Activation Codes and Methods, Hardware Details, Sniffing
Post Reply
thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

XS Stick W100-2 from 4G Systems GmbH & Co. KG

Post by thomasschaefer » 15 Nov 2015, 20:33

( there is a german discussion about this device here:
https://forum.ubuntuusers.de/topic/inte ... st-7903378
)

4gsystems sells two total different LTE-surfsticks under the same name.

The first one was from alcatel with a different firmware.

The newer version of XS Stick W100 is from "omega"

Code: Select all

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  3 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1c9e ProdID=9bfe Rev=02.32
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=1234567890
C:  #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
One successful switch is (see ubuntu forum, link above)

Code: Select all

usb_modeswitch -v 1c9e -p 9bfe -S
The result is a switch from 1c9e:9bfe to 1c9e:9b01.
Under windows the driver switches to the same ID, and uses MI03\6 for network and MI01\6 for modem.
The XS-Manager from 4G-systems uses the networkinterface.

At the moment no driver grabs the device, so nothing happens(except storage):

Code: Select all

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1c9e ProdID=9b01 Rev=02.32
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=
C:  #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage


after loading qmi_wwan and option (in this order!)

echo "1c9e 9b01" > /sys/bus/usb/drivers/qmi_wwan/new_id
echo "1c9e 9b01" > /sys/bus/usb-serial/drivers/option1/new_id



Code: Select all

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1c9e ProdID=9b01 Rev=02.32
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=
C:  #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
Now all important things are there:

wwp0s29f7u2i3 (net), ttyUSB2 (at), cdc-wdm0 (qmi), ttyUSB1 (at)

There is also ttyUSB0, but it is not usable, at least not for at.

The device works well with qmi and ModemManager-NetworkManager.

Unfortunately dualstack is configured(addresses, routes, DNS-Resolver) , but only ipv4 works.
I don't know why. (Windows configures/uses only ipv4)
Top
Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Re: XS Stick W100-2 from 4G Systems GmbH & Co. KG

Post by Josh » 15 Nov 2015, 21:11

Thanks, once more! Will be added.

One thing strikes me as odd. From the discussion you linked, it seems that the stick works also with a non-qmi driver configuration. They just bound the "option" driver and the stick obviously worked ...

Does that mean that Network Manager can use ttyUSB ports in a QMI way - or does that mean that interface 3 understands both QMI and AT protocols?
Top
Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Re: XS Stick W100-2 from 4G Systems GmbH & Co. KG

Post by Josh » 15 Nov 2015, 21:13

Annother question is how the QMI driver knows which interface to bind to if the device is yet unknown ...
Top
thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

Re: XS Stick W100-2 from 4G Systems GmbH & Co. KG

Post by thomasschaefer » 15 Nov 2015, 21:47

If I don't load qmi_wwan and remove usb0 and usb1 then modemmanager can connect via ttyUSB2 and ppp in the traditional way.

Using qmi, there is just one interface and mm finds it.


ppp versus qmi:

Windows uses the network/qmi-mode

In most cases qmi-mode supports IPv6.

This modem unfortunately supports dualstack ipv4/ipv6 only via UMTS, via LTE the firmware seems to be buggy.


Edit 20151206:

This modem works now dualstack ipv4/ipv6 when used in qmi/raw-ip-mode.
Last edited by thomasschaefer on 06 Dec 2015, 19:44, edited 1 time in total.
Top
thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

Re: XS Stick W100-2 from 4G Systems GmbH & Co. KG

Post by thomasschaefer » 15 Nov 2015, 21:51

Josh wrote:Annother question is how the QMI driver knows which interface to bind to if the device is yet unknown ...
Some attempts to bind fail:

Code: Select all

[ 2770.201963] usb-storage 1-2:1.4: USB Mass Storage device detected
[ 2770.202777] scsi8 : usb-storage 1-2:1.4
[ 2771.212905] scsi 8:0:0:0: Direct-Access     USBModem Disk             2.31 PQ: 0 ANSI: 2
[ 2771.214053] sd 8:0:0:0: Attached scsi generic sg1 type 0
[ 2771.218155] sd 8:0:0:0: [sdb] Attached SCSI removable disk
[ 2923.340336] usbcore: registered new interface driver cdc_wdm
[ 2923.344027] usbcore: registered new interface driver qmi_wwan
[ 2931.307760] qmi_wwan: probe of 1-2:1.0 failed with error -22
[ 2931.307883] qmi_wwan 1-2:1.1: bogus CDC Union: master=0, slave=0
[ 2931.307917] qmi_wwan: probe of 1-2:1.1 failed with error -1
[ 2931.308009] qmi_wwan 1-2:1.2: bogus CDC Union: master=0, slave=0
[ 2931.308036] qmi_wwan: probe of 1-2:1.2 failed with error -1
[ 2931.309006] qmi_wwan 1-2:1.3: cdc-wdm0: USB WDM device
[ 2931.311942] qmi_wwan 1-2:1.3 wwan0: register 'qmi_wwan' at usb-0000:00:1d.7-2, WWAN/QMI device, 32:e2:f0:2e:7a:ae
Top
bmork
Posts: 167
Joined: 15 Mar 2012, 22:47
Location: Oslo, Norway

Re: XS Stick W100-2 from 4G Systems GmbH & Co. KG

Post by bmork » 16 Nov 2015, 11:49

thomasschaefer wrote:
Josh wrote:Annother question is how the QMI driver knows which interface to bind to if the device is yet unknown ...
Some attempts to bind fail:

Code: Select all

[ 2770.201963] usb-storage 1-2:1.4: USB Mass Storage device detected
[ 2770.202777] scsi8 : usb-storage 1-2:1.4
[ 2771.212905] scsi 8:0:0:0: Direct-Access     USBModem Disk             2.31 PQ: 0 ANSI: 2
[ 2771.214053] sd 8:0:0:0: Attached scsi generic sg1 type 0
[ 2771.218155] sd 8:0:0:0: [sdb] Attached SCSI removable disk
[ 2923.340336] usbcore: registered new interface driver cdc_wdm
[ 2923.344027] usbcore: registered new interface driver qmi_wwan
[ 2931.307760] qmi_wwan: probe of 1-2:1.0 failed with error -22
[ 2931.307883] qmi_wwan 1-2:1.1: bogus CDC Union: master=0, slave=0
[ 2931.307917] qmi_wwan: probe of 1-2:1.1 failed with error -1
[ 2931.308009] qmi_wwan 1-2:1.2: bogus CDC Union: master=0, slave=0
[ 2931.308036] qmi_wwan: probe of 1-2:1.2 failed with error -1
[ 2931.309006] qmi_wwan 1-2:1.3: cdc-wdm0: USB WDM device
[ 2931.311942] qmi_wwan 1-2:1.3 wwan0: register 'qmi_wwan' at usb-0000:00:1d.7-2, WWAN/QMI device, 32:e2:f0:2e:7a:ae
So that's by pure luck :)

I do actually plan to remove the hard requirement on the CDC Union because I got a report about a device with such a descriptor on the QMI interface. This prevented the device from working at all with the current qmi_wwan driver. But I haven't submitted the patch yet because I have problems getting the full details from the reporter, and I don't want to make that change without some docs referring to an actual device needing it.

There is no point in keeping the hard requirement, even if it worked out real well for this particular device. You should always expect to play a bit with the "bind" and/or "unbind" sysfs files to make dynamic IDs work on a composite device like this.

My suggested test procedure would be:
1) load qmi_wwan
2) add the device to qmi_wwan using "new_id"
3) test all the new possible qmi-devices with qmicli or similar until you find the correct one(s)
4) unbind all the failing ones using "echo x-y:z.w >/sys/bus/usb/drivers/qmi_wwan/unbind", to make them available for option
5) load option
6) add the device to option using "new_id"

You could reverse the order, but it is simpler this way because qmi_wwan has stricter requirements than option and will therefore bind to fewer interfaces (only the ones with 3 endpoints), and it is simpler to verify that QMI is not working than to check for all possible serial protocols (which could be AT, NMEA, DM and more).
Top
thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

Re: XS Stick W100-2 from 4G Systems GmbH & Co. KG

Post by thomasschaefer » 13 Feb 2016, 21:15

unswitched

Code: Select all

lsusb -v -d 1c9e:9bfe 

Bus 003 Device 006: ID 1c9e:9bfe OMEGA TECHNOLOGY 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x1c9e OMEGA TECHNOLOGY
  idProduct          0x9bfe 
  bcdDevice            2.32
  iManufacturer           2 USB Modem
  iProduct                3 USB Modem
  iSerial                 4 1234567890

  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              1 Mass Storage
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)
switched

Code: Select all

lsusb -v -d 1c9e:9b01

Bus 003 Device 007: ID 1c9e:9b01 OMEGA TECHNOLOGY 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x1c9e OMEGA TECHNOLOGY
  idProduct          0x9b01 
  bcdDevice            2.32
  iManufacturer           2 USB Modem
  iProduct                3 USB Modem
  iSerial                 4 

  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          183
    bNumInterfaces          5
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 00
      ** UNRECOGNIZED:  04 24 02 02
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 00
      ** UNRECOGNIZED:  04 24 02 02
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              1 Mass Storage
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x88  EP 8 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)
Top
Post Reply

Return to “Device Information”