[LEDE-DEV] Open and secure firmware for Quectel 4G modems [Was: Re: Quectel EC20 QMI autoconnect issues [Was: Re: [LEDE-DEV, 3/3, v3] uqmi: Prevent 'POLICY MISMATCH' error.]]

[Bjørn Mork]

Harald Welte <laforge at gnumonks.org> writes:
> On Sun, Jan 08, 2017 at 11:10:20PM +0100, Bjørn Mork wrote:
>> Note that there is nothing Quectel here.  This is a standard Qualcomm
>> platform.  The output above comes from the Sierra Wireless EM7455
>> originally delivered as part of my Lenovo X1 Carbon, running bog
>> standard firmare.
>
> Would you mind sharing information how to access the shell?  It would be
> great to add some wiki pages on the Sierra Wireless modems to our wiki
> at https://osmocom.org/projects/quectel-modems/wiki (which despite the
> URL contains a lot of information that's not quectel specific).

This is valid only for the MC/EM74xx generation:

Change the "USB_COMP" NVRAM variable to e.g. 0x0000100f
(diag,adb,nmea,modem,mbim) or 0x0000050f (diag,adb,nmea,modem,rmnet0,rmnet1).
Reset the modem, and the firmware will add an Android gadget with adbd
running as root.  There you have your root shell.

I could provide more details on how exactly you change that variable,
but I'm a little worried about distributing that to every Windows laptop
user out there. It's too easy to use without understanding the
implications.  Someone is sooner or later going to softbrick their
modems in ways that can be difficult to fix without removing the modem
from the laptop.  You can argue that it will be a self inflicted
problem, but we know it will happen so I think it is better to protect
the innocent..

FWIW, I've already been through one modem not booting properly after
playing with this variable.

But I'll send you the script I am using to create a flashable NVRAM
update in private, without any distribution restrictions. That way you
can choose whether you agree or not.  I'll not complain.  I'll just
direct any support questions to you :)



Bjørn