After some dsl outages I decided to use the SIM card and M.2 slot on the mainboard of my firewall for a LTE WAN failover. The list of supported 4G modems on FreeBSD 13 is short, however it has been extended recently with 13.2 BETA.

I decided getting an Sierra Wireless LTE card as they have an extended documentation and the is a FreeBSD Bug ( Bug 234578 ) on their bugtracker to support EM7455. This card is also known as Dell AirPrime DW5811e or Lenovo Thinkpad EM7455.

The next steps guide you through my experience getting this card running on FreeBSD in serial mode. This technically can work with every Sierra Wireless card. You can convert them to accept qmi mode and AT commands.

The first steps are mentioned in within the bug on FreeBSDs bugtracker. You have to boot a Linux System (I recommend a Debian based distribution, use Rufus with persistent storage) and install the following packages:

sudo apt update
sudo apt-get install libqmi-glib5 libqmi-proxy libqmi-utils curl libuuid-tiny-perl libipc-shareable-perl libjson-perl minicom build-essential -y

Afterwards you may want to stop the ModemManager to not interfere during the process:

systemctl disable ModemManager
systemctl stop ModemManager

Afterwards you want to download the following script and execute it with the appropriate mode. Its mode 6 for the EM7455, it can be different for other cards. You want to change the card to QMI Mode. The device will show up as /dev/cdc-wdm0 or /dev/cdc-wdm1
Download: swi_setusbcomp.pl

sudo perl swi_setusbcomp.pl --device=/dev/cdc-wdm0 --usbcomp=6

Running in MBIM mode (driver=cdc_mbim)
MBIM OPEN succeeded
QMI msg '0x0021' returned status = 1
MBIM QMI support verified
supports 17 QMI subsystems:
  0x00 (1.5)    'QMI_CTL'       - Control service
  0x01 (1.12)   'QMI_WDS'       - Wireless data service
  0x02 (1.7)    'QMI_DMS'       - Device management service
  0x03 (1.21)   'QMI_NAS'       - Network access service
  0x04 (1.3)    'QMI_QOS'       - Quality of service, err, service 
  0x05 (1.4)    'QMI_WMS'       - Wireless messaging service
  0x06 (1.10)   'QMI_PDS'       - Position determination service
  0x07 (1.1)    'QMI_AUTH'      - Authentication service
  0x08 (1.1)    'QMI_AT'        - AT command processor service
  0x09 (2.1)    'QMI_VOICE'     - Voice service
  0x0a (2.0)    'QMI_CAT2'      - Card application toolkit service (new)
  0x0b (1.4)    'QMI_UIM'       - UIM service
  0x0c (1.4)    'QMI_PBM'       - Phonebook service
  0x11 (1.0)    'QMI_SAR'       - Specific absorption rate service
  0x1a (1.0)    'QMI_WDA'       - Wireless data administrative service
  0xe0 (2.0)    'QMI_CAT'       - Card application toolkit service
  0xe1 (1.0)    'QMI_RMS'       - Remote management service
QMI msg '0x0022' returned status = 1
Got QMI DMS client ID '4'
QMI msg '0x555b' returned status = 1
Current USB composition: 14
USB compositions:
   0 - HIP  DM    NMEA  AT    MDM1  MDM2  MDM3  MS      NOT SUPPORTED
   1 - HIP  DM    NMEA  AT    MDM1  MS                  NOT SUPPORTED
   2 - HIP  DM    NMEA  AT    NIC1  MS                  NOT SUPPORTED
   3 - HIP  DM    NMEA  AT    MDM1  NIC1  MS            NOT SUPPORTED
   4 - HIP  DM    NMEA  AT    NIC1  NIC2  NIC3  MS      NOT SUPPORTED
   5 - HIP  DM    NMEA  AT    ECM1  MS                  NOT SUPPORTED
   6 - DM   NMEA  AT    QMI                             SUPPORTED
   7 - DM   NMEA  AT    RMNET1 RMNET2 RMNET3            SUPPORTED
   8 - DM   NMEA  AT    MBIM                            SUPPORTED
   9 - MBIM                                             SUPPORTED
  10 - NMEA MBIM                                        SUPPORTED
  11 - DM   MBIM                                        SUPPORTED
  12 - DM   NMEA  MBIM                                  SUPPORTED
  13 - Config1: comp6    Config2: comp8                 SUPPORTED
* 14 - Config1: comp6    Config2: comp9                 SUPPORTED
  15 - Config1: comp6    Config2: comp10                SUPPORTED
  16 - Config1: comp6    Config2: comp11                SUPPORTED
  17 - Config1: comp6    Config2: comp12                SUPPORTED
  18 - Config1: comp7    Config2: comp8                 SUPPORTED
  19 - Config1: comp7    Config2: comp9                 SUPPORTED
  20 - Config1: comp7    Config2: comp10                SUPPORTED
  21 - Config1: comp7    Config2: comp11                SUPPORTED
  22 - Config1: comp7    Config2: comp12                SUPPORTED
QMI msg '0x555c' returned status = 1
QMI msg '0x0023' returned status = 1

You need to reset the Modem by restarting or unplugging. Now you have the chance doing a firmware update (Downlaod from Sierra Wireless) and execute it with the following commands. While the following IDs for EM7455 match 1199:9071 = Generic Sierra Wireless, 1199:9078 or 9079 for Lenovo EM7455 and 413C:81B6 for Dell.

deviceid=`lsusb | grep -i -E '1199:9071|1199:9079|413C:81B6' | awk '{print $6}'`

sudo qmi-firmware-update --update -d "$deviceid" SWI9X30C_<Version>.cwe SWI9X30C_<Version>_<Generic/Provider>_<Version2>.nvu

You will find the modem as /dev/ttyUSB2 and can access it with minicom now. Technically you can already but back to FreeBSD and use cu -l /dev/cuaUX.2 instead minicom -D /dev/ttyUSB2.

Now we can send AT commands to the modem an convert it to a Generic Sierra Wireless Modem with the following commands. While ENTERCND enables protected commands.

AT!ENTERCND="A710"
OK
AT!USBPID=9071,9070
OK
AT!USBVID=1199

OK
AT!USBPRODUCT="EM7455"

OK
AT!PRIID="9904802","001.001","Generic-Laptop"
OK

Afterwards you maybe able to get a signal info with “AT!GSTATUS?” (assuming the SIM card has no PIN). If this is the case, you’re done and can continue to follow OPNSenses Guide: Configuring Cellular Modems — OPNsense documentation

If this is not the case you have to disable FCC Auth to get this up and running.

AT!GSTATUS?
!GSTATUS:
Current Time:  59588            Temperature: 38
Reset Counter: 8                Mode:        LOW POWER MODE

FCC Auth can only be turned off within the developer menu. The serial can be generated on any device. Send the following commands to you card.

Check for FCCAuth:

AT!PCFCCAUTH?
NV Setting: 1
FCC Auth Enabled: 1
FCC Lock State: 1

OK

Generate Challange:

AT!OPENLOCK?
ABCDEFGHIJ123456

OK

Checkout the following github respository on any Linux system and generate your access key. MDM9x30 matches the EM7455, you can find the full list here: Supported Devices

git clone https://github.com/bkerler/edl

edl/edclient/Tools/sierrakeygen -l ABCDEFGHIJ123456 -d MDM9x30

AT!OPENLOCK="123456ABCDEFGHIJ"
OK
AT!PCFCCAUTH=0
OK
AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 1
FCC Lock State: 1

OK
AT!RESET
OK

After a reset the result should be the following:

AT!ENTERCND="A710"
OK
AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 0
FCC Lock State: 0

OK

Afterwards the output of “AT!GSTATUS?” should show the reception:

AT!GSTATUS?
!GSTATUS:
Current Time:  59588            Temperature: 38
Reset Counter: 8                Mode:        ONLINE
System mode:   LTE              PS state:    Attached
LTE band:      B1               LTE bw:      20 MHz
LTE Rx chan:   100              LTE Tx chan: 18100
LTE CA state:  NOT ASSIGNED
EMM state:     Registered       Normal Service
RRC state:     RRC Idle
IMS reg state: No Srv

PCC RxM RSSI:  -72              RSRP (dBm):  -104
PCC RxD RSSI:  -65              RSRP (dBm):  -97
Tx Power:      0                TAC:         1234 (12345)
RSRQ (dB):     -11.6            Cell ID:     12345678 (12345678)
SINR (dB):      0.8


OK

Sources:

EM7455, Deactivate Low-Power-Mode – IoT Modules / MC/EM Series – Sierra Wireless Forum

EM Series (sierrawireless.com)

234578 – Support for Sierra Wireless EM7455 modem (freebsd.org)

Update Firmware On EM7455 Chip And Set Device ID To Sierra Wireless | ThinkPenguin.com

edl/sierrakeygen_README.md at master · bkerler/edl (github.com)

danielewood/sierra-wireless-modems: EM7565/EM7455/MC7455 – Modem Configuration (github.com)