Bug 234578 - Support for Sierra Wireless EM7455 modem
Summary: Support for Sierra Wireless EM7455 modem
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: usb (show other bugs)
Version: CURRENT
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-usb (Nobody)
Keywords: easy, feature, needs-qa, patch
Depends on:
Reported: 2019-01-02 18:57 UTC by Oleksandr Kryvulia
Modified: 2021-10-12 17:21 UTC (History)
9 users (show)

See Also:
koobs: mfc-stable12?
koobs: mfc-stable11?

patch to add product id (997 bytes, patch)
2019-01-02 18:57 UTC, Oleksandr Kryvulia
no flags Details | Diff
FCC_auth disabled carrier config (411 bytes, application/zip)
2019-01-04 20:23 UTC, Oleksandr Kryvulia
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Oleksandr Kryvulia 2019-01-02 18:57:20 UTC
Created attachment 200722 [details]
patch to add product id

Adds new product id to support Sierra Wireless EM7455 modem by u3g kernel module. Tested on Lenovo Thinkpad T470p. Please note, because of lack of support QMI protocol by default device is in Low Power Mode, so it need special nvu-file which sends FCC_AUTH=0 to modem. On Linux it can be done by qmicli --dms-set-fcc-authentication command.

root@thinkpad:/usr/src # usbconfig -d 0.3 dump_device_desc
ugen0.3: <Sierra Wireless, Incorporated Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A> at, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (500mA)

  bLength = 0x0012 
  bDescriptorType = 0x0001 
  bcdUSB = 0x0200 
  bDeviceClass = 0x0000  <Probed by interface class>
  bDeviceSubClass = 0x0000 
  bDeviceProtocol = 0x0000 
  bMaxPacketSize0 = 0x0040 
  idVendor = 0x1199 
  idProduct = 0x9079 
  bcdDevice = 0x0006 
  iManufacturer = 0x0001  <Sierra Wireless, Incorporated>
  iProduct = 0x0002  <Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A>
  iSerialNumber = 0x0003  <LF75061727011022>
  bNumConfigurations = 0x0001
Comment 1 Ed Maste freebsd_committer 2019-01-04 17:32:56 UTC
> need special nvu-file which sends FCC_AUTH=0 to modem

Can you expand on this note (i.e., how to obtain or create the nvu-file)
Comment 2 Oleksandr Kryvulia 2019-01-04 20:23:39 UTC
Created attachment 200778 [details]
FCC_auth disabled carrier config
Comment 3 Oleksandr Kryvulia 2019-01-04 20:24:43 UTC
I didn't find a way to disable LPM vi AT-commands and found special nvu-file on russian-speaking technical forum[1] and upload it with new GENERIC firmware[2] to modem using qmi-firmware-update from Ubuntu Live USB.

[1] http://forum.ixbt.com/post.cgi?id=print:17:53544&page=9
[2] https://source.sierrawireless.com/resources/airprime/minicard/74xx/airprime-em_mc74xx-approved-fw-packages/
Comment 4 dean 2019-12-16 23:11:02 UTC
This python script automates the engineering challenge response via AT commands for many S.W. devices


Having entered engineering mode, you can use cu or similar to connect to the usb serial of the device and issue these commands


The S.W. device will reset and the FCC low power mode will remain disabled forever after.

Observe with:


Further, this at command will list the available usb modes for the device


As far as i can tell the QMI, RMNET and MBIM protocols arent supported in freebsd so ppp via the USB serial port is the only option. Which is available in the 6,7 and 8 modes.


The above can be manipulated in QMI only mode with the script https://git.mork.no/wwan.git/plain/scripts/swi_setusbcomp.pl - which you will need to run on linux. But once AT commands are exposed via usb serial devices you can plug on to BSD.

The above is taken from my personal notes on S.W. devices. There is a lot of arcane magic involved, as you can flash vendor badged devices to generic SW firmware, change their usb VID and PID so that freebsd recognizes it etc. But once you have a generic firmware presenting as a generic USB device - youre in business with the above.

I would be delighted to be proven wrong that QMI, RMNET and MBIM arent supported.
Comment 5 Tomasz "CeDeROM" CEDRO 2020-04-19 23:03:27 UTC
I have Sierra EM7305 on Panasonic Toughbook CF-MX4 and the same problem - the VID/PID is known but the modem is not operational, it needs some additional setup.

In older laptop Panasonic Toughbook CF-C2 also I had Sierra WWAN modem with the same problem. There I have replaced it with another device that was working out of the box.

I know Frank Harvey (dvwerks@cox.net) is Sierra expert and offered help in solving the problem on the forum nickname phishfry. Maybe we could write a simple libusb based application that would switch these modems into operational state for FreeBSD :-)
Comment 6 Hans Petter Selasky freebsd_committer 2020-04-20 07:09:18 UTC
There is modeswitch in the ports, but it is better when the kernel handles it.

Comment 7 Qingjun Wei 2020-09-15 14:09:55 UTC
Is there any progress?
I am a user of OpnSense. And it appears EM7455 is the only LTE card I can use in US.
Comment 8 Tomasz "CeDeROM" CEDRO 2020-09-15 21:46:18 UTC
Not on my side, sorry, eaten up by some other tasks, will get into it maybe in two months, also would like to have it working on my laptop :-)

I can see two problems to solve:
1. Modeswitch so modem works in a way that FreeBSD can make use of. Either userland libusb based or Kernel mode?
2. Device firmwares / binary configs needs to be provided in order to get it into a state that FreeBSD can make use of. Can we provide such binaries with system or as a Port?
Comment 9 Qingjun Wei 2020-09-16 00:16:06 UTC
Appreciate your feedback.
I think there are two separated problems. 
BSD certainly will have to provide a modeswitch utility.
As for the firmware, it should be user's responsibility. As long as there are utilities to flash firmware on any platform, it should ne sufficient.
Comment 10 Aleks Michajlow 2021-05-31 09:06:20 UTC
I have Sierra Wireless EM7345 4G LTE and i have the same probleme.
I can not get IP-adress to ue0 device, becouse it is in Low Power Mode.

# lsusb -d  1199:a001
Bus /dev/usb Device /dev/ugen0.4: ID 1199:a001 Sierra Wireless, Inc. 

# usbconfig -d 0.4 dump_device_desc
ugen0.4: <Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE> at usbus0, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (100mA)

  bLength = 0x0012 
  bDescriptorType = 0x0001 
  bcdUSB = 0x0200 
  bDeviceClass = 0x00ef  <Miscellaneous device>
  bDeviceSubClass = 0x0002 
  bDeviceProtocol = 0x0001 
  bMaxPacketSize0 = 0x0040 
  idVendor = 0x1199 
  idProduct = 0xa001 
  bcdDevice = 0x1729 
  iManufacturer = 0x0001  <Sierra Wireless Inc.>
  iProduct = 0x0002  <Sierra Wireless EM7345 4G LTE>
  iSerialNumber = 0x0003  <013937009553015>
  bNumConfigurations = 0x0001 

This device working good in Linux and OpenBSD
Comment 11 Maurice J Niessen 2021-09-16 07:35:33 UTC
As Qingjun Wei already mentioned, you are discussing different issues here and you are losing focus...

The device 1199:9079 is not handled by u3g.ko to give us support (like /dev/ttyU*, /dev/cuaU*) for sending AT commands to it. AFAIK other methods like MBIM, QMI and RMNET* aren’t supported in FreeBSD at all.

Sending “magic packets” to specific OEM versions of 1199:9079 (and yes, mine says “customer: lenovo-laptop” as well) to overcome the “low power mode (LPM)/ FCC AUTH” issue is something else. BUT for the “magic” of a challenge/response authentication and setting FCC AUTH=0, it’s necessary to send AT commands to our lovely 1199:9079.
Dean already mentioned the “description” in form of a python script how to do that “magic”. Within the years, the link has changed. It can be found here now:


Patching the firmware of 1199:9079 with a black-boxed nvu-file from a Russian-speaking technical forum nvu-file to make it less specific, is something that I would neither do, nor recommend. This might be a workaround, but like Ed Maste I want to know how to reproduce the nvu-file/fixes on my own - generally. I love the fact, that my 1199:9079 is not able to produce high power signals (or even signals at all, so that ue0 gets an IP address for example) without “permission”. Sure… it’s more an annoying “feature”, but much more important it’s not a bug of FreeBSD and nothing which needs to be discussed in this topic/thread here (no offense).

Yes, I know how to patch and build my own kernel… BUT you are speaking of a single line of “code” (more harmless definitions than real code) in two files for years now. I would love to see those lines within FreeBSD 13 sources in the nearer future.
Comment 12 mike 2021-09-16 14:54:20 UTC
(In reply to dean from comment #4)

This is how we use them as well.  We convert them on a linux box to use serial and then use PPP on FreeBSD over /dev/cuaU0.2.  They are pretty solid in the field (in Canada on Rogers, Bell and Telus) and give pretty close to expected speeds. Sierra is pretty good about giving firmware out. You just register on their website, and you can download the necessary firmware blobs.  But in North America, I find they work out of the box so to speak. 

Manufacturer: Sierra Wireless, Incorporated
Model: MC7455
Revision: SWI9X30C_02.08.02.00 r5428 CARMD-EV-FRMWR2 2016/01/06 20:38:53
MEID: xxxx
IMEI: xxxx
FSN: LQ71xxxx

Current Time:  498659           Temperature: 33
Reset Counter: 2                Mode:        ONLINE         
System mode:   LTE              PS state:    Attached     
LTE band:      B2               LTE bw:      15 MHz  
LTE Rx chan:   675              LTE Tx chan: 18675
EMM state:     Registered       Normal Service 
RRC state:     RRC Idle       
IMS reg state: No Srv  

PCC RxM RSSI:  -71              RSRP (dBm):  -100
PCC RxD RSSI:  -94              RSRP (dBm):  -138
Tx Power:      0                TAC:         73A0 (29600)
RSRQ (dB):     -11.7            Cell ID:     008BE916 (9169174)
SINR (dB):     19.0

+csq: 21,99
Comment 13 Tomasz "CeDeROM" CEDRO 2021-09-16 15:12:30 UTC
Would be perfect to be able to "convert" them directly on FreeBSD :-)

Can you please provide some instructions Mike? 

Do you use `usb_modeswitch` for conversion? I could not make it work with `usb_modeswitch`. If other I would like to port that configuration tool.. in perfect world I would see a Python module :-)
Comment 14 mike 2021-09-16 15:18:20 UTC
(In reply to Tomasz "CeDeROM" CEDRO from comment #13)

On Linux, we do 
you might need to install the necessary perl libs

   apt-get install build-essential
   apt-get install libuuid-tiny-perl libipc-shareable-perl libjson-perl
   /tmp/swi_setusbcomp.pl --device=/dev/cdc-wdm0 --usbcomp=19

Note, its not always 19. Run the command above and it will list the current mode as well as supported modes. Sometimes the target value is 6. e.g in this example, we re-ran it with usbcomp=6 to pick the right mode (qmi)

root@ali-u21-6port:/usr/bin# swi_setusbcomp.pl --device=/dev/cdc-wdm0 --usbcomp=6
Running in MBIM mode (driver=cdc_mbim)
MBIM OPEN succeeded
QMI msg '0x0021' returned status = 1
MBIM QMI support verified
supports 17 QMI subsystems:
  0x00 (1.5)    'QMI_CTL'       - Control service
  0x01 (1.12)   'QMI_WDS'       - Wireless data service
  0x02 (1.7)    'QMI_DMS'       - Device management service
  0x03 (1.21)   'QMI_NAS'       - Network access service
  0x04 (1.3)    'QMI_QOS'       - Quality of service, err, service 
  0x05 (1.4)    'QMI_WMS'       - Wireless messaging service
  0x06 (1.10)   'QMI_PDS'       - Position determination service
  0x07 (1.1)    'QMI_AUTH'      - Authentication service
  0x08 (1.1)    'QMI_AT'        - AT command processor service
  0x09 (2.1)    'QMI_VOICE'     - Voice service
  0x0a (2.0)    'QMI_CAT2'      - Card application toolkit service (new)
  0x0b (1.4)    'QMI_UIM'       - UIM service
  0x0c (1.4)    'QMI_PBM'       - Phonebook service
  0x11 (1.0)    'QMI_SAR'       - Specific absorption rate service
  0x1a (1.0)    'QMI_WDA'       - Wireless data administrative service
  0xe0 (2.0)    'QMI_CAT'       - Card application toolkit service
  0xe1 (1.0)    'QMI_RMS'       - Remote management service
QMI msg '0x0022' returned status = 1
Got QMI DMS client ID '4'
QMI msg '0x555b' returned status = 1
Current USB composition: 14
USB compositions:
   0 - HIP  DM    NMEA  AT    MDM1  MDM2  MDM3  MS      NOT SUPPORTED
   1 - HIP  DM    NMEA  AT    MDM1  MS                  NOT SUPPORTED
   2 - HIP  DM    NMEA  AT    NIC1  MS                  NOT SUPPORTED
   3 - HIP  DM    NMEA  AT    MDM1  NIC1  MS            NOT SUPPORTED
   4 - HIP  DM    NMEA  AT    NIC1  NIC2  NIC3  MS      NOT SUPPORTED
   5 - HIP  DM    NMEA  AT    ECM1  MS                  NOT SUPPORTED
   6 - DM   NMEA  AT    QMI                             SUPPORTED
   7 - DM   NMEA  AT    RMNET1 RMNET2 RMNET3            SUPPORTED
   8 - DM   NMEA  AT    MBIM                            SUPPORTED
   9 - MBIM                                             SUPPORTED
  10 - NMEA MBIM                                        SUPPORTED
  11 - DM   MBIM                                        SUPPORTED
  12 - DM   NMEA  MBIM                                  SUPPORTED
  13 - Config1: comp6    Config2: comp8                 SUPPORTED
* 14 - Config1: comp6    Config2: comp9                 SUPPORTED
  15 - Config1: comp6    Config2: comp10                SUPPORTED
  16 - Config1: comp6    Config2: comp11                SUPPORTED
  17 - Config1: comp6    Config2: comp12                SUPPORTED
  18 - Config1: comp7    Config2: comp8                 SUPPORTED
  19 - Config1: comp7    Config2: comp9                 SUPPORTED
  20 - Config1: comp7    Config2: comp10                SUPPORTED
  21 - Config1: comp7    Config2: comp11                SUPPORTED
  22 - Config1: comp7    Config2: comp12                SUPPORTED
QMI msg '0x555c' returned status = 1
QMI msg '0x0023' returned status = 1
Then reboot the modem (disconnect / reconnect). If you see ttyUSB3, you should be good to go.

root@virtbox1b:/dev# miniterm 

--- Available ports:
---  1: /dev/ttyS0           'ttyS0'
---  2: /dev/ttyS1           'ttyS1'
---  3: /dev/ttyUSB0         'MC7700'
---  4: /dev/ttyUSB1         'MC7700'
---  5: /dev/ttyUSB2         'MC7700'
--- Enter port index or full name: 5
--- Miniterm on /dev/ttyUSB2  9600,8,N,1 ---
--- Quit: Ctrl+] | Menu: Ctrl+T | Help: Ctrl+T followed by Ctrl+H ---
Manufacturer: Sierra Wireless, Incorporated
Model: MC7700
Revision: SWI9200X_03.05.29.03ap r6485 CNSHZ-ED-XP0031 2014/12/02 17:53:15
IMEI: 012626001461340
FSN: CDC2793208110
3GPP Release 8

&C: 1; &D: 2; &E: 0; &F: 0; &S: 0; &W: 0; E: 1; L: 0; M: 0; Q: 0; V: 1;
X: 1; Z: 0; \Q: 3; \S: 0; \V: 0; O: 0; S0: 0; S2: 43; S3: 13; S4: 10;
S5: 8; S6: 2; S7: 0; S8: 2; S9: 6; S10: 14; S11: 95; S30: 0; S103: 1;
S104: 1; +FCLASS: 0; +ICF: 3,3; +IFC: 2,2; +IPR: 115200; +DR: 0;
+DS: 0,0,2048,6; +CMEE: 2; +WS46: 12; +CFUN:; +CBST: 0,0,1;
+CRLP: (61,61,48,6,0),(61,61,48,6,1),(240,240,52,6,2);
+CV120: 1,1,1,0,0,0; +CHSN: 0,0,0,0; +CSSN: 0,0; +CREG: 0; +CGREG: 0;
+CEREG: 0; +CSCS: "IRA"; +CSTA: 129; +CR: 0; +CRC: 0; 
+CGDCONT: (1,"IP","fast.t-mobile.com","",0,0),(2,"IP","wap.cingular","",0,0);
+CSMS: 0; +CMGF: 0; +CSAS: 0; +CRES: 0; +CSCA: "",; +CSMP: ,,0,0;
+CSDH: 0; +CSCB: 0,"",""; +FDD: 0; +FAR: 0; +FCL: 0; +FIT: 0,0; +ES: ,,;
+ESA: 0,,,,0,0,255,; +CMOD: 0; +CEMODE: 3; +CVHU: 0;
+CPIN: ��������,��������; +CMEC: 0,0,0,0; +CIND: 0,0,0,0,0,0,0,0;
+CMER: 0,0,0,0,0; +CGATT: 0;  +CGACT: 0; +CPBS: "SM";
+CPMS: "SM","SM","SM"; +CNMI: 0,0,0,0,0; +CMMS: 0; +FTS: 0; +FRS: 0;
+FTH: 3; +FRH: 3; +FTM: 96; +FRM: 96; +CCUG: 0,0,0; +COPS: 0,0,"";
+CUSD: 0; +CAOC: 1; +CCWA: 0; +CCLK: ""; +CPOL: 0,2,"",0,0,0,0; +CPLS: 0;
+CTZR: 0; +CTZU: 0; +CLIP: 0; +COLP: 0; +CDIP: 0; +CLIR: 0;
+CMUX: 0,0,5,31,10,3,30,10,2; !CMUX: 0,0,5,31,10,3,30,10,2



--- exit ---
You should now see an extra serial port, and when you attach the device to FreeBSD, it will attach as u3g and you should see the familiar /dev/cuaU0.x ports to use.

root@virtbox1b:/dev# ls -lat | head
total 4
crw-rw-rw-  1 root tty       5,   2 Oct 10 14:04 ptmx
drwxr-xr-x 21 root root        4400 Oct 10 14:04 .
drwxr-xr-x  2 root root        4120 Oct 10 14:04 char
drwxr-xr-x  4 root root          80 Oct 10 14:04 serial
crw-rw----  1 root dialout 188,   0 Oct 10 14:04 ttyUSB0
crw-rw----  1 root dialout 188,   1 Oct 10 14:04 ttyUSB1
crw-rw----  1 root dialout 188,   2 Oct 10 14:04 ttyUSB2
crw-rw----  1 root dialout 188,   3 Oct 10 14:04 ttyUSB3
crw-rw----  1 root dialout 188,   4 Oct 10 14:04 ttyUSB4
root@virtbox1b:/dev# ls -lat | head
total 4
crw-rw-rw-  1 root tty       5,   2 Oct 10 14:04 ptmx
drwxr-xr-x 21 root root        4400 Oct 10 14:04 .
drwxr-xr-x  2 root root        4120 Oct 10 14:04 char
drwxr-xr-x  4 root root          80 Oct 10 14:04 serial
crw-rw----  1 root dialout 188,   0 Oct 10 14:04 ttyUSB0
crw-rw----  1 root dialout 188,   1 Oct 10 14:04 ttyUSB1
crw-rw----  1 root dialout 188,   2 Oct 10 14:04 ttyUSB2
crw-rw----  1 root dialout 188,   3 Oct 10 14:04 ttyUSB3
crw-rw----  1 root dialout 188,   4 Oct 10 14:04 ttyUSB4

root@virtbox1b:/dev# lsusb 
Bus 003 Device 025: ID 1199:68a3 Sierra Wireless, Inc. MC8700 Modem
Comment 15 Tomasz "CeDeROM" CEDRO 2021-09-16 15:28:55 UTC
Thank you Mike! I plan to get into this around next month :-)