Zyxel NR7101 QMI Mode crash

Hi, I have successfully installed OpenWRT on NR7101 and currently using MBIM mode as I've read that QMI mode will crash the usb on speeds more than 200mbps.

Now I have some questions:

  1. How come the stock Zyxel Firmware can use QMI mode for the modem but openWRT cannot, since Zyxel's fw seems to be some locked-up version of OpenWRT
  2. Why is there so different performance between QMI on stock Zyxel Firmware vs MBIM mode on OpenWRT? The NR7101 cannot keep a good CA on MBIM (B3 or B7 + N28) while on stock firmware QMI I get B3 + CA B1+B7+B20 + N28
  3. Is there any roadmap on fixing this?

you can't assume it'll be fixed, ever.

it might get fixed, but the person most suitable for implementing the fix(es) is the one with
the device on hand, which would be you.

Thanks for the response @frollic

You are right, but I have no experience in this software engineering domain, however, since I do own the device, I will be more than happy to somehow assist, if someone puts me in the right direction.

The stock firmware use QMI with buffering/aggregation (QMAP). This is not yet supported with OpenWrt. Using MBIM will achieve the same and is preferred anyway. Much easier to set up and use.

Note that mode only affects framing in practice. All the useful QMI configuration and monitoring requests are available in either mode, with proper tools. For example:

root@OpenWrt:/# mbimcli -p -d /dev/cdc-wdm0  --query-device-caps
[/dev/cdc-wdm0] Device capabilities retrieved:
              Device type: 'embedded'
           Cellular class: 'gsm'
              Voice class: 'no-voice'
                SIM class: 'removable'
               Data class: 'umts, hsdpa, hsupa, lte, custom'
                 SMS caps: 'pdu-receive, pdu-send'
                Ctrl caps: 'reg-manual'
             Max sessions: '15'
        Custom data class: '5G/TDS'
                Device ID: '354351110015210'
            Firmware info: 'RG502QEAACR13A02M4G_ZYXEL'
            Hardware info: 'RG502Q-EA'
root@OpenWrt:/# qmicli -p -d /dev/cdc-wdm0 --device-open-mbim    --get-service-v
ersion-info
[/dev/cdc-wdm0] Supported versions:
        ctl (1.5)
        wds (1.229)
        dms (1.79)
        nas (1.25)
        qos (1.18)
        wms (1.10)
        auth (1.14)
        at (1.6)
        voice (2.1)
        cat2 (2.24)
        uim (1.77)
        pbm (1.4)
        test (1.0)
        loc (2.145)
        sar (1.0)
        ims (1.93)
        csd (1.0)
        ts (1.0)
        tmd (1.0)
        wda (1.28)
        csvt (1.6)
        imsa (1.44)
        coex (1.0)
        pdc (1.0)
        rfrpe (1.0)
        dsd (1.77)
        unknown [0x2d] (1.3)
        unknown [0x30] (1.12)
        unknown [0x31] (1.0)
        unknown [0x44] (1.6)
        unknown [0x47] (1.1)
        unknown [0x49] (1.7)
        unknown [0x4a] (1.1)
        unknown [0x4b] (1.3)
        unknown [0x4c] (1.0)
        unknown [0x4d] (1.5)
        unknown [0x4e] (1.2)
        unknown [0x55] (1.0)
[23 Jan 2023, 15:35:17] -Warning ** [/dev/cdc-wdm0] MBIM device wasn't explicitly closed

This is unexpected. Don't see why that would be different. Worth looking into if you're interested in working on this.

How may I help @bmork ?

I don't know exactly how.

But that's not a problem which is likely to be solved unless someone figures out what stock and we do differently. And it's not something I'd know how to reproduce. I guess that goes for others as well.

Which means that if this is going to be solved, then it's probably up to you to poke around the stock firmware and see if there is any trick we can pick up from them.

Note that you can run most AT commands on stock firmware using the atcmd command:

root@NR7101:~# atcmd /dev/ttyUSB3 ATI
Quectel
RG502Q-EA
Revision: RG502QEAACR13A02M4G_ZYXEL

OK

This is awesome. I am not sure with what commands to start though? Is the any specific sort of output that would be useful to you?

Coming back to this as I haven’t been able to somehow eavesdrop the stock firmware, but I have experimented using the Rooter firmware (the pure OpenWRT images for the NR7101 are borked).

I have tested cellular connection over QMI and MBIM mode. Thing is that when in QMI mode, I have full LTE carrier aggregation (1 main and 3 CA) and 5G NSA, while in MBIM mode I will either get 1LTE main and one 5G NSA or just 1 LTE.

I am not technically experienced in this particular domain to understand what’s going on under the hood, but I don’t think it’s some difference from the stock firmware, or if it is, it’s just under the MBIM protocol, because when in QMI protocol on Rooter, the cellular connection is very similar to the stock firmware. Of course I have not tried to benchmark the connection under QMI in order to avoid crashes.

any chance of an opkg list-installed from rooter compared to pure openwrt?

Will do when I get back home, in a couple of days.

Hi,
Maybe I don't have a 5G modem, but I would like to stand up for normal OpenWrt. I'm using mbim and it works fine with my modem (EM160R-GL).

There you go, @hecatae

BusyBox v1.33.1 (2021-08-31 22:20:08 UTC) built-in shell (ash)

  _______              __           
 |  __   |.-----.-----|  |_ .-----..----.
 |  __  _||  _  |  _  |   _||  -__||   _|
 |_|  \_\ |_____|_____|____||_____||__|  
      C E L L U L A R   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02-SNAPSHOT r16279-5cc0535800
 -----------------------------------------------------
root@ROOter:~# opkg list
464xlat - 12
base-files - 5-r16279-5cc0535800
block-mount - 2021-01-04-c53b1882-1
busybox - 1.33.1-1
bwmon - 1.000-1
ca-bundle - 20210119-1
ca-certificates - 20210119-1
cgi-io - 2020-10-27-ab4c3471-19
chat - 2.4.8.git-2020-10-03-3
comgt - 0.32-33
coreutils - 8.32-6
coreutils-date - 8.32-6
curl - 7.78.0-1
ddns-scripts - 2.8.2-11
ddns-scripts-services - 2.8.2-11
dnsmasq - 2.85-1
dropbear - 2020.81-2
eoip - 0.5-1
etherwake - 1.09-5
ext-buttons - 1.000-1
ext-command - 4.500-1
ext-extra - 1.000-1
ext-login - 1.000-1
ext-p910nd - 1.000-1
ext-rooter-basic - 4.500-1
ext-rspeedtest - 1.000-1
ext-simplegps - 1.000-1
ext-sms - 1.000-1
ext-speedtest - 1.000-1
ext-splash - 1.000-1
ext-splashconfig - 1.000-1
ext-theme - 1.000-1
ext-wireguard - 4.500-1
fdisk - 2.36.1-2
firewall - 2021-03-23-61db17ed-1
fstools - 2021-01-04-c53b1882-1
fwtool - 2019-11-12-8f7fe925-1
getrandom - 2020-10-25-9ef88681-2
hd-idle - 1.05-2
hostapd-common - 2020-06-08-5a8b3662-35
httping - 2.5-1
ip-tiny - 5.11.0-3
ip6tables - 1.8.7-1
ipset - 7.6-1
iptables - 1.8.7-1
iptables-mod-conntrack-extra - 1.8.7-1
iptables-mod-ipopt - 1.8.7-1
irqbalance - 1.8.0-1
iw - 5.9-8fab0c9e-1
iwinfo - 2021-04-30-c45f0b58-2.1
jshn - 2021-05-16-b14c4688-2
jsonfilter - 2018-02-04-c7e938d6-1
kernel - 5.4.158-1-ba49f87837f1ddf5642a28d03009acfe
kmod-cfg80211 - 5.4.158+5.10.68-1-1
kmod-crypto-aead - 5.4.158-1
kmod-crypto-arc4 - 5.4.158-1
kmod-crypto-ccm - 5.4.158-1
kmod-crypto-cmac - 5.4.158-1
kmod-crypto-crc32c - 5.4.158-1
kmod-crypto-ctr - 5.4.158-1
kmod-crypto-des - 5.4.158-1
kmod-crypto-ecb - 5.4.158-1
kmod-crypto-gcm - 5.4.158-1
kmod-crypto-gf128 - 5.4.158-1
kmod-crypto-ghash - 5.4.158-1
kmod-crypto-hash - 5.4.158-1
kmod-crypto-hmac - 5.4.158-1
kmod-crypto-lib-blake2s - 5.4.158-1
kmod-crypto-lib-chacha20 - 5.4.158-1
kmod-crypto-lib-chacha20poly1305 - 5.4.158-1
kmod-crypto-lib-curve25519 - 5.4.158-1
kmod-crypto-lib-poly1305 - 5.4.158-1
kmod-crypto-manager - 5.4.158-1
kmod-crypto-md4 - 5.4.158-1
kmod-crypto-md5 - 5.4.158-1
kmod-crypto-null - 5.4.158-1
kmod-crypto-pcompress - 5.4.158-1
kmod-crypto-rng - 5.4.158-1
kmod-crypto-seqiv - 5.4.158-1
kmod-crypto-sha256 - 5.4.158-1
kmod-crypto-sha512 - 5.4.158-1
kmod-fs-exfat - 5.4.158+5.12.3-1
kmod-fs-ext4 - 5.4.158-1
kmod-fs-hfs - 5.4.158-1
kmod-fs-ksmbd - 5.4.158+3.3.9-1
kmod-fs-vfat - 5.4.158-1
kmod-fuse - 5.4.158-1
kmod-gpio-button-hotplug - 5.4.158-3
kmod-ifb - 5.4.158-1
kmod-ip6tables - 5.4.158-1
kmod-ipt-conntrack - 5.4.158-1
kmod-ipt-conntrack-extra - 5.4.158-1
kmod-ipt-core - 5.4.158-1
kmod-ipt-ipopt - 5.4.158-1
kmod-ipt-ipset - 5.4.158-1
kmod-ipt-nat - 5.4.158-1
kmod-ipt-offload - 5.4.158-1
kmod-ipt-raw - 5.4.158-1
kmod-leds-gpio - 5.4.158-1
kmod-lib-crc-ccitt - 5.4.158-1
kmod-lib-crc16 - 5.4.158-1
kmod-lib-crc32c - 5.4.158-1
kmod-mac80211 - 5.4.158+5.10.68-1-1
kmod-mii - 5.4.158-1
kmod-mt76-core - 5.4.158+2021-06-06-22b69033-4
kmod-mt7603 - 5.4.158+2021-06-06-22b69033-4
kmod-nat46 - 5.4.158+2020-08-17-362640b4-1
kmod-nf-conntrack - 5.4.158-1
kmod-nf-conntrack6 - 5.4.158-1
kmod-nf-flow - 5.4.158-1
kmod-nf-ipt - 5.4.158-1
kmod-nf-ipt6 - 5.4.158-1
kmod-nf-nat - 5.4.158-1
kmod-nf-reject - 5.4.158-1
kmod-nf-reject6 - 5.4.158-1
kmod-nfnetlink - 5.4.158-1
kmod-nft-bridge - 5.4.158-1
kmod-nft-core - 5.4.158-1
kmod-nft-netdev - 5.4.158-1
kmod-nls-base - 5.4.158-1
kmod-nls-cp437 - 5.4.158-1
kmod-nls-iso8859-1 - 5.4.158-1
kmod-nls-utf8 - 5.4.158-1
kmod-ppp - 5.4.158-1
kmod-pppoe - 5.4.158-1
kmod-pppox - 5.4.158-1
kmod-rt2800-lib - 5.4.158+5.10.68-1-1
kmod-rt2800-usb - 5.4.158+5.10.68-1-1
kmod-rt2x00-lib - 5.4.158+5.10.68-1-1
kmod-rt2x00-usb - 5.4.158+5.10.68-1-1
kmod-sched-cake - 5.4.158-1
kmod-sched-core - 5.4.158-1
kmod-scsi-core - 5.4.158-1
kmod-slhc - 5.4.158-1
kmod-tun - 5.4.158-1
kmod-udptunnel4 - 5.4.158-1
kmod-udptunnel6 - 5.4.158-1
kmod-usb-acm - 5.4.158-1
kmod-usb-core - 5.4.158-1
kmod-usb-ehci - 5.4.158-1
kmod-usb-net - 5.4.158-1
kmod-usb-net-cdc-ether - 5.4.158-1
kmod-usb-net-cdc-mbim - 5.4.158-1
kmod-usb-net-cdc-ncm - 5.4.158-1
kmod-usb-net-huawei-cdc-ncm - 5.4.158-1
kmod-usb-net-ipheth - 5.4.158-1
kmod-usb-net-qmi-wwan - 5.4.158-1
kmod-usb-net-rndis - 5.4.158-1
kmod-usb-net-sierrawireless - 5.4.158-1
kmod-usb-ohci - 5.4.158-1
kmod-usb-printer - 5.4.158-1
kmod-usb-serial - 5.4.158-1
kmod-usb-serial-option - 5.4.158-1
kmod-usb-serial-qualcomm - 5.4.158-1
kmod-usb-serial-sierrawireless - 5.4.158-1
kmod-usb-serial-wwan - 5.4.158-1
kmod-usb-storage - 5.4.158-1
kmod-usb-uhci - 5.4.158-1
kmod-usb-wdm - 5.4.158-1
kmod-usb2 - 5.4.158-1
kmod-usb3 - 5.4.158-1
kmod-wireguard - 5.4.158-1
ksmbd-server - 3.3.9-1
libatomic1 - unknown-3
libblkid1 - 2.36.1-2
libblobmsg-json20210516 - 2021-05-16-b14c4688-2
libc - unknown-3
libcurl4 - 7.78.0-1
libevdev - 1.10.1-1
libfdisk1 - 2.36.1-2
libgcc1 - unknown-3
libgmp10 - 6.2.1-1
libgnutls - 3.7.1-1
libimobiledevice - 1.3.0-2
libimobiledevice-utils - 1.3.0-2
libip4tc2 - 1.8.7-1
libip6tc2 - 1.8.7-1
libipset13 - 7.6-1
libiwinfo-data - 2021-04-30-c45f0b58-2.1
libiwinfo-lua - 2021-04-30-c45f0b58-2.1
libiwinfo20210430 - 2021-04-30-c45f0b58-2.1
libjson-c5 - 0.15-2
libjson-script20210516 - 2021-05-16-b14c4688-2
liblua5.1.5 - 5.1.5-9
liblucihttp-lua - 2021-06-11-3dc89af4-1
liblucihttp0 - 2021-06-11-3dc89af4-1
liblzo2 - 2.10-4
libmnl0 - 1.0.4-2
libncurses6 - 6.2-3
libnettle8 - 3.6-1
libnftnl11 - 1.1.8-1
libnghttp2-14 - 1.43.0-1
libnl-core200 - 3.5.0-1
libnl-genl200 - 3.5.0-1
libnl-tiny1 - 2020-08-05-c291088f-2
libopenssl-conf - 1.1.1l-1
libopenssl1.1 - 1.1.1l-1
libplist - 2.2.0-2
libpthread - unknown-3
librt - unknown-3
libsmartcols1 - 2.36.1-2
libstdcpp6 - unknown-3
libubox20210516 - 2021-05-16-b14c4688-2
libubus-lua - 2021-06-30-4fc532c8-2
libubus20210630 - 2021-06-30-4fc532c8-2
libuci20130104 - 2020-10-06-52bbc99f-5
libuclient20201210 - 2021-05-14-6a6011df-1
libudev-zero - 0.4.5-2
libusb-1.0-0 - 1.0.24-1
libusbmuxd - 2.0.2-1
libusbmuxd-utils - 2.0.2-1
libustream-wolfssl20201210 - 2020-12-10-68d09243-1
libuuid1 - 2.36.1-2
libwolfssl4.8.1.66253b90 - 4.8.1-stable-1
libxml2 - 2.9.12-1
libxtables12 - 1.8.7-1
logd - 2020-10-25-9ef88681-2
lua - 5.1.5-9
luci - git-121.327.84788-c42fd6a
luci-app-ddns - git-121.327.84788-c42fd6a
luci-app-firewall - git-121.327.84788-c42fd6a
luci-app-guestwifi - 1.000-1
luci-app-hotspot - 1.000-1
luci-app-ksmbd - git-121.327.84788-c42fd6a
luci-app-nft-qos - git-122.127.81683-4e339b8
luci-app-opkg - git-121.344.66729-79f7548
luci-app-rootervpn - 1.000-1
luci-app-sqm - git-121.327.84788-c42fd6a
luci-app-vpnbypass - 1.3.1-9
luci-app-wol - git-121.327.84788-c42fd6a
luci-base - git-121.327.84788-c42fd6a
luci-compat - git-121.327.84788-c42fd6a
luci-lib-base - git-121.327.84788-c42fd6a
luci-lib-ip - git-121.327.84788-c42fd6a
luci-lib-ipkg - git-121.327.84788-c42fd6a
luci-lib-jsonc - git-121.327.84788-c42fd6a
luci-lib-nixio - git-121.327.84788-c42fd6a
luci-mod-admin-full - git-121.327.84788-c42fd6a
luci-mod-network - git-121.327.84788-c42fd6a
luci-mod-status - git-121.327.84788-c42fd6a
luci-mod-system - git-122.216.56156-8d8a4cf
luci-proto-3g - git-121.327.84788-c42fd6a
luci-proto-3x - 1.0-1
luci-proto-ipv6 - git-121.327.84788-c42fd6a
luci-proto-mbim - 1.0-1
luci-proto-ppp - git-121.327.84788-c42fd6a
luci-proto-wireguard - git-121.327.84788-c42fd6a
luci-ssl - git-121.327.84788-c42fd6a
luci-theme-argon - 2.2.5
luci-theme-argondark - 1.000-1
luci-theme-material - 1.000-1
luci-theme-openwrt-2020 - git-121.327.84788-c42fd6a
luci-theme-tomato - 1.000-1
msmtp - 1.8.15-1
mtd - 26
nano - 5.8-1
netifd - 2021-07-26-440eb064-1
nft-qos - 1.0.6-2
nftables-nojson - 0.9.6-2
ntfs-3g - 2017.3.23-4-fuseint
odhcp6c - 2021-01-09-53f07e90-16
odhcpd-ipv6only - 2021-07-18-bc9d317f-1
openssl-util - 1.1.1l-1
openvpn-easy-rsa - 3.0.8-3
openvpn-openssl - 2.5.2-1
openwrt-keyring - 2021-02-20-49283916-2
opkg - 2021-06-13-1bf042dd-1
p910nd - 0.97-9
picocom - 3.1-5
pingtest - 1.000-1
ppp - 2.4.8.git-2020-10-03-3
ppp-mod-pppoe - 2.4.8.git-2020-10-03-3
procd - 2021-02-23-37eed131-1
px5g-wolfssl - 1
qfirehose - 1
qlog - 1
rmbim - 2021-08-18-de562310-18
rpcd - 2021-03-11-ccb75178-1
rpcd-mod-file - 2021-03-11-ccb75178-1
rpcd-mod-iwinfo - 2021-03-11-ccb75178-1
rpcd-mod-luci - 20210614
rpcd-mod-rrdns - 20170710
rqmi - 2021-11-06-6f956265-11
rt2800-usb-firmware - 20201118-3
speedtestpp - 1.14-1
sqm-scripts - 1.5.1-1
tc-mod-iptables - 5.11.0-3
tc-tiny - 5.11.0-3
terminfo - 6.2-3
ubi-utils - 2.1.2-1
uboot-envtools - 2021.01-1
ubox - 2020-10-25-9ef88681-2
ubus - 2021-06-30-4fc532c8-2
ubusd - 2021-06-30-4fc532c8-2
uci - 2020-10-06-52bbc99f-5
uclient-fetch - 2021-05-14-6a6011df-1
udp-tunnel - 1
uhttpd - 2021-03-21-15346de8-2
uhttpd-mod-ubus - 2021-03-21-15346de8-2
urandom-seed - 3
urngd - 2020-01-21-c7f7b6b6-1
usb-modeswitch - 2017-12-19-f40f84c2-2
usb-storage - 1.000-1
usbids - 0.350-1
usbmuxd - 1.1.1-1
usbutils - 013-2
usign - 2020-05-23-f1f65026-1
vpnbypass - 1.3.2-1
webconsole - 1.000-1
wireguard-tools - 1.0.20210223-2
wireless-regdb - 2021.08.28-1
wireless-tools - 29-6
wpad-openssl - 2020-06-08-5a8b3662-35
wsdd2 - 2021-06-28-062a9542-1
wwan - 2019-04-29-5
zlib - 1.2.11-3
root@ROOter:~#  
1 Like

@IceG the mf286d works in qmi mode doesn't it?

Yes, in ZTE mf286d we use the QMI protocol.