After some dsl outages I decided to use the SIM card and M.2 slot on the mainboard of my firewall for a LTE WAN failover. The list of supported 4G modems on FreeBSD 13 is short, however it has been extended recently with 13.2 BETA.
I decided getting an Sierra Wireless LTE card as they have an extended documentation and the is a FreeBSD Bug ( Bug 234578 ) on their bugtracker to support EM7455. This card is also known as Dell AirPrime DW5811e or Lenovo Thinkpad EM7455.
The next steps guide you through my experience getting this card running on FreeBSD in serial mode. This technically can work with every Sierra Wireless card. You can convert them to accept qmi mode and AT commands.
The first steps are mentioned in within the bug on FreeBSDs bugtracker. You have to boot a Linux System (I recommend a Debian based distribution, use Rufus with persistent storage) and install the following packages:
sudo apt update
sudo apt-get install libqmi-glib5 libqmi-proxy libqmi-utils curl libuuid-tiny-perl libipc-shareable-perl libjson-perl minicom build-essential -yAfterwards you may want to stop the ModemManager to not interfere during the process:
systemctl disable ModemManager
systemctl stop ModemManagerAfterwards you want to download the following script and execute it with the appropriate mode. Its mode 6 for the EM7455, it can be different for other cards. You want to change the card to QMI Mode. The device will show up as /dev/cdc-wdm0 or /dev/cdc-wdm1
Download: swi_setusbcomp.pl
sudo perl swi_setusbcomp.pl --device=/dev/cdc-wdm0 --usbcomp=6
Running in MBIM mode (driver=cdc_mbim)
MBIM OPEN succeeded
QMI msg '0x0021' returned status = 1
MBIM QMI support verified
supports 17 QMI subsystems:
0x00 (1.5) 'QMI_CTL' - Control service
0x01 (1.12) 'QMI_WDS' - Wireless data service
0x02 (1.7) 'QMI_DMS' - Device management service
0x03 (1.21) 'QMI_NAS' - Network access service
0x04 (1.3) 'QMI_QOS' - Quality of service, err, service
0x05 (1.4) 'QMI_WMS' - Wireless messaging service
0x06 (1.10) 'QMI_PDS' - Position determination service
0x07 (1.1) 'QMI_AUTH' - Authentication service
0x08 (1.1) 'QMI_AT' - AT command processor service
0x09 (2.1) 'QMI_VOICE' - Voice service
0x0a (2.0) 'QMI_CAT2' - Card application toolkit service (new)
0x0b (1.4) 'QMI_UIM' - UIM service
0x0c (1.4) 'QMI_PBM' - Phonebook service
0x11 (1.0) 'QMI_SAR' - Specific absorption rate service
0x1a (1.0) 'QMI_WDA' - Wireless data administrative service
0xe0 (2.0) 'QMI_CAT' - Card application toolkit service
0xe1 (1.0) 'QMI_RMS' - Remote management service
QMI msg '0x0022' returned status = 1
Got QMI DMS client ID '4'
QMI msg '0x555b' returned status = 1
Current USB composition: 14
USB compositions:
0 - HIP DM NMEA AT MDM1 MDM2 MDM3 MS NOT SUPPORTED
1 - HIP DM NMEA AT MDM1 MS NOT SUPPORTED
2 - HIP DM NMEA AT NIC1 MS NOT SUPPORTED
3 - HIP DM NMEA AT MDM1 NIC1 MS NOT SUPPORTED
4 - HIP DM NMEA AT NIC1 NIC2 NIC3 MS NOT SUPPORTED
5 - HIP DM NMEA AT ECM1 MS NOT SUPPORTED
6 - DM NMEA AT QMI SUPPORTED
7 - DM NMEA AT RMNET1 RMNET2 RMNET3 SUPPORTED
8 - DM NMEA AT MBIM SUPPORTED
9 - MBIM SUPPORTED
10 - NMEA MBIM SUPPORTED
11 - DM MBIM SUPPORTED
12 - DM NMEA MBIM SUPPORTED
13 - Config1: comp6 Config2: comp8 SUPPORTED
* 14 - Config1: comp6 Config2: comp9 SUPPORTED
15 - Config1: comp6 Config2: comp10 SUPPORTED
16 - Config1: comp6 Config2: comp11 SUPPORTED
17 - Config1: comp6 Config2: comp12 SUPPORTED
18 - Config1: comp7 Config2: comp8 SUPPORTED
19 - Config1: comp7 Config2: comp9 SUPPORTED
20 - Config1: comp7 Config2: comp10 SUPPORTED
21 - Config1: comp7 Config2: comp11 SUPPORTED
22 - Config1: comp7 Config2: comp12 SUPPORTED
QMI msg '0x555c' returned status = 1
QMI msg '0x0023' returned status = 1You need to reset the Modem by restarting or unplugging. Now you have the chance doing a firmware update (Downlaod from Sierra Wireless) and execute it with the following commands. While the following IDs for EM7455 match 1199:9071 = Generic Sierra Wireless, 1199:9078 or 9079 for Lenovo EM7455 and 413C:81B6 for Dell.
deviceid=`lsusb | grep -i -E '1199:9071|1199:9079|413C:81B6' | awk '{print $6}'`
sudo qmi-firmware-update --update -d "$deviceid" SWI9X30C_<Version>.cwe SWI9X30C_<Version>_<Generic/Provider>_<Version2>.nvuYou will find the modem as /dev/ttyUSB2 and can access it with minicom now. Technically you can already boot back to FreeBSD and use cu -l /dev/cuaUX.2 instead minicom -D /dev/ttyUSB2.
Now we can send AT commands to the modem an convert it to a Generic Sierra Wireless Modem with the following commands. While ENTERCND enables protected commands.
AT!ENTERCND="A710"
OK
AT!USBPID=9071,9070
OK
AT!USBVID=1199
OK
AT!USBPRODUCT="EM7455"
OK
AT!PRIID="9904802","001.001","Generic-Laptop"
OKAfterwards you maybe able to get a signal info with “AT!GSTATUS?” (assuming the SIM card has no PIN). If this is the case, you’re done and can continue to follow OPNSenses Guide: Configuring Cellular Modems — OPNsense documentation
If this is not the case you have to disable FCC Auth to get this up and running.
AT!GSTATUS?
!GSTATUS:
Current Time: 59588 Temperature: 38
Reset Counter: 8 Mode: LOW POWER MODEFCC Auth can only be turned off within the developer menu. The serial can be generated on any device. Send the following commands to you card.
Check for FCCAuth:
AT!PCFCCAUTH?
NV Setting: 1
FCC Auth Enabled: 1
FCC Lock State: 1
OKGenerate Challange:
AT!OPENLOCK?
ABCDEFGHIJ123456
OKCheckout the following github respository on any Linux system and generate your access key. MDM9x30 matches the EM7455, you can find the full list here: Supported Devices
git clone https://github.com/bkerler/edl
edl/edclient/Tools/sierrakeygen -l ABCDEFGHIJ123456 -d MDM9x30AT!OPENLOCK="123456ABCDEFGHIJ"
OK
AT!PCFCCAUTH=0
OK
AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 1
FCC Lock State: 1
OK
AT!RESET
OKAfter a reset the result should be the following:
AT!ENTERCND="A710"
OK
AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 0
FCC Lock State: 0
OKAfterwards the output of “AT!GSTATUS?” should show the reception:
AT!GSTATUS?
!GSTATUS:
Current Time: 59588 Temperature: 38
Reset Counter: 8 Mode: ONLINE
System mode: LTE PS state: Attached
LTE band: B1 LTE bw: 20 MHz
LTE Rx chan: 100 LTE Tx chan: 18100
LTE CA state: NOT ASSIGNED
EMM state: Registered Normal Service
RRC state: RRC Idle
IMS reg state: No Srv
PCC RxM RSSI: -72 RSRP (dBm): -104
PCC RxD RSSI: -65 RSRP (dBm): -97
Tx Power: 0 TAC: 1234 (12345)
RSRQ (dB): -11.6 Cell ID: 12345678 (12345678)
SINR (dB): 0.8
OKSources:
EM7455, Deactivate Low-Power-Mode – IoT Modules / MC/EM Series – Sierra Wireless Forum
EM Series (sierrawireless.com)
234578 – Support for Sierra Wireless EM7455 modem (freebsd.org)
Update Firmware On EM7455 Chip And Set Device ID To Sierra Wireless | ThinkPenguin.com
edl/sierrakeygen_README.md at master · bkerler/edl (github.com)
danielewood/sierra-wireless-modems: EM7565/EM7455/MC7455 – Modem Configuration (github.com)
Recent Comments