EM9190: 5G SA SMS Not Working — SMSoNAS/IMS Both Failed, ENDC Unavailable

Module Information

Item Detail
Model EM9190
Original config Customer: Getac, cross-flashed to GENERIC
Firmware SWIX55C_03.17.09.00 (Release 9, 2025/07/24)
IMEI SV 29
PRI GENERIC 030.115_000
IMPREF GENERIC (preferred/current both 03.17.09.00_GENERIC)
Host OpenWrt router, MHI/PCIe
AT access /dev/ttyUSB0 via option/qcserial kernel drivers

SIM & Network

  • Operator: China Mobile (MCC-MNC 460-00)
  • SIM type: Standard consumer SIM (personally registered, non-IoT)
  • 5G SA: n41, 100 MHz BW, RRC Connected, MM5G Registered Normal Service
  • LTE: B3/B34/B39/B40/B41 — all attach normally

Problem Description

SMS (both send and receive) works flawlessly on LTE (SELRAT=01), but completely fails on 5G SA.

Whether the RAT is set to Automatic (AT!SELRAT=00) or NR5G Only (AT!SELRAT=06), AT!GSTATUS? consistently shows:

IMS reg state:   NOT REGISTERED
IMS mode:        Normal
IMS Srv State:   UNKNOWN SMS, UNKNOWN VoIP

NSA/ENDC mode (AT!SELRAT=02) is not available on this firmware/PRI combination. The only available RAT options are:

00 = Automatic
01 = LTE Only
06 = NR5G Only

Troubleshooting Performed

All of the following were attempted — none resolved the issue:

# Approach Command(s) Result
1 SMS over NAS (SMSoNAS, 3GPP 24.501) AT+CGSMS=3 Acknowledged (OK), SMS still not received
2 SMS over PS / IMS AT+CGSMS=1 IMS never registers on SA
3 Phase 2+ SMS enablement AT+CSMS=1 Returns 1,1,1, no effect
4 Protocol stack full reset AT+CFUN=1 Module re-registers; IMS remains NOT REGISTERED
5 SMSoNAS shortcut toggle AT!CELLSMS=1 No effect
6 SMSC verification AT+CSCA? +8613800851500,145 — correct
7 SMS storage check AT+CPMS? Normal ("ME",0,255...)
8 SMS notification check AT+CNMI? Normal (2,1,0,0,0)
9 RAT switching SELRAT=00/01/06 01 (LTE) SMS works; 00/06 (SA) IMS NOT REGISTERED
10 CUSTOM option audit AT!CUSTOM=? No SMSoNAS/IMS/MMWave-related entries available

Questions

  1. Does SMSoNAS require any additional NV item or CUSTOM flag to be enabled on EM9190 with GENERIC PRI 030.115_000? If so, what are the specific parameters?

  2. Is there a way to force IMS registration on the 5G SA connection, or to re-enable NSA/ENDC mode so SMS can ride on the LTE anchor?

  3. Is simultaneous SA data + LTE IMS registration possible on the EM9190 (dual-registration or equivalent)? If not, what is the recommended configuration for a setup that needs both 5G data and reliable SMS delivery?


Any guidance would be greatly appreciated. Happy to provide additional AT!GSTATUS? / AT!IMAGE? / AT!BAND? output or QMI logs if needed.

if you want to set ENDC/LTE only, you can use the following commands:

AT+cfun=0
at!selrat=0
at!band=13,1,"CUSTOMER",1,0000A7E2BB0F38DF,0000000000000042
at!band=13,1,"CUSTOMER",3,000081A0090808D7,0000000000007042
at!band=13,1,"CUSTOMER",4,0000000000000000,0000000000000000
at!band=13
AT+cfun=1

Here my test shows that with LTE or ENDC, EM9191 can send SMS:

at!gstatus?
!GSTATUS:
Current Time:  1581             Temperature: 41

Reset Counter: 1                Mode:        ONLINE
System mode:   ENDC             PS state:    Attached
LTE band:      B7               LTE bw:      20 MHz
LTE Rx chan:   2850             LTE Tx chan: 20850
LTE SCC1 state:ACTIVE           LTE SCC1 band: B3
LTE SCC1 bw  : 10 MHz           LTE SCC1 Rx chan: 1850
LTE SCC1 UL Configured: FALSE   LTE SCC1 Tx chan: 0
LTE SCC2 state:ACTIVE           LTE SCC2 band: B3
LTE SCC2 bw  : 10 MHz           LTE SCC2 Rx chan: 1650
LTE SCC2 UL Configured: FALSE   LTE SCC2 Tx chan: 0
EMM state:     Registered       Normal Service
RRC state:     RRC Connected
IMS reg state: NOT REGISTERED   IMS mode:    Normal
IMS Srv State: UNKNOWN SMS,UNKNOWN VoIP

PCC Rx0 RSSI:  -83              PCC Rx0 RSRP:  -121
PCC Rx1 RSSI:  -54              PCC Rx1 RSRP:  -90
PCC Rx2 RSSI:  ---              PCC Rx2 RSRP:  ---
PCC Rx3 RSSI:  ---              PCC Rx3 RSRP:  ---
SCC1 Rx0 RSSI: -90              SCC1 Rx0 RSRP: -116
SCC1 Rx1 RSSI: -66              SCC1 Rx1 RSRP: -91
SCC1 Rx2 RSSI:  ---             SCC1 Rx2 RSRP:  ---
SCC1 Rx3 RSSI:  ---             SCC1 Rx3 RSRP:  ---
SCC2 Rx0 RSSI: -92              SCC2 Rx0 RSRP: -121
SCC2 Rx1 RSSI: -64              SCC2 Rx1 RSRP: -91
SCC2 Rx2 RSSI:  ---             SCC2 Rx2 RSRP:  ---
SCC2 Rx3 RSSI:  ---             SCC2 Rx3 RSRP:  ---
PCC Tx Power:  20               TAC:         9f62 (40802)
SCC1 Tx Power: ---
SCC2 Tx Power: ---
RSRQ (dB):     -16.4            Cell ID:     0188A953 (25733459)
SINR (dB):     -7.0
SCC1 NR5G band:       n78       SCC1 NR5G bw:         50 MHz
SCC1 NR5G Tx Power:   21        SCC1 NR5G Tx chan:    629000
SCC1 NR5G Rx chan:    629000
NR5G RSRP (dBm): -85            NR5G RSRQ (dB):  -12
NR5G SINR (dB):  17.5


OK
at+cmgs="1234567"
> asdfasdf

+CMGS: 15

OK
at!gstatus?
!GSTATUS:
Current Time:  1597             Temperature: 43

Reset Counter: 1                Mode:        ONLINE
System mode:   ENDC             PS state:    Attached
LTE band:      B7               LTE bw:      20 MHz
LTE Rx chan:   2850             LTE Tx chan: 20850
LTE SCC1 state:INACTIVE         LTE SCC1 band: B3
LTE SCC1 bw  : 10 MHz           LTE SCC1 Rx chan: 1850
LTE SCC1 UL Configured: FALSE   LTE SCC1 Tx chan: 0
LTE SCC2 state:INACTIVE         LTE SCC2 band: B3
LTE SCC2 bw  : 10 MHz           LTE SCC2 Rx chan: 1650
LTE SCC2 UL Configured: FALSE   LTE SCC2 Tx chan: 0
EMM state:     Registered       Normal Service
RRC state:     RRC Connected
IMS reg state: NOT REGISTERED   IMS mode:    Normal
IMS Srv State: UNKNOWN SMS,UNKNOWN VoIP

PCC Rx0 RSSI:  -85              PCC Rx0 RSRP:  -122
PCC Rx1 RSSI:  -56              PCC Rx1 RSRP:  -96
PCC Rx2 RSSI:  ---              PCC Rx2 RSRP:  ---
PCC Rx3 RSSI:  ---              PCC Rx3 RSRP:  ---
SCC1 Rx0 RSSI: -81              SCC1 Rx0 RSRP: -107
SCC1 Rx1 RSSI: -63              SCC1 Rx1 RSRP: -90
SCC1 Rx2 RSSI:  ---             SCC1 Rx2 RSRP:  ---
SCC1 Rx3 RSSI:  ---             SCC1 Rx3 RSRP:  ---
SCC2 Rx0 RSSI: -85              SCC2 Rx0 RSRP: -111
SCC2 Rx1 RSSI: -65              SCC2 Rx1 RSRP: -91
SCC2 Rx2 RSSI:  ---             SCC2 Rx2 RSRP:  ---
SCC2 Rx3 RSSI:  ---             SCC2 Rx3 RSRP:  ---
PCC Tx Power:  20               TAC:         9f62 (40802)
SCC1 Tx Power: ---
SCC2 Tx Power: ---
RSRQ (dB):     -18.5            Cell ID:     0188A953 (25733459)
SINR (dB):     -4.8
SCC1 NR5G band:       n78       SCC1 NR5G bw:         50 MHz
SCC1 NR5G Tx Power:   22        SCC1 NR5G Tx chan:    629000
SCC1 NR5G Rx chan:    629000
NR5G RSRP (dBm): -85            NR5G RSRQ (dB):  -12
NR5G SINR (dB):  17.5


OK
ati3
Manufacturer: Sierra Wireless, Incorporated
Model: EM9191
Revision: SWIX55C_03.17.04.00 0dd104 jenkins 2024/12/23 07:22:09
IMEI: 355890340712345
IMEI SV: 28
FSN: 78214751212345
+GCAP: +CGSM


OK
at!impref?
!IMPREF:
 preferred fw version:    03.17.04.00
 preferred carrier name:  GENERIC
 preferred config name:   GENERIC_030.112_000
 preferred subpri index:  000
 current fw version:      03.17.04.00
 current carrier name:    GENERIC
 current config name:     GENERIC_030.112_000
 current subpri index:    000

OK
at!selrat?
!SELRAT: 00, Automatic


OK
at!band?
Index, Name
13, CUSTOMER,
0 - GW:    0000000000000000
1 - LTE:   0000A7E2BB0F38DF 0000000000000042
3 - NRNSA: 000081A0090808D7 0000000000007042
4 - NRSA:  0000000000000000 0000000000000000

OK

Thanks for the detailed reply — really helpful.

I tried your band config on my EM9190 with China Mobile (MCC 460-00, n41). SMS over LTE now works, but the module only camps on LTE B41 (20 MHz, ~30 Mbps), never triggers ENDC to n41. It seems B41 is not configured for n41 EN-DC on China Mobile’s network here — they typically use B3 (1800 FDD) or B39 (1900 TDD) as the NR anchor for n41.

AT!BAND? after applying my config shows:

LTE:   0000A7E2BB0F38DF 0000000000000042
NRNSA: 000081A0090808D7 0000000000007042
NRSA:  0000000000000000 0000000000000000

Since my module always camps on B41 (strongest signal) and B41 doesn’t seem to anchor n41 EN-DC

you need to start some data traffic to push the module to ENDC mode.
e.g. Here i need to do the SMS testing together with youtube streaming.