Bug 234578 - Support for Sierra Wireless EM7455 modem
Summary: Support for Sierra Wireless EM7455 modem
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: usb (show other bugs)
Version: CURRENT
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-usb (Nobody)
Keywords: easy, feature, needs-qa, patch
Depends on:
Reported: 2019-01-02 18:57 UTC by Oleksandr Kryvulia
Modified: 2023-08-03 23:42 UTC (History)
13 users (show)

See Also:
koobs: mfc-stable12?
koobs: mfc-stable11?

patch to add product id (997 bytes, patch)
2019-01-02 18:57 UTC, Oleksandr Kryvulia
no flags Details | Diff
FCC_auth disabled carrier config (411 bytes, application/zip)
2019-01-04 20:23 UTC, Oleksandr Kryvulia
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Oleksandr Kryvulia 2019-01-02 18:57:20 UTC
Created attachment 200722 [details]
patch to add product id

Adds new product id to support Sierra Wireless EM7455 modem by u3g kernel module. Tested on Lenovo Thinkpad T470p. Please note, because of lack of support QMI protocol by default device is in Low Power Mode, so it need special nvu-file which sends FCC_AUTH=0 to modem. On Linux it can be done by qmicli --dms-set-fcc-authentication command.

root@thinkpad:/usr/src # usbconfig -d 0.3 dump_device_desc
ugen0.3: <Sierra Wireless, Incorporated Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A> at, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (500mA)

  bLength = 0x0012 
  bDescriptorType = 0x0001 
  bcdUSB = 0x0200 
  bDeviceClass = 0x0000  <Probed by interface class>
  bDeviceSubClass = 0x0000 
  bDeviceProtocol = 0x0000 
  bMaxPacketSize0 = 0x0040 
  idVendor = 0x1199 
  idProduct = 0x9079 
  bcdDevice = 0x0006 
  iManufacturer = 0x0001  <Sierra Wireless, Incorporated>
  iProduct = 0x0002  <Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A>
  iSerialNumber = 0x0003  <LF75061727011022>
  bNumConfigurations = 0x0001
Comment 1 Ed Maste freebsd_committer freebsd_triage 2019-01-04 17:32:56 UTC
> need special nvu-file which sends FCC_AUTH=0 to modem

Can you expand on this note (i.e., how to obtain or create the nvu-file)
Comment 2 Oleksandr Kryvulia 2019-01-04 20:23:39 UTC
Created attachment 200778 [details]
FCC_auth disabled carrier config
Comment 3 Oleksandr Kryvulia 2019-01-04 20:24:43 UTC
I didn't find a way to disable LPM vi AT-commands and found special nvu-file on russian-speaking technical forum[1] and upload it with new GENERIC firmware[2] to modem using qmi-firmware-update from Ubuntu Live USB.

[1] http://forum.ixbt.com/post.cgi?id=print:17:53544&page=9
[2] https://source.sierrawireless.com/resources/airprime/minicard/74xx/airprime-em_mc74xx-approved-fw-packages/
Comment 4 dean 2019-12-16 23:11:02 UTC
This python script automates the engineering challenge response via AT commands for many S.W. devices


Having entered engineering mode, you can use cu or similar to connect to the usb serial of the device and issue these commands


The S.W. device will reset and the FCC low power mode will remain disabled forever after.

Observe with:


Further, this at command will list the available usb modes for the device


As far as i can tell the QMI, RMNET and MBIM protocols arent supported in freebsd so ppp via the USB serial port is the only option. Which is available in the 6,7 and 8 modes.


The above can be manipulated in QMI only mode with the script https://git.mork.no/wwan.git/plain/scripts/swi_setusbcomp.pl - which you will need to run on linux. But once AT commands are exposed via usb serial devices you can plug on to BSD.

The above is taken from my personal notes on S.W. devices. There is a lot of arcane magic involved, as you can flash vendor badged devices to generic SW firmware, change their usb VID and PID so that freebsd recognizes it etc. But once you have a generic firmware presenting as a generic USB device - youre in business with the above.

I would be delighted to be proven wrong that QMI, RMNET and MBIM arent supported.
Comment 5 Tomasz "CeDeROM" CEDRO 2020-04-19 23:03:27 UTC
I have Sierra EM7305 on Panasonic Toughbook CF-MX4 and the same problem - the VID/PID is known but the modem is not operational, it needs some additional setup.

In older laptop Panasonic Toughbook CF-C2 also I had Sierra WWAN modem with the same problem. There I have replaced it with another device that was working out of the box.

I know Frank Harvey (dvwerks@cox.net) is Sierra expert and offered help in solving the problem on the forum nickname phishfry. Maybe we could write a simple libusb based application that would switch these modems into operational state for FreeBSD :-)
Comment 6 Hans Petter Selasky freebsd_committer freebsd_triage 2020-04-20 07:09:18 UTC
There is modeswitch in the ports, but it is better when the kernel handles it.

Comment 7 Qingjun Wei 2020-09-15 14:09:55 UTC
Is there any progress?
I am a user of OpnSense. And it appears EM7455 is the only LTE card I can use in US.
Comment 8 Tomasz "CeDeROM" CEDRO 2020-09-15 21:46:18 UTC
Not on my side, sorry, eaten up by some other tasks, will get into it maybe in two months, also would like to have it working on my laptop :-)

I can see two problems to solve:
1. Modeswitch so modem works in a way that FreeBSD can make use of. Either userland libusb based or Kernel mode?
2. Device firmwares / binary configs needs to be provided in order to get it into a state that FreeBSD can make use of. Can we provide such binaries with system or as a Port?
Comment 9 Qingjun Wei 2020-09-16 00:16:06 UTC
Appreciate your feedback.
I think there are two separated problems. 
BSD certainly will have to provide a modeswitch utility.
As for the firmware, it should be user's responsibility. As long as there are utilities to flash firmware on any platform, it should ne sufficient.
Comment 10 Aleks Michajlow 2021-05-31 09:06:20 UTC
I have Sierra Wireless EM7345 4G LTE and i have the same probleme.
I can not get IP-adress to ue0 device, becouse it is in Low Power Mode.

# lsusb -d  1199:a001
Bus /dev/usb Device /dev/ugen0.4: ID 1199:a001 Sierra Wireless, Inc. 

# usbconfig -d 0.4 dump_device_desc
ugen0.4: <Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE> at usbus0, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (100mA)

  bLength = 0x0012 
  bDescriptorType = 0x0001 
  bcdUSB = 0x0200 
  bDeviceClass = 0x00ef  <Miscellaneous device>
  bDeviceSubClass = 0x0002 
  bDeviceProtocol = 0x0001 
  bMaxPacketSize0 = 0x0040 
  idVendor = 0x1199 
  idProduct = 0xa001 
  bcdDevice = 0x1729 
  iManufacturer = 0x0001  <Sierra Wireless Inc.>
  iProduct = 0x0002  <Sierra Wireless EM7345 4G LTE>
  iSerialNumber = 0x0003  <013937009553015>
  bNumConfigurations = 0x0001 

This device working good in Linux and OpenBSD
Comment 11 Maurice J Niessen 2021-09-16 07:35:33 UTC
As Qingjun Wei already mentioned, you are discussing different issues here and you are losing focus...

The device 1199:9079 is not handled by u3g.ko to give us support (like /dev/ttyU*, /dev/cuaU*) for sending AT commands to it. AFAIK other methods like MBIM, QMI and RMNET* aren’t supported in FreeBSD at all.

Sending “magic packets” to specific OEM versions of 1199:9079 (and yes, mine says “customer: lenovo-laptop” as well) to overcome the “low power mode (LPM)/ FCC AUTH” issue is something else. BUT for the “magic” of a challenge/response authentication and setting FCC AUTH=0, it’s necessary to send AT commands to our lovely 1199:9079.
Dean already mentioned the “description” in form of a python script how to do that “magic”. Within the years, the link has changed. It can be found here now:


Patching the firmware of 1199:9079 with a black-boxed nvu-file from a Russian-speaking technical forum nvu-file to make it less specific, is something that I would neither do, nor recommend. This might be a workaround, but like Ed Maste I want to know how to reproduce the nvu-file/fixes on my own - generally. I love the fact, that my 1199:9079 is not able to produce high power signals (or even signals at all, so that ue0 gets an IP address for example) without “permission”. Sure… it’s more an annoying “feature”, but much more important it’s not a bug of FreeBSD and nothing which needs to be discussed in this topic/thread here (no offense).

Yes, I know how to patch and build my own kernel… BUT you are speaking of a single line of “code” (more harmless definitions than real code) in two files for years now. I would love to see those lines within FreeBSD 13 sources in the nearer future.
Comment 12 mike 2021-09-16 14:54:20 UTC
(In reply to dean from comment #4)

This is how we use them as well.  We convert them on a linux box to use serial and then use PPP on FreeBSD over /dev/cuaU0.2.  They are pretty solid in the field (in Canada on Rogers, Bell and Telus) and give pretty close to expected speeds. Sierra is pretty good about giving firmware out. You just register on their website, and you can download the necessary firmware blobs.  But in North America, I find they work out of the box so to speak. 

Manufacturer: Sierra Wireless, Incorporated
Model: MC7455
Revision: SWI9X30C_02.08.02.00 r5428 CARMD-EV-FRMWR2 2016/01/06 20:38:53
MEID: xxxx
IMEI: xxxx
FSN: LQ71xxxx

Current Time:  498659           Temperature: 33
Reset Counter: 2                Mode:        ONLINE         
System mode:   LTE              PS state:    Attached     
LTE band:      B2               LTE bw:      15 MHz  
LTE Rx chan:   675              LTE Tx chan: 18675
EMM state:     Registered       Normal Service 
RRC state:     RRC Idle       
IMS reg state: No Srv  

PCC RxM RSSI:  -71              RSRP (dBm):  -100
PCC RxD RSSI:  -94              RSRP (dBm):  -138
Tx Power:      0                TAC:         73A0 (29600)
RSRQ (dB):     -11.7            Cell ID:     008BE916 (9169174)
SINR (dB):     19.0

+csq: 21,99
Comment 13 Tomasz "CeDeROM" CEDRO 2021-09-16 15:12:30 UTC
Would be perfect to be able to "convert" them directly on FreeBSD :-)

Can you please provide some instructions Mike? 

Do you use `usb_modeswitch` for conversion? I could not make it work with `usb_modeswitch`. If other I would like to port that configuration tool.. in perfect world I would see a Python module :-)
Comment 14 mike 2021-09-16 15:18:20 UTC
(In reply to Tomasz "CeDeROM" CEDRO from comment #13)

On Linux, we do 
you might need to install the necessary perl libs

   apt-get install build-essential
   apt-get install libuuid-tiny-perl libipc-shareable-perl libjson-perl
   /tmp/swi_setusbcomp.pl --device=/dev/cdc-wdm0 --usbcomp=19

Note, its not always 19. Run the command above and it will list the current mode as well as supported modes. Sometimes the target value is 6. e.g in this example, we re-ran it with usbcomp=6 to pick the right mode (qmi)

root@ali-u21-6port:/usr/bin# swi_setusbcomp.pl --device=/dev/cdc-wdm0 --usbcomp=6
Running in MBIM mode (driver=cdc_mbim)
MBIM OPEN succeeded
QMI msg '0x0021' returned status = 1
MBIM QMI support verified
supports 17 QMI subsystems:
  0x00 (1.5)    'QMI_CTL'       - Control service
  0x01 (1.12)   'QMI_WDS'       - Wireless data service
  0x02 (1.7)    'QMI_DMS'       - Device management service
  0x03 (1.21)   'QMI_NAS'       - Network access service
  0x04 (1.3)    'QMI_QOS'       - Quality of service, err, service 
  0x05 (1.4)    'QMI_WMS'       - Wireless messaging service
  0x06 (1.10)   'QMI_PDS'       - Position determination service
  0x07 (1.1)    'QMI_AUTH'      - Authentication service
  0x08 (1.1)    'QMI_AT'        - AT command processor service
  0x09 (2.1)    'QMI_VOICE'     - Voice service
  0x0a (2.0)    'QMI_CAT2'      - Card application toolkit service (new)
  0x0b (1.4)    'QMI_UIM'       - UIM service
  0x0c (1.4)    'QMI_PBM'       - Phonebook service
  0x11 (1.0)    'QMI_SAR'       - Specific absorption rate service
  0x1a (1.0)    'QMI_WDA'       - Wireless data administrative service
  0xe0 (2.0)    'QMI_CAT'       - Card application toolkit service
  0xe1 (1.0)    'QMI_RMS'       - Remote management service
QMI msg '0x0022' returned status = 1
Got QMI DMS client ID '4'
QMI msg '0x555b' returned status = 1
Current USB composition: 14
USB compositions:
   0 - HIP  DM    NMEA  AT    MDM1  MDM2  MDM3  MS      NOT SUPPORTED
   1 - HIP  DM    NMEA  AT    MDM1  MS                  NOT SUPPORTED
   2 - HIP  DM    NMEA  AT    NIC1  MS                  NOT SUPPORTED
   3 - HIP  DM    NMEA  AT    MDM1  NIC1  MS            NOT SUPPORTED
   4 - HIP  DM    NMEA  AT    NIC1  NIC2  NIC3  MS      NOT SUPPORTED
   5 - HIP  DM    NMEA  AT    ECM1  MS                  NOT SUPPORTED
   6 - DM   NMEA  AT    QMI                             SUPPORTED
   7 - DM   NMEA  AT    RMNET1 RMNET2 RMNET3            SUPPORTED
   8 - DM   NMEA  AT    MBIM                            SUPPORTED
   9 - MBIM                                             SUPPORTED
  10 - NMEA MBIM                                        SUPPORTED
  11 - DM   MBIM                                        SUPPORTED
  12 - DM   NMEA  MBIM                                  SUPPORTED
  13 - Config1: comp6    Config2: comp8                 SUPPORTED
* 14 - Config1: comp6    Config2: comp9                 SUPPORTED
  15 - Config1: comp6    Config2: comp10                SUPPORTED
  16 - Config1: comp6    Config2: comp11                SUPPORTED
  17 - Config1: comp6    Config2: comp12                SUPPORTED
  18 - Config1: comp7    Config2: comp8                 SUPPORTED
  19 - Config1: comp7    Config2: comp9                 SUPPORTED
  20 - Config1: comp7    Config2: comp10                SUPPORTED
  21 - Config1: comp7    Config2: comp11                SUPPORTED
  22 - Config1: comp7    Config2: comp12                SUPPORTED
QMI msg '0x555c' returned status = 1
QMI msg '0x0023' returned status = 1
Then reboot the modem (disconnect / reconnect). If you see ttyUSB3, you should be good to go.

root@virtbox1b:/dev# miniterm 

--- Available ports:
---  1: /dev/ttyS0           'ttyS0'
---  2: /dev/ttyS1           'ttyS1'
---  3: /dev/ttyUSB0         'MC7700'
---  4: /dev/ttyUSB1         'MC7700'
---  5: /dev/ttyUSB2         'MC7700'
--- Enter port index or full name: 5
--- Miniterm on /dev/ttyUSB2  9600,8,N,1 ---
--- Quit: Ctrl+] | Menu: Ctrl+T | Help: Ctrl+T followed by Ctrl+H ---
Manufacturer: Sierra Wireless, Incorporated
Model: MC7700
Revision: SWI9200X_03.05.29.03ap r6485 CNSHZ-ED-XP0031 2014/12/02 17:53:15
IMEI: 012626001461340
FSN: CDC2793208110
3GPP Release 8

&C: 1; &D: 2; &E: 0; &F: 0; &S: 0; &W: 0; E: 1; L: 0; M: 0; Q: 0; V: 1;
X: 1; Z: 0; \Q: 3; \S: 0; \V: 0; O: 0; S0: 0; S2: 43; S3: 13; S4: 10;
S5: 8; S6: 2; S7: 0; S8: 2; S9: 6; S10: 14; S11: 95; S30: 0; S103: 1;
S104: 1; +FCLASS: 0; +ICF: 3,3; +IFC: 2,2; +IPR: 115200; +DR: 0;
+DS: 0,0,2048,6; +CMEE: 2; +WS46: 12; +CFUN:; +CBST: 0,0,1;
+CRLP: (61,61,48,6,0),(61,61,48,6,1),(240,240,52,6,2);
+CV120: 1,1,1,0,0,0; +CHSN: 0,0,0,0; +CSSN: 0,0; +CREG: 0; +CGREG: 0;
+CEREG: 0; +CSCS: "IRA"; +CSTA: 129; +CR: 0; +CRC: 0; 
+CGDCONT: (1,"IP","fast.t-mobile.com","",0,0),(2,"IP","wap.cingular","",0,0);
+CSMS: 0; +CMGF: 0; +CSAS: 0; +CRES: 0; +CSCA: "",; +CSMP: ,,0,0;
+CSDH: 0; +CSCB: 0,"",""; +FDD: 0; +FAR: 0; +FCL: 0; +FIT: 0,0; +ES: ,,;
+ESA: 0,,,,0,0,255,; +CMOD: 0; +CEMODE: 3; +CVHU: 0;
+CPIN: ��������,��������; +CMEC: 0,0,0,0; +CIND: 0,0,0,0,0,0,0,0;
+CMER: 0,0,0,0,0; +CGATT: 0;  +CGACT: 0; +CPBS: "SM";
+CPMS: "SM","SM","SM"; +CNMI: 0,0,0,0,0; +CMMS: 0; +FTS: 0; +FRS: 0;
+FTH: 3; +FRH: 3; +FTM: 96; +FRM: 96; +CCUG: 0,0,0; +COPS: 0,0,"";
+CUSD: 0; +CAOC: 1; +CCWA: 0; +CCLK: ""; +CPOL: 0,2,"",0,0,0,0; +CPLS: 0;
+CTZR: 0; +CTZU: 0; +CLIP: 0; +COLP: 0; +CDIP: 0; +CLIR: 0;
+CMUX: 0,0,5,31,10,3,30,10,2; !CMUX: 0,0,5,31,10,3,30,10,2



--- exit ---
You should now see an extra serial port, and when you attach the device to FreeBSD, it will attach as u3g and you should see the familiar /dev/cuaU0.x ports to use.

root@virtbox1b:/dev# ls -lat | head
total 4
crw-rw-rw-  1 root tty       5,   2 Oct 10 14:04 ptmx
drwxr-xr-x 21 root root        4400 Oct 10 14:04 .
drwxr-xr-x  2 root root        4120 Oct 10 14:04 char
drwxr-xr-x  4 root root          80 Oct 10 14:04 serial
crw-rw----  1 root dialout 188,   0 Oct 10 14:04 ttyUSB0
crw-rw----  1 root dialout 188,   1 Oct 10 14:04 ttyUSB1
crw-rw----  1 root dialout 188,   2 Oct 10 14:04 ttyUSB2
crw-rw----  1 root dialout 188,   3 Oct 10 14:04 ttyUSB3
crw-rw----  1 root dialout 188,   4 Oct 10 14:04 ttyUSB4
root@virtbox1b:/dev# ls -lat | head
total 4
crw-rw-rw-  1 root tty       5,   2 Oct 10 14:04 ptmx
drwxr-xr-x 21 root root        4400 Oct 10 14:04 .
drwxr-xr-x  2 root root        4120 Oct 10 14:04 char
drwxr-xr-x  4 root root          80 Oct 10 14:04 serial
crw-rw----  1 root dialout 188,   0 Oct 10 14:04 ttyUSB0
crw-rw----  1 root dialout 188,   1 Oct 10 14:04 ttyUSB1
crw-rw----  1 root dialout 188,   2 Oct 10 14:04 ttyUSB2
crw-rw----  1 root dialout 188,   3 Oct 10 14:04 ttyUSB3
crw-rw----  1 root dialout 188,   4 Oct 10 14:04 ttyUSB4

root@virtbox1b:/dev# lsusb 
Bus 003 Device 025: ID 1199:68a3 Sierra Wireless, Inc. MC8700 Modem
Comment 15 Tomasz "CeDeROM" CEDRO 2021-09-16 15:28:55 UTC
Thank you Mike! I plan to get into this around next month :-)
Comment 16 malavon 2022-05-01 12:46:18 UTC
I have created a new bug that adds support for this modem and several others of the same family. Dell versions are supported as well.
See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263700

No need to talk about custom firmwares over there.

I'd like to ask a mod to link both bugs and maybe remove the attachment on this one. I'm not sure the FreeBSD project should be hosting a cracked firmware.  There is some really good documentation in this bug so please don't remove the bug entirely.
Comment 17 Tomasz "CeDeROM" CEDRO 2022-05-08 23:40:48 UTC
Hey there Malavon :-)

At first I am sorry it takes long time and I did not get into problem "next month" as advertised :-( I have switched to a different computer and this problem is not critical for me anymore. I still have and occasionally use the laptop so it would be nice to make that modem work (I still have working SIM card inside) :-)

The problem here in fact is not the USB VID:PID because my modem is already on the list. It is good that you have added new VID:PID pairs for new devices. But that will not solve the problem.

The problem is that modern modems can work in several different communication modes with the host computer (i.e. AT, Ethernet). In order for Sierra to work with FreeBSD it needs to be switched to a supported mode using usb_modeswitch utility (it is already in the ports).

Special commands needs to be sent to the modem as raw USB packets to switch it to a mode that will allow operations on FreeBSD.

1. We need to figure out what modes are supported by modem.
2. What mode is required by FreeBSD to work with the modem.
3. What are the commands (USB packets) that needs to be sent to the modem to switch it to correct mode.
4. Patch usb_modeswitch with these commands for that modem.
5. If any additional modem firmware is necessary it usually can be found on the vendor website and/or in the windows drivers.

From what I remember Sierra has pretty good documentation on their website. Firmware may be also there. You need to register to access it. There was one nice guy working in Sierra that was using FreeBSD and gave me some hints. I am sure that he can help us getting things done :-)
Comment 18 Tomasz "CeDeROM" CEDRO 2022-05-08 23:48:29 UTC
Technical specifications and firmware files are here:
Comment 19 Tomasz "CeDeROM" CEDRO 2022-05-09 00:41:18 UTC
If I am not mistaken Sierra now provides full documentation and source codes for driver development on Linux.

Also Mike provided some working examples that may be a good hint too :-)
Comment 20 malavon 2022-05-16 20:57:25 UTC
Hi Tomasz,

apparently I'm not subscribed to this issue so I just happened to see this now. The issue here is two-fold, it is correct that the right mode needs to be set. But there are workarounds for that - using a Linux live CD or probably a VM too, as explained here and in many places on the web.

However in my case  the VIDs aren't there, so I can't use it no matter the mode the modem is in. It'd be nice to switch modes using FreeBSD, but not critical. It's a one-time thing anyway. However, if the kernel doesn't know what driver to add to the modem, nothing is going to happen.

So that's just why I've created the other bug, to add the necessary VIDs and have the modems that are in the right mode working on FreeBSD as well. I hope it gets merged soon, would be nice to have it in FreeBSD 13.2.