Master Quectel AT Command & Compound Chaining Reference

This document serves as the comprehensive engineering cheat sheet and syntax manual for Quectel 5G and LTE-A modems (RM551E, RM520N, RM521F, RG501, RM502, RM500Q). It details standard command forms, high-throughput compound chaining syntax, RF control states, MBN profiles, and low-level Qualcomm NVRAM commands.

Command Syntax & Compound Chaining (";") Rules#

Quectel AT commands follow standard V.250 conventions with 4 execution variations:

Test Command (AT+<cmd>=?): Queries supported parameters and acceptable value ranges.
Read Command (AT+<cmd>?): Returns current operational values.
Write Command (AT+<cmd>=<p1>,<p2>): Sets active configuration parameters.
Execution Command (AT+<cmd>): Triggers a specific action with no arguments.

Compound Command Chaining with Semicolons (`;`)#

Multiple AT commands can be concatenated into a single atomic string by using a semicolon (;) delimiter:

AT+CFUN=0;+CGDCONT=1,"IPV4V6","fast.t-mobile.com";+CFUN=1

The prefix AT is specified once at the start of the line.
Subsequent chained commands begin immediately with + after the semicolon (omit redundant AT).
Compound chaining reduces serial bus round-trips and guarantees that radio toggle sequences execute in rapid atomic succession.

System Identity & Firmware Revision Commands#

AT Command	Syntax Example	Description
`ATI`	`ATI`	Product Identification: Returns manufacturer name, model designation, and baseline firmware revision.
`+GSN`	`AT+GSN`	Returns the International Mobile Equipment Identity (IMEI) number.
`+QGMR`	`AT+QGMR`	Quectel Extended Firmware Version: Returns full internal build string (e.g. `RM520NGLAAR03A03M4G`).
`+QPRTPARA`	`AT+QPRTPARA=1`	Restore NVRAM factory default parameters. (`AT+QPRTPARA=3` restores backup NV parameters).
`+QPRTPARA`	`AT+QPRTPARA=4`	Backup current NV configuration to recovery flash partition.
`+QSCLK`	`AT+QSCLK=0`	Sleep mode control (0 = disable baseband sleep, 1 = enable sleep/low-power).

Radio Power States, CFUN Modes & Network Registration#

Setting RF Power States (`AT+CFUN=<mode>`)#

AT+CFUN=0: Minimum functionality. Disables RF transceiver and cuts cellular transmit/receive power (SIM card remains powered).
AT+CFUN=1: Full functionality. RF active, registers on network, and maintains data sessions.
AT+CFUN=4: Airplane mode. Disables RF transceiver; safe for antenna disconnection.
AT+CFUN=1,1: Hardware reboot. Performs full warm reboot of baseband processor and reloads NVRAM.
AT+CFUN=7: Offline / Factory Test mode. ⚠️ Warning: On RM550V/RM551E modules, invoking CFUN 7 on mismatched EFS combos can lock the modem into an unprovisioned test loop.

Network Registration Queries#

AT+CREG?: Query 2G/3G GSM circuit-switched registration.
AT+CEREG?: Query 4G LTE packet data registration (0,1 = home network, 0,5 = registered roaming).
AT+C5GREG?: Query 5G NR network registration (0,1 = registered 5G SA home, 0,5 = 5G SA roaming).
AT+COPS=?: Scan for all available cellular operators in range (blocking operation, may take 30–60 seconds).
AT+COPS?: Query currently selected operator and network acquisition mode.

Qualcomm MBN Carrier Profiling & Auto-Selection#

Quectel Qualcomm modems store pre-compiled carrier firmware configuration bundles called MBN (Modem Binary) files:

AT Command	Syntax Example	Description
`+QMBNCFG="list"`	`AT+QMBNCFG="list"`	Displays all carrier MBN profiles installed in modem flash with activation status.
`+QMBNCFG="AutoSel"`	`AT+QMBNCFG="AutoSel",1`	Enables automatic MBN selection based on inserted SIM MCC/MNC (`0` = disable auto-select).
`+QMBNCFG="select"`	`AT+QMBNCFG="select","mcfg_sw/generic/common/row/commercial/mcfg_sw.mbn"`	Manually activates a specific carrier MBN profile (e.g. Generic ROW or T-Mobile commercial).
`+QMBNCFG="deactivate"`	`AT+QMBNCFG="deactivate"`	Deactivates currently selected MBN profile, reverting to uncustomized baseband baseline.

Cellular Band Selection & Physical Cell Tower Locking#

Band Locking Commands#

AT+QNWPREFCFG="nr5g_band": Lock specific 5G NR bands (e.g. AT+QNWPREFCFG="nr5g_band",41:71:77).
AT+QNWPREFCFG="lte_band": Lock specific 4G LTE bands (e.g. AT+QNWPREFCFG="lte_band",2:4:12:66).
AT+QNWPREFCFG="mode_pref": Set cellular RAT priority:
- "AUTO" = Automatic (5G NR / LTE / WCDMA)
- "NR5G" = 5G Standalone (SA) only
- "LTE" = 4G LTE only

Tower & Cell Locking Commands (`+QNWLOCK`)#

4G Cell Lock: AT+QNWLOCK="common/4g",<num_cells>,<earfcn>,<pci>
5G Cell Lock: AT+QNWLOCK="common/5g",<num_cells>,<arfcn>,<pci>,<scs>,<band>
Unlock All Cells: AT+QNWLOCK="common/4g",0 and AT+QNWLOCK="common/5g",0

QMAP IP Routing, Multiplexing & MPDN Rules#

QMAP commands configure internal packet routing between modem baseband contexts and Ethernet/USB interfaces:

AT+QMAP="MPDN_rule",<rule_id>,<pdp_id>,<vlan_id>,<ip_type>,<target_if>

LAN IP Configuration: AT+QMAP="LAN_IP_Set",<ip>,<subnet>,<gateway>
DHCP Server Range: AT+QMAP="DHCP_Range",<start_ip>,<end_ip>,<lease_time>
DNS Proxy Bypass: AT+QMAP="DHCPV4DNS","disable" (Pushes carrier DNS directly to client without modem interception).

Ethernet PHY (QETH) & PCIe Bus Configuration#

AT Command	Syntax Example	Description
`+QCFG="pcie/mode"`	`AT+QCFG="pcie/mode",1`	Switches PCIe controller between Endpoint (`0`) and Root Complex (`1`).
`+QETH="eth_driver"`	`AT+QETH="eth_driver","r8125",1`	Binds the Realtek RTL8125 2.5G Ethernet PHY driver.
`+QETH="phy_type"`	`AT+QETH="phy_type"`	Queries or sets hardware PHY interface type (RGMII, PCIe, SGMII).
`+QETH="speed"`	`AT+QETH="speed",2500`	Forces Ethernet link speed (10, 100, 1000, 2500 Mbps, or auto-negotiate).
`+QCFG="usbnet"`	`AT+QCFG="usbnet",0`	Configures USB network interface driver (0 = QMI, 1 = ECM, 2 = MBIM, 3 = RNDIS).

Low-Level NVRAM, EFS Management & ADB Backdoors#

AT+QNVFW: Injects custom carrier aggregation combo tables and RRC capability structures into modem NVRAM.
AT+QNVFD: Deletes designated files from Qualcomm EFS partition (used to purge stale CA configurations).
AT+QADBKEY?: Requests the cryptographic challenge string for unlocking modem ADB root shell.
Value 2 ADB Backdoor Bypass: On select beta and development firmwares:
AT
```
AT+QCFG="usbcfg",0x2C7C,0x0801,1,1,1,1,1,2,0
```
Setting parameter 9 to value 2 forcibly unlocks ADB without requiring a response key from AT+QADBKEY.

Reference Credits & Heritage#

This master command reference incorporates reverse-engineered command parameters, chaining syntax, and hardware registers documented by:

Cameron Thompson (iamromulan) — Maintainer of Cellular Modem Wiki & Quectel RGMII Toolkit.