Fibocom FM350-GL Support

For Developers
211

Would have done that the problem is that the AT Port also does not come up anymore, my guess is that the fm-350 goes into some other mode and the t7xx cant pull it back to normal operation. Only a full power reset by pulling the plug helps.

Edit: Maybe there is a way by writing something in the pcie device setup in /sys/bus/pci/devices/0000:xx:xx/*. Tried it by echo 1 > ./reset and echo 1 > ./remove followed by a rescan. Both methods work, but they cant reset the device fully. So I cant recover it that way. So the devices stays in that strange state.

212

rmmod mtk-t7xx with a follwed modprobe does not work as well. lspci -vv shows the the reload of the kmod works, but it has no effect.

Kernel Log from that module reset maybe it helps:

[   74.711831] mtk_t7xx 0003:01:00.0: MD handshake timeout
[   74.717065] mtk_t7xx 0003:01:00.0: Boot Handshake failure
[  331.318710] pci_bus 0003:01: scanning bus
[  331.322755] pci_bus 0003:01: bus scan returning with max=01
[  502.443574] mtk_t7xx 0003:01:00.0: assign IRQ: got 112
[  502.448738] mtk_t7xx 0003:01:00.0: enabling bus mastering
[  502.456312] mtk-pcie-gen3 11280000.pcie: msi#0x1 address_hi 0x0 address_lo 0x11280c00 data 1
[  502.464863] mtk-pcie-gen3 11280000.pcie: msi#0x2 address_hi 0x0 address_lo 0x11280c00 data 2
[  502.473339] mtk-pcie-gen3 11280000.pcie: msi#0x3 address_hi 0x0 address_lo 0x11280c00 data 3
[  502.481784] mtk-pcie-gen3 11280000.pcie: msi#0x4 address_hi 0x0 address_lo 0x11280c00 data 4
[  502.490258] mtk-pcie-gen3 11280000.pcie: msi#0x5 address_hi 0x0 address_lo 0x11280c00 data 5
[  502.498714] mtk-pcie-gen3 11280000.pcie: msi#0x6 address_hi 0x0 address_lo 0x11280c00 data 6
[  502.507168] mtk-pcie-gen3 11280000.pcie: msi#0x7 address_hi 0x0 address_lo 0x11280c00 data 7
[  502.515620] mtk-pcie-gen3 11280000.pcie: msi#0x8 address_hi 0x0 address_lo 0x11280c00 data 8
[  566.231834] mtk_t7xx 0003:01:00.0: MD handshake timeout
[  566.237063] mtk_t7xx 0003:01:00.0: Boot Handshake failure
[  578.284620] mtk_t7xx 0003:01:00.0: assign IRQ: got 112
[  578.289783] mtk_t7xx 0003:01:00.0: enabling bus mastering
[  578.297365] mtk-pcie-gen3 11280000.pcie: msi#0x1 address_hi 0x0 address_lo 0x11280c00 data 1
[  578.305907] mtk-pcie-gen3 11280000.pcie: msi#0x2 address_hi 0x0 address_lo 0x11280c00 data 2
[  578.314395] mtk-pcie-gen3 11280000.pcie: msi#0x3 address_hi 0x0 address_lo 0x11280c00 data 3
[  578.322862] mtk-pcie-gen3 11280000.pcie: msi#0x4 address_hi 0x0 address_lo 0x11280c00 data 4
[  578.331308] mtk-pcie-gen3 11280000.pcie: msi#0x5 address_hi 0x0 address_lo 0x11280c00 data 5
[  578.339760] mtk-pcie-gen3 11280000.pcie: msi#0x6 address_hi 0x0 address_lo 0x11280c00 data 6
[  578.348209] mtk-pcie-gen3 11280000.pcie: msi#0x7 address_hi 0x0 address_lo 0x11280c00 data 7
[  578.356658] mtk-pcie-gen3 11280000.pcie: msi#0x8 address_hi 0x0 address_lo 0x11280c00 data 8
[  643.031831] mtk_t7xx 0003:01:00.0: MD handshake timeout
[  643.037061] mtk_t7xx 0003:01:00.0: Boot Handshake failure
213

Alright found something, the modem goes into fastboot mode, if the driver disconnects, this can be due to reboot, crash etc. According to that post: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2049358 fixes for that where implemented in kernel 6.9.

2 Likes
214

Thanks for pointing this out. I did see this and a few other bug reports that didn't seem to be related to an issue I've run into with mine.

I've since been trying to get this working on a BPI-R64 where initially it worked but seems like ever since I can't get it to work properly and always ends up with a probe failure message in dmesg. lspci shows it fine and the mtk-t7xx module is active but nothing in mmcli. Here's a short excerpt:

[    8.082495] mtk_t7xx 0001:01:00.0: assign IRQ: got 133
[    8.087691] mtk_t7xx 0001:01:00.0: enabling device (0000 -> 0002)
[    8.093899] mtk_t7xx 0001:01:00.0: enabling bus mastering
[    8.101418] mt7622-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20190801210006a
[    8.101418]
[    8.111600] mtk_t7xx 0001:01:00.0: PM configuration timed out
[    8.117360] mtk_t7xx: probe of 0001:01:00.0 failed with error -110

I did initially try doing a pci reset and rescan but got the handshake timeouts like you.

What seemed to work for me at least with one try here (will definitely have to see if it is repeatable) is I went in and commented out the module in /etc/modules.d/mtk-t7xx so it won't automatically insert on boot. Rebooted and gave it a bit of time and manually ran modprobe and it pulled up fine. So may need to test and figure out timing and write a script for this.

Hopefully the patch in 6.9 works here as well.

215

Will try it. Thanks. Guess we have to wait for the updates, Openwrt normaly waits for the next LTS release. Maybe with 6.12-15 we will get the next big kernel update. With some luck we maybe get a 6.6 backport, if the changes for the t7xx on 6.9 are really that good.

216

Thank you so much .... its a great solution

really I wish if OpenWRT team can do something to add this steps automatically to their software . because not all people has adapter

217

I have made a unlock script. Not fully tested since my modem was unlocked.
It´s, more or less, a copy of ModemManger's and R00ter's script.

Package dependency: xxd and comgt.
Copy getrun_at.gcom and run_at.gcom, from my atc- package, to /etc/gcom/. Or install atc-fib-fm350_gl_2024-08-04-0.2_all.ipk.
Make sure no other application is using the AT-port.

  • Copy the script.
  • Make the script executable: chmod +x fm350_fcc_unlock.sh
  • Run the script with: ./fm350_fcc_unlock.sh /dev/ttyUSBx

fm350_fcc_unlock.sh

#!/bin/sh
#
# FCC unlock script for Fibocom FM350-GL modem
#

device=$1
VENDOR_ID_HASH="3df8c719"

atOut=$(COMMAND='AT+GTFCCEFFSTATUS?' gcom -d "$device" -s /etc/gcom/getrun_at.gcom | grep -o '[0-9,]\+')
mode_value=$(echo $atOut | awk -F ',' '{print $1}')
status_value=$(echo $atOut | awk -F ',' '{print $2}')

if [ "$mode_value" = '0' ]
then
    echo 'Modem is unlocked!'
elif [ "$mode_value" = '1' -o "$mode_value" = '2' ]
then
    xxd_installed=$(opkg info xxd | grep 'Status: install')
    if [ -z "$xxd_installed" ]
    then
        echo 'xxd is not installed'
        exit 1
    fi

    [ "$mode_value" = '1' ] && echo *The modem has a One time lock'
    [ "$mode_value" = '2' ] && echo *The modem has a Power-up lock'

    CHALLENGE=$(COMMAND='AT+GTFCCLOCKGEN' gcom -d "$device" -s /etc/gcom/getrun_at.gcom | grep -o '0x[0-9a-fA-F]\+' | awk '{print $1}')
    if [ -n "$CHALLENGE" ]
    then
        echo 'Got challenge from modem: '$CHALLENGE
        HEX_CHALLENGE=$(printf "%08x" "$CHALLENGE")
        COMBINED_CHALLENGE="${HEX_CHALLENGE}$(printf "%.8s" "${VENDOR_ID_HASH}")"
        RESPONSE_HASH=$(echo "$COMBINED_CHALLENGE" | xxd -r -p | sha256sum | cut -d ' ' -f 1)
        TRUNCATED_RESPONSE=$(printf "%.8s" "$RESPONSE_HASH")
        RESPONSE=$(printf "%d" "0x$TRUNCATED_RESPONSE")
        echo 'Sending response to modem: '$RESPONSE
        UNLOCK_RESPONSE=$(COMMAND='AT+GTFCCLOCKVER='$RESPONSE gcom -d "$device" -s /etc/gcom/getrun_at.gcom | grep -o '[0-9,]\+' | awk '{print $1}')

        if [ "$UNLOCK_RESPONSE" = '1' ]; then
            echo 'FCC unlock succeeded'

            if [ "$mode_value" = '2' ]
            then
                atOut=$(COMMAND='AT+GTFCCLOCKMODE=0' gcom -d "$device" -s /etc/gcom/run_at.gcom)
                [ "$atOut" = 'OK' ] && echo 'Power-up unlock succeeded' || echo 'Power-up unlock failed'
            fi
        else
            echo 'Unlock failed.'
        fi
    else
        echo 'Failed to obtain FCC challenge.'
    fi
else
    echo 'Make sure no application is using the AT-port: '$device
    echo 'run AT+GTFCCEFFSTATUS? manually'
fi
3 Likes
218

root@OpenWrt:/dev# dmesg | grep -i "mtk_t7xx"
[ 10.715737] mtk_t7xx 0003:01:00.0: assign IRQ: got 112
[ 10.720905] mtk_t7xx 0003:01:00.0: enabling device (0000 -> 0002)
[ 10.727047] mtk_t7xx 0003:01:00.0: enabling bus mastering
[ 74.711266] mtk_t7xx 0003:01:00.0: MD handshake timeout
[ 74.716500] mtk_t7xx 0003:01:00.0: Boot Handshake failure

got my fm350 today and i cant get it to work with latest snapshot.hope someone can guide me.

need to power off first then the modem get detected..

root@OpenWrt:~# mmcli -m 0
  ---------------------------------
  General   |                 path: /org/freedesktop/ModemManager1/Modem/0
            |            device id: 8553bb39e35e1c9c170443698f6cca5a310e50de
  ---------------------------------
  Hardware  |         manufacturer: generic
            |                model: MBIM [14C3:4D75]
            |    firmware revision: 81600.0000.00.29.18.16_GC
            |                       C28
            |         h/w revision: V1.0.6
            |            supported: gsm-umts, lte, 5gnr
            |              current: gsm-umts, lte, 5gnr
            |         equipment id: 354174400131202
  ---------------------------------
  System    |               device: /sys/devices/platform/soc/11280000.pcie/pci0003:00/0003:00:00.0/0003:01:00.0
            |              physdev: /sys/devices/platform/soc/11280000.pcie/pci0003:00/0003:00:00.0/0003:01:00.0
            |              drivers: mtk_t7xx
            |               plugin: generic
            |         primary port: wwan0mbim0
            |                ports: wwan0 (net), wwan0at0 (at), wwan0mbim0 (mbim)
  ---------------------------------
  Status    |                 lock: sim-pin2
            |       unlock retries: sim-pin2 (3)
            |                state: connected
            |          power state: on
            |          access tech: lte, 5gnr
            |       signal quality: 58% (cached)

it is working under modem manager , but how can i add it to my interface??

edit: got lte speed only , how to lock it on 5g mode?

sp
sp1833×894 56.1 KB

edit: after a few reboots got 5G speed but only half the speed im getting compare to my iphone 5g speed test

edit : kernel panic

root@OpenWrt:/# [ 204.463846] NOHZ tick-stop error: local softirq work is pendi ng, handler #08!!!
[ 204.498342] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.505749] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.522842] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.532842] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.562857] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.582842] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.595340] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.625342] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 204.630345] NOHZ tick-stop error: local softirq work is pending, handler #08! !!
[ 287.861909] skbuff: skb_under_panic: text:ffffffc080767730 len:-65292 put:149 head:ffffff80c810b000 data:ffffff7fc811afff tail:0xc9 end:0xec0 dev:wwan0
[ 287.875519] ------------[ cut here ]------------
[ 287.880137] Kernel BUG at skb_panic+0x48/0x4c [verbose debug info unavailable ]
[ 287.887359] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
[ 287.893442] Modules linked in: rt2800usb(O) rt2800lib(O) pppoe ppp_async nft_ fib_inet nf_flow_table_inet rt2x00usb(O) rt2x00lib(O) pppox ppp_generic nft_reje ct_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numge n nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_ fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrac k mtk_t7xx mt7996e(O) mt7915e(O) mt76_connac_lib(O) mt76(O) mac80211(O) cfg80211 (O) wwan usbserial slhc sfp rtc_pcf8563 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mdio_i2c libcrc32c compat(O) at24 cr ypto_safexcel pwm_fan i2c_mux_pca954x i2c_mux sha512_arm64 sha1_ce sha1_generic seqiv md5 geniv des_generic libdes authencesn authenc leds_gpio xhci_plat_hcd xh ci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug(O) usbcore usb_common aquantia
[ 287.970030] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G O 6.6.45

219

I successfully set up an Internet connection on ArchLinux using the Waveshare USB to M.2 B-Key adapter (https://www.waveshare.com/product/iot-communication/long-range-wireless/4g-gsm-gprs/usb-to-m.2-b-key.htm) and AT commands:

•	AT+CGDCONT=1,"IP","internet"
•	AT+CGACT=1,1
•	AT+CGPADDR=1

The connection is stable and fast.

However, when I tried the same setup on an RPi 5 with the latest OpenWRT snapshot, I encountered disconnections during the AT command setup (using picocom). Has anyone experienced this issue? Could you share the output of opkg list-installed?

220

i think u need the package luci-proto-modemmanager then u can add a interface with modemmanager

221

So many bugs there...
Still waiting for upstream to fix it.

222

luci-proto-modemmanager already installed, kernel panic happens during speedtest on upload

223

I suspect that my issues could be related to the power supply. The dmesg log shows an "Over-current change" message, but I've also tried using an additional PD charger. It's possible that the RBPi 5 is sending a signal causing the modem to reset. Interestingly, I don't experience any similar issues when I connect the device directly to my laptop running ArchLinux.

224

Have the same problem with the bpi r4. Can be due to low voltage, because the modem needs more current than the bpi can deliver. Heat could also be a problem, most modems go into forced shutdown if the get warmer than 80°C. But I would tend more to that the driver for the mtk pcie 3.0 controller is also not 100% stable, i do not exp. this on my x86 platform. Despite x86 seems a bit more stable, the mtk-t7xx is still a mess there either.

But fixes for the mtk-t7xx should come with the next move to a newer LTS kernel.

3 Likes
225

Can someone who owns a modem confirm if it makes a strange sound while operating, like a hissing noise?

226

For most of the modules,it will drain a high current to transmit the wireless signal.So your on board dc-dc converter(which converts power from your device to 3.3v) will work with loads,so it may make some noise.
But if you think your module is heating up too quick, you may need to check your antenna or module itself.

227

Hi
I try to add the bands support to my FM350 USB ModemManager-Module
I think i get the bands over the command at+GTACT=?
the rsponse is

+GTACT: (1,2,4,10,14,16,17,20),(2,3,6),(2,3,6),(),(1,2,4,5,8),(101,102,103,104,105,107,108,112,113,114,117,118,119,120,125,126,128,129,130,132,134,138,139,140,141,142,143,146,148,166,171),(),(),(501,502,503,505,507,508,5020,5025,5028,5030,5038,5040,5041,5048,5066,5071,5077,5078,5079)

5GNR is 501,502,503,505,507,508,5020,5025,5028,5030,5038,5040,5041,5048,5066,5071,5077,5078,5079
4G is 101,102,103,104,105,107,108,112,113,114,117,118,119,120,125,126,128,129,130,132,134,138,139,140,141,142,143,146,148,166,171
and 3g is 1,2,4,5,8

i add the values to the Supported bands list but the Otuput of mmcli is

  ----------------------------------
  General  |                   path: /org/freedesktop/ModemManager1/Modem/0
           |              device id: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
  ----------------------------------
  Hardware |           manufacturer: Fibocom Wireless Inc.
           |                  model: FM350-GL
           |      firmware revision: 81600.0000.00.29.21.24
           |              supported: gsm-umts, lte
           |                current: gsm-umts, lte
  ----------------------------------
  System   |                 device: /sys/devices/pci0000:00/0000:00:14.0/usb1/1-1
           |                physdev: /sys/devices/pci0000:00/0000:00:14.0/usb1/1-1
           |                drivers: usbserial_generic, rndis_host
           |                 plugin: fm350gl
           |           primary port: ttyUSB4
           |                  ports: enx000011121314 (net), ttyUSB0 (ignored),
           |                         ttyUSB1 (ignored), ttyUSB2 (ignored), ttyUSB3 (ignored), ttyUSB4 (at),
           |                         ttyUSB5 (ignored), ttyUSB6 (ignored), ttyUSB7 (ignored)
  ----------------------------------
  Numbers  |                    own: xxxxxxxxxxxxxx
  ----------------------------------
  Status   |         unlock retries: sim-pin (3), sim-puk (10), sim-pin2 (3), sim-puk2 (10)
           |                  state: connected
           |            power state: on
           |            access tech: lte, 5gnr
           |         signal quality: 40% (recent)
  ----------------------------------
  Modes    |              supported: allowed: 3g; preferred: none
           |                         allowed: 4g; preferred: none
           |                         allowed: 5g; preferred: none
           |                         allowed: 3g, 4g; preferred: 3g
           |                         allowed: 3g, 4g; preferred: 4g
           |                         allowed: 3g, 5g; preferred: 3g
           |                         allowed: 3g, 5g; preferred: 5g
           |                         allowed: 4g, 5g; preferred: 4g
           |                         allowed: 4g, 5g; preferred: 5g
           |                         allowed: 3g, 4g, 5g; preferred: 3g
           |                         allowed: 3g, 4g, 5g; preferred: 4g
           |                         allowed: 3g, 4g, 5g; preferred: 5g
           |                current: allowed: 3g, 4g, 5g; preferred: 5g
  ----------------------------------
  Bands    |              supported: egsm, dcs, g850, utran-1, utran-6, eutran-71, (null),
           |                         (null), (null), (null), (null), (null), (null), (null), (null),
           |                         (null), (null), (null), (null), (null), (null), cdma-bc0, cdma-bc1,
           |                         cdma-bc2, cdma-bc4, cdma-bc5, cdma-bc9, cdma-bc10, cdma-bc11,
           |                         cdma-bc12, cdma-bc13, cdma-bc14, cdma-bc17, cdma-bc19, (null), (null),
           |                         (null), (null), (null), (null), (null), (null), (null), (null),
           |                         (null), (null), (null), (null), (null), (null), (null), (null),
           |                         (null), (null), (null)
           |                current: egsm, dcs, g850, utran-1, utran-6, eutran-71, (null),
           |                         (null), (null), (null), (null), (null), (null), (null), (null),
           |                         (null), (null), (null), (null), (null), (null), cdma-bc0, cdma-bc1,
           |                         cdma-bc2, cdma-bc4, cdma-bc5, cdma-bc9, cdma-bc10, cdma-bc11,
           |                         cdma-bc12, cdma-bc13, cdma-bc14, cdma-bc17, cdma-bc19, (null), (null),
           |                         (null), (null), (null), (null), (null), (null), (null), (null),
           |                         (null), (null), (null), (null), (null), (null), (null), (null),
           |                         (null), (null), (null)
  ----------------------------------
  IP       |              supported: ipv4, ipv6, ipv4v6
  ----------------------------------
  3GPP     |          enabled locks: sim
           |            operator id: 26201
           |          operator name: Telekom.de
           |           registration: home
           |   packet service state: attached
  ----------------------------------
  3GPP EPS |   ue mode of operation: csps-2
           |    initial bearer path: /org/freedesktop/ModemManager1/Bearer/0
           | initial bearer ip type: ipv4v6
  ----------------------------------
  SIM      |       primary sim path: /org/freedesktop/ModemManager1/SIM/0
  ----------------------------------
  Bearer   |                  paths: /org/freedesktop/ModemManager1/Bearer/1

anyone know why ModemManager not know the values?

the Documentation says

This command allows to switch between all the allowed RATs and BANDs for air interface
access
....

+GTACT: (list of supported <Rat>s),(list of
supported
<PreferredAct1>s),(list of supported
<PreferredAct2>s),(list of supported
<gsm_band>s),(list
of supported <umts_band>s),(list of
supported
<lte_band>s),(list of supported
<cdma_band>s),(list of supported
<evdo_band>s), (list of supported
<nr_band>s
228

Could be a format problem. utran ( seems to be the native band display [ 1, 2100 | 8, 900 ]. For LTE the fm350 uses 10xx and for NR 50xx. But i dont get then why some utran bands are missing and LTE Band 71 ( 600Mhz ) ist displayed.

1 Like
229

i think modemmanager uses the MMModemBand enum from include/ModemManager-enums.h · main · Mobile broadband connectivity / ModemManager · GitLab (starts at line 460)
its only goes to number 561

gsm/umts is 1 - 20
LTE 31 - 255
5G 301 -561

but i dont know how i can convert between the formats :face_with_spiral_eyes:

230

I guess this has to be done for every supplier, brand and in some case even modem. For example the t77w968 ( dw5821e X20 ) does it different than a rm500q-gl and the fm350. Fibocom just uses this format. I guess that for exp. 5001 means band 1 NR5G, while 1001 means LTE band 1, and only 1 means UMTS band 1. That would be my guess.

Not an expert for MM but i guess you would have to add the specific methode with the right format to MM, my guess would be that MM uses them by the USB ID or PCIE ID.

That would mean if we look at the output of supported bands that would mean: 1 --> utran-1 | 1001 --> eutran-1 | 5001 --> ngran-1 | 1020 --> eutran-20 | 5078 --> ngran-78 | 8 --> utran-8 and so on would be my guess.

1 Like