FM350-GL GNSS functionality

[Janrupf]

Hi,
thanks for the package, this got the modem into a working state! I'm now trying to see what else the model is capable of. According to the documentation, it is also supposed to support GNSS, however, I can't get this working.

AT+GTGPSSWITCH?

+CME ERROR: unknown

Do you happen to have any idea what is going on here? The manual states that this command is supposed to toggle GPS power, but from what I can tell my modem doesn't know this command in the first place?

[mrhaav]

Hi
I have the same issue.
I don´t if the state of pin26, W_DISABLE2#, will change anything.

[Janrupf]

Hmm, I would have expected that pin to only be relevant when AT+GTFMODE=1,1 is set, though interestingly enough the manual only mentions that explictily for W_DISABLE1#, which is the RF disable pin.

[Janrupf]

I couldn't get it to work regardless of the state of the W_DISABLE2# pin, neither setting it high or low changed anything.

Commands to toggle the pin on a Banana Pi R3 Mini:

# set W_DISABLE2# = LOW
gpioset -c 0 11=0
# set W_DISABLE2# = HIGH
gpioset -c 0 11=1

How I got this information:

• Banana Pi R3 mini device tree: https://github.com/torvalds/linux/blob/848e076317446f9c663771ddec142d7c2eb4cb43/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3-mini.dts#L361 [Note: GPIO_6 is not the number you are looking for, you need to look at the GPIO dirver!]
• mt7986 GPIO driver: https://github.com/torvalds/linux/blob/848e076317446f9c663771ddec142d7c2eb4cb43/drivers/pinctrl/mediatek/pinctrl-mt7986.c#L491 [shows mapping of GPIO_6 to 11]
• Banana Pi R3 mini schematics: https://drive.google.com/file/d/1wvovcYf0OtvQl5fekJku25QNeER1D7cM/view [confirms GPIO_6 as the GNSS disable pin]

For anyone reading this/trying to reproduce this: The commands above only, and I really mean only work on the Banana Pi R3 Mini. If you have a different board, you will need to check the drivers/schematics in order to find the correct GPIO numbers

[mrhaav]

Regarding the gpioset command, I don´t get any response when I run gpioset -c 0 11=1. I need to run CRTL + c to interrupt it.
Is that normal?

[Janrupf]

Yeah thats normal, it also only keeps the pin set while the command is running, after the command exits the pin is floating again (well, the kernel only guarantees that it is set while the command is running, but in most cases it doesn't reset after interrupting. Though to be sure just background it)

On my Banana Pi R3 mini the LTE LED toggles off when running gpioset -c 0 13=0 and on when running gpioset -c 0 13=1, should be a nice confirmation that the commands are working.

[mrhaav]

gpioset -c 0 13=0 = AT+CFUN=4 = Flight mode On
gpioset -c 0 13=1 = AT+CFUN=1 = Flight mode Off

[Janrupf]

Does your module actually respond with +CFUN: 4 when setting 13 to 0?

Because interestingly enough, regardless of +GTFMODE, the LTE light toggles, but +CFUN is always 1.

[Janrupf]

I figured it out by reverse engineering the firmware... as far as I can tell, the commands in the manual are plainly wrong and don't exist.

Here is what I figured out:

1. The TTY for GPS commands is another one (I'm unsure which to be honest, in my case it was ttyUSB5 - IMPORTANT: the tty does NOT echo the commands you type, but it also responds to AT
2. Thanks to this russian forum I managed to get an ADB shell onto the device (yep... it runs OpenWRT, lmao) - on Windows this works when the MTK USB drivers are installed. On Linux its weird... adb doesn't find the device for some reason when using libusb, however, start ADB with ADB_LIBUSB=0 adb start-server (if already running, issue adb kill-server first) makes ADB detect it.

From there you can do adb shell and in the shell run login, username is root without a password. It's a normal OpenWRT system, logread -f is surprisingly helpful because Fibocom seems to have left in a bunch of debugging information.

3. I reverse engineered parts of the firmware in Ghidra to figure out the basic commands:

• AT+GTGPSSWITCH=1 <- from the manual, I haven't find this in the part I reverse engineered but it works
• AT+ELCSGNSSENABLE=1 <- No idea why that is needed, but thats what enables all the magic
• AT+GTGPSPOWER=1 <- this works after running AT+ELCSGNSSENABLE=1

And thats it... suddenly it spits out NMEA information.

Apendix: All the commands I'm aware of that are in the GPS daemon:

AT+ELCSSTART
AT+ELCSSTOP
AT+ELCSHOSTRST
AT+ELCSSTATUS?
AT+ELCSGNSSENABLE
AT+ELCSNIENABLE
AT+ELCSAGPSMODE
AT+ELCSSUPLVER
AT+ELCSSUPLADDR
AT+ELCSDELAIDING
AT+ELCSNIRSP
AT+ELCSREFLOCRSP
AT+ELCSREFTIMERSP
AT+ELCSNMEACFG
AT+ELCSTTFFQOP
AT+ELCSLOOPBACK
AT+ELCSCERT
AT+ELCSCERT?
AT+ELCSCERTDEL
AT+ELCSCERTDELALL
AT+EGEOMAX?
AT+EGEOADDCIRCLE
AT+EGEODEL
AT+EGEODELALL
AT+ELCSTEST
AT+ELCSLOCSATCFG
AT+ELCSNMEAINTERVAL
AT+ELCSGNSSMODE
AT+ELCSGNSSDBGLOGSTART
AT+ELCSGNSSDBGLOGSTOP

[mrhaav]

Do you have any special GPS antenna connected?

Which of the USB interface is the GPS interface?

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
D:  Ver= 3.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs=  1
P:  Vendor=0e8d ProdID=7127 Rev= 0.01
S:  Manufacturer=Fibocom Wireless Inc.
S:  Product=FM350-GL
C:* #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=896mA
A:  FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=125us
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=87(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=06(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=07(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=08(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=8a(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=09(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms

[Janrupf]

Do you have any special GPS antenna connected?

On the D/G Slot I have a 5G antenna (some random amazon one). In order to get reception I needed to move the antenna very close to a window, but the signal is more than excellent now.

Which of the USB interface is the GPS interface?

On my Banana Pi R3 its ttyUSB1 now, if I interpret the output correctly, its If#3:

# readlink -f /sys/class/tty/ttyUSB1/device/
/sys/devices/platform/soc/11200000.usb/usb2/2-1/2-1:1.3/ttyUSB1

Otherwise you'll need to tell me how to go from ttyUSBX to the USB IF#.