Snapdragon X55 (Thinkpad X1 Nano w/5G Modem)

[Aleksander Morgado]

Hey,

Comments inline below.

>
> I'm trying to get the modem running on my Thinkpad X1 Nano which i ordered with the Snapdragon X55 / 5G Modem.
>
> I contacted Bjørn Mork who seems to be the author for some other kernel modules for usb-devices and we've been digging a bit. He informed me that you're already working on this chip here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/bus/mhi/pci_generic.c?id=aac426562f568520b674f0d5ae3929977be9f1c0
> I'm on ubuntu 21.04 (if it matters) and have built my kernel from mainline git (as well as bleeding-edge modemmanager, libqmi, libmbim as of may 7th) and now ModemManager detects the modem but but something is still failing when trying to enable it.
>
> Here's a loose translation of what Bjørn mentioned:
>
> ---------------------
> This problem might be specific to Lenovo/Thinkpad, the only thing you might need could be to actually turn on the radio:
>
>                                                                  >>>>>>   HwRadioState = 'on'
>                                                                  >>>>>>   SwRadioState = 'off'
>
> HwRadioState indicates that the input-signal to the module (W_DISABLE#) is OK.
> SwRadioState indicates that the radio is put in airplane mode through software.  Either BIOS or it might be the default of the modem-firmware.
>
> Lenovo has earlier (EM7455) required that the driver sends a magic "Set FCC Authentication" request on startup to enable the radio. You can also see it in your log since MM tries it when the radio-state returns "OperationNotAllowed".
>
>                                                                  <<<<<< QMUX:
>                                                                  <<<<<<   length  = 19
>                                                                  <<<<<<   flags   = 0x80
>                                                                  <<<<<<   service = "dms"
>                                                                  <<<<<<   client  = 1
>                                                                  <<<<<< QMI:
>                                                                  <<<<<<   flags       = "response"
>                                                                  <<<<<<   transaction = 5
>                                                                  <<<<<<   tlv_length  = 7
>                                                                  <<<<<<   message     = "Set FCC Authentication" (0x555F)
>                                                                  <<<<<< TLV:
>                                                                  <<<<<<   type       = "Result" (0x02)
>                                                                  <<<<<<   length     = 4
>                                                                  <<<<<<   value      = 01:00:11:00
>                                                                  <<<<<<   translated = FAILURE: MissingArgument
>
>
> 'MissingArgument' is also interesting. It means that the request ID exists and since this is a vendor-specific code (as far as i know) it oculd mean that it's specified by Lenovo, not by Sierra Wireless as i've previously thought.
>

I've seen different vendors adding this kind of message codes for
different purposes, so I think any of those assumptions could be
valid.

> That could mean that this is the correct method to enable the radio, but that they require an input-argument. Maybe a code? or something else?
>
> It could also just mean that QMI_DMS request 0x555F is something else entirely in this Foxconn modem and is completley unrelated to radio on/off.
>
> The problem we have now is that we no longer have a simple solution to snoop the trafic from windows. It was simple with USB but I have no idea how to do that with PCIe. I've never worked with PCI-drivers.
> ---------------------
>
> Does anyone have any idea / some other input for how to get further?
>

So, my assumption is that Lenovo should have a tool to "unlock" this
module; something equivalent to the Set FCC authentication in Sierra
modules. Maybe something equivalent to this Dell custkit tool for the
Foxconn SDX20 module?
https://gitlab.freedesktop.org/aleksm/libqmi/-/tree/aleksander/dell-cuskit

If that tool does what I think it does, it would "validate" that the
module is running in a certified Dell laptop, and if so, send a
specific magic QMI command to the module. And if so, there should be
nothing preventing us from doing the same, unless the magic command
requires some additional logic to pass a magic value computed from
imei or whatever, that would be a bit more complex.

I have a draft setup to test the commands provided in the custkit
tool, but never made it work I'm afraid:
https://gitlab.freedesktop.org/aleksm/libqmi/-/tree/aleksander/dell-cuskit

That branch introduces a new qmicli --dms-dell-cuskit-unlock=[XX]
command, where XX is a uint8 value (00-255). I was able to play with a
locked SDX20 with that command but could never make it work. Don't
know if you'll be able to do the same?

But all this said, hey, you bought an X1 with a SDX55 module, Lenovo
should give you a way to unlock the mode rightfully. It's not like you
bought the SDX55 in ebay and you're trying to use it elsewhere.

My assumption, given the good relationship between Ubuntu and Lenovo,
is that the Ubuntu shipped in those laptops will include that magic
tool, maybe embedded in some other program or just "hidden in the
public" and we just need to look for that. This may not be a bad idea
to investigate I think.



--
Aleksander
https://aleksander.es