Snapdragon X55 (Thinkpad X1 Nano w/5G Modem)

[Loic Poulain]

Hi Oskar, Aleksander,

+Jarvis

On Tue, 11 May 2021 at 09:35, Aleksander Morgado
<aleksander at aleksander.es> wrote:
>
> Hey,
>
> Comments inline below.
>
> >
> > I'm trying to get the modem running on my Thinkpad X1 Nano which i ordered with the Snapdragon X55 / 5G Modem.
> >
> > I contacted Bjørn Mork who seems to be the author for some other kernel modules for usb-devices and we've been digging a bit. He informed me that you're already working on this chip here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/bus/mhi/pci_generic.c?id=aac426562f568520b674f0d5ae3929977be9f1c0
> > I'm on ubuntu 21.04 (if it matters) and have built my kernel from mainline git (as well as bleeding-edge modemmanager, libqmi, libmbim as of may 7th) and now ModemManager detects the modem but but something is still failing when trying to enable it.
> >
> > Here's a loose translation of what Bjørn mentioned:
> >
> > ---------------------
> > This problem might be specific to Lenovo/Thinkpad, the only thing you might need could be to actually turn on the radio:
> >
> >                                                                  >>>>>>   HwRadioState = 'on'
> >                                                                  >>>>>>   SwRadioState = 'off'
> >
> > HwRadioState indicates that the input-signal to the module (W_DISABLE#) is OK.
> > SwRadioState indicates that the radio is put in airplane mode through software.  Either BIOS or it might be the default of the modem-firmware.
> >
> > Lenovo has earlier (EM7455) required that the driver sends a magic "Set FCC Authentication" request on startup to enable the radio. You can also see it in your log since MM tries it when the radio-state returns "OperationNotAllowed".
> >
> >                                                                  <<<<<< QMUX:
> >                                                                  <<<<<<   length  = 19
> >                                                                  <<<<<<   flags   = 0x80
> >                                                                  <<<<<<   service = "dms"
> >                                                                  <<<<<<   client  = 1
> >                                                                  <<<<<< QMI:
> >                                                                  <<<<<<   flags       = "response"
> >                                                                  <<<<<<   transaction = 5
> >                                                                  <<<<<<   tlv_length  = 7
> >                                                                  <<<<<<   message     = "Set FCC Authentication" (0x555F)
> >                                                                  <<<<<< TLV:
> >                                                                  <<<<<<   type       = "Result" (0x02)
> >                                                                  <<<<<<   length     = 4
> >                                                                  <<<<<<   value      = 01:00:11:00
> >                                                                  <<<<<<   translated = FAILURE: MissingArgument
> >
> >
> > 'MissingArgument' is also interesting. It means that the request ID exists and since this is a vendor-specific code (as far as i know) it oculd mean that it's specified by Lenovo, not by Sierra Wireless as i've previously thought.
> >
>
> I've seen different vendors adding this kind of message codes for
> different purposes, so I think any of those assumptions could be
> valid.
>
> > That could mean that this is the correct method to enable the radio, but that they require an input-argument. Maybe a code? or something else?
> >
> > It could also just mean that QMI_DMS request 0x555F is something else entirely in this Foxconn modem and is completley unrelated to radio on/off.
> >
> > The problem we have now is that we no longer have a simple solution to snoop the trafic from windows. It was simple with USB but I have no idea how to do that with PCIe. I've never worked with PCI-drivers.
> > ---------------------
> >
> > Does anyone have any idea / some other input for how to get further?
> >
>
> So, my assumption is that Lenovo should have a tool to "unlock" this
> module; something equivalent to the Set FCC authentication in Sierra
> modules. Maybe something equivalent to this Dell custkit tool for the
> Foxconn SDX20 module?
> https://gitlab.freedesktop.org/aleksm/libqmi/-/tree/aleksander/dell-cuskit
>
> If that tool does what I think it does, it would "validate" that the
> module is running in a certified Dell laptop, and if so, send a
> specific magic QMI command to the module. And if so, there should be
> nothing preventing us from doing the same, unless the magic command
> requires some additional logic to pass a magic value computed from
> imei or whatever, that would be a bit more complex.
>
> I have a draft setup to test the commands provided in the custkit
> tool, but never made it work I'm afraid:
> https://gitlab.freedesktop.org/aleksm/libqmi/-/tree/aleksander/dell-cuskit
>
> That branch introduces a new qmicli --dms-dell-cuskit-unlock=[XX]
> command, where XX is a uint8 value (00-255). I was able to play with a
> locked SDX20 with that command but could never make it work. Don't
> know if you'll be able to do the same?
>
> But all this said, hey, you bought an X1 with a SDX55 module, Lenovo
> should give you a way to unlock the mode rightfully. It's not like you
> bought the SDX55 in ebay and you're trying to use it elsewhere.
>
> My assumption, given the good relationship between Ubuntu and Lenovo,
> is that the Ubuntu shipped in those laptops will include that magic
> tool, maybe embedded in some other program or just "hidden in the
> public" and we just need to look for that. This may not be a bad idea
> to investigate I think.

I'm not really familiar with this, but some vendors also implement a
specific vendor one-shot AT command for unlocking the modem, not sure
this is the case though. Have you tried to start the modem on Windows?
and then on Linux/Ubuntu?

I mention that since a recent patch has been submitted to LKML to
enable support for the AT channel/port on these modems:
https://www.spinics.net/lists/linux-arm-msm/msg85591.html

So you may have to apply that patch to submit whatever command is requested.

Jarvis, any input on this?

Regards,
Loic