Activation Codes and Methods, Hardware Details, Sniffing
Post Reply
LOM
Posts: 1292
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Huawei K3806

Post by LOM » Wed Jan 23, 2013 6:02 am

This is a device which looks like a serial modem device but it is not.

Info from Huawei Linux Driver package:

SUBSYSTEMS=="usb", ATTRS{modalias}=="usb:v12D1p14AE*", KERNEL=="ttyUSB*", ATTRS{bInterfaceNumber}=="00", ATTRS{bInterfaceProtocol}=="ff", NAME="ttyUSB_utps_pcui"

SUBSYSTEMS=="usb", ATTRS{modalias}=="usb:v12D1p14AE*", KERNEL=="ttyUSB*", ATTRS{bInterfaceNumber}=="02", ATTRS{bInterfaceProtocol}=="ff", NAME="ttyUSB_utps_modem"

Info from Windows .inf file:


%VDFPcuiDesc% = DevInstall, USBCDCACM\VID_12D1&PID_14AE&MI_00
%VDFECMDesc% = ew_jucdcecm.ndi, USBCDCECM\VID_12D1&PID_14AE&MI_01
%VDFModemDesc% = DevInstall, USBCDCACM\VID_12D1&PID_14AE&MI_02

and finally a cat of the devices file which I found on the net:

T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=12d1 ProdID=14ae Rev=01.02
S: Manufacturer=Vodafone Group (Huawei)
S: Product=Vodafone Mobile Broadband (Huawei)
S: SerialNumber=0
C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 1 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=ff Driver=option
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 3 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage


bjorn?

bmork
Posts: 167
Joined: Thu Mar 15, 2012 10:47 pm
Location: Oslo, Norway

Re: Huawei K3806

Post by bmork » Wed Jan 23, 2013 10:17 pm

LOM wrote:This is a device which looks like a serial modem device but it is not.

Info from Huawei Linux Driver package:

SUBSYSTEMS=="usb", ATTRS{modalias}=="usb:v12D1p14AE*", KERNEL=="ttyUSB*", ATTRS{bInterfaceNumber}=="00", ATTRS{bInterfaceProtocol}=="ff", NAME="ttyUSB_utps_pcui"

SUBSYSTEMS=="usb", ATTRS{modalias}=="usb:v12D1p14AE*", KERNEL=="ttyUSB*", ATTRS{bInterfaceNumber}=="02", ATTRS{bInterfaceProtocol}=="ff", NAME="ttyUSB_utps_modem"

Info from Windows .inf file:


%VDFPcuiDesc% = DevInstall, USBCDCACM\VID_12D1&PID_14AE&MI_00
%VDFECMDesc% = ew_jucdcecm.ndi, USBCDCECM\VID_12D1&PID_14AE&MI_01
%VDFModemDesc% = DevInstall, USBCDCACM\VID_12D1&PID_14AE&MI_02

and finally a cat of the devices file which I found on the net:

T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=12d1 ProdID=14ae Rev=01.02
S: Manufacturer=Vodafone Group (Huawei)
S: Product=Vodafone Mobile Broadband (Huawei)
S: SerialNumber=0
C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 1 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=ff Driver=option
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 3 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage


bjorn?
The devices listing seems consistent with the .inf. Both interface #0 and interface#2 should be serial ports, most likely supporting AT commands. But not necessarily PPP.

Interface #1 is supposed to be a CDC ECM interface and supported by the cdc_ether driver. It has this entry which should match:

Code: Select all

 {
        /* Various Huawei modems with a network port like the UMG1831 */
        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
                 | USB_DEVICE_ID_MATCH_INT_INFO,
        .idVendor               = HUAWEI_VENDOR_ID,
        .bInterfaceClass        = USB_CLASS_COMM,
        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
        .bInterfaceProtocol     = 255,
        .driver_info = (unsigned long)&wwan_info,
},
But a single endpoint is obviously not going to do. This driver needs 3 (interrupt + bulk in/out), preferably distributed over 2 interfaces (control + data). And I don't see any possible data interface here. The two data endpoints are probably hidden in an interface #1 altsetting we don't see. Which is one of the reasons I really dislike the usb-devices script.... It does not show the same information the old /proc/bus/usb/devices file used to show. Inactive configurations and altsettings are hidden. This makes it somewhat useless.

Could you get a lsusb -v listing for this device? That would also show the CDC functional descriptors, which we need to know to be able to support it.

I do not think the cdc_ether driver can support this right now. It currently requires a separate data interface. But I assume we can fix that in much the same way we recently fixed cdc_ncm to work with another Huawei Jungo firmware variant.


Bjørn

LOM
Posts: 1292
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: Huawei K3806

Post by LOM » Thu Jan 24, 2013 1:37 pm

bmork wrote: Could you get a lsusb -v listing for this device? That would also show the CDC functional descriptors, which we need to know to be able to support it.

I do not think the cdc_ether driver can support this right now. It currently requires a separate data interface. But I assume we can fix that in much the same way we recently fixed cdc_ncm to work with another Huawei Jungo firmware variant.

Bjørn
I've been looking all over the net but that usb-devices output is all I can find.
The problem with K3806 is mentioned in a couple of forums but no user has provided much of useful info in order to
solve his problem :(
Someone googling for K3806 problem may find this thread and supply the needed info.

zuzzurro
Posts: 1
Joined: Thu Dec 06, 2018 4:05 pm

Re: Huawei K3806

Post by zuzzurro » Thu Dec 06, 2018 4:15 pm

LOM wrote:
bmork wrote: Could you get a lsusb -v listing for this device? That would also show the CDC functional descriptors, which we need to know to be able to support it.

I do not think the cdc_ether driver can support this right now. It currently requires a separate data interface. But I assume we can fix that in much the same way we recently fixed cdc_ncm to work with another Huawei Jungo firmware variant.

Bjørn
I've been looking all over the net but that usb-devices output is all I can find.
The problem with K3806 is mentioned in a couple of forums but no user has provided much of useful info in order to
solve his problem :(
Someone googling for K3806 problem may find this thread and supply the needed info.
And that's precisely what happened. It just took 5 years. I have one K3806, I would like to use it, and here is the lsusb -v:

Code: Select all

Bus 001 Device 011: ID 12d1:14ae Huawei Technologies Co., Ltd. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x12d1 Huawei Technologies Co., Ltd.
  idProduct          0x14ae 
  bcdDevice            1.02
  iManufacturer           3 Vodafone Group (Huawei)
  iProduct                2 Vodafone Mobile Broadband (Huawei)
  iSerial                 4 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x00c7
    bNumInterfaces          4
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  04 24 02 07
      ** UNRECOGNIZED:  05 24 01 03 00
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      6 Ethernet Networking
      bInterfaceProtocol    255 
      iInterface              0 
      CDC Header:
        bcdCDC               1.10
      CDC Ethernet:
        iMacAddress                      1 001e101f0001
        bmEthernetStatistics    0x0000000f
        wMaxSegmentSize               1514
        wNumberMCFilters            0x0003
        bNumberPowerFilters              1
      CDC Union:
        bMasterInterface        1
        bSlaveInterface         1 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       1
      bNumEndpoints           3
      bInterfaceClass         2 Communications
      bInterfaceSubClass      6 Ethernet Networking
      bInterfaceProtocol    255 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  04 24 02 07
      ** UNRECOGNIZED:  05 24 01 03 02
      ** UNRECOGNIZED:  05 24 06 02 02
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0000
  (Bus Powered)


LOM
Posts: 1292
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: Huawei K3806

Post by LOM » Mon Dec 10, 2018 4:11 pm

zuzzurro wrote: I have one K3806, I would like to use it,
Thanks for the verbose usb listing which shows that the ethernet data interface is missing but the ethernet control interface has an alternate mode which must be the missing data part.

The linux ethernet driver does currently not support this type of combined interface which is a Huawei experiment.
Bjorn mentioned a possibility to rewrite the ethernet driver but I question if it is worth doing, K3806 is afaik the only ethernet dongle using this combined interface model and it is an old and slow device.
I will ping Bjorn and ask him to come here, he may have a different opinion.


You can probably get the device to work in linux if you use Huawei's proprietary driver (hw_cdc_driver.c) but you'll have to compile it yourself from source.

bmork
Posts: 167
Joined: Thu Mar 15, 2012 10:47 pm
Location: Oslo, Norway

Re: Huawei K3806

Post by bmork » Tue Dec 11, 2018 11:27 am

Thanks for the lsusb output confirming our earlier assumptions. It shows the alternate setting with 3 endpoints as expected, and it shows that we have all the necessary CDC functional descriptors. Including a Union descriptor with master and slave pointing to the same interface. Which is as correct as possible with a combined control and data interface like this.

The only problem is that I can't see where this fails with the current cdc_ether driver. I've looked through it with that lsusb output in mind, and AFAICS it should work. Which means I'm missing something.... Assuming it doesn't work, of course.
  1. The interface class/subclass/protocol should match the id table entry I pointed to earlier, making cdc_ether autoload and probe the interface.
  2. This should end up calling usbnet_generic_cdc_bind() to do most of the probe work.
  3. Parsing the CDC functional descriptors should find all 3 required: header, ethernet and union, since this happens while the interface is in altsetting 0
  4. The code will use the interface number from the union descriptor to figure out which interfaces to use for control and data, and it is prepared for these being the same. So that should resultin in interface #1 being both control and data interface here.
  5. We will then call usbnet_get_endpoints(), which will cycle through all possible altsettings looking for one with the necessary endpoints. This should end up with the interface being swithced to altsetting 1 and all 3 endpoints found
  6. Then we'll read the mac address using the ethernet descriptor found earlier and the cdc_ether specific probing is done
I will need some debugging help figuroung out where this fails. Assuming you run this on a standard distro kernel with all bells and whistles, the easiest start is to simply turn on the little debugging that's already there. Do this as root, using sudo or whatever is your distros preferred method:

Code: Select all

mount -t debugfs none /sys/kernel/debug
modprobe cdc_ether
echo 'file cdc_ether.c +fp' >/sys/kernel/debug/dynamic_debug/control
echo 'file usbnet.c +fp' >/sys/kernel/debug/dynamic_debug/control 
Then plug in the modem and run dmesg to see the kernel messages. Post the result here.

Note that you should disconnect any other USB ethernet like adapters while doing this to prevent unnecessary log noise. The above recipe will enable all debug messages in the driver. You can look at the available messages and their status flags by reading the /sys/kernel/debug/dynamic_debug/control file. To quickly disable all dynamic debugging, do for example:

Code: Select all

echo '=_' >/sys/kernel/debug/dynamic_debug/control 
I am hoping these messages will point to a specific place where this fails.

Post Reply