QMI via MBIM for "FCC Authentication" fix

[Collin McMillan]

Hi Folks,

I am poking around with a new Sierra Wireless EM7355 in a Lenovo T440p.
I've had two big problems getting it to work, one being easily solvable (
https://bugs.freedesktop.org/show_bug.cgi?id=91351).

The other problem is the "FCC Authentication" trick discussed here:
https://bugzilla.kernel.org/show_bug.cgi?id=92101

That trick doesn't work on my modem because the EM7355 apparently doesn't
support a QMI interface.  It starts up in MBIM mode.  I can switch it to
QMI mode by setting bConfiguationValue in /sys/bus/usb/devices/1-10 to 1.
The device reattaches with the proper ttyUSB devices.  I can connect to
ttyUSB2 with minicom and issue AT commands.  The password A701 even lets me
change the maintenance settings just fine.  However, no QMI commands are
possible.  Just for example:

=============================================
# qmicli -d /dev/cdc-wdm0 --dms-get-capabilities --verbose
[24 Jul 2015, 18:33:31] [Debug] [/dev/cdc-wdm0] Opening device with flags
'none'...
[24 Jul 2015, 18:33:31] [Debug] QMI Device at '/dev/cdc-wdm0' ready
[24 Jul 2015, 18:33:31] [Debug] [/dev/cdc-wdm0] Assuming service 'dms' is
supported...
[24 Jul 2015, 18:33:31] [Debug] [/dev/cdc-wdm0] Allocating new client ID...
[24 Jul 2015, 18:33:31] [Debug] [/dev/cdc-wdm0] Sent message...
<<<<<< RAW:
<<<<<<   length = 16
<<<<<<   data   = 01:0F:00:00:00:00:00:01:22:00:04:00:01:01:00:02

[24 Jul 2015, 18:33:31] [Debug] [/dev/cdc-wdm0] Sent message (translated)...
<<<<<< QMUX:
<<<<<<   length  = 15
<<<<<<   flags   = 0x00
<<<<<<   service = "ctl"
<<<<<<   client  = 0
<<<<<< QMI:
<<<<<<   flags       = "none"
<<<<<<   transaction = 1
<<<<<<   tlv_length  = 4
<<<<<<   message     = "Allocate CID" (0x0022)
<<<<<< TLV:
<<<<<<   type       = "Service" (0x01)
<<<<<<   length     = 1
<<<<<<   value      = 02
<<<<<<   translated = dms

error: couldn't create client for the 'dms' service: CID allocation failed
in the CTL client: Transaction timed out
=============================================

In addition, ModemManager reports:
....
ModemManager[2839]: <debug> [1437767847.000186] [mm-port-probe.c:435]
port_qmi_open_ready(): (usbmisc/cdc-wdm0) error checking QMI support:
'Transaction timed out'
ModemManager[2839]: <debug> [1437767847.000226] [mm-port-probe.c:290]
mm_port_probe_set_result_qmi(): (usbmisc/cdc-wdm0) port is not QMI-capable
....

I have also read reports of some of these modems not supporting QMI, only
MBIM.  I do have the latest firmware from Sierra.

SO, I am now trying to get the QMI over MBIM procedure going, which is
rumored to exist. :-)
http://lists.freedesktop.org/archives/modemmanager-devel/2015-July/002087.html

Apparently it is straight forward once you know what to do -- just send a
QMI message to MBIM service d1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3.  I can
verify that my modem has this service with:
mbimcli -d /dev/cdc-wdm0 --query-device-services

This is where I am stuck.  I suppose this is not possible with mbimcli, so
I am trying to write a utility using libmbim to send the QMI FCC auth
command through MBIM.  Once I figure that out I am looking at adding that
functionality to mbimcli.

Would anyone on the list have a few more clues?  Specifically, do I need to
create the QMI command to wrap in libqmi first, or can it be done
manually?  Is there a simplified/minimized API usage example somewhere for
sending MBIM commands?  If not, mbimcli's code will do. :-)

Thanks in advance!

Collin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/libmbim-devel/attachments/20150724/c82c99f4/attachment.html>