EM7565, how to enable radio

IoT Modules
1

I’m evaluating an EM7565 sample for possible use in product. Carrier is Verizon. Host OS is Ubuntu 20.04. Sample was purchased from Digikey. Location is United States.

Bus 003 Device 004: ID 1199:9091 Sierra Wireless, Inc. Sierra Wireless EM7565 Qualcomm® Snapdragon™ X16 LTE-A

$ sudo systemctl stop ModemManager 
$ sudo qmi-firmware-update --update --cdc-wdm /dev/cdc-wdm0 SWI9X50C_01.14.02.00_VERIZON_002.039_002.nvu  SWI9X50C_01.14.02.0
 firmware update operation finished successfully

$ sudo qmicli -d /dev/cdc-wdm0 --dms-set-fcc-authentication -v
error: couldn't set FCC authentication: QMI protocol error (26): 'NoEffect'

$ sudo systemctl start ModemManager
$ sudo mmcli -m /org/freedesktop/ModemManager1/Modem/0 -e
error: couldn't enable the modem: 'GDBus.Error:org.freedesktop.ModemManager1.Error.Core.Retry: Invalid transition'

$ mmcli -m /org/freedesktop/ModemManager1/Modem/0 
  -----------------------------------
  General  |                    path: /org/freedesktop/ModemManager1/Modem/0
           |               device id: 5000e892a222f63df13a16d7e24529f83e0103c6
  -----------------------------------
  Hardware |            manufacturer: Sierra Wireless, Incorporated
           |                   model: EM7565
           |       firmware revision: SWI9X50C_01.14.02.00 2e210b jenkins 2020/08/19 14:18:39
           |          carrier config: default
           |            h/w revision: 1.0
           |               supported: gsm-umts, lte
           |                 current: gsm-umts, lte
           |            equipment id: 353533102789669
  -----------------------------------
  System   |                  device: /sys/devices/pci0000:00/0000:00:08.1/0000:05:00.3/usb3/3-2
           |                 drivers: qcserial, qmi_wwan
           |                  plugin: sierra
           |            primary port: cdc-wdm0
           |                   ports: cdc-wdm0 (qmi), ttyUSB0 (qcdm), ttyUSB1 (gps), 
           |                          ttyUSB2 (at), wwan0 (net)
  -----------------------------------
  Numbers  |                     own: [REDACTED]
  -----------------------------------
  Status   |                    lock: sim-pin2
           |          unlock retries: sim-pin (3), sim-puk (10), sim-pin2 (3), sim-puk2 (10)
           |                   state: disabled
           |             power state: low
           |          signal quality: 0% (cached)
  -----------------------------------
  Modes    |               supported: allowed: 3g; preferred: none
           |                          allowed: 4g; preferred: none
           |                          allowed: 3g, 4g; preferred: 4g
           |                          allowed: 3g, 4g; preferred: 3g
           |                 current: allowed: 2g, 3g, 4g; preferred: 4g
  -----------------------------------
  Bands    |               supported: utran-1, utran-4, utran-6, utran-5, utran-8, utran-9, 
           |                          utran-2, eutran-2, eutran-4, eutran-5, eutran-13, eutran-66, utran-19
           |                 current: utran-1, utran-4, utran-6, utran-5, utran-8, utran-9, 
           |                          utran-2, eutran-2, eutran-4, eutran-5, eutran-13, eutran-66, utran-19
  -----------------------------------
  IP       |               supported: ipv4, ipv6, ipv4v6
  -----------------------------------
  3GPP     |                    imei: 353533102789669
           |           enabled locks: fixed-dialing
  -----------------------------------
  3GPP EPS |    ue mode of operation: csps-2
           |      initial bearer apn: ims
           |  initial bearer ip type: ipv4v6
  -----------------------------------
  SIM      |        primary sim path: /org/freedesktop/ModemManager1/SIM/0
           |          sim slot paths: slot 1: /org/freedesktop/ModemManager1/SIM/0 (active)
           |                          slot 2: none
2

What is the return of

At!entercnd=“A710”
At!impref?
At+cfun?

3 
$ sudo systemctl stop ModemManager
$ sudo /usr/sbin/ModemManager  --debug &

$ sudo mmcli -m /org/freedesktop/ModemManager1/Modem/0 --command='At!entercnd=“A710”'
error: command failed: 'GDBus.Error:org.freedesktop.ModemManager1.Error.Connection.NoCarrier: No carrier'
$ sudo mmcli -m /org/freedesktop/ModemManager1/Modem/0 --command='At!impref?'
error: command failed: 'GDBus.Error:org.freedesktop.ModemManager1.Error.Connection.NoCarrier: No carrier'
$ sudo mmcli -m /org/freedesktop/ModemManager1/Modem/0 --command='At+cfun?'
error: command failed: 'GDBus.Error:org.freedesktop.ModemManager1.Error.Connection.NoCarrier: No carrier'
$ sudo mmcli -m /org/freedesktop/ModemManager1/Modem/0 --command="AT+CGMI"
response: 'Sierra Wireless, Incorporated'
4

Log from ModemManager in debug mode.

mmlog.txt (175.2 KB)

5

i mean in modem port, not mmcli

6 
$ echo -e 'At!entercnd=“A710”' | sudo socat - /dev/ttyUSB2,crnl,crnl

ERROR
$ echo -e 'At!impref?' | sudo socat - /dev/ttyUSB2,crnl,crnl

!IMPREF: 
 preferred fw version:    01.14.02.00
 preferred carrier name:  VERIZON
 preferred config name:   VERIZON_002.039_002
 preferred subpri index:  000
 current fw version:      01.14.02.00
 current carrier name:    VERIZON
 current config name:     VERIZON_002.039_002
 current subpri index:    000

OK
$ echo -e 'At+cfun?' | sudo socat - /dev/ttyUSB2,crnl,crnl

+CFUN: 0

OK
7

then how about AT!GSTATUS?

( it seems you can turn it on by AT+CFUN=1)

8

I was able to pass a AT!OPENUNLOCK challenge response using a response generator found on github, but perhaps it was ephemeral and the unlock disappeared when starting ModemManager. And I can’t issue the challenge response when ModemManger is running. Which means I still have not been able to enable the radio. What is the correct engineering path when trying to develop a product using an EM7565?

9 
$ echo -e 'AT!GSTATUS?' | sudo socat - /dev/ttyUSB2,crnl,crnl

!GSTATUS: 
Current Time:  39950		Temperature: 27
Reset Counter: 3		Mode:        LOW POWER MODE 


OK
$ echo -e 'AT+CFUN=1' | sudo socat - /dev/ttyUSB2,crnl,crnl

+CME ERROR: 4
10

how about
at!PCINFO?
AT!PCOFFEN?
AT!PCTEMP?
at!PCVOLT?

11 
$ echo -e 'at!PCINFO?' | sudo socat - /dev/ttyUSB2,crnl,crnl

State: Low Power Mode
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:1, IMSWITCH:0, BIOS:0, LWM2M:0, OMADM:0, FOTA:0, RFCAL:0, ATNV_CRIT:0
LPM persistence - None

OK
$ echo -e 'AT!PCOFFEN?' | sudo socat - /dev/ttyUSB2,crnl,crnl

0

OK
$ echo -e 'AT!PCTEMP?' | sudo socat - /dev/ttyUSB2,crnl,crnl

Temp state: Normal
Temperature: 27.00 C
BOARD:            27.00 C (866 mV ADC: 7572)
PA_THERM1:        27.00 C (866 mV ADC: 7572)
PMIC DIE:         30.41 C (608 mV ADC: 5318)
XO:               28.10 C (869 mV ADC: 7599)
XO_GPS:           28.10 C (869 mV ADC: 7599)
tsens_tz_sensor0: 27.70 C
tsens_tz_sensor1: 28.00 C
tsens_tz_sensor2: 28.30 C
tsens_tz_sensor3: 27.70 C
tsens_tz_sensor4: 28.00 C


OK
$ echo -e 'at!PCVOLT?' | sudo socat - /dev/ttyUSB2,crnl,crnl

Volt state: Normal
Power supply voltage: 3379 mV (ADC: 9841)


OK
12

This means that you’re holding the W_DISABLE input low. You might get away with masking it with a piece of tape if you can’t force it high on your host platform

13

Thank you. I see two pins on the M.2 B-key slot, W_DISABLE1_B# in Pin 8 and W_DISABLE2_B# on Pin 26. Which one is relevant? Is this typically controlled by BIOS, or by operating system? If BIOS, I don’t see any relevant jumpers or BIOS settings. If I need to talk to the BIOS vendor, what is the correct thing to ask for? (“Please set pin X to high?”)

14

I believe it’ s the pin 8 one.

Normally this pin is controlled by either a physical switch or an exported firmware procedure (e.g ACPI call) to make it user controllable. Ask for anything related to “airplane mode”, “flight mode” or maybe “rfkill” if they’re Linux centric

15

I don’t think the operating system is in airplane mode because a separate M.2 wifi card is functioning correctly. Do you think the EM7565 requires whitelisting by the BIOS vendor?

16

I haven’t seen any implementation using this signal for whitelisting. But anything is possible when it comes to firmware, of course…

Note that there could be (and most likely is) separate switches for wlan and wwan airplane mode. Can’t explain the reasoning.

This is controlled by the SWAN ACPI method placed under the EC “HKEY” handle on my Lenovo Thinkpad:

        Scope (\_SB.PCI0.LPC.EC.HKEY)
        {
       ....
            Method (SWAN, 1, NotSerialized)
            {
                If ((Arg0 & 0x02))
                {
                    WPWC (0x01)
                }
                Else
                {
                    WPWC (0x00)
                }
            }
....
           Method (WPWC, 1, NotSerialized)
            {
                If ((Arg0 && ((WGFL & 0x01) && !(WGFL & 0x08
                    ))))
                {
                    If (\H8DR)
                    {
                        \_SB.PCI0.LPC.EC.DCWW = One
                    }
                    Else
                    {
                        \MBEC (0x3A, 0xFF, 0x40)
                    }

                    WGFL |= 0x02
                }
                Else
                {
                    If (\H8DR)
                    {
                        \_SB.PCI0.LPC.EC.DCWW = Zero
                    }
                    Else
                    {
                        \MBEC (0x3A, 0xBF, 0x00)
                    }

                    WGFL &= ~0x02
                }
            }

This is normally handled by the thinkpad_acpi driver, exporting it as an rfkill device, so I don’t have to go around remembering how to make ACPI calls. But as you can see, there’s a lot of firmware magic there. I believe the WGFL testing is for card presence detection. Which means that there is firmware code running earlier which will detect this. But this is all different from the whitelisting, which will prevent this system from booting at all unless the modem is whitelisted.

But this’s only one arbitrary example. All this is extremely system dependent. There is no way to guess how an unknown system behaves. The only ones who can really answer the questions are are those who designed the system you’re plugging the modem into.

Or just go with the tape solution… I believe the pin has an internal pullup, so isolating it should work.

17

It looks like rfkill has no knowledge of the EM7565.

$ rfkill list
0: hci0: Bluetooth
        Soft blocked: no
        Hard blocked: no
1: phy0: Wireless LAN
        Soft blocked: no
        Hard blocked: no
18

!PCOFFEN commands the modem to ignore W_DISABLE. Easier to apply than tape.

19

Ultimate solution was to work with BIOS folks and get that pin enabled.