NCM with Lte Modem

Installing and Using OpenWrt
1

I have a rather unknown Huawei LTE Router Based on mt7621AT soc, known as B5318-42 CPE.

it has a detachable LTE modem module, the module is (you guesses right) B5318-42.

the modem module interfaces with the router using USB 3.0 using Mezzanine (IEEE 1386) connector.

  4.841598] xhci-mtk 1e1c0000.xhci: supply vbus not found, using dummy regulator
[    4.849311] xhci-mtk 1e1c0000.xhci: supply vusb33 not found, using dummy regulator
[    4.857128] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    4.862461] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 1
[    4.883318] xhci-mtk 1e1c0000.xhci: hcc params 0x01401198 hci version 0x96 quirks 0x0000000000290010
[    4.892490] xhci-mtk 1e1c0000.xhci: irq 21, io mem 0x1e1c0000
[    4.899555] hub 1-0:1.0: USB hub found
[    4.903479] hub 1-0:1.0: 2 ports detected
[    4.908109] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    4.913492] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 2
[    4.920976] xhci-mtk 1e1c0000.xhci: Host supports USB 3.0 SuperSpeed
[    4.927541] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.936544] hub 2-0:1.0: USB hub found
[    4.940434] hub 2-0:1.0: 1 port detected
[    4.996387] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.023613] init: - preinit -
[    5.364697] **usb 2-1: new SuperSpeed Gen 1 USB device number 2 using xhci-mtk**
[    5.568758] random: procd: uninitialized urandom read (4 bytes read)
[    6.697280] random: jshn: uninitialized urandom read (4 bytes read)
[    6.904427] random: jshn: uninitialized urandom read (4 bytes read)
[    6.979771] random: jshn: uninitialized urandom read (4 bytes read)
[    7.231163] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[    7.239552] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx

modem data:

Manufacturer: huawei
Model: B5318-42
Revision: 21.297.07.19.00
IMEI: 860943030360820
+GCAP: +CGSM,+DS,+ES

the modem is sim unlocked and datalocked:

AT^SIMLOCK?
^SIMLOCK:0

OK
AT^DATALOCK?
^DATALOCK:1

OK

anyway I can connect to the internet using my simcard which is from another vendor (ISP) using the OEM firmware but not using openwrt !.

the modem works in NCM mode but fails to assign IP address to wwan0 ?
and I don't know how solve the issue.

Sun Oct  9 00:11:06 2022 daemon.notice netifd: Interface 'NCM' is now down
Sun Oct  9 00:11:06 2022 daemon.notice netifd: Interface 'NCM' is setting up now
Sun Oct  9 00:11:08 2022 daemon.notice netifd: NCM (8772): sending -> AT
Sun Oct  9 00:11:09 2022 daemon.notice netifd: NCM (8772): sending -> ATZ
Sun Oct  9 00:11:10 2022 daemon.notice netifd: NCM (8772): sending -> ATQ0
Sun Oct  9 00:11:10 2022 daemon.notice netifd: NCM (8772): sending -> ATV1
Sun Oct  9 00:11:11 2022 daemon.notice netifd: NCM (8772): sending -> ATE1
Sun Oct  9 00:11:12 2022 daemon.notice netifd: NCM (8772): sending -> ATS0=0
Sun Oct  9 00:11:12 2022 daemon.notice netifd: NCM (8772): sending -> AT+CGDCONT=1,"IP","net"
Sun Oct  9 00:11:13 2022 daemon.notice netifd: NCM (8772): Configuring modem
Sun Oct  9 00:11:13 2022 daemon.notice netifd: NCM (8772): Setting mode
Sun Oct  9 00:11:14 2022 daemon.notice netifd: NCM (8772): sending -> AT^SYSCFGEX="030201",3fffffff,2,4,7fffffffffffffff,,
Sun Oct  9 00:11:15 2022 daemon.notice netifd: NCM (8772): Starting network NCM
Sun Oct  9 00:11:15 2022 daemon.notice netifd: NCM (8772): Connecting modem
Sun Oct  9 00:11:16 2022 daemon.notice netifd: NCM (8772): sending -> AT^NDISDUP=1,1,"net"
Sun Oct  9 00:11:16 2022 daemon.notice netifd: NCM (8772): Setting up wwan0
Sun Oct  9 00:11:16 2022 daemon.notice netifd: Interface 'NCM' is now up
Sun Oct  9 00:11:16 2022 daemon.notice netifd: Network device 'wwan0' link is up
Sun Oct  9 00:11:16 2022 daemon.notice netifd: Network alias 'wwan0' link is up
Sun Oct  9 00:11:17 2022 daemon.notice netifd: Interface 'NCM_4' is enabled
Sun Oct  9 00:11:17 2022 daemon.notice netifd: Interface 'NCM_4' has link connectivity
Sun Oct  9 00:11:17 2022 daemon.notice netifd: Interface 'NCM_4' is setting up now
Sun Oct  9 00:11:17 2022 daemon.notice netifd: NCM_4 (8905): udhcpc: started, v1.35.0
Sun Oct  9 00:11:17 2022 user.notice firewall: Reloading firewall due to ifup of NCM (wwan0)
Sun Oct  9 00:11:17 2022 daemon.notice netifd: NCM_4 (8905): udhcpc: broadcasting discover
Sun Oct  9 00:11:20 2022 daemon.notice netifd: NCM_4 (8905): udhcpc: broadcasting discover
Sun Oct  9 00:11:23 2022 daemon.notice netifd: NCM_4 (8905): udhcpc: broadcasting discover
Sun Oct  9 00:12:31 2022 daemon.notice netifd: NCM (9002): Stopping network NCM
Sun Oct  9 00:12:31 2022 daemon.notice netifd: NCM_4 (8905): udhcpc: received SIGTERM
Sun Oct  9 00:12:31 2022 daemon.notice netifd: NCM_4 (8905): udhcpc: entering released state
Sun Oct  9 00:12:31 2022 daemon.notice netifd: NCM_4 (8905): Command failed: ubus call network.interface notify_proto { "action": 0, "link-up": false, "keep": false, "interface": "NCM_4" } (Permission denied)

1- As you can see the dhcpc never got an ipaddress , why? (this is the problem I believe since it is the last step in ncm protcol if I am correct)
2- permission denied, why?

when I checked the modem, found it connected to my ISP and has a public ip address:

AT+CGPADDR

+CGPADDR: 1,"10.132.244.213" //the ip address from my isp

USB initialization Log:

[   18.570916] usbcore: registered new interface driver kaweth
[   18.603833] usbcore: registered new interface driver lan78xx
[   18.674025] usbcore: registered new interface driver r8152
[   18.681599] usbcore: registered new interface driver rtl8150
[   18.724550] usbcore: registered new interface driver usb-storage
[   18.764451] usbcore: registered new interface driver usbserial_generic
[   18.771240] usbserial: USB Serial support registered for generic
[   18.786115] usbcore: registered new interface driver aqc111
[   18.807954] usbcore: registered new interface driver asix
[   18.823506] usbcore: registered new interface driver ax88179_178a
[   18.831514] usbcore: registered new interface driver cdc_eem
[   18.839366] usbcore: registered new interface driver cdc_ether
[   18.856642] usbcore: registered new interface driver cdc_ncm
[   18.863895] usbcore: registered new interface driver cdc_subset
[   19.002282] huawei_cdc_ncm 2-1:1.0: MAC-Address: 00:1e:10:1f:00:00
[   19.008565] huawei_cdc_ncm 2-1:1.0: setting rx_max = 16384
[   19.019729] huawei_cdc_ncm 2-1:1.0: NDP will be placed at end of frame for this device.
[   19.028139] huawei_cdc_ncm 2-1:1.0: cdc-wdm0: USB WDM device
[   19.035393] huawei_cdc_ncm 2-1:1.0 wwan0: register 'huawei_cdc_ncm' at usb-1e1c0000.xhci-1, Huawei CDC NCM device, 00:1e:10:1f:00:00
[   19.152276] huawei_cdc_ncm 2-1:1.1: MAC-Address: 00:1e:10:1f:00:00
[   19.158663] huawei_cdc_ncm 2-1:1.1: setting rx_max = 16384
[   19.169758] huawei_cdc_ncm 2-1:1.1: NDP will be placed at end of frame for this device.
[   19.178118] huawei_cdc_ncm 2-1:1.1: cdc-wdm1: USB WDM device
[   19.185267] huawei_cdc_ncm 2-1:1.1 wwan1: register 'huawei_cdc_ncm' at usb-1e1c0000.xhci-1, Huawei CDC NCM device, 00:1e:10:1f:00:00
[   19.302230] huawei_cdc_ncm 2-1:1.2: MAC-Address: 00:1e:10:1f:00:00
[   19.308581] huawei_cdc_ncm 2-1:1.2: setting rx_max = 16384
[   19.319648] huawei_cdc_ncm 2-1:1.2: NDP will be placed at end of frame for this device.
[   19.328000] huawei_cdc_ncm 2-1:1.2: cdc-wdm2: USB WDM device
[   19.335413] huawei_cdc_ncm 2-1:1.2 wwan2: register 'huawei_cdc_ncm' at usb-1e1c0000.xhci-1, Huawei CDC NCM device, 00:1e:10:1f:00:00
[   19.452207] huawei_cdc_ncm 2-1:1.3: MAC-Address: 00:1e:10:1f:00:00
[   19.458530] huawei_cdc_ncm 2-1:1.3: setting rx_max = 16384
[   19.469744] huawei_cdc_ncm 2-1:1.3: NDP will be placed at end of frame for this device.
[   19.478078] huawei_cdc_ncm 2-1:1.3: cdc-wdm3: USB WDM device
[   19.485204] huawei_cdc_ncm 2-1:1.3 wwan3: register 'huawei_cdc_ncm' at usb-1e1c0000.xhci-1, Huawei CDC NCM device, 00:1e:10:1f:00:00
[   19.497623] usbcore: registered new interface driver huawei_cdc_ncm
[   19.506105] usbcore: registered new interface driver kalmia
[   19.708167] mt7621-pci 1e140000.pcie: bus=1 slot=0 irq=23
[   19.713694] pci 0000:00:00.0: enabling device (0006 -> 0007)
[   19.719368] mt7603e 0000:01:00.0: enabling device (0000 -> 0002)
[   19.725598] mt7603e 0000:01:00.0: ASIC revision: 76030010
[   20.764810] mt7603e 0000:01:00.0: Firmware Version: ap_pcie
[   20.770415] mt7603e 0000:01:00.0: Build Time: 20160107100755
[   20.813151] mt7603e 0000:01:00.0: firmware init done
[   20.998982] mt7621-pci 1e140000.pcie: bus=2 slot=1 irq=24
[   21.004515] pci 0000:00:01.0: enabling device (0006 -> 0007)
[   21.010192] mt76x2e 0000:02:00.0: enabling device (0000 -> 0002)
[   21.016624] mt76x2e 0000:02:00.0: ASIC revision: 76120044
[   21.704449] mt76x2e 0000:02:00.0: ROM patch build: 20141115060606a
[   21.718646] mt76x2e 0000:02:00.0: Firmware Version: 0.0.00
[   21.724294] mt76x2e 0000:02:00.0: Build: 1
[   21.728417] mt76x2e 0000:02:00.0: Build Time: 201607111443____
[   21.753190] mt76x2e 0000:02:00.0: Firmware running!
[   21.831787] usbcore: registered new interface driver pl2303
[   21.837657] usbserial: USB Serial support registered for pl2303
[   21.847183] PPP generic driver version 2.4.2
[   21.855016] NET: Registered protocol family 24
[   21.874481] usbcore: registered new interface driver qmi_wwan
[   21.884615] usbcore: registered new interface driver rndis_host
[   21.901209] usbcore: registered new interface driver ti_usb_3410_5052
[   21.907957] usbserial: USB Serial support registered for TI USB 3410 1 port adapter
[   21.915893] usbserial: USB Serial support registered for TI USB 5052 2 port adapter
[   21.932113] usbcore: registered new interface driver cdc_mbim
[   21.940581] usbcore: registered new interface driver ipw
[   21.946189] usbserial: USB Serial support registered for IPWireless converter
[   21.968672] usbcore: registered new interface driver option
[   21.974523] usbserial: USB Serial support registered for GSM modem (1-port)
[   21.982186] option 2-1:1.4: GSM modem (1-port) converter detected
[   21.988698] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB0
[   21.995954] option 2-1:1.5: GSM modem (1-port) converter detected
[   22.002502] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB1
[   22.009848] option 2-1:1.6: GSM modem (1-port) converter detected
[   22.016671] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB2
[   22.024088] option 2-1:1.7: GSM modem (1-port) converter detected
[   22.030832] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB3

The modem responds on ttyUSB0 not cdc_wdm0
but wwan0 is registrted on cdc_wdm0 which might be a problem (I really don't know).

USB listing:

root@OpenWrt:~# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux 5.10.138 xhci-hcd xHCI Host Controller
Bus 002 Device 002: ID 12d1:1506 HUAWEI_MOBILE HUAWEI_MOBILE
Bus 002 Device 001: ID 1d6b:0003 Linux 5.10.138 xhci-hcd xHCI Host Controller

root@OpenWrt:~# lsusb -t
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci-mtk/1p, 5000M
    |__ Port 1: Dev 2, If 0, Class=, Driver=huawei_cdc_ncm, 5000M
    |__ Port 1: Dev 2, If 1, Class=, Driver=huawei_cdc_ncm, 5000M
    |__ Port 1: Dev 2, If 2, Class=, Driver=huawei_cdc_ncm, 5000M
    |__ Port 1: Dev 2, If 3, Class=, Driver=huawei_cdc_ncm, 5000M
    |__ Port 1: Dev 2, If 4, Class=, Driver=option, 5000M
    |__ Port 1: Dev 2, If 5, Class=, Driver=option, 5000M
    |__ Port 1: Dev 2, If 6, Class=, Driver=option, 5000M
    |__ Port 1: Dev 2, If 7, Class=, Driver=option, 5000M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci-mtk/2p, 480M
root@OpenWrt:~#

Thank you.

2

Hi

Your modem creates multiple wwan interfaces, wwan0 - wwan3. Maybe wwan1 - wwan3 is used. You could try to add new interface, with DHCP client for the wwan1 - wwan3, to see if the modem is using something else then wwan0.
You can also check if the modem has a DHCP active with AT^DHCP?.

3

thanks for the reply,

AT^DHCP?
^DHCP: 6198840A,FCFFFFFF,6298840A,6298840A,43039825,14059825,00000000,00000000,150000000,150000000

I think dhcp is active , right ?

Also tried adding a new dhcp client interface for wwan0-wwan3 but no luck.

I really don't know what to do next.

wrt
wrt853×921 131 KB

also things that might be of help

AT^DHCP=?
^DHCP: (1-11)


AT^SETPORT?
^SETPORT:A1,A2;1,16,3,2,5,A,A1,A2


AT^SETPORT=?

^SETPORT:3: 3G DIAG
^SETPORT:10: 4G MODEM // this port is not active 
^SETPORT:1: 3G MODEM
^SETPORT:12: 4G PCUI
^SETPORT:13: 4G DIAG
^SETPORT:5: 3G GPS
^SETPORT:14: 4G GPS
^SETPORT:A: BLUE TOOTH
^SETPORT:16: NCM
^SETPORT:A1: CDROM
^SETPORT:A2: SD

OK

AT^SETPORT="FF;10,12"
ERROR   //could this be the problem?
4

Does it work if you assign this address manually to wwan0? You might have to do some tricks to make it work, since the NCM function emulates ethernet. E.g invent a netmask and gateway and see if that works

This is most likely not a problem. The cdc_wdm0 device is an artifact of the huawei_cdc_ncm driver. It's only an alternative transport for AT commands if supported by the modem firmware. But we don't know if it's supported on this modem, since this obviously is quite different from most Huawei USB sticks.

In any case, if the ttyUSBx devices work then just use them. You have 4 NCM devices and 4 tty devices. My guess is that these are pairs of ip packet transport (NCM/wwanX) and management (AT/ttyUSBx).

Ignore the cdc-wdmX devices if they don't work. The driver does not know that. It just provides a transport channel, translating a character device to USB control messages.

Huawei are well known for re-implementing their vendor specific features in different firmware code bases. This is good in the way that you got driver support here, without having to patch anything. But the implementations are rarely 100% identical, so you some odd differences should be expected. And the firmwares are also configured for the intended use, which in this case is limited to the OEM firmware running on the router. Which means that they may have removed "unnecessary" modem firmware features.

1 Like
5

I don't think this tells us anything about a possible DHCP server in the modem firmware. I believe you can be pretty sure there isn't any if it doesn't respond. If Huawei doesn't use in in their router firmware, then there was no need for them to enable it in the modem firmware.

The output of the AT^DHCP? command is the IP configuration you should apply to the host system (i.e the MT7621 router). IIRC, it's ip addres, netmask, gateway and DNS servers. The addresses are written in hex and little endian (which they sometimes mess up and use big endian instead...).

anyway, you have
6198840A = 10.132.152.97
FCFFFFFF = 255.255.255.252
6298840A = 10.132.152.98
43039825 = 37.152.3.67
14059825 = 37.152.5.20

6

Hey thanks for the ideas bmork:
I got the plain text IP address, DNS, gateway,net-mask using this command:

AT+CGCONTRDP
+CGCONTRDP: 1,5,"net.MNC003.MCC416.GPRS","10.217.20.127.255.255.255.0","10.217.20.1","37.152.3.67","37.152.5.20",,

I tried setting the wwan0,1,2,3 to static address using the above parameters But that didn't work.

I have 2 devices from this router model and I hacked the router enabling telnet to the OEM firmware also I have dumped the root file system of the oem firmware , if that of any help let me know what I can do with it.

The device is almost fully functional with openwrt , 2.4 ghz and 5 ghz wifi (are working very well) and has a good soc, the only thing left is this modem connectivity.

so please don't give up, I am open to any suggestions and ideas.
Thank you all.

8

some update that might help in solving this issue:

this is ifconfig data from OEM firmware running on the same router:

# ifconfig
br0       Link encap:Ethernet  HWaddr 00:06:F4:F5:C5:50
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::206:f4ff:fef5:c550/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:402260 errors:0 dropped:0 overruns:0 frame:0
          TX packets:539400 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:33881544 (32.3 MiB)  TX bytes:352572534 (336.2 MiB)

eth2      Link encap:Ethernet  HWaddr 00:06:F4:F5:C5:50
          inet6 addr: fe80::206:f4ff:fef5:c550/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:397387 errors:0 dropped:0 overruns:0 frame:0
          TX packets:538672 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:40596966 (38.7 MiB)  TX bytes:343238468 (327.3 MiB)
          Interrupt:3

eth2.1    Link encap:Ethernet  HWaddr 00:06:F4:F5:C5:50
          inet6 addr: fe80::206:f4ff:fef5:c550/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:397387 errors:0 dropped:0 overruns:0 frame:0
          TX packets:527708 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:35033548 (33.4 MiB)  TX bytes:338538845 (322.8 MiB)

eth2.2    Link encap:Ethernet  HWaddr 00:06:F4:F5:C5:50
          inet6 addr: fe80::206:f4ff:fef5:c550/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10956 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:4698935 (4.4 MiB)

eth_data  Link encap:Ethernet  HWaddr 58:02:03:04:05:06
          inet addr:10.123.146.142  Bcast:10.255.255.255  Mask:255.255.255.255
          inet6 addr: fe80::5a02:3ff:fe04:506/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:480433 errors:0 dropped:0 overruns:0 frame:0
          TX packets:358959 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:299575804 (285.6 MiB)  TX bytes:48737732 (46.4 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:21810 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21810 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:7006802 (6.6 MiB)  TX bytes:7006802 (6.6 MiB)

ra0       Link encap:Ethernet  HWaddr 00:06:F4:F5:C5:51
          inet6 addr: fe80::206:f4ff:fef5:c551/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7061 errors:1 dropped:0 overruns:0 frame:0
          TX packets:11720 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:663952 (648.3 KiB)  TX bytes:15983165 (15.2 MiB)
          Interrupt:4

rai0      Link encap:Ethernet  HWaddr 00:06:F4:F5:C5:52
          inet6 addr: fe80::206:f4ff:fef5:c552/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:24

usbcomm0  Link encap:Ethernet  HWaddr 58:02:03:04:05:09
          inet addr:169.254.1.1  Bcast:169.254.1.255  Mask:255.255.255.0
          inet6 addr: fe80::5a02:3ff:fe04:509/64 Scope:Link
          UP BROADCAST RUNNING  MTU:1500  Metric:1
          RX packets:10 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:658 (658.0 B)  TX bytes:1592 (1.5 KiB)

some elaboration :
br0 -> bridge interface
eth2 -> physical ethernet and has 2 physical ports : eth2.1 and eth2.2
eth_data -> actual LTE wan interface
ra0 ->2.4gh wifi interface
rai0->5ghz wifi interface
usbcomm0 -> usb interface (Based on the Tx Rx of this interface I believe wwan0 is this interface, not sure)

Also digging in the OEM root filesystem I found som scripts that are very intersting:

@bmork Looks like you are correct that the router sets the wwan( "eth_data" in this case) IP address statically:
(while reading the script please note that the router is running in NAT mode)

#!/bin/sush
# usage: data_pesi.sh  [start|stop|restart]
#
. /sbin/global.sh

SCRIPT="LTE ipv4 data channel"
#this file focus on basic LTE ipv4 data channel link management, don't coupling with operation mode.

nvram_set cache om_channel_state 1

start(){

	wan_ipaddr=`nvram_get cache wan_ipaddr`
	wan_netmask=`nvram_get cache wan_netmask`
	mtu=`nvram_get 2860 internet_mtu`	
	wan_gateway=`nvram_get cache wan_gateway`
	
	if [ "$wan_ipaddr" != "" -a "$wan_netmask" != "" -a "$wan_gateway" != "" ] ;then


		echo "ifconfig eth_data $wan_ipaddr netmask $wan_netmask mtu $mtu up"
		ifconfig eth_data $wan_ipaddr netmask $wan_netmask mtu $mtu up

		ifconfig br0 mtu $mtu

		echo "[MTU]mtu.sh br0"
		mtu.sh br0
		echo "[MTU]mtu.sh eth_data"
		mtu.sh eth_data
	
#		nvram_set cache internet_led 1
#		killall -USR2 gpiod

		allnetconfig.sh start
		
#		echo "++++++start print network info+++++++++++++++++++++++"
#		ifconfig eth_data
#		route -n
#		arp -a
		echo "--------------end data_pesi.sh"
#		echo "++++++end-- print network info+++++++++++++++++++++++"
		
#		dns_pesi.sh
	fi
	
}

stop(){
	
	ifconfig eth_data 0.0.0.0 
	ip_route.sh clear default_data
	ip_route.sh clear vpn
	
#	nvram_set cache wan_ipaddr ""
#	nvram_set cache wan_netmask ""
#	nvram_set cache wan_primary_dns ""
#	nvram_set cache wan_secondary_dns ""
	
#	nvram_set cache wan_state 1
#	nvram_set cache internet_led 0
#	killall -USR2 gpiod

	allnetconfig.sh stop
}

usage () {
        echo "$0 [start|stop|restart|]"
        exit 1
}

# handle 

[ -z "$1" ] && usage;

for action in $*; do
	case $action in 
		start)			start;;
		stop)			stop;;
		restart)		stop; sleep 3; start;;
		*)		usage;;
	esac
	if [ $? != "0" ] ; then
		echo $SCRIPT $action error
		exit 1
	fi

	echo $SCRIPT $action ok
done

exit 0

the above file file depends on allnetconfig.sh that contains:

#!/bin/sush
#  
# usage: allnetconfig.sh  [start|stop|restart]
# Do init at startup only once.
SCRIPT="Config system network"

oper_mode=`nvram_get 2860 oper_mode`
internet_mtu=`nvram_get 2860 internet_mtu`
vpn_type=`nvram_get 2860 vpn_type`
nat_enable=`nvram_get 2860 nat_enable`
bcp_enable=`nvram_get 2860 bcp_enable`
gre_type=`nvram_get 2860 gre_type`
wan_ipaddr=`nvram_get cache wan_ipaddr`
wan_gateway=`nvram_get cache wan_gateway`

do_start_network(){

	if [ "${oper_mode}" = "0" ]; then	
		echo "current oper_mode is NAT"
		killall -TSTP webserver

		ip_route.sh clear default
		ip_route.sh clear data
		ip_route.sh default eth_data $wan_gateway
		ip_route.sh data "${wan_ipaddr}"
		static_route.sh start
		
	elif [ "${oper_mode}" = "1" ]; then
		echo "current oper_mode is ROUTE"
		killall -TSTP webserver

		ip_route.sh clear default
		ip_route.sh clear data
		ip_route.sh default eth_data $wan_gateway
		ip_route.sh data "${wan_ipaddr}"
		static_route.sh start
		
	elif [ "${oper_mode}" = "2" ]; then
		echo "current oper_mode is VPN"
		killall -TSTP webserver

		ip_route.sh clear default
		ip_route.sh clear data
		ip_route.sh default eth_data $wan_gateway
		ip_route.sh data "${wan_ipaddr}"
		if [ "${vpn_type}" = "0" ]; then	
			echo "start l2tp ..."
		elif [ "${vpn_type}" = "1" ]; then
			echo "start gre ..."
			if [ "${gre_type}" = "0" ]; then
				echo "start gre L3"
				gre_pesi.sh start
			elif [ "${gre_type}" = "1" ]; then
				echo "start gre L2"
				gre_trans_bridge.sh start
			fi		
		fi
	fi
}


do_route_update(){
	echo "[LAN_DBG]do update lan route config..."
	data_conn=`nvram_get cache lte_data_state`
	if [ "3" = "${data_conn}" ];then
		echo "[$0]update DataPdn table"
		#update table DataPdn
		ip_route.sh clear data
		ip_route.sh data "${wan_ipaddr}"

		#update table VpnPdn
		if [ "2" = "${oper_mode}" ];then
			echo "[$0]update VpnPdn table"
			if [ "0" = "${vpn_type}" -a "0" = "${bcp_enable}" ];then
					ip_route.sh clear vpn
					ip_route.sh vpn ppp0
			elif [ "1" = "${vpn_type}" -a "0" = "${gre_type}" ];then
					ip_route.sh clear vpn
					ip_route.sh vpn gre1
			else
				echo "[${0}] no need update route"
			fi
		fi

	else	
		echo "[$0]data pdn disconnected"
	fi

	#update table VoicePdn
	voip_conn=`nvram_get cache lte_voip_state`
	if [ "3" = "${voip_conn}" ];then
		echo "[$0]update VoicePdn table"
		voip_ipaddr=`nvram_get cache wan2_ipaddr`
		ip_route.sh clear voice
		ip_route.sh voice "${voip_ipaddr}"
	else	
		echo "[$0]voice pdn disconnected"
	fi

	#update static route
	static_route.sh restart
	return 0
}

do_stop_network(){

	ip_route.sh clear default
	ip_route.sh clear data
	ip_route.sh clear vpn
	
	killall -TSTP webserver

	if [ "${oper_mode}" = "0" ]; then	
		echo "current oper_mode is NAT"
		
	elif [ "${oper_mode}" = "1" ]; then
		echo "current oper_mode is ROUTE"
	elif [ "${oper_mode}" = "2" ]; then
		echo "current oper_mode is VPN"
		if [ "${vpn_type}" = "0" ]; then	
			echo "stop l2tp ..."
		elif [ "${vpn_type}" = "1" ]; then
			echo "stop gre ..."
			if [ "${gre_type}" = "0" ]; then
				echo "stop gre L3"
				gre_pesi.sh stop
			elif [ "${gre_type}" = "1" ]; then
				echo "stop gre L2"
				gre_trans_bridge.sh stop
			fi		
		fi
	fi
	static_route.sh stop
}

usage () {
        echo "$0 [start|stop|restart|]"
        exit 1
}

# handle 

[ -z "$1" ] && usage;

for action in $*; do
	case $action in 
		start)			do_start_network;;
		stop)			do_stop_network;;
		restart)		do_stop_network; sleep 3; do_start_network;;
		route_update)		do_route_update;;
		*)		usage;;
	esac
	if [ $? != "0" ] ; then
		echo $SCRIPT $action error
		exit 1
	fi

	echo $SCRIPT $action ok
done

exit 0

and static_rout.sh:

#!/bin/sush
#
# usage: static_route.sh [start|stop|restart]

SCRIPT="Static Route"

STATIC_ROUTE_DELSCRIPT="/var/run/del_static_route.sh"
STATIC_ROUTE_SHELL_PID="/var/run/static_route.pid"

stop(){
	echo "Stop ${SCRIPT} ..."	
	
	[ -f "$STATIC_ROUTE_DELSCRIPT" ] && "$STATIC_ROUTE_DELSCRIPT"
	
	if [ -f "$STATIC_ROUTE_SHELL_PID" ] ;then

		exist_pid=`cat "$STATIC_ROUTE_SHELL_PID"`
		[ "$exist_pid" != "" ] && kill "$exist_pid"
		
		rm "$STATIC_ROUTE_SHELL_PID"
	fi
	sysctl -w net.ipv4.ip_forward=1
	ip route flush cache
}

start(){
	echo "Start ${SCRIPT} ..."

	if [ -f "$STATIC_ROUTE_SHELL_PID" ] ;then
		exist_pid=`cat "$STATIC_ROUTE_SHELL_PID"`
		[ "$exist_pid" != "" ] && kill "$exist_pid"
	fi
	
	pidof static_route.sh > "$STATIC_ROUTE_SHELL_PID"

	staticroutelist=`nvram_get 2860 static_route_key`
	
	oper_mode=`nvram_get 2860 oper_mode`
	vpn_nat_en=`nvram_get 2860 nat_enable`
	l3vpn_default_if=`nvram_get 2860 l3vpn_default_if`
	bcp_enable=`nvram_get 2860 bcp_enable`
	vpn_type=`nvram_get 2860 vpn_type`
	gre_type=`nvram_get 2860 gre_type`
	route_table="main"
	route_dev="br0"



	if [ "2" = "${oper_mode}" ];then
		route_table="VpnPdn"
	else
		route_table="main"
	fi

	
	echo "static route list =$staticroutelist"

	i=1;
	echo "#!/bin/sush" > "$STATIC_ROUTE_DELSCRIPT"
	route=`echo "${staticroutelist};" | cut -d ";" -f ${i}`
	run_route_list=""

	while [ "$route" != "" ] 
	do
		gatway=`echo "$route" | cut -d "," -f 1`
		destipadd=`echo "$route" | cut -d "," -f 2`
		routemask=`echo "$route" | cut -d "," -f 3`
		route_type=`echo "$route" | cut -d "," -f 4`

		if [ "2" = "${route_type}" ] && [ "2" = "${oper_mode}" ];then
			if [ "${vpn_type}" = "1" -a "${gre_type}" = "0"  ];then
				route_dev="gre1"	
			elif [ "${vpn_type}" = "0" -a "${bcp_enable}" = "0" ];then
				route_dev="ppp0"	
			else
				echo "Only l3 vpn need vpn static route"
				i=`expr $i + 1`
				route=`echo "${staticroutelist};" | cut -d ";" -f ${i}`
				continue
			fi
		elif [ "1" = "${route_type}" ];then
			route_dev="eth_data"
		elif [ "0" = "${route_type}" ];then
			route_dev="br0"
		else
			echo "static route type set error"
			i=`expr $i + 1`
			route=`echo "${staticroutelist};" | cut -d ";" -f ${i}`
			continue
		fi

		if [ "$destipadd" != "" -a  "$routemask" != "" ]; then
			cidr=$(getter get_cidr_address $destipadd $routemask)
			if [ 0 != $? ];then
				i=`expr $i + 1`
				route=`echo "${staticroutelist};" | cut -d ";" -f ${i}`
				continue
			fi

			echo "cidr:${cidr} gw:${gatway}"

			if [ "2" = "${route_type}" ];then
				#vpn static route set
				echo "ip route add ${cidr}  dev $route_dev table $route_table "
				ip route add ${cidr}  dev $route_dev table $route_table 
			elif [ "1" = "${route_type}" ];then
				#wan static route set
				wan_gw=`nvram_get cache wan_gateway`
				if [ "" = "${wan_gw}" -o " " = "${wan_gw}" ];then
					echo "wan gateway null,${cidr} set error"
					i=`expr $i + 1`
					route=`echo "${staticroutelist};" | cut -d ";" -f ${i}`
					continue
				else
					echo "ip route add ${cidr} via ${wan_gw} dev $route_dev table $route_table "
					ip route add ${cidr} via ${wan_gw} dev $route_dev table $route_table 
					
				fi
			else 
				#lan static route set
				route_table="main"
				if [ "" = "${gatway}" -o " " = "${gatway}" ];then
					echo "ip route add ${cidr}  dev $route_dev table $route_table "
					ip route add ${cidr}  dev $route_dev table $route_table
				else
					echo "ip route add ${cidr} via $gatway dev $route_dev table $route_table "
					ip route add ${cidr} via $gatway dev $route_dev  table $route_table
				fi
			fi

			if [ $? = "0" ] ; then
				echo "ip route del ${cidr} table ${route_table}" >> "$STATIC_ROUTE_DELSCRIPT"
			else
				echo "ip route add error!"
				i=`expr $i + 1`
				route=`echo "${staticroutelist};" | cut -d ";" -f ${i}`
				continue
			fi
		fi

		if [ "1" != "${i}" ];then
			run_route_list="${run_route_list};${route}"
		else
			run_route_list=${route}
		fi


		i=`expr $i + 1`
		route=`echo "${staticroutelist};" | cut -d ";" -f ${i}`
	done

	#for debug
	echo "${run_route_list}" > /tmp/run_route_list.log

	chmod 777 "$STATIC_ROUTE_DELSCRIPT"

	sysctl -w net.ipv4.ip_forward=1
	ip route flush cache
	conntrack -D -n > /dev/null
	conntrack -D -g > /dev/null
	return 0
}

usage () {
    echo "$0 [start|stop|restart]"
    exit 1
}

# handle 

[ -z "$1" ] && usage;

for action in $*; do
	case $action in 
		start)			start;;
		stop)			stop;;
		restart)		stop; sleep 3; start;;
		*)		usage;;
	esac
	if [ $? != "0" ] ; then
		echo "$SCRIPT $action error"
		exit 1
	fi

	echo "$SCRIPT $action ok"
done

exit 0

(Note: I connected to the OEM firmware though telnet and tested these scripts, Fun fact they work :slight_smile: )

so my thinking is usbcomm0 interface is confused by openwrt to be wwan0 (again not really sure!)

I hope you guys can Have some insight on this and all feedback is much appreciated.

9

I believe ultimately with telnet access on Huwaei devices you can actually override the IMEI (just mentioning for research purposes only naturally).

I have the B818-263 but telnet access is blocked unfortunately. And I am not aware of another route to issue AT commands.

10

My router was sim locked and telnet blocked basically impossible to access.
after connecting UART and dumping U-Boot mtd variables partition and hex to ascii conversion I found some hidden U-boot variables that enable Telnet and found the sim Lock key as sha1 encrypted, thus I changed the Telnet variable to enabled and Viola , telnet access Granted, I also de hashed the sim lock and also got the router sim unlocked.

1 Like
11

Impressive. I guess in the case of my B818-263 that'd require opening the poor thing up? Would be nice to have a go at overcoming ISP device-identifier-based restrictions in violation of net neutrality.

What sort of bandwidth can you get with yours?

12

original ISP that I got the router from 70MBits/s. but that is ISP limitation but should reach 300Mbits/s.

13

Interesting. That's not the address published by the device descriptors: From your OpenWrt boot log:

This is one of the variables which might cause problems. NCM transports ethernet frames, so there is an ethernet header with source and destination mac there. The actual values have little meaning. It's a point-to-pont usb link between the router and modem. You can use any address you like. But the two ends need to agree. If for example the modem sends a frame to 58:02:03:04:05:06 and the router believes that its local address is 00:1e:10:1f:00:00, then those frames will be silently dropped ("not for me").

We might end up having to snoop on the USB bus to figure out what's happening here, but one simple thing to try first is just changing the mac address of wwan0 interface.

You could also try to disable arp on wwan0, but I assume that will rather break things than fix them. ARP is obviously not necessary since you only ever will have two devices on this link, but it's a way for the two ends to discover eachothers mac adressess.

Following that idea, it would be useful to look at the arp cache. Doing "ip neigh show" and see if the router is able to resolve the modem "gateway" ip to a mac address.

There are also a few possible quirks related to NCM framing. I'm not at all sure about the status for different Huawei devices there, but I assume this is a previously unknown modem where we dont' automatically apply any quirks. If you look in /sys/class/net/wwan0/cdc_ncm/ you'll see a few tunables. The "ndp_to_end" could be interesting. It's a boolean, so you could just try to toggle it and see if that makes any difference.

There could also be issues related to 32bit vs 16bit pointers inside the NTBs (NCM superframes). I know some Huawei firmwares have had non-standard requirements there (which they can have, since this is not a standard CDC NCM device).

1 Like
14

Tried that and it didn't work.

Default value was "Y" changed to "N" and nothing changed.

m# arp
IP address       HW type     Flags       HW address            Mask     Device
192.168.1.159    0x1         0x2         60:45:cb:73:1b:5f     *        br-lan
10.132.201.41    0x1         0x0         00:00:00:00:00:00     *        wwan0 //aslo wwan1,2,3 have this WH address


root@OpenWrt:~#  ip neigh show
192.168.1.159 dev br-lan lladdr 60:45:cb:73:1b:5f ref 1 used 1264/0/1261 probes 1 REACHABLE
fe80::21e:10ff:fe1f:0 dev wwan0 lladdr 00:1e:10:1f:00:00 used 27/87/27 probes 0 STALE
fe80::d0f7:812c:550c:f308 dev br-lan lladdr 60:45:cb:73:1b:5f used 71/71/26 probes 1 STALE
fd53:d6ba:5625:0:79e3:d2b3:81de:ca50 dev br-lan lladdr 60:45:cb:73:1b:5f ref 1 used 31/31/31 probes 1 REACHABLE

wwan0 was stating "INCOMPLETE" instead of "STALE" but got the above after a reboot.

also found that usbcomm0 is used for only one job which to upload modem firmware from the router.

here is the complete OEM boot log:
https://pastebin.com/Gm8FnuC4

some intersting drivers are:

usbcore: registered new interface driver catc
catc: v2.8:CATC EL1210A NetMate USB Ethernet driver
usbcore: registered new interface driver asix
usbcore: registered new interface driver ax88179_178a
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver net1080
usbcore: registered new interface driver cdc_subset
usbcore: registered new interface driver zaurus

i could not find this driver for openwrt.

CATC EL1210A NetMate USB Ethernet drive
15

Is it possible to change mode with usb-modeswitch?
Can you paste the Huawei part of cat /sys/kernel/debug/usb/devices?

16

it seems empty

# cd /sys/kernel/debug/
# ls
#