Activation Codes and Methods, Hardware Details, Sniffing
Post Reply
thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

4G LTE usb-modem U901

Post by thomasschaefer » 11 Feb 2016, 23:17

Hi,

I collect some information about this device, but I need some help:


The device looks like this:

Code: Select all

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  3 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=98ff Rev=00.00
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=1234567890ABCDEF
C:  #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
After

Code: Select all

usb_modeswitch -v 05c6 -p 98ff -S
it looks like this

Code: Select all

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 12 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=6001 Rev=00.00
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=1234567890ABCDEF
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 12 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=6001 Rev=00.00
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=1234567890ABCDEF
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
But I afraid I have not the right module bindings.

Just

Code: Select all

echo "05c6 6001" > /sys/bus/usb/drivers/qmi_wwan/new_id
echo "05c6 6001" > /sys/bus/usb-serial/drivers/option1/new_id
is to much.

In windows the device switches to 05c6:6001

and the

device -numbers are:

00 for diagnostic
01 for modem
02 for application
03 for ethernet

Code: Select all

[ 9448.024904] usb 1-4: USB disconnect, device number 5
[ 9448.612099] usb 1-4: new high-speed USB device number 6 using ehci-pci
[ 9448.748666] usb 1-4: New USB device found, idVendor=05c6, idProduct=6001
[ 9448.748682] usb 1-4: New USB device strings: Mfr=3, Product=2, SerialNumber=4
[ 9448.748692] usb 1-4: Product: USB Modem
[ 9448.748700] usb 1-4: Manufacturer: USB Modem
[ 9448.748708] usb 1-4: SerialNumber: 1234567890ABCDEF
[ 9448.753921] usb-storage 1-4:1.4: USB Mass Storage device detected
[ 9448.760654] scsi host7: usb-storage 1-4:1.4
[ 9449.761811] scsi 7:0:0:0: Direct-Access     USBModem Disk             2.31 PQ: 0 ANSI: 2
[ 9449.762825] sd 7:0:0:0: Attached scsi generic sg1 type 0
[ 9449.768614] sd 7:0:0:0: [sdb] Attached SCSI removable disk
[ 9449.769238] scsi 7:0:0:1: CD-ROM            USBModem Disk             2.31 PQ: 0 ANSI: 2
[ 9449.778474] sr 7:0:0:1: [sr0] scsi-1 drive
[ 9449.779111] sr 7:0:0:1: Attached scsi CD-ROM sr0
[ 9449.779723] sr 7:0:0:1: Attached scsi generic sg2 type 5
[ 9519.787956] usbcore: registered new interface driver cdc_wdm
[ 9519.792313] usbcore: registered new interface driver qmi_wwan
[ 9634.893621] qmi_wwan: probe of 1-4:1.0 failed with error -22
[ 9634.896384] qmi_wwan 1-4:1.1: cdc-wdm0: USB WDM device
[ 9634.897596] qmi_wwan 1-4:1.1 wwan0: register 'qmi_wwan' at usb-0000:00:1d.7-4, WWAN/QMI device, b6:d2:21:28:db:f7
[ 9634.903310] qmi_wwan: probe of 1-4:1.2 failed with error -22
[ 9634.904938] qmi_wwan 1-4:1.3: cdc-wdm1: USB WDM device
[ 9634.907517] qmi_wwan 1-4:1.3 wwan1: register 'qmi_wwan' at usb-0000:00:1d.7-4, WWAN/QMI device, b6:d2:21:28:db:f7
[ 9635.113942] qmi_wwan 1-4:1.1: unknown notification 32 received: index 1 len 2
dmesg-1.txt lines 1-45/45 (END)
I think there is one wwan-device to much, or it is completely wrong.

Any suggestions?
Should I try different modules too, if so which?

Regards,
Thomas

thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

Re: 4G LTE usb-modem U901

Post by thomasschaefer » 11 Feb 2016, 23:46

I found that I have to do here:

http://www.draisberghof.de/usb_modeswit ... 017#p16017


I will present the results later...

thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

Re: 4G LTE usb-modem U901

Post by thomasschaefer » 12 Feb 2016, 16:25

Code: Select all

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=6001 Rev=00.00
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=1234567890ABCDEF
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage


qmicli -d /dev/cdc-wdm1 --get-service-version-info

[/dev/cdc-wdm1] Supported versions:
        ctl (1.5)
        wds (1.12)
        dms (1.6)
        nas (1.16)
        wms (1.4)
        pds (1.10)
        auth (1.1)
        at (1.1)
        voice (2.1)
        cat2 (2.0)
        uim (1.4)
        pbm (1.4)
        cat (2.0)


echo "1-4:1.1" > /sys/bus/usb/drivers/qmi_wwan/unbind

modprobe option

echo "05c6 6001" > /sys/bus/usb-serial/drivers/option1/new_id
Starting ModemManager and NetworkManager - "connect".

IPv4/IPv6 works.

LOM
Posts: 1404
Joined: 11 Jul 2012, 15:14
Location: Koh Samui, TH

Re: 4G LTE usb-modem U901

Post by LOM » 12 Feb 2016, 19:24

Thanks for the report Thomas, the id's will be added in the next data package release.
Can you please confirm that the dongle switches using -S (which is SierraMode), I had expected the dongle to either switch by itself or by using -K (which is StandardEject).

The USB Id 05c6:6001 after switching is likely a Qualcomm default id which remains because a sloppy Chinese mfgr didn't have an own id to replace it with.
This is the third 05c6:6001 variant I know of.

thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

Re: 4G LTE usb-modem U901

Post by thomasschaefer » 12 Feb 2016, 20:31

Self switching did not happen.

I tried already -K and eject /dev/sr0 both without effect. I haven’t sniffed the Windows driver.
So tried some messages from Qualcomm, -K -S and some others.

Because the result is the same as under windows I think the switching method must be ok.

And it works. In ppp-mode it did not work under Windows. Under Linux I have not checked, if modemmanager did hit the right port, but it did not work - at least under my test conditions.

The (qmi)wwan-interface works well, with IPv4 and IPv6 in 3G and 4G. It was not necessary to switch in raw-ip-mode.

I will check the support of raw-ip-mode later. But now I have found a working configuration, which looks like the mode under windows.

About the ID-chaos, no comment. If we run in conflicts, we will see it.

Thomas

thomasschaefer
Posts: 114
Joined: 17 Jul 2011, 12:08

Re: 4G LTE usb-modem U901

Post by thomasschaefer » 13 Feb 2016, 20:43

unswitched:

Code: Select all

Bus 003 Device 003: ID 05c6:98ff Qualcomm, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x98ff 
  bcdDevice            0.00
  iManufacturer           3 USB Modem
  iProduct                2 USB Modem
  iSerial                 4 1234567890ABCDEF
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          1 USB Modem
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)
attempt to switch with a special message:

Code: Select all

 usb_modeswitch -v 05c6 -p 98ff -M "5553424312345678000000000001061e000000000000000000000000000000"
Look for default devices ...
   product ID matched
 Found devices in default mode (1)
Access device 004 on bus 003
Current configuration number is 1
Use interface number 0
Use endpoints 0x01 (out) and 0x81 (in)

USB description data (for identification)
-------------------------
Manufacturer: USB Modem
     Product: USB Modem
  Serial No.: 1234567890ABCDEF
-------------------------
Looking for active driver ...
 OK, driver detached
Set up interface 0
Use endpoint 0x01 for message sending ...
Trying to send message 1 to endpoint 0x01 ...
 OK, message successfully sent
Reset response endpoint 0x81
Reset message endpoint 0x01
-> Run lsusb to note any changes. Bye!

hpmini:~ # dmesg
hpmini:~ # dmesg
hpmini:~ # usb_modeswitch -v 05c6 -p 98ff -S
Look for default devices ...
   product ID matched
 Found devices in default mode (1)
Access device 004 on bus 003
Current configuration number is 1
Use interface number 0

USB description data (for identification)
-------------------------
Manufacturer: USB Modem
     Product: USB Modem
  Serial No.: 1234567890ABCDEF
-------------------------
Send Sierra control message
 communication with device stopped. May have switched modes anyway
-> Run lsusb to note any changes. Bye!

hpmini:~ # dmesg
[ 1061.997211] usb 3-4: USB disconnect, device number 4
[ 1062.584101] usb 3-4: new high-speed USB device number 5 using ehci-pci
[ 1062.719884] usb 3-4: New USB device found, idVendor=05c6, idProduct=6001
[ 1062.719902] usb 3-4: New USB device strings: Mfr=3, Product=2, SerialNumber=4
[ 1062.719911] usb 3-4: Product: USB Modem
[ 1062.719920] usb 3-4: Manufacturer: USB Modem
[ 1062.719928] usb 3-4: SerialNumber: 1234567890ABCDEF
[ 1062.726526] usb-storage 3-4:1.4: USB Mass Storage device detected
[ 1062.731160] scsi host6: usb-storage 3-4:1.4
[ 1063.730212] scsi 6:0:0:0: Direct-Access     USBModem Disk             2.31 PQ: 0 ANSI: 2
[ 1063.732434] sd 6:0:0:0: Attached scsi generic sg1 type 0
[ 1063.737727] sd 6:0:0:0: [sdb] Attached SCSI removable disk
[ 1063.746698] scsi 6:0:0:1: CD-ROM            USBModem Disk             2.31 PQ: 0 ANSI: 2
[ 1063.750209] sr 6:0:0:1: [sr0] scsi-1 drive
[ 1063.750802] sr 6:0:0:1: Attached scsi CD-ROM sr0
[ 1063.751741] sr 6:0:0:1: Attached scsi generic sg2 type 5
hpmini:~ #


attached is the switched version of the output lsusb -v
[Ed: included in post]

Code: Select all

Bus 003 Device 005: ID 05c6:6001 Qualcomm, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x6001 
  bcdDevice            0.00
  iManufacturer           3 USB Modem
  iProduct                2 USB Modem
  iSerial                 4 1234567890ABCDEF
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          138
    bNumInterfaces          5
    bConfigurationValue     1
    iConfiguration          1 USB Modem
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)
Attachments
lsub-v-2.txt
(7.42 KiB) Downloaded 569 times

Post Reply