EG25 reboots into broken QHSUSB__BULK mode

Technical Subjects
1

Hello!

I am developing a solution using an EG25GGB-MINIPCIE on a Linux system.

I have the modem working fine. :slight_smile:

However I’ve found thought that after any kind of reset either soft (at+cfun=1,1/at+qpowd=1) or hard (toggling PERST#), the modem boots into a different and dysfunctional state:

[Tue Jun 11 15:58:26 2024] usb 3-1.3: new high-speed USB device number 8 using dwc2
[Tue Jun 11 15:58:26 2024] usb 3-1.3: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00
[Tue Jun 11 15:58:26 2024] usb 3-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Tue Jun 11 15:58:26 2024] usb 3-1.3: Product: QHSUSB__BULK
[Tue Jun 11 15:58:26 2024] usb 3-1.3: Manufacturer: Qualcomm CDMA Technologies MSM
[Tue Jun 11 15:58:26 2024] option 3-1.3:1.0: GSM modem (1-port) converter detected
[Tue Jun 11 15:58:26 2024] usb 3-1.3: GSM modem (1-port) converter now attached to ttyUSB0

None of the required USB interfaces appear, there is only the DM interface…
From here, I’ve not yet found any way to recover the device other than to physically power cycle the whole system(!) Even a reboot of the host does not succeed.
Only a real power on reset seems to work - and I then get all my usb interfaces back:

[Tue Jun 11 17:39:50 2024] usb 3-1.3: new high-speed USB device number 4 using dwc2
[Tue Jun 11 17:39:51 2024] usb 3-1.3: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 3.18
[Tue Jun 11 17:39:51 2024] usb 3-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Tue Jun 11 17:39:51 2024] usb 3-1.3: Product: EG25-G
[Tue Jun 11 17:39:51 2024] usb 3-1.3: Manufacturer: Quectel
[Tue Jun 11 17:39:52 2024] usbcore: registered new interface driver cdc_wdm
[Tue Jun 11 17:39:52 2024] cdc_ether 3-1.3:1.4 usb0: register ‘cdc_ether’ at usb-fe980000.usb-1.3, CDC Ethernet Device, 82:4b:42:b5:9c:52
[Tue Jun 11 17:39:52 2024] usbcore: registered new interface driver cdc_ether
[Tue Jun 11 17:39:52 2024] usbcore: registered new interface driver usbserial_generic
[Tue Jun 11 17:39:52 2024] usbserial: USB Serial support registered for generic
[Tue Jun 11 17:39:52 2024] usbcore: registered new interface driver qmi_wwan
[Tue Jun 11 17:39:52 2024] usbcore: registered new interface driver option
[Tue Jun 11 17:39:52 2024] usbserial: USB Serial support registered for GSM modem (1-port)
[Tue Jun 11 17:39:52 2024] option 3-1.3:1.0: GSM modem (1-port) converter detected
[Tue Jun 11 17:39:52 2024] usb 3-1.3: GSM modem (1-port) converter now attached to ttyUSB0
[Tue Jun 11 17:39:52 2024] option 3-1.3:1.1: GSM modem (1-port) converter detected
[Tue Jun 11 17:39:52 2024] usb 3-1.3: GSM modem (1-port) converter now attached to ttyUSB1
[Tue Jun 11 17:39:52 2024] option 3-1.3:1.2: GSM modem (1-port) converter detected
[Tue Jun 11 17:39:52 2024] usb 3-1.3: GSM modem (1-port) converter now attached to ttyUSB2
[Tue Jun 11 17:39:52 2024] option 3-1.3:1.3: GSM modem (1-port) converter detected
[Tue Jun 11 17:39:52 2024] usb 3-1.3: GSM modem (1-port) converter now attached to ttyUSB3

Obviously this is unhelpful for a device that must operate remotely.

So my questions are:

  1. What IS this QHSUSB__BULK mode with only a DM interface? I couldn’t find anything in the documentation that describes it?
  2. How do I get out of this mode without having to physically unplug my system? e.g. is there some magic code I can send down the DM usb interface to recover?
  3. Is there anything I can do (e.g. a QCFG setting?) to prevent ever going into this mode?

Thank you.

2

It means that the modem is in DUMP mode.
It is better to provide the DUMP log and check the local FAEs. Seems that there is some bugs.

3

Thank you for the quick response!
How do I exit DUMP mode without a power cycle?

4

If it always enter dump mode. It should be fixed.

Unless that we catch the dump log or power off and power on again I don’t know how to exit the dump mode.
What’s the firmware version?

5

Ok, re: version:
ati
Quectel
EG25
Revision: EG25GGBR07A08M2G
How do I get the dump log? Is that something I get from the DM interface?

6

If you have QLog, just run the QLog.

7

OK, I’ve found qlog here:

I’ve downloaded, compiled and run it whilst doing an at+cfun1,1

It generated this log file:
https://portal.ramtech.co.uk:2443/20240612_131914_0000.qmdl

A directory was created called qlog_files/dump_20240612_131940 but there is nothing in it.

..and the console output was:
[000.000] Version: QLog_Linux_Android_V1.5.18
[000.000] will use filter file: built-in filter 0
[000.102] Find [0] idVendor=2c7c, idProduct=0125, bNumInterfaces=6, ttyDM=/dev/ttyUSB0, ttyGENERAL=, ttyTHIRD=, busnum=003, dev=004, usbdevice_pah=/sys/bus/usb/devices/3-1.3
[000.104] open /dev/ttyUSB0 ttyfd = 3
[000.104] Press CTRL+C to stop catch log.
[000.104] catch log via tty port
[000.107] kfifo_alloc [0] = 4
[000.107] qlog_logfile_create qlog_files/20240612_131914_0000.qmdl logfd=4
[000.421] qlog_init_filter_finished
[005.600] recv: 0M 411K 429B in 5495 msec
[013.374] recv: 0M 607K 360B in 7774 msec
[022.935] poll fd=3, revents = 0019
[022.935] QLog abnormal exit…
[022.935] kfifo_free [0] = 4
[022.935] close_fds exit
[023.938] No Quectel Modules found, Wait for connect or Press CTRL+C to quit!
[026.042] Find [0] idVendor=2c7c, idProduct=0125, bNumInterfaces=1, ttyDM=/dev/ttyUSB0, ttyGENERAL=, ttyTHIRD=, busnum=003, dev=008, usbdevice_pah=/sys/bus/usb/devices/3-1.3
[026.042] usbfs_is_kernel_driver_alive find interface 0 has match the driver option
[026.044] usbfs_detach_kernel_driver detach kernel driver success
[026.044] open /dev/bus/usb/003/008 dm_usbfd = 3
[026.044] Press CTRL+C to stop catch log.
[026.044] qlog_usbfs_read ( dm ) enter
[026.044] kfifo_alloc [0] = 5
[026.044] catch dump for mdm chipset
STATE ← SAHARA_WAIT_HELLO
← SAHARA PKT 0000: 01 00 00 00 30 00 00 00 …0…
RECEIVED ← SAHARA_HELLO_ID
RECEIVED ← SAHARA_MODE_IMAGE_TX_PENDING
Unexpected module state: 0
[026.045] ql_usbfs_read n = -1, errno: 108 (Cannot send after transport endpoint shutdown)
[026.045] kfifo_free [0] = 5
[026.045] qlog_usbfs_read ( dm ) exit
[026.045] close_fds exit

8

From the log, I can confirm that it is in dump mode.

9

OK, and how can I recover from this state?

10

As I mentioned, it seems bug. You need to provide the dump log to the Quectel to fix it.
And what is the current firmwware version, maybe you can flash with the lastest firmware.

11

Sorry, aren’t you Quectel? :sweat_smile:

12

Please provide the dump log.

13

Sorry, I thought I had. Isn’t that this?

14

That is not the dump log.
Dump log is very big.

15

Does this happen 100% of the time?

What is current firmware version?

16

Yes, every restart that is not a power cycle it does this. Even a hard reset via the PERST#.

ati
Quectel
EG25
Revision: EG25GGBR07A08M2G

OK
at+qgmr
EG25GGBR07A08M2G_30.203.30.203

OK

17

It is already the lastest firmare.
In this case, maybe the module is damaged somewhere.

18

Thanks for the information. It’s useful to know I am on the latest firmware.

I’m surprised if the module hardware is damaged as it works fine as cellular modem, it’s only on a reset that it enters this state…

With regard to the dump, I don’t seem to be able to get one. Running qlog after it is in this state, I just get:

[000.000] Version: QLog_Linux_Android_V1.5.18
[000.000] will use filter file: built-in filter 0
[001.104] Find [0] idVendor=2c7c, idProduct=0125, bNumInterfaces=1, ttyDM=, ttyGENERAL=, ttyTHIRD=, busnum=003, dev=008, usbdevice_pah=/sys/bus/usb/devices/3-1.3
[001.104] open /dev/bus/usb/003/008 dm_usbfd = 3
[001.104] Press CTRL+C to stop catch log.
[001.104] qlog_usbfs_read ( dm ) enter
[001.105] kfifo_alloc [0] = 5
[001.105] catch dump for mdm chipset
STATE ← SAHARA_WAIT_HELLO
[002.106] poll() = 0, errno: 17 (File exists)
Failed to read complete bytes. Only read upto 0 bytes
← SAHARA PKT 0000: 01 00 00 00 30 00 00 00 …0…
RECEIVED ← SAHARA_HELLO_ID
RECEIVED ← SAHARA_MODE_IMAGE_TX_PENDING
Unexpected module state: 0
[002.107] ql_usbfs_read n = -1, errno: 108 (Cannot send after transport endpoint shutdown)
[002.107] kfifo_free [0] = 5
[002.107] qlog_usbfs_read ( dm ) exit
[002.107] close_fds exit

So do you think my next step should be to source another unit and try that?

19

cat /sys/kernel/debug/usb/devices

20

T: Bus=03 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 8 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0125 Rev= 0.00
S: Manufacturer=Qualcomm CDMA Technologies MSM
S: Product=QHSUSB__BULK
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr= 2mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms