After some dsl outages I decided to use the SIM card and M.2 slot on the mainboard of my firewall for a LTE WAN failover. The list of supported 4G modems on FreeBSD 13 is short, however it has been extended recently with 13.2 BETA.
I decided getting an Sierra Wireless LTE card as they have an extended documentation and the is a FreeBSD Bug ( Bug 234578 ) on their bugtracker to support EM7455. This card is also known as Dell AirPrime DW5811e or Lenovo Thinkpad EM7455.
The next steps guide you through my experience getting this card running on FreeBSD in serial mode. This technically can work with every Sierra Wireless card. You can convert them to accept qmi mode and AT commands.
The first steps are mentioned in within the bug on FreeBSDs bugtracker. You have to boot a Linux System (I recommend a Debian based distribution, use Rufus with persistent storage) and install the following packages:
sudo apt update
sudo apt-get install libqmi-glib5 libqmi-proxy libqmi-utils curl libuuid-tiny-perl libipc-shareable-perl libjson-perl minicom build-essential -yAfterwards you may want to stop the ModemManager to not interfere during the process:
systemctl disable ModemManager
systemctl stop ModemManagerAfterwards you want to download the following script and execute it with the appropriate mode. Its mode 6 for the EM7455, it can be different for other cards. You want to change the card to QMI Mode. The device will show up as /dev/cdc-wdm0 or /dev/cdc-wdm1
Download: swi_setusbcomp.pl
sudo perl swi_setusbcomp.pl --device=/dev/cdc-wdm0 --usbcomp=6
Running in MBIM mode (driver=cdc_mbim)
MBIM OPEN succeeded
QMI msg '0x0021' returned status = 1
MBIM QMI support verified
supports 17 QMI subsystems:
0x00 (1.5) 'QMI_CTL' - Control service
0x01 (1.12) 'QMI_WDS' - Wireless data service
0x02 (1.7) 'QMI_DMS' - Device management service
0x03 (1.21) 'QMI_NAS' - Network access service
0x04 (1.3) 'QMI_QOS' - Quality of service, err, service
0x05 (1.4) 'QMI_WMS' - Wireless messaging service
0x06 (1.10) 'QMI_PDS' - Position determination service
0x07 (1.1) 'QMI_AUTH' - Authentication service
0x08 (1.1) 'QMI_AT' - AT command processor service
0x09 (2.1) 'QMI_VOICE' - Voice service
0x0a (2.0) 'QMI_CAT2' - Card application toolkit service (new)
0x0b (1.4) 'QMI_UIM' - UIM service
0x0c (1.4) 'QMI_PBM' - Phonebook service
0x11 (1.0) 'QMI_SAR' - Specific absorption rate service
0x1a (1.0) 'QMI_WDA' - Wireless data administrative service
0xe0 (2.0) 'QMI_CAT' - Card application toolkit service
0xe1 (1.0) 'QMI_RMS' - Remote management service
QMI msg '0x0022' returned status = 1
Got QMI DMS client ID '4'
QMI msg '0x555b' returned status = 1
Current USB composition: 14
USB compositions:
0 - HIP DM NMEA AT MDM1 MDM2 MDM3 MS NOT SUPPORTED
1 - HIP DM NMEA AT MDM1 MS NOT SUPPORTED
2 - HIP DM NMEA AT NIC1 MS NOT SUPPORTED
3 - HIP DM NMEA AT MDM1 NIC1 MS NOT SUPPORTED
4 - HIP DM NMEA AT NIC1 NIC2 NIC3 MS NOT SUPPORTED
5 - HIP DM NMEA AT ECM1 MS NOT SUPPORTED
6 - DM NMEA AT QMI SUPPORTED
7 - DM NMEA AT RMNET1 RMNET2 RMNET3 SUPPORTED
8 - DM NMEA AT MBIM SUPPORTED
9 - MBIM SUPPORTED
10 - NMEA MBIM SUPPORTED
11 - DM MBIM SUPPORTED
12 - DM NMEA MBIM SUPPORTED
13 - Config1: comp6 Config2: comp8 SUPPORTED
* 14 - Config1: comp6 Config2: comp9 SUPPORTED
15 - Config1: comp6 Config2: comp10 SUPPORTED
16 - Config1: comp6 Config2: comp11 SUPPORTED
17 - Config1: comp6 Config2: comp12 SUPPORTED
18 - Config1: comp7 Config2: comp8 SUPPORTED
19 - Config1: comp7 Config2: comp9 SUPPORTED
20 - Config1: comp7 Config2: comp10 SUPPORTED
21 - Config1: comp7 Config2: comp11 SUPPORTED
22 - Config1: comp7 Config2: comp12 SUPPORTED
QMI msg '0x555c' returned status = 1
QMI msg '0x0023' returned status = 1You need to reset the Modem by restarting or unplugging. Now you have the chance doing a firmware update (Downlaod from Sierra Wireless) and execute it with the following commands. While the following IDs for EM7455 match 1199:9071 = Generic Sierra Wireless, 1199:9078 or 9079 for Lenovo EM7455 and 413C:81B6 for Dell.
deviceid=`lsusb | grep -i -E '1199:9071|1199:9079|413C:81B6' | awk '{print $6}'`
sudo qmi-firmware-update --update -d "$deviceid" SWI9X30C_<Version>.cwe SWI9X30C_<Version>_<Generic/Provider>_<Version2>.nvuYou will find the modem as /dev/ttyUSB2 and can access it with minicom now. Technically you can already boot back to FreeBSD and use cu -l /dev/cuaUX.2 instead minicom -D /dev/ttyUSB2.
Now we can send AT commands to the modem an convert it to a Generic Sierra Wireless Modem with the following commands. While ENTERCND enables protected commands.
AT!ENTERCND="A710"
OK
AT!USBPID=9071,9070
OK
AT!USBVID=1199
OK
AT!USBPRODUCT="EM7455"
OK
AT!PRIID="9904802","001.001","Generic-Laptop"
OKAfterwards you maybe able to get a signal info with “AT!GSTATUS?” (assuming the SIM card has no PIN). If this is the case, you’re done and can continue to follow OPNSenses Guide: Configuring Cellular Modems — OPNsense documentation
If this is not the case you have to disable FCC Auth to get this up and running.
AT!GSTATUS?
!GSTATUS:
Current Time: 59588 Temperature: 38
Reset Counter: 8 Mode: LOW POWER MODEFCC Auth can only be turned off within the developer menu. The serial can be generated on any device. Send the following commands to you card.
Check for FCCAuth:
AT!PCFCCAUTH?
NV Setting: 1
FCC Auth Enabled: 1
FCC Lock State: 1
OKGenerate Challange:
AT!OPENLOCK?
ABCDEFGHIJ123456
OKCheckout the following github respository on any Linux system and generate your access key. MDM9x30 matches the EM7455, you can find the full list here: Supported Devices
git clone https://github.com/bkerler/edl
edl/edclient/Tools/sierrakeygen -l ABCDEFGHIJ123456 -d MDM9x30AT!OPENLOCK="123456ABCDEFGHIJ"
OK
AT!PCFCCAUTH=0
OK
AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 1
FCC Lock State: 1
OK
AT!RESET
OKAfter a reset the result should be the following:
AT!ENTERCND="A710"
OK
AT!PCFCCAUTH?
NV Setting: 0
FCC Auth Enabled: 0
FCC Lock State: 0
OKAfterwards the output of “AT!GSTATUS?” should show the reception:
AT!GSTATUS?
!GSTATUS:
Current Time: 59588 Temperature: 38
Reset Counter: 8 Mode: ONLINE
System mode: LTE PS state: Attached
LTE band: B1 LTE bw: 20 MHz
LTE Rx chan: 100 LTE Tx chan: 18100
LTE CA state: NOT ASSIGNED
EMM state: Registered Normal Service
RRC state: RRC Idle
IMS reg state: No Srv
PCC RxM RSSI: -72 RSRP (dBm): -104
PCC RxD RSSI: -65 RSRP (dBm): -97
Tx Power: 0 TAC: 1234 (12345)
RSRQ (dB): -11.6 Cell ID: 12345678 (12345678)
SINR (dB): 0.8
OKSources:
EM7455, Deactivate Low-Power-Mode – IoT Modules / MC/EM Series – Sierra Wireless Forum
EM Series (sierrawireless.com)
234578 – Support for Sierra Wireless EM7455 modem (freebsd.org)
Update Firmware On EM7455 Chip And Set Device ID To Sierra Wireless | ThinkPenguin.com
edl/sierrakeygen_README.md at master · bkerler/edl (github.com)
danielewood/sierra-wireless-modems: EM7565/EM7455/MC7455 – Modem Configuration (github.com)
E: Unable to locate package libqmi-utils
E: Unable to locate package libuuid-tiny-perl
E: Unable to locate package libipc-shareable-perl
E: Unable to locate package minicom
Seems to be the issues I’m getting when running the second command. Do these packages still exist?
Hello John,
they do still exist.
Which linux distribution are you trying to install the packages on? As mentioned in the post I used debian. Debian or Ubuntu should do the trick. Make sure you run apt-get update on a live environment before.
Cheers
Fixed that issue now – I ended up using MX and that downloaded the packages no issue.
Next issue I’m attempting to flash the updated firmware but am receiving a QMI error:
“error: couldn’t open QMI device: Transaction timed out”
Running the script before bring up the error:
“Running in QMI mode (driver=qmi_wwan)
Failed to verify QMI”
Any ideas?
Many thanks
You disabled the ModemManager? I would stronlgy recommend to use Linux Mint Live CD to get this done. Worked flawlessly. Whats the output of
lsusb | grep -i -E ‘1199:9071|1199:9079|413C:81B6’ | awk ‘{print $6}’
Maybe the manufacturer does not meet the usbid. Try lsusb to identify your device.
That was exactly the guide I was looking for.
However, it brought one of my EM7455 in an unusable state and I don’t have the background info why this happened what it means.
So I ran:
perl swi_setusbcomp.pl –device=/dev/cdc-wdm1 –usbcomp=6
And output was fine. However, after resetting the device no /dev/cdc-wdm device was present anymore and the following firmware update was not possible. Basically nothing is possible anymore as I also don’t have the serial devices available.
Connecting the modem to Windows shows me an unknown USB device and no driver installation solves it. I could imagine that the device sits in some kind of update mode / bootloader. But how do I leave it?
Btw: The devcice id is 1199:9075 which is close to the generic but not the generic .Googling it brings some Fujitsu results. The modem itself looks generic.
Any clue what I can do here?
For a second, Dell-branded modem, the procedure worked fine. Many thanks here.
Thanks!
Chris
Hey Chris,
thats totally fine the device disappeared. You changed it to QMI Mode. It should appear as /dev/ttyUSB, you may check lsusb. It allows you to update the firmware. After changing the mode a restart (cold boot!) is mandatory.
If you need it for a desktop device for ex. Windows, QMI Mode is not suitable. Change it to MBIM (8) for ex.
Cheers
Thanks for the quick reply.
That is the issue, there is neither a /dev/ttyUSB nor a /dev/cdc-wdm device. Cold reboots were done. (The procedure in general worked fine on a second modem I got.)
The modem hower shows up with lsusb.
dmesg gives me a very limited output, basically stating that no configuration for the modem was found.
Continues here https://forum.sierrawireless.com/t/em7455-not-recognised-anymore-after-usbmode-change/34271/1
🙂
Very strange, I haven’t experienced this yet. Nor I saw this device id before.
You tired the passwords listed here?
https://github.com/bkerler/edl/blob/master/sierrakeygen_README.md
You updated the firmware with Fujitsu or Generic one?
Feel free to contact me via HelpDesk or Contact form.
Hello XeroX,
I’m trying to get IPv6 working on opnsense but no success, any chance you get it through?
I can get an IPv6 address doing the following AT command before I get PPP interface up:
AT+CGDCONT=1,”IPV4V6″,”free”
AT+CGPADDR -> show both ipv4 and ipv6
But when I bring my interface up no IPv6 address show up. I tried different configurations with DHCPv6 and SLACK.
If I disconnect my WAN interface and issue AT+CGDCONT?, it show AT+CGDCONT=1,”IP”,”free” so my previous context type was overwrite, it seems opnsense force context type to “IP”.
I edited /usr/local/opnsense/scripts/interfaces/mpd.script to set CGDCONT type to “IPV4V6” but still no IPv6 address showing up… seems to be an opnsense issue I got some “dhcp6c 16164 – [meta sequenceId=”1″] transmit failed: Network is down” in /var/log/system/latest.log
Hey Raoul,
I’vent tested it with IPv6, however it looks like opnsense overwrites the settings. Have you tried editing your PPP Device and got to Advanced Settings and set the Init String to AT+CGDCONT=1,”IPV4V6″,”free”?
Hey XeroX,
I’ve tried but it doesn’t have effect because it is set hard written it the mpd script who run after.
That works for me is editing the mpd script and set the CGDCONT to IPV4V6 but the problem persists I don’t get any IPv6 address on opnsense (while AT+CGPADDR IPv6 is OK).
I got the following errors lines:
dhcp6c 47975 – [meta sequenceId=”1″] transmit failed: Network is down
ppp 37015 – [meta sequenceId=”41″] [wan] IPV6CP: parameter negotiation failed
I made few researches and I found noting about IPv6 working with 4G modem like EM7455 on opnsense or pfsense.
Tell me if you have the opportunity to test one day