Skip to content

Latest commit

 

History

History
575 lines (459 loc) · 21.6 KB

README.md

File metadata and controls

575 lines (459 loc) · 21.6 KB
Raw

Have a question/comment? Please use the Community Discussions instead of opening an issue.

CodeFactor

EM7565/EM7455/MC7455 - Modem Configuration

Index

Modem Performance/Specifications

  • The EM7455/MC7455 is a Category 6 LTE modem. It is capable of 300Mbps down and 50Mbps up.

  • Real world, you are unlikely to ever see much more than 230Mbps, even on Sprint Carrier Aggregation of Band 41+41 (40MHz total).

  • These are my peak results so far (B2+B12, 30MHz total):

    Speed Test peak LTE Results

  • Higher speeds will require a modem capable of 3CA (Three Carrier Aggregation) such as the em7565

    • EM7565 allows 3CA of B2+B12+B30 for a total downlink of 40MHz on approximately 60% of AT&T towers (Assuming you are close and have a strong signal).
    • These are my peak results so far (B2+B12+B30, 40MHz total):

Official Sierra Documents/Firmwares (May require free Sierra account)

Which Modem to Buy

  • If your Laptop has a M.2 WWAN slot, get the Dell DW5811e em7455 and change its identity according to your needs.
    • ~$15 Dell DW5811e em7455
    • This model (typically) supports Bands 29 and 30, unlike the Lenovo Branded Modem.
    • When purchasing the Dell, I would recommend you get a production model. Engineering Samples will sometimes contain an early (SWI9X30C_00.08.02.00) firmware that can be a royal pain to flash due to AT!BOOTHOLD not being implemented.

Adapters and Antennas

Create Accessible COM Port

My Automated Flashing of the EM7455/MC7455 with a Ubuntu Linux 18.04 LiveCD script will complete this task.

Manual Flashing Procedure (Ubuntu Linux 18.04)

  1. Install libqmi-utils version 1.20+
    • sudo add-apt-repository universe
    • sudo apt update
    • apt-get install libqmi-glib5 libqmi-proxy libqmi-utils -y
  2. Get the latest firmware bundle from Sierra Wireless.
    • curl -o SWI9X30C_02.30.01.01_Generic_002.045_000.zip -L https://source.sierrawireless.com/~/media/support_downloads/airprime/74xx/fw/02_30_01_01/7455/swi9x30c_02.30.01.01_generic_002.045_000.ashx
  3. Extract firmware CWE and NVU. unzip SWI9X30C_02.30.01.01_Generic_002.045_000.zip
  4. Stop Modem Manager systemctl stop ModemManager
  5. Flash firmware 
    deviceid=`lsusb | grep -i -E '1199:9071|1199:9079|413C:81B6' | awk '{print $6}'`
qmi-firmware-update --update -d "$deviceid" SWI9X30C_02.30.01.01.cwe SWI9X30C_02.30.01.01_GENERIC_002.045_000.nvu
  6. Modem will reset with new firmware and carrier profile.

Basic Setup

My Automated Flashing of the EM7455/MC7455 with a Ubuntu Linux 18.04 LiveCD script will complete this task.
  1. Enable Advanced Commands:
    • AT!ENTERCND="A710"
  2. Set preferred image to GENERIC (Will error if Generic does not exist)
    • AT!IMPREF="GENERIC"
  3. Set Interface bitmask to 0000100D (diag,nmea,modem,mbim). This is the same as USBCOMP=8.
    • AT!USBCOMP=1,1,0000100D
  4. Set LTE Only (Disables UMTS/HSDPA/3G fallback, which you probably dont want)
    • AT!SELRAT=06
  5. Set Modem to use all available bands (Dont hide any bands)
    • AT!BAND=00
  6. Save settings and reboot modem to apply
    • AT!RESET

EM7565 Basic Setup

  1. Enable Advanced Commands:
    • AT!ENTERCND="A710"
  2. Set preferred image to GENERIC (Will error if Generic does not exist)
    • AT!IMPREF="GENERIC"
  3. Set Interface bitmask to 0000100D (diag,nmea,modem,mbim).
    • AT!USBCOMP=1,3,0000100D
  4. Set LTE Only (Disables UMTS/HSDPA/3G fallback, which you probably dont want)
    • AT!SELRAT=06
  5. Set Modem to use all available LTE bands (Dont hide any bands)
    • AT!BAND=00
    • AT!BAND=09
  6. Save settings and reboot modem to apply
    • AT!RESET

Bypass Lenovo Whitelist for T470/Carbon X1 G6 and other newer Lenovo laptops

Note: Use a $10 M.2 USB Adapter to flash and configure the modem

  1. Enable Advanced Commands:
    • AT!ENTERCND="A710"
  2. Do not skip full initialization on cold boots.
    • AT!CUSTOM="FASTENUMEN",2
    • Prevents device from showing up until it has been fully initialized. This causes the modem to stealth bypass BIOS whitelists as it will not show up until a few seconds after the BIOS has completed its checks.
  3. Tell the modem to ignore the W_DISABLE pin sent by many laptop's internal M2 slots.
    • AT!PCOFFEN=2
  4. Force USB2 mode to enable compatibility with newer M.2 interfaces
    • AT!USBSPEED=0
    • The EM7455 cannot exceed USB2 interface speeds anyways, there is no performance loss.
  5. Save settings and reboot modem to apply
    • AT!RESET

References:

EM7565 ROOter Setup

For GoldenOrb 2017-12-15 Release

  • Run the following AT commands to set to LTE only, and set the USB Composition to something that works with ROOter.
AT!ENTERCND="A710"
AT!BAND=00
AT!BAND=09
AT!SELRAT=06
AT!USBCOMP=1,3,100D
AT!RESET
  • Run the following from SSH:
# Replace hooks for AirCard 340U (if you use a 340U, use PID 9041 as your sacrificial PID):
sed -i 's/ 9051 / 9091 /g' /usr/lib/rooter/connect/create_connect.sh
# Insert PID for EM7455 on every boot:
sed -i '$s%^exit 0%echo "1199 9091" > /sys/bus/usb-serial/drivers/option1/new_id\nexit 0\n%' /etc/rc.local
# Insert PID for EM7455 on immediately:
echo "1199 9091" > /sys/bus/usb-serial/drivers/option1/new_id

Change Modem Identity (Sierra Wireless / Lenovo / Dell)

My Automated Flashing of the EM7455/MC7455 with a Ubuntu Linux 18.04 LiveCD script will complete this task.
  1. Enable Terminal Echo 
    ATE1
  2. Enable Advanced Commands: 
    AT!ENTERCND="A710"
  3. Record current settings so you can revert if needed. 
    AT!USBVID?
AT!USBPID?
AT!USBPRODUCT?
AT!PRIID?
    Note the Carrier PRI, we'll use that below. 
    Carrier PRI: 9999999_9904609_SWI9X30C_02.24.05.06_00_GENERIC_002.026_000
PRI Part Number: 9904609
Revision: 002.026
Customer: Generic-Laptop
  4. Change Modem Identity (Generic, Lenovo, or Dell) Change Modem into a Generic Sierra Wireless em7455/mc7455 
    AT!USBVID=1199
AT!USBPID=9071,9070
AT!USBPRODUCT="EM7455"
AT!PRIID="9904609","002.026","Generic-Laptop"
    Change Modem into a Lenovo em7455/mc7455 (Use this if installing in a Lenovo) 
    AT!USBVID=1199
AT!USBPID=9079,9078
AT!USBPRODUCT="Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A"
AT!PRIID="9904609","002.026","Lenovo-Storm"
    Change Modem into a Dell DW5811e em7455/mc7455 
    AT!USBVID=413C
AT!USBPID=81B6,81B5
AT!USBPRODUCT="Dell Wireless 5811e Gobi(TM)4G LTE Mobile Broadband Card"
AT!PRIID="9904609","002.026","DELL"
  5. Save settings and reboot modem to apply 
    AT!RESET

Flash using Sierra Wireless Linux Flashing Tool (fwdwl-lite)

Flash modem stuck in QDLoader mode using qmi-firmware-update

deviceid=`lsusb | grep -i -E '1199:9070|1199:9078|413C:81B5' | awk '{print $6}'`
qmi-firmware-update --update-qdl -d "$deviceid" SWI9X30C_02.24.05.06.cwe SWI9X30C_02.24.05.06_GENERIC_002.026_000.nvu

Useful Commands/Info

Enable Terminal Echo

ATE1

Enable Advanced Commands:

AT!ENTERCND="A710"

Clear all Carrier Preferences/Firmwares other than current(You will want to flash the modem after this):

AT!IMAGE?
AT!IMAGE=0
AT!RESET

AT!IMAGE=?

AT!IMAGE=<op>[,<type>[,<slot>[,"<build_id>","<unique_id>"]]]
op   - 0:delete 1:list 2:get max num images
type - 0:FW 1:CONFIG
slot - FW slot index - none implies all slots
AT!IMAGE?[<op>[,<type>]]

Selectively Clear Firmwares:

  • Example: Delete (0), FW (0), Slot (3)
AT!ENTERCND="A710"
AT!IMAGE=0,0,3
AT!RESET

Clear all changes and restore to (Lenovo/Sierra) factory settings:

AT!ENTERCND="A710"
AT!RMARESET=1
AT!RESET

Clear all changes and restore to (Dell) factory settings:

AT!ENTERCND="A710"
AT!NVRESTORE=0
AT!RESET

Lock LTE Bands (Pick one)

AT!BAND=10,"B2 (1900)",0,0000000000000002
AT!BAND=10,"B4 (1700/2100)",0,0000000000000008
AT!BAND=10,"B5 (850)",0,0000000000000010
AT!BAND=10,"B12 (700)",0,0000000000000800
AT!BAND=10,"B2B4",0,000000000000000A
AT!BAND=10,"B2B4B5B12",0,000000000000081A

Set Band Lock:

AT!BAND=10

Clear Band Lock:

AT!BAND=00

AT!LTEINFO?

!LTEINFO:
Serving:   EARFCN MCC MNC   TAC      CID Bd D U SNR PCI  RSRQ   RSRP   RSSI RXLV
              800 310 410 35666 0A14666A  2 5 5  22 404 -14.1  -79.6  -45.5 --

IntraFreq:                                          PCI  RSRQ   RSRP   RSSI RXLV
                                                    404 -14.1  -79.6  -45.5 --
                                                    402 -20.0  -89.3  -57.6 --

InterFreq: EARFCN ThresholdLow ThresholdHi Priority PCI  RSRQ   RSRP   RSSI RXLV
             5110            0           0        0 272 -12.1  -80.9  -50.6   0

Show available Carrier Aggregations for your modem:

AT!LTECA?
Hardware:
LTEB1: B8,
LTEB2: B2, B5, B12, B13, B29,
LTEB3: B7, B20,
LTEB4: B4, B5, B12, B13, B29,
LTEB5: B2, B4, B30,
LTEB7: B3, B7, B20,
LTEB8: B1,
LTEB12: B2, B4, B30,
LTEB13: B2, B4,
LTEB20: B3, B7,
LTEB25:
LTEB26:
LTEB29:
LTEB30: B5, B12, B29,
LTEB41: B41,

Permitted Bands:
Empty

Prune_ca_combos:
Empty

AT!LTECA=?
!LTECA=<flag>
<flag>: 0 – disable CA
	1 – enable CA

AT!GSTATUS?

!GSTATUS:
Current Time:  22016		Temperature: 40
Reset Counter: 1		Mode:        ONLINE
System mode:   LTE        	PS state:    Attached
LTE band:      B2     		LTE bw:      20 MHz
LTE Rx chan:   800		LTE Tx chan: 18800
LTE CA state:  ACTIVE      		LTE Scell band:B12
LTE Scell bw:10 MHz  		LTE Scell chan:5110
EMM state:     Registered     	Normal Service
RRC state:     RRC Connected
IMS reg state: No Srv

PCC RxM RSSI:  -45		RSRP (dBm):  -81
PCC RxD RSSI:  -44		RSRP (dBm):  -79
SCC RxM RSSI:  -52		RSRP (dBm):  -83
SCC RxD RSSI:  -51		RSRP (dBm):  -81
Tx Power:      15		TAC:         8C65 (35666)
RSRQ (dB):     -14.0		Cell ID:     0A14666A (169106666)
SINR (dB):     23.8

AT!HWID?
Revision: 0.5

How to Calculate Bitmasks to Lock LTE Bands

When you see something like AT!BAND=10,"B2B4B5B12",0,000000000000081A, you may wonder how that number on the end is derrived. It is a bitmask.

  • First, unlock Advanced/Admin mode:
    • AT!ENTERCND="A710"
  • Next, check the bitmask options for your specific modem. There will be variations between modems, so always check what is actually available on your modem and reference that table.
AT!BAND=?
Index, Name,                        GW Band Mask     L Band Mask      TDS Band Mask
00, All bands                     0002000007C00000 00000100130818DF 0000000000000000
01, Europe 3G                     0002000000400000 0000000000000000 0000000000000000
02, North America 3G              0000000004800000 0000000000000000 0000000000000000
06, Europe                        0002000000400000 00000000000800C5 0000000000000000
07, North America                 0000000004800000 000000000300185A 0000000000000000
08, WCDMA ALL                     0002000007C00000 0000000000000000 0000000000000000
09, LTE ALL                       0000000000000000 00000100130818DF 0000000000000000

                                                   0000010000000000 - B41
                                                   0000000010000000 - B29
                                                   0000000002000000 - B26
                                                   0000000001000000 - B25
                                                   0000000000080000 - B20
                                                   0000000000001000 - B13
                                                   0000000000000800 - B12
                                                   0000000000000080 - B8
                                                   0000000000000040 - B7
                                                   0000000000000010 - B5
                                                   0000000000000008 - B4
                                                   0000000000000004 - B3
                                                   0000000000000002 - B2
                                                   0000000000000001 - B1
                                  0002000000000000 - B8  (900)
                                  0000000004000000 - B5  (850)
                                  0000000002000000 - B4 (1700)
                                  0000000001000000 - B3 (1700)
                                  0000000000800000 - B2 (1900)
                                  0000000000400000 - B1 (2100)

OK
  • Now, if we want to create a mask that combines 3G B2+B1 and LTE B3+B7+B20, we do the following:
    • Look at the GW Band column for 3G band bit codes, note that:
      • 0000000000400000 - B1 (2100)
      • 0000000000800000 - B2 (1900)
    • Add together the two masks, since we are dealing with hex, 10 = A, 11 = B, 12 = C, and so on:
      • 0000000000C00000 - B1+B2
  • Perform the same task for the LTE column (notice that the mask is different than the 3G mask):
    • Look at the LTE Band column for LTE band bit codes, note that:
      • 0000000000000004 - B3
      • 0000000000000040 - B7
      • 0000000000080000 - B20
    • Add together the three masks:
      • 0000000000080044 - B3+B7+B20
  • To tie it altogether, we issue our custom band command:
    • AT!BAND=10,"B2B1-B3B7B20",0000000000C00000,0000000000080044
  • Finally, we set out custom band in slot 10:
    • AT!BAND=09

Connectivity/Router Options

  • Windows 10 will block Hotspot/ICS mode, you cannot use Windows 10's ICS with this setup.
  • Linux doesn't care, it will happily route packets all day long.
  • If you want a dead-simple setup:

Free Over-the-Air Updates

  • Sierra AirVantage FOTA
    • Use your name as Business Name
  • Get Modem FSN + IMEI with ATI
  • Change Modem Settings
    • AT+WDSC=3,x(x being the frequency of connection in minutes)
    • AT+WDSS=1,1 (Sends initial heartbeat immediately)

Additional References: