USB docking station support in Linux

• Make sure you have the hotplug package, including the fxload program. On RedHat 8.0 everything should be ok (not tested). On RedHat 7.3 you need to install fxload. Download it from: http://prdownloads.sourceforge.net/linux-hotplug/
• Download the firmware rexdock.hex and save in /usr/share/usb/
• Download hotplug script rexdock and save in /etc/hotplug/usb/
• Make sure hotplug script is executable:

  chmod +x /etc/hotplug/usb/rexdock

• Add the following lines to /etc/hotplug/usb.usermap

  rexdock              0x0003      0x085a   0x802c    0x0000       0x0000       0x00         0x00            0x00            0x00            0x00               0x00               0x00000000
  rexdock              0x0003      0x085a   0x002c    0x0000       0x0000       0x00         0x00            0x00            0x00            0x00               0x00               0x00000000

• And ofcourse you need usb support in your kernel, including the usbserial module. Should be ok in any standard kernel.

If everyting is ok, the rexdock should be available at /dev/usb/ttyUSB{0,1,...} or if you are using devfs /dev/usb/tts/{0,1,...}. Check /var/log/messages if unsure. Please note that both rextools and rex are a bit unreliable. They may need to be started several times before working. However, a small test program that I have written works perfectly every time.

Techical information

The cradle is based on the AN2131SC chip from Cypress. This is an 8051 based microcontroller with USB support and 8 KB RAM. Firmware is stored in RAM, so it has to be uploaded every time the cradle is powered up. Firmware upload was already supported in Linux, either using the ezusb2131 kernel module or the userspace tool fxtool. When firmware is uploaded the cradle works using the generic serial driver (usbserial).

The problem was to find the firmware. First I tried to find it in the Windows drivers. Using a dissambler I found some 8051 code in rexsera.sys, but I could not find the start of the code. So, after wasting a lot of time with hex editors and dissassemblers, I decided to try a diffrent approach. I search the net and found a document describing how to reverse engineener a Windows usb device driver. Using the sniffusb sofware I was able to capture the firmware as it was downloaded. After analyzing the log confering the AN2131SC download protocol, I wrote a script that extracted the firmware and saved it has Intel hex file. I was then clear that the firmware is stored in rexsysa.sys, but not in a single consecutive block.

The sync button

The sync button is not supported, however this migth be not too difficult to add. The cradle has three endpoints, one bulk in (address 81), one bulk out (address 01) and one interrupt in (address 82). The bulk endpoints is the serial port, the interrupt endpoint is the button. Using the usb sniffer, I assume that polling this endpoint always returns four bytes, all zero if the button has not been pressed. If the button has been pressed the first byte is 01.