Quectel EM120 FCC locked

The Quectel EM120 provided in the newer Thinkpad X1 Carbon Gen9 laptops comes FCC locked by default. There is currently no open source solution to unlock the module, although there seems to be some existing tool to do so already, as per the following Ubuntu bug report: https://bugs.launchpad.net/ubuntu/+source/modemmanager/+bug/1934286

Quoting from the bug description:

4.4 Check the modem’s status

$ mmcli --modem 0

4.5 Install and execute Lenovo’s FCC unlock app ( for Quectel modem only )

$ sudo snap install --devmode --dangerous dpr-wwan_1.0-wwan-test_amd64.snap

4.6 Enable the detected modem

$ sudo mmcli --modem 0 --enable

The dpr-wwan_1.0-wwan-test_amd64.snap package should provide the unlock tool, would be good to see if it can be integrated easily in ModemManager/libqmi/libmbim.

So where I can get this"dpr-wwan_1.0-wwan-test_amd64.snap"?

I wish I knew

So this is related?

https://forums.lenovo.com/t5/Fedora/Lenovo-X1-Gen-9-Fedora-and-Quectel-EM120R/m-p/5081326

And this snap is the only way if i understand correctly, true?

So this is related?

Exactly that, yes. Mark Pearson's post contains all the relevant information: https://forums.lenovo.com/topic/findpost/15028/5081326/5340955

There is no FCC unlock tool from Lenovo yet (at least publicly available), not for Ubuntu or for any other distribution, at least that I know of.

Good news ?! As I saw that yesterday this was published: https://snapcraft.io/lenovo-wwan-dpr

the package description says "In this version only FCC unlock App is implemented for DT SE30 product". Not sure if that applies to the X1 Carbon Gen9.

That's true , not supported yet...journalctl says:

DPR_wwan[5026]: get_product(): WWAN DPR functionality is not supported in this product
DPR_wwan[5026]: DPR and FCC unlock App is not supported by Lenovo now
systemd[1]: snap.lenovo-wwan-dpr.wwan-dpr.service: Deactivated successfully.
systemd[1]: Finished Service for snap application lenovo-wwan-dpr.wwan-dpr.

Meanwhile, Lenovo published a version of its FCC unlock app at https://snapcraft.io/lenovo-wwan-dpr . This package is designed for the EM160R, but I think both chipsets are quite similar. I've already had a quick glance at the contents of the snap. It consists of two CLI binaries linked to a shipped library called mbim2sar.so . Luckily Lenovo "forgot" to strip all binaries which is why they still contain symbols. Kudos for that one ;-)

mbim2sar.so exports several symbols, among them a function table called fcc_ops which contains various functions invoked by the CLI tools (especially the DPR_Fcc_unlock_service one). The CLI wrapper mainly verifies that you are actually running a computer with one of the Quectel modems in question installed. It does this by accessing DMI data and looking for a FCC signature string (with a value of KHOIHGIUCCHHII). My ThinkPad T14 with a Quectel EM120R-GL provides the correct signature but the CLI wrapper also tests the modem model and detects that it's not a EM160R, subsequently failing. Apart from the latter obstacle I think that I'm on the right path in that regard.

Back to mbim2sar.so. If you patch the various checks in DPR_Fcc_unlock_service away, the unlock procedure still fails. I'm fairly sure that mbim2sar.so either performs additional checks to verify that it's running on the right HW or there are some bits that differ between the two FCC unlock sequences. Not sure about that. Since the fcc_ops structure is an opaque one it's quite difficult to follow the execution path inside the library in order to understand what exactly they are doing there. There are references to some MD5 signing that happens inside the .so but I don't think that this is related to FCC unlocking (because, honestly, who would use MD5 for that ;) ).

Some success on both kernel 5.13 and 5.14, although the device path seems to have changed in 5.14.

mbim2sar.so is the one shipped as /usr/lib/mbim2sar.so in the lenovo-wwan-dpr snap, version 1.0.1-wwan-dpr-test, (obtained via snap download lenovo-wwan-dpr --edge at the time) .

C code to drive mbim2sar.so to perform the FCC unlock, note the two #defines just above main.

• You'll need to run it as root; and
• FCC unlock does not seem to persist when you power cycle; also
• if you set env VERBOSE, mbim2sar.so gets very verbose, see below!

I think this output is from a subsequent run, not a cold boot.

$ sudo env VERBOSE=1 ./fcc_unlock_v2
[09-17_17:49:21:652] mbim_proxy_connect('mbim-proxy') = 5
[09-17_17:49:21:652] mbim_read_thread is created
[09-17_17:49:21:652] > 03:00:00:00:5A:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:01:00:00:00:2A:00:00:00:0C:00:00:00:1E:00:00:00:0F:00:00:00:2F:00:64:00:65:00:76:00:2F:00:77:00:77:00:61:00:6E:00:30:00:6D:00:62:00:69:00:6D:00:30:00:
[09-17_17:49:21:652] > Header:
[09-17_17:49:21:652] > MessageLength = 90
[09-17_17:49:21:652] > MessageType =  MBIM_COMMAND_MSG (0x00000003)
[09-17_17:49:21:652] > TransactionId = 1
[09-17_17:49:21:652] > Contents:
[09-17_17:49:21:652] > DeviceServiceId = 838cf7fb-8d0d-4d7f-871e-d71dbefbb39b (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
[09-17_17:49:21:652] > CID = MBIM_CID_PROXY_CONTROL_CONFIGURATION (1)
[09-17_17:49:21:652] > CommandType = set (1)
[09-17_17:49:21:652] > InformationBufferLength = 42
[09-17_17:49:21:660] < 03:00:00:80:30:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:00:00:00:00:00:00:00:00:
[09-17_17:49:21:660] < Header:
[09-17_17:49:21:660] < MessageLength = 48
[09-17_17:49:21:660] < MessageType =  MBIM_COMMAND_DONE (0x80000003)
[09-17_17:49:21:660] < TransactionId = 1
[09-17_17:49:21:660] < Contents:
[09-17_17:49:21:660] < DeviceServiceId = 838cf7fb-8d0d-4d7f-871e-d71dbefbb39b (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
[09-17_17:49:21:660] < CID = MBIM_CID_PROXY_CONTROL_CONFIGURATION (1)
[09-17_17:49:21:660] < Status = 0
[09-17_17:49:21:660] < InformationBufferLength = 0
[09-17_17:49:21:660] GetIsMbimReady err=0, bValue=1
[09-17_17:49:21:660] mbim_device_service_subscribe_list_set(uuid=2d0c12c9-0e6a-495a-915c-8d174fe5d63c)
[09-17_17:49:21:660] > 03:00:00:00:64:00:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:13:00:00:00:01:00:00:00:34:00:00:00:01:00:00:00:0C:00:00:00:28:00:00:00:2D:0C:12:C9:0E:6A:49:5A:91:5C:8D:17:4F:E5:D6:3C:05:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:
[09-17_17:49:21:660] > Header:
[09-17_17:49:21:660] > MessageLength = 100
[09-17_17:49:21:660] > MessageType =  MBIM_COMMAND_MSG (0x00000003)
[09-17_17:49:21:660] > TransactionId = 2
[09-17_17:49:21:660] > Contents:
[09-17_17:49:21:660] > DeviceServiceId = UUID_BASIC_CONNECT (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
[09-17_17:49:21:660] > CID = MBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST (19)
[09-17_17:49:21:660] > CommandType = set (1)
[09-17_17:49:21:660] > InformationBufferLength = 52
[09-17_17:49:21:660] < 03:00:00:80:64:00:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:13:00:00:00:00:00:00:00:34:00:00:00:01:00:00:00:0C:00:00:00:28:00:00:00:2D:0C:12:C9:0E:6A:49:5A:91:5C:8D:17:4F:E5:D6:3C:05:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:
[09-17_17:49:21:660] < Header:
[09-17_17:49:21:660] < MessageLength = 100
[09-17_17:49:21:660] < MessageType =  MBIM_COMMAND_DONE (0x80000003)
[09-17_17:49:21:660] < TransactionId = 2
[09-17_17:49:21:660] < Contents:
[09-17_17:49:21:660] < DeviceServiceId = UUID_BASIC_CONNECT (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
[09-17_17:49:21:660] < CID = MBIM_CID_DEVICE_SERVICE_SUBSCRIBE_LIST (19)
[09-17_17:49:21:660] < Status = 0
[09-17_17:49:21:660] < InformationBufferLength = 52
[09-17_17:49:21:660] FccUnlock
[09-17_17:49:21:660] SMBIOS 3.2.0 present.
[09-17_17:49:21:660] Table at 0x90CA4000.
[09-17_17:49:21:660] Handle 0x0030, DMI type 133, 5 bytes
[09-17_17:49:21:660] String 1
[09-17_17:49:21:660] KHOIHGIUCCHHII
[09-17_17:49:21:660] mbim_radio_state_query()
[09-17_17:49:21:660] > 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00:
[09-17_17:49:21:660] > Header:
[09-17_17:49:21:660] > MessageLength = 48
[09-17_17:49:21:660] > MessageType =  MBIM_COMMAND_MSG (0x00000003)
[09-17_17:49:21:660] > TransactionId = 3
[09-17_17:49:21:660] > Contents:
[09-17_17:49:21:660] > DeviceServiceId = 11223344-5566-7788-99aa-bbccddeeff11 (11223344-5566-7788-99aa-bbccddeeff11)
[09-17_17:49:21:660] > CID = Unknow (1)
[09-17_17:49:21:660] > CommandType = query (0)
[09-17_17:49:21:660] > InformationBufferLength = 0
[09-17_17:49:21:665] < 03:00:00:80:34:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:01:00:00:00:
[09-17_17:49:21:665] < Header:
[09-17_17:49:21:665] < MessageLength = 52
[09-17_17:49:21:665] < MessageType =  MBIM_COMMAND_DONE (0x80000003)
[09-17_17:49:21:665] < TransactionId = 3
[09-17_17:49:21:665] < Contents:
[09-17_17:49:21:665] < DeviceServiceId = 11223344-5566-7788-99aa-bbccddeeff11 (11223344-5566-7788-99aa-bbccddeeff11)
[09-17_17:49:21:665] < CID = Unknow (1)
[09-17_17:49:21:665] < Status = 0
[09-17_17:49:21:665] < InformationBufferLength = 4
[09-17_17:49:21:665] HwRadioState: 1, SwRadioState: 0
[09-17_17:49:21:665] FccUnlock err=0
FCC unlock completed successfully
[09-17_17:49:21:665] mbim_read_thread exit
[09-17_17:49:21:665] UnInit

Looks like the secret is to send a messsage with service ID 11223344-5566-7788-99aa-bbccddeeff11.

Great! it works for me

Click to expand

de set. 17 19:51:50 hiro systemd[1]: Started Modem Manager.
de set. 17 19:51:51 hiro ModemManager[39139]: opening device...
de set. 17 19:51:51 hiro ModemManager[39139]: cannot connect to proxy: Could not connect: Connection refused
de set. 17 19:51:51 hiro ModemManager[39139]: spawning new mbim-proxy (try 1)...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Fallback to default max control message size: 4096
de set. 17 19:51:52 hiro ModemManager[39139]: <info>  [wwan0mbim0/mbim] MBIM device is not QMI capable
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] channel destroyed
de set. 17 19:51:52 hiro ModemManager[39139]: <info>  [base-manager] couldn't check support for device '/sys/devices/pci0000:00/0000:00:14.0/usb4/4-1/4-1.4': not supported by any plugin
de set. 17 19:51:52 hiro ModemManager[39139]: <info>  [base-manager] couldn't check support for device '/sys/devices/pci0000:00/0000:00:14.3': not supported by any plugin
de set. 17 19:51:52 hiro ModemManager[39139]: <info>  [device /sys/devices/pci0000:00/0000:00:1c.0/0000:08:00.0] creating modem with plugin 'quectel' and '4' ports
de set. 17 19:51:52 hiro ModemManager[39139]: <info>  [base-manager] modem for device '/sys/devices/pci0000:00/0000:00:1c.0/0000:08:00.0' successfully created
de set. 17 19:51:52 hiro ModemManager[39139]: opening device...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Fallback to default max control message size: 4096
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Opening device with flags 'version-info, proxy, mbim, expect-indications'...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] created endpoint
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] creating MBIM device...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] MBIM device created
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] opening MBIM device...
de set. 17 19:51:52 hiro ModemManager[39139]: opening device...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Fallback to default max control message size: 4096
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] MBIM device open
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Checking version info (15 retries)...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] QMI Device supports 31 services:
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    ctl (1.5)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    wds (1.155)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    dms (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    nas (1.25)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    qos (1.14)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    wms (1.10)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    auth (1.13)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    at (1.4)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    voice (2.1)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    cat2 (2.24)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    uim (1.77)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    pbm (1.4)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    test (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    loc (2.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    sar (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    ts (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    tmd (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    wda (1.20)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    csvt (1.1)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    coex (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    pdc (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    rfrpe (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    dsd (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x30] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x31] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x36] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x44] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x49] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x4a] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x4d] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0]    unknown [0x4e] (1.0)
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Enabling QMI indications via MBIM...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] enabled QMI indications via MBIM
de set. 17 19:51:52 hiro ModemManager[39139]: <info>  [modem0/wwan0mbim0/mbim] MBIM device is QMI capable
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Allocating new client ID...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Registered 'dms' (version 1.0) client with ID '1'
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Allocating new client ID...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Registered 'nas' (version 1.25) client with ID '5'
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Allocating new client ID...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Registered 'loc' (version 2.0) client with ID '1'
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Allocating new client ID...
de set. 17 19:51:52 hiro ModemManager[39139]: [/dev/wwan0mbim0] Registered 'pdc' (version 1.0) client with ID '1'
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] QMI-based capability and mode switching support enabled
de set. 17 19:51:53 hiro ModemManager[39139]: <warn>  [modem0/sim0] couldn't load list of emergency numbers: Failed to parse CRSM query result '+CRSM: 148,8,""'
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] state changed (unknown -> disabled)
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] state changed (disabled -> enabling)
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] power state updated: on
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] state changed (enabling -> enabled)
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] 3GPP registration state changed (unknown -> registering)
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] 3GPP registration state changed (registering -> home)
de set. 17 19:51:53 hiro ModemManager[39139]: <info>  [modem0] state changed (enabled -> registered)
de set. 17 19:52:18 hiro ModemManager[39139]: <info>  [modem0] simple connect started...
de set. 17 19:52:18 hiro ModemManager[39139]: <info>  [modem0] simple connect state (4/8): wait to get fully enabled
de set. 17 19:52:18 hiro ModemManager[39139]: <info>  [modem0] simple connect state (5/8): register
de set. 17 19:52:18 hiro ModemManager[39139]: <info>  [modem0] simple connect state (6/8): bearer
de set. 17 19:52:18 hiro ModemManager[39139]: <info>  [modem0] simple connect state (7/8): connect
de set. 17 19:52:18 hiro ModemManager[39139]: <info>  [modem0] state changed (registered -> connecting)
de set. 17 19:52:19 hiro ModemManager[39139]: <info>  [modem0] state changed (connecting -> connected)
de set. 17 19:52:19 hiro ModemManager[39139]: <info>  [modem0] simple connect state (8/8): all done

Could you run a strace of that program? Now I'm thinking there may be some additional thing run just after the device services query; i.e. in this chunk:

[09-17_17:49:21:660] FccUnlock
[09-17_17:49:21:660] SMBIOS 3.2.0 present.
[09-17_17:49:21:660] Table at 0x90CA4000.
[09-17_17:49:21:660] Handle 0x0030, DMI type 133, 5 bytes
[09-17_17:49:21:660] String 1
[09-17_17:49:21:660] KHOIHGIUCCHHII

Could I send you by email or another channel? I think that it prints out service tag or maybe other sensitive data.

Meanwhile, here's a cold boot VERBOSE output: https://gist.github.com/joar/416f37fe81558f5be0d5131018eb7f2a#file-fcc_unlock-output-console

It differs from the original output above.

Here's an strace from fcc_unlock_v2 following a firmware crash which may or may not be equivalent to cold boot: https://gist.github.com/joar/6d39755dced1275c3f7fb6f31b0d0078

@joar Thanks for sharing this piece of code, it worked on my Quectel EM120R-GL on my ThinkPad P14s Gen2 AMD running current Ubuntu 21.10. However, after a few minutes connected over LTE the modem's firmware crashes. I tried a few times, after rebooting, hoping it was a one-time-bad-luck but it turned out to be constantly repro, and I have not managed to gather actionable feedback from dmesg. All I can say is that I verified it was working and was stable under a Windows 10 (booted from a USB drive).

If you know what I should collect, don't hesitate, although I doubt you can do much about it.

FTR I've also opened a case on Lenovo support asking for the unlocking tool to be made available, because so far their model is non fonctional to me, and that's a first for a lenovo. It seems, though, those FCC locks are mroe and more common and not specific to this Quectel model ?

Thank you so much! This resolved my issue on a Lenovo X1 Yoga (Gen 6): #455 (closed)

Replying after a while, it looks like on my system (ThinkPad P14s Gen2 AMD, uptodate firmware) with Ubuntu 21.10:

• sudo VERBOSE=1 ./fcc-unlock with lenovo-wwan-dpr/1.0.2-wwan-dpr snap works and unlocks the modem
• I can connect to my provider (Sosh/Orange)
• when I try to exercise the modem for more than just a ping (browse the web, nperf), the firmware is crashing

kernel logs do not show more than:

[ 686.115025] mhi-pci-generic 0000:05:00.0: firmware crashed (7) [ 686.115045] mhi-pci-generic 0000:05:00.0: firmware crashed (6)

This is 5.13.0-23 from Ubuntu, is anyone else experiencing something similar on such a setup?

Great, meanwhile I have asked Nitin, the lenovo packager of snap, if the snap will cover other products and machines, here the comes the reply:

Will Quectel EM120R be supported by this snap package?

Yes

If yes are there any dates scheduled?

We are currently working to support X1 Yoga Gen 6 & X1 Carbon Gen 9 and release over SNAP. Also , we are evaluating x13 yoga g2 now and will plan to release it also. Its still work in progress and I assume it could be available in next few months.

That's definitely good to know, but as you might imagine, I'd prefer if we could manage to get that into ModemManager/libqmi instead, just as it worked out with the Foxconn modems ;)

Sure, i am completely agree with that

Snap has been updated to new version, still no support but THINKEDGE_SE30:

d’ag. 30 14:32:07 hiro DPR_Fcc_unlock_service[55823]: main(): FCC unlock app started
d’ag. 30 14:32:07 hiro DPR_Fcc_unlock_service[55823]: MACHINE = [-1] --- THINKEDGE_SE30 = [4]
d’ag. 30 14:32:07 hiro DPR_Fcc_unlock_service[55823]: WWAN is not supported in this machine

It seems that snap's mbim2sar.so changed their functions a little, though.

mentioned in commit aleksm/libmbim@5867033d

mentioned in commit aleksm/libmbim@652f6ad5

mentioned in merge request libmbim!97 (merged)

mentioned in commit aleksm/libmbim@3f39b023

@joar @aleixq I have created two merge requests in libmbim adding support for this operation, one is on top of git master (meson only) and the other one is on top of 1.26.x (autotools+meson)

Can any of you build one of those branches, and then after a system reboot run sudo mbimcli -d /dev/wwan0mbim0 -p -v --quectel-query-fcc-unlock?

sure @aleksm . Here the responses:

return of libmbim!97 (merged)

sudo mbimcli -d /dev/wwan0mbim0 -p -v --quectel-query-fcc-unlock
[20 de set. 2021, 22:26:08] [Debug] opening device...
[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Fallback to default max control message size: 4096
[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 92
<<<<<<   data   = 03:00:00:00:5C:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:01:00:00:00:2C:00:00:00:0C:00:00:00:1E:00:00:00:1E:00:00:00:2F:00:64:00:65:00:76:00:2F:00:77:00:77:00:61:00:6E:00:30:00:6D:00:62:00:69:00:6D:00:30:00:00:00

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 92
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 1
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
<<<<<<   cid     = 'configuration' (0x00000001)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   DevicePath = '/dev/wwan0mbim0'
<<<<<<   Timeout = '30'

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:00:00:00:00:00:00:00:00

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 1
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
>>>>>>   cid          = 'configuration' (0x00000001)

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 16
<<<<<<   data   = 01:00:00:00:10:00:00:00:02:00:00:00:00:10:00:00

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 16
<<<<<<   type        = open (0x00000001)
<<<<<<   transaction = 2
<<<<<< Contents:
<<<<<<   max control transfer = 4096

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 01:00:00:80:10:00:00:00:02:00:00:00:00:00:00:00

[20 de set. 2021, 22:26:08] [Debug] MBIM Device at '/dev/wwan0mbim0' ready
[20 de set. 2021, 22:26:08] [Debug] Asynchronously running FCC unlock...
[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 3
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
<<<<<<   cid     = 'fcc-unlock' (0x00000001)
<<<<<<   type    = 'query' (0x00000000)

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 52
>>>>>>   data   = 03:00:00:80:34:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:04:00:00:00

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 52
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 3
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
>>>>>>   cid          = 'fcc-unlock' (0x00000001)
>>>>>> Fields:
>>>>>>   HwRadioState = '(null)'
>>>>>>   SwRadioState = 'off'

[/dev/wwan0mbim0] Radio state retrieved after FCC unlock:
             Hardware radio state: 'unknown'
             Software radio state: 'off'
[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] closing device...
[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 12
<<<<<<   data   = 02:00:00:00:0C:00:00:00:04:00:00:00

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 12
<<<<<<   type        = close (0x00000002)
<<<<<<   transaction = 4

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 02:00:00:80:10:00:00:00:04:00:00:00:00:00:00:00

[20 de set. 2021, 22:26:08] [Debug] [/dev/wwan0mbim0] channel destroyed
[20 de set. 2021, 22:26:08] [Debug] Device closed

return of libmbim!98 (closed)

sudo mbimcli -d /dev/wwan0mbim0 -p -v --quectel-query-fcc-unlock
[20 de set. 2021, 22:42:07] [Debug] opening device...
[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Fallback to default max control message size: 4096
[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 92
<<<<<<   data   = 03:00:00:00:5C:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:01:00:00:00:2C:00:00:00:0C:00:00:00:1E:00:00:00:1E:00:00:00:2F:00:64:00:65:00:76:00:2F:00:77:00:77:00:61:00:6E:00:30:00:6D:00:62:00:69:00:6D:00:30:00:00:00

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 92
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 1
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
<<<<<<   cid     = 'configuration' (0x00000001)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   DevicePath = '/dev/wwan0mbim0'
<<<<<<   Timeout = '30'

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:00:00:00:00:00:00:00:00

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 1
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
>>>>>>   cid          = 'configuration' (0x00000001)

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 16
<<<<<<   data   = 01:00:00:00:10:00:00:00:02:00:00:00:00:10:00:00

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 16
<<<<<<   type        = open (0x00000001)
<<<<<<   transaction = 2
<<<<<< Contents:
<<<<<<   max control transfer = 4096

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 01:00:00:80:10:00:00:00:02:00:00:00:00:00:00:00

[20 de set. 2021, 22:42:07] [Debug] MBIM Device at '/dev/wwan0mbim0' ready
[20 de set. 2021, 22:42:07] [Debug] Asynchronously running FCC unlock...
[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 3
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
<<<<<<   cid     = 'fcc-unlock' (0x00000001)
<<<<<<   type    = 'query' (0x00000000)

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 52
>>>>>>   data   = 03:00:00:80:34:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:04:00:00:00

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 52
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 3
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
>>>>>>   cid          = 'fcc-unlock' (0x00000001)
>>>>>> Fields:
>>>>>>   HwRadioState = '(null)'
>>>>>>   SwRadioState = 'off'

[/dev/wwan0mbim0] Radio state retrieved after FCC unlock:
             Hardware radio state: 'unknown'
             Software radio state: 'off'
[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 12
<<<<<<   data   = 02:00:00:00:0C:00:00:00:04:00:00:00

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 12
<<<<<<   type        = close (0x00000002)
<<<<<<   transaction = 4

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 02:00:00:80:10:00:00:00:04:00:00:00:00:00:00:00

[20 de set. 2021, 22:42:07] [Debug] [/dev/wwan0mbim0] channel destroyed
[20 de set. 2021, 22:42:07] [Debug] Device closed

The original query is this:

[09-17_17:49:21:660] > 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00:

Our query is this:

<<<<<<   data   = 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00

The original response is:

[09-17_17:49:21:665] < 03:00:00:80:34:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:01:00:00:00:

Our response is this:

>>>>>>   data   = 03:00:00:80:34:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:04:00:00:00

The information buffer in the response is different, we're getting 0x0004 instead of 0x0001 for the HW radio state.

So there must be something else missing. Maybe we do need to run the explicit query of device services before the FCC unlock?

Can you try the following?

$ sudo systemctl disable ModemManager  // so that it's not started on next boot
$ sudo shutdown -h now // fully shutdown to make sure the WWAN module is shutdown
// manually boot the laptop
$ sudo /usr/libexec/mbim-proxy --no-exit --verbose
// in another terminal now:
$ sudo mbimcli -d /dev/wwan0mbim0 --query-device-services -p
$ sudo mbimcli -d /dev/wwan0mbim0 --quectel-query-fcc-unlock -p

That would be still a bit different, but more similar to what we can see in the original log. If that doesn't work, I'll add the implicit device services query in the same fcc unlock operation itself.

sudo /usr/lib/mbim-proxy --no-exit --verbose

sudo /usr/lib/mbim-proxy --no-exit --verbose
[21 de set. 2021, 10:35:34] [Debug] creating UNIX socket service...
[21 de set. 2021, 10:35:34] [Debug] starting UNIX socket service at 'mbim-proxy'...
[21 de set. 2021, 10:35:34] [Debug] proxy will remain running if unused
[21 de set. 2021, 10:35:56] [Debug] [client 1] connection open...
[21 de set. 2021, 10:35:56] [Debug] [client 1,0x00000001] request to configure proxy
[21 de set. 2021, 10:35:56] [Debug] opening device...
[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Couldn't query maximum message size: IOCTL_WDM_MAX_COMMAND failed: L’operació ioctl() no s’adequa al dispositiu
[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Fallback to default max control message size: 4096
[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 16
<<<<<<   data   = 01:00:00:00:10:00:00:00:01:00:00:00:00:10:00:00

[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 16
<<<<<<   type        = open (0x00000001)
<<<<<<   transaction = 1
<<<<<< Contents:
<<<<<<   max control transfer = 4096

[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 01:00:00:80:10:00:00:00:01:00:00:00:00:00:00:00

[21 de set. 2021, 10:35:56] [Debug] [client 1,0x00000001] proxy configured
[21 de set. 2021, 10:35:56] [Debug] [client 1] connection to MBIM device '/dev/wwan0mbim0' established
[21 de set. 2021, 10:35:56] [Debug] [client 1,0x00000003] forwarding request to device: basic-connect, query, device-services
[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:10:00:00:00:00:00:00:00:00:00:00:00

[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 2
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'device-services' (0x00000010)
<<<<<<   type    = 'query' (0x00000000)

[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 144
>>>>>>   data   = 07:00:00:80:90:00:00:00:00:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:02:00:00:00:64:00:00:00:01:00:00:00:1C:00:00:00:1E:00:00:00:3C:00:00:00:28:00:00:00:00:00:00:00:00:00:00:00:32:00:31:00:34:00:30:00:36:00:30:00:36:00:31:00:32:00:38:00:35:00:37:00:36:00:30:00:34:00:00:00:38:00:39:00:33:00:34:00:35:00:37:00:31:00:30:00:30:00:32:00:31:00:30:00:32:00:33:00:37:00:36:00:30:00:34:00:30:00:46:00

[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 144
>>>>>>   type        = indicate-status (0x80000007)
>>>>>>   transaction = 0
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid     = 'subscriber-ready-status' (0x00000002)
>>>>>> Fields:
>>>>>>   ReadyState = 'initialized'
>>>>>>   SubscriberId = '214060612857604'
>>>>>>   SimIccId = '8934571002102376040F'
>>>>>>   ReadyInfo = 'none'
>>>>>>   TelephoneNumbersCount = '0'
>>>>>>   TelephoneNumbers = ''

[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 1008
>>>>>>   data   = 03:00:00:80:F0:03:00:00:02:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:10:00:00:00:00:00:00:00:C0:03:00:00:11:00:00:00:00:00:00:00:90:00:00:00:6C:00:00:00:FC:00:00:00:30:00:00:00:2C:01:00:00:20:00:00:00:4C:01:00:00:2C:00:00:00:78:01:00:00:28:00:00:00:A0:01:00:00:24:00:00:00:C4:01:00:00:20:00:00:00:E4:01:00:00:20:00:00:00:04:02:00:00:38:00:00:00:3C:02:00:00:20:00:00:00:5C:02:00:00:34:00:00:00:90:02:00:00:3C:00:00:00:CC:02:00:00:44:00:00:00:10:03:00:00:4C:00:00:00:5C:03:00:00:24:00:00:00:80:03:00:00:20:00:00:00:A0:03:00:00:20:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:00:00:00:00:00:00:00:00:14:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:06:00:00:00:07:00:00:00:08:00:00:00:09:00:00:00:0A:00:00:00:0B:00:00:00:0C:00:00:00:0D:00:00:00:0F:00:00:00:10:00:00:00:13:00:00:00:14:00:00:00:15:00:00:00:16:00:00:00:17:00:00:00:53:3F:BE:EB:14:FE:44:67:9F:90:33:A2:23:E5:6C:3F:00:00:00:00:00:00:00:00:05:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:E5:50:A0:C8:5E:82:47:9E:82:F7:10:AB:F4:C3:35:1F:00:00:00:00:00:00:00:00:01:00:00:00:01:00:00:00:4B:F3:84:76:1E:6A:41:DB:B1:D8:BE:D2:89:C2:5B:DB:00:00:00:00:00:00:00:00:04:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:D8:F2:01:31:FC:B5:4E:17:86:02:D6:ED:38:16:16:4C:00:00:00:00:00:00:00:00:03:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:1D:2B:5F:F7:0A:A1:48:B2:AA:52:50:F1:57:67:17:4E:00:00:00:00:00:00:00:00:02:00:00:00:01:00:00:00:03:00:00:00:D1:A3:0B:C2:F9:7A:6E:43:BF:65:C7:E2:4F:B0:F0:D3:00:00:00:00:00:00:00:00:01:00:00:00:01:00:00:00:88:3B:7C:26:98:5F:43:FA:98:04:27:D7:FB:80:95:9C:00:00:00:00:00:00:00:00:01:00:00:00:01:00:00:00:2D:0C:12:C9:0E:6A:49:5A:91:5C:8D:17:4F:E5:D6:3C:00:00:00:00:00:00:00:00:07:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:07:00:00:00:09:00:00:00:E9:F7:DE:A2:FE:AF:40:09:93:CE:90:A3:69:41:03:B6:00:00:00:00:00:00:00:00:01:00:00:00:01:00:00:00:59:67:BD:CC:7F:D2:49:A2:9F:5C:B2:E7:0E:52:7D:B3:00:00:00:00:00:00:00:00:06:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:09:00:00:00:0A:00:00:00:64:27:01:5F:57:9D:48:F5:8C:54:F4:3E:D1:E7:6F:83:00:00:00:00:00:00:00:00:08:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:06:00:00:00:07:00:00:00:08:00:00:00:C2:F6:58:8E:F0:37:4B:C9:86:65:F4:D4:4B:D0:93:67:00:00:00:00:00:00:00:00:0A:00:00:00:01:00:00:00:02:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:06:00:00:00:07:00:00:00:08:00:00:00:09:00:00:00:0A:00:00:00:3D:01:DC:C5:FE:F5:4D:05:0D:3A:BE:F7:05:8E:9A:AF:00:00:00:00:00:00:00:00:0C:00:00:00:01:00:00:00:03:00:00:00:04:00:00:00:05:00:00:00:06:00:00:00:07:00:00:00:08:00:00:00:09:00:00:00:0A:00:00:00:0B:00:00:00:0C:00:00:00:0E:00:00:00:68:22:3D:04:9F:6C:4E:0F:82:2D:28:44:1F:B7:23:40:00:00:00:00:00:00:00:00:02:00:00:00:01:00:00:00:02:00:00:00:8D:8B:9E:BA:37:BE:44:9B:8F:1E:61:CB:03:4A:70:2E:00:00:00:00:00:00:00:00:01:00:00:00:0A:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:00:00:00:00:00:00:00:00:01:00:00:00:01:00:00:00

[21 de set. 2021, 10:35:56] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 1008
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 2
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'device-services' (0x00000010)
>>>>>> Fields:
>>>>>>   DeviceServicesCount = '17'
>>>>>>   MaxDssSessions = '0'
>>>>>>   DeviceServices = '{
>>>>>>     [0] = {
>>>>>>           DeviceServiceId = 'a289cc33-bcbb-8b4f-b6b0-133ec2aae6df'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '20'
>>>>>>           Cids = '1,2,3,4,5,6,7,8,9,10,11,12,13,15,16,19,20,21,22,23'
>>>>>>     },
>>>>>>     [1] = {
>>>>>>           DeviceServiceId = '533fbeeb-14fe-4467-9f90-33a223e56c3f'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '5'
>>>>>>           Cids = '1,2,3,4,5'
>>>>>>     },
>>>>>>     [2] = {
>>>>>>           DeviceServiceId = 'e550a0c8-5e82-479e-82f7-10abf4c3351f'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '1'
>>>>>>           Cids = '1'
>>>>>>     },
>>>>>>     [3] = {
>>>>>>           DeviceServiceId = '4bf38476-1e6a-41db-b1d8-bed289c25bdb'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '4'
>>>>>>           Cids = '1,2,3,4'
>>>>>>     },
>>>>>>     [4] = {
>>>>>>           DeviceServiceId = 'd8f20131-fcb5-4e17-8602-d6ed3816164c'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '3'
>>>>>>           Cids = '1,2,3'
>>>>>>     },
>>>>>>     [5] = {
>>>>>>           DeviceServiceId = '1d2b5ff7-0aa1-48b2-aa52-50f15767174e'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '2'
>>>>>>           Cids = '1,3'
>>>>>>     },
>>>>>>     [6] = {
>>>>>>           DeviceServiceId = 'd1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '1'
>>>>>>           Cids = '1'
>>>>>>     },
>>>>>>     [7] = {
>>>>>>           DeviceServiceId = '883b7c26-985f-43fa-9804-27d7fb80959c'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '1'
>>>>>>           Cids = '1'
>>>>>>     },
>>>>>>     [8] = {
>>>>>>           DeviceServiceId = '2d0c12c9-0e6a-495a-915c-8d174fe5d63c'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '7'
>>>>>>           Cids = '1,2,3,4,5,7,9'
>>>>>>     },
>>>>>>     [9] = {
>>>>>>           DeviceServiceId = 'e9f7dea2-feaf-4009-93ce-90a3694103b6'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '1'
>>>>>>           Cids = '1'
>>>>>>     },
>>>>>>     [10] = {
>>>>>>           DeviceServiceId = '5967bdcc-7fd2-49a2-9f5c-b2e70e527db3'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '6'
>>>>>>           Cids = '1,2,3,4,9,10'
>>>>>>     },
>>>>>>     [11] = {
>>>>>>           DeviceServiceId = '6427015f-579d-48f5-8c54-f43ed1e76f83'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '8'
>>>>>>           Cids = '1,2,3,4,5,6,7,8'
>>>>>>     },
>>>>>>     [12] = {
>>>>>>           DeviceServiceId = 'c2f6588e-f037-4bc9-8665-f4d44bd09367'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '10'
>>>>>>           Cids = '1,2,3,4,5,6,7,8,9,10'
>>>>>>     },
>>>>>>     [13] = {
>>>>>>           DeviceServiceId = '3d01dcc5-fef5-4d05-0d3a-bef7058e9aaf'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '12'
>>>>>>           Cids = '1,3,4,5,6,7,8,9,10,11,12,14'
>>>>>>     },
>>>>>>     [14] = {
>>>>>>           DeviceServiceId = '68223d04-9f6c-4e0f-822d-28441fb72340'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '2'
>>>>>>           Cids = '1,2'
>>>>>>     },
>>>>>>     [15] = {
>>>>>>           DeviceServiceId = '8d8b9eba-37be-449b-8f1e-61cb034a702e'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '1'
>>>>>>           Cids = '10'
>>>>>>     },
>>>>>>     [16] = {
>>>>>>           DeviceServiceId = '11223344-5566-7788-99aa-bbccddeeff11'
>>>>>>           DssPayload = '0'
>>>>>>           MaxDssInstances = '0'
>>>>>>           CidsCount = '1'
>>>>>>           Cids = '1'
>>>>>>     },
>>>>>>   }'

[21 de set. 2021, 10:35:56] [Debug] [client 1,0x00000003] response from device received
[21 de set. 2021, 10:35:56] [Debug] [client 1,0x00000004] requested explicit MBIM channel close
[21 de set. 2021, 10:35:56] [Debug] [client 1] connection closed
[21 de set. 2021, 10:36:27] [Debug] [client 2] connection open...
[21 de set. 2021, 10:36:27] [Debug] [client 2,0x00000001] request to configure proxy
[21 de set. 2021, 10:36:27] [Debug] [/dev/wwan0mbim0] checking device caps during client device open...
[21 de set. 2021, 10:36:27] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:01:00:00:00:00:00:00:00:00:00:00:00

[21 de set. 2021, 10:36:27] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 3
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'device-caps' (0x00000001)
<<<<<<   type    = 'query' (0x00000000)

[21 de set. 2021, 10:36:28] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 204
>>>>>>   data   = 03:00:00:80:CC:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:01:00:00:00:00:00:00:00:9C:00:00:00:01:00:00:00:01:00:00:00:01:00:00:00:02:00:00:00:3C:00:00:00:03:00:00:00:01:00:00:00:08:00:00:00:00:00:00:00:00:00:00:00:68:00:00:00:1E:00:00:00:40:00:00:00:26:00:00:00:88:00:00:00:12:00:00:00:45:00:4D:00:31:00:32:00:30:00:52:00:47:00:4C:00:41:00:50:00:52:00:30:00:32:00:41:00:30:00:37:00:4D:00:34:00:47:00:00:00:30:00:31:00:35:00:39:00:33:00:30:00:30:00:30:00:30:00:33:00:37:00:33:00:39:00:30:00:33:00:00:00:45:00:4D:00:31:00:32:00:30:00:52:00:5F:00:47:00:4C:00:00:00

[21 de set. 2021, 10:36:28] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 204
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 3
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'device-caps' (0x00000001)
>>>>>> Fields:
>>>>>>   DeviceType = 'embedded'
>>>>>>   CellularClass = 'gsm'
>>>>>>   VoiceClass = 'no-voice'
>>>>>>   SimClass = 'removable'
>>>>>>   DataClass = 'umts, hsdpa, hsupa, lte'
>>>>>>   SmsCaps = 'pdu-receive, pdu-send'
>>>>>>   ControlCaps = 'reg-manual'
>>>>>>   MaxSessions = '8'
>>>>>>   CustomDataClass = '(null)'
>>>>>>   DeviceId = '015930000373903'
>>>>>>   FirmwareInfo = 'EM120RGLAPR02A07M4G'
>>>>>>   HardwareInfo = 'EM120R_GL'

[21 de set. 2021, 10:36:28] [Debug] [/dev/wwan0mbim0] device caps query during internal open succeeded
[21 de set. 2021, 10:36:28] [Debug] [client 2,0x00000001] proxy configured
[21 de set. 2021, 10:36:28] [Debug] [client 2] connection to MBIM device '/dev/wwan0mbim0' established
[21 de set. 2021, 10:36:28] [Debug] [client 2,0x00000003] forwarding request to device: quectel, query, fcc-unlock
[21 de set. 2021, 10:36:28] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:04:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00

[21 de set. 2021, 10:36:28] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 4
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
<<<<<<   cid     = 'fcc-unlock' (0x00000001)
<<<<<<   type    = 'query' (0x00000000)

[21 de set. 2021, 10:36:28] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 52
>>>>>>   data   = 03:00:00:80:34:00:00:00:04:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:04:00:00:00

[21 de set. 2021, 10:36:28] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 52
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 4
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
>>>>>>   cid          = 'fcc-unlock' (0x00000001)
>>>>>> Fields:
>>>>>>   HwRadioState = '(null)'
>>>>>>   SwRadioState = 'off'

[21 de set. 2021, 10:36:28] [Debug] [client 2,0x00000003] response from device received
[21 de set. 2021, 10:36:28] [Debug] [client 2,0x00000004] requested explicit MBIM channel close
[21 de set. 2021, 10:36:28] [Debug] [client 2] connection closed

sudo mbimcli -d /dev/wwan0mbim0 --query-device-services -p

sudo mbimcli -d /dev/wwan0mbim0 --query-device-services -p
[/dev/wwan0mbim0] Device services retrieved:
        Max DSS sessions: '0'
                Services: (17)

                          Service: 'basic-connect'
                             UUID: [a289cc33-bcbb-8b4f-b6b0-133ec2aae6df]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: device-caps (1),
                                   subscriber-ready-status (2),
                                   radio-state (3),
                                   pin (4),
                                   pin-list (5),
                                   home-provider (6),
                                   preferred-providers (7),
                                   visible-providers (8),
                                   register-state (9),
                                   packet-service (10),
                                   signal-state (11),
                                   connect (12),
                                   provisioned-contexts (13),
                                   ip-configuration (15),
                                   device-services (16),
                                   device-service-subscribe-list (19),
                                   packet-statistics (20),
                                   network-idle-hint (21),
                                   emergency-mode (22),
                                   ip-packet-filters (23)

                          Service: 'sms'
                             UUID: [533fbeeb-14fe-4467-9f90-33a223e56c3f]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: configuration (1),
                                   read (2),
                                   send (3),
                                   delete (4),
                                   message-store-status (5)

                          Service: 'ussd'
                             UUID: [e550a0c8-5e82-479e-82f7-10abf4c3351f]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: ussd (1)

                          Service: 'phonebook'
                             UUID: [4bf38476-1e6a-41db-b1d8-bed289c25bdb]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: configuration (1),
                                   read (2),
                                   delete (3),
                                   write (4)

                          Service: 'stk'
                             UUID: [d8f20131-fcb5-4e17-8602-d6ed3816164c]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: pac (1),
                                   terminal-response (2),
                                   envelope (3)

                          Service: 'auth'
                             UUID: [1d2b5ff7-0aa1-48b2-aa52-50f15767174e]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: aka (1),
                                   sim (3)

                          Service: 'qmi'
                             UUID: [d1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: msg (1)

                          Service: 'ms-host-shutdown'
                             UUID: [883b7c26-985f-43fa-9804-27d7fb80959c]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: notify (1)

                          Service: 'unknown'
                             UUID: [2d0c12c9-0e6a-495a-915c-8d174fe5d63c]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: 1, 2, 3, 4, 5, 7, 9

                          Service: 'ms-firmware-id'
                             UUID: [e9f7dea2-feaf-4009-93ce-90a3694103b6]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: get (1)

                          Service: 'atds'
                             UUID: [5967bdcc-7fd2-49a2-9f5c-b2e70e527db3]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: signal (1),
                                   location (2),
                                   operators (3),
                                   rat (4),
                                   register-state (9),
                                   unknown (10)

                          Service: 'qdu'
                             UUID: [6427015f-579d-48f5-8c54-f43ed1e76f83]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: update-session (1),
                                   file-open (2),
                                   file-write (3),
                                   unknown (4),
                                   unknown (5),
                                   unknown (6),
                                   unknown (7),
                                   unknown (8)

                          Service: 'ms-uicc-low-level-access'
                             UUID: [c2f6588e-f037-4bc9-8665-f4d44bd09367]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: atr (1),
                                   open-channel (2),
                                   close-channel (3),
                                   apdu (4),
                                   terminal-capability (5),
                                   reset (6),
                                   unknown (7),
                                   unknown (8),
                                   unknown (9),
                                   unknown (10)

                          Service: 'ms-basic-connect-extensions'
                             UUID: [3d01dcc5-fef5-4d05-0d3a-bef7058e9aaf]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: provisioned-contexts (1),
                                   lte-attach-configuration (3),
                                   lte-attach-info (4),
                                   sys-caps (5),
                                   device-caps (6),
                                   device-slot-mappings (7),
                                   slot-info-status (8),
                                   pco (9),
                                   device-reset (10),
                                   unknown (11),
                                   unknown (12),
                                   unknown (14)

                          Service: 'ms-sar'
                             UUID: [68223d04-9f6c-4e0f-822d-28441fb72340]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: config (1),
                                   transmission-status (2)

                          Service: 'unknown'
                             UUID: [8d8b9eba-37be-449b-8f1e-61cb034a702e]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: 10

                          Service: 'quectel'
                             UUID: [11223344-5566-7788-99aa-bbccddeeff11]:
                      DSS payload: 0
                Max DSS instances: 0
                             CIDs: fcc-unlock (1)
                             

sudo mbimcli -d /dev/wwan0mbim0 --quectel-query-fcc-unlock -p

sudo mbimcli -d /dev/wwan0mbim0 --quectel-query-fcc-unlock -p
[/dev/wwan0mbim0] Radio state retrieved after FCC unlock:
             Hardware radio state: 'unknown'
             Software radio state: 'off'

output of mbim-proxy After trying to connect via modemmanager(failing):

[21 de set. 2021, 10:41:56] [Debug] [client 4,0x0000002d] forwarding request to device: basic-connect, query, radio-state
[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:49:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:00:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 73
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'radio-state' (0x00000003)
<<<<<<   type    = 'query' (0x00000000)

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 56
>>>>>>   data   = 03:00:00:80:38:00:00:00:49:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:00:00:00:00:08:00:00:00:01:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 56
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 73
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'radio-state' (0x00000003)
>>>>>> Fields:
>>>>>>   HwRadioState = 'on'
>>>>>>   SwRadioState = 'off'

[21 de set. 2021, 10:41:56] [Debug] [client 4,0x0000002d] response from device received
[21 de set. 2021, 10:41:56] [Debug] [client 4,0x0000002e] forwarding request to device: basic-connect, set, radio-state
[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 52
<<<<<<   data   = 03:00:00:00:34:00:00:00:4A:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:04:00:00:00:01:00:00:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 52
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 74
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'radio-state' (0x00000003)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   RadioState = 'on'

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:4A:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 74
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'Busy' (0x00000001)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'radio-state' (0x00000003)

[21 de set. 2021, 10:41:56] [Debug] [client 4,0x0000002e] response from device received
[21 de set. 2021, 10:41:56] [Debug] [client 5,0x00000029] forwarding request to device: qmi, set, msg
[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 61
<<<<<<   data   = 03:00:00:00:3D:00:00:00:4B:00:00:00:01:00:00:00:00:00:00:00:D1:A3:0B:C2:F9:7A:6E:43:BF:65:C7:E2:4F:B0:F0:D3:01:00:00:00:01:00:00:00:0D:00:00:00:01:0C:00:00:02:01:00:07:00:5F:55:00:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 61
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 75
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'qmi' (d1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3)
<<<<<<   cid     = 'msg' (0x00000001)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   QmiMsg = '01:0c:00:00:02:01:00:07:00:5f:55:00:00'

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 68
>>>>>>   data   = 03:00:00:80:44:00:00:00:4B:00:00:00:01:00:00:00:00:00:00:00:D1:A3:0B:C2:F9:7A:6E:43:BF:65:C7:E2:4F:B0:F0:D3:01:00:00:00:00:00:00:00:14:00:00:00:01:13:00:80:02:01:02:07:00:5F:55:07:00:02:04:00:01:00:39:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 68
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 75
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'qmi' (d1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3)
>>>>>>   cid          = 'msg' (0x00000001)
>>>>>> Fields:
>>>>>>   QMUX = '01:13:00:80:02:01:02:07:00:5f:55:07:00:02:04:00:01:00:39:00'

[21 de set. 2021, 10:41:56] [Debug] [client 5,0x00000029] response from device received
[21 de set. 2021, 10:41:56] [Debug] [client 4,0x0000002f] forwarding request to device: basic-connect, set, radio-state
[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 52
<<<<<<   data   = 03:00:00:00:34:00:00:00:4C:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:04:00:00:00:01:00:00:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 52
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 76
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'radio-state' (0x00000003)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   RadioState = 'on'

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:4C:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:56] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 76
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'Busy' (0x00000001)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'radio-state' (0x00000003)

[21 de set. 2021, 10:41:56] [Debug] [client 4,0x0000002f] response from device received
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000030] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000030] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000031] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000031] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000032] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000032] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000033] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000033] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000034] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000034] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000035] forwarding request to device: basic-connect, query, radio-state
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:4D:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:00:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 77
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'radio-state' (0x00000003)
<<<<<<   type    = 'query' (0x00000000)

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 56
>>>>>>   data   = 03:00:00:80:38:00:00:00:4D:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:00:00:00:00:08:00:00:00:01:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 56
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 77
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'radio-state' (0x00000003)
>>>>>> Fields:
>>>>>>   HwRadioState = 'on'
>>>>>>   SwRadioState = 'off'

[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000035] response from device received
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000036] forwarding request to device: basic-connect, set, radio-state
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 52
<<<<<<   data   = 03:00:00:00:34:00:00:00:4E:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:04:00:00:00:01:00:00:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 52
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 78
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'radio-state' (0x00000003)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   RadioState = 'on'

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:4E:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 78
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'Busy' (0x00000001)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'radio-state' (0x00000003)

[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000036] response from device received
[21 de set. 2021, 10:41:57] [Debug] [client 5,0x0000002a] forwarding request to device: qmi, set, msg
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 61
<<<<<<   data   = 03:00:00:00:3D:00:00:00:4F:00:00:00:01:00:00:00:00:00:00:00:D1:A3:0B:C2:F9:7A:6E:43:BF:65:C7:E2:4F:B0:F0:D3:01:00:00:00:01:00:00:00:0D:00:00:00:01:0C:00:00:02:01:00:08:00:5F:55:00:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 61
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 79
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'qmi' (d1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3)
<<<<<<   cid     = 'msg' (0x00000001)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   QmiMsg = '01:0c:00:00:02:01:00:08:00:5f:55:00:00'

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 68
>>>>>>   data   = 03:00:00:80:44:00:00:00:4F:00:00:00:01:00:00:00:00:00:00:00:D1:A3:0B:C2:F9:7A:6E:43:BF:65:C7:E2:4F:B0:F0:D3:01:00:00:00:00:00:00:00:14:00:00:00:01:13:00:80:02:01:02:08:00:5F:55:07:00:02:04:00:01:00:39:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 68
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 79
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'qmi' (d1a30bc2-f97a-6e43-bf65-c7e24fb0f0d3)
>>>>>>   cid          = 'msg' (0x00000001)
>>>>>> Fields:
>>>>>>   QMUX = '01:13:00:80:02:01:02:08:00:5f:55:07:00:02:04:00:01:00:39:00'

[21 de set. 2021, 10:41:57] [Debug] [client 5,0x0000002a] response from device received
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000037] forwarding request to device: basic-connect, set, radio-state
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 52
<<<<<<   data   = 03:00:00:00:34:00:00:00:50:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:04:00:00:00:01:00:00:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 52
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 80
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
<<<<<<   cid     = 'radio-state' (0x00000003)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   RadioState = 'on'

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:50:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:03:00:00:00:01:00:00:00:00:00:00:00

[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 80
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'Busy' (0x00000001)
>>>>>>   service      = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid          = 'radio-state' (0x00000003)

[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000037] response from device received
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000038] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000038] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000039] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x00000039] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x0000003a] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x0000003a] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x0000003b] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x0000003b] service subscribe list update in device not needed
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x0000003c] request to update service subscribe list received
[21 de set. 2021, 10:41:57] [Debug] [client 4] service subscribe list built
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merging client service subscribe lists...
[21 de set. 2021, 10:41:57] [Debug] [/dev/wwan0mbim0] merged service subscribe list not updated
[21 de set. 2021, 10:41:57] [Debug] [client 4,0x0000003c] service subscribe list update in device not needed
[21 de set. 2021, 10:41:59] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 144
>>>>>>   data   = 07:00:00:80:90:00:00:00:00:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:02:00:00:00:64:00:00:00:01:00:00:00:1C:00:00:00:1E:00:00:00:3C:00:00:00:28:00:00:00:00:00:00:00:00:00:00:00:32:00:31:00:34:00:30:00:36:00:30:00:36:00:31:00:32:00:38:00:35:00:37:00:36:00:30:00:34:00:00:00:38:00:39:00:33:00:34:00:35:00:37:00:31:00:30:00:30:00:32:00:31:00:30:00:32:00:33:00:37:00:36:00:30:00:34:00:30:00:46:00

[21 de set. 2021, 10:41:59] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 144
>>>>>>   type        = indicate-status (0x80000007)
>>>>>>   transaction = 0
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid     = 'subscriber-ready-status' (0x00000002)
>>>>>> Fields:
>>>>>>   ReadyState = 'initialized'
>>>>>>   SubscriberId = '214060612857604'
>>>>>>   SimIccId = '8934571002102376040F'
>>>>>>   ReadyInfo = 'none'
>>>>>>   TelephoneNumbersCount = '0'
>>>>>>   TelephoneNumbers = ''

Hello. I'm using T14 Gen.2 AMD with EM120R-GL factory-installed.

@joar On Ubuntu 21.10 preview + 5.14.6-generic-amd64 Ubuntu PPA kernel, the code doesn't work. (snap download lenovo-wwan-dpr --edge is done, and proper #define macro is given)

# env VERBOSE=1 ./fcc_unlock_v2
[09-21_03:53:36:598] Fail to connect 'mbim-proxy', errno: 111 (Connection refused)
[09-21_03:53:36:598] mbim_proxy_connect('mbim-proxy') = -1
[09-21_03:53:36:598] GetIsMbimReady err=-19, bValue=0
fcc_ops->GetIsMbimReady(): err=-1. Retrying in 10 seconds...

@aleksm On Ubuntu 21.10 preview + 5.14.6-generic-amd64 Ubuntu PPA kernel, the code doesn't work. (build with the source on master)

$ mbimcli --help
mbimcli: symbol lookup error: mbimcli: undefined symbol: mbim_message_ms_sar_config_set_new

@aleksm On Ubuntu 21.10 preview + 5.14.6-generic-amd64 Ubuntu PPA kernel, the code doesn't work. (build with the source on master)

$ mbimcli --help
mbimcli: symbol lookup error: mbimcli: undefined symbol: mbim_message_ms_sar_config_set_new

That is a broken build I'm afraid. I would bet you built the project without specifying --prefix and so everything is installed in /usr/local, and when you don't specify a full path, the mbimcli is taken from /usr/local/bin (in Ubuntu, which has this IMO broken thing of having that in the PATH) BUT the libmbim library is taking from /usr/lib instead. Please see this page for more details on that specific build issue: https://modemmanager.org/docs/faq/#can-the-projects-be-installed-in-usrlocal-instead-of-usr

The fix is simple, just use --prefix=/usr --libdir=/usr/lib/x86_64-linux-gnu in configure, the make and sudo make install, and that will overwrite the system-installed libmbim package.

Or if you don't want to overwrite and keep everything under /usr/local, then you need to use LD_LIBRARY_PATH as explained in the link above.

That is a broken build I'm afraid. I would bet you built the project without specifying --prefix and so everything is installed in /usr/local, and when you don't specify a full path, the mbimcli is taken from /usr/local/bin (in Ubuntu, which has this IMO broken thing of having that in the PATH) BUT the libmbim library is taking from /usr/lib instead. Please see this page for more details on that specific build issue: https://modemmanager.org/docs/faq/#can-the-projects-be-installed-in-usrlocal-instead-of-usr

The fix is simple, just use --prefix=/usr --libdir=/usr/lib/x86_64-linux-gnu in configure, the make and sudo make install, and that will overwrite the system-installed libmbim package.

Or if you don't want to overwrite and keep everything under /usr/local, then you need to use LD_LIBRARY_PATH as explained in the link above.

On Ubuntu 21.10 preview + 5.14.6-generic-amd64 Ubuntu PPA kernel, linking problem is still sticky. (both on 'master' source with meson builddir --prefix=/usr --libdir=/usr/lib/x86_64-linux-gnu; cd builddir; ninja; sudo ninja install and '1.26' source with ./autogen.sh; ./configure --prefix=/usr --libdir=/usr/lib/x86_64-linux-gnu; make; sudo make install)

$ sudo mbimcli -d /dev/wwan0mbim0 -p -v --quectel-query-fcc-unlock
mbimcli: symbol lookup error: mbimcli: undefined symbol: mbim_message_ms_basic_connect_extensions_version_response_parse

Did you "make uninstall" the previous installation?

Oh, I was dumb :( Now it executes something, but it fails in the same manner as @joar 's solution, I think. (something with mbim-proxy)

$ sudo mbimcli -d /dev/wwan0mbim0 -p -v --quectel-query-fcc-unlock
[21  9월 2021, 23:45:26] [Debug] opening device...
[21  9월 2021, 23:45:26] [Debug] cannot connect to proxy: Could not connect: Connection refused
[21  9월 2021, 23:45:26] [Debug] spawning new mbim-proxy (try 1)...
[21  9월 2021, 23:45:26] [Debug] [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
[21  9월 2021, 23:45:26] [Debug] [/dev/wwan0mbim0] Fallback to default max control message size: 4096
[21  9월 2021, 23:45:26] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 92
<<<<<<   data   = 03:00:00:00:5C:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:01:00:00:00:2C:00:00:00:0C:00:00:00:1E:00:00:00:1E:00:00:00:2F:00:64:00:65:00:76:00:2F:00:77:00:77:00:61:00:6E:00:30:00:6D:00:62:00:69:00:6D:00:30:00:00:00

[21  9월 2021, 23:45:26] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 92
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 1
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
<<<<<<   cid     = 'configuration' (0x00000001)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   DevicePath = '/dev/wwan0mbim0'
<<<<<<   Timeout = '30'

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:00:00:00:00:00:00:00:00

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 1
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
>>>>>>   cid          = 'configuration' (0x00000001)

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 16
<<<<<<   data   = 01:00:00:00:10:00:00:00:02:00:00:00:00:10:00:00

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 16
<<<<<<   type        = open (0x00000001)
<<<<<<   transaction = 2
<<<<<< Contents:
<<<<<<   max control transfer = 4096

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 01:00:00:80:10:00:00:00:02:00:00:00:00:00:00:00

[21  9월 2021, 23:45:27] [Debug] MBIM Device at '/dev/wwan0mbim0' ready
[21  9월 2021, 23:45:27] [Debug] Asynchronously running FCC unlock...
[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 3
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
<<<<<<   cid     = 'fcc-unlock' (0x00000001)
<<<<<<   type    = 'query' (0x00000000)

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 180
>>>>>>   data   = 07:00:00:80:B4:00:00:00:00:00:00:00:01:00:00:00:00:00:00:00:A2:89:CC:33:BC:BB:8B:4F:B6:B0:13:3E:C2:AA:E6:DF:02:00:00:00:88:00:00:00:01:00:00:00:40:00:00:00:1E:00:00:00:60:00:00:00:28:00:00:00:00:00:00:00:01:00:00:00:24:00:00:00:1A:00:00:00:2B:00:38:00:32:00:31:00:30:00:37:00:33:00:39:00:34:00:37:00:33:00:33:00:30:00:00:00:34:00:35:00:30:00:30:00:38:00:30:00:31:00:32:00:30:00:30:00:39:00:31:00:34:00:35:00:33:00:00:00:38:00:39:00:38:00:32:00:33:00:30:00:31:00:32:00:32:00:30:00:30:00:30:00:30:00:36:00:31:00:34:00:35:00:33:00:38:00:46:00

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 180
>>>>>>   type        = indicate-status (0x80000007)
>>>>>>   transaction = 0
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   service = 'basic-connect' (a289cc33-bcbb-8b4f-b6b0-133ec2aae6df)
>>>>>>   cid     = 'subscriber-ready-status' (0x00000002)
>>>>>> Fields:
>>>>>>   ReadyState = 'initialized'
>>>>>>   SubscriberId = '450080120091453'
>>>>>>   SimIccId = '8982301220000614538F'
>>>>>>   ReadyInfo = 'none'
>>>>>>   TelephoneNumbersCount = '1'
>>>>>>   TelephoneNumbers = '+821073947330'

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 52
>>>>>>   data   = 03:00:00:80:34:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:04:00:00:00

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 52
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 3
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
>>>>>>   cid          = 'fcc-unlock' (0x00000001)
>>>>>> Fields:
>>>>>>   HwRadioState = '(null)'
>>>>>>   SwRadioState = 'off'

[/dev/wwan0mbim0] Radio state retrieved after FCC unlock:
	     Hardware radio state: 'unknown'
	     Software radio state: 'off'
[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 12
<<<<<<   data   = 02:00:00:00:0C:00:00:00:04:00:00:00

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 12
<<<<<<   type        = close (0x00000002)
<<<<<<   transaction = 4

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 02:00:00:80:10:00:00:00:04:00:00:00:00:00:00:00

[21  9월 2021, 23:45:27] [Debug] [/dev/wwan0mbim0] channel destroyed
[21  9월 2021, 23:45:27] [Debug] Device closed

Is there something I'm missing about the Ubuntu's default 5.14.6 kernel or missing kernel modules, or settings about linking with mbim2sar.so from the snap package?

After sudo modprobe cdc_mbim, @joar 's solution returns FCC unlock completed successfully.

@aleksm After sudo modprobe cdc_mbim, now there's no mbim-proxy error:

$ sudo mbimcli -d /dev/wwan0mbim0 -p -v --quectel-query-fcc-unlock
[21  9월 2021, 23:57:10] [Debug] opening device...
[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Couldn't find descriptors file, possibly not using cdc_mbim
[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Fallback to default max control message size: 4096
[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 92
<<<<<<   data   = 03:00:00:00:5C:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:01:00:00:00:2C:00:00:00:0C:00:00:00:1E:00:00:00:1E:00:00:00:2F:00:64:00:65:00:76:00:2F:00:77:00:77:00:61:00:6E:00:30:00:6D:00:62:00:69:00:6D:00:30:00:00:00

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 92
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 1
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
<<<<<<   cid     = 'configuration' (0x00000001)
<<<<<<   type    = 'set' (0x00000001)
<<<<<< Fields:
<<<<<<   DevicePath = '/dev/wwan0mbim0'
<<<<<<   Timeout = '30'

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 48
>>>>>>   data   = 03:00:00:80:30:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:83:8C:F7:FB:8D:0D:4D:7F:87:1E:D7:1D:BE:FB:B3:9B:01:00:00:00:00:00:00:00:00:00:00:00

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 48
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 1
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'proxy-control' (838cf7fb-8d0d-4d7f-871e-d71dbefbb39b)
>>>>>>   cid          = 'configuration' (0x00000001)

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 16
<<<<<<   data   = 01:00:00:00:10:00:00:00:02:00:00:00:00:10:00:00

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 16
<<<<<<   type        = open (0x00000001)
<<<<<<   transaction = 2
<<<<<< Contents:
<<<<<<   max control transfer = 4096

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 01:00:00:80:10:00:00:00:02:00:00:00:00:00:00:00

[21  9월 2021, 23:57:10] [Debug] MBIM Device at '/dev/wwan0mbim0' ready
[21  9월 2021, 23:57:10] [Debug] Asynchronously running FCC unlock...
[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 48
<<<<<<   data   = 03:00:00:00:30:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:00:00:00:00

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 48
<<<<<<   type        = command (0x00000003)
<<<<<<   transaction = 3
<<<<<< Fragment header:
<<<<<<   total   = 1
<<<<<<   current = 0
<<<<<< Contents:
<<<<<<   service = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
<<<<<<   cid     = 'fcc-unlock' (0x00000001)
<<<<<<   type    = 'query' (0x00000000)

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 52
>>>>>>   data   = 03:00:00:80:34:00:00:00:03:00:00:00:01:00:00:00:00:00:00:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:11:01:00:00:00:00:00:00:00:04:00:00:00:01:00:00:00

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Received message (translated)...
>>>>>> Header:
>>>>>>   length      = 52
>>>>>>   type        = command-done (0x80000003)
>>>>>>   transaction = 3
>>>>>> Fragment header:
>>>>>>   total   = 1
>>>>>>   current = 0
>>>>>> Contents:
>>>>>>   status error = 'None' (0x00000000)
>>>>>>   service      = 'quectel' (11223344-5566-7788-99aa-bbccddeeff11)
>>>>>>   cid          = 'fcc-unlock' (0x00000001)
>>>>>> Fields:
>>>>>>   HwRadioState = 'on'
>>>>>>   SwRadioState = 'off'

[/dev/wwan0mbim0] Radio state retrieved after FCC unlock:
	     Hardware radio state: 'on'
	     Software radio state: 'off'
[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message...
<<<<<< RAW:
<<<<<<   length = 12
<<<<<<   data   = 02:00:00:00:0C:00:00:00:04:00:00:00

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Sent message (translated)...
<<<<<< Header:
<<<<<<   length      = 12
<<<<<<   type        = close (0x00000002)
<<<<<<   transaction = 4

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] Received message...
>>>>>> RAW:
>>>>>>   length = 16
>>>>>>   data   = 02:00:00:80:10:00:00:00:04:00:00:00:00:00:00:00

[21  9월 2021, 23:57:10] [Debug] [/dev/wwan0mbim0] channel destroyed
[21  9월 2021, 23:57:10] [Debug] Device closed

But what should I do now? I heard that mhi_pci_generic on the kernel > 5.13 does the job, but I cannot see any option to configure the WWAN.

After sudo mmcli --modem 0 --enable, I think it's working, at least in the context of the modem functionality.

$ sudo mmcli --modem 0
  --------------------------------
  General  |                 path: /org/freedesktop/ModemManager1/Modem/0
           |            device id: 3e8141ec7111357cbba3698266c17204ebaf9f26
  --------------------------------
  Hardware |         manufacturer: Quectel
           |                model: EM120R-GL
           |    firmware revision: EM120RGLAPR02A07M4G
           |            supported: gsm-umts, lte
           |              current: gsm-umts, lte
           |         equipment id: 015930001585364
  --------------------------------
  System   |               device: /sys/devices/pci0000:00/0000:00:02.5/0000:05:00.0
           |              drivers: mhi_net, mhi-pci-generic
           |               plugin: generic
           |         primary port: wwan0at0
           |                ports: mhi_mbim0 (net), wwan0at0 (at)
  --------------------------------
  Status   |       unlock retries: sim-pin (3), sim-puk (10), sim-pin2 (3), sim-puk2 (10)
           |                state: enabled
           |          power state: on
           |       signal quality: 20% (cached)
  --------------------------------
  Modes    |            supported: allowed: 2g, 3g, 4g; preferred: none
           |              current: allowed: 2g, 3g, 4g; preferred: none
  --------------------------------
  IP       |            supported: ipv4, ipv6, ipv4v6
  --------------------------------
  3GPP     |                 imei: 015930001585364
           |         registration: idle
  --------------------------------
  3GPP EPS | ue mode of operation: csps-2
  --------------------------------
  SIM      |     primary sim path: /org/freedesktop/ModemManager1/SIM/0

But no actual connection to the cellular network, but I think now it's about network setting issue like configuring APN, etc.

I got a strace from @aleixq and what I can see is that the program reads these two files just before running the lock query command I added as --quectel-query-fcc-unlock:

/sys/firmware/dmi/tables/smbios_entry_point
/sys/firmware/dmi/tables/DMI

I would have said that reading those files would be in order to perform the lenovo platform check (i.e. so that the unlock tool works only on lenovo setups); but maybe they have something to do with the unlock process itself?

I believe FccUnlock indirectly reads smbios_entry_point in order to fetch the KHOIHGIUCCHHII string, but from what I can see in mbim2sar.so, the KHOIHGIUCCHHII string is never used, in fact, KHOIHGIUCCHHII is assigned to a local char * FOO, but the next thing that happens is that FOO = get_time(). I'm not proficient enough in C/assembly to judge whether that's an underhanded C thing or if it's just the compiler optimizing away an unused variable.

I would say it's the latter. My assumption is that the DMI table read is just to validate whether the system is a Lenovo setup, i.e. so that the FCC unlock is not run in other systems.

I can confirm that the unlock process works. After building libmbim, libqmi, libqrtr-glib and subsequently ModemManager into /opt/modemmanager I ran

sudo env LD_LIBRARY_PATH=/opt/modemmanager/lib/x86_64-linux-gnu /opt/modemmanager/bin/mbimcli -d /dev/wwan0p2MBIM -p -v --quectel-query-fcc-unlock

after which modem initialization and connection worked. You need to make sure that you supply the correct pkg-config paths to meson, or the tools will link against your system's versions of the libs.

That's definitely a step in the right direction, but of course there's still plenty of work to do. If I can spare some time I might be able to try to take the buildscripts from Ubuntu's versions of things to create custom .debs for the patched versions of the packages.

Environment:

• Ubuntu 21.10 running upstream 5.13.0-16-generic kernel.
• libmbim taken from @aleksm 's MR
• libqmi libqmi@17c604d7
• libqrtr-glib libqrtr-glib@a57064b7
• ModemManager 8b80da15

Maybe I mess something with old libs in my system, I will check too that all these libs are correctly picked, repackaging everything in arch to be sure that I have at least the commits that @tehplague is using.

If I can get everything ordered and working as @tehplague I'll share the PKGBUILDs used to test in archlinux systems too.

BTW I have this environment:

• 5.14.6-arch1-1 #1 SMP PREEMPT Sat, 18 Sep 2021 16:19:35 +0000 x86_64 GNU/Linux
• libmbim taken from MR
• libqmi 1.30.2-1 ( libqmi-glib.so=5-64 ) commit libqmi@4831d544 (tag 1.30.2)
• libqrtr 1.0.0-1 ( libqrtr-glib.so=0-64 ) commit libqrtr-glib@cfb383e8 (tag 1.0.0)
• ModemManager 1.18.2-1 commit 5a2c9229 (tag 1.18.2)