DW5811e with empty fw image slots / active fw image in slot 255 / fw version mismatch

[hdlr33]

Hello everyone,

Thanks a lot for all the work and knowledge shared on this repository !
I've used the autoflash script on a DW5811e (3P10Y) EM7455 airprime module. From what I can see the flashing process does succeed, but I end up with no fw images stored in the 4 devoted slots / active fw image in slot 255 (cf outputs at the bottom). Additionally the IMPREF? command shows a firmware mismatch that I've not been able to get fixed. IMPREF="" results in an error as I believe there is no available fw image in the above mentioned slots. Consequently, I assume, the module stays stuck in low power mode.

The workaround I have found however, is to issue AT!IMPREF="AUTO-SIM", which fixes the fw mismatch and let the module power on. With that, I've been able to successfully use the module in a USB adapter with ModemManager; it performs strongly: north of 150Mb/s DL, connected to a 10+km LTE tower, admittedly with a pair very decent ISKRA P58 antennas.
I would be more than happy with that, but I cannot manage to have ROOter (Goldenorb running on a Mikrotik RBM33G) connect to the modem (ie reproduce the connection process of ModemManager). Any guidance as to how to build a custom connection process within ROOter that "mimics" the way ModemManager handles this modem would be much appreciated.

Back to the modem itself, I've managed to perform an RMARESET=1 command, but it doesn't get rid of the fw mismatch and after I rerun the autoflash script I'm basically back to where I was before the rmareset. I haven't checked that so far (I currently don't have access to the PC I ran the autoflash script for the first time), but it is possible that this modem had this fw mismatch / misconfiguration beforehand. I'm running out of ideas to explore alternative routes to fix that problem and have this modem work for my use case. Any help here would be much appreciated ! Thanks

Some AT commands outputs:

ATI

Manufacturer: Sierra Wireless, Incorporated
Model: EM7455B
Revision: SWI9X30C_02.33.03.00 r8209 CARMD-EV-FRMWR2 2019/08/28 20:59:30
MEID: removed
IMEI: removed
IMEI SV: 20
FSN: LF708107740410
+GCAP: +CGSM

---

AT!IMAGE?

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID BUILD_ID
FW 1 EMPTY 0 0 0
FW 2 EMPTY 0 0 0
FW 3 EMPTY 0 0 0
FW 4 EMPTY 0 0 0
Max FW images: 4
Active FW image is at slot 255

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID BUILD_ID
PRI FF GOOD 0 0 0 002.072_000 02.33.03.00_GENERIC
Max PRI images: 50

---

AT!IMPREF?

!IMPREF:
preferred fw version: 02.20.03.00
preferred carrier name: GENERIC
preferred config name: GENERIC_002.017_000
preferred subpri index: 000
current fw version: 02.33.03.00
current carrier name: GENERIC
current config name: GENERIC_002.017_000
current subpri index: 000

fw version mismatch

---

after AT!IMPREF="AUTO-SIM"

AT!IMPREF?
!IMPREF:
preferred fw version: 00.00.00.00
preferred carrier name: AUTO-SIM
preferred config name: AUTO-SIM_000.000_000
preferred subpri index: 000
current fw version: 02.33.03.00
current carrier name: GENERIC
current config name: GENERIC_002.072_000
current subpri index: 000

[danielewood]

Those settings indicate it did the clear command, but something went wonky with the flash command.

The simple fix is to reflash and it will probably work.

[hdlr33]

Hi, thanks for your feedback.
Logs/outputs seem to indicate that the flash step and the overall script goes well, the only "errors" I have spotted deal with cat /dev/ttyUSB2 failing, but I assume it has to do with the script waiting for the modem to show back again.
I've performed the auto flash script several times but I will try again and report here if it eventually fixes the issue.
An positive update however to my initial post : for an unknown reason Rooter eventually managed to connect to the modem set with the "AUTO-SIM" config and everything seems to be working properly. I will try to investigate why, and report here if I find out.

[Leo-PL]

I've stumbled upon exactly the same issue. Here are my full logs

--2021-06-02 15:57:55--  https://git.mork.no/wwan.git/plain/scripts/swi_setusbcomp.pl
Resolving git.mork.no (git.mork.no)... 213.138.100.138, 2001:41c8:51:8a:feff:ff:fe00:e5
Connecting to git.mork.no (git.mork.no)|213.138.100.138|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 22365 (22K) [text/plain]
Saving to: ‘swi_setusbcomp.pl’

swi_setusbcomp.pl                               100%[====================================================================================================>]  21,84K  --.-KB/s    in 0,1s    

2021-06-02 15:57:55 (178 KB/s) - ‘swi_setusbcomp.pl’ saved [22365/22365]

Waiting for modem to reboot...
---
Reseting modem...
Setting MBIM Mode for Modem
Interface bitmask: 0000100D (diag,nmea,modem,mbim)
---
Running Modem Mode Switch to usbcomp=8
Running in MBIM mode (driver=cdc_mbim)
MBIM OPEN succeeded
QMI msg '0x0021' returned status = 1
MBIM QMI support verified
supports 34 QMI subsystems:
  0x00 (1.5)    'QMI_CTL'       - Control service
  0x01 (1.67)   'QMI_WDS'       - Wireless data service
  0x02 (1.14)   'QMI_DMS'       - Device management service
  0x03 (1.25)   'QMI_NAS'       - Network access service
  0x04 (1.6)    'QMI_QOS'       - Quality of service, err, service 
  0x05 (1.10)   'QMI_WMS'       - Wireless messaging service
  0x07 (1.3)    'QMI_AUTH'      - Authentication service
  0x08 (1.2)    'QMI_AT'        - AT command processor service
  0x09 (2.1)    'QMI_VOICE'     - Voice service
  0x0a (2.24)   'QMI_CAT2'      - Card application toolkit service (new)
  0x0b (1.45)   'QMI_UIM'       - UIM service
  0x0c (1.4)    'QMI_PBM'       - Phonebook service
  0x0f (1.0)    'QMI_TEST'      - Test service
  0x10 (2.0)    'QMI_LOC'       - Location service 
  0x11 (1.0)    'QMI_SAR'       - Specific absorption rate service
  0x17 (1.0)    'QMI_TS'        - Thermal sensors service
  0x18 (1.0)    'QMI_TMD'       - Thermal mitigation device service
  0x1a (1.16)   'QMI_WDA'       - Wireless data administrative service
  0x1d (1.1)    'QMI_CSVT'      - Circuit switched videotelephony service
  0x22 (1.0)    'QMI_COEX'      - Coexistence service
  0x24 (1.0)    'QMI_PDC'       - Persistent device configuration service
  0x29 (1.0)    'QMI_RFRPE'     - RF radiated performance enhancement service
  0x2a (1.0)    'QMI_DSD'       - Data system determination service
  0x2b (1.0)    'QMI_SSCTL'     - Subsystem control service
  0x2e (1.0)    'unknown'       - 
  0x30 (1.0)    'unknown'       - 
  0x31 (1.0)    'unknown'       - 
  0x36 (1.0)    'unknown'       - 
  0xe1 (1.0)    'QMI_RMS'       - Remote management service
  0xf0 (1.0)    'unknown'       - 
  0xf3 (1.0)    'unknown'       - 
  0xf5 (1.0)    'unknown'       - 
  0xf6 (1.0)    'unknown'       - 
  0xfc (1.0)    'unknown'       - 
QMI msg '0x0022' returned status = 1
Got QMI DMS client ID '3'
QMI msg '0x555b' returned status = 1
Current USB composition: 8
USB compositions:
   0 - HIP  DM    NMEA  AT    MDM1  MDM2  MDM3  MS      NOT SUPPORTED
   1 - HIP  DM    NMEA  AT    MDM1  MS                  NOT SUPPORTED
   2 - HIP  DM    NMEA  AT    NIC1  MS                  NOT SUPPORTED
   3 - HIP  DM    NMEA  AT    MDM1  NIC1  MS            NOT SUPPORTED
   4 - HIP  DM    NMEA  AT    NIC1  NIC2  NIC3  MS      NOT SUPPORTED
   5 - HIP  DM    NMEA  AT    ECM1  MS                  NOT SUPPORTED
   6 - DM   NMEA  AT    QMI                             SUPPORTED
   7 - DM   NMEA  AT    RMNET1 RMNET2 RMNET3            NOT SUPPORTED
*  8 - DM   NMEA  AT    MBIM                            SUPPORTED
   9 - MBIM                                             SUPPORTED
  10 - NMEA MBIM                                        NOT SUPPORTED
  11 - DM   MBIM                                        NOT SUPPORTED
  12 - DM   NMEA  MBIM                                  NOT SUPPORTED
  13 - Config1: comp6    Config2: comp8                 NOT SUPPORTED
  14 - Config1: comp6    Config2: comp9                 NOT SUPPORTED
  15 - Config1: comp6    Config2: comp10                NOT SUPPORTED
  16 - Config1: comp6    Config2: comp11                NOT SUPPORTED
  17 - Config1: comp6    Config2: comp12                NOT SUPPORTED
  18 - Config1: comp7    Config2: comp8                 NOT SUPPORTED
  19 - Config1: comp7    Config2: comp9                 NOT SUPPORTED
  20 - Config1: comp7    Config2: comp10                NOT SUPPORTED
  21 - Config1: comp7    Config2: comp11                NOT SUPPORTED
  22 - Config1: comp7    Config2: comp12                NOT SUPPORTED
Current setting is already '8'
QMI msg '0x0023' returned status = 1
Waiting for modem to reboot...
---
Reseting modem...

OK

OK

OK

OK
Waiting for modem to reboot...
Waiting for modem to reboot...
Waiting for modem to reboot...
Waiting for modem to reboot...
Waiting for modem to reboot...
---
Current modem settings:
AT
OK
ATE1
OK
AT!ENTERCND="A710"
OK
AT!IMPREF?
!IMPREF: 
 preferred fw version:    02.32.11.00
 preferred carrier name:  GENERIC
 preferred config name:   GENERIC_002.064_000
 preferred subpri index:  000
 current fw version:      02.33.03.00
 current carrier name:    GENERIC
 current config name:     GENERIC_002.064_000
 current subpri index:    000

 fw version mismatch

OK
AT!GOBIIMPREF?
!GOBIIMPREF: 
 preferred fw version:    02.32.11.00
 preferred carrier name:  GENERIC
 preferred config name:   GENERIC_002.064_000
 preferred subpri index:  000
 current fw version:      02.33.03.00
 current carrier name:    GENERIC
 current config name:     GENERIC_002.064_000
 current subpri index:    000

 fw version mismatch

OK
AT!USBSPEED?
SUPPORTED:Super-Speed
CURRENT  :High-Speed

OK
AT!USBSPEED=?
!USBSPEED: <max_supported_speed>
<max_supported_speed>:
  0 - High Speed
  1 - Super Speed

OK
AT!USBCOMP?
Config Index: 1
Config Type:  1 (Generic)
Interface bitmask: 0000100D (diag,nmea,modem,mbim) 

OK
AT!USBCOMP=?
!USBCOMP: 
AT!USBCOMP=<Config Index>,<Config Type>,<Interface bitmask>
  <Config Index>      - configuration index to which the composition applies, should be 1

  <Config Type>       - 1:Generic, 2:USBIF-MBIM, 3:RNDIS
                        config type 2/3 should only be used for specific Sierra PIDs: 68B1, 9068
                        customized VID/PID should use config type 1

  <Interface bitmask> - DIAG     - 0x00000001,
                        NMEA     - 0x00000004,
                        MODEM    - 0x00000008,
                        RMNET0   - 0x00000100,
                        RMNET1   - 0x00000400,
                        MBIM     - 0x00001000,
  e.g.
  10D  - diag, nmea, modem, rmnet interfaces enabled
  1009 - diag, modem, mbim interfaces enabled

  The default configuration is:
  at!usbcomp=1,1,10F

OK
AT!USBVID?
!USBVID: 
413C

OK
AT!USBPID?
!USBPID: 
APP : 81B6
BOOT: 81B5

OK
AT!USBPRODUCT?
DW5811e Snapdragon™ X7 LTE

OK
AT!PRIID?
PRI Part Number: 9904336
Revision: 001.007
Customer: Dell

Carrier PRI: None

OK
AT!SELRAT?
!SELRAT: 00, Automatic


OK
AT!BAND?
Index, Name,                        GW Band Mask     L Band Mask      TDS Band Mask
00, All bands,                      0002000007C00000 00000100130818DF 0000000000000000


OK
AT!BAND=?
Index, Name,                        GW Band Mask     L Band Mask      TDS Band Mask
00, All bands                     0002000007C00000 00000100130818DF 0000000000000000
01, Europe 3G                     0002000000400000 0000000000000000 0000000000000000
02, North America 3G              0000000004800000 0000000000000000 0000000000000000
06, Europe                        0002000000400000 00000000000800C5 0000000000000000
07, North America                 0000000004800000 000000000300185A 0000000000000000
08, WCDMA ALL                     0002000007C00000 0000000000000000 0000000000000000
09, LTE ALL                       0000000000000000 00000100130818DF 0000000000000000

                                                   0000010000000000 - B41    
                                                   0000000010000000 - B29    
                                                   0000000002000000 - B26    
                                                   0000000001000000 - B25    
                                                   0000000000080000 - B20    
                                                   0000000000001000 - B13    
                                                   0000000000000800 - B12    
                                                   0000000000000080 - B8     
                                                   0000000000000040 - B7     
                                                   0000000000000010 - B5     
                                                   0000000000000008 - B4     
                                                   0000000000000004 - B3     
                                                   0000000000000002 - B2     
                                                   0000000000000001 - B1     
                                  0002000000000000 - B8  (900)
                                  0000000004000000 - B5  (850)
                                  0000000002000000 - B4 (1700)
                                  0000000001000000 - B3 (1700)
                                  0000000000800000 - B2 (1900)
                                  0000000000400000 - B1 (2100)

OK
AT!PCINFO?
State: Low Power Mode
LPM voters - Temp:0, Volt:0, User:0, W_DISABLE:0, IMSWITCH:1, BIOS:0, LWM2M:0, OMADM:0, FOTA:0
LPM persistence - None

OK
AT!PCOFFEN?
0

OK
AT!CUSTOM?
!CUSTOM: 
             GPSENABLE          0x01
             GPSSEL             0x01
             IPV6ENABLE         0x01
             SIMLPM             0x01
             USBSERIALENABLE    0x01
             SINGLEAPNSWITCH    0x01


OK
AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
FW   1    EMPTY  0   0 0                  
FW   2    EMPTY  0   0 0                  
FW   3    EMPTY  0   0 0                  
FW   4    EMPTY  0   0 0                  
Max FW images: 4
Active FW image is at slot 255

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
PRI  FF   GOOD   0   0 0      002.072_000 02.33.03.00_GENERIC
Max PRI images: 50


OK
AT
OK
AT!IMAGE=0
OK
AT!IMAGE?
TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
FW   1    EMPTY  0   0 0                  
FW   2    EMPTY  0   0 0                  
FW   3    EMPTY  0   0 0                  
FW   4    EMPTY  0   0 0                  
Max FW images: 4
Active FW image is at slot 255

TYPE SLOT STATUS LRU FAILURES UNIQUE_ID   BUILD_ID
Max PRI images: 50


OK
Waiting for modem to reboot...
Downloading https://download.ttl.one/swi/7455/SWI9X30C_02.33.03.00_GENERIC_002.072_000.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 60.7M  100 60.7M    0     0  1913k      0  0:00:32  0:00:32 --:--:-- 2766k
Archive:  SWI9X30C_02.33.03.00_GENERIC_002.072_000.zip
  inflating: SWI9X30C_02.33.03.00.cwe  
  inflating: SWI9X30C_02.33.03.00_GENERIC_002.072_000.nvu  
---
Flashing SWI9X30C_02.33.03.00.cwe onto Generic Sierra Modem...
reseter operation finished successfully
Waiting for modem in boothold mode...
Waiting for modem in boothold mode...
Waiting for modem in boothold mode...
Waiting for modem in boothold mode...
Waiting for modem in boothold mode...
Waiting for modem in boothold mode...
Waiting for modem in boothold mode...
Found 413c:81b5
downloading cwe image: SWI9X30C_02.33.03.00.cwe (64,4 MB)...
finalizing download... (may take more than one minute, be patient)
successfully downloaded in 57,77s (1,1 MB/s)
downloading cwe image: SWI9X30C_02.33.03.00_GENERIC_002.072_000.nvu (3,3 kB)...
finalizing download... (may take more than one minute, be patient)
successfully downloaded in 0,05s (62,5 kB/s)
rebooting in normal mode...
firmware update operation finished successfully
cat: /dev/ttyUSB2: No such file or directory
Done!

So it looks like `set_modem_settings got skipped because of too short timeout, and IMPREF isn't set by script. No surprise, as my modem after flashing still advertises itself as Dell one.

[Leo-PL]

I managed to restore the modem by flashing it under Windows using Sierra's latest generic firmware. Strangely, then, firmware equipped by drivers from Dell decided to roll it back to 02.32.11.00.