WPJ428 + SIMCOM 8202G

We try to build a FOSS 5GNR Router with OpenWRT. Some challenges we have encountered so far:

• OpenWRT stable misses a patch to enable our board ethernet port -> we compile from source
• The Modem Manager simtech plugin does not declare 5GNR

Flash OpenWRT from uboot

(Configure your computer with a static IP address 192.168.1.2/24 and make sure you have a running tftp server containing your image)

First connect your UART cable on the router:

Launch minicom

sudo minicom -D /dev/ttyUSB0

Then boot the router. Press repeatidly [ENTER] to get the following prompt:

(IPQ40xx) #

Then enter the following commands:

set ipaddr 192.168.1.1
set serverip 192.168.1.2
ping ${serverip}
sf probe
tftpboot 0x84000000 openwrt-ipq40xx-generic-compex_wpj428-squashfs-sysupgrade.bin
sf erase 0x00180000 +$filesize
sf write 0x84000000 0x00180000 $filesize
bootipq

Compile

make menuconfig
scripts/diffconfig.sh > ../wpj428/config
make download
make -j $(nproc)

To inject a config file:

# Append changes to bottom of .config
cat config >> .config
# Apply changes
make defconfig
make download
make -j $(nproc)

Flash OpenWRT from OpenWRT (!)

Copy the firmware in router's /tmp. Why /tmp? Your router has more volatile storage than persistent one, moreover you will overwrite the persistent storage. So, copy the firmware in /tmp! Next, we will use the sysupgrade command. -v is verbose, -n ask openwrt to erase configuration files (ie. ask for a factory reset).

sysupgrade -v -n /tmp/openwrt-ipq40xx-generic-compex_wpj428-squashfs-sysupgrade.bin

Get root on MimoAP

1. Download a backup from your router firmware
2. Extract it, edit /etc/shadow, replace the hash of the root user with the one from the admin user
3. Recompress the folder hierarchy
4. Import this new archive as backup in MimoAP
5. Run ssh root@192.168.1.1 (replace with the IP address of your router) and use your admin password
6. Enjoy! (But you should really install a vanilla OpenWRT instead)

Flash OpenWRT from Compex ROM (MimoAP)

Not written

Flash MimoAP/OpenWRT with Compex tools on Uboot

Not written

Using ModemManager

Wait for modems:

mmcli -M

Connect/Disconnect:

mmcli -m 0 --simple-connect="apn=free"
mmcli -m 0 --simple-disconnect

Set supported/preferred mode:

mmcli -m 0 --set-allowed-modes="3G|4G" --set-preferred-mode=4G
mmcli -m 0 --set-allowed-modes="5G"

Error

Despite patching ModemManager simtech plugin, we get an error if we force 5GNR. We typed:

mmcli -m 0 --set-allowed-modes="5G"
mmcli -m 0 --simple-disconnect
mmcli -m 0 --simple-connect="apn=free"

We got:

Fri Mar 19 23:57:22 2021 daemon.warn [2633]: <warn>  [modem0] couldn't load operator code: Current operator MCC/MNC is still unknown
Fri Mar 19 23:57:22 2021 daemon.warn [2633]: <warn>  [modem0] couldn't load operator name: Current operator description is still unknown
Fri Mar 19 23:57:48 2021 daemon.info [2633]: <info>  [modem0] state changed (connected -> disconnecting)
Fri Mar 19 23:57:48 2021 daemon.info [2633]: <info>  [modem0] state changed (disconnecting -> registered)
Fri Mar 19 23:57:48 2021 daemon.info [2633]: <info>  [modem0/bearer1] connection #1 finished: duration 936s, tx: 79 bytes, rx :566 bytes
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0] simple connect started...
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0] simple connect state (4/8): wait to get fully enabled
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0] simple connect state (5/8): register
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0] simple connect state (6/8): bearer
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0] simple connect state (7/8): connect
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0] state changed (registered -> connecting)
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0/bearer1] couldn't start network: QMI protocol error (14): 'CallFailed'
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0/bearer1] call end reason (3): generic-no-service
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0/bearer1] verbose call end reason (3,2001): [cm] no-service
Fri Mar 19 23:57:57 2021 daemon.warn [2633]: <warn>  [modem0/bearer1] connection attempt #2 failed: QMI protocol error (14): 'CallFailed'
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0] state changed (connecting -> registered)
Fri Mar 19 23:57:57 2021 daemon.info [2633]: <info>  [modem0/bearer1] connection #2 finished: duration 0s, tx: 0 bytes, rx :0 bytes

And the new bearer contains:

root@OpenWrt:/# mmcli -b 1
  ----------------------------
  General    |           path: /org/freedesktop/ModemManager1/Bearer/1
             |           type: default
  ----------------------------
  Status     |      connected: no
             |      suspended: no
             |     ip timeout: 20
  ----------------------------
  Properties |            apn: free
             |        roaming: allowed
  ----------------------------
  Statistics |       attempts: 2
             |       attempts: 1
             | total-duration: 936
             | total-bytes rx: 566
             | total-bytes tx: 79

Next step: qmi-utils!

• https://forum.sierrawireless.com/t/mc7354-got-qmi-error-callfailed-when-starting-network/9053
• https://community.autopi.io/t/error-when-starting-qmi-connection/2338

Logs

uboot logs:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00118
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -      1679 - bootable_media_detect_success, Start
B -      1693 - elf_loader_entry, Start
B -      5073 - auth_hash_seg_entry, Start
B -      7219 - auth_hash_seg_exit, Start
B -    577690 - elf_segs_hash_verify_entry, Start
B -    695375 - PBL, End
B -    695399 - SBL1, Start
B -    786439 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    787885 - boot_flash_init, Start
D -     52818 - boot_flash_init, Delta
B -    844845 - boot_config_data_table_init, Start
D -      3835 - boot_config_data_table_init, Delta - (419 Bytes)
B -    852054 - clock_init, Start
D -      7575 - clock_init, Delta
B -    864102 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B -    867516 - sbl1_ddr_set_params, Start
B -    872614 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    876996 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13176 - sbl1_ddr_set_params, Delta
B -    890735 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    960961 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    976579 - Image Load, Start
D -    151978 - QSEE Image Loaded, Delta - (297240 Bytes)
B -   1128985 - Image Load, Start
D -      1447 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1139420 - Image Load, Start
D -    211388 - APPSBL Image Loaded, Delta - (432219 Bytes)
B -   1351204 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1357421 - SBL1, End
D -    664130 - SBL1, Delta
S - Flash Throughput, 2007 KB/s  (731926 Bytes,  364613 us)
S - DDR Frequency, 537 MHz


U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Jul 25 2017 - 11:36:26)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010000
NAND:  SF: Detected MX25L25635E with page size 4 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x2000000
32 MiB
MMC:   
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
machid: 8010000
flash_type: 0
Hit any key to stop autoboot:  0 
Net:   MAC0 addr:4:f0:21:65:18:12
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0

Sources

• All the commits in OpenWRT about the WPJ428
• https://openwrt.org/docs/guide-developer/build-system/use-buildsystem