ZBT-5926 enable LTE chip modem

Installing and Using OpenWrt
1

Hi,
ZBT-5926 is similar to ZBT-1226, it is using MediaTek MT7628AN, and ThinkWill ML7820+ as LTE chip,
I have flashed it with openwrt 18.06.5
everything works fine, only LTE does not work, there are no cdc-wdm0 or ttyUSB in /dev !


root@OpenWrt:~# ls /dev/
bus                 kmsg                mtd2ro              mtd6ro              network_latency     shm                 ttyS14              ttyS8
console             log                 mtd3                mtdblock0           network_throughput  tty                 ttyS15              ttyS9
cpu_dma_latency     memory_bandwidth    mtd3ro              mtdblock1           null                ttyS0               ttyS2               urandom
full                mtd0                mtd4                mtdblock2           port                ttyS1               ttyS3               watchdog
gpiochip0           mtd0ro              mtd4ro              mtdblock3           ppp                 ttyS10              ttyS4               watchdog0
gpiochip1           mtd1                mtd5                mtdblock4           ptmx                ttyS11              ttyS5               zero
gpiochip2           mtd1ro              mtd5ro              mtdblock5           pts                 ttyS12              ttyS6
hwrng               mtd2                mtd6                mtdblock6           random              ttyS13              ttyS7

here is my usb devices:

root@OpenWrt:~# cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 4.14
S:  Manufacturer=Linux 4.14.151 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=101c0000.ehci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=02(comm.) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=0532 Rev= 1.00
S:  Manufacturer=ZXIC,Incorporated
S:  Product=ZXIC Mobile Boardband
S:  SerialNumber=29F009B92ABD2D09
C:* #Ifs= 7 Cfg#= 1 Atr=c0 MxPwr=500mA
A:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=87(I) Atr=03(Int.) MxPS=  16 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

the ZXIC Mobile Boardband is correct device, bcuz vendor firmware shows that too,
is there anyway to have /dev/cdc-wdm0 or /dev/ttyUSB ?

2

What's the output of cat /proc/devices?

3 
root@OpenWrt:~# cat /proc/devices
Character devices:
  1 mem
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
 10 misc
 90 mtd
108 ppp
128 ptm
136 pts
180 usb
188 ttyUSB
189 usb_device
253 watchdog
254 gpiochip

Block devices:
 31 mtdblock
259 blkext
4

Have you correctly loaded and installed all required packages? I can see the ttyUSB driver loaded next to a usb_device. If you indeed loaded all drivers and packages, then looks like procd is not creating the /dev/ttyUSB* node...

5

its is so weird,

root@OpenWrt:~# lsusb 
Bus 001 Device 002: ID 19d2:0532 ZTE WCDMA Technologies MSM 
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
6

@jow
any help plz

7

What does cat /proc/tty/driver/usbserial says?

8

Driver cdc_ether - try dhcp with eth1/eth2 etc as network interface. Modem looks like hilink/hostless.

9

If that's the case (I have no access to either device), then the OP probably didn't install usb-modeswitch or maybe didn't added the required rules.

10

Have anyone got this to work?

I have purchased a WE826-T, with a ML7820 4G modem daughterboard. I installed 19.07.1, r10911-c155900f66 for the 16MB WE826 (I am not sure whether my device has 16 or 32 MB of flash), and it seems to work for the Ethernet and Wireless access point.
However, I cannot get the 4G modem to work. I have installed various cdc related packages, and gotten to the point where I see an eth1 device. However, after using the UI to configure the eth1 interface for DHCP, it does not get an IP address. Also, I see no traffic whatsoever with tcpdump -i eth1.

Have anyone had success with the ML7820 4G modem?

# ip link show

...
3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN qlen 1000
...

# opkg list | grep cdc

kmod-usb-net-cdc-eem - 4.14.167-1 - Kernel support for USB CDC EEM
kmod-usb-net-cdc-ether - 4.14.167-1 - Kernel support for USB CDC Ethernet devices
kmod-usb-net-cdc-mbim - 4.14.167-1 - Kernel module for Option USB High Speed Mobile Devices
kmod-usb-net-cdc-ncm - 4.14.167-1 - Kernel support for CDC NCM connections
kmod-usb-net-cdc-subset - 4.14.167-1 - Kernel support for Simple USB Network Links (CDC Ethernet subset)
kmod-usb-net-huawei-cdc-ncm - 4.14.167-1 - Kernel support for Huawei CDC NCM connections

# dmesg

...
[   14.197028] cdc_ether 1-1.3:1.0 eth1: register 'cdc_ether' at usb-101c0000.ehci-1.3, ZTE CDC Ethernet Device, 00:a0:c6:00:00:00
...
[   28.128368] cdc_ether 1-1.3:1.0 eth1: kevent 12 may have been dropped
[   28.135599] cdc_ether 1-1.3:1.0 eth1: kevent 11 may have been dropped
...
[  151.907697] cdc_ether 1-1.3:1.0 eth1: kevent 12 may have been dropped
[  151.914366] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
...

/etc/config/network:

...
config interface 'Cellular'
        option ifname 'eth1'
        option proto 'dhcp'
        option force_link '1'
11

Dont have this modem. But other brands, which work. Actually the quectel EC25 is a good solution. Anyway, you should try to use serial connection.

12

I wish that I could do serial communication with the modem, and I see on this page https://market.aliyun.com/products/201196001/cmfw022388.html#sku=yuncode1638800000 that the module is supposed to support "standard AT instruction set (3GPP TS 27.007 and 27.005)" as well as "Think-Will extended AT instruction set".

However, as can be seen on the lsusb output in the very first post, the modem has 7 USB "interfaces", two of them are claimed by the cdc_ether driver, and the remaining 5 interfaces are "vendor", meaning that they do not fall into any standard USB "class". I am not a USB expert, but I would have expected a "serial communication" class, which would trigger the appearance of a /dev/ttyUSB0.

All I can see is that I do not have any ttyUSBx devices, so I have no obvious way of sending AT commands to the modem.

(I may try setting up a cross compiler, since I would like to try using libusb to open the five "bulk" interfaces in turn, and send "+++AT\r" to each of them, in the hopes that it is as simple as that.)

13

Does modem work with org ZBT-firmware ? If yes, which driver
used ?

14

The modem worked with the original firmware, but I did not try to ssh into it, before overwriting with plain OpenWrt. Now, I cannot find any place to download the original firmware, I have asked the vendor for it. I do recall seeing AT commands in some log transcript from the original firmware, so there must be some sort of serial interface to the modem.

I will continue to try to obtain the original firmware.

By the way, the reason I was so quick to "upgrade" to vanilla OpenWrt was that I noticed my cell carrier showing significantly more data use than the telemetry application that I was setting up. A tcpdump showed that it regularly performed DNS lookup of server names under .cn TLD, and communicating back and forth with them on port 4443. (Tcpdump was done by connecting the ZBT router to the internet through the wired WAN port, instead of the 4G modem.)

15

Usually ZBT is helpful. If no response during 10 days, lemme know. I worked for various customers of them. Unfirtunately not using your device.

16

I have contacted ZBT, and they were helpful, even during the holiday. However, they pointed out that while they manufacture and support the WE826-T motherboard (and enclosure), the particular modem, ML7820, was installed by a reseller, and that their standard firmware did not support that modem.

I have also contacted the reseller "C&O Tech Store", asking for a link to download the firmware that shipped with the device (and source code for any modified GPL code in it), but have yet to receive a reply.

17

Some positive news, by writing a little program using libusb, I have discovered that two of the five "bulk" USB interfaces (interface 2 and 3) of the ML7820 modem seem to support AT commands.

Below is a random sample of some interactions with the modem:

AT+COPS?
+COPS: 0,2,"310260",7,1
OK
AT+CGDCONT=1,"IP","epc.tmobile.com"
OK
AT+CGACT=1,1
OK
AT+CEER
+ZGIPDNS: 1,1,"IP","21.251.177.74","0.0.0.0","10.177.0.34","10.177.0.210"
OK
AT^NDISDUP=1,1,
+CME ERROR: 6003

I am not familiar with 3G/4G networking, last time I used AT commands was for sending SMS using a modem connected by an RS-232 port, but to me it seems as this modem is in contact with the towers, and has gotten some gateway IP addresses and whatnot. I tried some command like ATD*99#, which caused the interface to stop accepting commands, and spew loads of PPP packets at me, but so far, I have not found the right AT command, to turn my eth1 device alive. I assume that somehow, the key to getting "NO-CARRIER" to disappear from my ip link status is to tell the modem to route the data through the cdc_ether interface, rather than as ppp through the virtual serial port. I found the AT^NDISDUP mentioned as doing exactly that for Huawei modems, but apparently not for this one. (The 6003 error code is the same I get if I type a garbled AT command.)

I am hoping that some other members of this forum would know how other 3G/4G modems, which present themselves as an ethernet card, as well as a serial interface, are typically told to start routing traffic through their ethernet.

\# ip link show eth1
8: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN qlen 1000
    link/ether 00:a0:c6:00:00:00 brd ff:ff:ff:ff:ff:ff

Update:
I can now answer the question from the original poster, that is, how to get /dev/ttyUSBx devices. It turns out that the usbserial kernel module has a feature (intended for development/experimentation only, not production) which allows it to turn any pair of in/out usb bulk endpoints into a /dev entry looking like a serial port. The sequence of commands below will tell it to do so for the particular ZXIC modem, and also load the cdc_ether module so that an eth1 network interface to appear.
You should see /dev/ttyUSB0 through /dev/ttyUSB4 afterwards, with ttyUSB0 and ttyUSB1 responding to AT commands.

# opkg update && opkg install kmod-usb-net kmod-usb-net-cdc-ether kmod-usb-serial
# echo "0x19d2 0x0532" > /sys/bus/usb-serial/drivers/generic/new_id

18

The problem is that there is no "typically". This is proprietary vendor-specific land. The universally supported LTE modem management protocol is MBIM. The vendor specific QMI protocol is supported by many modems based on Qualcomm chipsets. But when it comes to AT command controlling ECM (or NCM) interfaces, then there is no standard at all. Each vendor have their own set of commands.

So the 3GGP standard +CGACT you tried is your best bet, and it does look like it's working. Maybe with +CGATT=1 too?

You could try to configure the eth1 interface manually with the ip address you got if DHCP still doesn't work. The DCHP servier would be a local modem firmware thing, so it's not necessarily supported. Either make up a netmask and gateway, or disable arp and just configure the single address and default route out the device. But this is futile as long as you got that NO-CARRIER. You need to figure out the magic AT command to enable the link.

You could try to see if there are any promising vendor specific commands in the AT+CLAC list, but note that this list probably is incomplete. You can usuallly get some idea about what pormising commands will do by running them with '=?'

It doesn't matter much unless you are going to use ppp, but you can get high speed serial support by using the 'option' driver instead of the generic usb-serial driver.

opkg install kmod-usb-serial-option
echo 19d2 0532 ff >/sys/bus/usb-serial/drivers/option1/new_id

Note that the last USB interface/function is ADB (ff/42/01). You can access it using e.g.

opkg install adb
adb shell

It uses libusb so no driver is necessary. But this is mostly for fun if you want to poke around inside the modem firmware. Not very useful in general.

19

Maybe this one?

AT+CGDATA Enter Data State
The AT+CGDATA write command causes the MT to perform whatever actions are necessary to
establish communication between the TE and the network using one or more packet domain PDP
types.

20

Thank you bmork and AndrewZ for useful suggestions.

I believe that both AT+CGACT and AT+CGATT deal with the connection between the modem and the network, not the connection between the modem and the host computer. (Consistent with what bmork points out that there is no standard for how to control ECM interface of modems.) What I see is that even when I run both, and use AT+CGPADDR=1 to see that the modem has obtained an IP address, eth1 still shows as NO-CARRIER.

AT+CGDATA? outputs a list of supported protocols, which in my case is only "PPP". So I believe that at most, this could be used to initiate PPP communication over the same serial link used for the AT commands. (That could be useful to try in itself, in order to verify that the modem in fact has data connection with the network, but I still hope to discover how to use the eth1 interface.)

The fact that one of the interfaces is ADB (Android Debug Bridge) is very interesting. It allowed me shell access to the modem, which is itself a little Linux system. By grepping around for known AT commands such as "CGDATA", I found one kernel module, cpko.ko, which contained that string.
Running strings on it revealed a whole set of seemingly vendor specific commands starting with AT+Z.
I picked a rather long one, "AT+ZCHNELSET", and a Google search revealed one single PDF document containing that string: http://www.usr.cn/Down/WH_G405tf-AT-command-set_V1.0.0.pdf.
Even though it is in Chinese, I could find a sequence diagram showing command AT+GCACT=1,1 being followed by AT+ZGACT=1,1 , which sounded promising.

Afterwards, I have found the AT+ZGACT command also described on this page: http://wiki.lemaker.org/ME3760 , which describes how to use the ZTE ME3760 modem with some Linux system, and it turns out the same sequence of AT commands resulted in my modem ThinkWill ML7820 opening the eth1 interface for traffic.

Now, all that remains is to automate the sequence of AT commands, which I assume OpenWrt already has ample support for, I just need to figure out how to script it properly, such that the system will attempt reconnection after losing contact with tower, etc. This is meant for a remote installation (temperature and other monitoring of a cabin), so I do not want OpenWrt to get stuck and need rebooting for any reason. I will probably want to add a fallback to power cycle the router, in case of no network contact for 24 hours, but I would like the modem and router itself to be able to automatically re-establish connection in most cases.