Qualcomm "05c6:f000" China LTE Dongle only working in serial mode

Hardware Questions and Recommendations
1

Hi there,

so I bought one of those 4G Wifi modems you can find all over Aliexpress.

It initially reports as 05c6:f000 and then mode_switches to 05c6:6000 which is usb_serial.

I can setup a 3g connection via ppp and max out at around 10mbit.

BUT this thing is a true LTE modem, when using it in WIFI mode (plugging it into a usb power socket) it's connecting via 4G and does ~ 150Mbit. I didn't test the dongle mode under Windows, cause I don't want Chinese Spyware.

Anyone also experimenting with those (cheap) devices? Any clue how to switch this thing into LTE mode?

2

Earlier discussions on that (?) modem: [SOLVED] 3g/LTE modem (Qualcomm MDM9200) - USB modeswitch problem and OpenWrt 18/Lede 18 with USB Modem dongle Alfa Networks Tube U4G (doesn't work)

Check yours with cat /sys/kernel/debug/usb/devices in order to see what interfaces are available.

3

That absolutely doesn't answer my question.

Both post are about the modem not switching.

I already wrote my modem is perfectly switching to :6000 and working, it's just not very fast in that legacy mode.
Alternative I found would be :9000 but it doesn't switch to that mode.

There must be some undocumented additional high speed mode in which it presents itself as cdc-ether or something like that.

1 Like
4

The 2nd link is about using QMI, that is what you need IMHO.

Possibly, check available interfaces as shown. Do this a few times, after each switching (to :6000, :9000, etc)

5

Second posts solution is to switch to

"t_product": [ 22, 36864 ],

which is :9000 hex, but in my case it's always switching to :6000 no mater what I propose in the json conf and then I have 4 ttyUSB devices

6

That is not what we need to know.
Do cat /sys/kernel/debug/usb/devices, switch to another configuration (if possible), repeat.
Publish your results, then we will see what interfaces like QMI, MBIM, etc are available with your modem.

7

Erm, that's what my question is about.
I can't switch to anything else, cause whatever I propose in the json config, it always switches to :6000

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  5 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=6000 Rev= 0.00
S:  Manufacturer=Qualcomm, Incorporated
S:  Product=Qualcomm CDMA Technologies MSM
S:  SerialNumber=1234567890ABCDEF
C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
8

Please show the same before switching, while the modem is its initial state 05c6:f000

You can try this usb_modeswitch code to switch to 0x9000.
Show the USB information if your modem can switch.

9

Already tried that code. No matter what message content is sent or what target id (even random ones) are given, i always end up with :6000

T:  Bus=04 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  8 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=05c6 ProdID=f000 Rev= 0.00
S:  Manufacturer=Qualcomm, Incorporated
S:  Product=Qualcomm CDMA Technologies MSM
S:  SerialNumber=1234567890ABCDEF
C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
10

I suppose that should be addressed to usb_modeswitch rather then OpenWrt.
You can also try to request the module documentation from the seller and see if there is an AT command to change the configuration.
BTW, one more interesting thread found: 3g/4g USB dongle not showing up You can try the eject method mentioned there.

11

If I understand it correctly -K is just a shortcut command for a standard eject message.
I fiddled a bit more on a linux box, basically there are 2 messages out there on the internet:

9000 5553424312345678000000000000061b000000020000000000000000000000
6000 5553424308306384c000000080000671030000000000000000000000000000

6000 is working fine and I end up with a serial modem which maxes out at around 10 mbit.
9000 does nothing. although both report

 OK, message successfully sent
Read the response to message 1 (CSW) ...
 Response successfully read (13 bytes), status 1
Reset response endpoint 0x81
Reset message endpoint 0x01
-> Run lsusb to note any changes. Bye!

Is there a documentation somewhere what the message content actually is. If I understand that maybe I can try to fiddle around with the message itself

12

as said before,

Try to ask here

P.S. there is a probability that this modem has no normal interfaces available (qmi, mbim, etc) and you will have to use ppp.

13

The messages are just SCSI commands wrapped like USB storage wants them. See for example

You'll find a list of commands here: https://en.wikipedia.org/wiki/SCSI_command

But the actual meaning in this context is defined by the modem firmware. So you are out of luck unless the vendor documented it, and very few do that. AFAIK, only Huawei have documented theirs.

FWIW, those two messages decodes as

dCBWSignature 55534243  "USBC"
dCBWTag       12345678   arbitrary
dCBWTransLen  00000000   0
bmCBWFlags    00               
bCBWLUN       00         LUN 0
bCBWCBLen     06
CBWCB         1b000000020000000000000000000000

1b is "START STOP UNIT", which is the command used for eject

dCBWSignature 55534243   "USBC"
dCBWTag       08306384   arbitrary
dCBWTransLen  c0000000   12
bmCBWFlags    80         data in from device
bCBWLUN       00         LUN 0
bCBWCBLen     06
CBWCB         71030000000000000000000000000000

I don't know what 71 is. It's also a bit strange to expect data from the device in a switching command. Not that it matters as long as the firmware and switching code agrees on the expected behaviour.

14

thanks @bmork , even if that doesn't directly help I have at least learned something :wink:

I guess I'll just cut my losses. It was a nice try but those sticks are probably not worth the effort.

15

Hi @Sterlink I just hit this same problem :expressionless: did you finally have any success whit this modem?

16

I have just check on windows machine that modem is switch to :6000 and I can setup ordinary dialup connection on modem port(COM3 in my case) without manufacturer software and I get good speed(about 20Mbps like it should) on OpenWRT is about 1Mbps).

Is it possible that usb serial drivers limits the badu rate of serial connection?