extent 319 | necessary to make it enforceable. Any law or regulation which provides 320 | that the language of a contract shall be construed against the drafter 321 | shall not be used to construe this License against a Contributor. 322 | 323 | 10. Versions of the License 324 | --------------------------- 325 | 326 | 10.1. New Versions 327 | 328 | Mozilla Foundation is the license steward. Except as provided in Section 329 | 10.3, no one other than the license steward has the right to modify or 330 | publish new versions of this License. Each version will be given a 331 | distinguishing version number. 332 | 333 | 10.2. Effect of New Versions 334 | 335 | You may distribute the Covered Software under the terms of the version 336 | of the License under which You originally received the Covered Software, 337 | or under the terms of any subsequent version published by the license 338 | steward. 339 | 340 | 10.3. Modified Versions 341 | 342 | If you create software not governed by this License, and you want to 343 | create a new license for such software, you may create and use a 344 | modified version of this License if you rename the license and remove 345 | any references to the name of the license steward (except to note that 346 | such modified license differs from this License). 347 | 348 | 10.4. Distributing Source Code Form that is Incompatible With Secondary 349 | Licenses 350 | 351 | If You choose to distribute Source Code Form that is Incompatible With 352 | Secondary Licenses under the terms of this version of the License, the 353 | notice described in Exhibit B of this License must be attached. 354 | 355 | Exhibit A - Source Code Form License Notice 356 | ------------------------------------------- 357 | 358 | This Source Code Form is subject to the terms of the Mozilla Public 359 | License, v. 2.0. If a copy of the MPL was not distributed with this 360 | file, You can obtain one at http://mozilla.org/MPL/2.0/. 361 | 362 | If it is not possible or desirable to put the notice in a particular 363 | file, then You may include the notice in a location (such as a LICENSE 364 | file in a relevant directory) where a recipient would be likely to look 365 | for such a notice. 366 | 367 | You may add additional accurate notices of copyright ownership. 368 | 369 | Exhibit B - "Incompatible With Secondary Licenses" Notice 370 | --------------------------------------------------------- 371 | 372 | This Source Code Form is "Incompatible With Secondary Licenses", as 373 | defined by the Mozilla Public License, v. 2.0. 374 | --------------------------------------------------------------------------------