Firmware upgrade for em7345 on Lenovo laptops

Mon Aug 27 19:55:51 UTC 2018

Am 26.08.2018 um 22:53 schrieb Andreas Fett:
> the modem firmware on the Sierra Wireless em7345 seems to have some
> issues. We've had recent reports from the Netherlands and some parts of
> Germany (depending on the provider) that the modems stopped working.
...
> Now my question is, could this upgrade be done using the upgrade utility
> provided with libqmi (using the qmi over mbim method)? Has anyone
> experiences with this? And how to get the firmware in a format that the
> upgrade tool can cope with, is there a way to extract it from the lenovo
> files or are there other sources for firmware images known to work with
> this modem model as build into Lenovo laptops?

I've played with Sierra Wireless EM7345 (Intel XMM6262) cards recently
and found a way to to upgrade the modem firmware on Linux systems.

### 01 - Get the Firmware images

Download the official firmware for windows from Lenovo's website
https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/gtwo40ww.exe
https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/gtwo42ww.exe
https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/gtwo44ww.exe
https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/gtwo45ww.exe
https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/gtwo46ww.exe
https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/gtwo47ww.exe
https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/nz0wo01w.exe

To extract the modem firmware from the exe files you need innoextract
and 7z. Both tools are probably already part of your favourite Linux
dristribution.

http://p7zip.sourceforge.net/
http://constexpr.org/innoextract/

$ innoextract -I app/SierraWirelessEM73454GLTESoftware.exe gtwo40ww.exe
$ 7z x app/SierraWirelessEM73454GLTESoftware.exe *FirmwareDatabase* -r
$ mkdir -p FW && find . -iname "*.fls" -print0 | xargs -r0 mv -t ./FW
$ for i in FW/*.fls; do echo -ne "$i:"; strings "$i"|egrep "_REV_.* 20";
done

So far I've found the following firmware versions from the Lenovo
websites. (Generic versions only as I'm personally not interested in the
customized versions that do exist for several carriers)

FIH7160_V1.1_01.1349.12_MBIM_GNSS_NAND_4.5_REL.fls
 -> FIH7160_XMM7160_V1.1_MBIM_GNSS_NAND_REV_4.5 2013-Dec-20 12:14:04
FIH7160_V1.2_WW_01.1415.07_NAND.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2014-Jun-5 11:54:58
FIH7160_V1.2_WW_01.1415.09_NAND.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2014-Oct-22 17:47:10
FIH7160_V1.2_WW_01.1442.07_NAND_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2014-Dec-3 14:16:09
FIH7160_V1.2_WW_01.1522.02_NAND_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2015-May-29 08:57:40
FIH7160_V1.2_WW_01.1528.04_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2015-Aug-27 09:01:45
FIH7160_V1.2_WW_01.1529.05_NAND_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2015-Oct-5 09:20:27
FIH7160_V1.2_WW_01.1548.02_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2015-Nov-30 13:37:25
FIH7160_V1.2_WW_01.1612.00_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2016-Mar-15 12:52:50
FIH7160_V1.2_WW_01.1616.01_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2016-Apr-26 08:17:52
FIH7160_V1.2_WW_01.1644.00_Generic.fls
 -> FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2016-Oct-20 09:11:55

### 02 - Get the Intel Platform Flash Tool Lite

https://01.org/node/2463

In case you are using Ubunto or Fedora you can probably just install the
deb or rpm files otherwise just extract the binaries from the Fedora rpm.

Here you can find some interesting tools when you have to deal with
Intel XMM based firmware.

* flsTool - This tool can do several different operations of FLS files
* downloadTool - This tool can be used to upgrade the firmware of Intel
XMM based modems

### 03 - Upgrade the firmware

Get your current firmware version via the XGENDATA AT-command

AT+XGENDATA
+XGENDATA: "    FIH7160_XMM7160_V1.2_MBIM_GNSS_NAND_REV_4.5 2016-Oct-20
09:11:55
                *FIH7160_V1.2_WW_01.1644.00*"

or

$ sudo mbimcli -p -d /dev/cdc-wdm0 --query-device-caps
[/dev/cdc-wdm0] Device capabilities retrieved:
              Device type: 'embedded'
           Cellular class: 'gsm'
              Voice class: 'no-voice'
                SIM class: 'removable'
               Data class: 'gprs, edge, umts, hsdpa, hsupa, lte, custom'
                 SMS caps: 'pdu-receive, pdu-send'
                Ctrl caps: 'reg-manual'
             Max sessions: '16'
        Custom data class: 'HSPA+'
                Device ID: '013937007140021'
            Firmware info: 'FIH7160_V1.2_WW_01.1644.00'
            Hardware info: 'XMM7160_V1.2_MBIM_GNSS_NAND_RE'

To upgrade the firmware kill any running ModemManager processes and
start downloadTool with proper parameters...

$ sudo killall -9 ModemManager
$ sudo ./downloadTool -v 4 -c1 --library=./libDownloadTool.so
FIH7160_V1.2_WW_01.1644.00_Generic.fls

Per default downloadTool will then wait 60 seconds for a reboot of your
wwan card.

In a second terminal reboot your wwan card via
$ sudo mbimcli -p -d /dev/cdc-wdm0 --intel-modem-reboot

After the reboot downloadTool kicks in and starts the firmware upgrade.
The the wwan card boots again and you've sucessfully flashed your firmware.

I'm not sure if ModemManager somehow interferes the firmware upgrade
procedure but killed it manually before I upgraded my WWAN card so far.

See the attached file for the full cli output from downloadTool during
the firmware upgrade.

Happy flashing :-)

best regards,
Martin

-------------- next part --------------
$ sudo ./downloadTool -v 4 -c1 --library=./libDownloadTool.so FIH7160_V1.2_WW_01.1644.00_Generic.fls

Intel Command Line FlashTool v.2.56 (Download Library v.5.23)

Setting Communication timeout to 60000
SetComPort(1, 1)
Setting Comport 1 (Channel 1)
 [Loading] FIH7160_V1.2_WW_01.1644.00_Generic.fls (Fls2)
  FIH7160_V1.2_WW_01.1644.00_Generic.fls (Code, 
get_nvm_tags Found 3 NVM tags in FIH7160_V1.2_WW_01.1644.00.fls
Cust, Code, PSI, SLB) (NAND)
Booting '/home/mhauke/XMM6262/Sierra-Wireless-EM7345/FIH7160_V1.2_WW_01.1644.00_Generic.fls', memclass: PSI
  -> Please reboot your phone device <-  
boot_target(1, /home/mhauke/XMM6262/Sierra-Wireless-EM7345/FIH7160_V1.2_WW_01.1644.00_Generic.fls)

> Device synchronized.
Details>   - Link response SecureLevel: 1
Details> Injecting RPSI
Details> Injecting EBL
Details> Boot-loader is active
Details> EBL version: XMM7160_1617.400_M1S1 1617..400
Details> Boot mode is: CC
> Using: Faster CRC, Writing all blocks , Skip data CRC , Skip protocol CRC
Details> Package length is 16384 - protocol: 3.32
Details> Baud rate set to 921600
Details> Get flash id.
Details> Flash ID is: 00B1002C
Details> Boot process finished

Downloading files (1)...
Downloading PSI...

> Start downloading item 'PSI:psi_flash_signed.fls'' from file '/home/mhauke/XMM6262/Sierra-Wireless-EM7345/FIH7160_V1.2_WW_01.1644.00_Generic.fls''.
Details> Sending sec-pack.
Details>   Load region 0
Details>   - Erasing. (Pre-erase, Used-length)
  Progress: 100%
Details>   - Sending data. (USB RAW mode)
  Progress: 100%
Details> Sending end-pack.
> Checksum OK (0x86D2)
Details> Verify OK
> Process time was 87 msec.
Downloading SLB...

> Start downloading item 'SLB:slb_signed.fls'' from file '/home/mhauke/XMM6262/Sierra-Wireless-EM7345/FIH7160_V1.2_WW_01.1644.00_Generic.fls''.
Details> Sending sec-pack.
Details>   Load region 0
Details>   - Erasing. (Pre-erase, Used-length)
  Progress: 100%
Details>   - Sending data. (USB RAW mode)
  Progress: 100%
Details> Sending end-pack.
> Checksum OK (0x3012)
Details> Verify OK
> Process time was 131 msec.
Downloading Code...

> Start downloading item 'Code:FIH7160_V1.2_WW_01.1644.00.fls'' from file '/home/mhauke/XMM6262/Sierra-Wireless-EM7345/FIH7160_V1.2_WW_01.1644.00_Generic.fls''.
Details> Sending sec-pack.
Details>   Load region 0
Details>   - Erasing. (Pre-erase, Used-length)
  Progress: 100%
Details>   - Sending data. (USB RAW mode)
  Progress: 100%
Details> Sending end-pack.
> Checksum OK (0x463B)
Details> Verify OK
> Process time was 2344 msec.
Downloading Code...

> Start downloading item 'Code:AENEAS_FW_signed.fls'' from file '/home/mhauke/XMM6262/Sierra-Wireless-EM7345/FIH7160_V1.2_WW_01.1644.00_Generic.fls''.
Details> Sending sec-pack.
Details>   Load region 0
Details>   - Erasing. (Pre-erase, Used-length)
  Progress: 100%
Details>   - Sending data. (USB RAW mode)
  Progress: 100%
Details> Sending end-pack.
> Checksum OK (0x9EC0)
Details> Verify OK
> Process time was 123 msec.
Downloading Cust...

> Start downloading item 'Cust:allcpus4eboot_ahb11_signed.fls'' from file '/home/mhauke/XMM6262/Sierra-Wireless-EM7345/FIH7160_V1.2_WW_01.1644.00_Generic.fls''.
Details> Sending sec-pack.
Details>   Load region 0
Details>   - Erasing. (Pre-erase, Used-length)
  Progress: 100%
Details>   - Sending data. (USB RAW mode)
  Progress: 100%
Details> Sending end-pack.
> Checksum OK (0x4033)
Details> Verify OK
> Process time was 465 msec.

Success!

Force Target Reset!
Forcing target SW reset...
> Total time was 3.9 sec.