root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-device-operating-mode
"online"
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-serving-system
{
"registration": "not_registered"
}
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-signal-info
"Information unavailable"
uqmi -d /dev/cdc-wdm0 --network-scan
doesn't finish, waited ~5 minutes.
If you set PLMN to auto first
uqmi -d /dev/cdc-wdm0 --set-plmn --mcc 0 --mnc 00
uqmi -d /dev/cdc-wdm0 --network-scan
Check capabilities
uqmi -d /dev/cdc-wdm0 --get-capabilities
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-capabilities
{
"max_tx_channel_rate": 50000000,
"max_rx_channel_rate": 100000000,
"data_service": "non_simultaneous_cs_ps",
"sim": "supported",
"networks": [
"umts",
"lte"
]
}
What APN have you configured?
uqmi -d /dev/cdc-wdm0 --get-profile-settings 3gpp,1
Try to do Flight mode on / off:
uqmi -d /dev/cdc-wdm0 --set-device-operating-mode low_power
uqmi -d /dev/cdc-wdm0 --get-serving-system
uqmi -d /dev/cdc-wdm0 --set-device-operating-mode online
uqmi -d /dev/cdc-wdm0 --get-serving-system
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-profile-settings 3gpp,1
{
"apn": "pinternet.interkom.de",
"pdp-type": "ipv4v6",
"username": "",
"password": "",
"auth": "pap",
"no-roaming": false,
"apn-disabled": false
}
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --set-device-operating-mode low_power
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-serving-system
{
"registration": "not_registered"
}
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --set-device-operating-mode online
root@OpenWrt:~# uqmi -d /dev/cdc-wdm0 --get-serving-system
{
"registration": "not_registered"
}
Can you do a power reboot, unplug the power cable, and past syslog?
/etc/config/network:
[...]
config interface 'wan'
option device '/dev/cdc-wdm0'
option proto 'qmi'
option pdptype 'ipv4v6'
option auth 'pap'
option abort_search 'false'
option apn 'pinternet.interkom.de'
option default_profile '1'
I've let it run for quite a while and it just keeps printing not_registered on. That also shouldn't be the case, should it?
For searching on and not_registered on it should print a number after it (the PLMN?) but it just never does.
Can you try another SIM?
Not very easily as I'm not home right now, but I tried another one from a different provider (same cellular network however - O2).
Result was the same, searching on and after that not_registered on
I've seen that there's a tool to update the modems firmware via QMI. Could that be a solution perhaps? Though I'm not very sure where to find it, TP-Link does not offer it and neither does Qualcomm directly, apparently.
If the update files are available from TP-Link, it may be possible to update the modem via adb.
Something relevant appears to be included in TP-Links firmware update. Though no idea what to cut out and what the modem accepts as firmware (update) 
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
83008 0x14440 U-Boot version string, "U-Boot 1.1.3 (Feb 26 2021 - 16:19:26)"
132096 0x20400 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3738100 bytes
1442304 0x160200 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 6745048 bytes, 674 inodes, blocksize: 131072 bytes, created: 2021-02-26 08:36:03
8192512 0x7D0200 Zip archive data, at least v1.0 to extract, name: bin/
8192574 0x7D023E Zip archive data, at least v2.0 to extract, compressed size: 23041, uncompressed size: 57672, name: bin/npd6
8215681 0x7D5C81 Zip archive data, at least v2.0 to extract, compressed size: 67685, uncompressed size: 168476, name: bin/tc
8283430 0x7E6526 Zip archive data, at least v2.0 to extract, compressed size: 30759, uncompressed size: 83756, name: bin/zebra
8314256 0x7EDD90 Zip archive data, at least v2.0 to extract, compressed size: 285130, uncompressed size: 726816, name: bin/openvpn
8599455 0x83379F Zip archive data, at least v2.0 to extract, compressed size: 35224, uncompressed size: 93964, name: bin/ripd
8634745 0x83C179 Zip archive data, at least v1.0 to extract, name: lib/
8634807 0x83C1B7 Zip archive data, at least v2.0 to extract, compressed size: 413578, uncompressed size: 906692, name: lib/libsqlite3.so.0.8.6
9048466 0x8A1192 Zip archive data, at least v2.0 to extract, compressed size: 112570, uncompressed size: 370432, name: lib/appid.ko
9161106 0x8BC992 Zip archive data, at least v2.0 to extract, compressed size: 26094, uncompressed size: 224008, name: lib/NetIspInfo.ini
9188079 0x8C32EF End of Zip archive, footer length: 22
9188101 0x8C3305 Zip archive data, at least v1.0 to extract, compressed size: 5640192, uncompressed size: 5640192, name: mdm9607-boot.img
14828367 0xE2434F Zip archive data, at least v1.0 to extract, compressed size: 27525120, uncompressed size: 27525120, name: mdm9607-sysfs.ubi
42353562 0x286439A Zip archive data, at least v1.0 to extract, compressed size: 24248320, uncompressed size: 24248320, name: NON-HLOS.ubi
66602207 0x3F844DF End of Zip archive, footer length: 22
Modem files can be extracted using binwalk
I would return to stock and upgrade the modem code as a part of the whole upgrade, then re-install OpenWrt and run through the manual tests with uqmi and/or AT commands as discussed earlier, without trying to make the Internet connection.
I've ran into a bit of an issue with that. Since the flash chip is just 8MB, I've attempted to cut out the lzma and squashfs like with the v4, but after flashing it just keeps on blinking.
dd if=original.bin of=tp_recover.bin skip=1 bs=512 count=16000
should be correct in this case, no?
I'm not sure and don't want to mislead you.
Well, it's a bit weird. I'm unable to return the device to stock properly. Cutting out the header only results in the power LED blinking, but with no access to the router. It's the 5.2 model and it doesn't matter which revision of 5.x I pick.
However...using the v4 FW image and cutting out the header results in stock being restored and accessible - v4 though; flashing v5 via the web interface isn't possible (I've tried to insert the v4 header into the firmware file but it only superficially accepts it before throwing an error right before reboot).