EM7455, can't get it to work on 21.02.3

Got a used Sierra Wireless EM7455, and installed in one of those USB3 enclosures.

updated it using the script at https://github.com/danielewood/sierra-wireless-modems

but I can't get it to work in OpenWRT.

is comes up as:

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=5000 MxCh= 0
D:  Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
P:  Vendor=1199 ProdID=9079 Rev= 0.06
S:  Manufacturer=Sierra Wireless, Incorporated
S:  Product=Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A
S:  SerialNumber=LF7094000000000
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=504mA
A:  FirstIf#=12 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#=12 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=87(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#=13 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#=13 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms

dmesg says:

[53350.825864] usb 2-1: new SuperSpeed Gen 1 USB device number 11 using xhci_hcd
[53350.859327] usb 2-1: config 1 has an invalid interface number: 12 but max is 4
[53350.867595] usb 2-1: config 1 has an invalid interface number: 13 but max is 4
[53350.875993] usb 2-1: config 1 has an invalid interface number: 13 but max is 4
[53350.884080] usb 2-1: config 1 has no interface number 1
[53350.889925] usb 2-1: config 1 has no interface number 4
[53350.901133] usb 2-1: Enable of device-initiated U1 failed.
[53350.907734] usb 2-1: Enable of device-initiated U2 failed.
[53350.938124] cdc_mbim 2-1:1.12: cdc-wdm0: USB WDM device
[53350.944779] cdc_mbim 2-1:1.12 wwan0: register 'cdc_mbim' at usb-0000:00:14.0-1, CDC MBIM, 2e:f5:60:b5:b5:2c
[53350.956029] usb 2-1: Enable of device-initiated U1 failed.
[53350.962572] usb 2-1: Enable of device-initiated U2 failed.
root@OpenWrt:/dev#

Running commands from OpenWrt with JT421E TD-LTE module - #20 by AndrewZ
returns ERROR: mbim message timeout.

seems I'm missing something obvious, any ideas @bmork or @AndrewZ ?

dmesg and usb-devices look all normal, including the warnings you get. That's just log noise to be ignored. You could install kmod-usb-serial-qualcomm to have driver support for the serial functions. Might be easier to use AT commands in a terminal application like picocom to do the initial debugging.

I can't explain the mbim timeout. Do you get that if you try

umbim  -n -d /dev/cdc-wdm0 caps

after a clean restart of the modem? This request should always work.

Thnx for the reply,

After installing the qualcomm kmod, ttyUSB[0-2] emerged, and caps is answering, and so are the other commands from the link above. The connect and config doesn't however generate any output, but that could be normal ?

root@OpenWrt:/dev# umbim -n -d /dev/cdc-wdm0 caps
  devicetype: 0003 - remote
  cellularclass: 0001
  voiceclass: 0001 - no-voice
  simclass: 0002
  dataclass: 003C
  smscaps: 0003
  controlcaps: 0001
  maxsessions: 0008
  deviceid: 014583000373737
  firmwareinfo: SWI9X30C_02.30.01.01
  hardwareinfo: EM7455

ttyUSB2 is replying to AT commands.

I always pull the modem after kmod installs.

All of the request should return some info if they are successful. Unfortunately they don't return anything at all on errors. You can look at the return value to see that the request failed.

Successful connect:

root@miraculix:/home/bjorn# umbim -p -n -t 2 -d /dev/cdc-wdm0 connect telenor.smart; echo $?
  sessionid: 0
  activationstate: 0001 - activated
  voicecallstate: 0000 - none
  nwerror: 0000 - unknown
  iptype: 0003 - ipv4v6
0

Unsuccessful connect (because the default session id - 0 - is already connected):

root@miraculix:/home/bjorn# umbim -p -n -t 2 -d /dev/cdc-wdm0 connect telenor.smart; echo $?
243

You can also see the actual MBIM dialogue as verbose debug messages f you've built umbim with debugging:

root@miraculix:/home/bjorn# umbim -v -p -n -t 2 -d /dev/cdc-wdm0 connect telenor.smart; echo $?
sending (88): 03 00 00 00 58 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 83 8c f7 fb 8d 0d 4d 7f 87 1e d7 1d be fb b3 9b 01 00 00 00 01 00 00 00 28 00 00 00 0c 00 00 00 1a 00 00 00 1e 00 00 00 2f 00 64 00 65 00 76 00 2f 00 63 00 64 00 63 00 2d 00 77 00 64 00 6d 00 30 00 00 00 
  header_type: 0003
  header_length: 0058
  header_transaction: 0002
sending (136): 03 00 00 00 88 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e c2 aa e6 df 0c 00 00 00 01 00 00 00 58 00 00 00 00 00 00 00 01 00 00 00 3c 00 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 5e 2a 7e 4e 6f 72 72 73 6b 65 6e 7e 5e 2a 7e 74 00 65 00 6c 00 65 00 6e 00 6f 00 72 00 2e 00 73 00 6d 00 61 00 72 00 74 00 00 00 
  header_type: 0003
  header_length: 0088
  header_transaction: 0003
reading (48): 03 00 00 80 30 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e c2 aa e6 df 0c 00 00 00 0d 00 00 00 00 00 00 00 
  header_type: 80000003
  header_length: 0030
  header_transaction: 0003
  command_id: 000C
  status_code: 000D
sending (16): 02 00 00 00 10 00 00 00 04 00 00 00 01 00 00 00 
  header_type: 0002
  header_length: 0010
  header_transaction: 0004
reading (16): 02 00 00 80 10 00 00 00 04 00 00 00 00 00 00 00 
  header_type: 80000002
  header_length: 0010
  header_transaction: 0004
243

(Don't mind the "-p" option in my examples - that's because I do this testing on my laptop, where I also have modemmanager with libmbim running)

No debug, it's stock owrt.

root@OpenWrt:/dev# umbim -v -n -t 2 -d /dev/cdc-wdm0 connect services.telenor.se
 ; echo $?
sending (148): 03 00 00 00 94 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e c2 aa e6 df 0c 00 00 00 01 00 00 00 64 00 00 00 00 00 00 00 01 00 00 00 3c 00 00 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 5e 2a 7e 4e 6f 72 72 73 6b 65 6e 7e 5e 2a 7e 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2e 00 74 00 65 00 6c 00 65 00 6e 00 6f 00 72 00 2e 00 73 00 65 00 00 00
  header_type: 0003
  header_length: 0094
  header_transaction: 0002
reading (16): 04 00 00 80 10 00 00 00 02 00 00 00 05 00 00 00
  header_type: 80000004
  header_length: 0010
  header_transaction: 0002
sending (16): 02 00 00 00 10 00 00 00 03 00 00 00 05 00 00 00
  header_type: 0002
  header_length: 0010
  header_transaction: 0003
reading (16): 02 00 00 80 10 00 00 00 03 00 00 00 00 00 00 00
  header_type: 80000002
  header_length: 0010
  header_transaction: 0003
255

it throws 255, as you can see.

if silence = error, then it fails starting with attach

root@OpenWrt:/dev# umbim -n -d /dev/cdc-wdm0 -t 3 pinstate
required pin: 3 - pin2
remaining attempts: 3
root@OpenWrt:/dev# umbim -n -d /dev/cdc-wdm0 -t 4 subscriber
  readystate: 0001 - initialized
  simiccid: 89400000000000000000
  subscriberid: 240000000000000
root@OpenWrt:/dev# umbim -n -d /dev/cdc-wdm0 -t 4 registration
  nwerror: 0000 - unknown
  registerstate: 0001 - deregistered
  registermode: 0001 - automatic
  availabledataclasses: 0000 - (null)
  currentcellularclass: 0001 - gsm
  provider_id: (null)
  provider_name: (null)
  roamingtext: (null)
root@OpenWrt:/dev# umbim -n -d /dev/cdc-wdm0 -t 5 attach; echo $?
255

could you explain the deal with the -t param ?

It set's the transaction ID, which can be used to match replies to requests. This ID is supposed to be incremented for each request, but no one cares. I usually use a fixed value when testing manually to make command line editing simpler. Any value except 0 is OK.

The main point of the "-t" param is that it disables the MBIM OPEN message umbim otherwise will send. This should only be sent once, before the very first request in a session. The modem starts a new session every time it receives new OPEN from a client. You obviously need to attach/connect/config in the same session for it to have any meaning

Ok, so there's no real sequence that has to followed here, just need to make sure they're uniqe.

tried

root@OpenWrt:/dev# mbim-network /dev/cdc-wdm0 start
Loading profile at /etc/mbim-network.conf...
    APN: services.telenor.se
    APN auth protocol: unset
    APN user: unset
    APN password: unset
    mbim-proxy: no
Loading previous state from /tmp/mbim-network-state-cdc-wdm0...
    Previous Transaction ID: 6
error: no actions specified
Clearing state at /tmp/mbim-network-state-cdc-wdm0...
Querying subscriber ready status 'mbimcli -d /dev/cdc-wdm0 --query-subscriber-ready-status --no-close '...
[/dev/cdc-wdm0] Subscriber ready status retrieved: Ready state: 'sim-not-inserted' Subscriber ID: 'unknown' SIM ICCID: 'unknown' Ready info: 'none' Telephone numbers: (0) 'unknown' [/dev/cdc-wdm0] Session not closed: TRID: '3'
Saving state at /tmp/mbim-network-state-cdc-wdm0... (TRID: 3)
Querying registration state 'mbimcli -d /dev/cdc-wdm0 --query-registration-state --no-open=3 --no-close '...
[/dev/cdc-wdm0] Registration status: Network error: 'unknown' Register state: 'deregistered' Register mode: 'automatic' Available data classes: 'unknown' Current cellular class: 'gsm' Provider ID: 'unknown' Provider name: 'unknown' Roaming text: 'unknown' Registration flags: 'packet-service-automatic-attach' [/dev/cdc-wdm0] Session not closed: TRID: '4'
Saving state at /tmp/mbim-network-state-cdc-wdm0... (TRID: 4)
Attaching to packet service with 'mbimcli -d /dev/cdc-wdm0 --attach-packet-service --no-open=4 --no-close '...
error: operation failed: SimNotInserted
Saving state at /tmp/mbim-network-state-cdc-wdm0... (TRID: 5)
Starting network with 'mbimcli -d /dev/cdc-wdm0 --connect=apn='services.telenor.se' --no-open=5 --no-close '...
error: operation failed: SimNotInserted
Network start failed
[/dev/cdc-wdm0] Session not closed: TRID: '6'
Saving state at /tmp/mbim-network-state-cdc-wdm0... (TRID: 6)

but the SimNotInserted seems a little strange, because it appears to be able to pull the simiccid and subscriberid.

another thing I find strange is ...

root@roqos:~# mbimcli -d /dev/cdc-wdm0 --query-radio-state
[/dev/cdc-wdm0] Radio state retrieved:
             Hardware radio state: 'on'
             Software radio state: 'off'

trying to enable it gives

root@roqos:~# mbimcli -v  -d /dev/cdc-wdm0 --set-radio-state=on
[30 May 2022, 16:32:29] [Debug] opening device...
[30 May 2022, 16:32:29] [Debug] [/dev/cdc-wdm0] Queried max control message size: 4096
[30 May 2022, 16:32:29] [Debug] [/dev/cdc-wdm0] Sent message...
<<<<<< RAW:
<<<<<<   length = 16
<<<<<<   data   = 01:00:00:00:10:00:00:00:01:00:00:00:00:10:00:00

[30 May 2022, 16:32:29] [Debug] [/dev/cdc-wdm0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 16
<<<<<<   type        = open (0x00000001)
<<<<<<   transaction = 1
<<<<<< Contents:
<<<<<<   max control transfer = 4096

[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 01:00:00:80:10:00:00:00:01:00:00:00:00:00:00:00

[30 May 2022, 16:32:32] [Debug] MBIM Device at '/dev/cdc-wdm0' ready
[30 May 2022, 16:32:32] [Debug] Asynchronously setting radio state to on...
[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Sent message...
<<<<<< RAW:
<<<<<<   length = 52
<<<<<<   data   = 03:00:00:00:34:00:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:04:00:00:00:01:00:00:00

[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 52
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 2
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'radio-state' (0x00000003)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   RadioState = 'on'

[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Received message...
>>>>>> RAW:
>>>>>>   length = 56
>>>>>>   data   = 03:00:00:80:38:00:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:02:00:00:00:08:00:00:00:01:00:00:00:00:00:00:00

[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 56
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 2
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'Failure' (0x00000002)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'radio-state' (0x00000003)

error: operation failed: Failure
[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Sent message...
<<<<<< RAW:
<<<<<<   length = 12
<<<<<<   data   = 02:00:00:00:0C:00:00:00:03:00:00:00

[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 12
<<<<<<   type        = close (0x00000002)
<<<<<<   transaction = 3

[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 02:00:00:80:10:00:00:00:03:00:00:00:00:00:00:00

[30 May 2022, 16:32:32] [Debug] [/dev/cdc-wdm0] channel destroyed
[30 May 2022, 16:32:32] [Debug] Device closed
at+cfun=1
+CME ERROR: operation not supported
at+cfun?
+CFUN: 0

Hi

Did you set PCOFFEN=2?

Tell the modem to ignore the W_DISABLE pin sent by many laptop's internal M2 slots.

AT!ENTERCND="A710"
AT!PCOFFEN=2
AT!RESET

for the radio state, it didn't help :confused:

there's also

AT!PCINFO?
State: Low Power Mode
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:0, IMSWITCH:1, BIOS:1, LWM2M:0, OMADM:0, FOTA:0
LPM persistence - None

OK

I would make it fully GENERIC by changing id's:
AT!USBPID=9071,9070 and upgrade the firmware to the latest.
Then you'll need to get it out of the LPM.
Check with AT!PCFCCAUTH? - I guess you'll see FCC Auth Enabled: 1

means that youe have an image/config mismatch and the modem is FCC locked. The latter is easy to fix. After opening the MBIM session, run

uqmi -m -d /dev/cdc-wdm0 --fcc-auth

The image/config mismatch needs some research. I assume that's fallout from the firmware updates. Run

AT!IMAGE?
AT!IMPREF?

in your terminal app. This should tell us more

... and if !impref will report the mismatch, just erase everything (AT!IMAGE=0) and re-flash, a new firmware (SWI9X30C_02.38.00.00, 002.082_000) has been released recently.

yes, FCC is enabled.

AT!ENTERCND="A710"
OK
AT!USBPID=9071,9070
OK
AT!PCFCCAUTH?
NV Setting: 1
FCC Auth Enabled: 1
FCC Lock State: 1
OK

You're very much correct, there's a FW mismatch.

AT!IMPREF?
!IMPREF:
 preferred fw version:    02.05.07.00
 preferred carrier name:  GENERIC
 preferred config name:   GENERIC_002.004_000
 current fw version:      02.30.01.01
 current carrier name:    GENERIC
 current config name:     GENERIC_002.004_000

 fw version mismatch

OK
AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
FW   1    EMPTY  0   0 0
FW   2    EMPTY  0   0 0
FW   3    EMPTY  0   0 0
FW   4    EMPTY  0   0 0
Max FW images: 4
Active FW image is at slot 255

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
PRI  FF   GOOD   0   0 0      002.045_000 02.30.01.01_GENERIC
Max PRI images: 50
OK

The uqmi command just hangs, but qmicli seems to pass ...

root@roqos:~# qmicli -d /dev/cdc-wdm0 --device-open-mbim --dms-set-fcc-authentic
ation
[/dev/cdc-wdm0] Successfully set FCC authentication
root@roqos:~# mbimcli -d /dev/cdc-wdm0 --query-radio-state
[/dev/cdc-wdm0] Radio state retrieved:
             Hardware radio state: 'on'
             Software radio state: 'off'

I'll reflash, and let you know.

Reflashed, but it seems the FCC lock came back with the new FW ?

AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
FW   1    EMPTY  0   0 0
FW   2    EMPTY  0   0 0
FW   3    EMPTY  0   0 0
FW   4    EMPTY  0   0 0
Max FW images: 4
Active FW image is at slot 255

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
PRI  FF   GOOD   0   0 0      002.082_000 02.38.00.00_GENERIC
Max PRI images: 50


OK
AT!IMPREF?
!IMPREF:
 preferred fw version:    02.38.00.00
 preferred carrier name:  GENERIC
 preferred config name:   GENERIC_002.082_000
 preferred subpri index:  000
 current fw version:      02.38.00.00
 current carrier name:    GENERIC
 current config name:     GENERIC_002.082_000
 current subpri index:    000

OK
AT!PCFCCAUTH?
NV Setting: 1
FCC Auth Enabled: 1
FCC Lock State: 1
OK

You need to unlock after every modem reboot. Tools like ModemManager will do that for you. Or you can just script it.

Permanently removing the lock isn't very well documented AFAIK.

Yeah,

this time software radion came on after doing the
qmicli -d /dev/cdc-wdm0 --device-open-mbim --dms-set-fcc-authentication

[/dev/cdc-wdm0] Radio state retrieved:
             Hardware radio state: 'on'
             Software radio state: 'on'