Flash on Zyxel NR7101

It should be

fw_setenv DebugFlag 0x1
fw_setenv CheckBypass 0
mtd -r write /tmp/100ABUV5C0.bin Kernel

as well, after you upload the bin to the /tmp folder.
Also, is it fine to revert like this, because since i followed previous guide and made a backup of the whole mtd content, should i just copy the backup mtd whit:

restore 
cat /tmp/X.bin > /dev/mtdX
cat /tmp/0.bin > /dev/mtd0

and restore whole mtdor just writing the kernel partition is enough?
Because openwrt create additional stuffs on mtd, so the point is:
Write kernel
Restore whole MTD
Which one? or both?

Until now , the device is running 2,5 days (uptime). Rock solid, I hope it stays like this. And hey, I've got SSH access so I can monitor, externally trigger a reboot and etc. in case it hangs.

Just for completeness, in case anyone else flashes the snapshot firmware and likes to setup the Quectel QMI modem under OpenWrt:

  • vim /etc/config/network
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option ula_prefix 'fdba:727a:8cdf::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.1.1'                      # Adjust to your LAN

config interface 'wan'
	option proto 'qmi'
	option pdptype 'ipv4'                # You can also select dual stack here
	option apn 'internet.t-d1.de'     # Adjust to your carrier APN
	option auth 'none'
	option device '/dev/cdc-wdm0'
	option modes 'all'
	option delay '60'                                  # Delay, timeout required because the modem didn't send/receive bytes on the WAN interface after boot up.
	option timeout '300'

After that, I recommend to:

opkg update
opkg install ddns-scripts htop nano picocom

and follow the guide to install LUCI Web UI: https://openwrt.org/docs/guide-user/luci/luci.essentials

1 Like

Don't ever write to mtd0. That's a backup you hope you'll never need.

Note also that mtd0 in the OEM firmware is a partition spanning all the flash. That''s not present in OpenWrt, so all the mtd-numbers will be off by one. And you won't really use the (OEM) mtd0 backup for anything except exploring the empty spaces. Which aren't so empty after all.

The OpenWrt kernel+rootfs splitting changes the mtd-numbering as well, adding the rootfs between the two Kernel partitions.

IMHO, tt's best to refer to partitions by name to avoid any numbering confusion. I kept the OEM names everywhere these map one-to-one with the OEM firmware.

I believe you should use mtd write to restore the backup as well. You might want to cut away the empty (all ff's) space at the end before writing it back.

And there should normally not be any reason to restore any other partition than "Kernel", and possibly "Kernel2" if you updated that with e.g. the Openwrt recovery initramfs.

1 Like

So what to do then?
To be honest i wasnt sure about what to do, i did what you said.
From OEM :
Loaded ZyZEL-NR7101-GO2022-02-15-recovery.bin in /tmp

cd /tmp
nvram setro uboot DebugFlag 0x1
nvram setro uboot CheckBypass 0
nvram commit
mtd_write -w write ZyZEL-NR7101-GO2022-02-15-recovery.bin Kernel

Reboot
Uploaded ZyZEL-NR7101-GO2022-02-26-update.bin in /tmp

cd /tmp
fw_setenv DebugFlag 0x1
fw_setenv CheckBypass 0
sysupgrade -u -n ZyZEL-NR7101-GO2022-02-26-update.bin

So i was in full openwrt.
At this point i didn't know how to fix the mtd partitions, so i just followed your advice.
Uploaded 100ABUV5C0.bin which is latest OEM firmware in /tmp

fw_setenv DebugFlag 0x1
fw_setenv CheckBypass 0
mtd -r  -e Kernel  write /tmp/100ABUV5C0.bin Kernel

Now im on OEM firmware again, and seems everything works.
Should i do something else?
I didnt write Openwrt recovery in Kernel2.

1 Like

That looks fine to me. You did it all like I would have.

Using the latest downloaed OEM image, like

100ABUV5C0.bin

should be preferred if that is an option.

But this isn't always the case if the device is running an operator specific firmware. These are only available from the operator, and often not anywhere public. Which means that you need the backup if you want to revert to that specific firmware.

Might sound like a strange thing to want, but local market conditions or operator restrictions can make it necessary.

my zyxel is non brand, no operator, its the free version, original Zyxel. So its ok to use Official firmware.

So, what about firmware on the module? can it be modified by zyxel?
Today i received the latest module firmware, but quectel referer said, zyxel could have programmed the module, so installing an official firmware, i might loose something. is it possible?
So he asked me to ask the producer, but, as you know, zyxel do not give full firmware pubicly, they only offer Dfota upgrade. Probably they would say i should not install it.

1 Like

I am only guessing, but I don't think ZyXEL does anything to the modem module firmware. But they do change some modem settings. These should survive a modem firmware upgrade though.

You might have noticed one of the modified settings: The modem has a ZyXEL IMEI, completely different from the Quectel one engraved on the module rf shield.

Yep, the problem is, im not doing upgrade, i would install a complete modem firmware, whit QFirehose, i dont have an upgrade to apply,thats zyxel department.
Upgrading whit QFirehose or qflash is different then Dfota.
Unless it does not matter much.

Upgrading with firehose should still not touch the nvram, I believe. Would be pretty unacceptable if all settings were reset to default on upgrades.

do i need to remove the sim, even when upgrading whit qfirehose?
or its ok, or maybe i have to issue a cfun=0 before?
Also, does exist a reset command for the module?
maybe it could help, after an upgrade, just like when you upgrade the firmware, a reset is in order to avoid errors, maybe even for the module is the same?

NVM, QFirehose put the modem in update mode, just like when you want to upload a smartphone firmware, and you put it in download mode. after that, it just install whole firmware inside, and thats it.
Problem is, why i wasnt able to use QFirehose from my linux pc?
They give the whole tool, but there is makefile etc so the source code inside, but also QFirehose binary, so i thought it was an already compiled and working program.
But, despite it does start, it always failedupdating the module.
Meanwhile from inside ROOter on another router, which have latest version of qfirehose, it worked.
Can it be a matter of kernel on my pc?
Because obviously since both ROOter whit same kernel, maybe thats why it worked.
Or maybe i had to run the program whit sudo?

@bmork Tusen takk! Thank you so much for all your detailed feedback on this subject.

I did the same, bought a used Telenor antenna, thinking that of course they have not locked it down, they have been quite good with not locking things down before at least in my experience. So now I know why I struggle to access the NR7101.
A quick and easy way, if I buy a used zyxel 8702 to set it up in bridge, could I still use another SIM card in NR7101?

If my main goal is to use ICE sim card in this router, is how you explained the quickest way to get here? :slight_smile:

If too much hassle, perhaps better just buy a B818 with 4g? Helping my parents... :slight_smile: They will notice a big difference I think... :slight_smile:

@Morgan With all you did now, is it worth all the time to unlock it? Did you get it up and running well without too much hassle properly? :slight_smile:

Takk til dere begge to :smiley:

Using OpenWrt (or any vendor-independent solution) will always require some additional work and maintenance. I believe it's a disservice to users to recommend it as an "easy" solution to any problem, so I won't do that. OpenWrt has lots of advantages. But you can't add flexibility without complexity, which can also be seen as a disadvantage.

The methods I've documented in the device page and in this thread can also be used to install standard OEM firmware without any operator restrictions. But that's really off topic here. And I can't tell if that will allow ICE SIMs since it also depends on ICE, and I haven't tried it myself.

You won't be able to run OpenWrt on a B818, so asking for recommendations wrt that device in this forum should not be necessary.

Just a side note:
ddns-scripts fail on boot and I had to start them manually so they started updating the wan ip at the dyndns provider.

Do NOT set "interface" for the detection method.

Solution: Set "network" and "wan_4" instead. That worked for me after rebooting the device with active ddns-scripts.

#ddns-scripts #qmi #wan #lte #modem

@bmork
I'm currently trying to do the modem firmware DFOTA upgrade. I took those steps, but then, nothing happens and internet is still connected. I also tried to hit "Stop" on the "wwan0" interface in LUCI, but still error 701.

picocom /dev/ttyUSB2
(...)
at
OK
ati
Quectel
RG502Q-EA
Revision: RG502QEAAAR11A03M4G

OK
at+cgact?
+CGACT: 1,1

OK
at+cgatt?
+CGATT: 1

OK
at+qfotadl="http://get.dyn.mork.no/nr7101/RG502QEAAAR11A03M4G-RG502QEAAAR11A06M4G.zip"
OK

+QIND: "FOTA","HTTPSTART"

+QIND: "FOTA","HTTPEND",701

What's wrong here? According to ( https://forums.quectel.com/t/bg95-bg96-dfota-701-error/11491/2 ) code 701 means "unknown error".

I've also seen that error. I don't know why, but disconnecting the modem first sometimes helps (don't do this unless you're connected locally by LAN or console):

AT+CGACT=0,1
AT+QFOTADL="http://get.dyn.mork.no/nr7101/RG502QEAAAR11A03M4G-RG502QEAAAR11A06M4G.zip"

There's some magic here which I don't fully understand... The modem firmware might be unable to multiplex IP sessions over an exported session maybe?

1 Like

The modem responds with "ERROR" to that command. How can I stop "exporting" the IP session via wwan0/wan_4?

Disconnect the modem like you normally would, and then retry the

AT+QFOTADL

I assume the modem firmware uses whatever APN is configured as the first profile, so make sure

AT+CGDCONT?

shows a working APN as profile number 1.

@bmork Sorry, I don't understand. Could you just tell me how to properly disconnect the modem? I've never done DFOTA through OpenWrt/SSH before so never disconnected the modem before (do I need to open the case and unplug USB? I think that's not what you mean).

I got this output:

AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0

AT+CGPADDR
+CGPADDR: 1,"10.24.10.105,42.1.5.159.208.10.255.236.0.1.0.2.24.68.148.72"

How can I configure the first APN? I'm not familiar with those AT commands and which of them are appropriate.

Is this correct for my APN from Telekom D1?

AT+CGDCONT=1,"IPV4V6","internet.t-d1.de"