Booting into arch
Arch’s Grub uses port speed 38400 so switch your terminal emulator accordingly
To boot into the live environment, at the Grub boot prompt press TAB and append console=ttyS0,38400 to the kernel commandline as described in the Arch wiki articleWorking with the serial console. Log in as root
Compiling qualcomm gobi drivers
The software provided by Sierra for flashing this modem requires the Qualcomm Gobi drivers. Sierra calls these the Linux Drivers QMI Software
First, download and unpack the drivers:
Configure usb interface
We need to ensure no MBIM interface is enabled for Linux to see our modem correctly. First, check the current setting:
AT!UDUSBCOMP?
!UDUSBCOMP: 14
OKList the settings to see what this maps to:
AT!UDUSBCOMP=?
0 - reserved NOT SUPPORTED
1 - DM AT SUPPORTED
2 - reserved NOT SUPPORTED
3 - reserved NOT SUPPORTED
4 - reserved NOT SUPPORTED
5 - reserved NOT SUPPORTED
6 - DM NMEA AT QMI SUPPORTED
7 - DM NMEA AT RMNET1 RMNET2 RMNET3 SUPPORTED
8 - DM NMEA AT MBIM SUPPORTED
9 - MBIM SUPPORTED
10 - NMEA MBIM SUPPORTED
11 - DM MBIM SUPPORTED
12 - DM NMEA MBIM SUPPORTED
13 - Config1: comp6 Config2: comp8 NOT SUPPORTED
14 - Config1: comp6 Config2: comp9 SUPPORTED
15 - Config1: comp6 Config2: comp10 NOT SUPPORTED
16 - Config1: comp6 Config2: comp11 NOT SUPPORTED
17 - Config1: comp6 Config2: comp12 NOT SUPPORTED
18 - Config1: comp7 Config2: comp8 NOT SUPPORTED
19 - Config1: comp7 Config2: comp9 SUPPORTED
20 - Config1: comp7 Config2: comp10 NOT SUPPORTED
21 - Config1: comp7 Config2: comp11 NOT SUPPORTED
22 - Config1: comp7 Config2: comp12 NOT SUPPORTED
OKIn the case above, 14 maps to configs 6 and 9. To do the flash in Linux, we need the AT and QMI interfaces which is 6 but we dont want the MBIM interface in 9.
Caution: ensure you do not set this to an interface without AT — this may lock you out of the modem
Set the USB interface to config number 6:
AT!UDUSBCOMP=6
OKFrom here, we should be good to start with the Linux half
Connect to your modem
First, verify your modem was found:
# dmesg | lessLook for something like this:
u3g0: <vendor 0x1199 MC7355, class 0/0, rev 2.00/0.06, addr 3> on usbus1
u3g0: Found 4 ports.The driver will create four USB-serial ports
# ls /dev/cuaU*[0-9]
/dev/cuaU0.0 /dev/cuaU0.1 /dev/cuaU0.2 /dev/cuaU0.3The port for AT commands is usually on cuaU0.1 or cuaU0.2. Try an AT command with each, pressing ~. to exit
the session
# cu -l /dev/cuaU0.1
Connected
AT
OKConnecting using mbim
You should now be able to connect. For testing this on Debian/Ubuntu you can install libqmi-utils:
sudo apt install libmbim-utilsDisconnection issues
It seems that many people experience intermittent disconnections with the MC7455. I’ve seen this happen myself and the GoldenOrb ROOter firmware has a nice feature for detecting these disconnects and re-connecting automatically. You have to enable this feature using the web UI. Remember to specify the IP to ping, otherwise it won’t work.
For OpenWRT you could write a simple scripts that pings some server and then reboots or re-initializes the modem when pings begin failing. Or maybe you could look at how it’s done in GoldebOrb ROOter.
Some have reported that the newer and faster EM7565 modem doesn’t suffer from these disconnection issues but I have not tested this.
Errors
Here are some pasted errors to help Googlers to reach this page
Frequencies and antennas
You will also need two antennas, or a single MIMO antenna. The frequencies used by Sprint in my area are:
- 25: 1850 to 1995 MHz (FDD-LTE)
- 26: 814 to 894 MHz (FDD-LTE)
- 41: 2496 to 2690 MHz (TDD-LTE)
Help! contribute! sponsor!
If you want to help, or sponsor further development in libmbim, mbimcli or the ModemManager integration, just let me know!
[UPDATE: Included freedesktop.org project link]
Inspect the current carrier configuration
Before proceeding, we need to check the current carrier to see whether we really need to do a flash
AT!GOBIIMPREF?
!GOBIIMPREF: preferred fw version: 01.08.16.05 preferred carrier name: VZW preferred config name: VZW_000.036_000 current fw version: 01.08.16.05 current carrier name: VZW current config name: VZW_000.036_000
OKIn this case, I want Sprint. Let’s see if a Sprint config is loaded that we can choose:
AT!PRIID?
PRI Part Number: 9902812
Revision: 01.07
Carrier PRI: 9999999_9902266_SWI9X15C_01.08.16.05_00_VZW_000.036_000If our preferred carrier appeared here, we could switch to it with this command (note how the string above maps to the
three fields):
AT!GOBIIMPREF="01.08.16.05","VZW","VZW_000.036_000"Since it doesn’t map, we’ll need to continue
Inspection: freebsd
For this step, we need to access the modem’s USB Serial interface. This will allow us to use modem AT Commands to inspect
the current configuration and turn off MBIM mode which prevents the modem from being discovered in Linux. Since Linux wont
(AFAICT) recognize the modem in this state, we need to rely on FreeBSD’s u3g driver.
Libmbim
The ‘libmbim‘ library is an attempt to write a protocol support library, as previously done with ‘libqmi‘.
The current codebase, GLib/GObject/GIO based, is pretty similar to what libqmi provided, with a ‘MbimDevice‘ GObject to handle the communication through the /dev/cdc-wdm port, as well as ‘MbimMessage‘ types to handle the creation of commands.
Given that there is no need for client allocations in MBIM, there is no ‘MbimClient‘ object needed. Also, given that the contents of each message are pre-defined, it wasn’t considered the need of input and output ‘bundles’ to handle collections of TLVs, as done in libqmi.
Locking to specific channel/frequency
TODO There is a way to force the modem to only use specified channels using AT commands. This could be useful if some channels are more crowded than others or if you have an antenna which doesn’t work well for some channels.
Manually configuring using umbim
OpenWRT does have a utility for mbim called umbim. You can install it using:
opkg update
opkg install umbimIf you want to use it on a non-openwrt system you can compile it like so:
Mbim basic types
The protocol not only defines which action is supported in each command; it also defines the contents of the request, response and indication messages. The contents of each message are composed of collections of basic types defined by the protocol:
- Unsigned 32bit integers: Even for the most simple values (e.g. booleans), little-endian 32 bit unsigned integers are used.
- Strings: UTF-16LE encoded strings are always used.
- UUIDs: The protocol defines a special 16-byte-long UUID type, e.g. to define Service IDs
- Arrays: Collection of N values of a given basic type.
- Structs: Sequence of other basic types, given in a specific order.
As you can see, there is not much effort (none, actually) into making the protocol efficient in terms of overhead introduced; more than half of the bytes in each message will very likely end up being NUL bytes. Also, it is assured that each field within a message is aligned in a 32bit boundary, which makes it easier to read independent fields directly from the binary stream.
Mbim commands
For each service, MBIM defines a set of Commands (CIDs); and each command can then be divided into 3 actions:
Not every action is supported by every command. For example, the “Device Caps” command in the “Basic Connect” service only supports the “Query” action, while the “Radio State” command of the same service supports all “Set“, “Query” and “Notification“.
But how does this match with the message types defined before?
- Host-created “Set” and “Query” requests are sent using “Command Messages“.
- Modem-created “Set” and “Query” responses are sent using “Command Done Messages“.
- Modem-created “Notifications” are sent using “Indication Messages“.
Mbim message types
The protocol defines different message types with different formats.
Some of them are used to establish the channel of communication with the modem:
- Open Message (Host->Modem): Initialization request.
- Open Done Message (Host<-Modem): Initialization response.
- Close Message (Host->Modem): Close request.
- Close Done Message (Host<-Modem): Close response.
Some of the messages are used to report errors in the protocol; which may be sent either from the host or from the modem:
- Host Error Message (Host->Modem): Host-reported error.
- Modem Error Message (Host<-Modem): Modem-reported error.
And finally, some messages provide access to the different CIDs (Command IDs) defined in each Service.
Mbim services
The protocol defines a basic set of different Services:
- Basic Connect: Which provides the support for basic IP connectivity
- SMS: SMS messaging
- USSD: Unstructured Supplementary Service Data
- Phonebook: Handling contacts and such
- STK: SIM toolkit
- Authentication
- Device Service Stream
Only the Basic Connect one is mandatory in every MBIM device; others are optional. Vendors or even Network Operators can also extend the functionality of the device with other services; for example to support other protocols embedded within MBIM (e.g. QMI or AT within MBIM); or just to provide specific new features.
Mbimcli
The project comes with a command line utility (mbimcli), which allows (will allow) running “Get” or “Set” commands directly from the shell. There aren’t many supported commands yet, so I cannot show many more examples than this one:
$ sudo mbimcli -d /dev/cdc-wdm1 —basic-connect-query-subscriber-ready-status
[/dev/cdc-wdm1] Subscriber ready status retrieved:Ready state: ‘device-locked’Subscriber ID: ‘unknown’SIM ICCID: ‘984310311520086950F1’Ready info: ‘unknown’Telephone numbers: »
Hint: Using —verbose will show you the raw binary message contents!
Notes
These procedures are specific to the setup I had to perform this on. Most notably, the only system I had with a mini-PCI-e
slot was the target pfSense system, a PCengines APU1d with no VGA port (serial console only). If you’re able to obtain a
USB-to-mini-PCI-e adapter, performing this flash will likely be much easier (perhaps even allowing you to use Windows in a VM).
System: PCenginesAPU1dLive USB: FreeBSD (i386 memstick installer)
Live USB: Arch linuxModem: Sierra MC7355, with Panasonic SKU (1101888)
Also used: Null modem adapter with USB-to-serial plugged into a spare machine
Two USB sticks
Openwrt
OpenWRT doesn’t seem to have complete official support for MBIM/QMI modems. An updated (as of late 2022) patch-set that uses ModemManager is available here. The problem with this solution (and why it will probably not get merged) is that it requires DBus rather than ubus.
The other option is to use the GoldenOrb ROOter firmware which automates everything via a nice web UI, but then you’re no longer running stock OpenWRT.
For now it just doesn’t seem that MBIM and QMI is well-integrated into OpenWRT, but I could be wrong. It could be that it’s simply not documented. The only mention seems to be here. For QMI, using the uqmi utility manually is documented here but it doesn’t seem to be integrated into uci or ubus.
Overview
The Sierra MC7355 can run configurations for several North American carriers. These cards are easy to find on eBay
and notable for their support for the Sprint LTE network. Unless you’re luck out, you may find you need to flash a new
carrier configuration onto the card you purchased before using it.
Removing incompatible drivers
The Sierra modem may be identified by several built-in kernel drivers that are incompatible with the drivers we’re about to compile. Remove any of the following modules with modprobe -r <modulename>:
- qcserial
- qmi_wwan
- usb_wwan
- cdc_mbim
- cdc_wdm
- cdc_ncm
- sierra
- sierra_net
Setting up linux live environment
To complete this we need a live linux environment with a serial console. For this I used an Arch installer. If using Arch, a second USB or system drive will be necessary as the live install’s root partition is not big enough for the compile dependencies. If another live distro is chosen, the requirements are:
- Boots with a serial console (minimum: grub configured on serial console)
- Ability to compile kernel modules (basic compiler tools, linux headers)
Troubleshooting
For troubleshooting modem configuration, I recommend this guide.
Usb errors when mbim mode is enabled in linux
Having an MBIM config (or maybe it’s just any multi-config UDUSBCOMP value?) makes Linux USB angry, causing the modem’s
Serial devices to not work
[ 484.038683] usb 3-1.3: config 1 has an invalid interface number: 8 but max is 3
[ 484.038693] usb 3-1.3: config 1 has no interface number 1
[ 484.039172] usb 3-1.3: config 2 has an invalid interface number: 12 but max is 1
[ 484.039181] usb 3-1.3: config 2 has an invalid interface number: 13 but max is 1
[ 484.039189] usb 3-1.3: config 2 has an invalid interface number: 13 but max is 1
[ 484.039196] usb 3-1.3: config 2 has no interface number 0
[ 484.039203] usb 3-1.3: config 2 has no interface number 1Verify your carrier once more
# pacman -S uucp
# cu -l /dev/ttyUSB2 # or ttyUSB1, varies
Connected.
AT
OK
AT!ENTERCND="A710"
OK
AT!GOBIIMPREF?
!GOBIIMPREF: preferred fw version: 05.05.63.01 preferred carrier name: SPRINT preferred config name: SPRINT_005.037_000 current fw version: 05.05.63.01 current carrier name: SPRINT current config name: SPRINT_005.037_000
OKSuccess!
What is mbim?
The Mobile Interface Broadband Model (MBIM) is a new standard developed by the USB Implementers Forum, specifically designed for high speed mobile broadband modem devices.
This new USB networking subclass defines two separate new features:
- A new MBIM USB device model, providing multiple IP connections over a single USB interface, and without the need of 802.3 frames (as was the case with ECM and NCM)
- A new MBIM control protocol to talk to modem devices
Where do i get it?
The ‘libmbim’ library and the ‘mbimcli’ utility are managed in FreeDesktop.org: