NO CARRIER with Huawei ME906s

With my Huawei ME906s on Linux (tested with debian sid, debian experimental, Fedora 24 and Ubuntu 16.04, but the result's the same under Windows 10), I get either ERROR or NO CARRIER messages (depending on which device I'm using). In contrast to this question, the behavior is consistent and also occurs when I run wvdial long after boot. I have removed the SIM PIN and verified that the mobile network works with an Android smartphone.

Using Linux 4.7.0-rc4, I see 5 devices I can associate to the card:

• /dev/ttyUSB0 - Speaks AT, output shown below
• /dev/ttyUSB1 - No output (for GPS?)
• /dev/ttyUSB2 - Speaks AT, but answers ERROR instead of NO CARRIER to dial
• /dev/ttyUSB3 - Same behavior as /dev/ttyUSB0
• /dev/ttyUSB4 - No output (for GPS?)

Here's the output I get with a specially crafted wvdial.conf:

--> WvDial: Internet dialer version 1.61
--> Initializing modem.
--> Sending: ATZ
ATZ
OK
--> Sending: AT+CFUN=1
AT+CFUN=1
OK
--> Sending: ATQ0 V1 E1 S0=0
ATQ0 V1 E1 S0=0
OK
--> Sending: AT+CGDCONT=1,"IP","internet.t-mobile"
AT+CGDCONT=1,"IP","internet.t-mobile"
OK
--> Sending: ATI
ATI
Manufacturer: Huawei Technologies Co., Ltd.
Model: ME906s-158
Revision: 11.617.00.00.00
IMEI: 8<snip by @phihag>0
+GCAP: +CGSM,+DS,+ES
OK
--> Sending: AT+CPIN?
AT+CPIN?
+CPIN: READY
OK
--> Sending: AT+CFUN?
AT+CFUN?
+CFUN: 1
OK
--> Sending: AT+CSQ
AT+CSQ
+CSQ: 99,99
OK
--> Sending: AT+CREG?
AT+CREG?
+CREG: 0,2
OK
--> Modem initialized.
--> Sending: ATD*99#
--> Waiting for carrier.
ATD*99#
NO CARRIER
--> No Carrier!  Trying again.

The last 5 lines are then repeated 10+ times.

Other tools like sakis3g and ModemManager/NetworkManager hang as well while trying to connect.

I am also seeing a network link associated with the modem, but that's not reachable either:

$ ip link
...
6: enp0s20f0u5c2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
    link/ether 02:1e:10:1f:00:00 brd ff:ff:ff:ff:ff:ff

I believe rfkill not to be active:

$ rfkill list
0: tpacpi_bluetooth_sw: Bluetooth
        Soft blocked: no
        Hard blocked: no
1: tpacpi_wwan_sw: Wireless WAN
        Soft blocked: no
        Hard blocked: no
3: phy0: Wireless LAN
        Soft blocked: no
        Hard blocked: no
10: hci0: Bluetooth
        Soft blocked: no
        Hard blocked: no

(talking to /dev/ttyUSB0)

AT^RFSWITCH?
^RFSWITCH: 1,1

OK

As suggested, I tried using AT^NDISDUP instead, to no avail (although at the next ATZ I see additional lines):

$ minicom -D /dev/ttyUSB0
ATZ
OK
^PDPSTATUS: 2
^NDISSTAT: 0,0,,"IPV4"
AT^NDISDUP=1,1,"internet.t-mobile"
OK

AT^DHCP?
ERROR

However, ip link still shows NO-CARRIER, and dhclient -v enp0s20f0u5c2 times out as well. With ethtool I see:

$ ethtool -i enp0s20f0u5c2
driver: cdc_ether
version: 22-Aug-2005
firmware-version: CDC Ethernet Device
expansion-rom-version: 
bus-info: usb-0000:00:14.0-5
supports-statistics: no
supports-test: no
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: no

dmesg looks good to me:

[   11.674523] cdc_ether 1-5:2.0 usb0: register 'cdc_ether' at usb-0000:00:14.0-5, CDC Ethernet Device, 02:1e:10:1f:00:00
[   11.674630] usbcore: registered new interface driver cdc_ether
[   11.675451] option 1-5:2.2: GSM modem (1-port) converter detected
[   11.675746] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB0
[   11.675767] option 1-5:2.3: GSM modem (1-port) converter detected
[   11.676499] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB1
[   11.676528] option 1-5:2.4: GSM modem (1-port) converter detected
[   11.676569] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB2
[   11.676586] option 1-5:2.5: GSM modem (1-port) converter detected
[   11.676620] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB3
[   11.676637] option 1-5:2.6: GSM modem (1-port) converter detected
[   11.676672] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB4

Similarily, the lsusb output looks fairly normal.

How do I get my Huawei ME906s to connect?

Did you check the AT^RFSWITCH? status? It should return AT^RFSWITCH: 1,1. If there are any zeroes, then the modem is in rfkill "airplane" mode.

The huawei modem has two rfswitch (also known as rflock or rfkill) settings: one hardware and one software. The Software rf-kill can be disabled by issuing AT^RFSWITCH=1.

The hardware setting must be disabled from your mainboard/platform, as it actually pulls low a pin on the M.2/mPCIe connector. On laptops this is often controlled by a ACPI function key. On my X260, this is exposed on Linux as /sys/class/rfkill/rfkill3/state

You might want to try a more recent connection method:

AT^NDISDUP=1,1,"internet.t-mobile"

Then use a DHCP client on your enp0s20f0u5c2 interface that you see.

If you are connected, then AT^DHCP? should also yield an answer with your IP in hexadecimal notation.

I had the same issue with my ME906s-158 modem. Tried to use it via MBIM - no luck. Modem had an outdated firmware - so I updated it to latest one got it from techship.com. After update ME906s worked as expected in cdc_ether mode. Before enabling connection on modem network interface looked as:

26: enp0s29u1u2u5c2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
     link/ether 02:1e:10:1f:00:00 brd ff:ff:ff:ff:ff:ff

I need to enable connection by AT command AT^NDISDUP=1,1. And interface got IP via DHCP:

26: enp0s29u1u2u5c2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
     link/ether 02:1e:10:1f:00:00 brd ff:ff:ff:ff:ff:ff
     inet 10.173.107.197/30 brd 10.173.107.199 scope global dynamic enp0s29u1u2u5c2
       valid_lft 518398sec preferred_lft 518398sec
    inet6 fe80::ef85:b8f8:761e:b922/64 scope link 
         valid_lft forever preferred_lft forever