Skip to content

Instantly share code, notes, and snippets.

@rjocoleman
Last active September 13, 2022 03:06
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rjocoleman/7e2ca10c0e9e371411d1ca1fb21aa8ad to your computer and use it in GitHub Desktop.
Save rjocoleman/7e2ca10c0e9e371411d1ca1fb21aa8ad to your computer and use it in GitHub Desktop.
My notes upgrading, unlocking and making a Lenovo branded Sierra Wireless EM7565 usable in mainline Linux. Includes PID change, FCC Auth Disable.

Pre-reqs are linux, libqmi and libqmi-utils. The modem connected via USB (USB 2.0 if you have issues connecting)

My modem came up as 1199:90c3 (Lenovo PID), this is not supported by mainline Linux kernel.

To enable the kernel drivers to pick it up and allow me to see the serial interface:

$ modprobe option
$ echo 1199 90c3 > /sys/bus/usb-serial/drivers/option1/new_id

To connect to the modem:

  1. Connect to the modem (root or sudo)
$ minicom -D /dev/ttyUSB0
  1. Enable echo
ATE
OK
  1. Check hardware/software information
ATI
Manufacturer: Sierra Wireless, Incorporated
Model: EM7565-9
Revision: SWI9X50C_00.06.02.00 f50f0a jenkins 2017/08/25 05:33:58
MEID: REDACTED
IMEI: REDACTED
IMEI SV:  1
FSN: REDACTED
+GCAP: +CGSM
                                                                                
                                                                                
OK 
  1. check which images are available
AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID                              
FW   1    GOOD   1   0 0      ?_?         00.05.03.00_?                         
FW   2    EMPTY  0   0 0                                                        
FW   3    EMPTY  0   0 0                                                        
FW   4    EMPTY  0   0 0                                                        
Max FW images: 4                                                                
Active FW image is at slot 255                                                  
                                                                                
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID                              
PRI  FF   GOOD   0   0 0      001.004_000 00.06.02.00_GENERIC                   
Max PRI images: 50                                                              
                                                                                
                                                                                
OK 
  1. Enabled enhanced commands
AT!ENTERCND="A710"?                                                                                                                                           
OK

  1. Check interfaces
AT!USBCOMP?                                                                     
Config Index: 1                                                                 
Config Type:  2 (USBIF-PCIE)                                                    
Interface bitmask: 0000000D (diag,nmea,modem)                                   
                                                                                
OK 

I have an old firmware: SWI9X50C_00.06.02.00 and interfaces disabled. I did not check bands because they will be reset by a firmware update. The newer firmware fixes a lot of bugs and gives better stability and support in Linux. Due to firmware signing changes we need to upgrade through SWI9X50C_01.05.01.00_00, and then to the latest firmware, we need to upgrade to the latest firmware twice to work around an issue with low power mode.

I also have Lenovo specific product ID which makes this hard to deal with, so I'll change it.

To upgrade the firmware, connected to the modem:

  1. Connect again if needed and enable enhanced commands
AT!ENTERCND="A710"?                                                                                                                                           
OK

  1. Enable Interfaces for QMI mode
AT!USBCOMP=1,3,000010D
OK
  1. Check interfaces
AT!USBCOMP?                                                                     
Config Index: 1
Config Type:  3 (Generic)
Interface bitmask: 0000010D (diag,nmea,modem,rmnet0) 

OK
  1. Change product id:
AT!USBPID=9091,9090
  1. Reset
AT!RESET
OK

Wait for device to come up.

  1. Download https://source.sierrawireless.com/resources/airprime/minicard/75xx/fw/swi9x50c_01,-d-,05,-d-,01,-d-,00_00_generic_001,-d-,028_000/

I needed to connect to a different serial port as I changed the interfaces:

$ minicom -D /dev/ttyUSB2
ATE
  1. use qmi-firmware-update (from computer, root or sudo)
$ qmi-firmware-update --update -d 1199:9091  SWI9X50C_01.05.01.00.cwe  SWI9X50C_01.05.01.00_GENERIC_001.028_000.nvu 
  1. download the latest firmware, in my case: SWI9X50C_01.14.13.00 https://source.sierrawireless.com/resources/airprime/minicard/75xx/em_mc75xx-approved-fw-packages/

  2. use qmi-firmware-update (from computer, root or sudo)

$ qmi-firmware-update --update -d 1199:9091  SWI9X50C_01.14.13.00.cwe SWI9X50C_01.14.13.00_GENERIC_002.048_000.nvu 
  1. Check low power mode (connected to modem)
$ minicom -D /dev/ttyUSB2
ATE
AT!PCINFO?
State: Low Power Mode
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:0, IMSWITCH:1, BIOS:0, LWM2M:0, OMADM:0, FOTA:0, RFCAL:0
LPM persistence - None

OK
  1. If low power mode is on: upgrade the firmware again, use qmi-firmware-update (from computer, root or sudo)
$ qmi-firmware-update --update -d 1199:9091  SWI9X50C_01.14.13.00.cwe SWI9X50C_01.14.13.00_GENERIC_002.048_000.nvu 

This Lenovo card also seem to have shipped with FCC Authentication enabled (some regulatory thing), which gets disabled by the driver in Windows. ModemManager can do this with extra config too. To check we see Low Power Mode is BIOS:1 and we can check FCC auth directly.

Check:

$ minicom -D /dev/ttyUSB2
ATE
AT!PCINFO?
State: Low Power Mode
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:0, IMSWITCH:0, BIOS:1, LWM2M:0, OMADM:0, FOTA:0, RFCAL:0
LPM persistence - None

OK

AT!ENTERCND="A710"
OK

AT!PCFCCAUTH?
NV Setting: 1
FCC Auth Enabled: 1
FCC Lock State: 1


OK

I am going to disable this on the card, using the NV RAM editing and the Challenge code generator from https://github.com/bkerler/edl/blob/master/sierrakeygen_README.md

$ git clone https://github.com/bkerler/edl
$ cd edl
$ pip install -r requirements.txt

Auto mode:

$ sudo ./edlclient/Tools/sierrakeygen -u
Detected Sierra Wireless device at: /dev/ttyUSB2
Device generation detected: MDM9x50
Sending AT!OPENLOCK? request
Received challenge: 43F8A7C91DC4FB38
Sending AT!OPENLOCK="CF7044ECDC2DF210" response.
Success. Device is now engineer unlocked.

or manual:

$ minicom -D /dev/ttyUSB2
ATE
AT!OPENLOCK?
025BBB762BD3562B

OK
$ sierrakeygen -l 43F8A7C91DC4FB38 -d MDM9x50
AT!OPENLOCK="CF7044ECDC2DF210"

OK

Permanently Disable FCC Auth mode:

AT!PCFCCAUTH?
NV Setting: 1
FCC Auth Enabled: 1
FCC Lock State: 1


OK

AT!PCFCCAUTH=0
OK

AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 1
FCC Lock State: 1


OK
AT!RESET
OK

AT!ENTERCND="A710"
OK

AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 0
FCC Lock State: 0


OK

AT!PCINFO?
State: Online
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:0, IMSWITCH:0, BIOS:0, LWM2M:0, OMADM:0, FOTA:0, RFCAL:0
LPM persistence - None

OK

FCC Auth is now turned off in the NV RAM.

Enable all bands, and disable fallback from LTE (disable UTMS/HSDPA/3G).

AT!BAND=00
OK
AT!BAND=09
OK
AT!SELRAT=06
OK

My card should now be showing on the standard VID:PID of 1199:9091, running the latest firmware, all the LTE bands enabled, fallback to UTMS/HSDPA/3G disabled and FCC auth off (and by association low power mode off). The serial and QMI interfaces enabled (diag,nmea,modem,rmnet0)

@rjocoleman
Copy link
Author

For MBIM instead of QMI substitute all instances of AT!USBCOMP=1,3,000010D (diag,nmea,modem,rmnet0) for AT!USBCOMP=1,3,0000100D (diag,nmea,modem,mbim)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment