The baseband modem in my Librem 5 Birch is a BroadMobi BM818-E1 modem. However, the following modemmanager command says “QUALCOMM INCORPORATED” which I think is wrong:
purism@pureos:~$ mmcli -L /org/freedesktop/ModemManager1/Modem/0 [QUALCOMM INCORPORATED] 0
It can also be seen in this way:
purism@pureos:~$ mmcli -m 0 -------------------------------- General | dbus path: /org/freedesktop/ModemManager1/Modem/0 | device id: [...] -------------------------------- Hardware | manufacturer: QUALCOMM INCORPORATED | model: 0 | firmware revision: MPSS.JO.2.0.2.c1.1-00032-9607_GENNS_PACK-1 1 [Feb 25 2019 01:00:00] | carrier config: default | h/w revision: 10000 | supported: gsm-umts, lte | current: gsm-umts, lte | equipment id: [...]
There, it says “manufacturer: QUALCOMM INCORPORATED” and “model: 0”.
It is possible to see correct manufacturer and model info by using the following “AT” command instead:
purism@pureos:~$ sudo mmcli -m 0 --command=ATI response: 'Manufacturer: BroadMobi Model: BM818-E1 Revision: M1.0.0_E184.108.40.206_A1.0.0 IMEI: [...] +GCAP: +CGSM' [...]
So it seems like the “AT” command gives correct manufacturer and model information, while the “mmcli -L” and “mmcli -m 0” commands give wrong results.
Having experimented with some ModemManager code changes, I think this has to do with the different ways that ModemManager can talk to the modem. The information shown when doing “mmcli -L” or “mmcli -m 0” has been fetched by ModemManager using QMI (https://en.wikipedia.org/wiki/Qualcomm_MSM_Interface). This can be seen in ModemManager debug output (enabled by adding --debug in /lib/systemd/system/ModemManager.service), it looks like this:
Feb 04 09:51:11 pureos ModemManager: <debug> [1612428671.653558] [modem0] loading manufacturer... Feb 04 09:51:11 pureos ModemManager: <debug> [1612428671.653595] [modem0] loading manufacturer by calling qmi_client_dms_get_manufacturer()... Feb 04 09:51:11 pureos ModemManager: [/dev/cdc-wdm0] sent message... <<<<<< RAW: <<<<<< length = 13 <<<<<< data = 01:0C:00:00:02:01:00:02:00:21:00:00:00 Feb 04 09:51:11 pureos ModemManager: [/dev/cdc-wdm0] sent generic request (translated)... <<<<<< QMUX: <<<<<< length = 12 <<<<<< flags = 0x00 <<<<<< service = "dms" <<<<<< client = 1 <<<<<< QMI: <<<<<< flags = "none" <<<<<< transaction = 2 <<<<<< tlv_length = 0 <<<<<< message = "Get Manufacturer" (0x0021) Feb 04 09:51:11 pureos ModemManager: <debug> [1612428671.654027] [modem0/ttyUSB1/at] <-- '<CR><LF>OK<CR><LF>' Feb 04 09:51:11 pureos ModemManager: <debug> [1612428671.654381] [modem0/ttyUSB1/at] --> 'AT+CMEE=1<CR>' Feb 04 09:51:11 pureos ModemManager: [/dev/cdc-wdm0] received message... <<<<<< RAW: <<<<<< length = 44 <<<<<< data = 01:2B:00:80:02:01:02:02:00:21:00:1F:00:02:04:00:00:00:00:00:01:15:00:51:55:41:4C:43:4F:4D:4D:20:49:4E:43:4F:52:50:4F:52:41:54:45:44 Feb 04 09:51:11 pureos ModemManager: [/dev/cdc-wdm0] received generic response (translated)... <<<<<< QMUX: <<<<<< length = 43 <<<<<< flags = 0x80 <<<<<< service = "dms" <<<<<< client = 1 <<<<<< QMI: <<<<<< flags = "response" <<<<<< transaction = 2 <<<<<< tlv_length = 31 <<<<<< message = "Get Manufacturer" (0x0021) <<<<<< TLV: <<<<<< type = "Result" (0x02) <<<<<< length = 4 <<<<<< value = 00:00:00:00 <<<<<< translated = SUCCESS <<<<<< TLV: <<<<<< type = "Manufacturer" (0x01) <<<<<< length = 21 <<<<<< value = 51:55:41:4C:43:4F:4D:4D:20:49:4E:43:4F:52:50:4F:52:41:54:45:44 <<<<<< translated = QUALCOMM INCORPORATED
If I understand this correctly, the above shows how ModemManager is sending a “Get Manufacturer” request to the modem, and the modem is responding with “SUCCESS” and claiming that the manufacturer is “QUALCOMM INCORPORATED”. It looks similar for the “model” info, there is again a request and a response, the response saying that the model is “0” which is what mmcli shows.
In contrast, when using the “sudo mmcli -m 0 --command=ATI” command, ModemManager is not using QMI but it is issuing the given commad “ATI” in another way, such “AT” commands is the old way of talking to modems (a.k.a. Hayes command set, https://en.wikipedia.org/wiki/Hayes_command_set).
So is seems we can get the correct manufacturer and model info when using “AT” commands, but not when using QMI. I think it seems like a problem not with ModemManager but inside the modem itself, since ModemManager is just using the information it is given by the modem, the modem is saying that the manufacturer is “QUALCOMM INCORPORATED” which is wrong. So I think there is a bug, but maybe not in any software I have direct access to, but in the (proprietary?) firmware of the modem.
What do you think, do you agree that this seems like a bug inside the modem?
If this modem does not work well with QMI, would it be possible to tell ModemManager to skip QMI altogether and just use AT commands instead when talking to the modem?
Can we find documentation for the modem somewhere, to see if it is supposed to handle QMI?
The most official page I could find was this one http://broadmobi.com/en/module_show.php?id=18 but not much details there.
I found this https://p.globalsources.com/IMAGES/PDT/SPEC/593/K1172549593.pdf which says “Control Via AT Commands” but does not seem to mention QMI.
Also this “Operation Manual” https://fccid.io/2AON8-BM818/User-Manual/BM818-Coperation-manual-V1-4-4107101 but it’s in a strange format, hopefully there is something better?
Other ideas or thoughts on this? Is it the FSFs fault that we are stuck with such a shitty modem? Or, perhaps a rant about how all such problems are really just caused by proprietary code and how great it would be to have FOSS firmware for everything?