[bbf]

Hello,

I have an Hame A11W, which is a portable 3g wifi router.
If you search for it in Hame's site, you won't find it, but I bought it at DX.com.
Maybe it was meant only for the chinese market or something.

http://dx.com/p/hame-a11w-portable-3g-w ... ack-149308

But anyways, I've compiled OpenWRT for it, and I can properly boot it.
I'm now trying to make the embedded 3G card work.

Initially, the device is detected as a mass storage device:

Code: Select all

[   14.200000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   15.220000] ehci-platform ehci-platform: Generic Platform EHCI Controller
[   15.230000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[   15.280000] ehci-platform ehci-platform: irq 26, io mem 0x101c0000
[   15.310000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[   15.320000] hub 1-0:1.0: USB hub found
[   15.330000] hub 1-0:1.0: 1 port detected
[   15.930000] usb 1-1: new high-speed USB device number 2 using ehci-platform
[   16.210000] hub 1-0:1.0: unable to enumerate USB device on port 1
[   16.540000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[   16.560000] ohci-platform ohci-platform: Generic Platform OHCI Controller
[   16.570000] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2
[   16.580000] ohci-platform ohci-platform: irq 26, io mem 0x101c1000
[   16.660000] hub 2-0:1.0: USB hub found
[   16.670000] hub 2-0:1.0: 1 port detected
[   16.820000] usbcore: registered new interface driver cdc_acm
[   16.830000] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[   17.020000] usbcore: registered new interface driver usbserial
[   17.040000] usbcore: registered new interface driver usbserial_generic
[   17.050000] usbserial: USB Serial support registered for generic
[   17.180000] Initializing USB Mass Storage driver...
[   17.190000] usbcore: registered new interface driver usb-storage
[   17.200000] USB Mass Storage support registered.
[   17.230000] usbcore: registered new interface driver cdc_wdm
[   17.490000] usbcore: registered new interface driver cdc_ether
[   17.520000] usbcore: registered new interface driver cdc_ncm
[   17.610000] usbcore: registered new interface driver sierra_net
[   17.760000] usbcore: registered new interface driver option
[   17.770000] usbserial: USB Serial support registered for GSM modem (1-port)
[   17.930000] usbcore: registered new interface driver usbhid
[   17.940000] usbhid: USB HID core driver
[   18.880000] usb 1-1: new high-speed USB device number 3 using ehci-platform
[   19.090000] scsi0 : usb-storage 1-1:1.0
[   20.100000] scsi 0:0:0:0: CD-ROM            WCDMA    MMC CD-ROM       1.10 PQ: 0 ANSI: 2
[   20.190000] sr0: scsi-1 drive
[   20.190000] cdrom: Uniform CD-ROM driver Revision: 3.20
[   20.200000] sr 0:0:0:0: Attached scsi CD-ROM sr0
[   20.200000] sr 0:0:0:0: Attached scsi generic sg0 type 5

And here is a dump from lsusb

Code: Select all

Bus 001 Device 003: ID 23a2:1010
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x23a2
  idProduct          0x1010
  bcdDevice            0.00
  iManufacturer           1 3G-WCDMA Mobile Card
  iProduct                2 3G-WCDMA Mobile Card
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x08  EP 8 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)

So I can't find ANY reference anywhere about that vendor/product id 23a2:1010. I tried dumping all cmds from all known usb_modeswitch data, and neither of them worked. So I then tried using sdparm eject, and it "might" have worked:

Code: Select all

root@OpenWrt:/# sdparm --command=eject /dev/sr0
    /dev/sr0: WCDMA  MMC CD-ROM  1.10  [cd/dvd]
[  431.040000] usb 1-1: USB disconnect, device number 3
[  431.430000] usb 1-1: new high-speed USB device number 4 using ehci-platform
[  431.650000] cdc_acm 1-1:1.0: ttyACM0: USB ACM device

Now a lsusb shows:

Code: Select all

Bus 001 Device 004: ID 23a2:1234
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            2 Communications
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x23a2
  idProduct          0x1234
  bcdDevice            1.00
  iManufacturer           1 3G-WCDMA Mobile Card
  iProduct                2 3G-WCDMA Mobile Card
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           72
    bNumInterfaces          2
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x06
          sends break
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          1
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval              10
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      ** UNRECOGNIZED:  05 24 00 10 01
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x08  EP 8 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            2 Communications
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)

But I only have one ttyACM0 device. Shouldn't I have at least 2? I saw one interface descriptor for AT-commands port, and another for CDC Data. But if I try to use picocom on /dev/ttyACM0, I get just a lot of garbage on-screen. I suppose that's the CDC Data? Should I be passing something to some of the kernel modules? Or do I need something else do fully do the modeswitch?

I ask for help from you gurus, in any way that could help me... because I'm no expert on this. What is that "UNRECOGNIZED: 05 24 00 10 01"?

BTW, I did mount that CDROM device, and I was able to retrieve a windows exe with a installer to interface with this modem. Even thought this is soldered into the board. I have some pics on my Google+:

https://plus.google.com/u/1/11210815851 ... ut4ivVoa3T


Cheers!

[bmork]

But I only have one ttyACM0 device. Shouldn't I have at least 2?

No, not with this configuration. It has only one ACM function, using two USB interfaces (control + data). Both interfaces are used for the ttyACM0 device.

I saw one interface descriptor for AT-commands port, and another for CDC Data. But if I try to use picocom on /dev/ttyACM0, I get just a lot of garbage on-screen. I suppose that's the CDC Data?

That is unexpected. I would expect it to use AT commands. But it does not have to. It could use any serial protocol. Maybe it expects you to start a ppp session? Or maybe something else.

Should I be passing something to some of the kernel modules? Or do I need something else do fully do the modeswitch?

There could of course be other modes exposing more functions, but we have no way to guess how to switch into those. And it is not entirely unlikely that the exposed mode is the only one available either.

I ask for help from you gurus, in any way that could help me... because I'm no expert on this. What is that "UNRECOGNIZED: 05 24 00 10 01"?

That is a CDC header with version 1.10, justlike the one you see decoded on the control interface. It displays as UNRECOGNIZED because it is not expected on a data interface.

BTW, I did mount that CDROM device, and I was able to retrieve a windows exe with a installer to interface with this modem. Even thought this is soldered into the board.

If you are able to extract any *.inf files from that installer, then that would be useful. It might give the answer to whether there are other modes with more functions or not.

But then again, it may be a common driver package for a number of devices from the same vendor, in which case we don't know anything.

Of course, if you could install the device under Windows then you could snoop on any mode switching commands. But I guess that is difficult if this is an embedded modem on a non-PC platform....
[/quote]

[bbf]

Regarding it being CDC or ttyUSB with AT commands, I'm pretty sure it's the latter. I had poked around in the original firmware, and I could part of it in debug and saw lots of AT commands being sent. But the way they made the modem connect was very stupid. They had a binary program, that sent commands and awaited replies. Be it shell commands, or AT commands. If any of the replies was incorrect, it would just restart all over again. And that would include removing the kernel modules and re-inserting them. That's one of the reasons I decided to change over to OpenWRT.

I should have backed up my original firmware though, because now I can't seem to find it anywhere, and I can't even communicate with their tech support. Their firmware didn't come with 'dd' so it was really hard to dump the mtd. I should really have statically linked busybox and just do it.

Well, I suspected something was a little off, so I removed the cdc module from my kernel, and instead tried to force the option module with that new_id command. And it did work, partially at least.

I now have 2 ttyUSB devices. One should be the AT interface, and the other the data port. But if I use picocom on ttyUSB0, I don't get any replies or output whatsoever. And if I try to use comctl (openwrt), I get a kernel panic at usb_wwan. yay

I'm missing something? Maybe an extra reset that usb_modeswitch sends usually? Is there a way I can use usb_modeswitch to send the exact same command that "sdparm --command=eject /dev/sr0" does?

Thanks!

Update:

I went through the INF file that I was able to find, and found this (snippets):

Code: Select all

[MPS.NTx86]
%TitanDesc% = HSPA.Install, USB\VID_FEED&PID_1234
%TitanDesc% = HSPA.Install, USB\VID_23A2&PID_1234
%TitanDesc% = HSPA.Install, USB\VID_23A2&PID_0001
%TitanDesc% = HSPA.Install, USB\VID_FEED&PID_5678&MI_00
%TitanDesc% = HSPA.Install, USB\VID_23A2&PID_5678&MI_00
%TitanDesc% = HSPA.Install, USB\VID_23A2&PID_0001&MI_00


[HSPA.Install.NT]
AddReg = GenericAddReg, HSPA.NT.AddReg, Prop, USB
CopyFiles = CopyFiles


[GenericAddReg]
;HKR,,FriendlyDriver,0,Unimodem.vxd
;HKR,,DevLoader,0,*vcomm
HKR,,ConfigDialog,,modemui.dll
HKR,,EnumPropPages,,modemui.dll,EnumPropPages
HKR,, DeviceType, 1, 02
;HKR,,PortSubClass,1,02
HKR, Init,      1,, "AT<cr>"


[HSPA.NT.AddReg]
HKR,, InactivityScale,1, 3c,00,00,00
HKR, Init, 1,, "AT<cr>" 
HKR, Init, 2,, "AT&FE0V1X1&D2&C1S0=0<cr>"
HKR, Monitor, 1,, "ATS0=0<cr>"
HKR, Monitor, 2,, "None"
HKR, Answer,    1,, "ATA<cr>"
HKR, Hangup,    1,, "ATH<cr>"
HKR,, Reset,, "AT&F<cr>"   
HKR, Settings, Prefix,, "AT"
HKR, Settings, Terminator,, "<cr>"
........ (lots more ofc) .........


[Prop]
HKR,, Properties, 1, 80,01,00,00, 00,00,00,00, 00,00,00,00, 00,00,00,00, 00,00,00,00, 00,01,00,00, 80,9f,d5,00, 80,9f,d5,00


[USB]
HKR,,Contention,,""



[Strings]
MPS="Wcdma HSPA  Inc"
MPS.Disk="HSPA Modem Installation Disk"
Titan.Service.Name = " Titan MODEM Driver"
Titan.Service.Desc = " Titan MODEM Driver"
TitanDesc = "WCDMA HSPA MODEM 3.5G"


[CopyFiles]
hspacdc.sys,,,2

I'm now unsure about the whole CDC vs option alternative.