1 /* $NetBSD: if_umb.c,v 1.27 2025/08/18 20:59:55 andvar Exp $ */ 2 /* $OpenBSD: if_umb.c,v 1.20 2018/09/10 17:00:45 gerhard Exp $ */ 3 4 /* 5 * Copyright (c) 2016 genua mbH 6 * All rights reserved. 7 * 8 * Permission to use, copy, modify, and distribute this software for any 9 * purpose with or without fee is hereby granted, provided that the above 10 * copyright notice and this permission notice appear in all copies. 11 * 12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 */ 20 21 /* 22 * Mobile Broadband Interface Model specification: 23 * http://www.usb.org/developers/docs/devclass_docs/MBIM10Errata1_073013.zip 24 * Compliance testing guide 25 * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf 26 */ 27 28 #include <sys/cdefs.h> 29 __KERNEL_RCSID(0, "$NetBSD: if_umb.c,v 1.27 2025/08/18 20:59:55 andvar Exp $"); 30 31 #ifdef _KERNEL_OPT 32 #include "opt_inet.h" 33 #endif 34 35 #include <sys/param.h> 36 #include <sys/device.h> 37 #include <sys/endian.h> 38 #include <sys/kauth.h> 39 #include <sys/kernel.h> 40 #include <sys/kmem.h> 41 #include <sys/mbuf.h> 42 #include <sys/rndsource.h> 43 #include <sys/socket.h> 44 #include <sys/syslog.h> 45 #include <sys/systm.h> 46 47 #include <net/bpf.h> 48 #include <net/if.h> 49 #include <net/if_media.h> 50 #include <net/if_types.h> 51 52 #ifdef INET 53 #include <netinet/in.h> 54 #include <netinet/if_inarp.h> 55 #include <netinet/in_var.h> 56 #include <netinet/ip.h> 57 #endif 58 59 #include <dev/usb/usb.h> 60 #include <dev/usb/usbdi.h> 61 #include <dev/usb/usbdivar.h> 62 #include <dev/usb/usbdi_util.h> 63 #include <dev/usb/usbdevs.h> 64 #include <dev/usb/usbcdc.h> 65 66 #include <dev/usb/mbim.h> 67 #include <dev/usb/if_umbreg.h> 68 69 #ifdef UMB_DEBUG 70 #define DPRINTF(x...) \ 71 do { if (umb_debug) log(LOG_DEBUG, x); } while (0) 72 73 #define DPRINTFN(n, x...) \ 74 do { if (umb_debug >= (n)) log(LOG_DEBUG, x); } while (0) 75 76 #define DDUMPN(n, b, l) \ 77 do { \ 78 if (umb_debug >= (n)) \ 79 umb_dump((b), (l)); \ 80 } while (0) 81 82 int umb_debug = 0; 83 Static char *umb_uuid2str(uint8_t [MBIM_UUID_LEN]); 84 Static void umb_dump(void *, int); 85 86 #else 87 #define DPRINTF(x...) do { } while (0) 88 #define DPRINTFN(n, x...) do { } while (0) 89 #define DDUMPN(n, b, l) do { } while (0) 90 #endif 91 92 #define DEVNAM(sc) device_xname((sc)->sc_dev) 93 94 /* 95 * State change timeout 96 */ 97 #define UMB_STATE_CHANGE_TIMEOUT 30 98 99 /* 100 * State change flags 101 */ 102 #define UMB_NS_DONT_DROP 0x0001 /* do not drop below current state */ 103 #define UMB_NS_DONT_RAISE 0x0002 /* do not raise below current state */ 104 105 /* 106 * Diagnostic macros 107 */ 108 const struct umb_valdescr umb_regstates[] = MBIM_REGSTATE_DESCRIPTIONS; 109 const struct umb_valdescr umb_dataclasses[] = MBIM_DATACLASS_DESCRIPTIONS; 110 const struct umb_valdescr umb_simstate[] = MBIM_SIMSTATE_DESCRIPTIONS; 111 const struct umb_valdescr umb_messages[] = MBIM_MESSAGES_DESCRIPTIONS; 112 const struct umb_valdescr umb_status[] = MBIM_STATUS_DESCRIPTIONS; 113 const struct umb_valdescr umb_cids[] = MBIM_CID_DESCRIPTIONS; 114 const struct umb_valdescr umb_pktstate[] = MBIM_PKTSRV_STATE_DESCRIPTIONS; 115 const struct umb_valdescr umb_actstate[] = MBIM_ACTIVATION_STATE_DESCRIPTIONS; 116 const struct umb_valdescr umb_error[] = MBIM_ERROR_DESCRIPTIONS; 117 const struct umb_valdescr umb_pintype[] = MBIM_PINTYPE_DESCRIPTIONS; 118 const struct umb_valdescr umb_istate[] = UMB_INTERNAL_STATE_DESCRIPTIONS; 119 120 #define umb_regstate(c) umb_val2descr(umb_regstates, (c)) 121 #define umb_dataclass(c) umb_val2descr(umb_dataclasses, (c)) 122 #define umb_simstate(s) umb_val2descr(umb_simstate, (s)) 123 #define umb_request2str(m) umb_val2descr(umb_messages, (m)) 124 #define umb_status2str(s) umb_val2descr(umb_status, (s)) 125 #define umb_cid2str(c) umb_val2descr(umb_cids, (c)) 126 #define umb_packet_state(s) umb_val2descr(umb_pktstate, (s)) 127 #define umb_activation(s) umb_val2descr(umb_actstate, (s)) 128 #define umb_error2str(e) umb_val2descr(umb_error, (e)) 129 #define umb_pin_type(t) umb_val2descr(umb_pintype, (t)) 130 #define umb_istate(s) umb_val2descr(umb_istate, (s)) 131 132 Static int umb_match(device_t, cfdata_t, void *); 133 Static void umb_attach(device_t, device_t, void *); 134 Static int umb_detach(device_t, int); 135 Static int umb_activate(device_t, enum devact); 136 Static void umb_ncm_setup(struct umb_softc *); 137 Static int umb_alloc_xfers(struct umb_softc *); 138 Static void umb_free_xfers(struct umb_softc *); 139 Static int umb_alloc_bulkpipes(struct umb_softc *); 140 Static void umb_close_bulkpipes(struct umb_softc *); 141 Static int umb_ioctl(struct ifnet *, u_long, void *); 142 Static int umb_output(struct ifnet *, struct mbuf *, 143 const struct sockaddr *, const struct rtentry *); 144 Static void umb_input(struct ifnet *, struct mbuf *); 145 Static void umb_start(struct ifnet *); 146 Static void umb_watchdog(struct ifnet *); 147 Static void umb_statechg_timeout(void *); 148 149 Static int umb_mediachange(struct ifnet *); 150 Static void umb_mediastatus(struct ifnet *, struct ifmediareq *); 151 152 Static void umb_newstate(struct umb_softc *, enum umb_state, int); 153 Static void umb_state_task(void *); 154 Static void umb_up(struct umb_softc *); 155 Static void umb_down(struct umb_softc *, int); 156 157 Static void umb_get_response_task(void *); 158 159 Static void umb_decode_response(struct umb_softc *, void *, int); 160 Static void umb_handle_indicate_status_msg(struct umb_softc *, void *, 161 int); 162 Static void umb_handle_opendone_msg(struct umb_softc *, void *, int); 163 Static void umb_handle_closedone_msg(struct umb_softc *, void *, int); 164 Static int umb_decode_register_state(struct umb_softc *, void *, int); 165 Static int umb_decode_devices_caps(struct umb_softc *, void *, int); 166 Static int umb_decode_subscriber_status(struct umb_softc *, void *, int); 167 Static int umb_decode_radio_state(struct umb_softc *, void *, int); 168 Static int umb_decode_pin(struct umb_softc *, void *, int); 169 Static int umb_decode_packet_service(struct umb_softc *, void *, int); 170 Static int umb_decode_signal_state(struct umb_softc *, void *, int); 171 Static int umb_decode_connect_info(struct umb_softc *, void *, int); 172 Static int umb_decode_ip_configuration(struct umb_softc *, void *, int); 173 Static void umb_rx(struct umb_softc *); 174 Static void umb_rxeof(struct usbd_xfer *, void *, usbd_status); 175 Static int umb_encap(struct umb_softc *, struct mbuf *); 176 Static void umb_txeof(struct usbd_xfer *, void *, usbd_status); 177 Static void umb_decap(struct umb_softc *, struct usbd_xfer *); 178 179 Static usbd_status umb_send_encap_command(struct umb_softc *, void *, int); 180 Static int umb_get_encap_response(struct umb_softc *, void *, int *); 181 Static void umb_ctrl_msg(struct umb_softc *, uint32_t, void *, int); 182 183 Static void umb_open(struct umb_softc *); 184 Static void umb_close(struct umb_softc *); 185 186 Static int umb_setpin(struct umb_softc *, int, int, void *, int, void *, 187 int); 188 Static void umb_setdataclass(struct umb_softc *); 189 Static void umb_radio(struct umb_softc *, int); 190 Static void umb_allocate_cid(struct umb_softc *); 191 Static void umb_send_fcc_auth(struct umb_softc *); 192 Static void umb_packet_service(struct umb_softc *, int); 193 Static void umb_connect(struct umb_softc *); 194 Static void umb_disconnect(struct umb_softc *); 195 Static void umb_send_connect(struct umb_softc *, int); 196 197 Static void umb_qry_ipconfig(struct umb_softc *); 198 Static void umb_cmd(struct umb_softc *, int, int, const void *, int); 199 Static void umb_cmd1(struct umb_softc *, int, int, const void *, int, uint8_t *); 200 Static void umb_command_done(struct umb_softc *, void *, int); 201 Static void umb_decode_cid(struct umb_softc *, uint32_t, void *, int); 202 Static void umb_decode_qmi(struct umb_softc *, uint8_t *, int); 203 204 Static void umb_intr(struct usbd_xfer *, void *, usbd_status); 205 206 Static char *umb_ntop(struct sockaddr *); 207 208 Static const char * 209 inet_ntop(int af, const void *src, char *dst, socklen_t size); 210 static const char *inet_ntop4(const u_char *src, char *dst, size_t size); 211 #ifdef INET6 212 static const char *inet_ntop6(const u_char *src, char *dst, size_t size); 213 #endif /* INET6 */ 214 215 Static int umb_xfer_tout = USBD_DEFAULT_TIMEOUT; 216 217 Static uint8_t umb_uuid_basic_connect[] = MBIM_UUID_BASIC_CONNECT; 218 Static uint8_t umb_uuid_context_internet[] = MBIM_UUID_CONTEXT_INTERNET; 219 Static uint8_t umb_uuid_qmi_mbim[] = MBIM_UUID_QMI_MBIM; 220 Static uint32_t umb_session_id = 0; 221 222 CFATTACH_DECL_NEW(umb, sizeof(struct umb_softc), umb_match, umb_attach, 223 umb_detach, umb_activate); 224 225 const int umb_delay = 4000; 226 227 /* 228 * These devices require an "FCC Authentication" command. 229 */ 230 const struct usb_devno umb_fccauth_devs[] = { 231 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_EM7455 }, 232 }; 233 234 Static const uint8_t umb_qmi_alloc_cid[] = { 235 0x01, 236 0x0f, 0x00, /* len */ 237 0x00, /* QMUX flags */ 238 0x00, /* service "ctl" */ 239 0x00, /* CID */ 240 0x00, /* QMI flags */ 241 0x01, /* transaction */ 242 0x22, 0x00, /* msg "Allocate CID" */ 243 0x04, 0x00, /* TLV len */ 244 0x01, 0x01, 0x00, 0x02 /* TLV */ 245 }; 246 247 Static const uint8_t umb_qmi_fcc_auth[] = { 248 0x01, 249 0x0c, 0x00, /* len */ 250 0x00, /* QMUX flags */ 251 0x02, /* service "dms" */ 252 #define UMB_QMI_CID_OFFS 5 253 0x00, /* CID (filled in later) */ 254 0x00, /* QMI flags */ 255 0x01, 0x00, /* transaction */ 256 0x5f, 0x55, /* msg "Send FCC Authentication" */ 257 0x00, 0x00 /* TLV len */ 258 }; 259 260 Static int 261 umb_match(device_t parent, cfdata_t match, void *aux) 262 { 263 struct usbif_attach_arg *uiaa = aux; 264 usb_interface_descriptor_t *id; 265 266 if (!uiaa->uiaa_iface) 267 return UMATCH_NONE; 268 if ((id = usbd_get_interface_descriptor(uiaa->uiaa_iface)) == NULL) 269 return UMATCH_NONE; 270 271 /* 272 * If this function implements NCM, check if alternate setting 273 * 1 implements MBIM. 274 */ 275 if (id->bInterfaceClass == UICLASS_CDC && 276 id->bInterfaceSubClass == 277 UISUBCLASS_NETWORK_CONTROL_MODEL) 278 id = usbd_find_idesc(uiaa->uiaa_device->ud_cdesc, uiaa->uiaa_iface->ui_index, 1); 279 if (id == NULL) 280 return UMATCH_NONE; 281 282 if (id->bInterfaceClass == UICLASS_CDC && 283 id->bInterfaceSubClass == 284 UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL && 285 id->bInterfaceProtocol == 0) 286 return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO; 287 288 return UMATCH_NONE; 289 } 290 291 Static void 292 umb_attach(device_t parent, device_t self, void *aux) 293 { 294 struct umb_softc *sc = device_private(self); 295 struct usbif_attach_arg *uiaa = aux; 296 char *devinfop; 297 usbd_status status; 298 usbd_desc_iter_t iter; 299 const usb_descriptor_t *desc; 300 const usb_cdc_descriptor_t *csdesc; 301 int v; 302 const usb_cdc_union_descriptor_t *ud; 303 const struct mbim_descriptor *md; 304 int i; 305 int ctrl_ep; 306 const usb_interface_descriptor_t *id; 307 usb_config_descriptor_t *cd; 308 usb_endpoint_descriptor_t *ed; 309 const usb_interface_assoc_descriptor_t *ad; 310 int current_ifaceno = -1; 311 int data_ifaceno = -1; 312 int altnum; 313 int s; 314 struct ifnet *ifp; 315 316 sc->sc_dev = self; 317 sc->sc_udev = uiaa->uiaa_device; 318 319 aprint_naive("\n"); 320 aprint_normal("\n"); 321 322 devinfop = usbd_devinfo_alloc(sc->sc_udev, 0); 323 aprint_normal_dev(self, "%s\n", devinfop); 324 usbd_devinfo_free(devinfop); 325 326 sc->sc_ctrl_ifaceno = uiaa->uiaa_ifaceno; 327 328 /* 329 * Some MBIM hardware does not provide the mandatory CDC Union 330 * Descriptor, so we also look at matching Interface 331 * Association Descriptors to find out the MBIM Data Interface 332 * number. 333 */ 334 sc->sc_ver_maj = sc->sc_ver_min = -1; 335 sc->sc_maxpktlen = MBIM_MAXSEGSZ_MINVAL; 336 usb_desc_iter_init(sc->sc_udev, &iter); 337 while ((desc = usb_desc_iter_next(&iter))) { 338 if (desc->bDescriptorType == UDESC_INTERFACE_ASSOC) { 339 if (desc->bLength < sizeof(*ad)) 340 continue; 341 ad = (const usb_interface_assoc_descriptor_t *)desc; 342 if (ad->bFirstInterface == uiaa->uiaa_ifaceno && 343 ad->bInterfaceCount > 1) 344 data_ifaceno = uiaa->uiaa_ifaceno + 1; 345 continue; 346 } 347 if (desc->bDescriptorType == UDESC_INTERFACE) { 348 if (desc->bLength < sizeof(*id)) 349 continue; 350 id = (const usb_interface_descriptor_t *)desc; 351 current_ifaceno = id->bInterfaceNumber; 352 continue; 353 } 354 if (current_ifaceno != uiaa->uiaa_ifaceno) 355 continue; 356 if (desc->bDescriptorType != UDESC_CS_INTERFACE) 357 continue; 358 if (desc->bLength < sizeof(*csdesc)) 359 continue; 360 csdesc = (const usb_cdc_descriptor_t *)desc; 361 switch (csdesc->bDescriptorSubtype) { 362 case UDESCSUB_CDC_UNION: 363 if (desc->bLength < sizeof(*ud)) 364 continue; 365 ud = (const usb_cdc_union_descriptor_t *)desc; 366 data_ifaceno = ud->bSlaveInterface[0]; 367 break; 368 case UDESCSUB_MBIM: 369 if (desc->bLength < sizeof(*md)) 370 continue; 371 md = (const struct mbim_descriptor *)desc; 372 v = UGETW(md->bcdMBIMVersion); 373 sc->sc_ver_maj = MBIM_VER_MAJOR(v); 374 sc->sc_ver_min = MBIM_VER_MINOR(v); 375 sc->sc_ctrl_len = UGETW(md->wMaxControlMessage); 376 /* Never trust a USB device! Could try to exploit us */ 377 if (sc->sc_ctrl_len < MBIM_CTRLMSG_MINLEN || 378 sc->sc_ctrl_len > MBIM_CTRLMSG_MAXLEN) { 379 DPRINTF("%s: control message len %d out of " 380 "bounds [%d .. %d]\n", DEVNAM(sc), 381 sc->sc_ctrl_len, MBIM_CTRLMSG_MINLEN, 382 MBIM_CTRLMSG_MAXLEN); 383 /* cont. anyway */ 384 } 385 sc->sc_maxpktlen = UGETW(md->wMaxSegmentSize); 386 DPRINTFN(2, "%s: ctrl_len=%d, maxpktlen=%d, cap=%#x\n", 387 DEVNAM(sc), sc->sc_ctrl_len, sc->sc_maxpktlen, 388 md->bmNetworkCapabilities); 389 break; 390 default: 391 break; 392 } 393 } 394 if (sc->sc_ver_maj < 0) { 395 aprint_error_dev(self, "missing MBIM descriptor\n"); 396 goto fail; 397 } 398 399 aprint_normal_dev(self, "version %d.%d\n", sc->sc_ver_maj, 400 sc->sc_ver_min); 401 402 if (usb_lookup(umb_fccauth_devs, uiaa->uiaa_vendor, uiaa->uiaa_product)) { 403 sc->sc_flags |= UMBFLG_FCC_AUTH_REQUIRED; 404 sc->sc_cid = -1; 405 } 406 407 for (i = 0; i < uiaa->uiaa_nifaces; i++) { 408 id = usbd_get_interface_descriptor(uiaa->uiaa_ifaces[i]); 409 if (id != NULL && id->bInterfaceNumber == data_ifaceno) { 410 sc->sc_data_iface = uiaa->uiaa_ifaces[i]; 411 } 412 } 413 if (sc->sc_data_iface == NULL) { 414 aprint_error_dev(self, "no data interface found\n"); 415 goto fail; 416 } 417 418 /* 419 * If this is a combined NCM/MBIM function, switch to 420 * alternate setting one to enable MBIM. 421 */ 422 id = usbd_get_interface_descriptor(uiaa->uiaa_iface); 423 if (id->bInterfaceClass == UICLASS_CDC && 424 id->bInterfaceSubClass == 425 UISUBCLASS_NETWORK_CONTROL_MODEL) 426 usbd_set_interface(uiaa->uiaa_iface, 1); 427 428 id = usbd_get_interface_descriptor(uiaa->uiaa_iface); 429 ctrl_ep = -1; 430 for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) { 431 ed = usbd_interface2endpoint_descriptor(uiaa->uiaa_iface, i); 432 if (ed == NULL) 433 break; 434 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT && 435 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) 436 ctrl_ep = ed->bEndpointAddress; 437 } 438 if (ctrl_ep == -1) { 439 aprint_error_dev(self, "missing interrupt endpoint\n"); 440 goto fail; 441 } 442 443 /* 444 * For the MBIM Data Interface, select the appropriate 445 * alternate setting by looking for a matching descriptor that 446 * has two endpoints. 447 */ 448 cd = usbd_get_config_descriptor(sc->sc_udev); 449 altnum = usbd_get_no_alts(cd, data_ifaceno); 450 for (i = 0; i < altnum; i++) { 451 id = usbd_find_idesc(cd, sc->sc_data_iface->ui_index, i); 452 if (id == NULL) 453 continue; 454 if (id->bInterfaceClass == UICLASS_CDC_DATA && 455 id->bInterfaceSubClass == UISUBCLASS_DATA && 456 id->bInterfaceProtocol == UIPROTO_DATA_MBIM && 457 id->bNumEndpoints == 2) 458 break; 459 } 460 if (i == altnum || id == NULL) { 461 aprint_error_dev(self, "missing alt setting for interface #%d\n", 462 data_ifaceno); 463 goto fail; 464 } 465 status = usbd_set_interface(sc->sc_data_iface, i); 466 if (status) { 467 aprint_error_dev(self, "select alt setting %d for interface #%d " 468 "failed: %s\n", i, data_ifaceno, usbd_errstr(status)); 469 goto fail; 470 } 471 472 id = usbd_get_interface_descriptor(sc->sc_data_iface); 473 sc->sc_rx_ep = sc->sc_tx_ep = -1; 474 for (i = 0; i < id->bNumEndpoints; i++) { 475 if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface, 476 i)) == NULL) 477 break; 478 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK && 479 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) 480 sc->sc_rx_ep = ed->bEndpointAddress; 481 else if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK && 482 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT) 483 sc->sc_tx_ep = ed->bEndpointAddress; 484 } 485 if (sc->sc_rx_ep == -1 || sc->sc_tx_ep == -1) { 486 aprint_error_dev(self, "missing bulk endpoints\n"); 487 goto fail; 488 } 489 490 DPRINTFN(2, "%s: ctrl-ifno#%d: ep-ctrl=%d, data-ifno#%d: ep-rx=%d, " 491 "ep-tx=%d\n", DEVNAM(sc), sc->sc_ctrl_ifaceno, 492 UE_GET_ADDR(ctrl_ep), data_ifaceno, 493 UE_GET_ADDR(sc->sc_rx_ep), UE_GET_ADDR(sc->sc_tx_ep)); 494 495 usb_init_task(&sc->sc_umb_task, umb_state_task, sc, 496 0); 497 usb_init_task(&sc->sc_get_response_task, umb_get_response_task, sc, 498 0); 499 callout_init(&sc->sc_statechg_timer, 0); 500 callout_setfunc(&sc->sc_statechg_timer, umb_statechg_timeout, sc); 501 502 if (usbd_open_pipe_intr(uiaa->uiaa_iface, ctrl_ep, USBD_SHORT_XFER_OK, 503 &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof(sc->sc_intr_msg), 504 umb_intr, USBD_DEFAULT_INTERVAL)) { 505 aprint_error_dev(self, "failed to open control pipe\n"); 506 goto fail; 507 } 508 509 sc->sc_resp_buf = kmem_alloc(sc->sc_ctrl_len, KM_SLEEP); 510 sc->sc_ctrl_msg = kmem_alloc(sc->sc_ctrl_len, KM_SLEEP); 511 512 sc->sc_info.regstate = MBIM_REGSTATE_UNKNOWN; 513 sc->sc_info.pin_attempts_left = UMB_VALUE_UNKNOWN; 514 sc->sc_info.rssi = UMB_VALUE_UNKNOWN; 515 sc->sc_info.ber = UMB_VALUE_UNKNOWN; 516 517 umb_ncm_setup(sc); 518 DPRINTFN(2, "%s: rx/tx size %d/%d\n", DEVNAM(sc), 519 sc->sc_rx_bufsz, sc->sc_tx_bufsz); 520 521 s = splnet(); 522 523 /* initialize the interface */ 524 ifp = GET_IFP(sc); 525 ifp->if_softc = sc; 526 ifp->if_flags = IFF_SIMPLEX | IFF_MULTICAST | IFF_POINTOPOINT; 527 ifp->if_ioctl = umb_ioctl; 528 ifp->if_start = umb_start; 529 530 ifp->if_watchdog = umb_watchdog; 531 strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ); 532 ifp->if_link_state = LINK_STATE_DOWN; 533 ifmedia_init(&sc->sc_im, 0, umb_mediachange, umb_mediastatus); 534 535 ifp->if_type = IFT_MBIM; 536 ifp->if_addrlen = 0; 537 ifp->if_hdrlen = sizeof(struct ncm_header16) + 538 sizeof(struct ncm_pointer16); 539 ifp->if_mtu = 1500; /* use a common default */ 540 ifp->if_mtu = sc->sc_maxpktlen; 541 ifp->if_output = umb_output; 542 ifp->_if_input = umb_input; 543 IFQ_SET_READY(&ifp->if_snd); 544 545 /* attach the interface */ 546 if_initialize(ifp); 547 if_register(ifp); 548 if_alloc_sadl(ifp); 549 550 bpf_attach(ifp, DLT_RAW, 0); 551 rnd_attach_source(&sc->sc_rnd_source, device_xname(sc->sc_dev), 552 RND_TYPE_NET, RND_FLAG_DEFAULT); 553 554 /* 555 * Open the device now so that we are able to query device information. 556 * XXX maybe close when done? 557 */ 558 umb_open(sc); 559 560 sc->sc_attached = 1; 561 splx(s); 562 563 usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev); 564 565 if (!pmf_device_register(self, NULL, NULL)) 566 aprint_error_dev(self, "couldn't establish power handler\n"); 567 568 return; 569 570 fail: 571 umb_activate(sc->sc_dev, DVACT_DEACTIVATE); 572 return; 573 } 574 575 Static int 576 umb_detach(device_t self, int flags) 577 { 578 struct umb_softc *sc = device_private(self); 579 struct ifnet *ifp = GET_IFP(sc); 580 int s; 581 582 pmf_device_deregister(self); 583 584 s = splnet(); 585 if (ifp->if_flags & IFF_RUNNING) 586 umb_down(sc, 1); 587 umb_close(sc); 588 589 usb_rem_task_wait(sc->sc_udev, &sc->sc_get_response_task, 590 USB_TASKQ_DRIVER, NULL); 591 sc->sc_nresp = 0; 592 if (sc->sc_rx_ep != -1 && sc->sc_tx_ep != -1) { 593 callout_destroy(&sc->sc_statechg_timer); 594 usb_rem_task_wait(sc->sc_udev, &sc->sc_umb_task, 595 USB_TASKQ_DRIVER, NULL); 596 } 597 if (sc->sc_ctrl_pipe) { 598 usbd_close_pipe(sc->sc_ctrl_pipe); 599 sc->sc_ctrl_pipe = NULL; 600 } 601 if (sc->sc_ctrl_msg) { 602 kmem_free(sc->sc_ctrl_msg, sc->sc_ctrl_len); 603 sc->sc_ctrl_msg = NULL; 604 } 605 if (sc->sc_resp_buf) { 606 kmem_free(sc->sc_resp_buf, sc->sc_ctrl_len); 607 sc->sc_resp_buf = NULL; 608 } 609 if (ifp->if_softc) { 610 ifmedia_fini(&sc->sc_im); 611 } 612 if (sc->sc_attached) { 613 rnd_detach_source(&sc->sc_rnd_source); 614 bpf_detach(ifp); 615 if_detach(ifp); 616 } 617 618 sc->sc_attached = 0; 619 splx(s); 620 return 0; 621 } 622 623 Static int 624 umb_activate(device_t self, enum devact act) 625 { 626 struct umb_softc *sc = device_private(self); 627 628 switch (act) { 629 case DVACT_DEACTIVATE: 630 if_deactivate(GET_IFP(sc)); 631 sc->sc_dying = 1; 632 return 0; 633 default: 634 return EOPNOTSUPP; 635 } 636 } 637 638 Static void 639 umb_ncm_setup(struct umb_softc *sc) 640 { 641 usb_device_request_t req; 642 struct ncm_ntb_parameters np; 643 644 /* Query NTB transfers sizes */ 645 req.bmRequestType = UT_READ_CLASS_INTERFACE; 646 req.bRequest = NCM_GET_NTB_PARAMETERS; 647 USETW(req.wValue, 0); 648 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 649 USETW(req.wLength, sizeof(np)); 650 if (usbd_do_request(sc->sc_udev, &req, &np) == USBD_NORMAL_COMPLETION && 651 UGETW(np.wLength) == sizeof(np)) { 652 sc->sc_rx_bufsz = UGETDW(np.dwNtbInMaxSize); 653 sc->sc_tx_bufsz = UGETDW(np.dwNtbOutMaxSize); 654 } else 655 sc->sc_rx_bufsz = sc->sc_tx_bufsz = 8 * 1024; 656 } 657 658 Static int 659 umb_alloc_xfers(struct umb_softc *sc) 660 { 661 int err = 0; 662 663 if (!sc->sc_rx_xfer) { 664 err |= usbd_create_xfer(sc->sc_rx_pipe, 665 sc->sc_rx_bufsz, 666 0, 0, &sc->sc_rx_xfer); 667 } 668 if (!sc->sc_tx_xfer) { 669 err |= usbd_create_xfer(sc->sc_tx_pipe, 670 sc->sc_tx_bufsz, 671 0, 0, &sc->sc_tx_xfer); 672 } 673 if (err) 674 return err; 675 676 sc->sc_rx_buf = usbd_get_buffer(sc->sc_rx_xfer); 677 sc->sc_tx_buf = usbd_get_buffer(sc->sc_tx_xfer); 678 679 return 0; 680 } 681 682 Static void 683 umb_free_xfers(struct umb_softc *sc) 684 { 685 if (sc->sc_rx_xfer) { 686 /* implicit usbd_free_buffer() */ 687 usbd_destroy_xfer(sc->sc_rx_xfer); 688 sc->sc_rx_xfer = NULL; 689 sc->sc_rx_buf = NULL; 690 } 691 if (sc->sc_tx_xfer) { 692 usbd_destroy_xfer(sc->sc_tx_xfer); 693 sc->sc_tx_xfer = NULL; 694 sc->sc_tx_buf = NULL; 695 } 696 m_freem(sc->sc_tx_m); 697 sc->sc_tx_m = NULL; 698 } 699 700 Static int 701 umb_alloc_bulkpipes(struct umb_softc *sc) 702 { 703 struct ifnet *ifp = GET_IFP(sc); 704 int rv; 705 706 if (!(ifp->if_flags & IFF_RUNNING)) { 707 if ((rv = usbd_open_pipe(sc->sc_data_iface, sc->sc_rx_ep, 708 USBD_EXCLUSIVE_USE, &sc->sc_rx_pipe))) { 709 DPRINTFN(4, "usbd_open_pipe() failed (RX) %d\n", rv); 710 return 0; 711 } 712 if ((rv = usbd_open_pipe(sc->sc_data_iface, sc->sc_tx_ep, 713 USBD_EXCLUSIVE_USE, &sc->sc_tx_pipe))) { 714 DPRINTFN(4, "usbd_open_pipe() failed (TX) %d\n", rv); 715 return 0; 716 } 717 718 if ((rv = umb_alloc_xfers(sc)) != 0) { 719 DPRINTFN(4, "umb_alloc_xfers() failed %d\n", rv); 720 return 0; 721 } 722 723 ifp->if_flags |= IFF_RUNNING; 724 ifp->if_flags &= ~IFF_OACTIVE; 725 umb_rx(sc); 726 } 727 return 1; 728 } 729 730 Static void 731 umb_close_bulkpipes(struct umb_softc *sc) 732 { 733 struct ifnet *ifp = GET_IFP(sc); 734 735 ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE); 736 ifp->if_timer = 0; 737 if (sc->sc_rx_pipe) { 738 usbd_close_pipe(sc->sc_rx_pipe); 739 sc->sc_rx_pipe = NULL; 740 } 741 if (sc->sc_tx_pipe) { 742 usbd_close_pipe(sc->sc_tx_pipe); 743 sc->sc_tx_pipe = NULL; 744 } 745 } 746 747 Static int 748 umb_ioctl(struct ifnet *ifp, u_long cmd, void *data) 749 { 750 struct umb_softc *sc = ifp->if_softc; 751 struct ifaddr *ifa = (struct ifaddr *)data; 752 struct ifreq *ifr = (struct ifreq *)data; 753 int s, error = 0; 754 struct umb_parameter mp; 755 756 if (sc->sc_dying) 757 return EIO; 758 759 s = splnet(); 760 switch (cmd) { 761 case SIOCINITIFADDR: 762 ifp->if_flags |= IFF_UP; 763 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 764 switch (ifa->ifa_addr->sa_family) { 765 #ifdef INET 766 case AF_INET: 767 break; 768 #endif /* INET */ 769 #ifdef INET6 770 case AF_INET6: 771 break; 772 #endif /* INET6 */ 773 default: 774 error = EAFNOSUPPORT; 775 break; 776 } 777 ifa->ifa_rtrequest = p2p_rtrequest; 778 break; 779 case SIOCSIFFLAGS: 780 error = ifioctl_common(ifp, cmd, data); 781 if (error) 782 break; 783 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 784 break; 785 case SIOCGUMBINFO: 786 error = kauth_authorize_network(kauth_cred_get(), 787 KAUTH_NETWORK_INTERFACE, 788 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, KAUTH_ARG(cmd), 789 NULL); 790 if (error) 791 break; 792 error = copyout(&sc->sc_info, ifr->ifr_data, 793 sizeof(sc->sc_info)); 794 break; 795 case SIOCSUMBPARAM: 796 error = kauth_authorize_network(kauth_cred_get(), 797 KAUTH_NETWORK_INTERFACE, 798 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, KAUTH_ARG(cmd), 799 NULL); 800 if (error) 801 break; 802 803 if ((error = copyin(ifr->ifr_data, &mp, sizeof(mp))) != 0) 804 break; 805 806 if ((error = umb_setpin(sc, mp.op, mp.is_puk, mp.pin, mp.pinlen, 807 mp.newpin, mp.newpinlen)) != 0) 808 break; 809 810 if (mp.apnlen < 0 || mp.apnlen > sizeof(sc->sc_info.apn)) { 811 error = EINVAL; 812 break; 813 } 814 sc->sc_roaming = mp.roaming ? 1 : 0; 815 memset(sc->sc_info.apn, 0, sizeof(sc->sc_info.apn)); 816 memcpy(sc->sc_info.apn, mp.apn, mp.apnlen); 817 sc->sc_info.apnlen = mp.apnlen; 818 memset(sc->sc_info.username, 0, sizeof(sc->sc_info.username)); 819 memcpy(sc->sc_info.username, mp.username, mp.usernamelen); 820 sc->sc_info.usernamelen = mp.usernamelen; 821 memset(sc->sc_info.password, 0, sizeof(sc->sc_info.password)); 822 memcpy(sc->sc_info.password, mp.password, mp.passwordlen); 823 sc->sc_info.passwordlen = mp.passwordlen; 824 sc->sc_info.preferredclasses = mp.preferredclasses; 825 umb_setdataclass(sc); 826 break; 827 case SIOCGUMBPARAM: 828 memset(&mp, 0, sizeof(mp)); 829 memcpy(mp.apn, sc->sc_info.apn, sc->sc_info.apnlen); 830 mp.apnlen = sc->sc_info.apnlen; 831 mp.roaming = sc->sc_roaming; 832 mp.preferredclasses = sc->sc_info.preferredclasses; 833 error = copyout(&mp, ifr->ifr_data, sizeof(mp)); 834 break; 835 case SIOCSIFMTU: 836 /* Does this include the NCM headers and tail? */ 837 if (ifr->ifr_mtu > ifp->if_mtu) { 838 error = EINVAL; 839 break; 840 } 841 ifp->if_mtu = ifr->ifr_mtu; 842 break; 843 case SIOCSIFADDR: 844 case SIOCAIFADDR: 845 case SIOCSIFDSTADDR: 846 case SIOCADDMULTI: 847 case SIOCDELMULTI: 848 break; 849 case SIOCGIFMEDIA: 850 error = ifmedia_ioctl(ifp, ifr, &sc->sc_im, cmd); 851 break; 852 default: 853 error = ifioctl_common(ifp, cmd, data); 854 break; 855 } 856 splx(s); 857 return error; 858 } 859 860 Static int 861 umb_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 862 const struct rtentry *rtp) 863 { 864 int error; 865 866 DPRINTFN(10, "%s: %s: enter\n", 867 device_xname(((struct umb_softc *)ifp->if_softc)->sc_dev), 868 __func__); 869 870 /* 871 * if the queueing discipline needs packet classification, 872 * do it now. 873 */ 874 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 875 876 /* 877 * Queue message on interface, and start output if interface 878 * not yet active. 879 */ 880 error = if_transmit_lock(ifp, m); 881 882 return error; 883 } 884 885 Static void 886 umb_input(struct ifnet *ifp, struct mbuf *m) 887 { 888 size_t pktlen = m->m_len; 889 int s; 890 891 if ((ifp->if_flags & IFF_UP) == 0) { 892 m_freem(m); 893 return; 894 } 895 if (pktlen < sizeof(struct ip)) { 896 if_statinc(ifp, if_ierrors); 897 DPRINTFN(4, "%s: dropping short packet (len %zd)\n", __func__, 898 pktlen); 899 m_freem(m); 900 return; 901 } 902 s = splnet(); 903 if (__predict_false(!pktq_enqueue(ip_pktq, m, 0))) { 904 if_statinc(ifp, if_iqdrops); 905 m_freem(m); 906 } else { 907 if_statadd2(ifp, if_ipackets, 1, if_ibytes, pktlen); 908 } 909 splx(s); 910 } 911 912 Static void 913 umb_start(struct ifnet *ifp) 914 { 915 struct umb_softc *sc = ifp->if_softc; 916 struct mbuf *m_head = NULL; 917 918 if (sc->sc_dying || (ifp->if_flags & IFF_OACTIVE)) 919 return; 920 921 IFQ_POLL(&ifp->if_snd, m_head); 922 if (m_head == NULL) 923 return; 924 925 if (!umb_encap(sc, m_head)) { 926 ifp->if_flags |= IFF_OACTIVE; 927 return; 928 } 929 IFQ_DEQUEUE(&ifp->if_snd, m_head); 930 931 bpf_mtap(ifp, m_head, BPF_D_OUT); 932 933 ifp->if_flags |= IFF_OACTIVE; 934 ifp->if_timer = (2 * umb_xfer_tout) / 1000; 935 } 936 937 Static void 938 umb_watchdog(struct ifnet *ifp) 939 { 940 struct umb_softc *sc = ifp->if_softc; 941 942 if (sc->sc_dying) 943 return; 944 945 if_statinc(ifp, if_oerrors); 946 printf("%s: watchdog timeout\n", DEVNAM(sc)); 947 usbd_abort_pipe(sc->sc_tx_pipe); 948 return; 949 } 950 951 Static void 952 umb_statechg_timeout(void *arg) 953 { 954 struct umb_softc *sc = arg; 955 struct ifnet *ifp = GET_IFP(sc); 956 957 if (sc->sc_info.regstate != MBIM_REGSTATE_ROAMING || sc->sc_roaming) 958 if (ifp->if_flags & IFF_DEBUG) 959 log(LOG_DEBUG, "%s: state change timeout\n", 960 DEVNAM(sc)); 961 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 962 } 963 964 Static int 965 umb_mediachange(struct ifnet * ifp) 966 { 967 return 0; 968 } 969 970 Static void 971 umb_mediastatus(struct ifnet * ifp, struct ifmediareq * imr) 972 { 973 switch (ifp->if_link_state) { 974 case LINK_STATE_UP: 975 imr->ifm_status = IFM_AVALID | IFM_ACTIVE; 976 break; 977 case LINK_STATE_DOWN: 978 imr->ifm_status = IFM_AVALID; 979 break; 980 default: 981 imr->ifm_status = 0; 982 break; 983 } 984 } 985 986 Static void 987 umb_newstate(struct umb_softc *sc, enum umb_state newstate, int flags) 988 { 989 struct ifnet *ifp = GET_IFP(sc); 990 991 if (newstate == sc->sc_state) 992 return; 993 if (((flags & UMB_NS_DONT_DROP) && newstate < sc->sc_state) || 994 ((flags & UMB_NS_DONT_RAISE) && newstate > sc->sc_state)) 995 return; 996 if (ifp->if_flags & IFF_DEBUG) 997 log(LOG_DEBUG, "%s: state going %s from '%s' to '%s'\n", 998 DEVNAM(sc), newstate > sc->sc_state ? "up" : "down", 999 umb_istate(sc->sc_state), umb_istate(newstate)); 1000 sc->sc_state = newstate; 1001 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 1002 } 1003 1004 Static void 1005 umb_state_task(void *arg) 1006 { 1007 struct umb_softc *sc = arg; 1008 struct ifnet *ifp = GET_IFP(sc); 1009 struct ifreq ifr; 1010 int s; 1011 int state; 1012 1013 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) { 1014 /* 1015 * Query the registration state until we're with the home 1016 * network again. 1017 */ 1018 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, NULL, 0); 1019 return; 1020 } 1021 1022 s = splnet(); 1023 if (ifp->if_flags & IFF_UP) 1024 umb_up(sc); 1025 else 1026 umb_down(sc, 0); 1027 1028 state = sc->sc_state == UMB_S_UP ? LINK_STATE_UP : LINK_STATE_DOWN; 1029 if (ifp->if_link_state != state) { 1030 if (ifp->if_flags & IFF_DEBUG) 1031 log(LOG_DEBUG, "%s: link state changed from %s to %s\n", 1032 DEVNAM(sc), 1033 (ifp->if_link_state == LINK_STATE_UP) 1034 ? "up" : "down", 1035 (state == LINK_STATE_UP) ? "up" : "down"); 1036 ifp->if_link_state = state; 1037 if (state != LINK_STATE_UP) { 1038 /* 1039 * Purge any existing addresses 1040 */ 1041 memset(sc->sc_info.ipv4dns, 0, 1042 sizeof(sc->sc_info.ipv4dns)); 1043 if (in_control(NULL, SIOCGIFADDR, &ifr, ifp) == 0 && 1044 satosin(&ifr.ifr_addr)->sin_addr.s_addr != 1045 INADDR_ANY) { 1046 in_control(NULL, SIOCDIFADDR, &ifr, ifp); 1047 } 1048 } 1049 if_link_state_change(ifp, state); 1050 } 1051 splx(s); 1052 } 1053 1054 Static void 1055 umb_up(struct umb_softc *sc) 1056 { 1057 switch (sc->sc_state) { 1058 case UMB_S_DOWN: 1059 DPRINTF("%s: init: opening ...\n", DEVNAM(sc)); 1060 umb_open(sc); 1061 break; 1062 case UMB_S_OPEN: 1063 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED) { 1064 if (sc->sc_cid == -1) { 1065 DPRINTF("%s: init: allocating CID ...\n", 1066 DEVNAM(sc)); 1067 umb_allocate_cid(sc); 1068 break; 1069 } else 1070 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP); 1071 } else { 1072 DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc)); 1073 umb_radio(sc, 1); 1074 break; 1075 } 1076 /*FALLTHROUGH*/ 1077 case UMB_S_CID: 1078 DPRINTF("%s: init: sending FCC auth ...\n", DEVNAM(sc)); 1079 umb_send_fcc_auth(sc); 1080 break; 1081 case UMB_S_RADIO: 1082 DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc)); 1083 umb_cmd(sc, MBIM_CID_SUBSCRIBER_READY_STATUS, MBIM_CMDOP_QRY, 1084 NULL, 0); 1085 break; 1086 case UMB_S_SIMREADY: 1087 DPRINTF("%s: init: attaching ...\n", DEVNAM(sc)); 1088 umb_packet_service(sc, 1); 1089 break; 1090 case UMB_S_ATTACHED: 1091 sc->sc_tx_seq = 0; 1092 DPRINTF("%s: init: connecting ...\n", DEVNAM(sc)); 1093 umb_connect(sc); 1094 break; 1095 case UMB_S_CONNECTED: 1096 DPRINTF("%s: init: getting IP config ...\n", DEVNAM(sc)); 1097 umb_qry_ipconfig(sc); 1098 break; 1099 case UMB_S_UP: 1100 DPRINTF("%s: init: reached state UP\n", DEVNAM(sc)); 1101 if (!umb_alloc_bulkpipes(sc)) { 1102 printf("%s: opening bulk pipes failed\n", DEVNAM(sc)); 1103 umb_down(sc, 1); 1104 } 1105 break; 1106 } 1107 if (sc->sc_state < UMB_S_UP) 1108 callout_schedule(&sc->sc_statechg_timer, 1109 UMB_STATE_CHANGE_TIMEOUT * hz); 1110 else 1111 callout_stop(&sc->sc_statechg_timer); 1112 return; 1113 } 1114 1115 Static void 1116 umb_down(struct umb_softc *sc, int force) 1117 { 1118 umb_close_bulkpipes(sc); 1119 if (sc->sc_state < UMB_S_CONNECTED) 1120 umb_free_xfers(sc); 1121 1122 switch (sc->sc_state) { 1123 case UMB_S_UP: 1124 case UMB_S_CONNECTED: 1125 DPRINTF("%s: stop: disconnecting ...\n", DEVNAM(sc)); 1126 umb_disconnect(sc); 1127 if (!force) 1128 break; 1129 /*FALLTHROUGH*/ 1130 case UMB_S_ATTACHED: 1131 DPRINTF("%s: stop: detaching ...\n", DEVNAM(sc)); 1132 umb_packet_service(sc, 0); 1133 if (!force) 1134 break; 1135 /*FALLTHROUGH*/ 1136 case UMB_S_SIMREADY: 1137 case UMB_S_RADIO: 1138 DPRINTF("%s: stop: turning radio off ...\n", DEVNAM(sc)); 1139 umb_radio(sc, 0); 1140 if (!force) 1141 break; 1142 /*FALLTHROUGH*/ 1143 case UMB_S_CID: 1144 case UMB_S_OPEN: 1145 case UMB_S_DOWN: 1146 /* Do not close the device */ 1147 DPRINTF("%s: stop: reached state DOWN\n", DEVNAM(sc)); 1148 break; 1149 } 1150 if (force) 1151 sc->sc_state = UMB_S_OPEN; 1152 1153 if (sc->sc_state > UMB_S_OPEN) 1154 callout_schedule(&sc->sc_statechg_timer, 1155 UMB_STATE_CHANGE_TIMEOUT * hz); 1156 else 1157 callout_stop(&sc->sc_statechg_timer); 1158 } 1159 1160 Static void 1161 umb_get_response_task(void *arg) 1162 { 1163 struct umb_softc *sc = arg; 1164 int len; 1165 int s; 1166 1167 /* 1168 * Function is required to send on RESPONSE_AVAILABLE notification for 1169 * each encapsulated response that is to be processed by the host. 1170 * But of course, we can receive multiple notifications before the 1171 * response task is run. 1172 */ 1173 s = splusb(); 1174 while (sc->sc_nresp > 0) { 1175 --sc->sc_nresp; 1176 len = sc->sc_ctrl_len; 1177 if (umb_get_encap_response(sc, sc->sc_resp_buf, &len)) 1178 umb_decode_response(sc, sc->sc_resp_buf, len); 1179 } 1180 splx(s); 1181 } 1182 1183 Static void 1184 umb_decode_response(struct umb_softc *sc, void *response, int len) 1185 { 1186 struct mbim_msghdr *hdr = response; 1187 struct mbim_fragmented_msg_hdr *fraghdr; 1188 uint32_t type; 1189 1190 DPRINTFN(3, "%s: got response: len %d\n", DEVNAM(sc), len); 1191 DDUMPN(4, response, len); 1192 1193 if (len < sizeof(*hdr) || le32toh(hdr->len) != len) { 1194 /* 1195 * We should probably cancel a transaction, but since the 1196 * message is too short, we cannot decode the transaction 1197 * id (tid) and hence don't know, whom to cancel. Must wait 1198 * for the timeout. 1199 */ 1200 DPRINTF("%s: received short response (len %d)\n", 1201 DEVNAM(sc), len); 1202 return; 1203 } 1204 1205 /* 1206 * XXX FIXME: if message is fragmented, store it until last frag 1207 * is received and then re-assemble all fragments. 1208 */ 1209 type = le32toh(hdr->type); 1210 switch (type) { 1211 case MBIM_INDICATE_STATUS_MSG: 1212 case MBIM_COMMAND_DONE: 1213 fraghdr = response; 1214 if (le32toh(fraghdr->frag.nfrag) != 1) { 1215 DPRINTF("%s: discarding fragmented messages\n", 1216 DEVNAM(sc)); 1217 return; 1218 } 1219 break; 1220 default: 1221 break; 1222 } 1223 1224 DPRINTF("%s: <- rcv %s (tid %u)\n", DEVNAM(sc), umb_request2str(type), 1225 le32toh(hdr->tid)); 1226 switch (type) { 1227 case MBIM_FUNCTION_ERROR_MSG: 1228 case MBIM_HOST_ERROR_MSG: 1229 { 1230 struct mbim_f2h_hosterr *e; 1231 int err; 1232 1233 if (len >= sizeof(*e)) { 1234 e = response; 1235 err = le32toh(e->err); 1236 1237 DPRINTF("%s: %s message, error %s (tid %u)\n", 1238 DEVNAM(sc), umb_request2str(type), 1239 umb_error2str(err), le32toh(hdr->tid)); 1240 if (err == MBIM_ERROR_NOT_OPENED) 1241 umb_newstate(sc, UMB_S_DOWN, 0); 1242 } 1243 break; 1244 } 1245 case MBIM_INDICATE_STATUS_MSG: 1246 umb_handle_indicate_status_msg(sc, response, len); 1247 break; 1248 case MBIM_OPEN_DONE: 1249 umb_handle_opendone_msg(sc, response, len); 1250 break; 1251 case MBIM_CLOSE_DONE: 1252 umb_handle_closedone_msg(sc, response, len); 1253 break; 1254 case MBIM_COMMAND_DONE: 1255 umb_command_done(sc, response, len); 1256 break; 1257 default: 1258 DPRINTF("%s: discard message %s\n", DEVNAM(sc), 1259 umb_request2str(type)); 1260 break; 1261 } 1262 } 1263 1264 Static void 1265 umb_handle_indicate_status_msg(struct umb_softc *sc, void *data, int len) 1266 { 1267 struct mbim_f2h_indicate_status *m = data; 1268 uint32_t infolen; 1269 uint32_t cid; 1270 1271 if (len < sizeof(*m)) { 1272 DPRINTF("%s: discard short %s message\n", DEVNAM(sc), 1273 umb_request2str(le32toh(m->hdr.type))); 1274 return; 1275 } 1276 if (memcmp(m->devid, umb_uuid_basic_connect, sizeof(m->devid))) { 1277 DPRINTF("%s: discard %s message for other UUID '%s'\n", 1278 DEVNAM(sc), umb_request2str(le32toh(m->hdr.type)), 1279 umb_uuid2str(m->devid)); 1280 return; 1281 } 1282 infolen = le32toh(m->infolen); 1283 if (len < sizeof(*m) + infolen) { 1284 DPRINTF("%s: discard truncated %s message (want %d, got %d)\n", 1285 DEVNAM(sc), umb_request2str(le32toh(m->hdr.type)), 1286 (int)sizeof(*m) + infolen, len); 1287 return; 1288 } 1289 1290 cid = le32toh(m->cid); 1291 DPRINTF("%s: indicate %s status\n", DEVNAM(sc), umb_cid2str(cid)); 1292 umb_decode_cid(sc, cid, m->info, infolen); 1293 } 1294 1295 Static void 1296 umb_handle_opendone_msg(struct umb_softc *sc, void *data, int len) 1297 { 1298 struct mbim_f2h_openclosedone *resp = data; 1299 struct ifnet *ifp = GET_IFP(sc); 1300 uint32_t status; 1301 1302 status = le32toh(resp->status); 1303 if (status == MBIM_STATUS_SUCCESS) { 1304 if (sc->sc_maxsessions == 0) { 1305 umb_cmd(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_QRY, NULL, 1306 0); 1307 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_QRY, NULL, 0); 1308 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, 1309 NULL, 0); 1310 } 1311 umb_newstate(sc, UMB_S_OPEN, UMB_NS_DONT_DROP); 1312 } else if (ifp->if_flags & IFF_DEBUG) 1313 log(LOG_ERR, "%s: open error: %s\n", DEVNAM(sc), 1314 umb_status2str(status)); 1315 return; 1316 } 1317 1318 Static void 1319 umb_handle_closedone_msg(struct umb_softc *sc, void *data, int len) 1320 { 1321 struct mbim_f2h_openclosedone *resp = data; 1322 uint32_t status; 1323 1324 status = le32toh(resp->status); 1325 if (status == MBIM_STATUS_SUCCESS) 1326 umb_newstate(sc, UMB_S_DOWN, 0); 1327 else 1328 DPRINTF("%s: close error: %s\n", DEVNAM(sc), 1329 umb_status2str(status)); 1330 return; 1331 } 1332 1333 static inline void 1334 umb_getinfobuf(char *in, int inlen, uint32_t offs, uint32_t sz, 1335 void *out, size_t outlen) 1336 { 1337 offs = le32toh(offs); 1338 sz = le32toh(sz); 1339 if (inlen >= offs + sz) { 1340 memset(out, 0, outlen); 1341 memcpy(out, in + offs, MIN(sz, outlen)); 1342 } 1343 } 1344 1345 static inline int 1346 umb_padding(void *data, int len, size_t sz) 1347 { 1348 char *p = data; 1349 int np = 0; 1350 1351 while (len < sz && (len % 4) != 0) { 1352 *p++ = '\0'; 1353 len++; 1354 np++; 1355 } 1356 return np; 1357 } 1358 1359 static inline int 1360 umb_addstr(void *buf, size_t bufsz, int *offs, void *str, int slen, 1361 uint32_t *offsmember, uint32_t *sizemember) 1362 { 1363 if (*offs + slen > bufsz) 1364 return 0; 1365 1366 *sizemember = htole32((uint32_t)slen); 1367 if (slen && str) { 1368 *offsmember = htole32((uint32_t)*offs); 1369 memcpy((char *)buf + *offs, str, slen); 1370 *offs += slen; 1371 *offs += umb_padding(buf, *offs, bufsz); 1372 } else 1373 *offsmember = htole32(0); 1374 return 1; 1375 } 1376 1377 static void 1378 umb_in_len2mask(struct in_addr *mask, int len) 1379 { 1380 int i; 1381 u_char *p; 1382 1383 p = (u_char *)mask; 1384 memset(mask, 0, sizeof(*mask)); 1385 for (i = 0; i < len / 8; i++) 1386 p[i] = 0xff; 1387 if (len % 8) 1388 p[i] = (0xff00 >> (len % 8)) & 0xff; 1389 } 1390 1391 Static int 1392 umb_decode_register_state(struct umb_softc *sc, void *data, int len) 1393 { 1394 struct mbim_cid_registration_state_info *rs = data; 1395 struct ifnet *ifp = GET_IFP(sc); 1396 1397 if (len < sizeof(*rs)) 1398 return 0; 1399 sc->sc_info.nwerror = le32toh(rs->nwerror); 1400 sc->sc_info.regstate = le32toh(rs->regstate); 1401 sc->sc_info.regmode = le32toh(rs->regmode); 1402 sc->sc_info.cellclass = le32toh(rs->curcellclass); 1403 1404 /* XXX should we remember the provider_id? */ 1405 umb_getinfobuf(data, len, rs->provname_offs, rs->provname_size, 1406 sc->sc_info.provider, sizeof(sc->sc_info.provider)); 1407 umb_getinfobuf(data, len, rs->roamingtxt_offs, rs->roamingtxt_size, 1408 sc->sc_info.roamingtxt, sizeof(sc->sc_info.roamingtxt)); 1409 1410 DPRINTFN(2, "%s: %s, availclass %#x, class %#x, regmode %d\n", 1411 DEVNAM(sc), umb_regstate(sc->sc_info.regstate), 1412 le32toh(rs->availclasses), sc->sc_info.cellclass, 1413 sc->sc_info.regmode); 1414 1415 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && 1416 !sc->sc_roaming && 1417 sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED) { 1418 if (ifp->if_flags & IFF_DEBUG) 1419 log(LOG_INFO, 1420 "%s: disconnecting from roaming network\n", 1421 DEVNAM(sc)); 1422 umb_disconnect(sc); 1423 } 1424 return 1; 1425 } 1426 1427 Static int 1428 umb_decode_devices_caps(struct umb_softc *sc, void *data, int len) 1429 { 1430 struct mbim_cid_device_caps *dc = data; 1431 1432 if (len < sizeof(*dc)) 1433 return 0; 1434 sc->sc_maxsessions = le32toh(dc->max_sessions); 1435 sc->sc_info.supportedclasses = le32toh(dc->dataclass); 1436 umb_getinfobuf(data, len, dc->devid_offs, dc->devid_size, 1437 sc->sc_info.devid, sizeof(sc->sc_info.devid)); 1438 umb_getinfobuf(data, len, dc->fwinfo_offs, dc->fwinfo_size, 1439 sc->sc_info.fwinfo, sizeof(sc->sc_info.fwinfo)); 1440 umb_getinfobuf(data, len, dc->hwinfo_offs, dc->hwinfo_size, 1441 sc->sc_info.hwinfo, sizeof(sc->sc_info.hwinfo)); 1442 DPRINTFN(2, "%s: max sessions %d, supported classes %#x\n", 1443 DEVNAM(sc), sc->sc_maxsessions, sc->sc_info.supportedclasses); 1444 return 1; 1445 } 1446 1447 Static int 1448 umb_decode_subscriber_status(struct umb_softc *sc, void *data, int len) 1449 { 1450 struct mbim_cid_subscriber_ready_info *si = data; 1451 struct ifnet *ifp = GET_IFP(sc); 1452 int npn; 1453 1454 if (len < sizeof(*si)) 1455 return 0; 1456 sc->sc_info.sim_state = le32toh(si->ready); 1457 1458 umb_getinfobuf(data, len, si->sid_offs, si->sid_size, 1459 sc->sc_info.sid, sizeof(sc->sc_info.sid)); 1460 umb_getinfobuf(data, len, si->icc_offs, si->icc_size, 1461 sc->sc_info.iccid, sizeof(sc->sc_info.iccid)); 1462 1463 npn = le32toh(si->no_pn); 1464 if (npn > 0) 1465 umb_getinfobuf(data, len, si->pn[0].offs, si->pn[0].size, 1466 sc->sc_info.pn, sizeof(sc->sc_info.pn)); 1467 else 1468 memset(sc->sc_info.pn, 0, sizeof(sc->sc_info.pn)); 1469 1470 if (sc->sc_info.sim_state == MBIM_SIMSTATE_LOCKED) 1471 sc->sc_info.pin_state = UMB_PUK_REQUIRED; 1472 if (ifp->if_flags & IFF_DEBUG) 1473 log(LOG_INFO, "%s: SIM %s\n", DEVNAM(sc), 1474 umb_simstate(sc->sc_info.sim_state)); 1475 if (sc->sc_info.sim_state == MBIM_SIMSTATE_INITIALIZED) 1476 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_DROP); 1477 return 1; 1478 } 1479 1480 Static int 1481 umb_decode_radio_state(struct umb_softc *sc, void *data, int len) 1482 { 1483 struct mbim_cid_radio_state_info *rs = data; 1484 struct ifnet *ifp = GET_IFP(sc); 1485 1486 if (len < sizeof(*rs)) 1487 return 0; 1488 1489 sc->sc_info.hw_radio_on = 1490 (le32toh(rs->hw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0; 1491 sc->sc_info.sw_radio_on = 1492 (le32toh(rs->sw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0; 1493 if (!sc->sc_info.hw_radio_on) { 1494 printf("%s: radio is disabled by hardware switch\n", 1495 DEVNAM(sc)); 1496 /* 1497 * XXX do we need a time to poll the state of the rfkill switch 1498 * or will the device send an unsolicited notification 1499 * in case the state changes? 1500 */ 1501 umb_newstate(sc, UMB_S_OPEN, 0); 1502 } else if (!sc->sc_info.sw_radio_on) { 1503 if (ifp->if_flags & IFF_DEBUG) 1504 log(LOG_INFO, "%s: radio is off\n", DEVNAM(sc)); 1505 umb_newstate(sc, UMB_S_OPEN, 0); 1506 } else 1507 umb_newstate(sc, UMB_S_RADIO, UMB_NS_DONT_DROP); 1508 return 1; 1509 } 1510 1511 Static int 1512 umb_decode_pin(struct umb_softc *sc, void *data, int len) 1513 { 1514 struct mbim_cid_pin_info *pi = data; 1515 struct ifnet *ifp = GET_IFP(sc); 1516 uint32_t attempts_left; 1517 1518 if (len < sizeof(*pi)) 1519 return 0; 1520 1521 attempts_left = le32toh(pi->remaining_attempts); 1522 if (attempts_left != 0xffffffff) 1523 sc->sc_info.pin_attempts_left = attempts_left; 1524 1525 switch (le32toh(pi->state)) { 1526 case MBIM_PIN_STATE_UNLOCKED: 1527 sc->sc_info.pin_state = UMB_PIN_UNLOCKED; 1528 break; 1529 case MBIM_PIN_STATE_LOCKED: 1530 switch (le32toh(pi->type)) { 1531 case MBIM_PIN_TYPE_PIN1: 1532 sc->sc_info.pin_state = UMB_PIN_REQUIRED; 1533 break; 1534 case MBIM_PIN_TYPE_PUK1: 1535 sc->sc_info.pin_state = UMB_PUK_REQUIRED; 1536 break; 1537 case MBIM_PIN_TYPE_PIN2: 1538 case MBIM_PIN_TYPE_PUK2: 1539 /* Assume that PIN1 was accepted */ 1540 sc->sc_info.pin_state = UMB_PIN_UNLOCKED; 1541 break; 1542 } 1543 break; 1544 } 1545 if (ifp->if_flags & IFF_DEBUG) 1546 log(LOG_INFO, "%s: %s state %s (%d attempts left)\n", 1547 DEVNAM(sc), umb_pin_type(le32toh(pi->type)), 1548 (le32toh(pi->state) == MBIM_PIN_STATE_UNLOCKED) ? 1549 "unlocked" : "locked", 1550 le32toh(pi->remaining_attempts)); 1551 1552 /* 1553 * In case the PIN was set after IFF_UP, retrigger the state machine 1554 */ 1555 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 1556 return 1; 1557 } 1558 1559 Static int 1560 umb_decode_packet_service(struct umb_softc *sc, void *data, int len) 1561 { 1562 struct mbim_cid_packet_service_info *psi = data; 1563 int state, highestclass; 1564 uint64_t up_speed, down_speed; 1565 struct ifnet *ifp = GET_IFP(sc); 1566 1567 if (len < sizeof(*psi)) 1568 return 0; 1569 1570 sc->sc_info.nwerror = le32toh(psi->nwerror); 1571 state = le32toh(psi->state); 1572 highestclass = le32toh(psi->highest_dataclass); 1573 up_speed = le64toh(psi->uplink_speed); 1574 down_speed = le64toh(psi->downlink_speed); 1575 if (sc->sc_info.packetstate != state || 1576 sc->sc_info.uplink_speed != up_speed || 1577 sc->sc_info.downlink_speed != down_speed) { 1578 if (ifp->if_flags & IFF_DEBUG) { 1579 log(LOG_INFO, "%s: packet service ", DEVNAM(sc)); 1580 if (sc->sc_info.packetstate != state) 1581 addlog("changed from %s to ", 1582 umb_packet_state(sc->sc_info.packetstate)); 1583 addlog("%s, class %s, speed: %" PRIu64 " up / %" PRIu64 " down\n", 1584 umb_packet_state(state), 1585 umb_dataclass(highestclass), up_speed, down_speed); 1586 } 1587 } 1588 sc->sc_info.packetstate = state; 1589 sc->sc_info.highestclass = highestclass; 1590 sc->sc_info.uplink_speed = up_speed; 1591 sc->sc_info.downlink_speed = down_speed; 1592 1593 if (sc->sc_info.regmode == MBIM_REGMODE_AUTOMATIC) { 1594 /* 1595 * For devices using automatic registration mode, just proceed, 1596 * once registration has completed. 1597 */ 1598 if (ifp->if_flags & IFF_UP) { 1599 switch (sc->sc_info.regstate) { 1600 case MBIM_REGSTATE_HOME: 1601 case MBIM_REGSTATE_ROAMING: 1602 case MBIM_REGSTATE_PARTNER: 1603 umb_newstate(sc, UMB_S_ATTACHED, 1604 UMB_NS_DONT_DROP); 1605 break; 1606 default: 1607 break; 1608 } 1609 } else 1610 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE); 1611 } else switch (sc->sc_info.packetstate) { 1612 case MBIM_PKTSERVICE_STATE_ATTACHED: 1613 umb_newstate(sc, UMB_S_ATTACHED, UMB_NS_DONT_DROP); 1614 break; 1615 case MBIM_PKTSERVICE_STATE_DETACHED: 1616 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE); 1617 break; 1618 } 1619 return 1; 1620 } 1621 1622 Static int 1623 umb_decode_signal_state(struct umb_softc *sc, void *data, int len) 1624 { 1625 struct mbim_cid_signal_state *ss = data; 1626 struct ifnet *ifp = GET_IFP(sc); 1627 int rssi; 1628 1629 if (len < sizeof(*ss)) 1630 return 0; 1631 1632 if (le32toh(ss->rssi) == 99) 1633 rssi = UMB_VALUE_UNKNOWN; 1634 else { 1635 rssi = -113 + 2 * le32toh(ss->rssi); 1636 if ((ifp->if_flags & IFF_DEBUG) && sc->sc_info.rssi != rssi && 1637 sc->sc_state >= UMB_S_CONNECTED) 1638 log(LOG_INFO, "%s: rssi %d dBm\n", DEVNAM(sc), rssi); 1639 } 1640 sc->sc_info.rssi = rssi; 1641 sc->sc_info.ber = le32toh(ss->err_rate); 1642 if (sc->sc_info.ber == -99) 1643 sc->sc_info.ber = UMB_VALUE_UNKNOWN; 1644 return 1; 1645 } 1646 1647 Static int 1648 umb_decode_connect_info(struct umb_softc *sc, void *data, int len) 1649 { 1650 struct mbim_cid_connect_info *ci = data; 1651 struct ifnet *ifp = GET_IFP(sc); 1652 int act; 1653 1654 if (len < sizeof(*ci)) 1655 return 0; 1656 1657 if (le32toh(ci->sessionid) != umb_session_id) { 1658 DPRINTF("%s: discard connection info for session %u\n", 1659 DEVNAM(sc), le32toh(ci->sessionid)); 1660 return 1; 1661 } 1662 if (memcmp(ci->context, umb_uuid_context_internet, 1663 sizeof(ci->context))) { 1664 DPRINTF("%s: discard connection info for other context\n", 1665 DEVNAM(sc)); 1666 return 1; 1667 } 1668 act = le32toh(ci->activation); 1669 if (sc->sc_info.activation != act) { 1670 if (ifp->if_flags & IFF_DEBUG) 1671 log(LOG_INFO, "%s: connection %s\n", DEVNAM(sc), 1672 umb_activation(act)); 1673 if ((ifp->if_flags & IFF_DEBUG) && 1674 le32toh(ci->iptype) != MBIM_CONTEXT_IPTYPE_DEFAULT && 1675 le32toh(ci->iptype) != MBIM_CONTEXT_IPTYPE_IPV4) 1676 log(LOG_DEBUG, "%s: got iptype %d connection\n", 1677 DEVNAM(sc), le32toh(ci->iptype)); 1678 1679 sc->sc_info.activation = act; 1680 sc->sc_info.nwerror = le32toh(ci->nwerror); 1681 1682 if (sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED) 1683 umb_newstate(sc, UMB_S_CONNECTED, UMB_NS_DONT_DROP); 1684 else if (sc->sc_info.activation == 1685 MBIM_ACTIVATION_STATE_DEACTIVATED) 1686 umb_newstate(sc, UMB_S_ATTACHED, 0); 1687 /* else: other states are purely transitional */ 1688 } 1689 return 1; 1690 } 1691 1692 Static int 1693 umb_decode_ip_configuration(struct umb_softc *sc, void *data, int len) 1694 { 1695 struct mbim_cid_ip_configuration_info *ic = data; 1696 struct ifnet *ifp = GET_IFP(sc); 1697 int s; 1698 uint32_t avail; 1699 uint32_t val; 1700 int n, i; 1701 int off; 1702 struct mbim_cid_ipv4_element ipv4elem; 1703 struct in_aliasreq ifra; 1704 struct sockaddr_in *sin; 1705 int state = -1; 1706 int rv; 1707 1708 if (len < sizeof(*ic)) 1709 return 0; 1710 if (le32toh(ic->sessionid) != umb_session_id) { 1711 DPRINTF("%s: ignore IP configuration for session id %d\n", 1712 DEVNAM(sc), le32toh(ic->sessionid)); 1713 return 0; 1714 } 1715 s = splnet(); 1716 1717 /* 1718 * IPv4 configuration 1719 */ 1720 avail = le32toh(ic->ipv4_available); 1721 if ((avail & (MBIM_IPCONF_HAS_ADDRINFO | MBIM_IPCONF_HAS_GWINFO)) == 1722 (MBIM_IPCONF_HAS_ADDRINFO | MBIM_IPCONF_HAS_GWINFO)) { 1723 n = le32toh(ic->ipv4_naddr); 1724 off = le32toh(ic->ipv4_addroffs); 1725 1726 if (n == 0 || off + sizeof(ipv4elem) > len) 1727 goto done; 1728 1729 /* Only pick the first one */ 1730 memcpy(&ipv4elem, (char *)data + off, sizeof(ipv4elem)); 1731 ipv4elem.prefixlen = le32toh(ipv4elem.prefixlen); 1732 1733 memset(&ifra, 0, sizeof(ifra)); 1734 sin = (struct sockaddr_in *)&ifra.ifra_addr; 1735 sin->sin_family = AF_INET; 1736 sin->sin_len = sizeof(ifra.ifra_addr); 1737 sin->sin_addr.s_addr = ipv4elem.addr; 1738 1739 sin = (struct sockaddr_in *)&ifra.ifra_dstaddr; 1740 sin->sin_family = AF_INET; 1741 sin->sin_len = sizeof(ifra.ifra_dstaddr); 1742 off = le32toh(ic->ipv4_gwoffs); 1743 memcpy(&sin->sin_addr.s_addr, (const char *)data + off, 1744 sizeof(sin->sin_addr.s_addr)); 1745 1746 sin = (struct sockaddr_in *)&ifra.ifra_mask; 1747 sin->sin_family = AF_INET; 1748 sin->sin_len = sizeof(ifra.ifra_mask); 1749 umb_in_len2mask(&sin->sin_addr, ipv4elem.prefixlen); 1750 1751 rv = in_control(NULL, SIOCAIFADDR, &ifra, ifp); 1752 if (rv == 0) { 1753 if (ifp->if_flags & IFF_DEBUG) 1754 log(LOG_INFO, "%s: IPv4 addr %s, mask %s, " 1755 "gateway %s\n", device_xname(sc->sc_dev), 1756 umb_ntop(sintosa(&ifra.ifra_addr)), 1757 umb_ntop(sintosa(&ifra.ifra_mask)), 1758 umb_ntop(sintosa(&ifra.ifra_dstaddr))); 1759 state = UMB_S_UP; 1760 } else 1761 printf("%s: unable to set IPv4 address, error %d\n", 1762 device_xname(sc->sc_dev), rv); 1763 } 1764 1765 memset(sc->sc_info.ipv4dns, 0, sizeof(sc->sc_info.ipv4dns)); 1766 if (avail & MBIM_IPCONF_HAS_DNSINFO) { 1767 n = le32toh(ic->ipv4_ndnssrv); 1768 off = le32toh(ic->ipv4_dnssrvoffs); 1769 i = 0; 1770 while (n-- > 0) { 1771 if (off + sizeof(uint32_t) > len) 1772 break; 1773 memcpy(&val, (const char *)data + off, sizeof(val)); 1774 if (i < UMB_MAX_DNSSRV) 1775 sc->sc_info.ipv4dns[i++] = val; 1776 off += sizeof(uint32_t); 1777 } 1778 } 1779 1780 if ((avail & MBIM_IPCONF_HAS_MTUINFO)) { 1781 val = le32toh(ic->ipv4_mtu); 1782 if (ifp->if_mtu != val && val <= sc->sc_maxpktlen) { 1783 ifp->if_mtu = val; 1784 if (ifp->if_mtu > val) 1785 ifp->if_mtu = val; 1786 if (ifp->if_flags & IFF_DEBUG) 1787 log(LOG_INFO, "%s: MTU %d\n", DEVNAM(sc), val); 1788 } 1789 } 1790 1791 avail = le32toh(ic->ipv6_available); 1792 if ((ifp->if_flags & IFF_DEBUG) && avail & MBIM_IPCONF_HAS_ADDRINFO) { 1793 /* XXX FIXME: IPv6 configuration missing */ 1794 log(LOG_INFO, "%s: ignoring IPv6 configuration\n", DEVNAM(sc)); 1795 } 1796 if (state != -1) 1797 umb_newstate(sc, state, 0); 1798 1799 done: 1800 splx(s); 1801 return 1; 1802 } 1803 1804 Static void 1805 umb_rx(struct umb_softc *sc) 1806 { 1807 usbd_setup_xfer(sc->sc_rx_xfer, sc, sc->sc_rx_buf, 1808 sc->sc_rx_bufsz, USBD_SHORT_XFER_OK, 1809 USBD_NO_TIMEOUT, umb_rxeof); 1810 usbd_transfer(sc->sc_rx_xfer); 1811 } 1812 1813 Static void 1814 umb_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status) 1815 { 1816 struct umb_softc *sc = priv; 1817 struct ifnet *ifp = GET_IFP(sc); 1818 1819 if (sc->sc_dying || !(ifp->if_flags & IFF_RUNNING)) 1820 return; 1821 1822 if (status != USBD_NORMAL_COMPLETION) { 1823 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED) 1824 return; 1825 DPRINTF("%s: rx error: %s\n", DEVNAM(sc), usbd_errstr(status)); 1826 if (status == USBD_STALLED) 1827 usbd_clear_endpoint_stall_async(sc->sc_rx_pipe); 1828 if (++sc->sc_rx_nerr > 100) { 1829 log(LOG_ERR, "%s: too many rx errors, disabling\n", 1830 DEVNAM(sc)); 1831 umb_activate(sc->sc_dev, DVACT_DEACTIVATE); 1832 } 1833 } else { 1834 sc->sc_rx_nerr = 0; 1835 umb_decap(sc, xfer); 1836 } 1837 1838 umb_rx(sc); 1839 return; 1840 } 1841 1842 Static int 1843 umb_encap(struct umb_softc *sc, struct mbuf *m) 1844 { 1845 struct ncm_header16 *hdr; 1846 struct ncm_pointer16 *ptr; 1847 usbd_status err; 1848 int len; 1849 1850 /* All size constraints have been validated by the caller! */ 1851 hdr = (struct ncm_header16 *)sc->sc_tx_buf; 1852 ptr = (struct ncm_pointer16 *)(hdr + 1); 1853 USETDW(hdr->dwSignature, NCM_HDR16_SIG); 1854 USETW(hdr->wHeaderLength, sizeof(*hdr)); 1855 USETW(hdr->wSequence, sc->sc_tx_seq); 1856 sc->sc_tx_seq++; 1857 1858 len = m->m_pkthdr.len; 1859 1860 USETDW(ptr->dwSignature, MBIM_NCM_NTH16_SIG(umb_session_id)); 1861 USETW(ptr->wLength, sizeof(*ptr)); 1862 USETW(ptr->wNextNdpIndex, 0); 1863 USETW(ptr->dgram[0].wDatagramIndex, MBIM_HDR16_LEN); 1864 USETW(ptr->dgram[0].wDatagramLen, len); 1865 USETW(ptr->dgram[1].wDatagramIndex, 0); 1866 USETW(ptr->dgram[1].wDatagramLen, 0); 1867 1868 KASSERT(len <= sc->sc_tx_bufsz - sizeof(*hdr) - sizeof(*ptr)); 1869 m_copydata(m, 0, len, ptr + 1); 1870 sc->sc_tx_m = m; 1871 len += MBIM_HDR16_LEN; 1872 USETW(hdr->wBlockLength, len); 1873 1874 DPRINTFN(3, "%s: encap %d bytes\n", DEVNAM(sc), len); 1875 DDUMPN(5, sc->sc_tx_buf, len); 1876 usbd_setup_xfer(sc->sc_tx_xfer, sc, sc->sc_tx_buf, len, 1877 USBD_FORCE_SHORT_XFER, umb_xfer_tout, umb_txeof); 1878 err = usbd_transfer(sc->sc_tx_xfer); 1879 if (err != USBD_IN_PROGRESS) { 1880 DPRINTF("%s: start tx error: %s\n", DEVNAM(sc), 1881 usbd_errstr(err)); 1882 return 0; 1883 } 1884 return 1; 1885 } 1886 1887 Static void 1888 umb_txeof(struct usbd_xfer *xfer, void *priv, usbd_status status) 1889 { 1890 struct umb_softc *sc = priv; 1891 struct ifnet *ifp = GET_IFP(sc); 1892 int s; 1893 1894 s = splnet(); 1895 ifp->if_flags &= ~IFF_OACTIVE; 1896 ifp->if_timer = 0; 1897 1898 m_freem(sc->sc_tx_m); 1899 sc->sc_tx_m = NULL; 1900 1901 if (status != USBD_NORMAL_COMPLETION) { 1902 if (status != USBD_NOT_STARTED && status != USBD_CANCELLED) { 1903 if_statinc(ifp, if_oerrors); 1904 DPRINTF("%s: tx error: %s\n", DEVNAM(sc), 1905 usbd_errstr(status)); 1906 if (status == USBD_STALLED) 1907 usbd_clear_endpoint_stall_async(sc->sc_tx_pipe); 1908 } 1909 } 1910 if (IFQ_IS_EMPTY(&ifp->if_snd) == 0) 1911 umb_start(ifp); 1912 1913 splx(s); 1914 } 1915 1916 Static void 1917 umb_decap(struct umb_softc *sc, struct usbd_xfer *xfer) 1918 { 1919 struct ifnet *ifp = GET_IFP(sc); 1920 int s; 1921 char *buf; 1922 uint32_t len; 1923 char *dp; 1924 struct ncm_header16 *hdr16; 1925 struct ncm_header32 *hdr32; 1926 struct ncm_pointer16 *ptr16; 1927 struct ncm_pointer16_dgram *dgram16; 1928 struct ncm_pointer32_dgram *dgram32; 1929 uint32_t hsig, psig; 1930 int hlen, blen; 1931 int ptrlen, ptroff, dgentryoff; 1932 uint32_t doff, dlen; 1933 struct mbuf *m; 1934 1935 usbd_get_xfer_status(xfer, NULL, (void **)&buf, &len, NULL); 1936 DPRINTFN(4, "%s: recv %d bytes\n", DEVNAM(sc), len); 1937 DDUMPN(5, buf, len); 1938 s = splnet(); 1939 if (len < sizeof(*hdr16)) 1940 goto toosmall; 1941 1942 hdr16 = (struct ncm_header16 *)buf; 1943 hsig = UGETDW(hdr16->dwSignature); 1944 hlen = UGETW(hdr16->wHeaderLength); 1945 if (len < hlen) 1946 goto toosmall; 1947 if (len > sc->sc_rx_bufsz) { 1948 DPRINTF("%s: packet too large (%d)\n", DEVNAM(sc), len); 1949 goto fail; 1950 } 1951 switch (hsig) { 1952 case NCM_HDR16_SIG: 1953 blen = UGETW(hdr16->wBlockLength); 1954 ptroff = UGETW(hdr16->wNdpIndex); 1955 if (hlen != sizeof(*hdr16)) { 1956 DPRINTF("%s: bad header len %d for NTH16 (exp %zu)\n", 1957 DEVNAM(sc), hlen, sizeof(*hdr16)); 1958 goto fail; 1959 } 1960 break; 1961 case NCM_HDR32_SIG: 1962 hdr32 = (struct ncm_header32 *)hdr16; 1963 blen = UGETDW(hdr32->dwBlockLength); 1964 ptroff = UGETDW(hdr32->dwNdpIndex); 1965 if (hlen != sizeof(*hdr32)) { 1966 DPRINTF("%s: bad header len %d for NTH32 (exp %zu)\n", 1967 DEVNAM(sc), hlen, sizeof(*hdr32)); 1968 goto fail; 1969 } 1970 break; 1971 default: 1972 DPRINTF("%s: unsupported NCM header signature (0x%08x)\n", 1973 DEVNAM(sc), hsig); 1974 goto fail; 1975 } 1976 if (len < blen) { 1977 DPRINTF("%s: bad NTB len (%d) for %d bytes of data\n", 1978 DEVNAM(sc), blen, len); 1979 goto fail; 1980 } 1981 1982 ptr16 = (struct ncm_pointer16 *)(buf + ptroff); 1983 psig = UGETDW(ptr16->dwSignature); 1984 ptrlen = UGETW(ptr16->wLength); 1985 if (len < ptrlen + ptroff) 1986 goto toosmall; 1987 if (!MBIM_NCM_NTH16_ISISG(psig) && !MBIM_NCM_NTH32_ISISG(psig)) { 1988 DPRINTF("%s: unsupported NCM pointer signature (0x%08x)\n", 1989 DEVNAM(sc), psig); 1990 goto fail; 1991 } 1992 1993 switch (hsig) { 1994 case NCM_HDR16_SIG: 1995 dgentryoff = offsetof(struct ncm_pointer16, dgram); 1996 break; 1997 case NCM_HDR32_SIG: 1998 dgentryoff = offsetof(struct ncm_pointer32, dgram); 1999 break; 2000 default: 2001 goto fail; 2002 } 2003 2004 while (dgentryoff < ptrlen) { 2005 switch (hsig) { 2006 case NCM_HDR16_SIG: 2007 if (ptroff + dgentryoff < sizeof(*dgram16)) 2008 goto done; 2009 dgram16 = (struct ncm_pointer16_dgram *) 2010 (buf + ptroff + dgentryoff); 2011 dgentryoff += sizeof(*dgram16); 2012 dlen = UGETW(dgram16->wDatagramLen); 2013 doff = UGETW(dgram16->wDatagramIndex); 2014 break; 2015 case NCM_HDR32_SIG: 2016 if (ptroff + dgentryoff < sizeof(*dgram32)) 2017 goto done; 2018 dgram32 = (struct ncm_pointer32_dgram *) 2019 (buf + ptroff + dgentryoff); 2020 dgentryoff += sizeof(*dgram32); 2021 dlen = UGETDW(dgram32->dwDatagramLen); 2022 doff = UGETDW(dgram32->dwDatagramIndex); 2023 break; 2024 default: 2025 if_statinc(ifp, if_ierrors); 2026 goto done; 2027 } 2028 2029 /* Terminating zero entry */ 2030 if (dlen == 0 || doff == 0) 2031 break; 2032 if (len < dlen + doff) { 2033 /* Skip giant datagram but continue processing */ 2034 DPRINTF("%s: datagram too large (%d @ off %d)\n", 2035 DEVNAM(sc), dlen, doff); 2036 continue; 2037 } 2038 2039 dp = buf + doff; 2040 DPRINTFN(3, "%s: decap %d bytes\n", DEVNAM(sc), dlen); 2041 m = m_devget(dp, dlen, 0, ifp); 2042 if (m == NULL) { 2043 if_statinc(ifp, if_iqdrops); 2044 continue; 2045 } 2046 2047 if_percpuq_enqueue((ifp)->if_percpuq, (m)); 2048 } 2049 done: 2050 splx(s); 2051 return; 2052 toosmall: 2053 DPRINTF("%s: packet too small (%d)\n", DEVNAM(sc), len); 2054 fail: 2055 if_statinc(ifp, if_ierrors); 2056 splx(s); 2057 } 2058 2059 Static usbd_status 2060 umb_send_encap_command(struct umb_softc *sc, void *data, int len) 2061 { 2062 usb_device_request_t req; 2063 2064 if (len > sc->sc_ctrl_len) 2065 return USBD_INVAL; 2066 2067 /* XXX FIXME: if (total len > sc->sc_ctrl_len) => must fragment */ 2068 req.bmRequestType = UT_WRITE_CLASS_INTERFACE; 2069 req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND; 2070 USETW(req.wValue, 0); 2071 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 2072 USETW(req.wLength, len); 2073 DELAY(umb_delay); 2074 return usbd_do_request(sc->sc_udev, &req, data); 2075 } 2076 2077 Static int 2078 umb_get_encap_response(struct umb_softc *sc, void *buf, int *len) 2079 { 2080 usb_device_request_t req; 2081 usbd_status err; 2082 2083 req.bmRequestType = UT_READ_CLASS_INTERFACE; 2084 req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE; 2085 USETW(req.wValue, 0); 2086 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 2087 USETW(req.wLength, *len); 2088 /* XXX FIXME: re-assemble fragments */ 2089 2090 DELAY(umb_delay); 2091 err = usbd_do_request_flags(sc->sc_udev, &req, buf, USBD_SHORT_XFER_OK, 2092 len, umb_xfer_tout); 2093 if (err == USBD_NORMAL_COMPLETION) 2094 return 1; 2095 DPRINTF("%s: ctrl recv: %s\n", DEVNAM(sc), usbd_errstr(err)); 2096 return 0; 2097 } 2098 2099 Static void 2100 umb_ctrl_msg(struct umb_softc *sc, uint32_t req, void *data, int len) 2101 { 2102 struct ifnet *ifp = GET_IFP(sc); 2103 uint32_t tid; 2104 struct mbim_msghdr *hdr = data; 2105 usbd_status err; 2106 int s; 2107 2108 if (sc->sc_dying) 2109 return; 2110 if (len < sizeof(*hdr)) 2111 return; 2112 tid = ++sc->sc_tid; 2113 2114 hdr->type = htole32(req); 2115 hdr->len = htole32(len); 2116 hdr->tid = htole32(tid); 2117 2118 #ifdef UMB_DEBUG 2119 if (umb_debug) { 2120 const char *op, *str; 2121 if (req == MBIM_COMMAND_MSG) { 2122 struct mbim_h2f_cmd *c = data; 2123 if (le32toh(c->op) == MBIM_CMDOP_SET) 2124 op = "set"; 2125 else 2126 op = "qry"; 2127 str = umb_cid2str(le32toh(c->cid)); 2128 } else { 2129 op = "snd"; 2130 str = umb_request2str(req); 2131 } 2132 DPRINTF("%s: -> %s %s (tid %u)\n", DEVNAM(sc), op, str, tid); 2133 } 2134 #endif 2135 s = splusb(); 2136 err = umb_send_encap_command(sc, data, len); 2137 splx(s); 2138 if (err != USBD_NORMAL_COMPLETION) { 2139 if (ifp->if_flags & IFF_DEBUG) 2140 log(LOG_ERR, "%s: send %s msg (tid %u) failed: %s\n", 2141 DEVNAM(sc), umb_request2str(req), tid, 2142 usbd_errstr(err)); 2143 2144 /* will affect other transactions, too */ 2145 usbd_abort_pipe(sc->sc_udev->ud_pipe0); 2146 } else { 2147 DPRINTFN(2, "%s: sent %s (tid %u)\n", DEVNAM(sc), 2148 umb_request2str(req), tid); 2149 DDUMPN(3, data, len); 2150 } 2151 return; 2152 } 2153 2154 Static void 2155 umb_open(struct umb_softc *sc) 2156 { 2157 struct mbim_h2f_openmsg msg; 2158 2159 memset(&msg, 0, sizeof(msg)); 2160 msg.maxlen = htole32(sc->sc_ctrl_len); 2161 umb_ctrl_msg(sc, MBIM_OPEN_MSG, &msg, sizeof(msg)); 2162 return; 2163 } 2164 2165 Static void 2166 umb_close(struct umb_softc *sc) 2167 { 2168 struct mbim_h2f_closemsg msg; 2169 2170 memset(&msg, 0, sizeof(msg)); 2171 umb_ctrl_msg(sc, MBIM_CLOSE_MSG, &msg, sizeof(msg)); 2172 } 2173 2174 Static int 2175 umb_setpin(struct umb_softc *sc, int op, int is_puk, void *pin, int pinlen, 2176 void *newpin, int newpinlen) 2177 { 2178 struct mbim_cid_pin cp; 2179 int off; 2180 2181 if (pinlen == 0) 2182 return 0; 2183 if (pinlen < 0 || pinlen > MBIM_PIN_MAXLEN || 2184 newpinlen < 0 || newpinlen > MBIM_PIN_MAXLEN || 2185 op < 0 || op > MBIM_PIN_OP_CHANGE || 2186 (is_puk && op != MBIM_PIN_OP_ENTER)) 2187 return EINVAL; 2188 2189 memset(&cp, 0, sizeof(cp)); 2190 cp.type = htole32(is_puk ? MBIM_PIN_TYPE_PUK1 : MBIM_PIN_TYPE_PIN1); 2191 2192 off = offsetof(struct mbim_cid_pin, data); 2193 if (!umb_addstr(&cp, sizeof(cp), &off, pin, pinlen, 2194 &cp.pin_offs, &cp.pin_size)) 2195 return EINVAL; 2196 2197 cp.op = htole32(op); 2198 if (newpinlen) { 2199 if (!umb_addstr(&cp, sizeof(cp), &off, newpin, newpinlen, 2200 &cp.newpin_offs, &cp.newpin_size)) 2201 return EINVAL; 2202 } else { 2203 if ((op == MBIM_PIN_OP_CHANGE) || is_puk) 2204 return EINVAL; 2205 if (!umb_addstr(&cp, sizeof(cp), &off, NULL, 0, 2206 &cp.newpin_offs, &cp.newpin_size)) 2207 return EINVAL; 2208 } 2209 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_SET, &cp, off); 2210 return 0; 2211 } 2212 2213 Static void 2214 umb_setdataclass(struct umb_softc *sc) 2215 { 2216 struct mbim_cid_registration_state rs; 2217 uint32_t classes; 2218 2219 if (sc->sc_info.supportedclasses == MBIM_DATACLASS_NONE) 2220 return; 2221 2222 memset(&rs, 0, sizeof(rs)); 2223 rs.regaction = htole32(MBIM_REGACTION_AUTOMATIC); 2224 classes = sc->sc_info.supportedclasses; 2225 if (sc->sc_info.preferredclasses != MBIM_DATACLASS_NONE) 2226 classes &= sc->sc_info.preferredclasses; 2227 rs.data_class = htole32(classes); 2228 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_SET, &rs, sizeof(rs)); 2229 } 2230 2231 Static void 2232 umb_radio(struct umb_softc *sc, int on) 2233 { 2234 struct mbim_cid_radio_state s; 2235 2236 DPRINTF("%s: set radio %s\n", DEVNAM(sc), on ? "on" : "off"); 2237 memset(&s, 0, sizeof(s)); 2238 s.state = htole32(on ? MBIM_RADIO_STATE_ON : MBIM_RADIO_STATE_OFF); 2239 umb_cmd(sc, MBIM_CID_RADIO_STATE, MBIM_CMDOP_SET, &s, sizeof(s)); 2240 } 2241 2242 Static void 2243 umb_allocate_cid(struct umb_softc *sc) 2244 { 2245 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET, 2246 umb_qmi_alloc_cid, sizeof(umb_qmi_alloc_cid), umb_uuid_qmi_mbim); 2247 } 2248 2249 Static void 2250 umb_send_fcc_auth(struct umb_softc *sc) 2251 { 2252 uint8_t fccauth[sizeof(umb_qmi_fcc_auth)]; 2253 2254 if (sc->sc_cid == -1) { 2255 DPRINTF("%s: missing CID, cannot send FCC auth\n", DEVNAM(sc)); 2256 umb_allocate_cid(sc); 2257 return; 2258 } 2259 memcpy(fccauth, umb_qmi_fcc_auth, sizeof(fccauth)); 2260 fccauth[UMB_QMI_CID_OFFS] = sc->sc_cid; 2261 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET, 2262 fccauth, sizeof(fccauth), umb_uuid_qmi_mbim); 2263 } 2264 2265 Static void 2266 umb_packet_service(struct umb_softc *sc, int attach) 2267 { 2268 struct mbim_cid_packet_service s; 2269 2270 DPRINTF("%s: %s packet service\n", DEVNAM(sc), 2271 attach ? "attach" : "detach"); 2272 memset(&s, 0, sizeof(s)); 2273 s.action = htole32(attach ? 2274 MBIM_PKTSERVICE_ACTION_ATTACH : MBIM_PKTSERVICE_ACTION_DETACH); 2275 umb_cmd(sc, MBIM_CID_PACKET_SERVICE, MBIM_CMDOP_SET, &s, sizeof(s)); 2276 } 2277 2278 Static void 2279 umb_connect(struct umb_softc *sc) 2280 { 2281 struct ifnet *ifp = GET_IFP(sc); 2282 2283 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) { 2284 log(LOG_INFO, "%s: connection disabled in roaming network\n", 2285 DEVNAM(sc)); 2286 return; 2287 } 2288 if (ifp->if_flags & IFF_DEBUG) 2289 log(LOG_DEBUG, "%s: connecting ...\n", DEVNAM(sc)); 2290 umb_send_connect(sc, MBIM_CONNECT_ACTIVATE); 2291 } 2292 2293 Static void 2294 umb_disconnect(struct umb_softc *sc) 2295 { 2296 struct ifnet *ifp = GET_IFP(sc); 2297 2298 if (ifp->if_flags & IFF_DEBUG) 2299 log(LOG_DEBUG, "%s: disconnecting ...\n", DEVNAM(sc)); 2300 umb_send_connect(sc, MBIM_CONNECT_DEACTIVATE); 2301 } 2302 2303 Static void 2304 umb_send_connect(struct umb_softc *sc, int command) 2305 { 2306 struct mbim_cid_connect *c; 2307 int off; 2308 2309 /* Too large or the stack */ 2310 c = kmem_zalloc(sizeof(*c), KM_SLEEP); 2311 c->sessionid = htole32(umb_session_id); 2312 c->command = htole32(command); 2313 off = offsetof(struct mbim_cid_connect, data); 2314 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.apn, 2315 sc->sc_info.apnlen, &c->access_offs, &c->access_size)) 2316 goto done; 2317 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.username, 2318 sc->sc_info.usernamelen, &c->user_offs, &c->user_size)) 2319 goto done; 2320 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.password, 2321 sc->sc_info.passwordlen, &c->passwd_offs, &c->passwd_size)) 2322 goto done; 2323 c->authprot = htole32(MBIM_AUTHPROT_NONE); 2324 c->compression = htole32(MBIM_COMPRESSION_NONE); 2325 c->iptype = htole32(MBIM_CONTEXT_IPTYPE_IPV4); 2326 memcpy(c->context, umb_uuid_context_internet, sizeof(c->context)); 2327 umb_cmd(sc, MBIM_CID_CONNECT, MBIM_CMDOP_SET, c, off); 2328 done: 2329 kmem_free(c, sizeof(*c)); 2330 return; 2331 } 2332 2333 Static void 2334 umb_qry_ipconfig(struct umb_softc *sc) 2335 { 2336 struct mbim_cid_ip_configuration_info ipc; 2337 2338 memset(&ipc, 0, sizeof(ipc)); 2339 ipc.sessionid = htole32(umb_session_id); 2340 umb_cmd(sc, MBIM_CID_IP_CONFIGURATION, MBIM_CMDOP_QRY, 2341 &ipc, sizeof(ipc)); 2342 } 2343 2344 Static void 2345 umb_cmd(struct umb_softc *sc, int cid, int op, const void *data, int len) 2346 { 2347 umb_cmd1(sc, cid, op, data, len, umb_uuid_basic_connect); 2348 } 2349 2350 Static void 2351 umb_cmd1(struct umb_softc *sc, int cid, int op, const void *data, int len, 2352 uint8_t *uuid) 2353 { 2354 struct mbim_h2f_cmd *cmd; 2355 int totlen; 2356 2357 /* XXX FIXME support sending fragments */ 2358 if (sizeof(*cmd) + len > sc->sc_ctrl_len) { 2359 DPRINTF("%s: set %s msg too long: cannot send\n", 2360 DEVNAM(sc), umb_cid2str(cid)); 2361 return; 2362 } 2363 cmd = sc->sc_ctrl_msg; 2364 memset(cmd, 0, sizeof(*cmd)); 2365 cmd->frag.nfrag = htole32(1); 2366 memcpy(cmd->devid, uuid, sizeof(cmd->devid)); 2367 cmd->cid = htole32(cid); 2368 cmd->op = htole32(op); 2369 cmd->infolen = htole32(len); 2370 totlen = sizeof(*cmd); 2371 if (len > 0) { 2372 memcpy(cmd + 1, data, len); 2373 totlen += len; 2374 } 2375 umb_ctrl_msg(sc, MBIM_COMMAND_MSG, cmd, totlen); 2376 } 2377 2378 Static void 2379 umb_command_done(struct umb_softc *sc, void *data, int len) 2380 { 2381 struct mbim_f2h_cmddone *cmd = data; 2382 struct ifnet *ifp = GET_IFP(sc); 2383 uint32_t status; 2384 uint32_t cid; 2385 uint32_t infolen; 2386 int qmimsg = 0; 2387 2388 if (len < sizeof(*cmd)) { 2389 DPRINTF("%s: discard short %s message\n", DEVNAM(sc), 2390 umb_request2str(le32toh(cmd->hdr.type))); 2391 return; 2392 } 2393 cid = le32toh(cmd->cid); 2394 if (memcmp(cmd->devid, umb_uuid_basic_connect, sizeof(cmd->devid))) { 2395 if (memcmp(cmd->devid, umb_uuid_qmi_mbim, 2396 sizeof(cmd->devid))) { 2397 DPRINTF("%s: discard %s message for other UUID '%s'\n", 2398 DEVNAM(sc), umb_request2str(le32toh(cmd->hdr.type)), 2399 umb_uuid2str(cmd->devid)); 2400 return; 2401 } else 2402 qmimsg = 1; 2403 } 2404 2405 status = le32toh(cmd->status); 2406 switch (status) { 2407 case MBIM_STATUS_SUCCESS: 2408 break; 2409 case MBIM_STATUS_NOT_INITIALIZED: 2410 if (ifp->if_flags & IFF_DEBUG) 2411 log(LOG_ERR, "%s: SIM not initialized (PIN missing)\n", 2412 DEVNAM(sc)); 2413 return; 2414 case MBIM_STATUS_PIN_REQUIRED: 2415 sc->sc_info.pin_state = UMB_PIN_REQUIRED; 2416 /*FALLTHROUGH*/ 2417 default: 2418 if (ifp->if_flags & IFF_DEBUG) 2419 log(LOG_ERR, "%s: set/qry %s failed: %s\n", DEVNAM(sc), 2420 umb_cid2str(cid), umb_status2str(status)); 2421 return; 2422 } 2423 2424 infolen = le32toh(cmd->infolen); 2425 if (len < sizeof(*cmd) + infolen) { 2426 DPRINTF("%s: discard truncated %s message (want %d, got %d)\n", 2427 DEVNAM(sc), umb_cid2str(cid), 2428 (int)sizeof(*cmd) + infolen, len); 2429 return; 2430 } 2431 if (qmimsg) { 2432 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED) 2433 umb_decode_qmi(sc, cmd->info, infolen); 2434 } else { 2435 DPRINTFN(2, "%s: set/qry %s done\n", DEVNAM(sc), 2436 umb_cid2str(cid)); 2437 umb_decode_cid(sc, cid, cmd->info, infolen); 2438 } 2439 } 2440 2441 Static void 2442 umb_decode_cid(struct umb_softc *sc, uint32_t cid, void *data, int len) 2443 { 2444 int ok = 1; 2445 2446 switch (cid) { 2447 case MBIM_CID_DEVICE_CAPS: 2448 ok = umb_decode_devices_caps(sc, data, len); 2449 break; 2450 case MBIM_CID_SUBSCRIBER_READY_STATUS: 2451 ok = umb_decode_subscriber_status(sc, data, len); 2452 break; 2453 case MBIM_CID_RADIO_STATE: 2454 ok = umb_decode_radio_state(sc, data, len); 2455 break; 2456 case MBIM_CID_PIN: 2457 ok = umb_decode_pin(sc, data, len); 2458 break; 2459 case MBIM_CID_REGISTER_STATE: 2460 ok = umb_decode_register_state(sc, data, len); 2461 break; 2462 case MBIM_CID_PACKET_SERVICE: 2463 ok = umb_decode_packet_service(sc, data, len); 2464 break; 2465 case MBIM_CID_SIGNAL_STATE: 2466 ok = umb_decode_signal_state(sc, data, len); 2467 break; 2468 case MBIM_CID_CONNECT: 2469 ok = umb_decode_connect_info(sc, data, len); 2470 break; 2471 case MBIM_CID_IP_CONFIGURATION: 2472 ok = umb_decode_ip_configuration(sc, data, len); 2473 break; 2474 default: 2475 /* 2476 * Note: the above list is incomplete and only contains 2477 * mandatory CIDs from the BASIC_CONNECT set. 2478 * So alternate values are not unusual. 2479 */ 2480 DPRINTFN(4, "%s: ignore %s\n", DEVNAM(sc), umb_cid2str(cid)); 2481 break; 2482 } 2483 if (!ok) 2484 DPRINTF("%s: discard %s with bad info length %d\n", 2485 DEVNAM(sc), umb_cid2str(cid), len); 2486 return; 2487 } 2488 2489 Static void 2490 umb_decode_qmi(struct umb_softc *sc, uint8_t *data, int len) 2491 { 2492 uint8_t srv; 2493 uint16_t msg, tlvlen; 2494 uint32_t val; 2495 2496 #define UMB_QMI_QMUXLEN 6 2497 if (len < UMB_QMI_QMUXLEN) 2498 goto tooshort; 2499 2500 srv = data[4]; 2501 data += UMB_QMI_QMUXLEN; 2502 len -= UMB_QMI_QMUXLEN; 2503 2504 #define UMB_GET16(p) ((uint16_t)*p | (uint16_t)*(p + 1) << 8) 2505 #define UMB_GET32(p) ((uint32_t)*p | (uint32_t)*(p + 1) << 8 | \ 2506 (uint32_t)*(p + 2) << 16 |(uint32_t)*(p + 3) << 24) 2507 switch (srv) { 2508 case 0: /* ctl */ 2509 #define UMB_QMI_CTLLEN 6 2510 if (len < UMB_QMI_CTLLEN) 2511 goto tooshort; 2512 msg = UMB_GET16(&data[2]); 2513 tlvlen = UMB_GET16(&data[4]); 2514 data += UMB_QMI_CTLLEN; 2515 len -= UMB_QMI_CTLLEN; 2516 break; 2517 case 2: /* dms */ 2518 #define UMB_QMI_DMSLEN 7 2519 if (len < UMB_QMI_DMSLEN) 2520 goto tooshort; 2521 msg = UMB_GET16(&data[3]); 2522 tlvlen = UMB_GET16(&data[5]); 2523 data += UMB_QMI_DMSLEN; 2524 len -= UMB_QMI_DMSLEN; 2525 break; 2526 default: 2527 DPRINTF("%s: discard QMI message for unknown service type %d\n", 2528 DEVNAM(sc), srv); 2529 return; 2530 } 2531 2532 if (len < tlvlen) 2533 goto tooshort; 2534 2535 #define UMB_QMI_TLVLEN 3 2536 while (len > 0) { 2537 if (len < UMB_QMI_TLVLEN) 2538 goto tooshort; 2539 tlvlen = UMB_GET16(&data[1]); 2540 if (len < UMB_QMI_TLVLEN + tlvlen) 2541 goto tooshort; 2542 switch (data[0]) { 2543 case 1: /* allocation info */ 2544 if (msg == 0x0022) { /* Allocate CID */ 2545 if (tlvlen != 2 || data[3] != 2) /* dms */ 2546 break; 2547 sc->sc_cid = data[4]; 2548 DPRINTF("%s: QMI CID %d allocated\n", 2549 DEVNAM(sc), sc->sc_cid); 2550 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP); 2551 } 2552 break; 2553 case 2: /* response */ 2554 if (tlvlen != sizeof(val)) 2555 break; 2556 val = UMB_GET32(&data[3]); 2557 switch (msg) { 2558 case 0x0022: /* Allocate CID */ 2559 if (val != 0) { 2560 log(LOG_ERR, "%s: allocation of QMI CID" 2561 " failed, error %#x\n", DEVNAM(sc), 2562 val); 2563 /* XXX how to proceed? */ 2564 return; 2565 } 2566 break; 2567 case 0x555f: /* Send FCC Authentication */ 2568 if (val == 0) 2569 DPRINTF("%s: send FCC " 2570 "Authentication succeeded\n", 2571 DEVNAM(sc)); 2572 else if (val == 0x001a0001) 2573 DPRINTF("%s: FCC Authentication " 2574 "not required\n", DEVNAM(sc)); 2575 else 2576 log(LOG_INFO, "%s: send FCC " 2577 "Authentication failed, " 2578 "error %#x\n", DEVNAM(sc), val); 2579 2580 /* FCC Auth is needed only once after power-on*/ 2581 sc->sc_flags &= ~UMBFLG_FCC_AUTH_REQUIRED; 2582 2583 /* Try to proceed anyway */ 2584 DPRINTF("%s: init: turning radio on ...\n", 2585 DEVNAM(sc)); 2586 umb_radio(sc, 1); 2587 break; 2588 default: 2589 break; 2590 } 2591 break; 2592 default: 2593 break; 2594 } 2595 data += UMB_QMI_TLVLEN + tlvlen; 2596 len -= UMB_QMI_TLVLEN + tlvlen; 2597 } 2598 return; 2599 2600 tooshort: 2601 DPRINTF("%s: discard short QMI message\n", DEVNAM(sc)); 2602 return; 2603 } 2604 2605 Static void 2606 umb_intr(struct usbd_xfer *xfer, void *priv, usbd_status status) 2607 { 2608 struct umb_softc *sc = priv; 2609 struct ifnet *ifp = GET_IFP(sc); 2610 int total_len; 2611 2612 if (status != USBD_NORMAL_COMPLETION) { 2613 DPRINTF("%s: notification error: %s\n", DEVNAM(sc), 2614 usbd_errstr(status)); 2615 if (status == USBD_STALLED) 2616 usbd_clear_endpoint_stall_async(sc->sc_ctrl_pipe); 2617 return; 2618 } 2619 usbd_get_xfer_status(xfer, NULL, NULL, &total_len, NULL); 2620 if (total_len < UCDC_NOTIFICATION_LENGTH) { 2621 DPRINTF("%s: short notification (%d<%d)\n", DEVNAM(sc), 2622 total_len, UCDC_NOTIFICATION_LENGTH); 2623 return; 2624 } 2625 if (sc->sc_intr_msg.bmRequestType != UCDC_NOTIFICATION) { 2626 DPRINTF("%s: unexpected notification (type=0x%02x)\n", 2627 DEVNAM(sc), sc->sc_intr_msg.bmRequestType); 2628 return; 2629 } 2630 2631 switch (sc->sc_intr_msg.bNotification) { 2632 case UCDC_N_NETWORK_CONNECTION: 2633 if (ifp->if_flags & IFF_DEBUG) 2634 log(LOG_DEBUG, "%s: network %sconnected\n", DEVNAM(sc), 2635 UGETW(sc->sc_intr_msg.wValue) ? "" : "dis"); 2636 break; 2637 case UCDC_N_RESPONSE_AVAILABLE: 2638 DPRINTFN(2, "%s: umb_intr: response available\n", DEVNAM(sc)); 2639 ++sc->sc_nresp; 2640 usb_add_task(sc->sc_udev, &sc->sc_get_response_task, USB_TASKQ_DRIVER); 2641 break; 2642 case UCDC_N_CONNECTION_SPEED_CHANGE: 2643 DPRINTFN(2, "%s: umb_intr: connection speed changed\n", 2644 DEVNAM(sc)); 2645 break; 2646 default: 2647 DPRINTF("%s: unexpected notification (0x%02x)\n", 2648 DEVNAM(sc), sc->sc_intr_msg.bNotification); 2649 break; 2650 } 2651 } 2652 2653 /* 2654 * Diagnostic routines 2655 */ 2656 Static char * 2657 umb_ntop(struct sockaddr *sa) 2658 { 2659 #define NUMBUFS 4 2660 static char astr[NUMBUFS][INET_ADDRSTRLEN]; 2661 static unsigned nbuf = 0; 2662 char *s; 2663 2664 s = astr[nbuf++]; 2665 if (nbuf >= NUMBUFS) 2666 nbuf = 0; 2667 2668 switch (sa->sa_family) { 2669 case AF_INET: 2670 default: 2671 inet_ntop(AF_INET, &satosin(sa)->sin_addr, s, sizeof(astr[0])); 2672 break; 2673 case AF_INET6: 2674 inet_ntop(AF_INET6, &satosin6(sa)->sin6_addr, s, 2675 sizeof(astr[0])); 2676 break; 2677 } 2678 return s; 2679 } 2680 2681 #ifdef UMB_DEBUG 2682 Static char * 2683 umb_uuid2str(uint8_t uuid[MBIM_UUID_LEN]) 2684 { 2685 static char uuidstr[2 * MBIM_UUID_LEN + 5]; 2686 2687 #define UUID_BFMT "%02X" 2688 #define UUID_SEP "-" 2689 snprintf(uuidstr, sizeof(uuidstr), 2690 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_SEP 2691 UUID_BFMT UUID_BFMT UUID_SEP 2692 UUID_BFMT UUID_BFMT UUID_SEP 2693 UUID_BFMT UUID_BFMT UUID_SEP 2694 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT, 2695 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5], 2696 uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11], 2697 uuid[12], uuid[13], uuid[14], uuid[15]); 2698 return uuidstr; 2699 } 2700 2701 Static void 2702 umb_dump(void *buf, int len) 2703 { 2704 int i = 0; 2705 uint8_t *c = buf; 2706 2707 if (len == 0) 2708 return; 2709 while (i < len) { 2710 if ((i % 16) == 0) { 2711 if (i > 0) 2712 addlog("\n"); 2713 log(LOG_DEBUG, "%4d: ", i); 2714 } 2715 addlog(" %02x", *c); 2716 c++; 2717 i++; 2718 } 2719 addlog("\n"); 2720 } 2721 #endif /* UMB_DEBUG */ 2722 2723 /* char * 2724 * inet_ntop(af, src, dst, size) 2725 * convert a network format address to presentation format. 2726 * return: 2727 * pointer to presentation format address (`dst'), or NULL (see errno). 2728 * author: 2729 * Paul Vixie, 1996. 2730 */ 2731 Static const char * 2732 inet_ntop(int af, const void *src, char *dst, socklen_t size) 2733 { 2734 switch (af) { 2735 case AF_INET: 2736 return inet_ntop4(src, dst, (size_t)size); 2737 #ifdef INET6 2738 case AF_INET6: 2739 return inet_ntop6(src, dst, (size_t)size); 2740 #endif /* INET6 */ 2741 default: 2742 return NULL; 2743 } 2744 /* NOTREACHED */ 2745 } 2746 2747 /* const char * 2748 * inet_ntop4(src, dst, size) 2749 * format an IPv4 address, more or less like inet_ntoa() 2750 * return: 2751 * `dst' (as a const) 2752 * notes: 2753 * (1) uses no statics 2754 * (2) takes a u_char* not an in_addr as input 2755 * author: 2756 * Paul Vixie, 1996. 2757 */ 2758 Static const char * 2759 inet_ntop4(const u_char *src, char *dst, size_t size) 2760 { 2761 char tmp[sizeof("255.255.255.255")]; 2762 int l; 2763 2764 l = snprintf(tmp, sizeof(tmp), "%u.%u.%u.%u", 2765 src[0], src[1], src[2], src[3]); 2766 if (l <= 0 || l >= size) { 2767 return NULL; 2768 } 2769 strlcpy(dst, tmp, size); 2770 return dst; 2771 } 2772 2773 #ifdef INET6 2774 /* const char * 2775 * inet_ntop6(src, dst, size) 2776 * convert IPv6 binary address into presentation (printable) format 2777 * author: 2778 * Paul Vixie, 1996. 2779 */ 2780 Static const char * 2781 inet_ntop6(const u_char *src, char *dst, size_t size) 2782 { 2783 /* 2784 * Note that int32_t and int16_t need only be "at least" large enough 2785 * to contain a value of the specified size. On some systems, like 2786 * Crays, there is no such thing as an integer variable with 16 bits. 2787 * Keep this in mind if you think this function should have been coded 2788 * to use pointer overlays. All the world's not a VAX. 2789 */ 2790 char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")]; 2791 char *tp, *ep; 2792 struct { int base, len; } best, cur; 2793 #define IN6ADDRSZ 16 2794 #define INT16SZ 2 2795 u_int words[IN6ADDRSZ / INT16SZ]; 2796 int i; 2797 int advance; 2798 2799 /* 2800 * Preprocess: 2801 * Copy the input (bytewise) array into a wordwise array. 2802 * Find the longest run of 0x00's in src[] for :: shorthanding. 2803 */ 2804 memset(words, '\0', sizeof(words)); 2805 for (i = 0; i < IN6ADDRSZ; i++) 2806 words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3)); 2807 best.base = -1; 2808 best.len = 0; 2809 cur.base = -1; 2810 cur.len = 0; 2811 for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) { 2812 if (words[i] == 0) { 2813 if (cur.base == -1) 2814 cur.base = i, cur.len = 1; 2815 else 2816 cur.len++; 2817 } else { 2818 if (cur.base != -1) { 2819 if (best.base == -1 || cur.len > best.len) 2820 best = cur; 2821 cur.base = -1; 2822 } 2823 } 2824 } 2825 if (cur.base != -1) { 2826 if (best.base == -1 || cur.len > best.len) 2827 best = cur; 2828 } 2829 if (best.base != -1 && best.len < 2) 2830 best.base = -1; 2831 2832 /* 2833 * Format the result. 2834 */ 2835 tp = tmp; 2836 ep = tmp + sizeof(tmp); 2837 for (i = 0; i < (IN6ADDRSZ / INT16SZ) && tp < ep; i++) { 2838 /* Are we inside the best run of 0x00's? */ 2839 if (best.base != -1 && i >= best.base && 2840 i < (best.base + best.len)) { 2841 if (i == best.base) { 2842 if (tp + 1 >= ep) 2843 return NULL; 2844 *tp++ = ':'; 2845 } 2846 continue; 2847 } 2848 /* Are we following an initial run of 0x00s or any real hex? */ 2849 if (i != 0) { 2850 if (tp + 1 >= ep) 2851 return NULL; 2852 *tp++ = ':'; 2853 } 2854 /* Is this address an encapsulated IPv4? */ 2855 if (i == 6 && best.base == 0 && 2856 (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) { 2857 if (!inet_ntop4(src+12, tp, (size_t)(ep - tp))) 2858 return NULL; 2859 tp += strlen(tp); 2860 break; 2861 } 2862 advance = snprintf(tp, ep - tp, "%x", words[i]); 2863 if (advance <= 0 || advance >= ep - tp) 2864 return NULL; 2865 tp += advance; 2866 } 2867 /* Was it a trailing run of 0x00's? */ 2868 if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ)) { 2869 if (tp + 1 >= ep) 2870 return NULL; 2871 *tp++ = ':'; 2872 } 2873 if (tp + 1 >= ep) 2874 return NULL; 2875 *tp++ = '\0'; 2876 2877 /* 2878 * Check for overflow, copy, and we're done. 2879 */ 2880 if ((size_t)(tp - tmp) > size) { 2881 return NULL; 2882 } 2883 strlcpy(dst, tmp, size); 2884 return dst; 2885 } 2886 #endif /* INET6 */ 2887
Indexes created Sun Sep 28 16:09:52 GMT 2025