MBIM Patch (Round 3)

classic Classic list List threaded Threaded
43 messages Options
123
Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Mark Kettenis
> From: Gerhard Roth <[hidden email]>
> Date: Thu, 9 Jun 2016 23:48:23 +0200
>
> On 09.06.2016 23:42, Mark Kettenis wrote:
> >> Date: Thu, 9 Jun 2016 22:59:28 +0200 (CEST)
> >> From: Mark Kettenis <[hidden email]>
> >>
> >>> Date: Wed, 8 Jun 2016 15:08:52 +0200
> >>> From: Gerhard Roth <[hidden email]>
> >>>
> >>> I would be glad to hear from some people trying this with a real MBIM
> >>> device.
> >>
> >> Sierra Wireless EM7345 4G LTE here.  This devices currently attached
> >> as umodem(4).  But I did add its vendor id and device id to umb_devs,
> >> which makes it partially attach:
> >>
> >> umb0 at uhub0 port 4 "Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE" rev 2.00/17.29 addr 2
> >> umb0: switching to config #1
> >> umb0: ignoring invalid segment size 1500
> >> umb0: ctrl_len=512, maxpktlen=8192, cap=0x4
> >> umb0: no control interface found
> >>
> >> (this is with UMB_DEBUG enabled)
> >>
> >> It seems this device needs some additional poking to select alternate
> >> interface settings.
> >
> > With the appropriate alternate settings for the communication
> > interface and data interface (1 and 2) hardcoded in the driver, this
> > works!
>
> Great!
>
> Although another example of a device violating the MBIM spec which
> clearly states that alternate settings 0 and 1 have to be used.

Which version of the spec are you looking at?  Because my copy
(Revision 1.0 Errata-1) clearly status alternate settings 1 and 2 have
to be used ;).

It does violate the spec for the maximumsegment size though.

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Stuart Henderson
On 2016/06/10 00:10, Mark Kettenis wrote:

> > From: Gerhard Roth <[hidden email]>
> > Date: Thu, 9 Jun 2016 23:48:23 +0200
> >
> > On 09.06.2016 23:42, Mark Kettenis wrote:
> > >> Date: Thu, 9 Jun 2016 22:59:28 +0200 (CEST)
> > >> From: Mark Kettenis <[hidden email]>
> > >>
> > >>> Date: Wed, 8 Jun 2016 15:08:52 +0200
> > >>> From: Gerhard Roth <[hidden email]>
> > >>>
> > >>> I would be glad to hear from some people trying this with a real MBIM
> > >>> device.
> > >>
> > >> Sierra Wireless EM7345 4G LTE here.  This devices currently attached
> > >> as umodem(4).  But I did add its vendor id and device id to umb_devs,
> > >> which makes it partially attach:
> > >>
> > >> umb0 at uhub0 port 4 "Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE" rev 2.00/17.29 addr 2
> > >> umb0: switching to config #1
> > >> umb0: ignoring invalid segment size 1500
> > >> umb0: ctrl_len=512, maxpktlen=8192, cap=0x4
> > >> umb0: no control interface found
> > >>
> > >> (this is with UMB_DEBUG enabled)
> > >>
> > >> It seems this device needs some additional poking to select alternate
> > >> interface settings.
> > >
> > > With the appropriate alternate settings for the communication
> > > interface and data interface (1 and 2) hardcoded in the driver, this
> > > works!
> >
> > Great!
> >
> > Although another example of a device violating the MBIM spec which
> > clearly states that alternate settings 0 and 1 have to be used.
>
> Which version of the spec are you looking at?  Because my copy
> (Revision 1.0 Errata-1) clearly status alternate settings 1 and 2 have
> to be used ;).

There are different sections, 3.2 for dual-mode (NCM1.0 / MBIM)
devices talks about various alternate settings for NCM1.0 and
for MBIM, then 6.6 which is only dealing with MBIM just talks
about 0 and 1 ..

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Gerhard Roth-2
On 10.06.2016 00:22, Stuart Henderson wrote:

> On 2016/06/10 00:10, Mark Kettenis wrote:
>>> From: Gerhard Roth <[hidden email]>
>>> Date: Thu, 9 Jun 2016 23:48:23 +0200
>>>
>>> On 09.06.2016 23:42, Mark Kettenis wrote:
>>>>> Date: Thu, 9 Jun 2016 22:59:28 +0200 (CEST)
>>>>> From: Mark Kettenis <[hidden email]>
>>>>>
>>>>>> Date: Wed, 8 Jun 2016 15:08:52 +0200
>>>>>> From: Gerhard Roth <[hidden email]>
>>>>>>
>>>>>> I would be glad to hear from some people trying this with a real MBIM
>>>>>> device.
>>>>>
>>>>> Sierra Wireless EM7345 4G LTE here.  This devices currently attached
>>>>> as umodem(4).  But I did add its vendor id and device id to umb_devs,
>>>>> which makes it partially attach:
>>>>>
>>>>> umb0 at uhub0 port 4 "Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE" rev 2.00/17.29 addr 2
>>>>> umb0: switching to config #1
>>>>> umb0: ignoring invalid segment size 1500
>>>>> umb0: ctrl_len=512, maxpktlen=8192, cap=0x4
>>>>> umb0: no control interface found
>>>>>
>>>>> (this is with UMB_DEBUG enabled)
>>>>>
>>>>> It seems this device needs some additional poking to select alternate
>>>>> interface settings.
>>>>
>>>> With the appropriate alternate settings for the communication
>>>> interface and data interface (1 and 2) hardcoded in the driver, this
>>>> works!
>>>
>>> Great!
>>>
>>> Although another example of a device violating the MBIM spec which
>>> clearly states that alternate settings 0 and 1 have to be used.
>>
>> Which version of the spec are you looking at?  Because my copy
>> (Revision 1.0 Errata-1) clearly status alternate settings 1 and 2 have
>> to be used ;).
>
> There are different sections, 3.2 for dual-mode (NCM1.0 / MBIM)
> devices talks about various alternate settings for NCM1.0 and
> for MBIM, then 6.6 which is only dealing with MBIM just talks
> about 0 and 1 ..
>

That's how I looked at it, too. But it seems that some vendors look
at it differently ;)

So we should find a solution where we don't need to use the
currently hard-coded MBIM_INTERFACE_ALTSETTING (== 1) anymore.

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Bryan Vyhmeister-3
In reply to this post by Gerhard Roth-2
On Thu, Jun 09, 2016 at 10:31:58PM +0200, Gerhard Roth wrote:
> If you're using the latest version of the driver, the 'ifconfig ubm0 inet
> ...' isn't required anymore.
>
> But you probably have to set the default route after the interface is
> up.

Good to know. Thanks!

> Hmm, around here apart from some special company bulk contracts,
> almost all SIM cards require PINs. But since yours says "PIN valid"
> it clearly is content without one. But the "SIM not initialized"
> is a bit strange.

That seemed odd to me as well.

> No, I don't think that you have problems with the correct APN at this
> stage. The driver is trying to turn on the radio and doesn't get a
> response on the radio state.
>
> Are you sure you haven't turned it off with the rfkill switch?

There is no physical switch on the X260 that I'm aware of and the WWAN
card is enabled in the BIOS.

> Or maybe this device refuses to accept radio commands and wants to
> auto-control the radio. You could try this by commenting out the
> "break" statement in umb_ub() in the UBM_S_RADIO case and see
> what happens:
>
>         case UMB_S_RADIO:
>                 umb_cmd(sc, MBIM_CID_SUBSCRIBER_READY_STATUS,
>    MBIM_CMDOP_QRY, NULL, 0);
>                 // break;
>         case UMB_S_SIMREADY:
>                 umb_packet_service(sc, 1);
>                 break;
>
> This way, it will send a command to turn the radio on, but also
> continue to send the next command (register packet service) which
> would otherwise be delayed until the device confirms that the radio
> is on.

I commented out break as above and that made no difference.

> If that doesn't help, please set UMB_DEBUG and set umb_debug to 5.

I'm compiling a new kernel new with UMB_DEBUG and will provide the
output.

Bryan

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Bryan Vyhmeister-3
In reply to this post by Stuart Henderson
On Thu, Jun 09, 2016 at 09:58:10PM +0100, Stuart Henderson wrote:
> You're getting further than me.
>
> Though, looking at list posts, it does seem that Lenovo is another
> vendor which requires the command being referred to as "fcc auth"
> in order to connect, at least in some of their cards.

That would not be surprising at all. At this point this "fcc auth" would
have to be hardcoded into the driver as well it sounds like?

> There are several PINs and unlock codes (PIN1 PIN2 PUK1 PUK2)
> on a SIM card. A SIM can be setup so that a PIN1 is required to
> make calls etc, or not required. PIN2 is for configuration
> (setting call restrictions, editing the restricted numbers
> list, etc).
>
> Too many bad attempts to enter a PIN1 will result in the SIM
> being locked and requiring the PUK1 to unlock. In most cases
> these are fairly easy to obtain from the operator.
>
> Too many bad attempts to enter a PIN2 will result in the SIM
> being locked and requiring the PUK2 to unlock. These are
> usually harder to obtain from the operator and at least
> require more checks.
>
> From a phone or older-type WWAN device with AT command set
> (or probably the vendor tools on Windows, and maybe libmbim
> on linux) you can control which PINs the card asks for.
> You'll need to know what a PIN is before you can lock it.
> Most operators have a default PIN that they use (different
> ones for different operators) though theoretically they
> could use a different one per SIM.
>
> If PIN1 is unlocked (no matter whether PIN2 is locked or not),
> you shouldn't need to use a PIN to connect.
>
> > umb0: SIM not initialized (PIN missing)
> > umb0: SIM not initialized (PIN missing)
>
> The description in the spec for the state which triggers this
> message is,
>
>         "The operation failed because the device is
>         in the process of initializing. Retry the
>         operation after the ReadyState of the device
>         changes to MBIMSubscriberReadyStateInitialized."
>
> Spec may differ from real-world devices, but from my reading
> of the spec it doesn't seem to me that this indicates "PIN
> missing".
>
> I think you should rebuild with UMB_DEBUG (one simple way
> is to just add "#define UMB_DEBUG" before #ifdef UMB_DEBUG
> in if_umb.c) and see if you get more information. It's
> probably worth changing the 'umb_debug = 0' to 2 or 4
> while debugging too (this can be done using DDB, but if
> you want to capture any possible messages starting at
> boot then you probably want to chagne it in the code).

Thanks for the explanation on how all the PIN codes work. I wasn't aware
it was so complex. I'm compiling a new kernel right now with UMB_DEBUG
so we will see what happens there.

Bryan

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Bryan Vyhmeister-3
In reply to this post by Gerhard Roth-2
On Thu, Jun 09, 2016 at 10:31:58PM +0200, Gerhard Roth wrote:
> If that doesn't help, please set UMB_DEBUG and set umb_debug to 5.

I left that break commented out which perhaps I shouldn't have but below
is the output when I set an apn and bring umb0 up.


OpenBSD 6.0-beta (GENERIC.MP) #0: Thu Jun  9 16:28:43 PDT 2016
    [hidden email]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 17024274432 (16235MB)
avail mem = 16503758848 (15739MB)
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.8 @ 0xb7c01000 (66 entries)
bios0: vendor LENOVO version "R02ET44W (1.17 )" date 01/25/2016
bios0: LENOVO 20F6CTO1WW
acpi0 at bios0: rev 2
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP UEFI SSDT SSDT ECDT HPET APIC MCFG SSDT SSDT DBGP DBG2 BOOT BATB SSDT SSDT MSDM DMAR ASF! FPDT UEFI
acpi0: wakeup devices LID_(S4) SLPB(S3) IGBE(S4) PXSX(S4) PXSX(S4) PXSX(S4) PXSX(S4) EXP8(S4) PXSX(S4) XHCI(S3)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpiec0 at acpi0
acpihpet0 at acpi0: 23999999 Hz
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2485.30 MHz
cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu0: 256KB 64b/line 8-way L2 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
cpu0: apic clock running at 23MHz
cpu0: mwait min=64, max=64, C-substates=0.2.1.2.4.1.1.1, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.16 MHz
cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu1: 256KB 64b/line 8-way L2 cache
cpu1: smt 0, core 1, package 0
cpu2 at mainbus0: apid 1 (application processor)
cpu2: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.16 MHz
cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu2: 256KB 64b/line 8-way L2 cache
cpu2: smt 1, core 0, package 0
cpu3 at mainbus0: apid 3 (application processor)
cpu3: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.16 MHz
cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu3: 256KB 64b/line 8-way L2 cache
cpu3: smt 1, core 1, package 0
ioapic0 at mainbus0: apid 2 pa 0xfec00000, version 20, 120 pins
acpimcfg0 at acpi0 addr 0xf8000000, bus 0-63
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus -1 (PEG0)
acpiprt2 at acpi0: bus -1 (PEG1)
acpiprt3 at acpi0: bus -1 (PEG2)
acpiprt4 at acpi0: bus 2 (EXP1)
acpiprt5 at acpi0: bus 4 (EXP3)
acpiprt6 at acpi0: bus -1 (EXP4)
acpiprt7 at acpi0: bus -1 (EXP5)
acpiprt8 at acpi0: bus -1 (EXP8)
acpicpu0 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu1 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu2 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu3 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpipwrres0 at acpi0: PUBS, resource for XHCI
acpipwrres1 at acpi0: PG00, resource for PEG0
acpipwrres2 at acpi0: PG01, resource for PEG1
acpipwrres3 at acpi0: PG02, resource for PEG2
acpipwrres4 at acpi0: WRST
acpipwrres5 at acpi0: WRST
acpitz0 at acpi0: critical temperature is 128 degC
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
"LEN0071" at acpi0 not configured
"LEN2014" at acpi0 not configured
"INT3F0D" at acpi0 not configured
acpibat0 at acpi0: BAT0 model "45N1113" serial  4020 type LION oem "LGC"
acpibat1 at acpi0: BAT1 model "45N1738" serial  2903 type LION oem "LGC"
acpiac0 at acpi0: AC unit online
acpithinkpad0 at acpi0
"PNP0C14" at acpi0 not configured
"PNP0C14" at acpi0 not configured
"PNP0C14" at acpi0 not configured
"INT3394" at acpi0 not configured
acpivideo0 at acpi0: GFX0
acpivout at acpivideo0 not configured
cpu0: Enhanced SpeedStep 2485 MHz: speeds: 2701, 2700, 2600, 2500, 2300, 2100, 1900, 1800, 1600, 1400, 1300, 1100, 800, 700, 600, 400 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel Core 6G Host" rev 0x08
"Intel HD Graphics 520" rev 0x07 at pci0 dev 2 function 0 not configured
xhci0 at pci0 dev 20 function 0 "Intel 100 Series xHCI" rev 0x21: msi
usb0 at xhci0: USB revision 3.0
uhub0 at usb0 "Intel xHCI root hub" rev 3.00/1.00 addr 1
pchtemp0 at pci0 dev 20 function 2 "Intel 100 Series Thermal" rev 0x21
"Intel 100 Series MEI" rev 0x21 at pci0 dev 22 function 0 not configured
ahci0 at pci0 dev 23 function 0 "Intel 100 Series AHCI" rev 0x21: msi, AHCI 1.3.1
ahci0: port 1: 6.0Gb/s
scsibus1 at ahci0: 32 targets
sd0 at scsibus1 targ 1 lun 0: <ATA, Samsung SSD 850, EXM0> SCSI3 0/direct fixed naa.500253884012b49d
sd0: 244198MB, 512 bytes/sector, 500118192 sectors, thin
ppb0 at pci0 dev 28 function 0 "Intel 100 Series PCIE" rev 0xf1: msi
pci1 at ppb0 bus 2
rtsx0 at pci1 dev 0 function 0 "Realtek RTS522A Card Reader" rev 0x01: msi
sdmmc0 at rtsx0: 4-bit
ppb1 at pci0 dev 28 function 2 "Intel 100 Series PCIE" rev 0xf1: msi
pci2 at ppb1 bus 4
iwm0 at pci2 dev 0 function 0 "Intel Dual Band Wireless AC 8260" rev 0x3a, msi
pcib0 at pci0 dev 31 function 0 "Intel 100 Series LPC" rev 0x21
"Intel 100 Series PMC" rev 0x21 at pci0 dev 31 function 2 not configured
azalia0 at pci0 dev 31 function 3 "Intel 100 Series HD Audio" rev 0x21: msi
azalia0: codecs: Realtek/0x0293, Intel/0x2809, using Realtek/0x0293
audio0 at azalia0
ichiic0 at pci0 dev 31 function 4 "Intel 100 Series SMBus" rev 0x21: apic 2 int 16
iic0 at ichiic0
em0 at pci0 dev 31 function 6 "Intel I219-LM" rev 0x21: msi, address 50:7b:9d:d6:df:00
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0: console keyboard
pms0 at pckbc0 (aux slot)
wsmouse0 at pms0 mux 0
wsmouse1 at pms0 mux 0
pms0: Synaptics clickpad, firmware 8.1
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
vmm0 at mainbus0: VMX/EPT
efifb0 at mainbus0
wsdisplay0 at efifb0 mux 1: console (std, vt100 emulation), using wskbd0
wsdisplay0: screen 1-5 added (std, vt100 emulation)
umb0 at uhub0 port 3 configuration 1 interface 12 "Sierra Wireless, Incorporated Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A" rev 2.10/0.06 addr 2
umb0: ctrl_len=4096, maxpktlen=2048, cap=0x20
umb0: ctrl-ifno#12: ep-ctrl=2, data-ifno#13: ep-rx=1, ep-tx=1
umb0: -> snd MBIM_OPEN_MSG (tid 1)
umb0: sent MBIM_OPEN_MSG (tid 1)
   0:   01 00 00 00 10 00 00 00 01 00 00 00 00 10 00 00
umb0: vers 1.0
vscsi0 at root
scsibus2 at vscsi0: 256 targets
softraid0 at root
scsibus3 at softraid0: 256 targets
sd1 at scsibus3 targ 1 lun 0: <OPENBSD, SR CRYPTO, 006> SCSI2 0/direct fixed
sd1: 244197MB, 512 bytes/sector, 500116577 sectors
root on sd1a (acef1b0856ff7402.a) swap on sd1b dump on sd1b
iwm0: hw rev 0x200, fw ver 16.242414.0, address 44:85:00:0f:cf:8a
umb0: umb_intr: response available
umb0: got response: len 16
   0:   01 00 00 80 10 00 00 00 01 00 00 00 00 00 00 00
umb0: <- rcv MBIM_OPEN_DONE (tid 1)
umb0: -> qry MBIM_CID_DEVICE_CAPS (tid 2)
umb0: sent MBIM_COMMAND_MSG (tid 2)
   0:   03 00 00 00 30 00 00 00 02 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 01 00 00 00 00 00 00 00 00 00 00 00
umb0: -> qry MBIM_CID_PIN (tid 3)
umb0: sent MBIM_COMMAND_MSG (tid 3)
   0:   03 00 00 00 30 00 00 00 03 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 04 00 00 00 00 00 00 00 00 00 00 00
umb0: -> qry MBIM_CID_REGISTER_STATE (tid 4)
umb0: sent MBIM_COMMAND_MSG (tid 4)
   0:   03 00 00 00 30 00 00 00 04 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 00 00 00 00 00 00 00 00
umb0: state going up from 'down' to 'open'
umb0: umb_intr: response available
umb0: stop: reached state DOWN
umb0: umb_intr: response available
umb0: umb_intr: response available
umb0: got response: len 196
   0:   03 00 00 80 c4 00 00 00 02 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 01 00 00 00 00 00 00 00 94 00 00 00
  48:   03 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00
  64:   3c 00 00 00 03 00 00 00 01 00 00 00 08 00 00 00
  80:   00 00 00 00 00 00 00 00 40 00 00 00 1e 00 00 00
  96:   60 00 00 00 28 00 00 00 88 00 00 00 0c 00 00 00
 112:   30 00 31 00 34 00 35 00 38 00 32 00 30 00 30 00
 128:   30 00 31 00 39 00 34 00 37 00 38 00 38 00 00 00
 144:   53 00 57 00 49 00 39 00 58 00 33 00 30 00 43 00
 160:   5f 00 30 00 32 00 2e 00 30 00 38 00 2e 00 30 00
 176:   32 00 2e 00 30 00 30 00 45 00 4d 00 37 00 34 00
 192:   35 00 35 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 2)
umb0: set/qry MBIM_CID_DEVICE_CAPS done
umb0: max sessions 8, supported classes 0x3c
umb0: got response: len 60
   0:   03 00 00 80 3c 00 00 00 03 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 04 00 00 00 00 00 00 00 0c 00 00 00
  48:   03 00 00 00 01 00 00 00 03 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 3)
umb0: set/qry MBIM_CID_PIN done
umb0: PIN2 state locked (3 attempts left)
umb0: got response: len 96
   0:   03 00 00 80 60 00 00 00 04 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
  48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
  64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 4)
umb0: set/qry MBIM_CID_REGISTER_STATE done
umb0: not registered, availclass 0x0, class 0x1, regmode 1
umb0: stop: reached state DOWN
iwm0: device timeout
iwm0: device timeout
umb0: -> set MBIM_CID_REGISTER_STATE (tid 5)
umb0: sent MBIM_COMMAND_MSG (tid 5)
   0:   03 00 00 00 40 00 00 00 05 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 01 00 00 00 10 00 00 00
  48:   00 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00
umb0: umb_intr: response available
umb0: got response: len 96
   0:   03 00 00 80 60 00 00 00 05 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
  48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
  64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 5)
umb0: set/qry MBIM_CID_REGISTER_STATE done
umb0: not registered, availclass 0x0, class 0x1, regmode 1
umb0: init: turning radio on ...
umb0: set radio on
umb0: -> set MBIM_CID_RADIO_STATE (tid 6)
umb0: sent MBIM_COMMAND_MSG (tid 6)
   0:   03 00 00 00 34 00 00 00 06 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 03 00 00 00 01 00 00 00 04 00 00 00
  48:   01 00 00 00
umb0: umb_intr: response available
umb0: got response: len 56
   0:   03 00 00 80 38 00 00 00 06 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 03 00 00 00 02 00 00 00 08 00 00 00
  48:   01 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 6)
umb0: set/qry MBIM_CID_RADIO_STATE failed: FAILURE
iwm0: device timeout
umb0: state change time out
umb0: init: turning radio on ...
umb0: set radio on
umb0: -> set MBIM_CID_RADIO_STATE (tid 7)
umb0: sent MBIM_COMMAND_MSG (tid 7)
   0:   03 00 00 00 34 00 00 00 07 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 03 00 00 00 01 00 00 00 04 00 00 00
  48:   01 00 00 00
umb0: umb_intr: response available
umb0: got response: len 56
   0:   03 00 00 80 38 00 00 00 07 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 03 00 00 00 02 00 00 00 08 00 00 00
  48:   01 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 7)
umb0: set/qry MBIM_CID_RADIO_STATE failed: FAILURE

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Gerhard Roth-2
On 10.06.2016 05:09, Bryan Vyhmeister wrote:
> On Thu, Jun 09, 2016 at 10:31:58PM +0200, Gerhard Roth wrote:
>> If that doesn't help, please set UMB_DEBUG and set umb_debug to 5.
>
> I left that break commented out which perhaps I shouldn't have but below
> is the output when I set an apn and bring umb0 up.

Hmm, I don't see the missing break. It is still stuck in the same
state trying to turn on the radio and always getting non-confirmative
resonses.

If the break before "case UMB_S_RADIO:" is missing, I would expect
to see a debug printf "umb0: init: checking SIM state ...".
Could you please check once again?


> [...]
>
> umb0: init: turning radio on ...
> umb0: set radio on
> umb0: -> set MBIM_CID_RADIO_STATE (tid 7)
> umb0: sent MBIM_COMMAND_MSG (tid 7)
>    0:   03 00 00 00 34 00 00 00 07 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 03 00 00 00 01 00 00 00 04 00 00 00
>   48:   01 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 56
>    0:   03 00 00 80 38 00 00 00 07 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 03 00 00 00 02 00 00 00 08 00 00 00
                                   ^^^^^^^^^^^
                                   status == MBIM_STATUS_FAILURE
>   48:   01 00 00 00 00 00 00 00
           ^^^^^^^^^^^ ^^^^^^^^^^^^
           hw_state on sw_state off
> umb0: <- rcv MBIM_COMMAND_DONE (tid 7)
> umb0: set/qry MBIM_CID_RADIO_STATE failed: FAILURE
>

The error code is rather generic and gives us no help to
determine why exactly the device refuses to turn on the
radio. But it reports that the hw-state is on, which means
we can at least exclude any rfkill switch ;)

So why does the firmware refuse to turn it on? Could still
be a problem of the PIN-less SIM card you're using.

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Bryan Vyhmeister-3
On Fri, Jun 10, 2016 at 09:43:36AM +0200, Gerhard Roth wrote:
> Hmm, I don't see the missing break. It is still stuck in the same
> state trying to turn on the radio and always getting non-confirmative
> resonses.
>
> If the break before "case UMB_S_RADIO:" is missing, I would expect
> to see a debug printf "umb0: init: checking SIM state ...".
> Could you please check once again?

From a previous email you said to comment out the break after "case
UMB_S_RADIO" which did not have any effect. Commenting out the break
after "case UMB_S_OPEN" as I believe you are saying above did have an
effect.


        case UMB_S_OPEN:
                DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc));
                umb_radio(sc, 1);
                // break;
        case UMB_S_RADIO:
                DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc));
                umb_cmd(sc, MBIM_CID_SUBSCRIBER_READY_STATUS, MBIM_CMDOP_QRY,
                    NULL, 0);
                break;
        case UMB_S_SIMREADY:
                DPRINTF("%s: init: attaching ...\n", DEVNAM(sc));
                umb_packet_service(sc, 1);
                break;

> The error code is rather generic and gives us no help to
> determine why exactly the device refuses to turn on the
> radio. But it reports that the hw-state is on, which means
> we can at least exclude any rfkill switch ;)
>
> So why does the firmware refuse to turn it on? Could still
> be a problem of the PIN-less SIM card you're using.

With the break commented out above I now see this output from ifconfig
umb0 (sensitive info with XXX):

umb0: flags=8811<UP,POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
        index 5 priority 0
        roaming disabled registration not registered
        state SIM is ready cell-class none
        SIM initialized PIN valid (3 attempts left)
        subscriber-id XXXXXXXX ICC-id XXXXXXXXXX
        device EM7455 IMEI 014582000 firmware SWI9X30C_02.08.
        phone# ++XXXXXXXXXX APN broadband
        status: down

I have not seen the first ten digits of the SIM card's phone number, the
subscriber-id, or the ICC-id in ifconfig output before so that seems
promising. Could this be something like needing the FCC auth? The debug
output follows. Thank you!

Bryan



OpenBSD 6.0-beta (GENERIC.MP) #1: Fri Jun 10 04:25:48 PDT 2016
    [hidden email]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 17024274432 (16235MB)
avail mem = 16503758848 (15739MB)
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.8 @ 0xb7c01000 (66 entries)
bios0: vendor LENOVO version "R02ET44W (1.17 )" date 01/25/2016
bios0: LENOVO 20F6CTO1WW
acpi0 at bios0: rev 2
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP UEFI SSDT SSDT ECDT HPET APIC MCFG SSDT SSDT DBGP DBG2 BOOT BATB SSDT SSDT MSDM DMAR ASF! FPDT UEFI
acpi0: wakeup devices LID_(S4) SLPB(S3) IGBE(S4) PXSX(S4) PXSX(S4) PXSX(S4) PXSX(S4) EXP8(S4) PXSX(S4) XHCI(S3)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpiec0 at acpi0
acpihpet0 at acpi0: 23999999 Hz
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2485.32 MHz
cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu0: 256KB 64b/line 8-way L2 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
cpu0: apic clock running at 24MHz
cpu0: mwait min=64, max=64, C-substates=0.2.1.2.4.1.1.1, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.21 MHz
cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu1: 256KB 64b/line 8-way L2 cache
cpu1: smt 0, core 1, package 0
cpu2 at mainbus0: apid 1 (application processor)
cpu2: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.21 MHz
cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu2: 256KB 64b/line 8-way L2 cache
cpu2: smt 1, core 0, package 0
cpu3 at mainbus0: apid 3 (application processor)
cpu3: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.21 MHz
cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
cpu3: 256KB 64b/line 8-way L2 cache
cpu3: smt 1, core 1, package 0
ioapic0 at mainbus0: apid 2 pa 0xfec00000, version 20, 120 pins
acpimcfg0 at acpi0 addr 0xf8000000, bus 0-63
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus -1 (PEG0)
acpiprt2 at acpi0: bus -1 (PEG1)
acpiprt3 at acpi0: bus -1 (PEG2)
acpiprt4 at acpi0: bus 2 (EXP1)
acpiprt5 at acpi0: bus 4 (EXP3)
acpiprt6 at acpi0: bus -1 (EXP4)
acpiprt7 at acpi0: bus -1 (EXP5)
acpiprt8 at acpi0: bus -1 (EXP8)
acpicpu0 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu1 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu2 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu3 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpipwrres0 at acpi0: PUBS, resource for XHCI
acpipwrres1 at acpi0: PG00, resource for PEG0
acpipwrres2 at acpi0: PG01, resource for PEG1
acpipwrres3 at acpi0: PG02, resource for PEG2
acpipwrres4 at acpi0: WRST
acpipwrres5 at acpi0: WRST
acpitz0 at acpi0: critical temperature is 128 degC
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
"LEN0071" at acpi0 not configured
"LEN2014" at acpi0 not configured
"INT3F0D" at acpi0 not configured
acpibat0 at acpi0: BAT0 model "45N1113" serial  4020 type LION oem "LGC"
acpibat1 at acpi0: BAT1 model "45N1738" serial  2903 type LION oem "LGC"
acpiac0 at acpi0: AC unit online
acpithinkpad0 at acpi0
"PNP0C14" at acpi0 not configured
"PNP0C14" at acpi0 not configured
"PNP0C14" at acpi0 not configured
"INT3394" at acpi0 not configured
acpivideo0 at acpi0: GFX0
acpivout at acpivideo0 not configured
cpu0: Enhanced SpeedStep 2485 MHz: speeds: 2701, 2700, 2600, 2500, 2300, 2100, 1900, 1800, 1600, 1400, 1300, 1100, 800, 700, 600, 400 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel Core 6G Host" rev 0x08
"Intel HD Graphics 520" rev 0x07 at pci0 dev 2 function 0 not configured
xhci0 at pci0 dev 20 function 0 "Intel 100 Series xHCI" rev 0x21: msi
usb0 at xhci0: USB revision 3.0
uhub0 at usb0 "Intel xHCI root hub" rev 3.00/1.00 addr 1
pchtemp0 at pci0 dev 20 function 2 "Intel 100 Series Thermal" rev 0x21
"Intel 100 Series MEI" rev 0x21 at pci0 dev 22 function 0 not configured
ahci0 at pci0 dev 23 function 0 "Intel 100 Series AHCI" rev 0x21: msi, AHCI 1.3.1
ahci0: port 1: 6.0Gb/s
scsibus1 at ahci0: 32 targets
sd0 at scsibus1 targ 1 lun 0: <ATA, Samsung SSD 850, EXM0> SCSI3 0/direct fixed naa.500253884012b49d
sd0: 244198MB, 512 bytes/sector, 500118192 sectors, thin
ppb0 at pci0 dev 28 function 0 "Intel 100 Series PCIE" rev 0xf1: msi
pci1 at ppb0 bus 2
rtsx0 at pci1 dev 0 function 0 "Realtek RTS522A Card Reader" rev 0x01: msi
sdmmc0 at rtsx0: 4-bit
ppb1 at pci0 dev 28 function 2 "Intel 100 Series PCIE" rev 0xf1: msi
pci2 at ppb1 bus 4
iwm0 at pci2 dev 0 function 0 "Intel Dual Band Wireless AC 8260" rev 0x3a, msi
pcib0 at pci0 dev 31 function 0 "Intel 100 Series LPC" rev 0x21
"Intel 100 Series PMC" rev 0x21 at pci0 dev 31 function 2 not configured
azalia0 at pci0 dev 31 function 3 "Intel 100 Series HD Audio" rev 0x21: msi
azalia0: codecs: Realtek/0x0293, Intel/0x2809, using Realtek/0x0293
audio0 at azalia0
ichiic0 at pci0 dev 31 function 4 "Intel 100 Series SMBus" rev 0x21: apic 2 int 16
iic0 at ichiic0
em0 at pci0 dev 31 function 6 "Intel I219-LM" rev 0x21: msi, address 50:7b:9d:d6:df:00
em0: PHY reset is blocked due to SOL/IDER session.
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0: console keyboard
pms0 at pckbc0 (aux slot)
wsmouse0 at pms0 mux 0
wsmouse1 at pms0 mux 0
pms0: Synaptics clickpad, firmware 8.1
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
vmm0 at mainbus0: VMX/EPT
efifb0 at mainbus0
wsdisplay0 at efifb0 mux 1: console (std, vt100 emulation), using wskbd0
wsdisplay0: screen 1-5 added (std, vt100 emulation)
umb0 at uhub0 port 3 configuration 1 interface 12 "Sierra Wireless, Incorporated Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A" rev 2.10/0.06 addr 2
umb0: ctrl_len=4096, maxpktlen=2048, cap=0x20
umb0: ctrl-ifno#12: ep-ctrl=2, data-ifno#13: ep-rx=1, ep-tx=1
umb0: -> snd MBIM_OPEN_MSG (tid 1)
umb0: sent MBIM_OPEN_MSG (tid 1)
   0:   01 00 00 00 10 00 00 00 01 00 00 00 00 10 00 00
umb0: vers 1.0
vscsi0 at root
scsibus2 at vscsi0: 256 targets
softraid0 at root
scsibus3 at softraid0: 256 targets
sd1 at scsibus3 targ 1 lun 0: <OPENBSD, SR CRYPTO, 006> SCSI2 0/direct fixed
sd1: 244197MB, 512 bytes/sector, 500116577 sectors
root on sd1a (acef1b0856ff7402.a) swap on sd1b dump on sd1b
iwm0: hw rev 0x200, fw ver 16.242414.0, address 44:85:00:0f:cf:8a
umb0: umb_intr: response available
umb0: got response: len 16
   0:   01 00 00 80 10 00 00 00 01 00 00 00 00 00 00 00
umb0: <- rcv MBIM_OPEN_DONE (tid 1)
umb0: -> qry MBIM_CID_DEVICE_CAPS (tid 2)
umb0: sent MBIM_COMMAND_MSG (tid 2)
   0:   03 00 00 00 30 00 00 00 02 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 01 00 00 00 00 00 00 00 00 00 00 00
umb0: -> qry MBIM_CID_PIN (tid 3)
umb0: sent MBIM_COMMAND_MSG (tid 3)
   0:   03 00 00 00 30 00 00 00 03 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 04 00 00 00 00 00 00 00 00 00 00 00
umb0: -> qry MBIM_CID_REGISTER_STATE (tid 4)
umb0: sent MBIM_COMMAND_MSG (tid 4)
   0:   03 00 00 00 30 00 00 00 04 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 00 00 00 00 00 00 00 00
umb0: state going up from 'down' to 'open'
umb0: umb_intr: response available
umb0: stop: reached state DOWN
umb0: umb_intr: response available
umb0: umb_intr: response available
umb0: got response: len 196
   0:   03 00 00 80 c4 00 00 00 02 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 01 00 00 00 00 00 00 00 94 00 00 00
  48:   03 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00
  64:   3c 00 00 00 03 00 00 00 01 00 00 00 08 00 00 00
  80:   00 00 00 00 00 00 00 00 40 00 00 00 1e 00 00 00
  96:   60 00 00 00 28 00 00 00 88 00 00 00 0c 00 00 00
 112:   30 00 31 00 34 00 35 00 38 00 32 00 30 00 30 00
 128:   30 00 31 00 39 00 34 00 37 00 38 00 38 00 00 00
 144:   53 00 57 00 49 00 39 00 58 00 33 00 30 00 43 00
 160:   5f 00 30 00 32 00 2e 00 30 00 38 00 2e 00 30 00
 176:   32 00 2e 00 30 00 30 00 45 00 4d 00 37 00 34 00
 192:   35 00 35 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 2)
umb0: set/qry MBIM_CID_DEVICE_CAPS done
umb0: max sessions 8, supported classes 0x3c
umb0: got response: len 60
   0:   03 00 00 80 3c 00 00 00 03 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 04 00 00 00 00 00 00 00 0c 00 00 00
  48:   03 00 00 00 01 00 00 00 03 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 3)
umb0: set/qry MBIM_CID_PIN done
umb0: PIN2 state locked (3 attempts left)
umb0: got response: len 96
   0:   03 00 00 80 60 00 00 00 04 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
  48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
  64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 4)
umb0: set/qry MBIM_CID_REGISTER_STATE done
umb0: not registered, availclass 0x0, class 0x1, regmode 1
umb0: stop: reached state DOWN
iwm0: device timeout
umb0: -> set MBIM_CID_REGISTER_STATE (tid 5)
umb0: sent MBIM_COMMAND_MSG (tid 5)
   0:   03 00 00 00 40 00 00 00 05 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 01 00 00 00 10 00 00 00
  48:   00 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00
umb0: umb_intr: response available
umb0: got response: len 96
   0:   03 00 00 80 60 00 00 00 05 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
  48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
  64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 5)
umb0: set/qry MBIM_CID_REGISTER_STATE done
umb0: not registered, availclass 0x0, class 0x1, regmode 1
umb0: init: turning radio on ...
umb0: set radio on
umb0: -> set MBIM_CID_RADIO_STATE (tid 6)
umb0: sent MBIM_COMMAND_MSG (tid 6)
   0:   03 00 00 00 34 00 00 00 06 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 03 00 00 00 01 00 00 00 04 00 00 00
  48:   01 00 00 00
umb0: init: checking SIM state ...
umb0: -> qry MBIM_CID_SUBSCRIBER_READY_STATUS (tid 7)
umb0: sent MBIM_COMMAND_MSG (tid 7)
   0:   03 00 00 00 30 00 00 00 07 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 02 00 00 00 00 00 00 00 00 00 00 00
umb0: umb_intr: response available
umb0: got response: len 56
   0:   03 00 00 80 38 00 00 00 06 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 03 00 00 00 02 00 00 00 08 00 00 00
  48:   01 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 6)
umb0: set/qry MBIM_CID_RADIO_STATE failed: FAILURE
umb0: umb_intr: response available
umb0: got response: len 180
   0:   03 00 00 80 b4 00 00 00 07 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 02 00 00 00 00 00 00 00 84 00 00 00
  48:   01 00 00 00 3c 00 00 00 1e 00 00 00 5c 00 00 00
  64:   28 00 00 00 00 00 00 00 01 00 00 00 24 00 00 00
  80:   18 00 00 00 2b 00 31 00 32 00 30 00 39 00 34 00
  96:   35 00 34 00 39 00 30 00 39 00 37 00 33 00 31 00
 112:   30 00 34 00 31 00 30 00 38 00 38 00 34 00 30 00
 128:   37 00 36 00 31 00 36 00 38 00 00 00 38 00 39 00
 144:   30 00 31 00 34 00 31 00 30 00 34 00 32 00 37 00
 160:   38 00 38 00 34 00 30 00 37 00 36 00 31 00 36 00
 176:   38 00 30 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 7)
umb0: set/qry MBIM_CID_SUBSCRIBER_READY_STATUS done
umb0: SIM initialized
umb0: state going up from 'open' to 'SIM is ready'
umb0: init: attaching ...
umb0: attach packet service
umb0: -> set MBIM_CID_PACKET_SERVICE (tid 8)
umb0: sent MBIM_COMMAND_MSG (tid 8)
   0:   03 00 00 00 34 00 00 00 08 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
  48:   00 00 00 00
umb0: umb_intr: response available
umb0: got response: len 48
   0:   03 00 00 80 30 00 00 00 08 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 8)
umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
umb0: state change time out
umb0: init: attaching ...
umb0: attach packet service
umb0: -> set MBIM_CID_PACKET_SERVICE (tid 9)
umb0: sent MBIM_COMMAND_MSG (tid 9)
   0:   03 00 00 00 34 00 00 00 09 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
  48:   00 00 00 00
umb0: umb_intr: response available
umb0: got response: len 48
   0:   03 00 00 80 30 00 00 00 09 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 9)
umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
umb0: state change time out
umb0: init: attaching ...
umb0: attach packet service
umb0: -> set MBIM_CID_PACKET_SERVICE (tid 10)
umb0: sent MBIM_COMMAND_MSG (tid 10)
   0:   03 00 00 00 34 00 00 00 0a 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
  48:   00 00 00 00
umb0: umb_intr: response available
umb0: got response: len 48
   0:   03 00 00 80 30 00 00 00 0a 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 10)
umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
umb0: state change time out
umb0: init: attaching ...
umb0: attach packet service
umb0: -> set MBIM_CID_PACKET_SERVICE (tid 11)
umb0: sent MBIM_COMMAND_MSG (tid 11)
   0:   03 00 00 00 34 00 00 00 0b 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
  48:   00 00 00 00
umb0: umb_intr: response available
umb0: got response: len 48
   0:   03 00 00 80 30 00 00 00 0b 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 11)
umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
umb0: state change time out
umb0: init: attaching ...
umb0: attach packet service
umb0: -> set MBIM_CID_PACKET_SERVICE (tid 12)
umb0: sent MBIM_COMMAND_MSG (tid 12)
   0:   03 00 00 00 34 00 00 00 0c 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
  48:   00 00 00 00
umb0: umb_intr: response available
umb0: got response: len 48
   0:   03 00 00 80 30 00 00 00 0c 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 12)
umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
umb0: -> set MBIM_CID_REGISTER_STATE (tid 13)
umb0: sent MBIM_COMMAND_MSG (tid 13)
   0:   03 00 00 00 40 00 00 00 0d 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 01 00 00 00 10 00 00 00
  48:   00 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00
umb0: umb_intr: response available
umb0: got response: len 96
   0:   03 00 00 80 60 00 00 00 0d 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
  48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
  64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 13)
umb0: set/qry MBIM_CID_REGISTER_STATE done
umb0: not registered, availclass 0x0, class 0x1, regmode 1
umb0: state change time out
umb0: init: attaching ...
umb0: attach packet service
umb0: -> set MBIM_CID_PACKET_SERVICE (tid 14)
umb0: sent MBIM_COMMAND_MSG (tid 14)
   0:   03 00 00 00 34 00 00 00 0e 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
  48:   00 00 00 00
umb0: umb_intr: response available
umb0: got response: len 48
   0:   03 00 00 80 30 00 00 00 0e 00 00 00 01 00 00 00
  16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
  32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
umb0: <- rcv MBIM_COMMAND_DONE (tid 14)
umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Mark Kettenis
In reply to this post by Gerhard Roth-2
> From: Gerhard Roth <[hidden email]>
> Date: Fri, 10 Jun 2016 00:31:44 +0200
>
> On 10.06.2016 00:22, Stuart Henderson wrote:
> > On 2016/06/10 00:10, Mark Kettenis wrote:
> >>> From: Gerhard Roth <[hidden email]>
> >>> Date: Thu, 9 Jun 2016 23:48:23 +0200
> >>>
> >>> On 09.06.2016 23:42, Mark Kettenis wrote:
> >>>>> Date: Thu, 9 Jun 2016 22:59:28 +0200 (CEST)
> >>>>> From: Mark Kettenis <[hidden email]>
> >>>>>
> >>>>>> Date: Wed, 8 Jun 2016 15:08:52 +0200
> >>>>>> From: Gerhard Roth <[hidden email]>
> >>>>>>
> >>>>>> I would be glad to hear from some people trying this with a real MBIM
> >>>>>> device.
> >>>>>
> >>>>> Sierra Wireless EM7345 4G LTE here.  This devices currently attached
> >>>>> as umodem(4).  But I did add its vendor id and device id to umb_devs,
> >>>>> which makes it partially attach:
> >>>>>
> >>>>> umb0 at uhub0 port 4 "Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE" rev 2.00/17.29 addr 2
> >>>>> umb0: switching to config #1
> >>>>> umb0: ignoring invalid segment size 1500
> >>>>> umb0: ctrl_len=512, maxpktlen=8192, cap=0x4
> >>>>> umb0: no control interface found
> >>>>>
> >>>>> (this is with UMB_DEBUG enabled)
> >>>>>
> >>>>> It seems this device needs some additional poking to select alternate
> >>>>> interface settings.
> >>>>
> >>>> With the appropriate alternate settings for the communication
> >>>> interface and data interface (1 and 2) hardcoded in the driver, this
> >>>> works!
> >>>
> >>> Great!
> >>>
> >>> Although another example of a device violating the MBIM spec which
> >>> clearly states that alternate settings 0 and 1 have to be used.
> >>
> >> Which version of the spec are you looking at?  Because my copy
> >> (Revision 1.0 Errata-1) clearly status alternate settings 1 and 2 have
> >> to be used ;).
> >
> > There are different sections, 3.2 for dual-mode (NCM1.0 / MBIM)
> > devices talks about various alternate settings for NCM1.0 and
> > for MBIM, then 6.6 which is only dealing with MBIM just talks
> > about 0 and 1 ..
> >
>
> That's how I looked at it, too. But it seems that some vendors look
> at it differently ;)
>
> So we should find a solution where we don't need to use the
> currently hard-coded MBIM_INTERFACE_ALTSETTING (== 1) anymore.

I don't think that is too difficult.  The alternate settings are
encoded in the bAlternateSetting of the Interface Descriptor.  So we
just need to remmeber those when we iterate over the full set of
interface descriptors at the start of umb_attach().

In any case this is something we can figure out once the code hits the
tree.  Unless mpi@ is still unhappy with the way the driver performs
ioctls, I think we should get the driver bits into the tree such that
we can work on fixing the remaining issues with it.

The ifconfig bits seem to be a bit more controversial.  And we
defenitely need to test those in a RAMDISK context as well.

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Stuart Henderson
In reply to this post by Gerhard Roth-2
I found https://lists.freedesktop.org/archives/libmbim-devel/2016-April/000704.html
which suggests that the Lenovo firmware build of the 7455 is definitely one
that needs the fccauth command.

I don't think fccauth or device support are things that should stop the driver
going in though. It doesn't matter if it works everywhere.

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Stuart Henderson
In reply to this post by Mark Kettenis
On 2016/06/10 16:05, Mark Kettenis wrote:
> In any case this is something we can figure out once the code hits the
> tree.  Unless mpi@ is still unhappy with the way the driver performs
> ioctls, I think we should get the driver bits into the tree such that
> we can work on fixing the remaining issues with it.

Agreed.

Did people notice the uhub.c part? Any concerns with that?

> The ifconfig bits seem to be a bit more controversial.  And we
> defenitely need to test those in a RAMDISK context as well.

yes.

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Mark Kettenis
> Date: Fri, 10 Jun 2016 17:20:18 +0100
> From: Stuart Henderson <[hidden email]>
>
> On 2016/06/10 16:05, Mark Kettenis wrote:
> > In any case this is something we can figure out once the code hits the
> > tree.  Unless mpi@ is still unhappy with the way the driver performs
> > ioctls, I think we should get the driver bits into the tree such that
> > we can work on fixing the remaining issues with it.
>
> Agreed.
>
> Did people notice the uhub.c part? Any concerns with that?

Yes, that is a separate issue as well.  And should therefore be a
separate commit.  It doesn't seem unreasonable to me to retry once
before giving up.  But this is another area where mpi@ should have the
final say.

The printf doesn't trigger on my Sierra Wireless EM7345 (which really
is an Intel XMM 7160 in disguise).

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Martin Pieuchot
On 10/06/16(Fri) 21:09, Mark Kettenis wrote:

> > Date: Fri, 10 Jun 2016 17:20:18 +0100
> > From: Stuart Henderson <[hidden email]>
> >
> > On 2016/06/10 16:05, Mark Kettenis wrote:
> > > In any case this is something we can figure out once the code hits the
> > > tree.  Unless mpi@ is still unhappy with the way the driver performs
> > > ioctls, I think we should get the driver bits into the tree such that
> > > we can work on fixing the remaining issues with it.
> >
> > Agreed.
> >
> > Did people notice the uhub.c part? Any concerns with that?
>
> Yes, that is a separate issue as well.  And should therefore be a
> separate commit.  It doesn't seem unreasonable to me to retry once
> before giving up.  But this is another area where mpi@ should have the
> final say.
>
> The printf doesn't trigger on my Sierra Wireless EM7345 (which really
> is an Intel XMM 7160 in disguise).

I'm worried that this hack alone won't help us improve the currently
outdated code to initialize USB devices as it will work around other
bugs.

That said I think it's a good starting point to improve things,  so I
gave Gerhard my ok.

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Gerhard Roth-2
In reply to this post by Bryan Vyhmeister-3
On 10.06.2016 14:41, Bryan Vyhmeister wrote:

> On Fri, Jun 10, 2016 at 09:43:36AM +0200, Gerhard Roth wrote:
>> Hmm, I don't see the missing break. It is still stuck in the same
>> state trying to turn on the radio and always getting non-confirmative
>> resonses.
>>
>> If the break before "case UMB_S_RADIO:" is missing, I would expect
>> to see a debug printf "umb0: init: checking SIM state ...".
>> Could you please check once again?
>
>>From a previous email you said to comment out the break after "case
> UMB_S_RADIO" which did not have any effect. Commenting out the break
> after "case UMB_S_OPEN" as I believe you are saying above did have an
> effect.
>
>
>         case UMB_S_OPEN:
>                 DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc));
>                 umb_radio(sc, 1);
>                 // break;
>         case UMB_S_RADIO:
>                 DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc));
>                 umb_cmd(sc, MBIM_CID_SUBSCRIBER_READY_STATUS, MBIM_CMDOP_QRY,
>                     NULL, 0);
>                 break;
>         case UMB_S_SIMREADY:
>                 DPRINTF("%s: init: attaching ...\n", DEVNAM(sc));
>                 umb_packet_service(sc, 1);
>                 break;
>
>> The error code is rather generic and gives us no help to
>> determine why exactly the device refuses to turn on the
>> radio. But it reports that the hw-state is on, which means
>> we can at least exclude any rfkill switch ;)
>>
>> So why does the firmware refuse to turn it on? Could still
>> be a problem of the PIN-less SIM card you're using.
>
> With the break commented out above I now see this output from ifconfig
> umb0 (sensitive info with XXX):
>
> umb0: flags=8811<UP,POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
>         index 5 priority 0
>         roaming disabled registration not registered
>         state SIM is ready cell-class none
>         SIM initialized PIN valid (3 attempts left)
>         subscriber-id XXXXXXXX ICC-id XXXXXXXXXX
>         device EM7455 IMEI 014582000 firmware SWI9X30C_02.08.
>         phone# ++XXXXXXXXXX APN broadband
>         status: down
>
> I have not seen the first ten digits of the SIM card's phone number, the
> subscriber-id, or the ICC-id in ifconfig output before so that seems
> promising. Could this be something like needing the FCC auth? The debug
> output follows. Thank you!

Well, the device still refuses to turn on the radio and without it,
there's no chance to register with the provider.

That you see more information now is just due to the fact, that the
state machine now continues beyond the "turn radio on" step.

You might try the FCC auth patch, but I'm not very confident about
it in your situation. Your device already speaks MBIM, so why should
we need to enable it.

I haven't got the slightest clue, why it refuses to turn on the radio.
It might be related to the type of SIM card. But honestly, I don't know.


>
> Bryan
>
>
>
> OpenBSD 6.0-beta (GENERIC.MP) #1: Fri Jun 10 04:25:48 PDT 2016
>     [hidden email]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
> real mem = 17024274432 (16235MB)
> avail mem = 16503758848 (15739MB)
> mpath0 at root
> scsibus0 at mpath0: 256 targets
> mainbus0 at root
> bios0 at mainbus0: SMBIOS rev. 2.8 @ 0xb7c01000 (66 entries)
> bios0: vendor LENOVO version "R02ET44W (1.17 )" date 01/25/2016
> bios0: LENOVO 20F6CTO1WW
> acpi0 at bios0: rev 2
> acpi0: sleep states S0 S3 S4 S5
> acpi0: tables DSDT FACP UEFI SSDT SSDT ECDT HPET APIC MCFG SSDT SSDT DBGP DBG2 BOOT BATB SSDT SSDT MSDM DMAR ASF! FPDT UEFI
> acpi0: wakeup devices LID_(S4) SLPB(S3) IGBE(S4) PXSX(S4) PXSX(S4) PXSX(S4) PXSX(S4) EXP8(S4) PXSX(S4) XHCI(S3)
> acpitimer0 at acpi0: 3579545 Hz, 24 bits
> acpiec0 at acpi0
> acpihpet0 at acpi0: 23999999 Hz
> acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
> cpu0 at mainbus0: apid 0 (boot processor)
> cpu0: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2485.32 MHz
> cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
> cpu0: 256KB 64b/line 8-way L2 cache
> cpu0: smt 0, core 0, package 0
> mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
> cpu0: apic clock running at 24MHz
> cpu0: mwait min=64, max=64, C-substates=0.2.1.2.4.1.1.1, IBE
> cpu1 at mainbus0: apid 2 (application processor)
> cpu1: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.21 MHz
> cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
> cpu1: 256KB 64b/line 8-way L2 cache
> cpu1: smt 0, core 1, package 0
> cpu2 at mainbus0: apid 1 (application processor)
> cpu2: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.21 MHz
> cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
> cpu2: 256KB 64b/line 8-way L2 cache
> cpu2: smt 1, core 0, package 0
> cpu3 at mainbus0: apid 3 (application processor)
> cpu3: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz, 2494.21 MHz
> cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,LONG,LAHF,ABM,3DNOWP,PERF,ITSC,FSGSBASE,SGX,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,MPX,RDSEED,ADX,SMAP,CLFLUSHOPT,PT,SENSOR,ARAT
> cpu3: 256KB 64b/line 8-way L2 cache
> cpu3: smt 1, core 1, package 0
> ioapic0 at mainbus0: apid 2 pa 0xfec00000, version 20, 120 pins
> acpimcfg0 at acpi0 addr 0xf8000000, bus 0-63
> acpiprt0 at acpi0: bus 0 (PCI0)
> acpiprt1 at acpi0: bus -1 (PEG0)
> acpiprt2 at acpi0: bus -1 (PEG1)
> acpiprt3 at acpi0: bus -1 (PEG2)
> acpiprt4 at acpi0: bus 2 (EXP1)
> acpiprt5 at acpi0: bus 4 (EXP3)
> acpiprt6 at acpi0: bus -1 (EXP4)
> acpiprt7 at acpi0: bus -1 (EXP5)
> acpiprt8 at acpi0: bus -1 (EXP8)
> acpicpu0 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpicpu1 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpicpu2 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpicpu3 at acpi0: C3(200@1034 mwait.1@0x60), C2(200@151 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpipwrres0 at acpi0: PUBS, resource for XHCI
> acpipwrres1 at acpi0: PG00, resource for PEG0
> acpipwrres2 at acpi0: PG01, resource for PEG1
> acpipwrres3 at acpi0: PG02, resource for PEG2
> acpipwrres4 at acpi0: WRST
> acpipwrres5 at acpi0: WRST
> acpitz0 at acpi0: critical temperature is 128 degC
> acpibtn0 at acpi0: LID_
> acpibtn1 at acpi0: SLPB
> "LEN0071" at acpi0 not configured
> "LEN2014" at acpi0 not configured
> "INT3F0D" at acpi0 not configured
> acpibat0 at acpi0: BAT0 model "45N1113" serial  4020 type LION oem "LGC"
> acpibat1 at acpi0: BAT1 model "45N1738" serial  2903 type LION oem "LGC"
> acpiac0 at acpi0: AC unit online
> acpithinkpad0 at acpi0
> "PNP0C14" at acpi0 not configured
> "PNP0C14" at acpi0 not configured
> "PNP0C14" at acpi0 not configured
> "INT3394" at acpi0 not configured
> acpivideo0 at acpi0: GFX0
> acpivout at acpivideo0 not configured
> cpu0: Enhanced SpeedStep 2485 MHz: speeds: 2701, 2700, 2600, 2500, 2300, 2100, 1900, 1800, 1600, 1400, 1300, 1100, 800, 700, 600, 400 MHz
> pci0 at mainbus0 bus 0
> pchb0 at pci0 dev 0 function 0 "Intel Core 6G Host" rev 0x08
> "Intel HD Graphics 520" rev 0x07 at pci0 dev 2 function 0 not configured
> xhci0 at pci0 dev 20 function 0 "Intel 100 Series xHCI" rev 0x21: msi
> usb0 at xhci0: USB revision 3.0
> uhub0 at usb0 "Intel xHCI root hub" rev 3.00/1.00 addr 1
> pchtemp0 at pci0 dev 20 function 2 "Intel 100 Series Thermal" rev 0x21
> "Intel 100 Series MEI" rev 0x21 at pci0 dev 22 function 0 not configured
> ahci0 at pci0 dev 23 function 0 "Intel 100 Series AHCI" rev 0x21: msi, AHCI 1.3.1
> ahci0: port 1: 6.0Gb/s
> scsibus1 at ahci0: 32 targets
> sd0 at scsibus1 targ 1 lun 0: <ATA, Samsung SSD 850, EXM0> SCSI3 0/direct fixed naa.500253884012b49d
> sd0: 244198MB, 512 bytes/sector, 500118192 sectors, thin
> ppb0 at pci0 dev 28 function 0 "Intel 100 Series PCIE" rev 0xf1: msi
> pci1 at ppb0 bus 2
> rtsx0 at pci1 dev 0 function 0 "Realtek RTS522A Card Reader" rev 0x01: msi
> sdmmc0 at rtsx0: 4-bit
> ppb1 at pci0 dev 28 function 2 "Intel 100 Series PCIE" rev 0xf1: msi
> pci2 at ppb1 bus 4
> iwm0 at pci2 dev 0 function 0 "Intel Dual Band Wireless AC 8260" rev 0x3a, msi
> pcib0 at pci0 dev 31 function 0 "Intel 100 Series LPC" rev 0x21
> "Intel 100 Series PMC" rev 0x21 at pci0 dev 31 function 2 not configured
> azalia0 at pci0 dev 31 function 3 "Intel 100 Series HD Audio" rev 0x21: msi
> azalia0: codecs: Realtek/0x0293, Intel/0x2809, using Realtek/0x0293
> audio0 at azalia0
> ichiic0 at pci0 dev 31 function 4 "Intel 100 Series SMBus" rev 0x21: apic 2 int 16
> iic0 at ichiic0
> em0 at pci0 dev 31 function 6 "Intel I219-LM" rev 0x21: msi, address 50:7b:9d:d6:df:00
> em0: PHY reset is blocked due to SOL/IDER session.
> isa0 at pcib0
> isadma0 at isa0
> pckbc0 at isa0 port 0x60/5 irq 1 irq 12
> pckbd0 at pckbc0 (kbd slot)
> wskbd0 at pckbd0: console keyboard
> pms0 at pckbc0 (aux slot)
> wsmouse0 at pms0 mux 0
> wsmouse1 at pms0 mux 0
> pms0: Synaptics clickpad, firmware 8.1
> pcppi0 at isa0 port 0x61
> spkr0 at pcppi0
> vmm0 at mainbus0: VMX/EPT
> efifb0 at mainbus0
> wsdisplay0 at efifb0 mux 1: console (std, vt100 emulation), using wskbd0
> wsdisplay0: screen 1-5 added (std, vt100 emulation)
> umb0 at uhub0 port 3 configuration 1 interface 12 "Sierra Wireless, Incorporated Sierra Wireless EM7455 Qualcomm Snapdragon X7 LTE-A" rev 2.10/0.06 addr 2
> umb0: ctrl_len=4096, maxpktlen=2048, cap=0x20
> umb0: ctrl-ifno#12: ep-ctrl=2, data-ifno#13: ep-rx=1, ep-tx=1
> umb0: -> snd MBIM_OPEN_MSG (tid 1)
> umb0: sent MBIM_OPEN_MSG (tid 1)
>    0:   01 00 00 00 10 00 00 00 01 00 00 00 00 10 00 00
> umb0: vers 1.0
> vscsi0 at root
> scsibus2 at vscsi0: 256 targets
> softraid0 at root
> scsibus3 at softraid0: 256 targets
> sd1 at scsibus3 targ 1 lun 0: <OPENBSD, SR CRYPTO, 006> SCSI2 0/direct fixed
> sd1: 244197MB, 512 bytes/sector, 500116577 sectors
> root on sd1a (acef1b0856ff7402.a) swap on sd1b dump on sd1b
> iwm0: hw rev 0x200, fw ver 16.242414.0, address 44:85:00:0f:cf:8a
> umb0: umb_intr: response available
> umb0: got response: len 16
>    0:   01 00 00 80 10 00 00 00 01 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_OPEN_DONE (tid 1)
> umb0: -> qry MBIM_CID_DEVICE_CAPS (tid 2)
> umb0: sent MBIM_COMMAND_MSG (tid 2)
>    0:   03 00 00 00 30 00 00 00 02 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 01 00 00 00 00 00 00 00 00 00 00 00
> umb0: -> qry MBIM_CID_PIN (tid 3)
> umb0: sent MBIM_COMMAND_MSG (tid 3)
>    0:   03 00 00 00 30 00 00 00 03 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 04 00 00 00 00 00 00 00 00 00 00 00
> umb0: -> qry MBIM_CID_REGISTER_STATE (tid 4)
> umb0: sent MBIM_COMMAND_MSG (tid 4)
>    0:   03 00 00 00 30 00 00 00 04 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 09 00 00 00 00 00 00 00 00 00 00 00
> umb0: state going up from 'down' to 'open'
> umb0: umb_intr: response available
> umb0: stop: reached state DOWN
> umb0: umb_intr: response available
> umb0: umb_intr: response available
> umb0: got response: len 196
>    0:   03 00 00 80 c4 00 00 00 02 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 01 00 00 00 00 00 00 00 94 00 00 00
>   48:   03 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00
>   64:   3c 00 00 00 03 00 00 00 01 00 00 00 08 00 00 00
>   80:   00 00 00 00 00 00 00 00 40 00 00 00 1e 00 00 00
>   96:   60 00 00 00 28 00 00 00 88 00 00 00 0c 00 00 00
>  112:   30 00 31 00 34 00 35 00 38 00 32 00 30 00 30 00
>  128:   30 00 31 00 39 00 34 00 37 00 38 00 38 00 00 00
>  144:   53 00 57 00 49 00 39 00 58 00 33 00 30 00 43 00
>  160:   5f 00 30 00 32 00 2e 00 30 00 38 00 2e 00 30 00
>  176:   32 00 2e 00 30 00 30 00 45 00 4d 00 37 00 34 00
>  192:   35 00 35 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 2)
> umb0: set/qry MBIM_CID_DEVICE_CAPS done
> umb0: max sessions 8, supported classes 0x3c
> umb0: got response: len 60
>    0:   03 00 00 80 3c 00 00 00 03 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 04 00 00 00 00 00 00 00 0c 00 00 00
>   48:   03 00 00 00 01 00 00 00 03 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 3)
> umb0: set/qry MBIM_CID_PIN done
> umb0: PIN2 state locked (3 attempts left)
> umb0: got response: len 96
>    0:   03 00 00 80 60 00 00 00 04 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
>   48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
>   64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 4)
> umb0: set/qry MBIM_CID_REGISTER_STATE done
> umb0: not registered, availclass 0x0, class 0x1, regmode 1
> umb0: stop: reached state DOWN
> iwm0: device timeout
> umb0: -> set MBIM_CID_REGISTER_STATE (tid 5)
> umb0: sent MBIM_COMMAND_MSG (tid 5)
>    0:   03 00 00 00 40 00 00 00 05 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 09 00 00 00 01 00 00 00 10 00 00 00
>   48:   00 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 96
>    0:   03 00 00 80 60 00 00 00 05 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
>   48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
>   64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 5)
> umb0: set/qry MBIM_CID_REGISTER_STATE done
> umb0: not registered, availclass 0x0, class 0x1, regmode 1
> umb0: init: turning radio on ...
> umb0: set radio on
> umb0: -> set MBIM_CID_RADIO_STATE (tid 6)
> umb0: sent MBIM_COMMAND_MSG (tid 6)
>    0:   03 00 00 00 34 00 00 00 06 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 03 00 00 00 01 00 00 00 04 00 00 00
>   48:   01 00 00 00
> umb0: init: checking SIM state ...
> umb0: -> qry MBIM_CID_SUBSCRIBER_READY_STATUS (tid 7)
> umb0: sent MBIM_COMMAND_MSG (tid 7)
>    0:   03 00 00 00 30 00 00 00 07 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 02 00 00 00 00 00 00 00 00 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 56
>    0:   03 00 00 80 38 00 00 00 06 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 03 00 00 00 02 00 00 00 08 00 00 00
>   48:   01 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 6)
> umb0: set/qry MBIM_CID_RADIO_STATE failed: FAILURE
> umb0: umb_intr: response available
> umb0: got response: len 180
>    0:   03 00 00 80 b4 00 00 00 07 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 02 00 00 00 00 00 00 00 84 00 00 00
>   48:   01 00 00 00 3c 00 00 00 1e 00 00 00 5c 00 00 00
>   64:   28 00 00 00 00 00 00 00 01 00 00 00 24 00 00 00
>   80:   18 00 00 00 2b 00 31 00 32 00 30 00 39 00 34 00
>   96:   35 00 34 00 39 00 30 00 39 00 37 00 33 00 31 00
>  112:   30 00 34 00 31 00 30 00 38 00 38 00 34 00 30 00
>  128:   37 00 36 00 31 00 36 00 38 00 00 00 38 00 39 00
>  144:   30 00 31 00 34 00 31 00 30 00 34 00 32 00 37 00
>  160:   38 00 38 00 34 00 30 00 37 00 36 00 31 00 36 00
>  176:   38 00 30 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 7)
> umb0: set/qry MBIM_CID_SUBSCRIBER_READY_STATUS done
> umb0: SIM initialized
> umb0: state going up from 'open' to 'SIM is ready'
> umb0: init: attaching ...
> umb0: attach packet service
> umb0: -> set MBIM_CID_PACKET_SERVICE (tid 8)
> umb0: sent MBIM_COMMAND_MSG (tid 8)
>    0:   03 00 00 00 34 00 00 00 08 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
>   48:   00 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 48
>    0:   03 00 00 80 30 00 00 00 08 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 8)
> umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
> umb0: state change time out
> umb0: init: attaching ...
> umb0: attach packet service
> umb0: -> set MBIM_CID_PACKET_SERVICE (tid 9)
> umb0: sent MBIM_COMMAND_MSG (tid 9)
>    0:   03 00 00 00 34 00 00 00 09 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
>   48:   00 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 48
>    0:   03 00 00 80 30 00 00 00 09 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 9)
> umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
> umb0: state change time out
> umb0: init: attaching ...
> umb0: attach packet service
> umb0: -> set MBIM_CID_PACKET_SERVICE (tid 10)
> umb0: sent MBIM_COMMAND_MSG (tid 10)
>    0:   03 00 00 00 34 00 00 00 0a 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
>   48:   00 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 48
>    0:   03 00 00 80 30 00 00 00 0a 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 10)
> umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
> umb0: state change time out
> umb0: init: attaching ...
> umb0: attach packet service
> umb0: -> set MBIM_CID_PACKET_SERVICE (tid 11)
> umb0: sent MBIM_COMMAND_MSG (tid 11)
>    0:   03 00 00 00 34 00 00 00 0b 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
>   48:   00 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 48
>    0:   03 00 00 80 30 00 00 00 0b 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 11)
> umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
> umb0: state change time out
> umb0: init: attaching ...
> umb0: attach packet service
> umb0: -> set MBIM_CID_PACKET_SERVICE (tid 12)
> umb0: sent MBIM_COMMAND_MSG (tid 12)
>    0:   03 00 00 00 34 00 00 00 0c 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
>   48:   00 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 48
>    0:   03 00 00 80 30 00 00 00 0c 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 12)
> umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
> umb0: -> set MBIM_CID_REGISTER_STATE (tid 13)
> umb0: sent MBIM_COMMAND_MSG (tid 13)
>    0:   03 00 00 00 40 00 00 00 0d 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 09 00 00 00 01 00 00 00 10 00 00 00
>   48:   00 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 96
>    0:   03 00 00 80 60 00 00 00 0d 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 09 00 00 00 00 00 00 00 30 00 00 00
>   48:   00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00
>   64:   01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   80:   00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 13)
> umb0: set/qry MBIM_CID_REGISTER_STATE done
> umb0: not registered, availclass 0x0, class 0x1, regmode 1
> umb0: state change time out
> umb0: init: attaching ...
> umb0: attach packet service
> umb0: -> set MBIM_CID_PACKET_SERVICE (tid 14)
> umb0: sent MBIM_COMMAND_MSG (tid 14)
>    0:   03 00 00 00 34 00 00 00 0e 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 01 00 00 00 04 00 00 00
>   48:   00 00 00 00
> umb0: umb_intr: response available
> umb0: got response: len 48
>    0:   03 00 00 80 30 00 00 00 0e 00 00 00 01 00 00 00
>   16:   00 00 00 00 a2 89 cc 33 bc bb 8b 4f b6 b0 13 3e
>   32:   c2 aa e6 df 0a 00 00 00 14 00 00 00 00 00 00 00
> umb0: <- rcv MBIM_COMMAND_DONE (tid 14)
> umb0: set/qry MBIM_CID_PACKET_SERVICE failed: RADIO_POWER_OFF
>

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Bryan Vyhmeister-3
On Tue, Jun 14, 2016 at 11:17:56PM +0200, Gerhard Roth wrote:

> Well, the device still refuses to turn on the radio and without it,
> there's no chance to register with the provider.
>
> That you see more information now is just due to the fact, that the
> state machine now continues beyond the "turn radio on" step.
>
> You might try the FCC auth patch, but I'm not very confident about
> it in your situation. Your device already speaks MBIM, so why should
> we need to enable it.
>
> I haven't got the slightest clue, why it refuses to turn on the radio.
> It might be related to the type of SIM card. But honestly, I don't know.

I tried to apply your most recently posted public patch again on a clean
tree and ran into some problems with patching. As soon as I figure out
what changed between your patch and -current src I will try again with a
Verizon Wireless SIM card. It does seem that different device firmware
is specific to specific carriers in some cases but it's not that clear.
If I can rule out the SIM card causing problems it is at least one step
further along. Thanks again! I hope that umb(4) can make it into OpenBSD
soon!

Bryan

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Stuart Henderson
In reply to this post by Gerhard Roth-2
On 2016/06/14 23:17, Gerhard Roth wrote:
> You might try the FCC auth patch, but I'm not very confident about
> it in your situation. Your device already speaks MBIM, so why should
> we need to enable it.

As far as I can make out, the FCC auth is to enable the radio rather
than anything else, the command has to be sent over (qmi-over-)MBIM.
I haven't had time to get a linux install to see how it behaves there
but I would assume that it could easily look like an rfkill until
that command is sent.

The patch I sent (I think it may have been offlist) is highly unlikely
to work as-is, it looked like the device needs to be reset as well
after sending the command..

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Bryan Vyhmeister-3
On Tue, Jun 14, 2016 at 11:56:14PM +0100, Stuart Henderson wrote:
> As far as I can make out, the FCC auth is to enable the radio rather
> than anything else, the command has to be sent over (qmi-over-)MBIM.
> I haven't had time to get a linux install to see how it behaves there
> but I would assume that it could easily look like an rfkill until
> that command is sent.

Hopefully that's the problem.

> The patch I sent (I think it may have been offlist) is highly unlikely
> to work as-is, it looked like the device needs to be reset as well
> after sending the command..

Ah. That explains why I couldn't find the patch. I'm happy to test at
some point. Thanks again.

Bryan

Reply | Threaded
Open this post in threaded view
|

Re: MBIM Patch (Round 3)

Gerhard Roth-2
In reply to this post by Martin Pieuchot
On 13.06.2016 12:52, Martin Pieuchot wrote:

> On 10/06/16(Fri) 21:09, Mark Kettenis wrote:
>>> Date: Fri, 10 Jun 2016 17:20:18 +0100
>>> From: Stuart Henderson <[hidden email]>
>>>
>>> On 2016/06/10 16:05, Mark Kettenis wrote:
>>>> In any case this is something we can figure out once the code hits the
>>>> tree.  Unless mpi@ is still unhappy with the way the driver performs
>>>> ioctls, I think we should get the driver bits into the tree such that
>>>> we can work on fixing the remaining issues with it.
>>>
>>> Agreed.
>>>
>>> Did people notice the uhub.c part? Any concerns with that?
>>
>> Yes, that is a separate issue as well.  And should therefore be a
>> separate commit.  It doesn't seem unreasonable to me to retry once
>> before giving up.  But this is another area where mpi@ should have the
>> final say.
>>
>> The printf doesn't trigger on my Sierra Wireless EM7345 (which really
>> is an Intel XMM 7160 in disguise).
>
> I'm worried that this hack alone won't help us improve the currently
> outdated code to initialize USB devices as it will work around other
> bugs.
>
> That said I think it's a good starting point to improve things,  so I
> gave Gerhard my ok.
>

Thanks for the ok, the umb(4) driver has been committed now.

But because of the controversy, I did exclude the uhub.c part.
I would suggest to wait and see what other users of umb(4) experience.
If I'm the only one seeing this strange behavior, we might just forget
about it. But if others suffer from it, too, then I'll submit a separate
patch for it.

Gerhard

Reply | Threaded
Open this post in threaded view
|

umb(4) attachment

Mark Kettenis
In reply to this post by Stuart Henderson
As reported earlier, umb(4) currently doesn't attach to devices that
implement both NCM 1.0 and MBIM, such as the Sierra Wireless EM7345
that is found in some thinkpads.

The diff below fixes this.  It revamps the way we look up interface
descriptors quite a bit.  I removed the unused code for matching
devices based on vendor and product ids.  That code got a bit in my
way.  It should be possible to bring that back if needed.

With this fix, the EM7345 attaches as:

umb0 at uhub0 port 4 configuration 1 interface 0 "Sierra Wireless Inc. Sierra Wi
reless EM7345 4G LTE" rev 2.00/17.29 addr 2
umb0: ignoring invalid segment size 1500
umb0: vers 1.0
umodem0 at uhub0 port 4 configuration 1 interface 2 "Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE" rev 2.00/17.29 addr 2
umodem0: data interface 3, has no CM over data, has break
umodem0: status change notification available
ucom0 at umodem0

Note that it still attaches as umodem(4) as well.  That is actually a
good thing since it allows me to read out the GPS though that interface.

I believe this code should work on all devices that are properly MBIM
compliant.  But of course vendors are notoriously sloppy in providing
the right usb interface descriptors for their devices.  So testing is
welcome.  If you run into issues, please provide lsusb -v output.

Thanks,

Mark


Index: if_umb.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/if_umb.c,v
retrieving revision 1.1
diff -u -p -r1.1 if_umb.c
--- if_umb.c 15 Jun 2016 19:39:34 -0000 1.1
+++ if_umb.c 17 Jun 2016 20:08:05 -0000
@@ -204,48 +204,35 @@ const struct cfattach umb_ca = {
 
 int umb_delay = 4000;
 
-/*
- * Normally, MBIM devices are detected by their interface class and subclass.
- * But for some models that have multiple configurations, it is better to
- * match by vendor and product id so that we can select the desired
- * configuration ourselves.
- *
- * OTOH, some devices identifiy themself als an MBIM device but fail to speak
- * the MBIM protocol.
- */
-struct umb_products {
- struct usb_devno dev;
- int confno;
-};
-const struct umb_products umb_devs[] = {
- /*
- * Add devices here to force them to attach as umb.
- * Format: { { VID, PID }, CONFIGNO }
- */
-};
-
-#define umb_lookup(vid, pid) \
- ((const struct umb_products *)usb_lookup(umb_devs, vid, pid))
-
 int
 umb_match(struct device *parent, void *match, void *aux)
 {
  struct usb_attach_arg *uaa = aux;
  usb_interface_descriptor_t *id;
 
- if (umb_lookup(uaa->vendor, uaa->product) != NULL)
- return UMATCH_VENDOR_PRODUCT;
  if (!uaa->iface)
  return UMATCH_NONE;
  if ((id = usbd_get_interface_descriptor(uaa->iface)) == NULL)
  return UMATCH_NONE;
- if (id->bInterfaceClass != UICLASS_CDC ||
-    id->bInterfaceSubClass !=
-    UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL ||
-    id->bNumEndpoints != 1)
+
+ /*
+ * If this function implements NCM, check if alternate setting
+ * 1 implements MBIM.
+ */
+ if (id->bInterfaceClass == UICLASS_CDC &&
+    id->bInterfaceSubClass ==
+    UISUBCLASS_NETWORK_CONTROL_MODEL)
+ id = usbd_find_idesc(uaa->device->cdesc, uaa->ifaceno, 1);
+ if (id == NULL)
  return UMATCH_NONE;
 
- return UMATCH_DEVCLASS_DEVSUBCLASS;
+ if (id->bInterfaceClass == UICLASS_CDC &&
+    id->bInterfaceSubClass ==
+    UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL &&
+    id->bInterfaceProtocol == 0)
+ return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO;
+
+ return UMATCH_NONE;
 }
 
 void
@@ -257,45 +244,54 @@ umb_attach(struct device *parent, struct
  struct usbd_desc_iter iter;
  const usb_descriptor_t *desc;
  int v;
+ struct usb_cdc_union_descriptor *ud;
  struct mbim_descriptor *md;
  int i;
- struct usbd_interface *ctrl_iface = NULL;
  int ctrl_ep;
- uint8_t data_ifaceno;
  usb_interface_descriptor_t *id;
  usb_config_descriptor_t *cd;
  usb_endpoint_descriptor_t *ed;
+ usb_interface_assoc_descriptor_t *ad;
+ int current_ifaceno = -1;
+ int data_ifaceno = -1;
  int altnum;
  int s;
  struct ifnet *ifp;
  int hard_mtu;
 
  sc->sc_udev = uaa->device;
+ sc->sc_ctrl_ifaceno = uaa->ifaceno;
 
- if (uaa->configno < 0) {
- /*
- * In case the device was matched by VID/PID instead of
- * InterfaceClass/InterfaceSubClass, we have to pick the
- * correct configuration ourself.
- */
- uaa->configno = umb_lookup(uaa->vendor, uaa->product)->confno;
- DPRINTF("%s: switching to config #%d\n", DEVNAM(sc),
-    uaa->configno);
- status = usbd_set_config_no(sc->sc_udev, uaa->configno, 1);
- if (status) {
- printf("%s: failed to switch to config #%d: %s\n",
-    DEVNAM(sc), uaa->configno, usbd_errstr(status));
- goto fail;
- }
- }
-
+ /*
+ * Some MBIM hardware does not provide the mandatory CDC Union
+ * Descriptor, so we also look at matching Interface
+ * Association Descriptors to find out the MBIM Data Interface
+ * number.
+ */
  sc->sc_ver_maj = sc->sc_ver_min = -1;
- usbd_desc_iter_init(sc->sc_udev, &iter);
  hard_mtu = MBIM_MAXSEGSZ_MINVAL;
+ usbd_desc_iter_init(sc->sc_udev, &iter);
  while ((desc = usbd_desc_iter_next(&iter))) {
+ if (desc->bDescriptorType == UDESC_IFACE_ASSOC) {
+ ad = (usb_interface_assoc_descriptor_t *)desc;
+ if (ad->bFirstInterface == uaa->ifaceno &&
+    ad->bInterfaceCount > 1)
+ data_ifaceno = uaa->ifaceno + 1;
+ }
+ if (desc->bDescriptorType == UDESC_INTERFACE) {
+ id = (usb_interface_descriptor_t *)desc;
+ current_ifaceno = id->bInterfaceNumber;
+ continue;
+ }
+ if (current_ifaceno != uaa->ifaceno)
+ continue;
  if (desc->bDescriptorType != UDESC_CS_INTERFACE)
  continue;
  switch (desc->bDescriptorSubtype) {
+ case UDESCSUB_CDC_UNION:
+ ud = (struct usb_cdc_union_descriptor *)desc;
+ data_ifaceno = ud->bSlaveInterface[0];
+ break;
  case UDESCSUB_MBIM:
  md = (struct mbim_descriptor *)desc;
  v = UGETW(md->bcdMBIMVersion);
@@ -332,39 +328,29 @@ umb_attach(struct device *parent, struct
  goto fail;
  }
 
- for (i = 0; i < sc->sc_udev->cdesc->bNumInterface; i++) {
- if (usbd_iface_claimed(sc->sc_udev, i))
- continue;
- id = usbd_get_interface_descriptor(&sc->sc_udev->ifaces[i]);
- if (id == NULL)
- continue;
- if (id->bInterfaceClass == UICLASS_CDC &&
-    id->bInterfaceSubClass ==
-    UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL) {
- ctrl_iface = &sc->sc_udev->ifaces[i];
- sc->sc_ctrl_ifaceno = id->bInterfaceNumber;
- usbd_claim_iface(sc->sc_udev, i);
- } else if (id->bInterfaceClass == UICLASS_CDC_DATA &&
-    id->bInterfaceSubClass == UISUBCLASS_DATA &&
-    id->bInterfaceProtocol == UIPROTO_DATA_MBIM) {
- sc->sc_data_iface = &sc->sc_udev->ifaces[i];
- data_ifaceno = id->bInterfaceNumber;
- usbd_claim_iface(sc->sc_udev, i);
- }
- }
- if (ctrl_iface == NULL) {
- printf("%s: no control interface found\n", DEVNAM(sc));
- goto fail;
- }
- if (sc->sc_data_iface == NULL) {
+ if (data_ifaceno < 0 || data_ifaceno >= uaa->nifaces) {
  printf("%s: no data interface found\n", DEVNAM(sc));
  goto fail;
  }
+ sc->sc_data_iface = uaa->ifaces[data_ifaceno];
 
- id = usbd_get_interface_descriptor(ctrl_iface);
+ usbd_claim_iface(sc->sc_udev, uaa->ifaceno);
+ usbd_claim_iface(sc->sc_udev, data_ifaceno);
+
+ /*
+ * If this is a combined NCM/MBIM function, switch to
+ * alternate setting one to enable MBIM.
+ */
+ id = usbd_get_interface_descriptor(uaa->iface);
+ if (id->bInterfaceClass == UICLASS_CDC &&
+    id->bInterfaceSubClass ==
+    UISUBCLASS_NETWORK_CONTROL_MODEL)
+ usbd_set_interface(uaa->iface, 1);
+
+ id = usbd_get_interface_descriptor(uaa->iface);
  ctrl_ep = -1;
  for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) {
- ed = usbd_interface2endpoint_descriptor(ctrl_iface, i);
+ ed = usbd_interface2endpoint_descriptor(uaa->iface, i);
  if (ed == NULL)
  break;
  if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT &&
@@ -376,23 +362,38 @@ umb_attach(struct device *parent, struct
  goto fail;
  }
 
+ /*
+ * For the MBIM Data Interface, select the appropriate
+ * alternate setting by looking for a matching descriptor that
+ * has two endpoints.
+ */
  cd = usbd_get_config_descriptor(sc->sc_udev);
- id = usbd_get_interface_descriptor(sc->sc_data_iface);
- altnum = usbd_get_no_alts(cd, id->bInterfaceNumber);
- if (MBIM_INTERFACE_ALTSETTING >= altnum) {
- printf("%s: missing alt setting %d for interface #%d\n",
-    DEVNAM(sc), MBIM_INTERFACE_ALTSETTING, data_ifaceno);
+ altnum = usbd_get_no_alts(cd, data_ifaceno);
+ for (i = 0; i < altnum; i++) {
+ id = usbd_find_idesc(cd, data_ifaceno, i);
+ if (id == NULL)
+ continue;
+ if (id->bInterfaceClass == UICLASS_CDC_DATA &&
+    id->bInterfaceSubClass == UISUBCLASS_DATA &&
+    id->bInterfaceProtocol == UIPROTO_DATA_MBIM &&
+    id->bNumEndpoints == 2)
+ break;
+ }
+ if (i == altnum || id == NULL) {
+ printf("%s: missing alt setting for interface #%d\n",
+    DEVNAM(sc), data_ifaceno);
  goto fail;
  }
- sc->sc_rx_ep = sc->sc_tx_ep = -1;
- if ((status = usbd_set_interface(sc->sc_data_iface,
-    MBIM_INTERFACE_ALTSETTING))) {
+ status = usbd_set_interface(sc->sc_data_iface, i);
+ if (status) {
  printf("%s: select alt setting %d for interface #%d "
-    "failed: %s\n", DEVNAM(sc), MBIM_INTERFACE_ALTSETTING,
-    data_ifaceno, usbd_errstr(status));
+    "failed: %s\n", DEVNAM(sc), i, data_ifaceno,
+    usbd_errstr(status));
  goto fail;
  }
+
  id = usbd_get_interface_descriptor(sc->sc_data_iface);
+ sc->sc_rx_ep = sc->sc_tx_ep = -1;
  for (i = 0; i < id->bNumEndpoints; i++) {
  if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface,
     i)) == NULL)
@@ -420,7 +421,7 @@ umb_attach(struct device *parent, struct
     USB_TASK_TYPE_GENERIC);
  timeout_set(&sc->sc_statechg_timer, umb_statechg_timeout, sc);
 
- if (usbd_open_pipe_intr(ctrl_iface, ctrl_ep, USBD_SHORT_XFER_OK,
+ if (usbd_open_pipe_intr(uaa->iface, ctrl_ep, USBD_SHORT_XFER_OK,
     &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof (sc->sc_intr_msg),
     umb_intr, USBD_DEFAULT_INTERVAL)) {
  printf("%s: failed to open control pipe\n", DEVNAM(sc));

Reply | Threaded
Open this post in threaded view
|

Re: umb(4) attachment

Marcus MERIGHI
Hello,

the kernel does not compile for me with this patch.

src/sys/dev/usb/usb.h is missing UISUBCLASS_NETWORK_CONTROL_MODEL.

What value does it need?

(I get no umb(4) device with a value of 15. Am I supposed to get one
with this hardware and the correct value?)

One OT GPS question below, lsusb -v + dmesg as well.

[hidden email] (Mark Kettenis), 2016.06.17 (Fri) 22:22 (CEST):

> As reported earlier, umb(4) currently doesn't attach to devices that
> implement both NCM 1.0 and MBIM, such as the Sierra Wireless EM7345
> that is found in some thinkpads.
>
> The diff below fixes this.  It revamps the way we look up interface
> descriptors quite a bit.  I removed the unused code for matching
> devices based on vendor and product ids.  That code got a bit in my
> way.  It should be possible to bring that back if needed.
>
> With this fix, the EM7345 attaches as:
>
> umb0 at uhub0 port 4 configuration 1 interface 0 "Sierra Wireless Inc. Sierra Wi
> reless EM7345 4G LTE" rev 2.00/17.29 addr 2
> umb0: ignoring invalid segment size 1500
> umb0: vers 1.0
> umodem0 at uhub0 port 4 configuration 1 interface 2 "Sierra Wireless Inc. Sierra Wireless EM7345 4G LTE" rev 2.00/17.29 addr 2
> umodem0: data interface 3, has no CM over data, has break
> umodem0: status change notification available
> ucom0 at umodem0
>
> Note that it still attaches as umodem(4) as well.  That is actually a
> good thing since it allows me to read out the GPS though that interface.

My /dev/cuaU? all respond to at -> OK. How do you get the GPS data?

> I believe this code should work on all devices that are properly MBIM
> compliant.  But of course vendors are notoriously sloppy in providing
> the right usb interface descriptors for their devices.  So testing is
> welcome.  If you run into issues, please provide lsusb -v output.


Bus 000 Device 001: ID 8086:0000 Intel Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            9 Hub
  bDeviceSubClass         0 Unused
  bDeviceProtocol         1 Single TT
  bMaxPacketSize0        64
  idVendor           0x8086 Intel Corp.
  idProduct          0x0000
  bcdDevice            1.00
  iManufacturer           1 Intel
  iProduct                2 EHCI root hub
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           25
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0x40
      (Missing must-be-set bit!)
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         9 Hub
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 Full speed (or root) hub
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval              12
Hub Descriptor:
  bLength              10
  bDescriptorType      41
  nNbrPorts             3
  wHubCharacteristic 0x0002
    No power switching (usb 1.0)
    Ganged overcurrent protection
    TT think time 8 FS bits
  bPwrOn2PwrGood      200 * 2 milli seconds
  bHubContrCurrent      0 milli Ampere
  DeviceRemovable    0x00
  PortPwrCtrlMask    0x00
 Hub Port Status:
   Port 1: 0000.0503 highspeed power enable connect
   Port 2: 0000.0500 highspeed power
   Port 3: 0000.0500 highspeed power
Device Status:     0x0001
  Self Powered

Bus 000 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            9 Hub
  bDeviceSubClass         0 Unused
  bDeviceProtocol         1 Single TT
  bMaxPacketSize0        64
  idVendor           0x8087 Intel Corp.
  idProduct          0x0024 Integrated Rate Matching Hub
  bcdDevice            0.00
  iManufacturer           0
  iProduct                0
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           25
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         9 Hub
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 Full speed (or root) hub
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0001  1x 1 bytes
        bInterval              12
Hub Descriptor:
  bLength               9
  bDescriptorType      41
  nNbrPorts             6
  wHubCharacteristic 0x0009
    Per-port power switching
    Per-port overcurrent protection
    TT think time 8 FS bits
  bPwrOn2PwrGood       50 * 2 milli seconds
  bHubContrCurrent      0 milli Ampere
  DeviceRemovable    0x00
  PortPwrCtrlMask    0xff
 Hub Port Status:
   Port 1: 0000.0100 power
   Port 2: 0000.0100 power
   Port 3: 0000.0100 power
   Port 4: 0000.0100 power
   Port 5: 0000.0100 power
   Port 6: 0000.0100 power
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            9 Hub
  bDeviceSubClass         0 Unused
  bDeviceProtocol         0 Full speed (or root) hub
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered

Bus 001 Device 001: ID 1033:0000 Nucam Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               3.00
  bDeviceClass            9 Hub
  bDeviceSubClass         0 Unused
  bDeviceProtocol         1 Single TT
  bMaxPacketSize0         9
  idVendor           0x1033 Nucam Corp.
  idProduct          0x0000
  bcdDevice            1.00
  iManufacturer           1 NEC
  iProduct                2 xHCI root hub
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           25
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0x40
      (Missing must-be-set bit!)
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         9 Hub
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 Full speed (or root) hub
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0002  1x 2 bytes
        bInterval             255
Hub Descriptor:
  bLength              13
  bDescriptorType      42
  nNbrPorts             4
  wHubCharacteristic 0x0001
    Per-port power switching
    Ganged overcurrent protection
    TT think time 8 FS bits
  bPwrOn2PwrGood       10 * 2 milli seconds
  bHubContrCurrent      0 milli Ampere
  DeviceRemovable    0x00
  PortPwrCtrlMask    0x00
 Hub Port Status:
   Port 1: 0000.02a0 5Gbps power Rx.Detect
   Port 2: 0000.02a0 5Gbps power Rx.Detect
   Port 3: 0000.02a0 5Gbps power Rx.Detect
   Port 4: 0000.02a0 5Gbps power Rx.Detect
Device Status:     0x0001
  Self Powered

Bus 002 Device 001: ID 8086:0000 Intel Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            9 Hub
  bDeviceSubClass         0 Unused
  bDeviceProtocol         1 Single TT
  bMaxPacketSize0        64
  idVendor           0x8086 Intel Corp.
  idProduct          0x0000
  bcdDevice            1.00
  iManufacturer           1 Intel
  iProduct                2 EHCI root hub
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           25
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0x40
      (Missing must-be-set bit!)
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         9 Hub
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 Full speed (or root) hub
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval              12
Hub Descriptor:
  bLength              10
  bDescriptorType      41
  nNbrPorts             3
  wHubCharacteristic 0x0002
    No power switching (usb 1.0)
    Ganged overcurrent protection
    TT think time 8 FS bits
  bPwrOn2PwrGood      200 * 2 milli seconds
  bHubContrCurrent      0 milli Ampere
  DeviceRemovable    0x00
  PortPwrCtrlMask    0x00
 Hub Port Status:
   Port 1: 0000.0503 highspeed power enable connect
   Port 2: 0000.0500 highspeed power
   Port 3: 0000.0500 highspeed power
Device Status:     0x0001
  Self Powered

Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            9 Hub
  bDeviceSubClass         0 Unused
  bDeviceProtocol         1 Single TT
  bMaxPacketSize0        64
  idVendor           0x8087 Intel Corp.
  idProduct          0x0024 Integrated Rate Matching Hub
  bcdDevice            0.00
  iManufacturer           0
  iProduct                0
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           25
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         9 Hub
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 Full speed (or root) hub
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0002  1x 2 bytes
        bInterval              12
Hub Descriptor:
  bLength              11
  bDescriptorType      41
  nNbrPorts             8
  wHubCharacteristic 0x0009
    Per-port power switching
    Per-port overcurrent protection
    TT think time 8 FS bits
  bPwrOn2PwrGood       50 * 2 milli seconds
  bHubContrCurrent      0 milli Ampere
  DeviceRemovable    0x00 0x00
  PortPwrCtrlMask    0xff 0xff
 Hub Port Status:
   Port 1: 0000.0100 power
   Port 2: 0000.0100 power
   Port 3: 0000.0100 power
   Port 4: 0000.0503 highspeed power enable connect
   Port 5: 0000.0100 power
   Port 6: 0000.0100 power
   Port 7: 0000.0100 power
   Port 8: 0000.0100 power
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            9 Hub
  bDeviceSubClass         0 Unused
  bDeviceProtocol         0 Full speed (or root) hub
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered

Bus 002 Device 003: ID 0bdb:1911 Ericsson Business Mobile Networks BV
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            2 Communications
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0bdb Ericsson Business Mobile Networks BV
  idProduct          0x1911
  bcdDevice            0.00
  iManufacturer           1 Lenovo
  iProduct                2 F5521gw
  iSerial                 3 D445990E94347800
  bNumConfigurations      3
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          371
    bNumInterfaces         11
    bConfigurationValue     1
    iConfiguration          4 WMC Device with GPS
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass         2 Communications
      bInterfaceSubClass      8 Wireless Handset Control
      bInterfaceProtocol      0
      iInterface              5 F5521gw Mobile Broadband Device
      CDC Header:
        bcdCDC               1.10
      CDC WHCM:
        bcdVersion           1.00
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1 2 3 4 5 6 7 8 9 10
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              6 F5521gw Mobile Broadband Modem
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        1
        bSlaveInterface         2
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          2
      CDC ACM:
        bmCapabilities       0x07
          sends break
          line coding and serial state
          get/set/clear comm features
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x8a  EP 10 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              7 F5521gw Mobile Broadband Modem
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              8 F5521gw Mobile Broadband Data Modem
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        3
        bSlaveInterface         4
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          4
      CDC ACM:
        bmCapabilities       0x07
          sends break
          line coding and serial state
          get/set/clear comm features
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              9 F5521gw Mobile Broadband Data Modem
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        5
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      9 Device Management
      bInterfaceProtocol      1
      iInterface             10 F5521gw Mobile Broadband Device Management
      CDC Header:
        bcdCDC               1.10
      CDC Device Management:
        bcdVersion           1.00
        wMaxCommand          2048
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x88  EP 8 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        6
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass     13
      bInterfaceProtocol      0
      iInterface             11 F5521gw Mobile Broadband Network Adapter
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        6
        bSlaveInterface         7
      CDC Ethernet:
        iMacAddress                     12 028037EC0200
        bmEthernetStatistics    0x00000000
        wMaxSegmentSize               1514
        wNumberMCFilters            0x8040
        bNumberPowerFilters              1
      CDC NCM:
        bcdNcmVersion        1.00
        bmNetworkCapabilities 0x1b
          crc mode
          max datagram size
          net address
          packet filter
      CDC Command Set:
        bcdVersion           1.00
        iCommandSet            13 S_NCM_CMD_FUNC
        bGUID                {2e23bbae-c188-11df-bcdc-d9c6dfd72085}
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               7
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface             14 F5521gw Mobile Broadband Network Adapter
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       1
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      1
      iInterface             15 F5521gw Mobile Broadband Network Adapter
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        8
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      9 Device Management
      bInterfaceProtocol      1
      iInterface             16 F5521gw Mobile Broadband USIM Port
      CDC Header:
        bcdCDC               1.10
      CDC Device Management:
        bcdVersion           1.00
        wMaxCommand          2048
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        9
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface             17 F5521gw Mobile Broadband GPS Port
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        9
        bSlaveInterface         10
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          10
      CDC ACM:
        bmCapabilities       0x07
          sends break
          line coding and serial state
          get/set/clear comm features
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber       10
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface             18 F5521gw Mobile Broadband GPS Port
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          311
    bNumInterfaces          9
    bConfigurationValue     2
    iConfiguration         19 WMC Device
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass         2 Communications
      bInterfaceSubClass      8 Wireless Handset Control
      bInterfaceProtocol      0
      iInterface              5 F5521gw Mobile Broadband Device
      CDC Header:
        bcdCDC               1.10
      CDC WHCM:
        bcdVersion           1.00
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1 2 3 4 5 6 7 8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              6 F5521gw Mobile Broadband Modem
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        1
        bSlaveInterface         2
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          2
      CDC ACM:
        bmCapabilities       0x07
          sends break
          line coding and serial state
          get/set/clear comm features
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x8a  EP 10 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              7 F5521gw Mobile Broadband Modem
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              8 F5521gw Mobile Broadband Data Modem
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        3
        bSlaveInterface         4
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          4
      CDC ACM:
        bmCapabilities       0x07
          sends break
          line coding and serial state
          get/set/clear comm features
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              9 F5521gw Mobile Broadband Data Modem
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        5
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      9 Device Management
      bInterfaceProtocol      1
      iInterface             10 F5521gw Mobile Broadband Device Management
      CDC Header:
        bcdCDC               1.10
      CDC Device Management:
        bcdVersion           1.00
        wMaxCommand          2048
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x88  EP 8 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        6
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass     13
      bInterfaceProtocol      0
      iInterface             11 F5521gw Mobile Broadband Network Adapter
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        6
        bSlaveInterface         7
      CDC Ethernet:
        iMacAddress                     12 028037EC0200
        bmEthernetStatistics    0x00000000
        wMaxSegmentSize               1514
        wNumberMCFilters            0x8040
        bNumberPowerFilters              1
      CDC NCM:
        bcdNcmVersion        1.00
        bmNetworkCapabilities 0x1b
          crc mode
          max datagram size
          net address
          packet filter
      CDC Command Set:
        bcdVersion           1.00
        iCommandSet            13 S_NCM_CMD_FUNC
        bGUID                {2e23bbae-c188-11df-bcdc-d9c6dfd72085}
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               7
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface             14 F5521gw Mobile Broadband Network Adapter
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       1
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      1
      iInterface             15 F5521gw Mobile Broadband Network Adapter
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        8
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      9 Device Management
      bInterfaceProtocol      1
      iInterface             16 F5521gw Mobile Broadband USIM Port
      CDC Header:
        bcdCDC               1.10
      CDC Device Management:
        bcdVersion           1.00
        wMaxCommand          2048
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               8
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     3
    iConfiguration         20 MSC AutoInstall Device
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface             21 ST-Ericsson CD-ROM
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            2 Communications
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      3
Device Status:     0x0000
  (Bus Powered)


OpenBSD 6.0-beta (GENERIC.MP) #17: Sat Jun 18 15:03:35 CEST 2016
    xx@yy:/usr/src/sys/arch/amd64/compile/GENERIC.MP
RTC BIOS diagnostic error 80<clock_battery>
real mem = 8451125248 (8059MB)
avail mem = 8190476288 (7811MB)
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.6 @ 0xdae9c000 (64 entries)
bios0: vendor LENOVO version "8DET72WW (1.42 )" date 02/18/2016
bios0: LENOVO 4291QQ1
acpi0 at bios0: rev 2
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP SLIC SSDT SSDT SSDT HPET APIC MCFG ECDT ASF! TCPA SSDT SSDT DMAR UEFI UEFI UEFI
acpi0: wakeup devices LID_(S3) SLPB(S3) IGBE(S4) EXP4(S4) EXP7(S4) EHC1(S3) EHC2(S3) HDEF(S4)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpihpet0 at acpi0: 14318179 Hz
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Core(TM) i7-2620M CPU @ 2.70GHz, 2691.67 MHz
cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,POPCNT,DEADLINE,AES,XSAVE,AVX,NXE,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu0: 256KB 64b/line 8-way L2 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
cpu0: apic clock running at 99MHz
cpu0: mwait min=64, max=64, C-substates=0.2.1.1.2, IBE
cpu1 at mainbus0: apid 1 (application processor)
cpu1: Intel(R) Core(TM) i7-2620M CPU @ 2.70GHz, 2691.26 MHz
cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,POPCNT,DEADLINE,AES,XSAVE,AVX,NXE,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu1: 256KB 64b/line 8-way L2 cache
cpu1: smt 1, core 0, package 0
cpu2 at mainbus0: apid 2 (application processor)
cpu2: Intel(R) Core(TM) i7-2620M CPU @ 2.70GHz, 2691.26 MHz
cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,POPCNT,DEADLINE,AES,XSAVE,AVX,NXE,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu2: 256KB 64b/line 8-way L2 cache
cpu2: smt 0, core 1, package 0
cpu3 at mainbus0: apid 3 (application processor)
cpu3: Intel(R) Core(TM) i7-2620M CPU @ 2.70GHz, 2691.26 MHz
cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,POPCNT,DEADLINE,AES,XSAVE,AVX,NXE,LONG,LAHF,PERF,ITSC,SENSOR,ARAT
cpu3: 256KB 64b/line 8-way L2 cache
cpu3: smt 1, core 1, package 0
ioapic0 at mainbus0: apid 2 pa 0xfec00000, version 20, 24 pins
acpimcfg0 at acpi0 addr 0xf8000000, bus 0-63
acpiec0 at acpi0
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus -1 (PEG_)
acpiprt2 at acpi0: bus 2 (EXP1)
acpiprt3 at acpi0: bus 3 (EXP2)
acpiprt4 at acpi0: bus 5 (EXP4)
acpiprt5 at acpi0: bus 13 (EXP5)
acpiprt6 at acpi0: bus 14 (EXP7)
acpicpu0 at acpi0: C3(350@104 io@0x415), C1(1000@1 halt), PSS
acpicpu1 at acpi0: C3(350@104 io@0x415), C1(1000@1 halt), PSS
acpicpu2 at acpi0: C3(350@104 io@0x415), C1(1000@1 halt), PSS
acpicpu3 at acpi0: C3(350@104 io@0x415), C1(1000@1 halt), PSS
acpipwrres0 at acpi0: PUBS, resource for EHC1, EHC2
acpitz0 at acpi0: critical temperature is 99 degC
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
"PNP0303" at acpi0 not configured
"LEN0020" at acpi0 not configured
acpibat0 at acpi0: BAT0 model "45N1172" serial 13541 type LION oem "SANYO"
acpiac0 at acpi0: AC unit online
acpithinkpad0 at acpi0
"PNP0C14" at acpi0 not configured
"PNP0C14" at acpi0 not configured
acpidock0 at acpi0: GDCK not docked (0)
acpivideo0 at acpi0: VID_
acpivout at acpivideo0 not configured
acpivideo1 at acpi0: VID_
cpu0: Enhanced SpeedStep 2691 MHz: speeds: 2701, 2700, 2400, 2200, 2000, 1800, 1600, 1400, 1200, 1000, 800 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel Core 2G Host" rev 0x09
inteldrm0 at pci0 dev 2 function 0 "Intel HD Graphics 3000" rev 0x09
drm0 at inteldrm0
inteldrm0: msi
inteldrm0: 1366x768
wsdisplay0 at inteldrm0 mux 1: console (std, vt100 emulation)
wsdisplay0: screen 1-5 added (std, vt100 emulation)
"Intel 6 Series MEI" rev 0x04 at pci0 dev 22 function 0 not configured
em0 at pci0 dev 25 function 0 "Intel 82579LM" rev 0x04: msi, address f0:de:f1:8f:84:ac
ehci0 at pci0 dev 26 function 0 "Intel 6 Series USB" rev 0x04: apic 2 int 16
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
azalia0 at pci0 dev 27 function 0 "Intel 6 Series HD Audio" rev 0x04: msi
azalia0: codecs: Conexant CX20590, Intel/0x2805, using Conexant CX20590
audio0 at azalia0
ppb0 at pci0 dev 28 function 0 "Intel 6 Series PCIE" rev 0xb4: msi
pci1 at ppb0 bus 2
ppb1 at pci0 dev 28 function 1 "Intel 6 Series PCIE" rev 0xb4: msi
pci2 at ppb1 bus 3
iwn0 at pci2 dev 0 function 0 "Intel Centrino Ultimate-N 6300" rev 0x35: msi, MIMO 3T3R, MoW, address 00:24:d7:f0:ea:90
ppb2 at pci0 dev 28 function 3 "Intel 6 Series PCIE" rev 0xb4: msi
pci3 at ppb2 bus 5
ppb3 at pci0 dev 28 function 4 "Intel 6 Series PCIE" rev 0xb4: msi
pci4 at ppb3 bus 13
sdhc0 at pci4 dev 0 function 0 "Ricoh 5U822 SD/MMC" rev 0x07: apic 2 int 16
sdhc0: SDHC 3.0, 50 MHz base clock
sdmmc0 at sdhc0: 4-bit, sd high-speed, mmc high-speed, dma
ppb4 at pci0 dev 28 function 6 "Intel 6 Series PCIE" rev 0xb4: msi
pci5 at ppb4 bus 14
xhci0 at pci5 dev 0 function 0 "NEC xHCI" rev 0x04: msi
usb1 at xhci0: USB revision 3.0
uhub1 at usb1 "NEC xHCI root hub" rev 3.00/1.00 addr 1
ehci1 at pci0 dev 29 function 0 "Intel 6 Series USB" rev 0x04: apic 2 int 23
usb2 at ehci1: USB revision 2.0
uhub2 at usb2 "Intel EHCI root hub" rev 2.00/1.00 addr 1
pcib0 at pci0 dev 31 function 0 "Intel QM67 LPC" rev 0x04
ahci0 at pci0 dev 31 function 2 "Intel 6 Series AHCI" rev 0x04: msi, AHCI 1.3
ahci0: port 0: 6.0Gb/s
scsibus1 at ahci0: 32 targets
sd0 at scsibus1 targ 0 lun 0: <ATA, SanDisk SDSSDHII, X312> SCSI3 0/direct fixed naa.5001b44e1d7ef244
sd0: 228936MB, 512 bytes/sector, 468862128 sectors, thin
ichiic0 at pci0 dev 31 function 3 "Intel 6 Series SMBus" rev 0x04: apic 2 int 18
iic0 at ichiic0
spdmem0 at iic0 addr 0x50: 4GB DDR3 SDRAM PC3-12800 SO-DIMM
spdmem1 at iic0 addr 0x51: 4GB DDR3 SDRAM PC3-12800 SO-DIMM
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pms0 at pckbc0 (aux slot)
wsmouse0 at pms0 mux 0
wsmouse1 at pms0 mux 0
pms0: Synaptics clickpad, firmware 8.0
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
aps0 at isa0 port 0x1600/31
uhub3 at uhub0 port 1 "Intel Rate Matching Hub" rev 2.00/0.00 addr 2
uhub4 at uhub2 port 1 "Intel Rate Matching Hub" rev 2.00/0.00 addr 2
umodem0 at uhub4 port 4 configuration 1 interface 1 "Lenovo F5521gw" rev 2.00/0.00 addr 3
umodem0: data interface 2, has CM over data, has break
umodem0: status change notification available
ucom0 at umodem0
umodem1 at uhub4 port 4 configuration 1 interface 3 "Lenovo F5521gw" rev 2.00/0.00 addr 3
umodem1: data interface 4, has CM over data, has break
umodem1: status change notification available
ucom1 at umodem1
umodem2 at uhub4 port 4 configuration 1 interface 9 "Lenovo F5521gw" rev 2.00/0.00 addr 3
umodem2: data interface 10, has CM over data, has break
umodem2: status change notification available
ucom2 at umodem2
ugen0 at uhub4 port 4 configuration 1 "Lenovo F5521gw" rev 2.00/0.00 addr 3
vscsi0 at root
scsibus2 at vscsi0: 256 targets
softraid0 at root
scsibus3 at softraid0: 256 targets
root on sd0a (ba2fda317d02edc5.a) swap on sd0b dump on sd0b
sd1 at scsibus3 targ 1 lun 0: <OPENBSD, SR CRYPTO, 006> SCSI2 0/direct fixed
sd1: 207103MB, 512 bytes/sector, 424147633 sectors

Thanks, Marcus

>
> Index: if_umb.c
> ===================================================================
> RCS file: /cvs/src/sys/dev/usb/if_umb.c,v
> retrieving revision 1.1
> diff -u -p -r1.1 if_umb.c
> --- if_umb.c 15 Jun 2016 19:39:34 -0000 1.1
> +++ if_umb.c 17 Jun 2016 20:08:05 -0000
> @@ -204,48 +204,35 @@ const struct cfattach umb_ca = {
>  
>  int umb_delay = 4000;
>  
> -/*
> - * Normally, MBIM devices are detected by their interface class and subclass.
> - * But for some models that have multiple configurations, it is better to
> - * match by vendor and product id so that we can select the desired
> - * configuration ourselves.
> - *
> - * OTOH, some devices identifiy themself als an MBIM device but fail to speak
> - * the MBIM protocol.
> - */
> -struct umb_products {
> - struct usb_devno dev;
> - int confno;
> -};
> -const struct umb_products umb_devs[] = {
> - /*
> - * Add devices here to force them to attach as umb.
> - * Format: { { VID, PID }, CONFIGNO }
> - */
> -};
> -
> -#define umb_lookup(vid, pid) \
> - ((const struct umb_products *)usb_lookup(umb_devs, vid, pid))
> -
>  int
>  umb_match(struct device *parent, void *match, void *aux)
>  {
>   struct usb_attach_arg *uaa = aux;
>   usb_interface_descriptor_t *id;
>  
> - if (umb_lookup(uaa->vendor, uaa->product) != NULL)
> - return UMATCH_VENDOR_PRODUCT;
>   if (!uaa->iface)
>   return UMATCH_NONE;
>   if ((id = usbd_get_interface_descriptor(uaa->iface)) == NULL)
>   return UMATCH_NONE;
> - if (id->bInterfaceClass != UICLASS_CDC ||
> -    id->bInterfaceSubClass !=
> -    UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL ||
> -    id->bNumEndpoints != 1)
> +
> + /*
> + * If this function implements NCM, check if alternate setting
> + * 1 implements MBIM.
> + */
> + if (id->bInterfaceClass == UICLASS_CDC &&
> +    id->bInterfaceSubClass ==
> +    UISUBCLASS_NETWORK_CONTROL_MODEL)
> + id = usbd_find_idesc(uaa->device->cdesc, uaa->ifaceno, 1);
> + if (id == NULL)
>   return UMATCH_NONE;
>  
> - return UMATCH_DEVCLASS_DEVSUBCLASS;
> + if (id->bInterfaceClass == UICLASS_CDC &&
> +    id->bInterfaceSubClass ==
> +    UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL &&
> +    id->bInterfaceProtocol == 0)
> + return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO;
> +
> + return UMATCH_NONE;
>  }
>  
>  void
> @@ -257,45 +244,54 @@ umb_attach(struct device *parent, struct
>   struct usbd_desc_iter iter;
>   const usb_descriptor_t *desc;
>   int v;
> + struct usb_cdc_union_descriptor *ud;
>   struct mbim_descriptor *md;
>   int i;
> - struct usbd_interface *ctrl_iface = NULL;
>   int ctrl_ep;
> - uint8_t data_ifaceno;
>   usb_interface_descriptor_t *id;
>   usb_config_descriptor_t *cd;
>   usb_endpoint_descriptor_t *ed;
> + usb_interface_assoc_descriptor_t *ad;
> + int current_ifaceno = -1;
> + int data_ifaceno = -1;
>   int altnum;
>   int s;
>   struct ifnet *ifp;
>   int hard_mtu;
>  
>   sc->sc_udev = uaa->device;
> + sc->sc_ctrl_ifaceno = uaa->ifaceno;
>  
> - if (uaa->configno < 0) {
> - /*
> - * In case the device was matched by VID/PID instead of
> - * InterfaceClass/InterfaceSubClass, we have to pick the
> - * correct configuration ourself.
> - */
> - uaa->configno = umb_lookup(uaa->vendor, uaa->product)->confno;
> - DPRINTF("%s: switching to config #%d\n", DEVNAM(sc),
> -    uaa->configno);
> - status = usbd_set_config_no(sc->sc_udev, uaa->configno, 1);
> - if (status) {
> - printf("%s: failed to switch to config #%d: %s\n",
> -    DEVNAM(sc), uaa->configno, usbd_errstr(status));
> - goto fail;
> - }
> - }
> -
> + /*
> + * Some MBIM hardware does not provide the mandatory CDC Union
> + * Descriptor, so we also look at matching Interface
> + * Association Descriptors to find out the MBIM Data Interface
> + * number.
> + */
>   sc->sc_ver_maj = sc->sc_ver_min = -1;
> - usbd_desc_iter_init(sc->sc_udev, &iter);
>   hard_mtu = MBIM_MAXSEGSZ_MINVAL;
> + usbd_desc_iter_init(sc->sc_udev, &iter);
>   while ((desc = usbd_desc_iter_next(&iter))) {
> + if (desc->bDescriptorType == UDESC_IFACE_ASSOC) {
> + ad = (usb_interface_assoc_descriptor_t *)desc;
> + if (ad->bFirstInterface == uaa->ifaceno &&
> +    ad->bInterfaceCount > 1)
> + data_ifaceno = uaa->ifaceno + 1;
> + }
> + if (desc->bDescriptorType == UDESC_INTERFACE) {
> + id = (usb_interface_descriptor_t *)desc;
> + current_ifaceno = id->bInterfaceNumber;
> + continue;
> + }
> + if (current_ifaceno != uaa->ifaceno)
> + continue;
>   if (desc->bDescriptorType != UDESC_CS_INTERFACE)
>   continue;
>   switch (desc->bDescriptorSubtype) {
> + case UDESCSUB_CDC_UNION:
> + ud = (struct usb_cdc_union_descriptor *)desc;
> + data_ifaceno = ud->bSlaveInterface[0];
> + break;
>   case UDESCSUB_MBIM:
>   md = (struct mbim_descriptor *)desc;
>   v = UGETW(md->bcdMBIMVersion);
> @@ -332,39 +328,29 @@ umb_attach(struct device *parent, struct
>   goto fail;
>   }
>  
> - for (i = 0; i < sc->sc_udev->cdesc->bNumInterface; i++) {
> - if (usbd_iface_claimed(sc->sc_udev, i))
> - continue;
> - id = usbd_get_interface_descriptor(&sc->sc_udev->ifaces[i]);
> - if (id == NULL)
> - continue;
> - if (id->bInterfaceClass == UICLASS_CDC &&
> -    id->bInterfaceSubClass ==
> -    UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL) {
> - ctrl_iface = &sc->sc_udev->ifaces[i];
> - sc->sc_ctrl_ifaceno = id->bInterfaceNumber;
> - usbd_claim_iface(sc->sc_udev, i);
> - } else if (id->bInterfaceClass == UICLASS_CDC_DATA &&
> -    id->bInterfaceSubClass == UISUBCLASS_DATA &&
> -    id->bInterfaceProtocol == UIPROTO_DATA_MBIM) {
> - sc->sc_data_iface = &sc->sc_udev->ifaces[i];
> - data_ifaceno = id->bInterfaceNumber;
> - usbd_claim_iface(sc->sc_udev, i);
> - }
> - }
> - if (ctrl_iface == NULL) {
> - printf("%s: no control interface found\n", DEVNAM(sc));
> - goto fail;
> - }
> - if (sc->sc_data_iface == NULL) {
> + if (data_ifaceno < 0 || data_ifaceno >= uaa->nifaces) {
>   printf("%s: no data interface found\n", DEVNAM(sc));
>   goto fail;
>   }
> + sc->sc_data_iface = uaa->ifaces[data_ifaceno];
>  
> - id = usbd_get_interface_descriptor(ctrl_iface);
> + usbd_claim_iface(sc->sc_udev, uaa->ifaceno);
> + usbd_claim_iface(sc->sc_udev, data_ifaceno);
> +
> + /*
> + * If this is a combined NCM/MBIM function, switch to
> + * alternate setting one to enable MBIM.
> + */
> + id = usbd_get_interface_descriptor(uaa->iface);
> + if (id->bInterfaceClass == UICLASS_CDC &&
> +    id->bInterfaceSubClass ==
> +    UISUBCLASS_NETWORK_CONTROL_MODEL)
> + usbd_set_interface(uaa->iface, 1);
> +
> + id = usbd_get_interface_descriptor(uaa->iface);
>   ctrl_ep = -1;
>   for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) {
> - ed = usbd_interface2endpoint_descriptor(ctrl_iface, i);
> + ed = usbd_interface2endpoint_descriptor(uaa->iface, i);
>   if (ed == NULL)
>   break;
>   if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT &&
> @@ -376,23 +362,38 @@ umb_attach(struct device *parent, struct
>   goto fail;
>   }
>  
> + /*
> + * For the MBIM Data Interface, select the appropriate
> + * alternate setting by looking for a matching descriptor that
> + * has two endpoints.
> + */
>   cd = usbd_get_config_descriptor(sc->sc_udev);
> - id = usbd_get_interface_descriptor(sc->sc_data_iface);
> - altnum = usbd_get_no_alts(cd, id->bInterfaceNumber);
> - if (MBIM_INTERFACE_ALTSETTING >= altnum) {
> - printf("%s: missing alt setting %d for interface #%d\n",
> -    DEVNAM(sc), MBIM_INTERFACE_ALTSETTING, data_ifaceno);
> + altnum = usbd_get_no_alts(cd, data_ifaceno);
> + for (i = 0; i < altnum; i++) {
> + id = usbd_find_idesc(cd, data_ifaceno, i);
> + if (id == NULL)
> + continue;
> + if (id->bInterfaceClass == UICLASS_CDC_DATA &&
> +    id->bInterfaceSubClass == UISUBCLASS_DATA &&
> +    id->bInterfaceProtocol == UIPROTO_DATA_MBIM &&
> +    id->bNumEndpoints == 2)
> + break;
> + }
> + if (i == altnum || id == NULL) {
> + printf("%s: missing alt setting for interface #%d\n",
> +    DEVNAM(sc), data_ifaceno);
>   goto fail;
>   }
> - sc->sc_rx_ep = sc->sc_tx_ep = -1;
> - if ((status = usbd_set_interface(sc->sc_data_iface,
> -    MBIM_INTERFACE_ALTSETTING))) {
> + status = usbd_set_interface(sc->sc_data_iface, i);
> + if (status) {
>   printf("%s: select alt setting %d for interface #%d "
> -    "failed: %s\n", DEVNAM(sc), MBIM_INTERFACE_ALTSETTING,
> -    data_ifaceno, usbd_errstr(status));
> +    "failed: %s\n", DEVNAM(sc), i, data_ifaceno,
> +    usbd_errstr(status));
>   goto fail;
>   }
> +
>   id = usbd_get_interface_descriptor(sc->sc_data_iface);
> + sc->sc_rx_ep = sc->sc_tx_ep = -1;
>   for (i = 0; i < id->bNumEndpoints; i++) {
>   if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface,
>      i)) == NULL)
> @@ -420,7 +421,7 @@ umb_attach(struct device *parent, struct
>      USB_TASK_TYPE_GENERIC);
>   timeout_set(&sc->sc_statechg_timer, umb_statechg_timeout, sc);
>  
> - if (usbd_open_pipe_intr(ctrl_iface, ctrl_ep, USBD_SHORT_XFER_OK,
> + if (usbd_open_pipe_intr(uaa->iface, ctrl_ep, USBD_SHORT_XFER_OK,
>      &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof (sc->sc_intr_msg),
>      umb_intr, USBD_DEFAULT_INTERVAL)) {
>   printf("%s: failed to open control pipe\n", DEVNAM(sc));
>
>
> !DSPAM:57645c0c151265015712642!
>

123