Cell modules

^ Quectel

This section about Quectel cellular modules and supporting tools and documentation. Keywords: BG95 BG96.

Some Quectel documentation. All docs require account creation and login:

• https://www.quectel.com/product/lpwa-bg96-cat-m1-nb1-egprs
• https://www.quectel.com/library
• https://www.quectel.com/library/masterclass-mcus-and-rtos-for-iot-devices

Quectel BG95 and BG96 related projects on github: IM Card Configurations

• https://github.com/topics/bg96?l=c

• https://www.96boards.org/documentation/iot/stinger96/hardware-docs/files/stinger96-hw-user-manual.pdf

• https://github.com/botletics/SIM7000-LTE-Shield/issues/39

Subdomain at github.io . . .

• https://quic.github.io/startupkits/BG96/

^ Flashing utility QFirehose

Use of Quectel flashing utility QFirehose:

• https://forums.quectel.com/t/bg95-

m3-fw-update/6843/4

2025-10-07

QFirehose expects some fifteen or more files for a typical Quectel firmware update:

• https://forums.quectel.com/t/ec25-flash-new-firmware-error/5214/3

Excerpt from above post:

[alex@debiank QFirehose]$ sudo ./QFirehose -f /home/alex/Downloads/quectel/EC25EFAR06A08M4G
[000.000]: QFirehose Version: Quectel_LTE&5G_QFirehose_Linux&Android_V1.2.3
[000.000]: Builded: Apr 27 2020 12:56:28
[000.000]: Find md5 check file </home/alex/Downloads/quectel/EC25EFAR06A08M4G/md5.txt>
[000.000]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/contents.xml pass
[000.002]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/appsboot.mbn pass
[000.003]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/ENPRG9x07.mbn pass
[000.003]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/firehose/partition_complete_p4K_b256K.mbn pass
[000.003]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/firehose/patch_p4K_b256K.xml pass
[000.004]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/firehose/prog_nand_firehose_9x07.mbn pass
[000.004]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/firehose/rawprogram_nand_p4K_b256K_update.xml pass
[000.036]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/mdm9607-perf-boot.img pass
[000.296]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/mdm9607-perf-sysfs.ubi pass
[000.353]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/mdm-perf-recovery-image-mdm9607-perf.ubi pass
[000.581]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/NON-HLOS.ubi pass
[000.582]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/NPRG9x07.mbn pass
[000.582]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/partition.mbn pass
[000.582]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/partition_nand.xml pass
[000.583]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/rpm.mbn pass
[000.584]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/sbl1.mbn pass
[000.587]: md5 checking: /home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/tz.mbn pass
[000.587]: Totals checking 17 files md5 value, 0 file fail!
[000.587]: [1] /sys/bus/usb/devices/1-2 2c7c/125/0
[000.732]: P: /dev/bus/usb/001/025 idVendor=2c7c idProduct=0125
[000.732]: C: /dev/bus/usb/001/025 bNumInterfaces: 1
[000.732]: I: If#= 0 Alt= 0 #EPs= 2 Cls=ff Sub=ff Prot=ff
[000.732]: E: Ad=81 Atr=02 MxPS= 512 Ivl=0ms
[000.732]: E: Ad=01 Atr=02 MxPS= 512 Ivl=0ms
[000.732]: qusb_noblock_open port_name = /dev/ttyUSB0
[000.733]: dir=/home/alex/Downloads/quectel/EC25EFAR06A08M4G/update/firehose/..
[000.736]: d_name=NPRG9x07.mbn
[000.736]: prog_nand_firehose_filename = NPRG9x07.mbn
[000.736]: STATE ← SAHARA_WAIT_HELLO
[000.736]: RECEIVED ← SAHARA_HELLO_ID
[000.736]: RECEIVED ← SAHARA_MODE_MEMORY_DEBUG
[000.736]: ERROR NOT SAHARA_MODE_IMAGE_TX_PENDING
[000.736]: SENDING → SAHARA_HELLO_RESPONSE
[000.736]: STATE ← SAHARA_WAIT_COMMAND
[000.736]: RECEIVED ← SAHARA_HELLO_ID

^ Quectel App Notes

link to Quectel BG95 BG77 BG600L series HTTPS app note:

https://www.quectel.com/wp-content/uploads/2021/03/Quectel_BG95BG77BG600L_Series_HTTPS_Application_Note_V1.1.pdf

^ SIM Card Configurations

Eseye dot com SIM card instructions page:

• https://docs.eseye.com/Content/BGxx/ConnectBG95ToNetwork.htm

^ AT command responses

A number of the following commands noted from Quectel forum post https://forums.quectel.com/t/bg95-m3-doesnt-call-callback-function/15647 . . .

at+qgmr
BG95M3LAR02A03_01.004.01.004

at+qgmr
BG95M3LAR02A03_01.004.01.004

AT+CGPADDR
+CGPADDR: 1,10.163.171.64


at&v
&C: 1
&D: 2
&F: 0
&W: 0
Q: 0
V: 1
X: 1
Z: 0
E: 1
S0: 0
S4: 10
S5: 8
S6: 2
S7: 0
S8: 2
S10: 14
S3: 13

OK
at+csq
+csq: 23,99

OK

Potentially file related:

AT+QMBNCFG=?List_all"
+QMBNCFG: "list"
+QMBNCFG: "select"[,"<mbn name>"]
+QMBNCFG: "deactivate"
+QMBNCFG: "autosel"[,(0,1)]
+QMBNCFG: "delete","<mbn name>"
+QMBNCFG: "add","<filename>"

OK
AT+QMBNCFG="list"
+QMBNCFG: "list",0,1,1,"ROW_Commercial",0x09010801,201911271
+QMBNCFG: "list",1,0,0,"Commercial-TMO",0x09010500,202003131
+QMBNCFG: "list",2,0,0,"Non_VoLTE-ATT",0x09010300,201910241
+QMBNCFG: "list",3,0,0,"IMSless-Verizon",0x09010100,201911071

More pertinent info on Quectel file read and write access in BGxx modules may be available in https://www.quectel.com/wp-content/uploads/2021/03/Quectel_BG95BG77_FILE_Application_Note_V1.0-2.pdf.

at+qflst
+QFLST: "security/",2

OK
AT+QMBNCFG="List_all"
ERROR
AT+QMBNCFG=?List_all"
+QMBNCFG: "list"
+QMBNCFG: "select"[,"<mbn name>"]
+QMBNCFG: "deactivate"
+QMBNCFG: "autosel"[,(0,1)]
+QMBNCFG: "delete","<mbn name>"
+QMBNCFG: "add","<filename>"

OK
AT+QMBNCFG="list"
+QMBNCFG: "list",0,1,1,"ROW_Commercial",0x09010801,201911271
+QMBNCFG: "list",1,0,0,"Commercial-TMO",0x09010500,202003131
+QMBNCFG: "list",2,0,0,"Non_VoLTE-ATT",0x09010300,201910241
+QMBNCFG: "list",3,0,0,"IMSless-Verizon",0x09010100,201911071

OK
AT+QFREAD="ROW_Commercial"
+CME ERROR: 400
at+qfopen="ROW_Commercial"
+QFOPEN: 1

OK
AT+QFREAD=?
+QFREAD: <filehandle>[,<length>]

OK
at+qfread=AT+QFREAD=
OK
AT+QFREAD="ROW_Commercial",160
+CME ERROR: 400
AT+QFREAD=1,160
+CME ERROR: 402
AT+QFREAD=1,16
+CME ERROR: 402
at+qfclose=1
OK
at+qfopen="Commercial-TMO"
+QFOPEN: 1

OK
at+qfread=1,5
+CME ERROR: 402
at+qfread=?
+QFREAD: <filehandle>[,<length>]

OK
at+qfread=1
+CME ERROR: 402
at+qfopen
OK
at
OK
at+qflst
+QFLST: "Commercial-TMO",0
+QFLST: "ROW_Commercial",0
+QFLST: "security/",2

Here created a file on "eufs" directory of Quectel file system space:

OK
at+qflds="eufs"
+QFLDS: 1390592,2435072

OK
at+qflst
+QFLST: "security/",2

OK
at+qfopen="eufs:test",0
+QFOPEN: 20000

OK
at+qfwrite=20000,10
CONNECT
+QFWRITE: 6,6

Here learning how to list files in a directory on BG95 file system space:

at+qflst
+QFLST: "security/",2

OK
at+qflst="eufs"
+CME ERROR: 417
at+qflst="eufs:*"
+QFLST: "EUFS:test",16
+QFLST: "EUFS:test1",0

OK

Learning how to close and to delete a BG9x file:

at+qfclose=20000
OK
at+qfdel="EUFS:test"
OK

Excerpt . . .

at+qfopen="EUFS:test1.txt"
+QFOPEN: 20001

OK
at+qfread=20001
+CME ERROR: 402
at
OK
at+qfread=20001,10
+CME ERROR: 402
at+qfread=20001,16
+CME ERROR: 402
at
OK
at
OK
at+qflst="eufs:*"
+QFLST: "EUFS:test1.txt",0

OK
at+qflst="eufs:/datatx/"
+QFLST: "EUFS:",6

OK
at+qflst="eufs:/datatx/*"
+QFLST: "EUFS:private/",3
+QFLST: "EUFS:test1.txt",15
+QFLST: "EUFS:upgrade_efs/",2
+QFLST: "EUFS:upgrade_nand/",2

OK

^ Quectel AT Upload and Download File Commands

File which describes where in BG9x flash spaces to write two files which are normally part of their SDK sample apps:

• file:///home/ted/Downloads/Quectel_BG96_QuecOpen_Application_Note_V1.0.pdf . . . see page 18 of 37

File which describes various Quectel AT file commands, including ones to upload to BG module and to download files from module:

• Quectel_BG95&BG77_FILE_Application_Note_V1.0.pdf

^ Choosing a test-able GPIO for GPIO demo app

We would like to learn to write Quectel BG95 firmware which can control two or more GPIOs of the BG95-Mx module. QuecOpen's demo app to exercise a GPIO contains token ``, which appears many times in source file `example_gpio.c`. Following excerpt shares just some of these symbol appearances:

Excerpt x - QuecOpen gpio demo variable 'g_test_pin_num':

ted@localhost1:/usr/local/include/quectel/quectel/example/gpio/src$ grep -n g_test_pin_num ./*

149:MODULE_PIN_ENUM  g_test_pin_num = PIN_E_GPIO_01;
267:	IOT_INFO("[GPIO] ### Test pin is %d, gpio_id is %d ###", g_test_pin_num, gpio_map_tbl[g_test_pin_num].gpio_id);
268:	qt_uart_dbg(uart_conf.hdlr, "[GPIO] ### Test pin is %d, gpio_id is %d ###", g_test_pin_num, gpio_map_tbl[g_test_pin_num].gpio_id);
273:	{g_test_pin_num = 32;
274:		gpio_config(g_test_pin_num, QAPI_GPIO_OUTPUT_E, QAPI_GPIO_NO_PULL_E, QAPI_GPIO_2MA_E);	
275:		status = qapi_TLMM_Drive_Gpio(gpio_id_tbl[g_test_pin_num], gpio_map_tbl[g_test_pin_num].gpio_id, QAPI_GPIO_LOW_VALUE_E);
276:		IOT_DEBUG("[GPIO] Set %d QAPI_GPIO_LOW_VALUE_E status = %d", g_test_pin_num, status);
277:		qt_uart_dbg(uart_conf.hdlr,"[GPIO] Set %d QAPI_GPIO_LOW_VALUE_E status = %d", g_test_pin_num, status);
280:		status = qapi_TLMM_Drive_Gpio(gpio_id_tbl[g_test_pin_num], gpio_map_tbl[g_test_pin_num].gpio_id, QAPI_GPIO_HIGH_VALUE_E);
281:		IOT_DEBUG("[GPIO] Set %d QAPI_GPIO_HIGH_VALUE_E status = %d", g_test_pin_num, status);
282:		qt_uart_dbg(uart_conf.hdlr,"[GPIO] Set %d QAPI_GPIO_HIGH_VALUE_E status = %d", g_test_pin_num, status);
285:		status = qapi_TLMM_Release_Gpio_ID(&tlmm_config[g_test_pin_num], gpio_id_tbl[g_test_pin_num]);
 .
 .
 .

This variable is assigned values a couple of different places in the code, though not all these assignments necessarily can we say will happen at a given run time. But these assignments lead us to a symbol which expresses a QuecOpen C based data structure, and this in turn serves to create tables of GPIO pins and pin attributes. Three such pin tables are declared in `example_gpio.c`, one table for each of the modules BG95, BG77 and BG600L.

Following GPIO pin table from QuecOpen gpio demo app:

 52 /*  !!! This Pin Enumeration Only Applicable BG95-OPEN Project !!!
 53  */
 54  #if defined(_QUECTEL_PROJECT_BG95)
 55 GPIO_MAP_TBL gpio_map_tbl[PIN_E_GPIO_MAX] = {
 56 /* PIN NUM,   PIN NAME,  GPIO ID  GPIO FUNC */
 57     {  4,     "GPIO_01",    24,       0}, 
 58     {  5,     "GPIO_02",    21,       0}, 
 59     {  6,     "GPIO_03",    22,       0}, 
 60     {  7,     "GPIO_04",    23,       0}, 
 61     { 18,     "GPIO_05",     3,       0}, 
 62     { 19,     "GPIO_06",     2,       0}, 
 63     { 22,     "GPIO_07",     1,       0},
    .
    .
    .

From document Quectel_BG95BG77BG600L_Series_QuecOpen_Application_Note_V1.4.pdf, page 23, it appears that BG95 pin 18 has signal/port name GPIO5, which in turn can be configured to be GPIO_3 or I2C1_SCL. This matters because the eval board breaks out a limited number of test pins on J803, J805, J806 and J804. On J804 there is a pin designated as I2C_SCL. In document Quectel_BG95BG77BG600L_Series_QuecOpen_Application_Note_V1.4.pdf there are references only to I2C1, not any other numbered I2C peripheral.

To iterate over valid GPIOs in QuecOpen gpio sample app, a review of _____ data structure assists in needed modification to source file example_gpio.c:

ted@localhost1:/usr/local/include/quectel$ grep -nr GPIO_MAP_TBL ./*
./include/qapi/qapi_pwm.h:144:}PWM_GPIO_MAP_TBL;
./quectel/utils/include/quectel_gpio.h:71:}GPIO_MAP_TBL;    <-- this is the data structure we need understand

typedef struct{^M
        uint32_t pin_num;^M
        char     *pin_name;^M
        uint32_t gpio_id;^M
        uint32_t gpio_func;^M
}GPIO_MAP_TBL;^M

* Timer unit type.
*
* Enumeration of the units in which timer duration can 
* be specified. 
*/
typedef enum {
  QAPI_TIMER_UNIT_TICK,     /**< Return time in ticks. */
  QAPI_TIMER_UNIT_USEC,     /**< Return time in microseconds. */
  QAPI_TIMER_UNIT_MSEC,     /**< Return time in milliseconds. */
  QAPI_TIMER_UNIT_SEC,      /**< Return time in seconds. */
  QAPI_TIMER_UNIT_MIN,      /**< Return time in minutes. */
  QAPI_TIMER_UNIT_HOUR,     /**< Return time in hours. */
  QAPI_TIMER_UNIT_MAX
}qapi_TIMER_unit_type;

^ Eseye

• https://docs.eseye.com/Content/SoftwareProducts/AnyNetSMARTconnectATcommands/ETMSTATE.htm ETM states

^ References

• https://winjia.medium.com/linux-using-minicom-to-transfer-data-between-host-and-development-board-platform-f67133f386e2

• https://cnquectel-my.sharepoint.com/personal/america-fae_quectel_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Famerica%2Dfae%5Fquectel%5Fcom%2FDocuments%2Fstephen%2FBG95%2FBG95%5Foffcail%5Fdoc%2F04%20Software&ga=1

User manual for UMTS&LTE EVAL KIT:

• Quectel_UMTS-LTE_EVB_User_Guide_V2.1-1.pdf

Hardware reference manual for BG95:

• Quectel_BG95_Series_Hardware_Design_V1.3-1.pdf