Project

General

Profile

Sierra Wireless Modems » History » Version 2

domi, 08/15/2018 04:51 PM

1 1 laforge
h1. Sierra Wireless Modems
2
3
Sierra Wireless also seems to offer a number of modems that run on MDM9615 or its successors, with Linux inside the module.
4
5
h2. List of related modems
6
7
* EM7455
8
* many others suspected, FIXME.
9
10
h2. Getting access to the Linux system
11
12
Sierra Wireless uses a bitmapped NVRAM variable to tell the system which functions to enable. One of these functions is 'adb'. They also implement an AT command to set this variable, but you cannot enable 'adb' there anymore (or maybe you can, using some other password?).
13
14
This AT command help text is taken from an old memory dump:
15
16
<pre>
17
#AT!USBCOMP=<Config Index>,<Config Type>,<Interface bitmask>
18
#  <Config Index>      - configuration index to which the composition applies, should be 1
19
#  <Config Type>       - 1:Generic, 2:USBIF-MBIM, 3:RNDIS
20
#                        config type 2/3 should only be used for specific Sierra PIDs: 68B1, 9068
21
#                        customized VID/PID should use config type 1
22
#  <Interface bitmask> - DIAG     - 0x00000001,
23
#                        ADB      - 0x00000002,
24
#                        NMEA     - 0x00000004,
25
#                        MODEM    - 0x00000008,
26
#                        RMNET0   - 0x00000100,
27
#                        RMNET1   - 0x00000400,
28
#                        RMNET2   - 0x00000800,
29
#                        MBIM     - 0x00001000,
30
#                        RNDIS    - 0x00004000,
31
#                        AUDIO    - 0x00010000,
32
#                        ECM      - 0x00080000,
33
#                        UBIST    - 0x00200000
34
</pre>
35
36
There are other ways to set this and other variables, so the AT comand interpreter restriction is not a show stopper.  Note that there are invalid gadget combinations, so you can softbrick the modem by changing this variable.
37 2 domi
38
Based on my testing done with the EM7455 (found in Lenovo ThinkPads for example) you cannot use AT commands, because the AT serial port is not exposed. To enable the DIAG interface as well as the AT shell you can try to use the script "swi_usbcomp.pl" attached, created by Bjørn Mork. It is capable of showing the USB configurations available, and also changing the configuration.
39
40
Example output - querying the available configurations (the * denotes the active configuration):
41
42
<pre>
43
./swi_usbcomp.pl 
44
Running in MBIM mode (driver=cdc_mbim)
45
MBIM OPEN succeeded
46
QMI msg '0x0021' returned status = 1
47
MBIM QMI support verified
48
supports 33 QMI subsystems:
49
  0x00 (1.5)    'QMI_CTL'    - Control service
50
  0x01 (1.67)    'QMI_WDS'    - Wireless data service
51
  0x02 (1.14)    'QMI_DMS'    - Device management service
52
  0x03 (1.25)    'QMI_NAS'    - Network access service
53
  0x04 (1.6)    'QMI_QOS'    - Quality of service, err, service 
54
  0x05 (1.10)    'QMI_WMS'    - Wireless messaging service
55
  0x07 (1.3)    'QMI_AUTH'    - Authentication service
56
  0x08 (1.2)    'QMI_AT'    - AT command processor service
57
  0x09 (2.1)    'QMI_VOICE'    - Voice service
58
  0x0a (2.24)    'QMI_CAT2'    - Card application toolkit service (new)
59
  0x0b (1.45)    'QMI_UIM'    - UIM service
60
  0x0c (1.4)    'QMI_PBM'    - Phonebook service
61
  0x0f (1.0)    'QMI_TEST'    - Test service
62
  0x10 (2.0)    'QMI_LOC'    - Location service 
63
  0x11 (1.0)    'QMI_SAR'    - Specific absorption rate service
64
  0x17 (1.0)    'QMI_TS'    - Thermal sensors service
65
  0x18 (1.0)    'QMI_TMD'    - Thermal mitigation device service
66
  0x1a (1.16)    'QMI_WDA'    - Wireless data administrative service
67
  0x1d (1.1)    'QMI_CSVT'    - Circuit switched videotelephony service
68
  0x22 (1.0)    'QMI_COEX'    - Coexistence service
69
  0x24 (1.0)    'QMI_PDC'    - Persistent device configuration service
70
  0x29 (1.0)    'QMI_RFRPE'    - RF radiated performance enhancement service
71
  0x2a (1.0)    'QMI_DSD'    - Data system determination service
72
  0x2b (1.0)    'QMI_SSCTL'    - Subsystem control service
73
  0x2e (1.0)    'unknown'    - 
74
  0x30 (1.0)    'unknown'    - 
75
  0x31 (1.0)    'unknown'    - 
76
  0x36 (1.0)    'unknown'    - 
77
  0xe1 (1.0)    'QMI_RMS'    - Remote management service
78
  0xf0 (1.0)    'unknown'    - 
79
  0xf3 (1.0)    'unknown'    - 
80
  0xf5 (1.0)    'unknown'    - 
81
  0xf6 (1.0)    'unknown'    - 
82
QMI msg '0x0022' returned status = 1
83
Got QMI DMS client ID '3'
84
QMI msg '0x555b' returned status = 1
85
Current USB composition: 9
86
USB compositions:
87
   0 - HIP  DM    NMEA  AT    MDM1  MDM2  MDM3  MS      NOT SUPPORTED
88
   1 - HIP  DM    NMEA  AT    MDM1  MS                  NOT SUPPORTED
89
   2 - HIP  DM    NMEA  AT    NIC1  MS                  NOT SUPPORTED
90
   3 - HIP  DM    NMEA  AT    MDM1  NIC1  MS            NOT SUPPORTED
91
   4 - HIP  DM    NMEA  AT    NIC1  NIC2  NIC3  MS      NOT SUPPORTED
92
   5 - HIP  DM    NMEA  AT    ECM1  MS                  NOT SUPPORTED
93
   6 - DM   NMEA  AT    QMI                             SUPPORTED
94
   7 - DM   NMEA  AT    RMNET1 RMNET2 RMNET3            NOT SUPPORTED
95
   8 - DM   NMEA  AT    MBIM                            SUPPORTED
96
*  9 - MBIM                                             SUPPORTED
97
  10 - NMEA MBIM                                        NOT SUPPORTED
98
  11 - DM   MBIM                                        NOT SUPPORTED
99
  12 - DM   NMEA  MBIM                                  NOT SUPPORTED
100
  13 - Config1: comp6    Config2: comp8                 NOT SUPPORTED
101
  14 - Config1: comp6    Config2: comp9                 NOT SUPPORTED
102
  15 - Config1: comp6    Config2: comp10                NOT SUPPORTED
103
  16 - Config1: comp6    Config2: comp11                NOT SUPPORTED
104
  17 - Config1: comp6    Config2: comp12                NOT SUPPORTED
105
  18 - Config1: comp7    Config2: comp8                 NOT SUPPORTED
106
  19 - Config1: comp7    Config2: comp9                 NOT SUPPORTED
107
  20 - Config1: comp7    Config2: comp10                NOT SUPPORTED
108
  21 - Config1: comp7    Config2: comp11                NOT SUPPORTED
109
  22 - Config1: comp7    Config2: comp12                NOT SUPPORTED
110
QMI msg '0x0023' returned status = 1
111
</pre>
112
113
Changing the configuration is simple:
114
115
<pre>
116
./swi_usbcomp.pl –usbcomp=8
117
./swi_usbcomp.pl –reset
118
</pre>
119
120
As you can see ADB cannot be enabled for EM7455 using swi_usbcomp.pl, but at least DIAG and AT shell can be made accessible.
Add picture from clipboard (Maximum size: 48.8 MB)