ZTE MF636 USB u3g modem
Mike Tancsa
mike at sentex.net
Tue May 5 21:23:16 UTC 2009
At 01:41 PM 5/5/2009, Mike Tancsa wrote:
>Has anyone had any luck getting this modem to work under FreeBSD ? I
>have been trying to modify the driver to get it to recognize and
>send the unit into modem mode, but no luck. I even tried setting the
>unit into permanent modem mode first from Windows as referenced in
>http://www.matt-barrett.com/?p=5
>but no luck yet
>
>usbdevs shows it as
>port 2 addr 2: high speed, power 500 mA, config 1, ZTE CDMA
>Technologies MSM(0x2000), ZTE, Incorporated(0x19d2), rev 0.00
>
>
>u3g0: sending CD eject command to change to modem mode
>u3g0: sent command to change to modem mode
>u3g0: read back CSW
OK, some progress! It now comes up as
u3g0: <ZTE, Incorporated ZTE CDMA Technologies MSM, class 0/0, rev
2.00/0.00, addr 2> on uhub1
u3g0: changing CMOTECH modem to modem mode
u3g0: sent command to change to modem mode
u3g0: failed to read back CSW: 13
u3g0: at uhub1 port 2 (addr 2) disconnected
u3g0: detached
ucom0: <ZTE, Incorporated ZTE CDMA Technologies MSM, class 0/0, rev
2.00/0.00, addr 2> on uhub1
ucom0: port=0 iface=3 in=0x85 out=0x4
ucom0: configured 1 serial ports (U0.%d)
ucom1: <ZTE, Incorporated ZTE CDMA Technologies MSM, class 0/0, rev
2.00/0.00, addr 2> on uhub1
ucom1: configured 0 serial ports (U1.%d)
ucom2: <ZTE, Incorporated ZTE CDMA Technologies MSM, class 0/0, rev
2.00/0.00, addr 2> on uhub1
ucom2: configured 0 serial ports (U2.%d)
Looking through the modemswitch code, I grabbed out the string that
it sends the modem. Googling around, I found 2 different versions.
Both seem to work, however, the secondary ports do not with either
string. Not sure what it exactly does however.
--- /home/mdtancsa/u3g.c 2009-05-05 16:48:46.000000000 -0400
+++ u3g.c 2009-05-05 17:12:29.000000000 -0400
@@ -126,6 +126,8 @@
#define U3GFL_STUB_WAIT 0x80 // Device
reappears after a short delay
};
+#define U3GINIT_NONE 0
+#define U3GINIT_EJECT 2
// Note: The entries marked with XXX should be checked for the correct speed
// indication to set the buffer sizes.
static const struct u3g_dev_type_s u3g_devs[] = {
@@ -137,8 +139,10 @@
{{ USB_VENDOR_OPTION, USB_PRODUCT_OPTION_GTMAXHSUPA
}, U3GSP_HSDPA, U3GFL_NONE },
{{ USB_VENDOR_OPTION, USB_PRODUCT_OPTION_VODAFONEMC3G
}, U3GSP_UMTS, U3GFL_NONE },
/* OEM: Qualcomm, Inc. */
- {{ USB_VENDOR_QUALCOMMINC, USB_PRODUCT_QUALCOMMINC_ZTE_STOR
}, U3GSP_CDMA, U3GFL_SCSI_EJECT },
- {{ USB_VENDOR_QUALCOMMINC, USB_PRODUCT_QUALCOMMINC_CDMA_MSM
}, U3GSP_CDMA, U3GFL_SCSI_EJECT },
+ /* OEM: Qualcomm, Inc. */
+ {{ USB_VENDOR_QUALCOMMINC, USB_PRODUCT_QUALCOMMINC_ZTE_STOR
}, U3GSP_CDMA, 0x08},
+ {{ USB_VENDOR_QUALCOMMINC, USB_PRODUCT_QUALCOMMINC_CDMA_MSM
}, U3GSP_CDMA, U3GINIT_EJECT },
+ {{ USB_VENDOR_QUALCOMMINC, USB_PRODUCT_QUALCOMMINC_ZTE_MSM
}, U3GSP_CDMA, 2 }, // after switch
/* OEM: Huawei */
{{ USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_MOBILE
}, U3GSP_HSDPA, U3GFL_HUAWEI_INIT },
{{ USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E220
}, U3GSP_HSPA, U3GFL_HUAWEI_INIT },
@@ -262,6 +266,7 @@
if (uaa->ifaces[i] == NULL)
continue;
+ DPRINTF("MDTATTACH i = %d\n",i);
id = usbd_get_interface_descriptor(uaa->ifaces[i]);
if (id && id->bInterfaceClass == UICLASS_MASS) {
/* We attach to the interface instead of the device as
@@ -289,6 +294,7 @@
&&
UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
bulkout_no = ed->bEndpointAddress;
+ DPRINTF("MDTATTACH bulkout and in = %d
%d\n",bulkout_no, bulkin_no);
/* If we have found a pair of bulk-in/-out endpoints
* create a serial port for it. Note: We assume that
* the bulk-in and bulk-out endpoints appear in pairs.
@@ -474,26 +480,53 @@
/* See definition of umass_bbb_cbw_t in sys/dev/usb/umass.c
* in sys/cam/scsi/scsi_all.h .
- */
-static unsigned char cmotech_cmd[31] = {
+
* 55534243123456782400000080000c8500000024000000000000000000000000
- from u3g modem switch
+ * 55534243123456782000000080000c85010101180101010101000000000000 - from url
+ * 555342431234567820 00 00 00 80 00 0c 85 01 01 01 18 01 01 01 01
01 00 0000000000 - from url
+ * 555342431234567824 00 00 00 80 00 0c 85 00 00 00 24
000000000000000000000000
+*/
+#if 0
+static unsigned char cmotech_cmd[32] = {
0x55, 0x53, 0x42, 0x43, /* 0..3: Command Block Wrapper (CBW)
signature */
- 0x01, 0x00, 0x00, 0x00, /* 4..7: CBW Tag, unique 32-bit number */
- 0x00, 0x00, 0x00, 0x00, /* 8..11: CBW Transfer Length, no data here */
+ 0x12, 0x34, 0x56, 0x78, /* 4..7: CBW Tag, unique 32-bit number */
+ 0x20, 0x00, 0x00, 0x00, /* 8..11: CBW Transfer Length, no data here */
0x80, /* 12: CBW Flag: output, so 0 */
0x00, /* 13: CBW Lun */
- 0x08, /* 14: CBW Length */
+ 0x0c, /* 14: CBW Length */
- 0xff, /* 15+0 */
- 0x52, /* 15+1 */
- 0x44, /* 15+2 */
- 0x45, /* 15+2 */
- 0x56, /* 15+4 */
- 0x43, /* 15+5 */
- 0x48, /* 15+5 */
- 0x47, /* 15+5 */
+ 0x85, /* 15+0 */
+ 0x00, /* 15+1 */
+ 0x00, /* 15+2 */
+ 0x00, /* 15+2 */
+ 0x24, /* 15+4 */
+ 0x00, /* 15+5 */
+ 0x00, /* 15+5 */
+ 0x00, /* 15+5 */
0x00, 0x00, 0x00, 0x00, /* 15+8..15: unused */
- 0x00, 0x00, 0x00, 0x00
+ 0x00, 0x00, 0x00, 0x00, 0x00
};
+#endif
+
+static unsigned char cmotech_cmd[31] = {
+ 0x55, 0x53, 0x42, 0x43, /* 0..3: Command Block Wrapper (CBW)
signature */
+ 0x12, 0x34, 0x56, 0x78, /* 4..7: CBW Tag, unique 32-bit number */
+ 0x20, 0x00, 0x00, 0x00, /* 8..11: CBW Transfer Length, no data here */
+ 0x80, /* 12: CBW Flag: output, so 0 */
+ 0x00, /* 13: CBW Lun */
+ 0x0c, /* 14: CBW Length */
+
+ 0x85, /* 15+0 */
+ 0x01, /* 15+1 */
+ 0x01, /* 15+2 */
+ 0x01, /* 15+2 */
+ 0x18, /* 15+4 */
+ 0x01, /* 15+5 */
+ 0x01, /* 15+5 */
+ 0x01, /* 15+5 */
+ 0x01, 0x01, 0x00, 0x00, /* 15+8..15: unused */
+ 0x00, 0x00, 0x00, 0x00
+};
+
From bootup, I see in dmesg
ucom0: <ZTE, Incorporated ZTE CDMA Technologies MSM, class 0/0, rev
2.00/0.00, addr 2> on uhub1
ucom0: MDTATTACH i = 0
ucom0: MDTATTACH i = 1
ucom0: MDTATTACH i = 2
ucom0: MDTATTACH i = 3
ucom0: MDTATTACH bulkout and in = -1 -1
ucom0: MDTATTACH bulkout and in = -1 133
ucom0: MDTATTACH bulkout and in = 4 133
ucom0: port=0 iface=3 in=0x85 out=0x4
ucom0: configured 1 serial ports (U0.%d)
ucom1: <ZTE, Incorporated ZTE CDMA Technologies MSM, class 0/0, rev
2.00/0.00, addr 2> on uhub1
ucom1: MDTATTACH i = 1
ucom1: MDTATTACH i = 2
ucom1: configured 0 serial ports (U1.%d)
ucom2: <ZTE, Incorporated ZTE CDMA Technologies MSM, class 0/0, rev
2.00/0.00, addr 2> on uhub1
ucom2: MDTATTACH i = 2
ucom2: configured 0 serial ports (U2.%d)
# ls -l /dev/cuaU*
crw-rw---- 1 uucp dialer - 0, 79 May 5 17:20 /dev/cuaU0.0
crw-rw---- 1 uucp dialer - 0, 80 May 5 17:14 /dev/cuaU0.0.init
crw-rw---- 1 uucp dialer - 0, 81 May 5 17:14 /dev/cuaU0.0.lock
I am able to fireup ppp and surf / download from there. Anyone have
any thoughts on how to better configure this unit ?
---Mike
More information about the freebsd-usb
mailing list