No Root SSH ACCESS on WP7702 FX30

[Muammer.yildizer]

Hi,

I have tan issue on my WP7702, I can’t have Root SSH access on the FX30.

It gives me the error

(lsh:SWI-FX30-CATM) xxx@xxx:~/newWorkspace$ ssh root@192.168.2.2
ssh: connect to host 192.168.2.2 port 22: Connection refused

I can enter in AT!BOOTHOLD then have USB acces for re flash the firmwareWP77xx_Release15.1_SIERRA.spk

The reflash been with FTD2 on windows is successfull but same result -->refused access port 22
The reflash been with swiflash lasts longtime never finish.
(I updated the swiflash)
–>same result

I can also see on

AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
FW   1    EMPTY  0   0 0
FW   2    GOOD   2   0 0      ?_?         02.36.08.09_?
FW   3    GOOD   1   0 0      001.049_000 02.36.08.09_SIERRA
Max FW images: 3
Active FW image is at slot 2

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
PRI  FF   GOOD   0   0 0      001.067_005 02.36.06.00_ATT
PRI  FF   GOOD   0   0 0      001.079_000 02.36.08.09_GENERIC
PRI  FF   GOOD   0   0 0      001.049_000 02.36.08.09_SIERRA
PRI  FF   GOOD   0   0 0      001.059_001 02.36.08.01_TELSTRA
PRI  FF   GOOD   0   0 0      001.042_004 02.22.12.00_VERIZON
Max PRI images: 50

I also made hard reboot with 10s maintaining on reset on boot.
→ same result

I changed the dropbear file and I think the issu is due to that.
But when reflash the FW, we should have factory state and new default dropbear no?

Can someone help me or share the topic resolved please?

[jyijyi]

what is the return of AT!PARTITION=?

Are you able to downgrade to R11 and run swiflash to erase the userapp partition?

Swiflash -r broken with release 12 on wp77xx?

Hey, After a board issue (see topic https://forum.mangoh.io/t/cannot-access-mangoh-yellow-wp7702/4848/27) I think there is a problem with the swiflash command and its -r option for recovery mode. With fw R12, this tool doesn’t work, I had to downgrade to R11 to be able to use it. Thanks

[Muammer.yildizer]

Thanks for your reply,

AT!PARTITION=? Is not functioning gives ERROR.
but

AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
FW   1    EMPTY  0   0 0
FW   2    GOOD   2   0 0      ?_?         02.36.08.09_?
FW   3    GOOD   1   0 0      001.049_000 02.36.08.09_SIERRA
Max FW images: 3
Active FW image is at slot 2

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
PRI  FF   GOOD   0   0 0      001.067_005 02.36.06.00_ATT
PRI  FF   GOOD   0   0 0      001.079_000 02.36.08.09_GENERIC
PRI  FF   GOOD   0   0 0      001.049_000 02.36.08.09_SIERRA
PRI  FF   GOOD   0   0 0      001.059_001 02.36.08.01_TELSTRA
PRI  FF   GOOD   0   0 0      001.042_004 02.22.12.00_VERIZON
Max PRI images: 50

Yes I have done a downgrade to R11 and tried
swiflash -m "WP77XX" -r -f
stays hours at this state

(lsh:SWI-FX30-CATM) didier@ubuntu:~/newWorkspace$ swiflash -m "WP77XX" -r
Detecting USB of the target
DONE
Communicating with the target
DONE
Downloading the firmware
................................

[jyijyi]

For at!partition=? , you need to first enter at!entercnd=“A710”

After downgraded to r11, what is the return of ati3 and ati8?

[Muammer.yildizer]

AT!ENTERCND="A710"
OK
AT!PARTITION=?
To print partition table: AT!PARTITION?
To modify partition sizes: AT!PARTITION=<name>,<size0>[,<size1>,...]
  <name> - name of the first partition to modify its size, can be blank
  <size0> - new size in KB of the first partition
  <size1>,... - new sizes of next partitions
  for example: AT!PARTITION=0:boot,2560
  List of partitions whose size can be modified:

None/Not Allowed

OK
AT!PARTITION?
            PART    BLOCK     SIZE
            NAME   OFFSET     (KB)
           0:SBL 00000000     2560
         0:MIBIB 0000000A     2560
        0:BACKUP 00000014     6656
      0:SECURITY 0000002E     1024
       0:PERSIST 00000032     2048
          0:EFS2 0000003A    17920
       0:SWIFOTA 00000080    81152
            0:TZ 000001BD     1536
        0:DEVCFG 000001C3      768
           0:RPM 000001C6      768
         0:modem 000001C9    32768
         0:aboot 00000249     1024
          0:boot 0000024D    15360
        0:system 00000289    30720
       0:LEFWKRO 00000301     8960
         0:SWIRW 00000324    25600
       0:USERAPP 00000388   134144
      0:RESERVED 00000594    55808
        0:SLOT_2 0000066E    34304
        0:SLOT_1 000006F4    34304
        0:SLOT_0 0000077A    34304

OK

ATI3
Manufacturer: Sierra Wireless, Incorporated
Model: FX30(WP7702)
Revision: SWI9X06Y_02.36.08.09 c094f4 jenkins 2022/06/24 03:14:28
IMEI: 354723090964064
IMEI SV:  8
FSN: AT327275841010
+GCAP: +CGSM

ATI8
Legato Ver: 21.05.0.54b96444_0a6e18078edde5151619cb964564694d
Yocto Ver:  SWI9X06Y_03.00.13.00 2022-12-28_08:23:43
OS Ver: Linux version 4.14.253 (oe-user@oe-host) ( gcc version 9.3.0 (GCC), GNU ld (GNU Binutils) 2.34.0.20200220) #1 PREEMPT Wed Dec 28 07:40:21 UTC 2022
LK Ver: 1.3.0_1aea4d8ec8
RootFS Ver: SWI9X06Y_03.00.13.00 2022-12-28_08:23:43
UserFS Ver: unknown
MCU Ver: 002.015

OK

Is that ok?

[Muammer.yildizer]

As if the R11 is not flashed by FTD2 because I see :

at!fwd?ALVER
R15.1.0.004

But why swiflash can not flash it? I am up to date and removed reinstalled swiflash.

[jyijyi]

I think there is some anti-rollback mechanism to old firmware

[Muammer.yildizer]

I have that after flashed with FTD2:

AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
FW   1    GOOD   2   0 0      001.049_000 02.36.08.09_SIERRA
FW   2    GOOD   3   0 0      001.051_000 02.22.12.00_GENERIC
FW   3    EMPTY  0   0 0
Max FW images: 3
Active FW image is at slot 2

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
PRI  FF   GOOD   0   0 0      001.067_002 02.36.06.00_ATT
PRI  FF   GOOD   0   0 0      001.051_000 02.22.12.00_GENERIC
PRI  FF   GOOD   0   0 0      001.043_002 02.36.06.00_SIERRA
PRI  FF   GOOD   0   0 0      001.059_001 02.36.08.01_TELSTRA
PRI  FF   GOOD   0   0 0      001.042_003 02.22.12.00_VERIZON
Max PRI images: 50

OK

But swiflash still flash nothing

[jyijyi]

It says the active firmware is slot 2
Does it match with ati3 and ati8?

[Muammer.yildizer]

ATI3
Manufacturer: Sierra Wireless, Incorporated
Model: FX30(WP7702)
Revision: SWI9X06Y_02.22.12.00 eaf79c jenkins 2019/04/24 18:48:27
IMEI: 354723090964064
IMEI SV:  3
FSN: AT327275841010
+GCAP: +CGSM

OK
ATI8
Legato Ver: 21.05.0.54b96444_0a6e18078edde5151619cb964564694d
Yocto Ver:  SWI9X06Y_03.00.13.00 2022-12-28_08:23:43
OS Ver: Linux version 4.14.253 (oe-user@oe-host) ( gcc version 9.3.0 (GCC), GNU ld (GNU Binutils) 2.34.0.20200220) #1 PREEMPT Wed Dec 28 07:40:21 UTC 2022
LK Ver: 1.3.0_1aea4d8ec8
RootFS Ver: SWI9X06Y_03.00.13.00 2022-12-28_08:23:43
UserFS Ver: unknown
MCU Ver: 002.015

OK

[jyijyi]

the yocto linux and legato image have not been downgraded, so there is anti-rollback mechanism to go back to older firmware…

Can you do factory reset after flashing the latest firmware of fx30?

FX30 Factory Reset

After resetting the FX30 during boot using the reset button I am prompted for a new root password when connecting but it seems nothing else has changed. All my apps are still available and even start running. Changes to the root directory are also still present. It seems like the only update is the removal of the root password. I have updated the image on the FX30 to add some Python packages. The ‘AT!FWD?FACTORYRECOVERY’ command shows that factory recovery is enabled. Is there something else …

[Muammer.yildizer]

Here is the result after flash:

FDT version: 2.0.2012.0
Awaiting suitable port or adapter ...
Switching to streaming mode ...
Downloading images ...
Writing image C:\Users\MXY2106\Logiciels\FDTtool\Bin\x64\release\FX30_WP77xx_full_R15.1.0.004-sierra-SWI9X06Y_02.36.08.09.cwe /
Flashing image /
Enabling selective suspend ...
Awaiting adapter ...
Checking update status ...
Firmware image download succeeded.
Final Firmware update succeeded.

Preexisting images information:
        Current:
                Firmware:
                        ImageId:
                        BuildId:
                Configuration:
                        ImageId:
                        BuildId:
Final images information:
        Current:
                Firmware:
                        ImageId: 001.049_000
                        BuildId: 02.36.08.09_SIERRA
                Configuration:
                        ImageId: 001.049_000
                        BuildId: 02.36.08.09_SIERRA

OEM PRI: 9910239 001.002

IMEI: 354723090964064

Total time elapsed: 100594 ms.


Images downloaded:
        Image ID: 001.049_000
        Build ID: 02.36.08.09_SIERRA
                write time: 22656 ms
                additional flash time: 17969 ms

Time to reset to application mode: 55188 ms.

Press Enter to continue ...

ATI3
Manufacturer: Sierra Wireless, Incorporated
Model: FX30(WP7702)
Revision: SWI9X06Y_02.36.08.09 c094f4 jenkins 2022/06/24 03:14:28
IMEI: 354723090964064
IMEI SV:  8
FSN: AT327275841010
+GCAP: +CGSM

OK
ATI8
Legato Ver: 21.05.0.54b96444_0a6e18078edde5151619cb964564694d
Yocto Ver:  SWI9X06Y_03.00.13.00 2022-12-28_08:23:43
OS Ver: Linux version 4.14.253 (oe-user@oe-host) ( gcc version 9.3.0 (GCC), GNU ld (GNU Binutils) 2.34.0.20200220) #1 PREEMPT Wed Dec 28 07:40:21 UTC 2022
LK Ver: 1.3.0_1aea4d8ec8
RootFS Ver: SWI9X06Y_03.00.13.00 2022-12-28_08:23:43
UserFS Ver: unknown
MCU Ver: 002.015

OK

AT!FWD?FACTORYRECOVERY
ENABLED

After factory reset the access is not refused but unreachable now

xxx@xxx:~/myWorkspace$ ssh root@192.168.2.2
ssh: connect to host 192.168.2.2 port 22: Network is unreachable

[jyijyi]

what do you see in dmesg?
Is there any ECM interface enumerated?

BTW, does you FX30 have UART interface for the linux console control?

[Muammer.yildizer]

Do you mean for ECM:

didier@ubuntu~/newWorkspace$ ifconfig
enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.3  netmask 255.255.255.0  broadcast 192.168.2.255

For UART also yes:

didier@ubuntu:~/newWorkspace$ dmesg | grep tty
[    0.004000] console [tty0] enabled
[    3.797607] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0
[    3.800742] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB1
[    3.804600] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB2
didier@ubuntu:~/newWorkspace$ screen /dev/ttyUSB0 115200
[screen is terminating]

Sorry last information about access not unreachable but still refused

didier@ubuntu:~/newWorkspace$ ssh root@192.168.2.2
ssh: connect to host 192.168.2.2 port 22: Connection refused

[jyijyi]

How many modules are seeing this issue?

I think there are three possible solutions:

1. contact Sierra FAE to get a tool to enable AT!PARTITION so that you can change the partition size of userapp patition and format this partition.
2. if just happening to one particular module, ask the Sierra FAE to level-3 unlock the module and enable the AT!PARTITION command for you.
3. write an unsandboxed legato application to format the userapp partition like this:

Swiflash -r broken with release 12 on wp77xx?

According to the release note of fw r12, QTI9X07-2870 is to fix userapp partition being erased which is security hole. You might also try the following without downgrading to older version: (Be careful of the mtd number, different FW might have different mtd number for userapp partition !!! ) root@swi-mdm9x28-wp:~# cat /proc/mtd|grep userapp -i mtd16: 08300000 00040000 "userapp" root@swi-mdm9x28-wp:~# pwd /home/root root@swi-mdm9x28-wp:~# ls UART_Test1.wp77xx.update root@swi-mdm9x28-wp:~# fl…

If you cannot download the legato application to the module due to SSH problem, you might need to upload the application to AVMS and ask module to connect to it by AT+WDSS=1,1 command.

BTW, you can also run wireshark on linux PC to see why there is connection refuse.
Here says shutting down the firewall on module side can help:

"ssh: connect to host 192.168.2.2 port 22: Connection refused"

Hi, i am trying to upgrade the firmware but could not make, and shows a connection error “ssh: connect to host 192.168.2.2 port 22: Connection refused” [Capture11] I restarted, pressed the reset button and i can ping but refuse connections. Could someone help me?

[Muammer.yildizer]

Hi,

I have 2 modules seeing this issue.

Thanks for your proposals, I’m now in contact with Sierra FAE, I’ll let you know on progress if we find a solution.

Here is the wireshark

Thanks a lot again.

[jyijyi]

It is quite strange that if it rejects the TCP connection…

you might also try if other port can be used for ssh:

owner@ubuntu:~$ sudo nmap -T4 -sT -p T:1-65535 192.168.2.2

Starting Nmap 7.60 ( https://nmap.org ) at 2025-04-17 18:07 CST
Nmap scan report for 192.168.2.2
Host is up (0.0026s latency).
Not shown: 65534 filtered ports
PORT   STATE SERVICE
22/tcp open  ssh

[Muammer.yildizer]

In my case :

didier@ubuntu:~/newWorkspace$ sudo nmap -T4 -sT -p T:1-65535 192.168.2.2

Starting Nmap 7.60 ( https://nmap.org ) at 2025-04-17 13:33 CEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 1.55 seconds

[jyijyi]

is it ok to ping this address by “ping 192.168.2.2”?

[Muammer.yildizer]

Yes no problem on ping port 22 on 192.168.2.2

I just had a message from FAE that they will provide the key to unlock level 3 so as to recover just for 2 products.

I ll keep you updated.