EM7565 stuck in QMI mode but only with one DIAG port

[gorodon]

Hi! I realy need your help.

After my not quite competent conversion from full MBIM to QMI (but wrong mode),

AT!USBCOMP?
AT!USBCOMP=1,3,0101
AT!RESET

I have no way to change the modem composition and activate the AT port.
I have tried windows driver with changed parameters,

[Default Values]
SILENT=0
SS=1
MBBDRIVER=1
LOCATIONDRIVER=1
WIN8LOCATION=1
LOG=1
BUSDRIVER=1
WIN8BUSDRIVER=1
USBCOMP=8
CHECKFORDEVICE=0
GPS=1
GPSAUTO=1
GPSRADIO=1
DisableUsbCompAutoUpdate=1

With no luck.

This also

root@ImmortalWrt:~# qmicli -d /dev/cdc-wdm0 --dms-get-operating-mode
[/dev/cdc-wdm0] Operating mode retrieved:
        Mode: 'online'
        HW restricted: 'no'
root@ImmortalWrt:~# qmicli -d /dev/cdc-wdm0 --dms-swi-set-usb-composition=8
error: couldn't set USB composite modes: QMI protocol error (94): 'NotSupported'

Also I have reflashed firmware. Also no luck/changes.
Here additional hw info. I’d appreciate the help.
Thanks,
Aleksei

root@ImmortalWrt:~# lsusb -t -v
/: Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci-mtk/2p, 480M
 ID 1d6b:0002
/: Bus 002. Port 001: Dev 001, Class=root_hub, Driver=xhci-mtk/1p, 20000M/x2
 ID 1d6b:0003
 |__ Port 001: Dev 002, If 0, Class=[unknown], Driver=qcserial, 5000M/x2
 ID 1199:9091
 |__ Port 001: Dev 002, If 8, Class=[unknown], Driver=qmi_wwan, 5000M/x2
 ID 1199:9091

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
D:  Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
P:  Vendor=1199 ProdID=9091 Rev= 0.06
S:  Manufacturer=Sierra Wireless, Incorporated
S:  Product=Sierra Wireless EM7565 Qualcomm® Snapdragon™ X16 LTE-A
S:  SerialNumber=UF02910148031047
C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=896mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=qcserial
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms

[jyijyi]

Can you do AT command with the only port enumerated?
Can you see /dev/ttyUSBx port in linux?

not sure if it works if you change the USBCOMP to 9 in configuration.ini
You can double check:

Using Private LTE with EM9191

not sure if this works, you can have a try: download the USB driver of Windows: https://source.sierrawireless.com/resources/airprime/software/sdx55-windows-drivers-latest-release/#sthash.t4StrCJv.dpbs create a configuration.ini file in the same folder as the driver, add the following setting in configuration.ini [Default Values] USBCOMP=9 run the driver exe. connect the EM9 to windows again

[gorodon]

Continuing the discussion from EM7565 stuck in QMI mode but only with one DIAG port:

Hi!

I already tried to modify configuration.ini and ran with following way:

GenericDriverSetup_5087.exe USBCOMP=8 DisableUsbCompAutoUpdate=1
GenericDriverSetup_5087.exe USBCOMP=6 DisableUsbCompAutoUpdate=1

In Linux and ImmortalWRT I can see only ttyUSB0 unfortunately.

[jyijyi]

Can you do AT command with the only port enumerated?

how about changing the USBCOMP to 9 in configuration.ini?

[gorodon]

I have tried now. No luck. Just DM port.

[gorodon]

@jyijyi

mmand with the only port enumera

ttyUSB0 not reacting for AT-commands.

[jyijyi]

probably you need to contact Sierra FAE to get a tool to configure it

[gorodon]

How to reach this guys (Sierra FAE)? Maybe there are another approach to fix it?

[jyijyi]

how about changing the USBCOMP to 9 in configuration.ini and reinstall the windows driver?

[gorodon]

I have tried with no luck

[jyijyi]

You need to contact distributor to get a tool called setusbcomp.exe for em7565 module

[gorodon]

Is the any advices how to do it, due to I have bought it in on aliexpress?

[jyijyi]

can you return the goods there as it is not fully functioning?

[gorodon]

I don’t think so, due to it’s result of my activities. Better to fix it, if it’s possible.

[jyijyi]

How about using qmicli to do factory reset?

Reset AT!ENTERCND password

AT!ENTERCND=“A710” ERROR I’ve tried qmicli -d /dev/cdc-wdm0 --dms-restore-factory-defaults=“000000” hoping that would restore the default creds, but no luck. Please, how do I reset the nvram/force back to factory 1199:9013 Sierra Wireless, Inc. Sierra Wireless Gobi 3000 Modem device (MC8355)

[gorodon]

How about using qmicli to do factory reset?

How to do it?

[jyijyi]

does this work?

Reset AT!ENTERCND password

AT!ENTERCND=“A710” ERROR I’ve tried qmicli -d /dev/cdc-wdm0 --dms-restore-factory-defaults=“000000” hoping that would restore the default creds, but no luck. Please, how do I reset the nvram/force back to factory 1199:9013 Sierra Wireless, Inc. Sierra Wireless Gobi 3000 Modem device (MC8355)

[gorodon]

I’m trying to restore a proper USB composition that includes a working AT command port on a Sierra Wireless EM7565, so I can switch to MBIM (e.g. AT!USBCOMP=1,3,100D) and have Linux expose cdc_mbim instead of QMI-only behavior.​
On my OpenWrt-based router the modem enumerates mostly as QMI (qmi_wwan), and I cannot reliably access an AT port / get AT responses to change composition.

Attempts (what I tried)

1) Linux: AT!USBCOMP over ttyUSB

• Tried sending via picocom and also via printf ... > /dev/ttyUSB0:
  AT!ENTERCND="A710", AT!USBCOMP=1,3,100D, AT!RESET.

• The modem re-enumerates sometimes, but composition stays QMI (still qmi_wwan, no cdc_mbim).

• I couldn’t reliably see OK responses from that port; it may not be the real AT port (possibly DIAG).

• Reference: typical procedure for MBIM uses AT!USBCOMP=1,3,100D.​

2) Linux: QMI SWI USB composition API

• qmicli --version: 1.34.0.

• qmicli -d /dev/cdc-wdm0 --dms-swi-get-usb-composition → QMI protocol error (94): NotSupported.

• Same for --dms-swi-set-usb-composition.
  (So composition switching via SWI QMI extensions is not available on this FW/PRI.)​

3) Linux: DIAG tools (bkerler/edl → qc_diag)

• Used bkerler/edl qc_diag on interface 0 (VID/PID 1199:9091).​

• qc_diag has no AT passthrough functionality (help lists only info/cmd/sp/spc/nv*/efs*).

• NV reads / nvbackup: most items return Bad Parameter/restricted; I couldn’t locate a writable USB composition NV item.

• EFS browsing: root / and /nv list OK, but many subpaths return Directory not open; some paths (e.g. /nvup, /nvm) crash with struct.error: unpack requires a buffer of 4 bytes.

• Tried guessed raw DIAG vendor commands → Invalid Command Response.

• qc_diag crash is accepted and reboots the modem, but composition remains QMI.

4) Firmware update attempts (Linux/OpenWrt + Ubuntu Live)

• I already tried several recent firmware versions (last ~3–4 versions I had), but the issue persists across them.

• Tried flashing from Live Ubuntu 24.04 using fwdwl-lite (firmware download tool).

• Also tried flashing from OpenWrt via QMI, and also when the adapter enters a QDL/QDL-like download mode during “direct flashing” attempts (it drops into download mode in the process).

5) Windows attempt (during driver install)

• Under Windows (during Sierra driver installation / device setup), I tried changing/restoring the USB composition / AT port, but still didn’t end up with a stable AT+MBIM composition that works back on Linux/OpenWrt.

Logs (key outputs)

• QMI works: /dev/cdc-wdm0 exists; qmicli --dms-get-model returns EM7565; operating mode shows online.

• qmicli --dms-get-firmware-preference shows Generic firmware/PRI (currently 01.14.22.00_GENERIC / 002.059_002).

• lsusb -t typically shows qmi_wwan on interface 8; interface 0 is either qcserial or unbound.

• qmicli --dms-swi-get-usb-composition returns NotSupported.

Firmware packages I have locally

• I have multiple firmware packages. I already tested the most recent ~3–4 that I had.

• I also have a very old package available but haven’t tried downgrading to it yet:
  SWI9X50C_01.05.01.00.cwe + SWI9X50C_01.05.01.00_GENERIC_001.028_000.nvu.

Questions to the forum

1. Is there a known way to restore an AT port / full composition on EM7565 without relying on Windows, when SWI QMI composition commands are NotSupported and DIAG NV access seems blocked?​

2. Would downgrading to the much older firmware (01.05.01.00 / 001.028.000) likely restore a default composition that exposes AT, or enable SWI QMI USB composition switching?

3. Is there a recommended “recovery” USB composition value (or recovery procedure) for EM7565 that reliably brings back AT + DM + MBIM interfaces?​

If needed, I can paste full command outputs (lsusb -t, dmesg | grep -E 'qcserial|qmi_wwan|ttyUSB', qmicli --dms-get-firmware-preference, and the exact NotSupported errors).

[gorodon]

qmicli -d /dev/cdc-wdm0 --dms-restore-factory-defaults=“000000”
error: couldn’t create client for the ‘dms’ service: CID allocation failed in the CTL client: Transaction timed out

qmicli -d /dev/cdc-wdm0 --dms-restore-factory-defaults=“000000”
error: couldn’t create input data bundle: ‘Input variable ‘value_service_programming_code’ must be 6 characters long’

[jyijyi]

What do you see in windows pc?