Zyxel LTE3301-Plus kernel freeze when mobile IP set on wwan0

Hello,

I have a Zyxel LTE3301-Plus, Quectel EG06-E, with OpenWrt 23.05.2 / kernel 5.15.137.
I have learned in this thread Zyxel LTE3301-PLUS, Quectel EG06-E don't work I can start/power the lte-modem with this command: "echo 1 > /sys/class/gpio/power_modem/value"
Whether I use the normal web-luci or with luci-proto-modemmanager or command-line uqmi commands, the kernel freeze in the moment, when the mobile IPs set on wwan0.
SIM unlock does not work via webgui so I use "uqmi -d /dev/cdc-wdm0 --uim-verify-pin1 1234" on command line.

I see:
uqmi -d /dev/cdc-wdm0 --get-current-settings { "pdp-type": "ipv4v6", "ip-family": "ipv4", "mtu": 1500, "ipv4": { "ip": "100.87.45.XXX", "dns1": "139.7.30.125", "dns2": "139.7.30.126", "gateway": "100.87.45.222", "subnet": "255.255.255.252" }, "ipv6": { }, "domain-names": { } }

but in this moment:

11: wwan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN qlen 1000 link/ether be:f5:49:00:52:78 brd ff:ff:ff:ff:ff:ff inet6 fe80::bcf5:49ff:fe00:5278/64 scope link valid_lft forever preferred_lft forever

wwan0 has no IP.

Have anybody an idea what I do wrong and how I can use the LTE-Modem on the right way? Thank you very much.

When I use luci-proto-modemmanager this happend:

netifd: lte (5446): modem available at /org/freedesktop/ModemManager1/Modem/1
netifd: lte (5446): setting allowed mode to '4g'
netifd: lte (5446): successfully set current modes in the modem
netifd: lte (5446): starting connection with apn 'web.vodafone.de'...
[2538]: <info>  [modem1] simple connect started...
[2538]: <info>  [modem1] simple connect state (3/10): enable
[2538]: <info>  [modem1] state changed (disabled -> enabling)
[2538]: <info>  [modem1] power state updated: on
[2538]: <info>  [modem1] simple connect state (4/10): wait to get fully enabled
[2538]: <info>  [modem1] state changed (enabling -> enabled)
[2538]: <info>  [modem1] simple connect state (5/10): wait after enabled
[2538]: <info>  [modem1] 3GPP registration state changed (unknown -> registering)
[2538]: <info>  [modem1] simple connect state (6/10): register
[2538]: <info>  [modem1] 3GPP registration state changed (registering -> home)
[2538]: <info>  [modem1] state changed (enabled -> registered)
[2538]: <info>  [modem1] simple connect state (7/10): wait to get packet service state attached
[2538]: <info>  [modem1] simple connect state (8/10): bearer
[2538]: <info>  [modem1] simple connect state (9/10): connect
[2538]: <info>  [modem1] state changed (registered -> connecting)
[2538]: <info>  [modem1/bearer1] QMI IPv4 Settings:
[2538]: <info>  [modem1/bearer1]     address: 100.74.21.XXX/29
[2538]: <info>  [modem1/bearer1]     gateway: 100.74.21.XXX
[2538]: <info>  [modem1/bearer1]     DNS #1: 139.7.30.125
[2538]: <info>  [modem1/bearer1]     DNS #2: 139.7.30.126
[2538]: <info>  [modem1/bearer1]        MTU: 1500
[2538]: <info>  [modem1/bearer1] QMI IPv6 Settings:
[2538]: <info>  [modem1/bearer1]     address: 2a00:20:d007:4567:ed8c:57bc:XXXXXX/64
[2538]: <info>  [modem1/bearer1]     gateway: 2a00:20:d007:4567:28ca:1c6c:7fed:XXX/64
[2538]: <info>  [modem1/bearer1]     DNS #1: 2a01:860:0:300::53
[2538]: <info>  [modem1/bearer1]     DNS #2: 2a01:860:0:300::153
[2538]: <info>  [modem1/bearer1]        MTU: 1358
[2538]: <info>  [modem1/bearer1] reloading stats is supported by the device
[2538]: <info>  [modem1] state changed (connecting -> connected)
[2538]: <info>  [modem1] simple connect state (10/10): all done
netifd: lte (5446): successfully connected the modem
netifd: lte (5446): signal refresh rate is not set
netifd: lte (5446): network operator name: Vodafone.de
netifd: lte (5446): network operator MCCMNC: 26202
netifd: lte (5446): registration type: home
netifd: lte (5446): access technology: lte
netifd: lte (5446): signal quality: 80%
netifd: lte (5446): IPv4 connection setup required in interface lte: static
netifd: lte (5446): adding IPv4 address 100.74.21.XXX, netmask 255.255.255.248
netifd: lte (5446): adding default IPv4 route via 100.74.21.XXXX
netifd: lte (5446): adding primary DNS at 139.7.30.125
netifd: lte (5446): adding secondary DNS at 139.7.30.126
netifd: Interface 'lte' is now up
dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
netifd: Network device 'wwan0' link is up
netifd: lte (5446): IPv6 connection setup required in interface lte: static
dnsmasq[1]: using nameserver 185.150.99.255#53
dnsmasq[1]: using nameserver 9.9.9.9#53
dnsmasq[1]: using nameserver 139.7.30.125#53
dnsmasq[1]: using nameserver 139.7.30.126#53
dnsmasq[1]: using only locally-known addresses for test
dnsmasq[1]: using only locally-known addresses for onion
dnsmasq[1]: using only locally-known addresses for localhost
dnsmasq[1]: using only locally-known addresses for local
dnsmasq[1]: using only locally-known addresses for invalid
dnsmasq[1]: using only locally-known addresses for bind
dnsmasq[1]: using only locally-known addresses for lan
netifd: lte (5446): adding IPv6 address 2a00:20:d007:4567:ed8c:57bc:XXXXX, prefix 64
netifd: lte (5446): adding default IPv6 route via 2a00:20:d007:4567:28ca:1c6c:XXXXXX
netifd: lte (5446): adding primary DNS at 2a01:860:0:300::53
netifd: lte (5446): adding secondary DNS at 2a01:860:0:300::153
dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
dnsmasq[1]: using nameserver 185.150.99.255#53
dnsmasq[1]: using nameserver 9.9.9.9#53
dnsmasq[1]: using nameserver 139.7.30.125#53
dnsmasq[1]: using nameserver 139.7.30.126#53
dnsmasq[1]: using nameserver 2a01:860:0:300::53#53
dnsmasq[1]: using nameserver 2a01:860:0:300::153#53
dnsmasq[1]: using only locally-known addresses for test
dnsmasq[1]: using only locally-known addresses for onion
dnsmasq[1]: using only locally-known addresses for localhost
dnsmasq[1]: using only locally-known addresses for local
dnsmasq[1]: using only locally-known addresses for invalid
dnsmasq[1]: using only locally-known addresses for bind
dnsmasq[1]: using only locally-known addresses for lan

and then freeze the kernel.

Remove PIN check, uninstall ModemManager, switch the modem to MBIM and configure it as shown here: https://openwrt.org/docs/guide-user/network/wan/wwan/ltedongle

I have searched and tried to remove the PIN check, but I have not found the right command to do this. How can I remove the PIN check?

Just put it into a phone and make a change there. Otherwise see +CLCK description in the AT Commands Manual.

okay, I have removed the PIN-check in my phone.
ModemManager is removed.
now I fight with MBIM:

AT+QCFG="usbnet"
+QCFG: "usbnet",0

OK
AT+QCFG="usbnet"
+QCFG: "usbnet",0

OK
AT+QCFG="usbnet",2
OK
AT+QCFG="usbnet"
+QCFG: "usbnet",0

OK
AT+QCFG="usbnet",2
OK
AT+QCFG="usbnet"
+QCFG: "usbnet",0

OK

I got the OK for the change, but it does not change :confused:

Please read instructions carefully.

okay

# picocom /dev/ttyUSB3
...
RDY
AT+QCFG="usbnet"
+QCFG: "usbnet",2

OK

in the first try I used /dev/ttyUSB2.
I have installed "kmod-usb-net-cdc-mbim umbim luci-proto-mbi" and removed "luci-proto-qmi" too.
I configure a new interface as with "Protocol: QMI Cellular"
but now nothing starts:

netifd: Interface 'lte' is setting up now
netifd: lte (3927): Waiting for SIM initialization
dnsmasq[1]: read /etc/hosts - 12 names
dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 6 names
dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses
netifd: lte (4161): Stopping network lte
netifd: lte (4161): Command failed: ubus call network.interface notify_proto { "action": 0, "link-up": false, "keep": false, "interface": "lte" } (Permission denied)
netifd: Interface 'lte' is now down
netifd: Interface 'lte' is setting up now
netifd: lte (4169): Waiting for SIM initialization

You need to configure a new interface as "Protocol: MBIM Cellular"

yes, I have set a new interface as "Protocol: MBIM Cellular"
the power on echo command is in /etc/rc.local
When it comes online the kernel freeze as all times before, in that moment when the mobile IP set to wwan0:

kernel: [   31.967743] usb 2-1: new SuperSpeed USB device number 2 using xhci-mtk
kernel: [   32.016146] option 2-1:1.0: GSM modem (1-port) converter detected
kernel: [   32.029518] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB0
kernel: [   32.044669] option 2-1:1.1: GSM modem (1-port) converter detected
kernel: [   32.057786] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB1
kernel: [   32.073096] option 2-1:1.2: GSM modem (1-port) converter detected
kernel: [   32.086121] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB2
kernel: [   32.101515] option 2-1:1.3: GSM modem (1-port) converter detected
kernel: [   32.114555] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB3
kernel: [   32.199486] cdc_mbim 2-1:1.4: cdc-wdm0: USB WDM device
kernel: [   32.211935] cdc_mbim 2-1:1.4 wwan0: register 'cdc_mbim' at usb-1e1c0000.xhci-1, CDC MBIM, 32:e7:bf:5c:3d:XX
netifd: Interface 'lte' is setting up now
netifd: lte (3568): mbim[3568] Reading capabilities
dnsmasq[1]: started, version 2.89 cachesize 1000
dnsmasq[1]: DNS service limited to local subnets
dnsmasq[1]: compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
dnsmasq[1]: UBus support enabled: connected to system bus
dnsmasq-dhcp[1]: DHCP, IP range 192.168.2.100 -- 192.168.2.249, lease time 12h
dnsmasq-dhcp[1]: DHCP, IP range 192.168.1.100 -- 192.168.1.249, lease time 12h
dnsmasq[1]: using only locally-known addresses for test
dnsmasq[1]: using only locally-known addresses for onion
dnsmasq[1]: using only locally-known addresses for localhost
dnsmasq[1]: using only locally-known addresses for local
dnsmasq[1]: using only locally-known addresses for invalid
dnsmasq[1]: using only locally-known addresses for bind
dnsmasq[1]: using only locally-known addresses for lan
dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
dnsmasq[1]: using nameserver 185.150.99.255#53
dnsmasq[1]: using nameserver 9.9.9.9#53
dnsmasq[1]: using only locally-known addresses for test
dnsmasq[1]: using only locally-known addresses for onion
dnsmasq[1]: using only locally-known addresses for localhost
dnsmasq[1]: using only locally-known addresses for local
dnsmasq[1]: using only locally-known addresses for invalid
dnsmasq[1]: using only locally-known addresses for bind
dnsmasq[1]: using only locally-known addresses for lan
dnsmasq[1]: read /etc/hosts - 12 names
dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 6 names
dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses
netifd: lte (3568):   devicetype: 0003 - remote
netifd: lte (3568):   cellularclass: 0001
netifd: lte (3568):   voiceclass: 0001 - no-voice
netifd: lte (3568):   simclass: 0002
netifd: lte (3568):   dataclass: 003C
netifd: lte (3568):   smscaps: 0003
netifd: lte (3568):   controlcaps: 0001
netifd: lte (3568):   maxsessions: 0008
netifd: lte (3568):   deviceid: XXXXXXXXXXXX
netifd: lte (3568):   firmwareinfo: EG06ELAR03A07M4G
netifd: lte (3568):   hardwareinfo: EG06-E
netifd: lte (3568): mbim[3568] Checking pin
netifd: lte (3568): required pin: 3 - pin2
netifd: lte (3568): remaining attempts: 3
netifd: lte (3568): mbim[3568] Checking subscriber
netifd: lte (3568):   readystate: 0001 - initialized
netifd: lte (3568):   simiccid: XXXXXXXXXXXXXXXX
netifd: lte (3568):   subscriberid: XXXXXXXXXXXX
netifd: lte (3568): mbim[3568] Register with network
netifd: lte (3568):   nwerror: 0000 - unknown
netifd: lte (3568):   registerstate: 0002 - searching
netifd: lte (3568):   registermode: 0001 - automatic
netifd: lte (3568):   availabledataclasses: 0000 - (null)
netifd: lte (3568):   currentcellularclass: 0001 - gsm
netifd: lte (3568):   provider_id: (null)
netifd: lte (3568):   provider_name: (null)
netifd: lte (3568):   roamingtext: (null)
netifd: lte (3568): mbim[3568] Subscriber registration failed (code 2)
root: mbim bringup failed, retry in 15s
netifd: lte (3813): mbim[3813] Stopping network
netifd: lte (3813): Command failed: ubus call network.interface notify_proto { "action": 0, "link-up": false, "keep": false, "interface": "lte" } (Permission denied)
netifd: Interface 'lte' is now down
netifd: Interface 'lte' is setting up now
netifd: lte (3821): mbim[3821] Reading capabilities
netifd: lte (3821):   devicetype: 0003 - remote
netifd: lte (3821):   cellularclass: 0001
netifd: lte (3821):   voiceclass: 0001 - no-voice
netifd: lte (3821):   simclass: 0002
netifd: lte (3821):   dataclass: 003C
netifd: lte (3821):   smscaps: 0003
netifd: lte (3821):   controlcaps: 0001
netifd: lte (3821):   maxsessions: 0008
netifd: lte (3821):   deviceid: XXXXXXXXXXXX
netifd: lte (3821):   firmwareinfo: EG06ELAR03A07M4G
netifd: lte (3821):   hardwareinfo: EG06-E
netifd: lte (3821): mbim[3821] Checking pin
netifd: lte (3821): required pin: 3 - pin2
netifd: lte (3821): remaining attempts: 3
netifd: lte (3821): mbim[3821] Checking subscriber
netifd: lte (3821):   readystate: 0001 - initialized
netifd: lte (3821):   simiccid: XXXXXXXXXXXXXXXXXXXXXX
netifd: lte (3821):   subscriberid: XXXXXXXXXXXXXXXXXXXx
netifd: lte (3821): mbim[3821] Register with network
netifd: lte (3821):   nwerror: 0000 - unknown
netifd: lte (3821):   registerstate: 0003 - home
netifd: lte (3821):   registermode: 0001 - automatic
netifd: lte (3821):   availabledataclasses: 0020 - lte
netifd: lte (3821):   currentcellularclass: 0001 - gsm
netifd: lte (3821):   provider_id: 26202
netifd: lte (3821):   provider_name: vodafone.de
netifd: lte (3821):   roamingtext: (null)
netifd: lte (3821): mbim[3821] Registered in home mode
netifd: lte (3821): mbim[3821] Attach to network
netifd: lte (3821):   nwerror: 0000 - unknown
netifd: lte (3821):   packetservicestate: 0002 - attached
netifd: lte (3821):   uplinkspeed: 50000000
netifd: lte (3821):   downlinkspeed: 100000000
netifd: lte (3821): mbim[3821] Connect to network
netifd: lte (3821):   sessionid: 0
netifd: lte (3821):   activationstate: 0001 - activated
netifd: lte (3821):   voicecallstate: 0000 - none
netifd: lte (3821):   nwerror: 0000 - unknown
netifd: lte (3821):   iptype: 0003 - ipv4v6
netifd: lte (3821): mbim[3821] Connected
netifd: lte (3821): mbim[3821] Setting up wwan0
netifd: lte (3821):   ipv4address: 100.75.67.XXX/27
netifd: lte (3821):   ipv4gateway: 100.75.67.XXX
netifd: lte (3821):   ipv4mtu: 1500
netifd: lte (3821):   ipv4dnsserver: 139.7.30.125
netifd: lte (3821):   ipv4dnsserver: 139.7.30.126
netifd: lte (3821):   ipv6address: 2a00:20:d00b:7211:1ddf:53df:e2ba:XXXX/64
netifd: lte (3821):   ipv6gateway: 2a00:20:d00b:7211:8558:677c:d457:XXXX
netifd: lte (3821):   ipv6mtu: 1358
netifd: lte (3821):   ipv6dnsserver: 2a01:860:0:300:0:0:0:53
netifd: lte (3821):   ipv6dnsserver: 2a01:860:0:300:0:0:0:153
kernel: [   60.872103] 8021q: adding VLAN 0 to HW filter on device wwan0
netifd: Interface 'lte' is now up
netifd: Network device 'wwan0' link is up
netifd: Network alias 'wwan0' link is up
netifd: Interface 'lte_4' is enabled
netifd: Interface 'lte_4' is setting up now
netifd: Interface 'lte_4' is now up
netifd: Interface 'lte_4' has link connectivity
dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
dnsmasq[1]: using nameserver 185.150.99.255#53
dnsmasq[1]: using nameserver 9.9.9.9#53
dnsmasq[1]: using nameserver 139.7.30.125#53
dnsmasq[1]: using nameserver 139.7.30.126#53
dnsmasq[1]: using only locally-known addresses for test
dnsmasq[1]: using only locally-known addresses for onion
dnsmasq[1]: using only locally-known addresses for localhost
dnsmasq[1]: using only locally-known addresses for local
dnsmasq[1]: using only locally-known addresses for invalid
dnsmasq[1]: using only locally-known addresses for bind
dnsmasq[1]: using only locally-known addresses for lan
netifd: Interface 'lte_6' is enabled
netifd: Interface 'lte_6' is setting up now

sorry, because you recommended MBIM protocol instead of QMI

I would like to understand the reason for your choice as the EG06 LTE module is very similar to my EG18EA

you could remove the line:

"echo 1 > /sys/class/gpio/power_modem/value"

and try again (since my router with 4G connection has no command in /etc/rc.local for the connection)

you could show your current /etc/config/network configuration

That is weird, please show the content of /etc/config/network
I don't think that is related but see if you can update the modem firmware.

1 Like

One of the reasons is that MBIM is more standardised. Then in OpenWrt case MBIM code is more tolerant to IPV4V6 mismatch between the interface settings and carrier capabilities; it can also automatically set MTU. At the same time it is still possible to talk QMI with a modem in MBIM mode if necessary for debug etc.

1 Like

would I get additional information from debugging on MBIM or would I have the same performance and/or debug level I currently have a router with QMI

router = LTE5398-M904
config:

config interface 'wan'
        option device '/dev/cdc-wdm0'
        option proto 'qmi'
        option pdptype 'ipv4'
        option auth 'none'
        option apn 'iliad'
        option delegate '0'

Unrelated to the topic. Let's focus on OP's issue.

1 Like

I can contact you privately (if you think it is more correct regarding the post in question) if you want...

config interface 'lte'
	option proto 'mbim'
	option device '/dev/cdc-wdm0'
	option apn 'web.vodafone.de'
	option auth 'none'
	option pdptype 'ipv4v6'

can you confirm that the sim insert into a phone works ?

you can kindly try luci-proto-qmi package...

This sim card get's IPs in the lte router and works in a phone.
I also tried my phone sim card in the router, the same behavior.
No matter whether mbim, qmi or modemmanager, the modem goes online and the kernel freeze as soon as the wwan0 interface gets the IPs set.
I have no idea what in this situation is happening a linux kernel crashes.

please post output command:

dmesg 

If the kernel crashes and you can't execute any commands, you could try scheduling a process to run when the interface receives an IP address (and save the logs on a USB stick).

https://openwrt.org/docs/guide-user/advanced/hotplug_extras#instructions

or you could send the logs to a syslog server external to the router

https://openwrt.org/docs/guide-user/base-system/log.essentials#network_logging

another option is to try only ipv4 or only ipv6 in case the kernel doesn't crash with only one protocol active:

a test:

config interface 'lte'
	option proto 'mbim'
	option device '/dev/cdc-wdm0'
	option apn 'web.vodafone.de'
	option auth 'none'
	option pdptype 'ipv4'