Page 1 of 10
Cisco AM10
Posted: 29 Mar 2011, 06:03
by teegee543
Hello, I'm having a lot of trouble getting my Cisco AM10 Wireless-N USB adapter to work. First, I want to make sure usb_modeswitch is the right solution to my problem.
My wireless adapter is detected as a USB drive with lsusb -l:
Code: Select all
Bus 001 Device 053: ID 1307:1169 Transcend Information, Inc. TS2GJF210 JetFlash 210 2GB
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x1307 Transcend Information, Inc.
idProduct 0x1169 TS2GJF210 JetFlash 210 2GB
bcdDevice 1.00
iManufacturer 1 Cisco Systems, Inc.
iProduct 5 Cisco AM10 AM10
iSerial 3 00000000000AA3
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 39
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 98mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 8
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)
Bus 001 Device 052: ID 1307:0169 Transcend Information, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 9 Hub
bDeviceSubClass 0 Unused
bDeviceProtocol 1 Single TT
bMaxPacketSize0 64
idVendor 0x1307 Transcend Information, Inc.
idProduct 0x0169
bcdDevice 1.00
iManufacturer 1 Cisco Systems, Inc.
iProduct 4 Cisco AM10 USB Hub
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 98mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 8
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x0004
Ganged power switching
Compound device
Ganged overcurrent protection
TT think time 8 FS bits
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 49 milli Ampere
DeviceRemovable 0x0a
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0503 highspeed power enable connect
Port 2: 0000.0100 power
Port 3: 0000.0100 power
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 9 Hub
bDeviceSubClass 0 Unused
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered
From what I'm reading, I need to create a config file:
Code: Select all
########################################################
# Cisco AM10
DefaultVendor= 0x1307
DefaultProduct=0x1169
MessageEndpoint = 0x01
MessageContent="55534243088019820002000080000a2855534243088019820002000080000a28"
CheckSuccess=20
I got the MessageEndpoint and MessageContent from UsbSnoop, but I'm really confused as to which entry I should be getting the MessageContent from. I've seen a couple different TransferBufferMDL data values neither of which have worked:
55534243088019820002000080000a28000000000000000100000000000000
55534243088019820800000080000a25000000000000000000000000000000
Running my config file gives me this:
Code: Select all
usb_modeswitch -c 1307\:1169
Note: target parameter missing; success check limited
Looking for default devices ...
Found devices in default mode, class or configuration (1)
Accessing device 063 on bus 001 ...
Getting the current device configuration ...
OK, got current device configuration (1)
Using endpoints 0x01 (out) and 0x82 (in)
Using endpoints 0x01 (out) and 0x82 (in)
Inquiring device details; driver will be detached ...
Looking for active driver ...
OK, driver found ("usb-storage")
OK, driver "usb-storage" detached
SCSI inquiry data (for identification)
-------------------------
Vendor String:
Model String: Cisco AM10
Revision String: 0.00
-------------------------
USB description data (for identification)
-------------------------
Manufacturer: Cisco Systems, Inc.
Product: Cisco AM10 AM10
Serial No.: 00000000000AA3
-------------------------
Setting up communication with interface 0 ...
Using endpoint 0x01 for message sending ...
Trying to send message 1 to endpoint 0x01 ...
OK, message successfully sent
Resetting response endpoint 0x82
Resetting message endpoint 0x01
Checking for mode switch (max. 20 times, once per second) ...
Waiting for original device to vanish ...
According to this article, the chip in my device is a Ralink RT3072:
http://www.wikidevi.com/wiki/Cisco_AM10
And here's my UsbSnoop.log:
http://www.berrypi.com/UsbSnoop.log
Please let me know what I'm doing wrong. Thanks!
Posted: 29 Mar 2011, 08:22
by Josh
Did you sniff with the Windows driver already installed?
To me it looks like there is a lot of data exchange with the device in storage mode.
After you installed the "filter" in the sniffing program, clear any existing log ("Delete Log"), then start or resume log, then plug the device in (with driver already installed).
Note that with the driver installed, you probably won't see your original storage device as "Present" anymore because it will immediately be switched. Check the box "List Devices Not Present" to access it for filter installing.
Posted: 30 Mar 2011, 00:37
by teegee543
I did not have the Windows driver installed already. I installed the driver in XP and it was able to pick up wireless networks.
Here's the resulting log:
http://www.berrypi.com/UsbSnoop2.log
Here's another log that only had a filter on the Mass Storage Device. I'm not sure which device I should have had the filter installed on:
http://www.berrypi.com/UsbSnoop3.log
Posted: 30 Mar 2011, 08:35
by Josh
Hmm, your logs seem to start somewhere in the middle ...
Plug out your device, "Delete" the log, then start/resume logging, then plug in.
It is absolutely correct to install the filter only on the storage device; but make sure you get the right one - there might be annother one after switching which is usually a SD card slot.
So you want the original installation storage, with ID 1307:1169 (in Windows that would be "Vid_1307&Pid_1169"). This device ceases to exist at some point after the switching command, so the log should stop growing (hit "Refresh" to follow this).
This also means that the original installation storage is "not present" after switching; you have to find it in the long list.
Posted: 31 Mar 2011, 00:25
by teegee543
I've installed the filter on the original storage: ID 1307:1169, but Sniff USB won't let me resume logging when the device is unplugged. What am I doing wrong? I am using version Sniff USB 2.0.0006. Also, the mass storage device on the AM10 doesn't disappear when it gets switched. The wifi is enabled, but I can still access the USB drive in My Computer.
It looks like the drive has a hub built-in.
Posted: 01 Apr 2011, 08:12
by Josh
I do have that problem from time to time. I suspect one of the XP updates has meddled with the USB stack.
If you have deleted the log and "Resume" is greyed out, try to just plug in. Sometimes the logging starts right away.
Posted: 01 Apr 2011, 23:29
by teegee543
I managed to get logging to start right away, but I can only get that to work once per boot. Here's a log that hopefully starts at the beginning.
http://www.berrypi.com/UsbSnoop4.log
Thanks for the help so far!
Posted: 02 Apr 2011, 09:51
by Josh
Now the log does have a clear starting point. Very good.
Unfortunately, there are only standard storage commands in it, nothing outside of the norm ...
There is still the possibility that the switching command is issued through the hub device. Can you do it all over again with the filter installed on the hub ?
You can stop logging as soon as the network device is present - uncheck the "List Devices Not Present" before plugging in and hit "Refresh" repeatedly during logging, it should appear at some point.
Posted: 02 Apr 2011, 17:32
by teegee543
The reason I think there's a hub involved is because of this lsusb listing:
Code: Select all
Bus 001 Device 052: ID 1307:0169 Transcend Information, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 9 Hub
bDeviceSubClass 0 Unused
bDeviceProtocol 1 Single TT
bMaxPacketSize0 64
idVendor 0x1307 Transcend Information, Inc.
idProduct 0x0169
bcdDevice 1.00
iManufacturer 1 Cisco Systems, Inc.
iProduct 4 Cisco AM10 USB Hub
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 98mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 8
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x0004
Ganged power switching
Compound device
Ganged overcurrent protection
TT think time 8 FS bits
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 49 milli Ampere
DeviceRemovable 0x0a
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0503 highspeed power enable connect
Port 2: 0000.0100 power
Port 3: 0000.0100 power
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 9 Hub
bDeviceSubClass 0 Unused
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered
But that device ID 1307:0169 never shows up in Sniff USB:
http://img856.imageshack.us/img856/4022 ... onal20.png
And nothing seems to ever get logged on the device in the screenshot with a filter installed (the second Cisco AM10). When the adapter gets switched, only the first Cisco AM10 device is "Present" and the Mass Storage device also remains "Present". The other USB devices you see on the list have nothing to do with the wireless adapter. They all are "Present" when I unplug the dongle:
http://img856.imageshack.us/img856/212/ ... nal20f.png
Posted: 06 Apr 2011, 08:26
by Josh
That is all very mysterious ...
Could you do one last log with filters installed on all three Cisco devices?
Posted: 19 Apr 2011, 04:37
by teegee543
Yeah, I'm confused as well... Sorry about the delay, here's a log with filters on all three Cisco devices:
http://www.berrypi.com/UsbSnoop5.log
Posted: 19 Apr 2011, 14:41
by Josh
Not bad.
It is now obvious that the modem device appears at millisecond 4562.
Before that moment there is a lot of "00" commands (... 06 00) which is basically an "idle" function like "are you still there?". This goes on for over 2.5 seconds. Then, right before the modem appearance, there is a "read" command. Maybe you can try that one - it would be unusual, but so is the whole device setup ...
MessageContent="5553424330c5e2810800000080000a25000000000000000000000000000000"
NeedResponse=1
Posted: 19 Apr 2011, 23:41
by teegee543
Josh wrote:
MessageContent="5553424330c5e2810800000080000a25000000000000000000000000000000"
NeedResponse=1
That did not work. However, installing the driver in a Windows XP virtual machine and attaching the dongle to the VM somehow switches the device, allowing the wireless device to show up in lsusb:
Code: Select all
Bus 002 Device 020: ID 13b1:0031 Linksys AM10 v1 802.11n [Ralink RT2870]
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x13b1 Linksys
idProduct 0x0031 AM10 v1 802.11n [Ralink RT2870]
bcdDevice 1.01
iManufacturer 1 Cisco
iProduct 2 Cisco AM10
iSerial 3
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 67
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 450mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 7
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 5
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x05 EP 5 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x06 EP 6 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)
Bus 002 Device 019: ID 1307:1169 Transcend Information, Inc. TS2GJF210 JetFlash 210 2GB
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x1307 Transcend Information, Inc.
idProduct 0x1169 TS2GJF210 JetFlash 210 2GB
bcdDevice 1.00
iManufacturer 1 Cisco Systems, Inc.
iProduct 5 Cisco AM10 AM10
iSerial 3 00000000000AA3
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 39
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 98mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 8
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0000
(Bus Powered)
Bus 002 Device 018: ID 1307:0169 Transcend Information, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 9 Hub
bDeviceSubClass 0 Unused
bDeviceProtocol 1 Single TT
bMaxPacketSize0 64
idVendor 0x1307 Transcend Information, Inc.
idProduct 0x0169
bcdDevice 1.00
iManufacturer 1 Cisco Systems, Inc.
iProduct 4 Cisco AM10 USB Hub
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 98mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 8
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x0004
Ganged power switching
Compound device
Ganged overcurrent protection
TT think time 8 FS bits
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 49 milli Ampere
DeviceRemovable 0x0a
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0503 highspeed power enable connect
Port 2: 0000.0503 highspeed power enable connect
Port 3: 0000.0100 power
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 9 Hub
bDeviceSubClass 0 Unused
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered
Do you think we need to leave the mass storage device mounted for it to switch? When Windows XP does the switching, the dongle can still be seen as a USB drive.
Posted: 20 Apr 2011, 14:54
by Josh
teegee543 wrote:Do you think we need to leave the mass storage device mounted for it to switch? When Windows XP does the switching, the dongle can still be seen as a USB drive.
Well, that would be a catch 22 - to send
any custom command to a storage device, the storage driver has to be detached. Which means effectively unmounting the storage ...
Annother try:
Right before the repeating "idle" calls there is a sequence of "0xfd" commands (look for "0a fd"). This is not a standard SCSI or USB opcode. After these 11 commands there is only idling.
Here they are:
"55534243f83bcd810002000080000afd000000030000000100000000000000"
"55534243984300820002000080000afd000000070000000100000000000000"
"55534243984300820000000000000afd000100071000000000000000000000"
"55534243984300820002000080000afd000200230000000100000000000000"
"55534243984300820000000000000afd000300238200000000000000000000"
"55534243984300820002000080000afd000200260000000100000000000000"
"55534243984300820000000000000afd00030026c800000000000000000000"
"55534243d84c04820002000080000afd000010730000000100000000000000"
"55534243d84c04820002000080000afd000200240000000100000000000000"
"55534243d84c04820000000000000afd000300241300000000000000000000"
"55534243d84c04820000000000000afd000110732400000000000000000000"
Phew. OK. Time for some copy-and-paste.
Since usb_modeswitch can only take three bulk commands so far, you could try to set up four different config files and run them in sequence. "NeedResponse" should be set to 1 in all of them. Skip everything else like SuccessCheck and add the -I parameter on the command line.
If you get into trouble, I will create a special mode for this device in a usb_modeswitch test version.
Posted: 20 Apr 2011, 15:32
by Josh
There is more. Two "WRITE" commands which are not quite in place.
Before testing them, make sure you can't write to the storage. Otherwise these are potentially dangerous.
MessageContent="5553424308f024820002000000000a2a0000000fc000000100000000000000"
MessageContent2="5553424330c5e2810002000000000a2a000001117000000100000000000000"
