USB layout changes using DMS 0x5556 in HP lt4210

Thu Jan 12 12:18:57 UTC 2017

Hey, short update,

Looking at the Windows inf files, which serial is which is more clear:

For the 9d1d PID, ifaces 0, 3 and 4:
HPDevice9D1D0 = "HP lt4120 Snapdragon X5 LTE Diagnostic" (DIAG)
HPDevice9D1D3 = "HP lt4120 Snapdragon X5 LTE Application Interface" (Modem)
HPDevice9D1D4 = "HP lt4120 Snapdragon X5 LTE NMEA" (GPS)

For the 9e1d PID, ifaces 0, 2 and 3:
HPDevice9E1D0 = "HP lt4120 Snapdragon X5 LTE Diagnostic" (DIAG)
HPDevice9E1D2 = "HP lt4120 Snapdragon X5 LTE Application Interface" (Modem)
HPDevice9E1D3 = "HP lt4120 Snapdragon X5 LTE NMEA" (GPS)

I believe that iface #1 in "mode=4 (AT+MBIM)" (pid 9e1d) is also
serial/AT, but well, I think I'll just default to reporting the same
ports as in the windows driver files.

On Thu, Jan 12, 2017 at 11:32 AM, Aleksander Morgado
<aleksander at aleksander.es> wrote:
> Hey everyone,
>
> I recently got a HP lt4120 in order to play with the fastboot-based
> firmware download process. By default the modem boots with VID:PID
> 03f0:9d1d and a USB layout with 3 different configurations:
>
> Conf 0:
>   * iface 0: ??
>   * iface 1: QMI
>   * iface 2: (ff/00/00) serial
>   * iface 3: (ff/00/00) serial
>   * iface 4: (ff/00/00) serial
> Conf 1:
>   * ifaces 0/1: ECM
> Conf 2:
>   * ifaces 0/1: MBIM
>   * iface 2: ??
>
> Right now the kernel switches automatically to configuration #2, but
> the next usb_modeswitch release will come with support for
> automatically switching the device to configuration #3 (as MBIM will
> be preferred by usb_modeswitch by default).
>
> Back to the firmware download, the fastboot mode is requested using
> the DMS 0x5556 command that we have in our DB as "Change Device
> Download Mode". This command was snooped by Alexander Borovsky, see
> https://github.com/borovsky/x5-snapdragon-linux.
>
> We pass the 0x01 TLV to this command with an integer number; the magic
> integer to get the fastboot mode is 5, so I just ended up playing with
> other numbers to see what happens :)
>
> Note that the --device-open-mbim option would only be needed if the
> cdc-wdm is MBIM.
>
> Also, I'm attaching the lsusbs I got in the different steps.
>
> I also prepared some qmi_wwan and qcserial patches that I'll send to
> the LKML once I test a bit more.
>
> Finally, note that the 0x5556 command is also implemented in Sierra,
> but as Bjørn found out some time ago it just returns several firmware
> version strings, regardless of the "mode" parameter given.
>
> =======================================
> MODE 0:
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=0
> [--device-open-mbim]
> Looks like nothing happens
>
> =======================================
> MODE 1:
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=1
> [--device-open-mbim]
> Looks like nothing happens
>
> =======================================
> MODE 2:
>
> Still at VID:PID 03f0:9d1d but switches to a USB layout with one
> single configuration providing QMI+AT
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=2
> [--device-open-mbim]
> (wait 30s)
>
>   * iface 0: (ff/ff/ff) ??
>   * iface 1: (ff/ff/ff) QMI
>   * iface 2: (ff/00/00) serial
>   * iface 3: (ff/00/00) serial
>   * iface 4: (ff/00/00) serial
>
> =======================================
> MODE 3:
>
> Still at VID:PID 03f0:9d1d but switches to a USB layout with one
> single configuration providing ECM+AT
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=3
> [--device-open-mbim]
> (wait 30s)
>
>   * iface 0: ??
>   * iface 1/2: ECM
>   * iface 3: (ff/00/00) serial
>   * iface 4: (ff/00/00) serial
>   * iface 5: (ff/00/00) serial
>
> I have no idea why but in this mode the modem ends up power cycling
> itself several times:
>
> [  +0,231660] usb 4-1.5.3: new high-speed USB device number 105 using ehci-pci
> [  +0,138048] cdc_ether 4-1.5.3:1.1 usb0: register 'cdc_ether' at
> usb-0000:00:1d.0-1.5.3, CDC Ethernet Device, 4a:36:0d:52:a5:14
> [  +0,001912] qcserial 4-1.5.3:1.3: Qualcomm USB modem converter detected
> [  +0,000323] usb 4-1.5.3: Qualcomm USB modem converter now attached to ttyUSB0
> [  +0,000649] qcserial 4-1.5.3:1.4: Qualcomm USB modem converter detected
> [  +0,005259] usb 4-1.5.3: Qualcomm USB modem converter now attached to ttyUSB1
> [  +0,000350] qcserial 4-1.5.3:1.5: Qualcomm USB modem converter detected
> [  +0,000735] usb 4-1.5.3: Qualcomm USB modem converter now attached to ttyUSB2
> [  +0,051615] IPv6: ADDRCONF(NETDEV_UP): usb0: link is not ready
> [  +0,000128] cdc_ether 4-1.5.3:1.1 usb0: kevent 12 may have been dropped
> [  +0,000006] cdc_ether 4-1.5.3:1.1 usb0: kevent 12 may have been dropped
> [  +0,002583] cdc_ether 4-1.5.3:1.1 usb0: kevent 12 may have been dropped
> [  +0,000016] cdc_ether 4-1.5.3:1.1 usb0: kevent 12 may have been dropped
> [  +0,109896] cdc_ether 4-1.5.3:1.1 usb0: kevent 12 may have been dropped
> [ +10,462445] usb 4-1.5.3: USB disconnect, device number 105
> [  +0,003792] cdc_ether 4-1.5.3:1.1 usb0: unregister 'cdc_ether'
> usb-0000:00:1d.0-1.5.3, CDC Ethernet Device
> [  +0,016773] qcserial ttyUSB0: Qualcomm USB modem converter now
> disconnected from ttyUSB0
> [  +0,000017] qcserial 4-1.5.3:1.3: device disconnected
> [  +0,002361] qcserial ttyUSB1: Qualcomm USB modem converter now
> disconnected from ttyUSB1
> [  +0,000015] qcserial 4-1.5.3:1.4: device disconnected
> [  +0,000166] qcserial ttyUSB2: Qualcomm USB modem converter now
> disconnected from ttyUSB2
> [  +0,000014] qcserial 4-1.5.3:1.5: device disconnected
>
> And luckily, after some reboots it'll go back to the original mode
> with 3 configurations.
>
> =======================================
> MODE 4:
>
> Changes VID:PID to 03f0:9e1d and switches to a USB layout with one
> single configuration providing MBIM+AT
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=4
> --device-open-mbim
> (wait 30s)
>
>   * iface 0:   ??
>   * iface 1:   (ff/00/00) serial
>   * iface 2:   (ff/00/00) serial
>   * iface 3:   (ff/00/00) serial
>   * iface 4/5: MBIM
>
> =======================================
> MODE 5:
> Changes VID:PID to 03f0:9f1d and switches to FASTBOOT mode.
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=5
> --device-open-mbim
> (changes right away)
>
> $ sudo fastboot devices
> MDM9625 fastboot
>
> If we don't do any fastboot operation, plugging and replugging takes
> us to the last mode we had.
>
> =======================================
> MODE 6:
>
> Changes VID:PID to 03f0:9e1d (same one we had in mode 4) and ends up
> with a USB layout with one single interface.
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=6
> --device-open-mbim
> (changes right away)
>
>   * iface 0:   ??
>
> =======================================
> MODE 7:
>
> Seems to be a hard reset of some sort
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=7
> --device-open-mbim
> (reboots right away, doesn't even reply to the command)
>
>
> =======================================
> MODE 8:
>
> Seems to be a soft reset of some sort.
>
> $ sudo qmicli -d /dev/cdc-wdm2 --dms-change-device-download-mode=7
> --device-open-mbim
> (replies to the command, and then reboots)
>
>
> --
> Aleksander
> https://aleksander.es

-- 
Aleksander
https://aleksander.es