Trying to make sense of builtin modem's interfaces

Message

szatox · Post by **szatox** » Wed Oct 16, 2024 7:53 pm

Long story short, I want to make voice calls with a builtin modem, and the conventional wisdom of "use ttyUSB0 to initiate call, and play sound from data incomming on ttyUSB1" doesn't work; most likely because it's an mbim modem and not an emulated analogue.
So, I'm currently trying to understand what am I even working with. THIS seems to be relevant, but doesn't really tells me what to do next.

I can make and answer voice calls using modemmanager or gnome-calls.
I wasn't able to connect audio streams to mic/speakers. I currently don't know why: I'm on pipewire, gnome-calls attempts to use pulseaudio interface I've never tested before, and callaudiod is doing some stupid things, so it might very well be the culprit, but I'll be happy to use an shell script with ffmpeg instead, so didn't debug this part very hard for now.

This Fibocom has 4 interfaces (details will come later)
1.0 using driver cdc-mbim, connected to "usbmisc" /dev/cdc-wdm0. wwan0 uses this interface (fuser reports mbim_proxy talking to this device)
1.1 using driver cdc_mbim
1.2 using driver cdc_acm, connected to terminal /dev/ttyACM0 (fuser reports ModemManager)
1.3 using driver cdc_acm

I couldn't figure out what uses the odd interfaces.
Funny thing, I tried opening both terminals with screen; ttyACM0 prints some probably stats every second, and cdc-wdm0 instantly closes screen.
I think I should be able to get modemmanager to hand me audio streams in some way, but I don't really know what to look for.

At this stage I can't really make a coherent question, so just give me your thoughts. Anything you think might help.

Code: Select all

# lsusb -v
Bus 001 Device 057: ID 2cb7:0210 Fibocom L830-EB-00 LTE WWAN Modem
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 [unknown]
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x2cb7 Fibocom
  idProduct          0x0210 L830-EB-00 LTE WWAN Modem
  bcdDevice            3.33
  iManufacturer           1 FIBOCOM
  iProduct                2 L830-EB
  iSerial                 3 xxxxxxxxxxxxxx
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x00a1
    bNumInterfaces          4
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              100mA
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         0
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass      14 [unknown]
      bFunctionProtocol       0 
      iFunction               4 Fibocom L830-EB
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass     14 [unknown]
      bInterfaceProtocol      0 
      iInterface              5 Fibocom L830-EB
      CDC Header:
        bcdCDC               1.20
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1 
      CDC MBIM:
        bcdMBIMVersion       1.00
        wMaxControlMessage   512
        bNumberFilters       32
        bMaxFilterSize       192
        wMaxSegmentSize      1500
        bmNetworkCapabilities 0x00
      CDC MBIM Extended:
        bcdMBIMExtendedVersion           1.00
        bMaxOutstandingCommandMessages      1
        wMTU                             1500
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               4
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 [unknown]
      bInterfaceProtocol      2 
      iInterface              6 Data (OFF)
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       1
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 [unknown]
      bInterfaceProtocol      2 
      iInterface              7 Data (ON)
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         2
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       0 
      iFunction               8 Fibocom L830-EB
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      0 
      iInterface              9 Fibocom L830-EB
      CDC Header:
        bcdCDC               1.20
      CDC Union:
        bMasterInterface        2
        bSlaveInterface         3 
      CDC Call Management:
        bmCapabilities       0x00
        bDataInterface          3
      CDC ACM:
        bmCapabilities       0x07
          sends break
          line coding and serial state
          get/set/clear comm features
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               4
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 [unknown]
      bInterfaceProtocol      0 
      iInterface             10 Data
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 [unknown]
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered

gentoo_ram · Post by **gentoo_ram** » Wed Oct 16, 2024 11:04 pm

The cellular modules I've seen that support voice calls also enumerate USB-Audio devices. One for Headphone and one for Mic. That's what I've seen from modules based on Qualcomm chipsets. Maybe this one only really supports data calls.

szatox · Post by **szatox** » Wed Oct 16, 2024 11:38 pm

I know data-only modems exist, but if that was the case, shouldn't it be unavailable for voice calls on PSTN side?
Well, it is worth verifying, I'll look into that. I don't recall my Huawei modems showing up this way though, and I know they were voice-enabled. They even came with a dialler (for windows, obviously) on a builtin virtual cdrom.
Those were emulated analogue modems though, so showed up with 3 tty interfaces, which brings us back the conventional wisdom I mentioned at the very beginning, making it out of scope here. I'll consider it a plan C

Gotta compare it with a pinephone modem too. Definitely a voice-enabled one.

Edit:
/usr/lib/udev/rules.d/77-mm-fibocom-port-types.rules contains udev rules for a bunch of fibocom modems, but none of those seem to match my exact device. This might be another missing piece, or might just mean this modem doesn't need additional setup.
Any idea what do those rules actually do?

Code: Select all

# Fibocom FM101-GL (MBIM)
#  ttyUSB0 (if #2): AT port
#  ttyUSB1 (if #3): AT port
#  ttyUSB2 (if #4): debug port (ignore)
#  ttyUSB3 (if #5): debug port (ignore)
ATTRS{idVendor}=="2cb7", ATTRS{idProduct}=="01a2", ENV{.MM_USBIFNUM}=="02", SUBSYSTEM=="tty", ENV{ID_MM_PORT_TYPE_AT_PRIMARY}="1"
ATTRS{idVendor}=="2cb7", ATTRS{idProduct}=="01a2", ENV{.MM_USBIFNUM}=="03", SUBSYSTEM=="tty", ENV{ID_MM_PORT_TYPE_AT_SECONDARY}="1"
ATTRS{idVendor}=="2cb7", ATTRS{idProduct}=="01a2", ENV{.MM_USBIFNUM}=="04", ENV{ID_MM_PORT_IGNORE}="1"
ATTRS{idVendor}=="2cb7", ATTRS{idProduct}=="01a2", ENV{.MM_USBIFNUM}=="05", ENV{ID_MM_PORT_IGNORE}="1"

szatox · Post by **szatox** » Thu Oct 17, 2024 10:29 pm

I did some digging on the internet, and it actually is damn hard to find exact information on that fibocom inside my thinkpad.
Bing claims it is voice-enabled, but I couldn't find it on the website linked as the source; the datasheet for L830-EB I found only listed L830-EB-02 as applicable device and says it offers digital audio in PCM and I2S modes.

For reference, pinephone is equipped with a qmi modem, which presents itself to the system as /dev/cdc-wdm0 via module qmi_wwan+ /dev/ttyUSB[0-3] via module usbserial

Code: Select all

Bus 001 Device 002: ID 2c7c:0125 Quectel Wireless Solutions Co., Ltd. EC25 LTE modem

szatox · Post by **szatox** » Sat Oct 19, 2024 9:44 am

Did more digging; apparently modem is currently running in AT mode and MBIM interface is disabled. I guess that's why I couldn't open that cdc terminal with screen.
hw-probe reports the modem only as "detected" instead of "working", which is funny, since I use basically all the time. I wonder how these other systems make it, didn't have much luck with liveCDs though https://linux-hardware.org/?id=usb:2cb7-0210

Stumbled over https://www.kernel.org/doc/html/latest/ ... _mbim.html
In particular, section on DSS looks interesting, though it does not provide nearly enough information to be immediately usable, but if it's possible to get GPS information from wwan0 interface, it should also be possible to make phone call this way. Might be worth exploring.

szatox · Post by **szatox** » Sun Oct 20, 2024 9:55 pm

I dug up a spare parts table somewhere (?) at Lenovo website.
This particular modem is listed as "ThinkPad Fibocom Intel XMM7262 L830-EB CAT6 WWAN Module", which - according to Intel's scrap of a spec - features VoLTE. Which makes sense, considering I can both, make and answer calls with it, but it is explicitly listed this time.

In the meantime I played with drivers a bit:
Disabling mbim driver makes wwan0 go away and I lose connection to the internet. ModemManager stops recognizing the device as a modem.
Disabling acm driver on the other hand makes the modem lose voice capabilities.

I saw a datasheet with a hardware diagram for a similar modem offered in the same line of laptops, also for M.2 socket.
Among other things, it has separate lanes for legacy USB, USB3, I2C (for hardware codecs) and I2S/PCM (alternate function). Too bad, I currently don't have any information where those audio pins are connected on the other end.
Well, at least I got to the point where I know what I'm looking for.

szatox · Post by **szatox** » Tue Oct 22, 2024 9:23 am

So, I actually did something sane for a change

Looked up m.2 socket pin map and compared it to the pinout in the sister modem spec i found. They go in the same slot so I figured it should be good enough.
M.2 is made in 3 variants with different keys. M.2 with key B matches the modem spec.

Code: Select all

pin I2S PCM  M.2
20  CLK CLK  GPIO_5
22  RX  DIN  GPIO_6
24  TX  DOUT GPIO_7
28  WA  FS   GPIO_8

I2S function table lists WA/FS signal on pin 26 (GPIO_10)instead of 28, but the pin map and pin function function table agree it's 28. Just making a note the datasheet contains an error.
Pin function table lists those pins as I2S. Mapping to PCM is provided under "PCM mode", and PCM is basically described as a fallback for bluetooth devices that don't speak I2S, so I assume I2S is the default mode, which doesn't require additional AT commands I don't know right now.

Any hints how can I take control of those 4 GPIO lanes?
Bonus points for running on interrupts, negative points for complexity.
Edit: libgpiod looks promissing, but I still need to somehow identify the correct lanes among ~300 pins detected.

Also, what does "FS" stand for in PCM interface? There's so much stuff about different uses for PCM I couldn't get through the noise.

sanitariu · Post by **sanitariu** » Mon Nov 04, 2024 1:19 pm

I am playing with my fibocom modem too.
You can use your serial port to switch between ecm/mbim modes so you can use ppp/wwan0/usb0 interfaces for internet.
You can switch with commands using minicom like:

AT+GTUSBMODE=?
+GTUSBMODE: (17-27,29,66)

AT+GTUSBMODE=18
AT+GTUSBMODE=17

Mine is default 17.
I did an error switching to mode 23 and now i am missing serial access so i can not switch back to mode 17 (mbim) or 18 (ecm).
Do you know a way to make it back to 17 ?

szatox · Post by **szatox** » Mon Nov 04, 2024 3:41 pm

What kind of modem is it? Something similar to mine? Did you brick it to the point even cutting of power completely doesn't help?
I can't remove battery from my laptop, but its BIOS offers an option to put it into a service mode, which should be just as good for this purpose.

I don't know AT commands for this device. It didn't seem like they would be very helpful without the hardware part anyway, so I've been looking for this information first.
Anyway, might as well summarize the latest bits of information I found:
Those 4 pins I mentioned earlier are designated audio lines in PCIe M.2 socket specification. The protocol is not pre-determined, and has been left up to the vendor to decide.
Kernel reports 4 I2S pins, though I don't really understand what those kernel interface files actually mean nor how to use those pins.
Not even how to confirm they are the pins I'm looking for (e.g. do they belong to this particular socket).

Code: Select all

grep -r I2S /sys/kernel/debug/pinctrl/
/sys/kernel/debug/pinctrl/INT34BB:00/pinconf-pins:pin 171 (vCNV_BT_I2S_BCLK): input bias disabled
/sys/kernel/debug/pinctrl/INT34BB:00/pinconf-pins:pin 172 (vCNV_BT_I2S_WS_SYNC): input bias disabled
/sys/kernel/debug/pinctrl/INT34BB:00/pinconf-pins:pin 173 (vCNV_BT_I2S_SDO): input bias disabled
/sys/kernel/debug/pinctrl/INT34BB:00/pinconf-pins:pin 174 (vCNV_BT_I2S_SDI): input bias disabled
/sys/kernel/debug/pinctrl/INT34BB:00/pinmux-pins:pin 171 (vCNV_BT_I2S_BCLK): (MUX UNCLAIMED) (GPIO UNCLAIMED)
/sys/kernel/debug/pinctrl/INT34BB:00/pinmux-pins:pin 172 (vCNV_BT_I2S_WS_SYNC): (MUX UNCLAIMED) (GPIO UNCLAIMED)
/sys/kernel/debug/pinctrl/INT34BB:00/pinmux-pins:pin 173 (vCNV_BT_I2S_SDO): (MUX UNCLAIMED) (GPIO UNCLAIMED)
/sys/kernel/debug/pinctrl/INT34BB:00/pinmux-pins:pin 174 (vCNV_BT_I2S_SDI): (MUX UNCLAIMED) (GPIO UNCLAIMED)
/sys/kernel/debug/pinctrl/INT34BB:00/pins:pin 171 (vCNV_BT_I2S_BCLK) 222:INT34BB:00 GPIO 0x44000000 0x00000000 0x00000000 [LOCKED full, ACPI]
/sys/kernel/debug/pinctrl/INT34BB:00/pins:pin 172 (vCNV_BT_I2S_WS_SYNC) 223:INT34BB:00 GPIO 0x44000000 0x00000000 0x00000000 [LOCKED full, ACPI]
/sys/kernel/debug/pinctrl/INT34BB:00/pins:pin 173 (vCNV_BT_I2S_SDO) 224:INT34BB:00 GPIO 0x44000000 0x00000000 0x00000000 [LOCKED full, ACPI]
/sys/kernel/debug/pinctrl/INT34BB:00/pins:pin 174 (vCNV_BT_I2S_SDI) 225:INT34BB:00 GPIO 0x44000000 0x00000000 0x00000000 [LOCKED full, ACPI]

Somehow I can read current value with gpioget, but I can't subscribe to changes with gpiomon:

Code: Select all

# gpioget -c 0 171
"171"=inactive
# gpiomon -c 0 171
gpiomon: unable to request lines on chip /dev/gpiochip0: Operation not permitted

Also, I did some grepping in kernel sources, but can't find a suitable I2S driver. Could have missed something, but it kinda looks like I2S is only implemented for SoC devices.
There are several other bus drivers, like SPI and I2C implemented on top of GPIO though. I'm reluctant to go all in on this one though, since it's probably way above my paygrade. Being somewhat interested in programming hasn't made me that much of a C programmer so far.

sanitariu · Post by **sanitariu** » Wed Nov 06, 2024 8:34 am

Modem is Fibocom

Code: Select all

Bus 001 Device 002: ID 1508:1000 Fibocom Fibocom Modem

With AT commands you can switch between different modes. ECM,MBIM ...
I switched to wrong mode by accident and now i do not have serial port to issue commands.
Maybe it can be controlled other way but i have no idea.
Modem is detected but can not be used as wwan0,usb0 or ppp

Code: Select all

[    3.234039] usb 1-5: New USB device found, idVendor=1508, idProduct=1000, bcdDevice= 3.18
[    3.234045] usb 1-5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[    3.234047] usb 1-5: Product: Fibocom Modem
[    3.234049] usb 1-5: Manufacturer: Fibocom Wireless Inc.
[    3.234050] usb 1-5: SerialNumber: 6c606db9

Do you have any idea how to switch the mode back to default ?

[Administrator edit: added [code] tags to preserve output layout. -Hu]

sanitariu · Post by **sanitariu** » Thu Nov 07, 2024 8:24 am

I think i found and solved the problem.
For some reason after switching mode AT+GTUSBMODE=23 my device is recognised as

Code: Select all

Bus 001 Device 003: ID 1508:1000 Fibocom Fibocom Modem.

Checking drivers/usb/serial/option.c presents only

Code: Select all

        { USB_DEVICE(0x1508, 0x1001),                                           /* Fibocom NL668 (IOT version) */
          .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },

So i edited the file adding

Code: Select all

        { USB_DEVICE(0x1508, 0x1000),                                           /* Fibocom NL668 (IOT version) */
          .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },

recompiling and booting.
I had now /dev/ttyUSB1 so i did AT+GTUSBMODE=18 restared again and my device is now

Code: Select all

Bus 001 Device 003: ID 1508:1001 Fibocom Fibocom Modem

Maybe this is a bug. I hope it helps someone when his modem is locked.

[Administrator edit: added [code] tags to preserve output layout. -Hu]

logrusx · Post by **logrusx** » Thu Nov 07, 2024 8:36 am

It might not be a bug but just another very similar device being supported instead of your own. Maybe it's worth filing a kernel bug just so somebody helps you figure it out and with a bit of luck contribute to a new device being supported. Or fixing a bug if that is what it is after all.

Best Regards,
Georgi

sanitariu · Post by **sanitariu** » Thu Nov 07, 2024 8:48 am

No, the device is the same it just changes somehow the mode in which is detected maybe. Original is

Bus 001 Device 003: ID 1508:1000 Fibocom Fibocom Modem

After wrong mode become

Bus 001 Device 003: ID 1508:1000 Fibocom Fibocom Modem

1000 is missing in kernel option driver. So you are out of your modems and not AT
commands to return it back to mode 17/18.

szatox · Post by **szatox** » Mon Dec 01, 2025 12:52 pm

Hello again after a real life break

I did a bit more digging and here's what I learned:
* There are 2 types of modems on the market: "data" (with sms and ussd codes, but without voice) for computers and apparently "telematics" (with all capabilities enabled) for smartphones, IoT and automotive industry.
* Some modems can even provide UAC interface (USB Audio Device) as an alternative to or instead of serial port. This UAC can be directly linked to in pipewire, which is very convenient.
* EG25-G used in PinePhones can do UAC, unfortunately it's soldered to the mainboard, so I wasn't able to reuse it.
* It is possible to buy those industrial modems in computer-fit form factors, and they come at very reasonable prices, you just have to wait a few days for delivery from China. Check _all_ connectors you will need to make the module operational and explicitly tell the sellers what you want it for so they can stop you from making stupid mistakes.
There are also ready-made USB dongles and USB converter boards.
* Fibocom is just a rebrand of Sierra Wireless. Sierra a few years ago promised they would unlock voice with a firmware upgrade and never delivered. Shame on Sierra Wireless.
* Lenovo has a whitelist of authorized wireless cards baked in the bios. A laptop with M.2 modem not sold by Lenovo will refuse to boot. Shame on Lenovo.
* Gnome-calls is absolutely unreliable. Like in: it couldn't even reliably fail to answer a call, since it actually worked like 2 or 3 times out of 20 attempts. Shame on Gnome-Calls.
* ttyUSB has software flow control enabled by default. Terminals used for binary data need to be switched to raw mode (stty -F <device> raw)
* Modemmanager grabs all command ports it can find. It is still possible to butt in as root, but the terminal is "busy" when I try to access it as a regular user.
* I'm starting to hate modern desktop linux. It is slowly turning into the Windows I kicked to the curb like 20 years ago.

Alright. Questions time!
My modem offers 5 ttyUSB interfaces (unfortunately, no UAC). 2 AT-commands, 1 voice, and 2 which I haven't identified yet. Both AT interfaces seems to be identical, and I would like to take advantage of that to share control over the device between modemmanager (for internet access) and a dialler.
How do I prevent modemmanager from grabbing the second AT terminal? I've found some information about udev rules (Seriously, can't I just do it with modemmanager config? I'd really rather go this way), but the docs are not very friendly.

EDIT:
I managed to release one of the AT terminals using udev rules. I have no idea how those rules work, but every single ttyUSB has its own entry in the default rules file, so I was able to make it leave the secondary command interface out.
Now just need to write a simple dialer, and also crack bios.

sanitariu · Post by **sanitariu** » Mon Dec 01, 2025 4:59 pm

This is the most stpd programme !
Just uninstall it and user static configuration in /etc/network/interfaces if you use debian and similar to gentoo ...
Use wvdial to make ppp connection on one of the AT modems and the other you can use to check signal with AT+CSQ or just
to reset the modem.

Trying to make sense of builtin modem's interfaces

Trying to make sense of builtin modem's interfaces

1508:1000 Fibocom Fibocom Modem

Fibocom

Fixed

Same device

uninstall modemmanager