Librem 5 BroadMobi modem reports wrong (?) manufacturer/model info -- bug in firmware? Where to find documentation for the modem?

angus.ainslie · February 4, 2021, 2:11pm

There are very few M.2 modems that support voice. Most of them could but it’s due to closed firmware that the support can’t be added easily.

amosbatto · February 4, 2021, 2:28pm

The BroadMobi BM818 is based on the Qualcomm MDM9607 modem, so it is correctly reporting the maker of the cellular baseband. For more info on the modem, see: https://source.puri.sm/Librem5/community-wiki/-/wikis/Frequently-Asked-Questions#218-how-are-the-thales-cinteron-pls8-and-broadmobi-bm818-modems-different

Unfortunately, BroadMobi doesn’t provide any public documentation for its products. The AT commands listed in the manual for the Quectel EG25-G should work on the BM818, since the EG25-G and BM818 use the same Qualcomm modem.

Caliga · February 4, 2021, 2:54pm

Interesting. So, it’s essentially the same modem (or rather: chip) as in the pinephone. That might result in some synergies in the future.

amosbatto · February 4, 2021, 4:31pm

I assume that BroadMobi and Quectel license the cellular baseband core from Qualcomm, which they incorporate into their custom ASICs, so technically they are using different chips with the same baseband cores. What would be interesting to know is whether Qualcomm licenses its basebands in a way that allows licensees to modify them or do they have to treat them like unmodifiable black boxes.

irvinewade · February 5, 2021, 4:09am

Being about 1% of all AT commands, unfortunately.

I tried AT+QFLDS (seemed as if it should be harmless) and the response I received was: ERROR

Same result for AT+QFLST

What does this mean about the truth of your suggestion? I don’t know.

amosbatto · February 5, 2021, 6:01am

Did you try it this way?
AT+QFLDS=?

Each modem manufacturer can decide to implement the Qualcomm modem in their own way, so there are no guarantees. Did you get any of the AT commands to work?

irvinewade · February 5, 2021, 9:22am

Still ERROR

Yes e.g. ATI works fine
e.g. AT+CSQ works fine

amosbatto · February 5, 2021, 11:51am

@irvinewade’s tests with the AT commands suggests that the two modems are implemented very differently, so we might not get much synergy between the two modems.

Caliga · February 6, 2021, 4:40pm

If I understand that properly, then it’s the same IP core in different chips, with different firmware. Now, if someone were to try to reverse engineer both firmwares, maybe that knowledge could be helpful. You know, different implementations that in the end do similar things.
Just trying to see something positive in it

Skalman · February 7, 2021, 1:18am

It’s not all bad, there are some things that do work on both. I tried a bunch of AT commands found here https://wiki.pine64.org/images/2/2e/Quectel_EC25EC21_AT_Commands_Manual_V1.2.pdf and found that the following seem to work in the same way on Librem 5 and PinePhone:

purism@librem5:~$ sudo mmcli -m any --command="AT+GMI"
response: 'BroadMobi'
purism@librem5:~$ sudo mmcli -m any --command="AT+GMM"
response: 'BM818-E1'
purism@librem5:~$ sudo mmcli -m any --command="AT+GMR"
response: 'M1.0.0_E1.0.0.0_A1.0.0'

mobian@pinephone:~$ sudo mmcli -m any --command="AT+GMI"
response: 'Quectel'
mobian@pinephone:~$ sudo mmcli -m any --command="AT+GMM"
response: 'EG25'
mobian@pinephone:~$ sudo mmcli -m any --command="AT+GMR"
response: 'EG25GGBR07A08M2G'

AT+CPAS – Mobile Equipment Activity Status: gives 0 when idle and 4 when a call is ongoing

AT+GSN – Request International Mobile Equipment Identity (IMEI)

AT+CIMI – Request International Mobile Subscriber Identity (IMSI)

AT+CPIN? – check if PIN code has been entered OK, says “READY” if so

AT+COPS? – check current mode and currently selected operator:

purism@librem5:~$ sudo mmcli -m any --command="AT+COPS?"
response: '+COPS: 0,0,"Tele2",7'

mobian@pinephone:~$ sudo mmcli -m any --command="AT+COPS?"
response: '+COPS: 0,0,"Tele2 Comviq",7'

AT+CSQ – Signal Quality Report

AT+CLCC – List Current Calls of ME

AT+CMGF – check or set SMS Message Format, text mode or PDU mode

AT+CSCA? – Service Center Address

AT+CMGL=4 – list all SMS messages (to see them this way, chatty needs to be stopped because otherwise chatty will take care of the SMS messages and delete them from the modem)

AT+CGATT – Attachment or Detachment of PS

AT+CGDCONT? – Define PDP Context

purism@librem5:~$ sudo mmcli -m any --command="AT+CGDCONT?"
response: '+CGDCONT: 1,"IPV4V6","","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
+CGDCONT: 2,"IPV4V6","data.tre.se","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
+CGDCONT: 3,"IPV4V6","4g.tele2.se","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0'

mobian@pinephone:~$ sudo mmcli -m any --command="AT+CGDCONT?"
response: '+CGDCONT: 1,"IP","wholesale","0.0.0.0",0,0,0,0
+CGDCONT: 2,"IPV4V6","ims","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0
+CGDCONT: 3,"IPV4V6","","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,1'

AT+CGPADDR – Show PDP Address

AT+CCLK? – queries the real time clock (RTC) of the module

purism@librem5:~$ sudo mmcli -m any --command="AT+CCLK?"
response: '+CCLK: "21/02/07,00:57:47+04"'

mobian@pinephone:~$ sudo mmcli -m any --command="AT+CCLK?"
response: '+CCLK: "21/02/07,00:57:48+04"'

No idea why the timezone is “+04” but that’s what it says, on both of them.

Anyway my point was to show that there are quite a lot of commands that actually do work on both. (But far from all of them, my impression is that if you take some random AT command that works on the PinePhone then there is less than a 50/50 chance that it will work on the Librem 5.)

dos · February 7, 2021, 5:15pm

AT command set is relatively standardized and works across several vendors - but each vendor tends to also add their own custom commands that obviously won’t work on modules from other vendors. And in the case of those two modems, the vendors who implemented those additional commands are BroadMobi and Quectel, not Qualcomm (although some of the custom commands do seem to come from some Qualcomm’s reference implementation, I guess).

irvinewade · February 10, 2021, 1:03am

Because the timezone is in “quarters of an hour” i.e. 15 minute intervals. So “+04” means GMT+1 i.e. 1 hour ahead of GMT, which would be about right for a number of countries in western Europe.

I would suppose that this design allows the response to represent timezones that are e.g. 9.5 hours ahead of GMT using only two digits (e.g. +38), rather than the usual four digits (e.g. 0930).

On the other hand, which lamer decided to build a Y2K problem in by saving two more digits?

irvinewade · February 10, 2021, 1:27am

What does AT+CBC give on the PP? (get battery charge status)

On the L5:

AT+CBC
+CBC: 2,0

which means “charging has been finished” (not correct on my L5 right now) and “battery level is 0%” (empty? or full? wrong anyway).

I would suppose that the modem has no idea what the battery level is. Do some modems have their own battery?

dos · February 10, 2021, 1:54am

That’s correct. Modem modules like that can be used almost autonomously, serving as a communication brain for some data collecting microcontroller etc. They sometimes even include things like HTTP clients that can be used via AT commands, and some also allow to attach additional modules to them, for instance to get WiFi networking.

Of course the modem as used on the Librem 5 has no idea about the state of the battery or other peripherals.

Skalman · February 10, 2021, 7:15am

I get this on the PinePhone:

mobian@pinephone:~$ sudo mmcli -m any --command="AT+CBC=?"
response: '+CBC: (0-2),(0-100),(voltage)'
mobian@pinephone:~$ sudo mmcli -m any --command="AT+CBC"
response: '+CBC: 0,94,4115'

Same commands on the Librem 5:

purism@librem5:~$ sudo mmcli -m any --command="AT+CBC=?"
response: '+CBC: (0-3),(0-100)'
purism@librem5:~$ sudo mmcli -m any --command="AT+CBC"
response: '+CBC: 2,0'

So on the PinePhone there is a third piece of info there, apparently voltage in millivolts. And the charge level was 94%. So the PinePhone modem seems to have its own battery. I wonder, does this mean the modem is still active, using its internal battery, even after I turn off the PinePhone?

irvinewade · February 10, 2021, 7:32am

Is (was) this equal to the actual charge level of the phone’s battery?

I wouldn’t accept that conclusion necessarily but if that is correct then that would be a major concern!

Is it possible that mmcli is intercepting the specific command?

I’m using minicom to talk directly to the modem (on an L5).

Skalman · February 10, 2021, 7:54am

Not exactly, but both are nearly full. Looking at the phone battery in Settings–>power that shows 99%.

Starting a small experiment now, disconnecting the charging cable and turning the PinePhone off, the plan is to leave it off for a few hours and then turning it on and directly checking both battery charge levels. If the “modem battery” charge level is significantly lower then, that would indicate the existence of such a battery.

Jan2 · February 10, 2021, 8:37am

I always thought that there exist only 24 Time zones +12 to the East and -12 West of Greenwich (ore A…M -ex.J and N…Y). A precise description can be find in ISO 8601.
So a timezone defined in 15 min. is new to me.

Skalman · February 10, 2021, 8:44am

New to me as well. For example India has UTC+05:30: https://en.wikipedia.org/wiki/List_of_time_zones_by_country

irvinewade · February 10, 2021, 9:10am

A…M -ex.J and N…Y, plus Z are the military time zones. They are completely inadequate to represent all the world’s timezones (as they don’t allow half-hours, never mind about quarter-hours).

Of the military time zones, only Z is valid in ISO 8601, I believe. However a system processing a date in ISO 8601 format may have been implemented to be more tolerant.

Other systems still, like RFC 2822 (mail header format), explicitly allow military time zones, but only as an “obsolete” specification e.g. for compatibility with very old stored email.