Enable GNSS_NMEA for FN920C04/FN990A28 PCIE

based on:fn920c04-pcie-on-x86

vim drivers/bus/mhi/host/pci_generic.c

static const struct mhi_channel_config mhi_telit_fn920c04_channels[] = {
        MHI_CHANNEL_CONFIG_UL(0, "GNSS", 32, 1),
        MHI_CHANNEL_CONFIG_DL(1, "GNSS", 32, 1),
        MHI_CHANNEL_CONFIG_UL_SBL(2, "SAHARA", 32, 0),
        MHI_CHANNEL_CONFIG_DL_SBL(3, "SAHARA", 32, 0),
        MHI_CHANNEL_CONFIG_UL(4, "DIAG", 64, 1),
        MHI_CHANNEL_CONFIG_DL(5, "DIAG", 64, 1),
        MHI_CHANNEL_CONFIG_UL(14, "QMI", 32, 0),
        MHI_CHANNEL_CONFIG_DL(15, "QMI", 32, 0),
        
        MHI_CHANNEL_CONFIG_UL(30, "DUN3", 32, 0),
        MHI_CHANNEL_CONFIG_DL(31, "DUN3", 32, 0),
        
        MHI_CHANNEL_CONFIG_UL(32, "DUN", 32, 0),
        MHI_CHANNEL_CONFIG_DL(33, "DUN", 32, 0),
        MHI_CHANNEL_CONFIG_UL_FP(34, "FIREHOSE", 32, 0),
        MHI_CHANNEL_CONFIG_DL_FP(35, "FIREHOSE", 32, 0),
        MHI_CHANNEL_CONFIG_UL(92, "DUN2", 32, 1),
        MHI_CHANNEL_CONFIG_DL(93, "DUN2", 32, 1),
        
        MHI_CHANNEL_CONFIG_UL(94, "DUN4", 32, 1),
        MHI_CHANNEL_CONFIG_DL(95, "DUN4", 32, 1),
        
        MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0", 128, 2),
        MHI_CHANNEL_CONFIG_HW_DL(101, "IP_HW0", 128, 3),
};

vim drivers/net/wwan/mhi_wwan_ctrl.c

static const struct mhi_device_id mhi_wwan_ctrl_match_table[] = {
        { .chan = "DUN", .driver_data = WWAN_PORT_AT },
        { .chan = "DUN2", .driver_data = WWAN_PORT_AT },
        
        { .chan = "DUN3", .driver_data = WWAN_PORT_AT },
        { .chan = "DUN4", .driver_data = WWAN_PORT_AT },
        
        { .chan = "MBIM", .driver_data = WWAN_PORT_MBIM },
        { .chan = "QMI", .driver_data = WWAN_PORT_QMI },
        { .chan = "DIAG", .driver_data = WWAN_PORT_QCDM },
        { .chan = "FIREHOSE", .driver_data = WWAN_PORT_FIREHOSE },
        {},
};
MODULE_DEVICE_TABLE(mhi, mhi_wwan_ctrl_match_table);

minicom -D /dev/wwan0at1

AT$GPSNMUN=1,1,1,1,1,1,1
AT$GPSP=1

minicom -D /dev/wwan0at3

$GPSNMUN: $GPGSA,A,1,,,,,,,,,,,,,,,,*32
$GPSNMUN: $GPVTG,,T,,M,,N,,K,N*2C
$GPSNMUN: $GPRMC,,V,,,,,,,,,,N,V*29
$GPSNMUN: $GPGGA,,,,,,0,,,,,,,,*66
$GPSNMUN: $GPGLL,,,,,,V,N*64
...
...

FN990

static const struct mhi_channel_config mhi_telit_fn990_channels[] = {
        MHI_CHANNEL_CONFIG_UL_SBL(2, "SAHARA", 32, 0),
        MHI_CHANNEL_CONFIG_DL_SBL(3, "SAHARA", 32, 0),
        MHI_CHANNEL_CONFIG_UL(4, "DIAG", 64, 1),
        MHI_CHANNEL_CONFIG_DL(5, "DIAG", 64, 1),
        MHI_CHANNEL_CONFIG_UL(12, "MBIM", 32, 0),
        MHI_CHANNEL_CONFIG_DL(13, "MBIM", 32, 0),
        MHI_CHANNEL_CONFIG_UL(30, "DUN3", 32, 0),
        MHI_CHANNEL_CONFIG_DL(31, "DUN3", 32, 0),
        MHI_CHANNEL_CONFIG_UL(32, "DUN", 32, 0),
        MHI_CHANNEL_CONFIG_DL(33, "DUN", 32, 0),
        MHI_CHANNEL_CONFIG_UL(92, "DUN2", 32, 1),
        MHI_CHANNEL_CONFIG_DL(93, "DUN2", 32, 1),
        MHI_CHANNEL_CONFIG_UL(94, "DUN4", 32, 1),
        MHI_CHANNEL_CONFIG_DL(95, "DUN4", 32, 1),
        MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0_MBIM", 128, 2),
        MHI_CHANNEL_CONFIG_HW_DL(101, "IP_HW0_MBIM", 128, 3),
};

FN920C04 PCIE on X86_64

Kernel: 6.9.12

• Modify Kernel Code
  a. pci_generic.c
  b. kernel config

  $ grep -i "mhi" ./config-6.9.12
  CONFIG_QRTR_MHI=m
  # CONFIG_PCI_EPF_MHI is not set
  CONFIG_MHI_BUS=m
  CONFIG_MHI_BUS_DEBUG=y
  CONFIG_MHI_BUS_PCI_GENERIC=m
  CONFIG_MHI_BUS_EP=m
  CONFIG_MHI_NET=m
  CONFIG_MHI_WWAN_CTRL=m
  CONFIG_MHI_WWAN_MBIM=m
  

  c. lspci

  $ lspci -nn
  03:00.0 Unassigned class [ff00]: Qualcomm Device [17cb:011a]
  
  $ lspci -k
  03:00.0 Unassigned class [ff00]: Qualcomm Device 011a
          Subsystem: Device 1c5d:2020
          Kernel driver in use: mhi-pci-generic
          Kernel modules: mhi_pci_generic
  

  d. dmesg

  $ sudo dmesg | grep -i mhi
  [    5.721867] mhi_pci_generic: module verification failed: signature and/or required key missing - tainting kernel
  [    5.724379] mhi-pci-generic 0000:03:00.0: MHI PCI device found: telit-fn920c04
  [    5.724387] mhi-pci-generic 0000:03:00.0: BAR 0 [mem 0xd0801000-0xd0801fff 64bit]: assigned
  [    5.729509] mhi mhi0: Requested to power ON
  [    5.729535] mhi mhi0: Power on setup success
  

  e. device node

  $ ls -alh /dev/wwan0*
  crw------- 1 root root 242, 2  七   2 09:37 /dev/wwan0at0
  crw------- 1 root root 242, 3  七   2 09:37 /dev/wwan0at1
  crw------- 1 root root 242, 0  七   2 09:37 /dev/wwan0qcdm0
  crw------- 1 root root 242, 1  七   2 09:37 /dev/wwan0qmi0
  

  f. interface

  $ ls /sys/class/net/
  eno1  lo  mhi_hwip0
  
  
  $ udevadm info /sys/class/net/mhi_hwip0
  P: /devices/pci0000:00/0000:00:1c.0/0000:03:00.0/mhi0/mhi0_IP_HW0/net/mhi_hwip0
  L: 0
  E: DEVPATH=/devices/pci0000:00/0000:00:1c.0/0000:03:00.0/mhi0/mhi0_IP_HW0/net/mhi_hwip0
  E: INTERFACE=mhi_hwip0
  E: IFINDEX=3
  E: SUBSYSTEM=net
  E: USEC_INITIALIZED=5963171
  E: ID_MM_CANDIDATE=1
  E: ID_BUS=pci
  E: ID_VENDOR_ID=0x17cb
  E: ID_MODEL_ID=0x011a
  E: ID_PCI_CLASS_FROM_DATABASE=Unassigned class
  E: ID_VENDOR_FROM_DATABASE=Qualcomm
  E: ID_PATH=pci-0000:03:00.0
  E: ID_PATH_TAG=pci-0000_03_00_0
  E: ID_NET_DRIVER=mhi_net
  E: ID_NET_LINK_FILE=/usr/lib/systemd/network/99-default.link
  E: ID_NET_NAME=mhi_hwip0
  E: SYSTEMD_ALIAS=/sys/subsystem/net/devices/mhi_hwip0
  E: TAGS=:systemd:
  E: CURRENT_TAGS=:systemd:
  

FN920C04 FW version (要B022, B015有問題)

at#swpkgv
49.00.000-B022-P0V.130000
M0V.060000-B022
P0V.130000
A0V.000000-B022

qmicli+udhcpc, 但系統無法取得IP, 用ip route解決

#write profile in /etc/qmi-network.conf
    APN=INTERNET #CHT
    APN_USER=
    APN_PASS=
    PROXY=yes

$ qmicli -V
qmicli 1.32.0

$ sudo qmicli -d /dev/wwan0qmi0 --dms-set-operating-mode='online'
[/dev/wwan0qmi0] Operating mode set successfully


$ sudo ip link set wwan0 up


$ sudo qmicli -d /dev/wwan0qmi0 --wda-get-data-format
[/dev/wwan0qmi0] Successfully got data format
                   QoS flow header: no
               Link layer protocol: 'raw-ip'
  Uplink data aggregation protocol: 'disabled'
Downlink data aggregation protocol: 'disabled'
                     NDP signature: '0'
Downlink data aggregation max datagrams: '0'
Downlink data aggregation max size: '0'


$ sudo qmi-network /dev/wwan0qmi0 start
Loading profile at /etc/qmi-network.conf...
    APN: INTERNET
    APN user: unset
    APN password: unset
    qmi-proxy: yes
    IP_TYPE: unset
    PROFILE: unset
Checking data format with 'qmicli -d /dev/wwan0qmi0 --wda-get-data-format --device-open-proxy'...
Device link layer protocol retrieved: raw-ip
Getting expected data format with 'qmicli -d /dev/wwan0qmi0 --get-expected-data-format'...
error: cannot get expected data format: Setting expected data format management is unsupported by the driver
Expected link layer protocol not retrieved: kernel unsupported
Updating device link layer protocol with 'qmicli -d /dev/wwan0qmi0 --wda-set-data-format=802-3 --device-open-proxy'...
New device link layer protocol retrieved: raw-ip
Starting network with 'qmicli -d /dev/wwan0qmi0 --wds-start-network=apn='INTERNET'  --client-no-release-cid --device-open-proxy'...
Saving state at /tmp/qmi-network-state-wwan0qmi0... (CID: 15)
Saving state at /tmp/qmi-network-state-wwan0qmi0... (PDH: 3771166512)
Network started successfully


$ sudo qmicli -d /dev/wwan0qmi0 --wds-get-current-settings
[/dev/wwan0qmi0] Current settings retrieved:
           IP Family: IPv4
        IPv4 address: 10.169.211.193
    IPv4 subnet mask: 255.255.255.252
IPv4 gateway address: 10.169.211.194
    IPv4 primary DNS: 168.95.1.1
  IPv4 secondary DNS: 168.95.192.1
                 MTU: 1500
             Domains: none


$ sudo ip addr add 10.169.211.193/30 dev mhi_hwip0


$ ip route
10.169.211.192/30 dev mhi_hwip0 proto kernel scope link src 10.169.211.193



$ sudo ip route add default via 10.169.211.193


$ ifconfig mhi_hwip0
mhi_hwip0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 16384
        inet 10.169.211.193  netmask 255.255.255.252  destination 10.169.211.193
        inet6 fe80::200:ff:fe00:0  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 288 (288.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ ping -I mhi_hwip0 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 10.169.211.193 mhi_hwip0: 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=114 time=432 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=114 time=35.6 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=114 time=32.7 ms
...
...

$ ping google.com
ping: google.com: Temporary failure in name resolution



$ echo "nameserver 168.95.1.1" | sudo tee /etc/resolv.conf
nameserver 168.95.1.1


$ ping google.com
PING google.com (142.250.198.78) 56(84) bytes of data.
64 bytes from lctsaa-ab-in-f14.1e100.net (142.250.198.78): icmp_seq=1 ttl=114 time=15.5 ms
64 bytes from lctsaa-ab-in-f14.1e100.net (142.250.198.78): icmp_seq=2 ttl=114 time=40.8 ms
64 bytes from lctsaa-ab-in-f14.1e100.net (142.250.198.78): icmp_seq=3 ttl=114 time=39.9 ms
...
...

ModemManager (FN920C04 PCIE是用 wwan0qmi0)

$ mmcli --version
mmcli 1.18.6
Copyright (2011 - 2021) Aleksander Morgado
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl-2.0.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

$ mmcli -L
    /org/freedesktop/ModemManager1/Modem/0 [Telit Cinterion] FN920C04-WW

$ mmcli -m 0
  ----------------------------------
  General  |                   path: /org/freedesktop/ModemManager1/Modem/0
           |              device id: 6be85a5a4dfee78138924ac7c4fa075a8ebca546
  ----------------------------------
  Hardware |           manufacturer: Telit Cinterion
           |                  model: FN920C04-WW
           |      firmware revision: M0V.060000-B022
           |         carrier config: default
           |           h/w revision: 1.20
           |              supported: lte, 5gnr
           |                current: lte, 5gnr
           |           equipment id: 355411761011444
  ----------------------------------
  System   |                 device: /sys/devices/pci0000:00/0000:00:1c.0/0000:03:00.0
           |                drivers: mhi_net, mhi-pci-generic
           |                 plugin: generic
           |           primary port: wwan0qmi0
           |                  ports: mhi_hwip0 (net), wwan0at0 (at), wwan0at1 (at),
           |                         wwan0qmi0 (qmi)
  ----------------------------------
...
...
...
  ----------------------------------
  3GPP EPS |   ue mode of operation: csps-2
           |    initial bearer path: /org/freedesktop/ModemManager1/Bearer/0
           | initial bearer ip type: ipv4
  ----------------------------------
  SIM      |       primary sim path: /org/freedesktop/ModemManager1/SIM/0
           |         sim slot paths: slot 1: /org/freedesktop/ModemManager1/SIM/0 (active)
           |                         slot 2: none

troubleshooting
1. disable ModemManager and poweroff.

$ sudo qmicli -d /dev/wwan0qmi0 --dms-set-operating-mode='online'
[sudo] password for ubuntu:
[02  七  2025, 10:03:49] -Warning ** Error reading from istream: Resource temporarily unavailable
error: couldn't create client for the 'dms' service: CID allocation failed in the CTL client: endpoint hangup

2. 目前的FN920C04 FW(B22), 好像還不能使用ModemManager...升級1.24後再來試試

$ sudo mmcli -m 0 --create-bearer='apn=internet,ip-type=ipv4'
[sudo] password for ubuntu:
Successfully created new bearer in modem:
        /org/freedesktop/ModemManager1/Bearer/1

$ sudo mmcli -m 0 --simple-connect='apn=internet,ip-type=ipv4v6'
error: couldn't connect the modem: 'GDBus.Error:org.freedesktop.ModemManager1.Error.MobileEquipment.NetworkTimeout: Network timeout'

Send SMS via AT commands

Module:
Telit LN920A06

def text_to_ucs2_hex(text):
    return text.encode('utf-16-be').hex().upper()

def encode_phone_number(number):
    # 處理台灣號碼，如 0966123456 → +886966123456
    if number.startswith('0'):
        number = '886' + number[1:]
    elif number.startswith('+'):
        number = number[1:]

    if len(number) % 2 != 0:
        number += 'F'

    swapped = ''.join([number[i+1] + number[i] for i in range(0, len(number), 2)])
    return swapped, len(number)

def generate_pdu_and_cmgs(phone, message):
    # UCS2 編碼
    ucs2 = text_to_ucs2_hex(message)
    ucs2_len = len(ucs2) // 2  # bytes

    # 編碼電話號碼
    phone_enc, phone_digits = encode_phone_number(phone)
    phone_len_hex = f"{phone_digits:X}".zfill(2)

    # 組合 PDU
    smsc = "00"
    pdu_type = "11"
    mr = "00"
    toa = "91"
    pid = "00"
    dcs = "08"
    vp = "AA"  # 約 4 天
    udl = f"{ucs2_len:02X}"

    pdu_body = (
        pdu_type + mr + phone_len_hex + toa + phone_enc +
        pid + dcs + vp + udl + ucs2
    )

    full_pdu = smsc + pdu_body

    # CMGS = 從 PDU_TYPE 開始的長度（即去掉 SMSC 的 "00" 開頭，長度為 1 byte = 2 hex）
    cmgs_len = (len(full_pdu) - 2) // 2

    return full_pdu, cmgs_len

# 測試
phone = "0911223333"
message = "哈囉世界"

pdu, cmgs_len = generate_pdu_and_cmgs(phone, message)
print(f"AT+CMGF=0")
print(f"AT+CMGS={cmgs_len}")
print(pdu)

AT+CMGF=0 //PDU
OK

AT+CMGS=22
0011000C918896553679610008AA0854C856C94E16754C(ctrl+z)
+CMGS: 18

OK

ref:
1. GSM Modem 傳送簡訊的幾個 AT 指令
2. GPRS應用之: AT指令發送PDU簡訊詳解