EM7455 with OC1120 - AT+CSIM error

I’m trying to use the EM7455 with the OPTIGA™ Connect Consumer OC1120 esim chip from infineon connected to sim slot 0. Whenever I try any AT+CSIM command all I get is ERROR.
This doesn’t happen when I use the other sim slot which has a plastic euicc sim card connected to it.

I connected a logic analyzer to the data pin and got the following initial communication:
0x00 0xA4 0x00 0x04 0x02 0xA4 0x3F 0x00 0x61 0x27 0x00 0xC0 0x00 0x00 0x27 0xC0 0x62 0x25 0x82 0x02 0x78 0x21 0x83 0x02 0x3F 0x00 0xA5 0x0B 0x80 0x01 0x71 0x83 0x03 0x0C 0x27 0xBA 0x87 0x01 0x01 0x8A 0x01 0x05 0x8B 0x03 0x2F 0x06 0x01 0xC6 0x06 0x90 0x01 0x80 0x83 0x01 0x0A 0x90 0x00 0x80 0xAA 0x00 0x00 0x07 0xAA 0xA9 0x05 0x81 0x00 0x82 0x01 0x01 0x90 0x00 0x00 0xA4 0x08 0x04 0x02 0xA4 0x2F 0xE2 0x6A 0x82 0x00 0xA4 0x08 0x04 0x02 0xA4 0x2F 0x05 0x6A 0x82 0x00 0xA4 0x08 0x04 0x02 0xA4 0x2F 0xE2 0x6A 0x82 0x80 0x10 0x00 0x00 0x1E 0x10 0x37 0x09 0xE8 0xCE 0x11 0x9C 0x00 0x07 0x9C 0x00 0x00 0x1F 0xE2 0x60 0x00 0x00 0xC3 0xD0 0x00 0x07 0x00 0x01 0x60 0x00 0x50 0x00 0x00 0x00 0x00 0x08 0x90 0x00 0x00 0xA4 0x08 0x04 0x02 0xA4 0x2F 0x00 0x6A 0x82 0x00 0xA4 0x00 0x04 0x02 0xA4 0x3F 0x00 0x61 0x27 0x00 0xC0 0x00 0x00 0x27 0xC0 0x62 0x25 0x82 0x02 0x78 0x21 0x83 0x02 0x3F 0x00 0xA5 0x0B 0x80 0x01 0x71 0x83 0x03 0x0C 0x27 0xBA 0x87 0x01 0x01 0x8A 0x01 0x05 0x8B 0x03 0x2F 0x06 0x01 0xC6 0x06 0x90 0x01 0x80 0x83 0x01 0x0A 0x90 0x00

Afterwards, whenever I try any AT+CSIM command, nothing is sent over the data line.
I tried upgrading to the latest firmware and it didn’t help.
The output of ATI:

ATI
Manufacturer: Sierra Wireless, Incorporated
Model: EM7455
Revision: SWI9X30C_02.38.00.00 rE3F3E55C03AE94 jenkins 2022/01/13 05:16:00
MEID: 35982032135116                                                            
IMEI: 359820321351163                                                           
IMEI SV: 22                                                                     
FSN: LF235106220210                                                             
+GCAP: +CGSM                                                                    
                                                                                
                                                                                
OK       

Hi @tomerg
Welcome you to our community
Technically, the AT+CSIM command is used to query SIM card information, which can be stored on the physical SIM and not on the eSIM. So when you type AT+CSIM command on the eSIM, it returns an ERROR.

Please share with me specific the AT+CSIM command that you can use on a physical SIM but not on the eSIM.

Thanks,

Sure. For example AT+CSIM=14,"00A40004023F00" or even the simple AT+CSIM=? and AT+CSIM? all get the same ERROR response.
Do note the physical SIM I’m comparing to in the second slot is also an eSIM, just in a plastic SIM card form factor.

Hi @tomerg,

as can be seen when decoding the T0 data with Wireshark SELECT MF works when issued by the EM7455 but the eSIM does not have EF.ICCID and EF.DIR and is therefore not considered to be valid by the EM7455.

    1   0.000000              -              GSM SIM ISO/IEC 7816-4 SELECT File MF : Response ready, Response length is 39 
    2   0.000001              -              GSM SIM ISO/IEC 7816-4 GET RESPONSE 
    3   0.000002              -              GSM SIM ETSI TS 102.221 TERMINAL CAPABILITY 
    4   0.000003              -              GSM SIM ISO/IEC 7816-4 SELECT /EF.ICCID : Wrong parameters: File not found 
    5   0.000004              -              GSM SIM ISO/IEC 7816-4 SELECT /EF.ELP : Wrong parameters: File not found 
    6   0.000005              -              GSM SIM ISO/IEC 7816-4 SELECT /EF.ICCID : Wrong parameters: File not found 
    7   0.000006              -              GSM SIM ETSI TS 102.221 TERMINAL PROFILE 
    8   0.000007              -              GSM SIM ISO/IEC 7816-4 SELECT /EF.DIR : Wrong parameters: File not found 
    9   0.000008              -              GSM SIM ISO/IEC 7816-4 SELECT File MF : Response ready, Response length is 39 
   10   0.000009              -              GSM SIM ISO/IEC 7816-4 GET RESPONSE

This does not look like a HW issue to me.

Regards,
Reinhard

1 Like

Well, this story continues. @tomerg @rspmn

Initial problem was traced to a batch of bad ESIM ICs supplied. However even when this was corrected, it seems that EM7455 refuses to establish a link with any ESIM that contains no profiles.

When the profile is downloaded to the ESIM IC prior to connecting it to the EM7455, the ESIM is recognized correctly. However, in our product the profile is required to be downloaded on device activation and not during manufacturing.

This creates a catch-22 situation: establishing a link is needed to download a profile, and a profile is needed to establish a link (via MBIM or AT commands).

So: any advice on how to establish a connection with a blank ESIM in order to download a profile ?

Hi @vadim,

if this is a GSMA SGP.22-compliant eSIM you would have to use a device which provides a Local Profile Assistant (LPA) to download a profile on the eSIM.

If you are familiar with the GobiAPI (CodeLinaro / qsdk / oss / lklm / gobinet · GitLab) you could also try to make the eSIM available to a LPA running on the host via UIMSAPConnection and UIMSAPRequest.

@jyijyi, @mlw Are there Sierra Wireless modules which provide LPA functionality on the device itself?

Regards,
Reinhard

i saw this in EM9 AT command guide:

@rspmn

The short answer is no but its a bit of a chicken and egg situation.

The point of having a blank card with just the GSMA certificate on it means that you can provision it with any provider (in theory) but for the unit to connect to the server it needs a data connection, which it cannot get without attaching to the network, for which it needs a service providers profile, which it does not have because it is a blank SIM card and around and around we go in circles.

Handsets (and by extension their OS’s bve they iOS or Android which have LPA’s) can do this through their WiFi connection but standalone modules cannot as they are not aware of other IP connections nor do they have any way to control them.

Regards

Matt

@mlw , @rspmn
I think I wasn’t very clear in my question, sorry about that.

We do have LPA on our host processor, and we have verified its functionality.
However this LPA requires a communication channel to the SIM (we use MBIM). And this channel is being blocked (for no good reason it seems) when the SIM does not have a profile. If we download any profile into the ESIM by connecting directly to it (bypassing EM7455), then the MBIM channel is opened successfully and the LPA can manage ESIM (download more profiles, switch etc).

The communication to the SM-DP+ server is also not a problem, we do it via separate channel (wifi).

It’s this initial blocking of connection when the SIM has no profiles that was the subject of the question.

It would seem as some code path within the module firmware decides that the SIM is unusable for authenticating to the network (which it is at this stage) and then disables it altogether, being unaware of other SIM use cases, such as profile management.

@rspmn

So the 7455 is very old now, it might be that what is required is not supported on the MBIM interface, the interface was quite immature when the unit came out. Have you tried on a newer device?

Regards

Matt

@jyijyi @mlw Thank you for providing information on the availabity of internal LPA support .

@vadim For accessing the SIM connected to a EM7455 which is in MBIM mode from your own LPA running on the host you would have to use the MBIM QMI service mentioned in https://modemmanager.org/docs/libmbim/mbim-protocol/ to access the QMI UIM service. After you have called UIMSAPConnection to connect your application to the SIM you can reset it, read out the ATR, transfer APDUs etc. with UIMSAPRequest until you call UIMSAPConnection to disconnect your application from the SIM to make it available to the EM7455 again.

Regards,
Reinhard