This article will introduce how to use RM510Q-GL 5G LTE Modem with OpenWrt.

Working / Performing ways of 5G LTE Modern USB dongles

QMI and MBIM

① It is required to switch the modem to provide NDIS interface
QMI protocol is proprietary protocol by Qualcomm. In contrast to qmi, mbim is more standardized protocol for 3G/4G dongles.
RMNET driver is used for supporting the Multiplexing and aggregation Protocol (MAP). This protocol is used by all recent chipsets using Qualcomm Technologies, Inc. modems.
This driver can be used to register onto any physical network device in IP mode. Physical transports include USB, HSIC, PCIe and IP accelerator.
Multiplexing allows for creation of logical netdevices (rmnet devices) to handle multiple private data networks (PDN) like a default internet, tethering, multimedia messaging service (MMS) or IP media subsystem (IMS). Hardware sends packets with MAP headers to rmnet. Based on the multiplexer id, rmnet routes to the appropriate PDN after removing the MAP header.
Aggregation is required to achieve high data rates. This involves hardware sending aggregated bunch of MAP frames. rmnet driver will de-aggregate these MAP frames and send them to appropriate PDN’s.
② Kernel Cellular Modem Device Drivers – Rmnet Driver
MBIM (Mobile Broadband Interface Model).

NCM

NCM (Network Control Model) is ethernet over USB protocol used by some fast speed USB modems/dongles.
USB CDC-ECM

static const struct driver_info cdc_info = {
    .description =  "CDC Ethernet Device",
    .flags =    FLAG_ETHER | FLAG_POINTTOPOINT,
    .bind =     usbnet_cdc_bind,
    .unbind =   usbnet_cdc_unbind,
    .status =   usbnet_cdc_status,
    .set_rx_mode =  usbnet_cdc_update_filter,
    .manage_power = usbnet_manage_power,
};

③ Linux-Drivers-Net-USB-CDC-ethernet-based-networking-peripherals

RNDIS

RNDIS (Remote Network Driver Interface Specification) is ethernet over USB protocol used by some fast speed USB modems/dongles.
④ OpenWrt-WWAN-ethernetoverusb-RNDIS
The Remote Network Driver Interface Specification (RNDIS) is a Microsoft proprietary protocol used mostly on top of USB. It provides a virtual Ethernet link to most versions of the Windows, Linux, and FreeBSD operating systems. Multiple revisions of a partial RNDIS specification are available from Microsoft, but Windows implementations have been observed to issue requests not included in that specification, and to have undocumented constraints.
The protocol is tightly coupled to Microsoft’s programming interfaces and models, most notably the Network Driver Interface Specification (NDIS), which are alien to operating systems other than Windows. This complicates implementing RNDIS on non-Microsoft operating systems, but Linux, FreeBSD, NetBSD and OpenBSD implement RNDIS natively.
The USB Implementers Forum (USB-IF) defines at least three non-proprietary USB communications device class (USB CDC) protocols with comparable “virtual Ethernet” functionality; one of them (CDC-ECM) predates RNDIS and is widely used for interoperability with non-Microsoft operating systems, but does not work with Windows.
Most versions of Android include RNDIS USB functionality. For example, Samsung smartphones have the capability and use RNDIS over USB to operate as an virtual Ethernet card that will connect the host PC to the mobile or Wi-Fi network in use by the phone, effectively working as a mobile broadband modem or a wireless card, for mobile hotspot tethering.
⑤ Wikipedia-RNDIS

PPP

OpenWrt can be setup and configured for using a USB 3g/UMTS-modem for WAN connection using the older (and slower) ppp protocol.
⑥ OpenWrt PPP protocol

Some AT commands for 5G Modem

List Available Operator

AT+COPS=?

Current Operator

AT+COPS?

Query Network Information
Response
+QNWINFO: AcT,oper,band,channel
Example
+QNWINFO: “FDD LTE”,”44020″,”LTE BAND 3″,1675

AT+QNWINFO

Query the Service Provider Name
Response
+QSPN: FNN,SNN,SPN,alphabet,RPLMN
If alphabet is 0, FNN and SNN will be shown in GSM 7-bit default alphabet string.
If alphabet is 1, FNN and SNN will be shown in UCS2 hexadecimal string.
Example
+QSPN: “SoftBank”,”SoftBank”,”Y!mobile”,0,”44020″

AT+QSPN

Signal Quality Report
Integer type. Received signal strength indication.
0 -113 dBm or less
1 -111 dBm
2–30 -109 dBm to -53 dBm
31 -51 dBm or greater
99 Not known or not detectable

AT+CSQ

Query Primary Serving Cell Information
Response
In LTE mode:
+QENG: “servingcell”,state,”LTE”,is_tdd,MCC,MNC,cellID,PCID,earfcn,freq_band_ind,UL_bandwidth,DL_bandwidth,TAC,RSRP,RSRQ,RSSI,SINR,CQI,tx_power,srxlev
state: String type. UE state.
“SEARCH” UE is searching but could not (yet) find a suitable 3G/4G cell.
“LIMSRV” UE is camping on a cell but has not registered on the network.
“NOCONN” UE is camping on a cell and has registered on the network, and it is in idle mode.
“CONNECT” UE is camping on a cell and has registered on the network, and a call is in progress.
cellID: Integer type. Cell ID. The parameter determines the 16-bit (GSM) or 28-bit (UMTS) cell ID. Range: 0–0xFFFFFFF.
PCID: Number format. Physical cell ID.
earfcn: The parameter determines the E-UTRA-ARFCN of the cell that was scanned.
freq_band_ind: Integer type. E-UTRA frequency band (see 3GPP 36.101)
UL_bandwidth:
Integer type. UL bandwidth.
0 1.4 MHz
1 3 MHz
2 5 MHz
3 10 MHz
4 15 MHz
5 20 MHz
TAC: Tracking Area Code (see 3GPP 23.003 Section 19.4.2.3)
Example
+QENG: “servingcell”,”NOCONN”,”LTE”,”FDD”,440,20,4B1B302,25,1675,3,4,4,24A7,-87,-5,-62,27,-

⑦ Open Cellid Lookup

AT+QENG="servingcell"

Network Registration Status
Response
+CREG: n,stat,lac,ci,AcT
n: Integer type
0 Disable network registration unsolicited result code
1 Enable network registration unsolicited result code: +CREG: stat
2 Enable network registration unsolicited result code with location information:
lac： Two bytes location area code in hexadecimal format.
ci： 28-bit (UMTS/LTE) cell ID in hexadecimal format.

AT+CREG=n
AT+CREG?

Query the current configuration of preferred LTE bands to be searched by UE

AT+QNWPREFCFG="lte_band"

Write the preferred LTE bands to be searched by UE

AT+QNWPREFCFG="lte_band",:

Query the current configuration of Network Search Mode

AT+QNWPREFCFG="mode_pref"

Write the configuration of Network Search Mode

AT+QNWPREFCFG="mode_pref",:

Query the current configuration of Roaming Preference

AT+QNWPREFCFG="roam_pref"

Write the configuration of Roaming Preference
1 Roam only on home network
3 Roam on affiliate network
255 Roam on any network

AT+QNWPREFCFG="roam_pref",

Read the band configured in the carrier policy

AT+QNWPREFCFG="policy_band"

Query the band configured in the UE capability information

AT+QNWPREFCFG="ue_capability_band"

Attachment or Detachment of PS
Integer type. Indicate the state of PS attachment.
0 Detached
1 Attached

AT+CGATT?

Read PDP Contexts

AT+QGDCNT?

Write PDP Contexts

AT+CGDCONT=5,"IPV4V6","rakuten.jp","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0

Read all PDP Contexts
Response
+CGACT: cid,state
Integer type. Indicate the state of PDP context activation.
0 Deactivated
1 Activated

AT+CGACT?

Activate or Deactivate PDP Contexts

AT+CGATT=state,cid

Read Service Center Address

AT+CSCA?

Setting up working mode on a Windows PC using the Serial Debugging Tool by Quectel

0 RMNET via QMI tool using QMI commands, get public IP address.
1 ECM Interface, init data call via CDC-ECM, sending ECM commands, get local IP.
2 MBIM Interface, Mobile Broadband Interface Model, works well with win8/10/11.
3 RNDIS Interface, TCP/IP over USB based on RNDIS, get local IP.
Actually, Modem works on mode 0 by default and uses NDIS with the driver provided by quectel tech supporter on a windows PC.
And with the QCOM_V1.6.exe tool, you can send AT Commands to Modem.

AT+QCFG="usbnet"?
AT+QCFG="usbnet",0
AT+CFUN=1,1

楽天モバイル バンド3 固定

AT+QNWPREFCFG="lte_band",3

Package

Installation

opkg update
opkg install usb-modeswitch kmod-mii kmod-usb-net kmod-usb-wdm
opkg install kmod-usb-net-qmi-wwan uqmi luci-proto-qmi
reboot
ls -l /dev/cdc-wdm0

APN Configuration

IPv6 Configuration

References

[1]: https://openwrt.org/docs/guide-user/network/wan/wwan/ltedongle
[2]: https://www.kernel.org/doc/html/latest/networking/device_drivers/cellular/qualcomm/rmnet.html
[3]: https://github.com/torvalds/linux/blob/master/drivers/net/usb/cdc_ether.c
[4]: https://openwrt.org/docs/guide-user/network/wan/wwan/ethernetoverusb_rndis
[5]: https://en.wikipedia.org/wiki/RNDIS
[6]: https://openwrt.org/docs/guide-user/network/wan/wwan/3gdongle
[7]: https://opencellid.org/

Footer

Author: Yuzu
Link: https://kamisu66.com/2022/05/08/RM510Q-GL-5G-LTE-OpenWrt-Modem-USB-PCI-E-how-to/
Copyright Notice: All articles in this blog are licensed under CC BY-NC-SA 4.0 unless stating additionally.