Chapter 55F: Cellular modems¶

What: integrating a 4G/LTE modem with embedded Linux. The two big paths: USB modems with QMI/MBIM/RNDIS data interfaces (Quectel EC20/EC25, SimCom SIM7600), and UART AT-command modems with PPP (older parts and NB-IoT chips). The user-space orchestrator is ModemManager, supplemented by qmicli / mbimcli or, for AT modems, raw chat scripts.

Why: every IoT device that ships without WiFi+wired backhaul has a cellular modem. Getting the bring-up right early avoids weeks of customer-side debugging.

Focus: picking the data mode. The EC25 alone exposes four USB modes: RNDIS, ECM, QMI, MBIM. The wrong choice produces no working interface. QMI is the standard mode for Linux today. Use it unless you have a specific reason not to.

Tooling. This chapter uses ppp (pppd, chat), ModemManager (mmcli), libqmi-utils (qmicli).

Ubuntu-base (target): apt install ppp modemmanager libqmi-utils

Buildroot: BR2_PACKAGE_PPP=y BR2_PACKAGE_MODEM_MANAGER=y BR2_PACKAGE_LIBQMI=y Buildroot: a configuration-driven build system that produces a complete root filesystem and related images.

Full per-tool reference: Userspace tooling appendix. MCU bridge: Think of the rootfs as the firmware image’s file-backed runtime environment. On an MCU you link everything into flash. On Linux, programs and config live in this mounted tree. rootfs: root filesystem, the directory tree mounted at / that contains /bin, /etc, /dev, and libraries.

55F.1 Hardware connection¶

USB modems plug into a USB host port (i.MX6ULL USB OTG configured as host). They draw 1–2 A during TX bursts, your power supply must handle it. Most bench-test failures are power-related.

UART modems wire to a UART (typically 115200 baud + flow control). Plus an “enable” GPIO and a “status” GPIO.

MCU bridge: Think of Linux GPIO like the same pin set/reset block you used on STM32, but accessed through a kernel subsystem that owns numbering, direction, interrupts, and user-space exposure. GPIO: General-Purpose Input/Output, a pin controlled as a digital input, output, or interrupt source.

55F.2 USB EC25 (QMI mode)¶

After plugging in, lsusb shows:

[root@pa-mini:~]# lsusb
Bus 001 Device 002: ID 2c7c:0125 Quectel Wireless Solutions Co., Ltd. EC25 LTE modem

The driver qmi_wwan handles QMI. option provides AT-command serial ports.

[root@pa-mini:~]# dmesg | tail -20
usb 1-1: New USB device found, idVendor=2c7c, idProduct=0125
qmi_wwan 1-1:1.4 wwan0: register 'qmi_wwan' at usb-...
option 1-1:1.0: GSM modem (1-port) converter detected
usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0
usb 1-1: GSM modem (1-port) converter now attached to ttyUSB1
...

/dev/ttyUSB0–/dev/ttyUSB3 are AT-command channels. wwan0 is the data interface. /dev/cdc-wdm0 is the QMI control channel.

55F.3 ModemManager, the easy path¶

[root@pa-mini:~]# systemctl start ModemManager
[root@pa-mini:~]# mmcli -L
    /org/freedesktop/ModemManager1/Modem/0 [Quectel] EC25

[root@pa-mini:~]# mmcli -m 0
  -------------------------
  Hardware |   manufacturer: Quectel
           |          model: EC25
           |       revision: EC25EFAR05A04M4G
  System   |         device: /sys/devices/...
  ...
  Status   |  unlock retries: sim-pin (3), sim-puk (10)
           |          state: registered
           |    power state: on
           |        signal: 75 %

Set up a connection:

[root@pa-mini:~]# mmcli -m 0 --simple-connect="apn=internet"
successfully connected the modem
[root@pa-mini:~]# ip link show wwan0
wwan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
[root@pa-mini:~]# dhclient wwan0
[root@pa-mini:~]# ping 8.8.8.8

For NetworkManager / nmcli users:

nmcli connection add type gsm con-name lte apn internet
nmcli connection up lte

55F.4 Manual QMI¶

If you don’t want ModemManager:

# Set raw mode for the wwan0 interface
[root@pa-mini:~]# qmicli -d /dev/cdc-wdm0 --dms-set-operating-mode='online'
[root@pa-mini:~]# qmicli -d /dev/cdc-wdm0 --wda-set-data-format='raw-ip'
[root@pa-mini:~]# ip link set wwan0 down
[root@pa-mini:~]# echo Y > /sys/class/net/wwan0/qmi/raw_ip
[root@pa-mini:~]# ip link set wwan0 up

# Start data session
[root@pa-mini:~]# qmicli -d /dev/cdc-wdm0 --wds-start-network="apn='internet',ip-type=4" --client-no-release-cid
        Packet data handle: '...'
        CID: '...'

[root@pa-mini:~]# udhcpc -i wwan0

Manual setup is fragile. Use ModemManager when you can.

55F.5 UART AT-command modem (e.g., A7670C)¶

Wire UART TX/RX to a UART on the i.MX6ULL. Power-on sequence: assert PWRKEY GPIO for ~500 ms.

[root@pa-mini:~]# echo 1 > /sys/class/gpio/gpioN/value
[root@pa-mini:~]# sleep 0.5
[root@pa-mini:~]# echo 0 > /sys/class/gpio/gpioN/value

[root@pa-mini:~]# minicom -D /dev/ttymxc1 -b 115200
AT
OK
AT+CSQ
+CSQ: 22,99
OK
AT+CGREG?
+CGREG: 0,1
OK

For data: PPP via pppd + chat script.

/etc/ppp/peers/a7670:

/dev/ttymxc1
115200
crtscts
connect '/usr/sbin/chat -v -f /etc/ppp/chat-a7670'
defaultroute
usepeerdns
noauth

/etc/ppp/chat-a7670:

ABORT BUSY
ABORT 'NO CARRIER'
'' AT
OK ATD*99#
CONNECT ''

Then pppd call a7670. A ppp0 interface appears, with internet routed through the modem.

PPP is slow (~10 Mbit/s max) and adds latency. Use only for old modems without USB.

55F.6 Key Notes¶

Cellular integration separates modem control, the data interface and host network configuration. QMI, MBIM, Ethernet-like modes and PPP imply different drivers and management paths.
One manager should own modem state. Competing AT sessions or network managers can change a configuration another component expects to retain.
Registration, a data session, an IP address and usable routing are separate states. An OK reply to an AT command proves none of the later states.
Carrier provisioning, antenna design and supply transients are system dependencies. USB enumeration does not qualify the RF or power path.
Failover needs a route and retry policy that considers cost, availability and session disruption, not just whether one ping succeeded.

55F.7 Pitfalls¶

USB power. EC25 spikes to >1.5 A on TX bursts. 5V/2A is the minimum. Less = USB resets at the worst moments.
Wrong USB mode. EC25 boots in RNDIS by default in some firmware. Switch to QMI: AT+QCFG="usbnet",0.
APN wrong / missing. Carriers reject your registration silently. Cross-check with your SIM provider.
Regulatory. Some bands are illegal in some countries. Use a regional-specific modem variant.
Antenna SWR. Bad antenna match = poor signal. Cellular antennas matter as much as WiFi antennas.
raw_ip mode trap. EC25 needs raw_ip mode. ModemManager sets it. Manual QMI must too.

55F.8 Going deeper¶

https://www.freedesktop.org/wiki/Software/ModemManager/: ModemManager docs.
libqmi / libmbim: the C libraries beneath qmicli/mbimcli.
drivers/net/usb/qmi_wwan.c: kernel QMI driver.
drivers/usb/serial/option.c: AT-command channel exposure.
3GPP TS 27.007: AT command set standard.

Next chapter: Chapter 55G: Multi-touch GT911. Touchscreens, MT-B slot protocol, calibration.