Every piece of this is documented somewhere, and almost none of it is documented together. This is the whole path from a dead WWAN card to an eSIM profile installed and enabled on a ThinkPad P14s Gen 5 AMD running Arch, plus the failure modes that cost the most time.

Fair warning up front: the profile downloads and enables, but the modem still does not attach to the network. The open problem is at the bottom, unresolved. Everything above it is verified working.

Hardware

The two device nodes matter. lpac talks to the eUICC over the AT port, while radio state is set over MBIM. Reaching for the wrong one produces errors that look like hardware faults.

1. Firmware

Firmware comes through fwupdmgr, but current fwupd will not do it. You need to downgrade to 1.9.x from the Arch Archive. Stop ModemManager and unload libmbim/libqmi first, or the update fails holding a busy device.

fwupdmgr refresh --force
fwupdmgr get-devices
fwupdmgr update

Confirm the modem still answers afterwards:

minicom -D /dev/wwan0at0

Type AT, expect OK.

2. FCC unlock

Lenovo ships the modem FCC-locked. The radio stays off until an unlock runs. ModemManager has the script, it just is not wired up:

sudo ln -s /usr/share/ModemManager/fcc-unlock.available.d/1eac \
           /etc/ModemManager/fcc-unlock.d/1eac:1007

If the automatic unlock does not take, force the radio on directly:

mbimcli --device-open-proxy --device="/dev/wwan0mbim0" \
        --quectel-set-radio-state=on

There is also an AUR package that handles this as a service:

yay -S lenovo-wwan-unlock
sudo systemctl enable --now lenovo-wwan-unlock

3. Switch to the eSIM slot

The eUICC is slot 2. Stop ModemManager before touching the AT port, otherwise the two fight over it:

sudo systemctl stop ModemManager
sudo minicom -D /dev/wwan0at0

AT+QUIMSLOT=2

AT+QUIMSLOT? reports the current slot.

4. Install lpac

lpac is the eSIM profile manager, the LPA in the specification's terms.

paru -S lpac-git
sudo pacman -S pcsclite ccid
sudo systemctl enable --now pcscd.socket

The gotcha that wasted the most time. The environment variables must be passed through sudo, on the same side as the command:

sudo LPAC_APDU=at LPAC_APDU_AT_DEVICE=/dev/wwan0at0 lpac chip info

Setting them before sudo means lpac never sees them, falls back to the PC/SC backend, and fails with SCardEstablishContext, which looks like a smartcard daemon problem and is not one.

Also note the older names AT_DEBUG and AT_DEVICE are deprecated. Use LPAC_APDU_AT_DEBUG and LPAC_APDU_AT_DEVICE.

5. Download a profile

An eSIM QR code encodes LPA:1$<SMDP_ADDRESS>$<ACTIVATION_CODE>. Split it on the $ and feed the halves in:

sudo LPAC_APDU=at LPAC_APDU_AT_DEVICE=/dev/wwan0at0 \
     lpac profile download -s <SMDP_ADDRESS> -m "<ACTIVATION_CODE>"

This needs working internet over some other interface, Wi-Fi being the obvious one, since the download happens over IP and not over the cellular link you are trying to provision.

6. Enable it

Downloading is not enabling. A downloaded but disabled profile reports as esim-without-profiles, which reads like the download failed when it did not:

sudo LPAC_APDU=at LPAC_APDU_AT_DEVICE=/dev/wwan0at0 \
     lpac profile enable <ICCID>

Then reset the modem from minicom so it re-reads the eUICC:

AT+CFUN=1,1

7. Connect

sudo systemctl start ModemManager
mmcli -m 0 --enable
nmcli connection add type gsm ifname "*" con-name <name> apn <apn>
nmcli connection up <name>

Known issues

Collected from the actual attempts, in rough order of how much time each cost:

• SCardEstablishContext: LPAC_APDU=at did not reach lpac through sudo. See above.
• esim-without-profiles after a successful download: the profile is there but disabled. lpac profile enable.
• lpac hangs: the AT port can lock up during long operations. Reboot or rebind the USB device, then check state with lpac profile list.
• PhoneFailure on a network scan: radio is off. Re-run the mbimcli radio-state command and retry.
• EID mismatch on download: the profile was bound to a different device's eUICC. There is no fix on the Linux side; the carrier has to re-provision against the right EID.
• Activation code already consumed: once a profile has been downloaded to any device, the code is spent. It cannot be reused, including after a failed install on the same machine.
• Profiles do not transfer between devices: once activated on one eUICC the binding is permanent. Confirmed with the provider. Moving to another laptop means buying another profile, which is worth knowing before you buy the first one.
• General modem instability: the RM520N-GL resets itself fairly often, and the radio-state command frequently needs repeating afterwards.

The part that does not work

The profile is installed and enabled. The modem does not attach.

mmcli -m 0 --3gpp-scan fails with PhoneFailure even directly after a successful radio-state-on, and the correct APN for the provider is still unknown; the plausible candidates each fail the same way, so the scan failure is probably the real blocker rather than the APN.

Two open threads: whether the repeated self-resets are a firmware problem that a newer RM520NGL build fixes, and whether the profile needs a carrier-side activation step that was never performed. I will update this post when the link comes up.

Command reference

Your own IMEI, EID, and ICCID appear throughout lpac and mmcli output. They identify your hardware and your SIM subscription, so keep them out of anything you paste into a forum thread or an issue tracker.