1 /* $NetBSD: if_umb.c,v 1.9 2019/06/26 22:58:58 khorben Exp $ */ 2 /* $OpenBSD: if_umb.c,v 1.20 2018/09/10 17:00:45 gerhard Exp $ */ 3 4 /* 5 * Copyright (c) 2016 genua mbH 6 * All rights reserved. 7 * 8 * Permission to use, copy, modify, and distribute this software for any 9 * purpose with or without fee is hereby granted, provided that the above 10 * copyright notice and this permission notice appear in all copies. 11 * 12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 */ 20 21 /* 22 * Mobile Broadband Interface Model specification: 23 * http://www.usb.org/developers/docs/devclass_docs/MBIM10Errata1_073013.zip 24 * Compliance testing guide 25 * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf 26 */ 27 28 #include <sys/cdefs.h> 29 __KERNEL_RCSID(0, "$NetBSD: if_umb.c,v 1.9 2019/06/26 22:58:58 khorben Exp $"); 30 31 #ifdef _KERNEL_OPT 32 #include "opt_inet.h" 33 #endif 34 35 #include <sys/param.h> 36 #include <sys/device.h> 37 #include <sys/endian.h> 38 #include <sys/kauth.h> 39 #include <sys/kernel.h> 40 #include <sys/kmem.h> 41 #include <sys/mbuf.h> 42 #include <sys/rndsource.h> 43 #include <sys/socket.h> 44 #include <sys/syslog.h> 45 #include <sys/systm.h> 46 47 #include <net/bpf.h> 48 #include <net/if.h> 49 #include <net/if_media.h> 50 #include <net/if_types.h> 51 52 #ifdef INET 53 #include <netinet/in.h> 54 #include <netinet/if_inarp.h> 55 #include <netinet/in_var.h> 56 #include <netinet/ip.h> 57 #endif 58 59 #include <dev/usb/usb.h> 60 #include <dev/usb/usbdi.h> 61 #include <dev/usb/usbdivar.h> 62 #include <dev/usb/usbdi_util.h> 63 #include <dev/usb/usbdevs.h> 64 #include <dev/usb/usbcdc.h> 65 66 #include <dev/usb/mbim.h> 67 #include <dev/usb/if_umbreg.h> 68 69 #ifdef UMB_DEBUG 70 #define DPRINTF(x...) \ 71 do { if (umb_debug) log(LOG_DEBUG, x); } while (0) 72 73 #define DPRINTFN(n, x...) \ 74 do { if (umb_debug >= (n)) log(LOG_DEBUG, x); } while (0) 75 76 #define DDUMPN(n, b, l) \ 77 do { \ 78 if (umb_debug >= (n)) \ 79 umb_dump((b), (l)); \ 80 } while (0) 81 82 int umb_debug = 0; 83 Static char *umb_uuid2str(uint8_t [MBIM_UUID_LEN]); 84 Static void umb_dump(void *, int); 85 86 #else 87 #define DPRINTF(x...) do { } while (0) 88 #define DPRINTFN(n, x...) do { } while (0) 89 #define DDUMPN(n, b, l) do { } while (0) 90 #endif 91 92 #define DEVNAM(sc) device_xname((sc)->sc_dev) 93 94 /* 95 * State change timeout 96 */ 97 #define UMB_STATE_CHANGE_TIMEOUT 30 98 99 /* 100 * State change flags 101 */ 102 #define UMB_NS_DONT_DROP 0x0001 /* do not drop below current state */ 103 #define UMB_NS_DONT_RAISE 0x0002 /* do not raise below current state */ 104 105 /* 106 * Diagnostic macros 107 */ 108 const struct umb_valdescr umb_regstates[] = MBIM_REGSTATE_DESCRIPTIONS; 109 const struct umb_valdescr umb_dataclasses[] = MBIM_DATACLASS_DESCRIPTIONS; 110 const struct umb_valdescr umb_simstate[] = MBIM_SIMSTATE_DESCRIPTIONS; 111 const struct umb_valdescr umb_messages[] = MBIM_MESSAGES_DESCRIPTIONS; 112 const struct umb_valdescr umb_status[] = MBIM_STATUS_DESCRIPTIONS; 113 const struct umb_valdescr umb_cids[] = MBIM_CID_DESCRIPTIONS; 114 const struct umb_valdescr umb_pktstate[] = MBIM_PKTSRV_STATE_DESCRIPTIONS; 115 const struct umb_valdescr umb_actstate[] = MBIM_ACTIVATION_STATE_DESCRIPTIONS; 116 const struct umb_valdescr umb_error[] = MBIM_ERROR_DESCRIPTIONS; 117 const struct umb_valdescr umb_pintype[] = MBIM_PINTYPE_DESCRIPTIONS; 118 const struct umb_valdescr umb_istate[] = UMB_INTERNAL_STATE_DESCRIPTIONS; 119 120 #define umb_regstate(c) umb_val2descr(umb_regstates, (c)) 121 #define umb_dataclass(c) umb_val2descr(umb_dataclasses, (c)) 122 #define umb_simstate(s) umb_val2descr(umb_simstate, (s)) 123 #define umb_request2str(m) umb_val2descr(umb_messages, (m)) 124 #define umb_status2str(s) umb_val2descr(umb_status, (s)) 125 #define umb_cid2str(c) umb_val2descr(umb_cids, (c)) 126 #define umb_packet_state(s) umb_val2descr(umb_pktstate, (s)) 127 #define umb_activation(s) umb_val2descr(umb_actstate, (s)) 128 #define umb_error2str(e) umb_val2descr(umb_error, (e)) 129 #define umb_pin_type(t) umb_val2descr(umb_pintype, (t)) 130 #define umb_istate(s) umb_val2descr(umb_istate, (s)) 131 132 Static int umb_match(device_t, cfdata_t, void *); 133 Static void umb_attach(device_t, device_t, void *); 134 Static int umb_detach(device_t, int); 135 Static int umb_activate(device_t, enum devact); 136 Static void umb_ncm_setup(struct umb_softc *); 137 Static int umb_alloc_xfers(struct umb_softc *); 138 Static void umb_free_xfers(struct umb_softc *); 139 Static int umb_alloc_bulkpipes(struct umb_softc *); 140 Static void umb_close_bulkpipes(struct umb_softc *); 141 Static int umb_ioctl(struct ifnet *, u_long, void *); 142 Static int umb_output(struct ifnet *, struct mbuf *, 143 const struct sockaddr *, const struct rtentry *); 144 Static void umb_input(struct ifnet *, struct mbuf *); 145 Static void umb_start(struct ifnet *); 146 Static void umb_watchdog(struct ifnet *); 147 Static void umb_statechg_timeout(void *); 148 149 Static int umb_mediachange(struct ifnet *); 150 Static void umb_mediastatus(struct ifnet *, struct ifmediareq *); 151 152 Static void umb_newstate(struct umb_softc *, enum umb_state, int); 153 Static void umb_state_task(void *); 154 Static void umb_up(struct umb_softc *); 155 Static void umb_down(struct umb_softc *, int); 156 157 Static void umb_get_response_task(void *); 158 159 Static void umb_decode_response(struct umb_softc *, void *, int); 160 Static void umb_handle_indicate_status_msg(struct umb_softc *, void *, 161 int); 162 Static void umb_handle_opendone_msg(struct umb_softc *, void *, int); 163 Static void umb_handle_closedone_msg(struct umb_softc *, void *, int); 164 Static int umb_decode_register_state(struct umb_softc *, void *, int); 165 Static int umb_decode_devices_caps(struct umb_softc *, void *, int); 166 Static int umb_decode_subscriber_status(struct umb_softc *, void *, int); 167 Static int umb_decode_radio_state(struct umb_softc *, void *, int); 168 Static int umb_decode_pin(struct umb_softc *, void *, int); 169 Static int umb_decode_packet_service(struct umb_softc *, void *, int); 170 Static int umb_decode_signal_state(struct umb_softc *, void *, int); 171 Static int umb_decode_connect_info(struct umb_softc *, void *, int); 172 Static int umb_decode_ip_configuration(struct umb_softc *, void *, int); 173 Static void umb_rx(struct umb_softc *); 174 Static void umb_rxeof(struct usbd_xfer *, void *, usbd_status); 175 Static int umb_encap(struct umb_softc *, struct mbuf *); 176 Static void umb_txeof(struct usbd_xfer *, void *, usbd_status); 177 Static void umb_decap(struct umb_softc *, struct usbd_xfer *); 178 179 Static usbd_status umb_send_encap_command(struct umb_softc *, void *, int); 180 Static int umb_get_encap_response(struct umb_softc *, void *, int *); 181 Static void umb_ctrl_msg(struct umb_softc *, uint32_t, void *, int); 182 183 Static void umb_open(struct umb_softc *); 184 Static void umb_close(struct umb_softc *); 185 186 Static int umb_setpin(struct umb_softc *, int, int, void *, int, void *, 187 int); 188 Static void umb_setdataclass(struct umb_softc *); 189 Static void umb_radio(struct umb_softc *, int); 190 Static void umb_allocate_cid(struct umb_softc *); 191 Static void umb_send_fcc_auth(struct umb_softc *); 192 Static void umb_packet_service(struct umb_softc *, int); 193 Static void umb_connect(struct umb_softc *); 194 Static void umb_disconnect(struct umb_softc *); 195 Static void umb_send_connect(struct umb_softc *, int); 196 197 Static void umb_qry_ipconfig(struct umb_softc *); 198 Static void umb_cmd(struct umb_softc *, int, int, const void *, int); 199 Static void umb_cmd1(struct umb_softc *, int, int, const void *, int, uint8_t *); 200 Static void umb_command_done(struct umb_softc *, void *, int); 201 Static void umb_decode_cid(struct umb_softc *, uint32_t, void *, int); 202 Static void umb_decode_qmi(struct umb_softc *, uint8_t *, int); 203 204 Static void umb_intr(struct usbd_xfer *, void *, usbd_status); 205 206 Static char *umb_ntop(struct sockaddr *); 207 208 Static const char * 209 inet_ntop(int af, const void *src, char *dst, socklen_t size); 210 static const char *inet_ntop4(const u_char *src, char *dst, size_t size); 211 #ifdef INET6 212 static const char *inet_ntop6(const u_char *src, char *dst, size_t size); 213 #endif /* INET6 */ 214 215 Static int umb_xfer_tout = USBD_DEFAULT_TIMEOUT; 216 217 Static uint8_t umb_uuid_basic_connect[] = MBIM_UUID_BASIC_CONNECT; 218 Static uint8_t umb_uuid_context_internet[] = MBIM_UUID_CONTEXT_INTERNET; 219 Static uint8_t umb_uuid_qmi_mbim[] = MBIM_UUID_QMI_MBIM; 220 Static uint32_t umb_session_id = 0; 221 222 CFATTACH_DECL_NEW(umb, sizeof(struct umb_softc), umb_match, umb_attach, 223 umb_detach, umb_activate); 224 225 const int umb_delay = 4000; 226 227 /* 228 * These devices require an "FCC Authentication" command. 229 */ 230 const struct usb_devno umb_fccauth_devs[] = { 231 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_EM7455 }, 232 }; 233 234 Static const uint8_t umb_qmi_alloc_cid[] = { 235 0x01, 236 0x0f, 0x00, /* len */ 237 0x00, /* QMUX flags */ 238 0x00, /* service "ctl" */ 239 0x00, /* CID */ 240 0x00, /* QMI flags */ 241 0x01, /* transaction */ 242 0x22, 0x00, /* msg "Allocate CID" */ 243 0x04, 0x00, /* TLV len */ 244 0x01, 0x01, 0x00, 0x02 /* TLV */ 245 }; 246 247 Static const uint8_t umb_qmi_fcc_auth[] = { 248 0x01, 249 0x0c, 0x00, /* len */ 250 0x00, /* QMUX flags */ 251 0x02, /* service "dms" */ 252 #define UMB_QMI_CID_OFFS 5 253 0x00, /* CID (filled in later) */ 254 0x00, /* QMI flags */ 255 0x01, 0x00, /* transaction */ 256 0x5f, 0x55, /* msg "Send FCC Authentication" */ 257 0x00, 0x00 /* TLV len */ 258 }; 259 260 Static int 261 umb_match(device_t parent, cfdata_t match, void *aux) 262 { 263 struct usbif_attach_arg *uiaa = aux; 264 usb_interface_descriptor_t *id; 265 266 if (!uiaa->uiaa_iface) 267 return UMATCH_NONE; 268 if ((id = usbd_get_interface_descriptor(uiaa->uiaa_iface)) == NULL) 269 return UMATCH_NONE; 270 271 /* 272 * If this function implements NCM, check if alternate setting 273 * 1 implements MBIM. 274 */ 275 if (id->bInterfaceClass == UICLASS_CDC && 276 id->bInterfaceSubClass == 277 UISUBCLASS_NETWORK_CONTROL_MODEL) 278 id = usbd_find_idesc(uiaa->uiaa_device->ud_cdesc, uiaa->uiaa_iface->ui_index, 1); 279 if (id == NULL) 280 return UMATCH_NONE; 281 282 if (id->bInterfaceClass == UICLASS_CDC && 283 id->bInterfaceSubClass == 284 UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL && 285 id->bInterfaceProtocol == 0) 286 return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO; 287 288 return UMATCH_NONE; 289 } 290 291 Static void 292 umb_attach(device_t parent, device_t self, void *aux) 293 { 294 struct umb_softc *sc = device_private(self); 295 struct usbif_attach_arg *uiaa = aux; 296 char *devinfop; 297 usbd_status status; 298 usbd_desc_iter_t iter; 299 const usb_descriptor_t *desc; 300 int v; 301 const usb_cdc_union_descriptor_t *ud; 302 const struct mbim_descriptor *md; 303 int i; 304 int ctrl_ep; 305 const usb_interface_descriptor_t *id; 306 usb_config_descriptor_t *cd; 307 usb_endpoint_descriptor_t *ed; 308 const usb_interface_assoc_descriptor_t *ad; 309 int current_ifaceno = -1; 310 int data_ifaceno = -1; 311 int altnum; 312 int s; 313 struct ifnet *ifp; 314 int rv; 315 316 sc->sc_dev = self; 317 sc->sc_udev = uiaa->uiaa_device; 318 319 aprint_naive("\n"); 320 aprint_normal("\n"); 321 322 devinfop = usbd_devinfo_alloc(sc->sc_udev, 0); 323 aprint_normal_dev(self, "%s\n", devinfop); 324 usbd_devinfo_free(devinfop); 325 326 sc->sc_ctrl_ifaceno = uiaa->uiaa_ifaceno; 327 328 /* 329 * Some MBIM hardware does not provide the mandatory CDC Union 330 * Descriptor, so we also look at matching Interface 331 * Association Descriptors to find out the MBIM Data Interface 332 * number. 333 */ 334 sc->sc_ver_maj = sc->sc_ver_min = -1; 335 sc->sc_maxpktlen = MBIM_MAXSEGSZ_MINVAL; 336 usb_desc_iter_init(sc->sc_udev, &iter); 337 while ((desc = usb_desc_iter_next(&iter))) { 338 if (desc->bDescriptorType == UDESC_INTERFACE_ASSOC) { 339 ad = (const usb_interface_assoc_descriptor_t *)desc; 340 if (ad->bFirstInterface == uiaa->uiaa_ifaceno && 341 ad->bInterfaceCount > 1) 342 data_ifaceno = uiaa->uiaa_ifaceno + 1; 343 continue; 344 } 345 if (desc->bDescriptorType == UDESC_INTERFACE) { 346 id = (const usb_interface_descriptor_t *)desc; 347 current_ifaceno = id->bInterfaceNumber; 348 continue; 349 } 350 if (current_ifaceno != uiaa->uiaa_ifaceno) 351 continue; 352 if (desc->bDescriptorType != UDESC_CS_INTERFACE) 353 continue; 354 switch (desc->bDescriptorSubtype) { 355 case UDESCSUB_CDC_UNION: 356 ud = (const usb_cdc_union_descriptor_t *)desc; 357 data_ifaceno = ud->bSlaveInterface[0]; 358 break; 359 case UDESCSUB_MBIM: 360 md = (const struct mbim_descriptor *)desc; 361 v = UGETW(md->bcdMBIMVersion); 362 sc->sc_ver_maj = MBIM_VER_MAJOR(v); 363 sc->sc_ver_min = MBIM_VER_MINOR(v); 364 sc->sc_ctrl_len = UGETW(md->wMaxControlMessage); 365 /* Never trust a USB device! Could try to exploit us */ 366 if (sc->sc_ctrl_len < MBIM_CTRLMSG_MINLEN || 367 sc->sc_ctrl_len > MBIM_CTRLMSG_MAXLEN) { 368 DPRINTF("%s: control message len %d out of " 369 "bounds [%d .. %d]\n", DEVNAM(sc), 370 sc->sc_ctrl_len, MBIM_CTRLMSG_MINLEN, 371 MBIM_CTRLMSG_MAXLEN); 372 /* cont. anyway */ 373 } 374 sc->sc_maxpktlen = UGETW(md->wMaxSegmentSize); 375 DPRINTFN(2, "%s: ctrl_len=%d, maxpktlen=%d, cap=0x%x\n", 376 DEVNAM(sc), sc->sc_ctrl_len, sc->sc_maxpktlen, 377 md->bmNetworkCapabilities); 378 break; 379 default: 380 break; 381 } 382 } 383 if (sc->sc_ver_maj < 0) { 384 aprint_error_dev(self, "missing MBIM descriptor\n"); 385 goto fail; 386 } 387 388 aprint_normal_dev(self, "version %d.%d\n", sc->sc_ver_maj, 389 sc->sc_ver_min); 390 391 if (usb_lookup(umb_fccauth_devs, uiaa->uiaa_vendor, uiaa->uiaa_product)) { 392 sc->sc_flags |= UMBFLG_FCC_AUTH_REQUIRED; 393 sc->sc_cid = -1; 394 } 395 396 for (i = 0; i < uiaa->uiaa_nifaces; i++) { 397 id = usbd_get_interface_descriptor(uiaa->uiaa_ifaces[i]); 398 if (id != NULL && id->bInterfaceNumber == data_ifaceno) { 399 sc->sc_data_iface = uiaa->uiaa_ifaces[i]; 400 } 401 } 402 if (sc->sc_data_iface == NULL) { 403 aprint_error_dev(self, "no data interface found\n"); 404 goto fail; 405 } 406 407 /* 408 * If this is a combined NCM/MBIM function, switch to 409 * alternate setting one to enable MBIM. 410 */ 411 id = usbd_get_interface_descriptor(uiaa->uiaa_iface); 412 if (id->bInterfaceClass == UICLASS_CDC && 413 id->bInterfaceSubClass == 414 UISUBCLASS_NETWORK_CONTROL_MODEL) 415 usbd_set_interface(uiaa->uiaa_iface, 1); 416 417 id = usbd_get_interface_descriptor(uiaa->uiaa_iface); 418 ctrl_ep = -1; 419 for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) { 420 ed = usbd_interface2endpoint_descriptor(uiaa->uiaa_iface, i); 421 if (ed == NULL) 422 break; 423 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT && 424 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) 425 ctrl_ep = ed->bEndpointAddress; 426 } 427 if (ctrl_ep == -1) { 428 aprint_error_dev(self, "missing interrupt endpoint\n"); 429 goto fail; 430 } 431 432 /* 433 * For the MBIM Data Interface, select the appropriate 434 * alternate setting by looking for a matching descriptor that 435 * has two endpoints. 436 */ 437 cd = usbd_get_config_descriptor(sc->sc_udev); 438 altnum = usbd_get_no_alts(cd, data_ifaceno); 439 for (i = 0; i < altnum; i++) { 440 id = usbd_find_idesc(cd, sc->sc_data_iface->ui_index, i); 441 if (id == NULL) 442 continue; 443 if (id->bInterfaceClass == UICLASS_CDC_DATA && 444 id->bInterfaceSubClass == UISUBCLASS_DATA && 445 id->bInterfaceProtocol == UIPROTO_DATA_MBIM && 446 id->bNumEndpoints == 2) 447 break; 448 } 449 if (i == altnum || id == NULL) { 450 aprint_error_dev(self, "missing alt setting for interface #%d\n", 451 data_ifaceno); 452 goto fail; 453 } 454 status = usbd_set_interface(sc->sc_data_iface, i); 455 if (status) { 456 aprint_error_dev(self, "select alt setting %d for interface #%d " 457 "failed: %s\n", i, data_ifaceno, usbd_errstr(status)); 458 goto fail; 459 } 460 461 id = usbd_get_interface_descriptor(sc->sc_data_iface); 462 sc->sc_rx_ep = sc->sc_tx_ep = -1; 463 for (i = 0; i < id->bNumEndpoints; i++) { 464 if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface, 465 i)) == NULL) 466 break; 467 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK && 468 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) 469 sc->sc_rx_ep = ed->bEndpointAddress; 470 else if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK && 471 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT) 472 sc->sc_tx_ep = ed->bEndpointAddress; 473 } 474 if (sc->sc_rx_ep == -1 || sc->sc_tx_ep == -1) { 475 aprint_error_dev(self, "missing bulk endpoints\n"); 476 goto fail; 477 } 478 479 DPRINTFN(2, "%s: ctrl-ifno#%d: ep-ctrl=%d, data-ifno#%d: ep-rx=%d, " 480 "ep-tx=%d\n", DEVNAM(sc), sc->sc_ctrl_ifaceno, 481 UE_GET_ADDR(ctrl_ep), data_ifaceno, 482 UE_GET_ADDR(sc->sc_rx_ep), UE_GET_ADDR(sc->sc_tx_ep)); 483 484 usb_init_task(&sc->sc_umb_task, umb_state_task, sc, 485 0); 486 usb_init_task(&sc->sc_get_response_task, umb_get_response_task, sc, 487 0); 488 callout_init(&sc->sc_statechg_timer, 0); 489 callout_setfunc(&sc->sc_statechg_timer, umb_statechg_timeout, sc); 490 491 if (usbd_open_pipe_intr(uiaa->uiaa_iface, ctrl_ep, USBD_SHORT_XFER_OK, 492 &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof(sc->sc_intr_msg), 493 umb_intr, USBD_DEFAULT_INTERVAL)) { 494 aprint_error_dev(self, "failed to open control pipe\n"); 495 goto fail; 496 } 497 498 sc->sc_resp_buf = kmem_alloc(sc->sc_ctrl_len, KM_SLEEP); 499 sc->sc_ctrl_msg = kmem_alloc(sc->sc_ctrl_len, KM_SLEEP); 500 501 sc->sc_info.regstate = MBIM_REGSTATE_UNKNOWN; 502 sc->sc_info.pin_attempts_left = UMB_VALUE_UNKNOWN; 503 sc->sc_info.rssi = UMB_VALUE_UNKNOWN; 504 sc->sc_info.ber = UMB_VALUE_UNKNOWN; 505 506 umb_ncm_setup(sc); 507 DPRINTFN(2, "%s: rx/tx size %d/%d\n", DEVNAM(sc), 508 sc->sc_rx_bufsz, sc->sc_tx_bufsz); 509 510 s = splnet(); 511 512 /* initialize the interface */ 513 ifp = GET_IFP(sc); 514 ifp->if_softc = sc; 515 ifp->if_flags = IFF_SIMPLEX | IFF_MULTICAST | IFF_POINTOPOINT; 516 ifp->if_ioctl = umb_ioctl; 517 ifp->if_start = umb_start; 518 519 ifp->if_watchdog = umb_watchdog; 520 strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ); 521 ifp->if_link_state = LINK_STATE_DOWN; 522 ifmedia_init(&sc->sc_im, 0, umb_mediachange, umb_mediastatus); 523 524 ifp->if_type = IFT_MBIM; 525 ifp->if_addrlen = 0; 526 ifp->if_hdrlen = sizeof(struct ncm_header16) + 527 sizeof(struct ncm_pointer16); 528 ifp->if_mtu = 1500; /* use a common default */ 529 ifp->if_mtu = sc->sc_maxpktlen; 530 ifp->if_output = umb_output; 531 ifp->_if_input = umb_input; 532 IFQ_SET_READY(&ifp->if_snd); 533 534 /* attach the interface */ 535 rv = if_initialize(ifp); 536 if (rv != 0) { 537 aprint_error_dev(self, "if_initialize failed(%d)\n", rv); 538 splx(s); 539 return; 540 } 541 if_register(ifp); 542 if_alloc_sadl(ifp); 543 544 bpf_attach(ifp, DLT_RAW, 0); 545 rnd_attach_source(&sc->sc_rnd_source, device_xname(sc->sc_dev), 546 RND_TYPE_NET, RND_FLAG_DEFAULT); 547 548 /* 549 * Open the device now so that we are able to query device information. 550 * XXX maybe close when done? 551 */ 552 umb_open(sc); 553 554 sc->sc_attached = 1; 555 splx(s); 556 557 usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev); 558 559 if (!pmf_device_register(self, NULL, NULL)) 560 aprint_error_dev(self, "couldn't establish power handler\n"); 561 562 return; 563 564 fail: 565 umb_activate(sc->sc_dev, DVACT_DEACTIVATE); 566 return; 567 } 568 569 Static int 570 umb_detach(device_t self, int flags) 571 { 572 struct umb_softc *sc = (struct umb_softc *)self; 573 struct ifnet *ifp = GET_IFP(sc); 574 int s; 575 576 pmf_device_deregister(self); 577 578 s = splnet(); 579 if (ifp->if_flags & IFF_RUNNING) 580 umb_down(sc, 1); 581 umb_close(sc); 582 583 usb_rem_task_wait(sc->sc_udev, &sc->sc_get_response_task, 584 USB_TASKQ_DRIVER, NULL); 585 sc->sc_nresp = 0; 586 if (sc->sc_rx_ep != -1 && sc->sc_tx_ep != -1) { 587 callout_destroy(&sc->sc_statechg_timer); 588 usb_rem_task_wait(sc->sc_udev, &sc->sc_umb_task, 589 USB_TASKQ_DRIVER, NULL); 590 } 591 if (sc->sc_ctrl_pipe) { 592 usbd_close_pipe(sc->sc_ctrl_pipe); 593 sc->sc_ctrl_pipe = NULL; 594 } 595 if (sc->sc_ctrl_msg) { 596 kmem_free(sc->sc_ctrl_msg, sc->sc_ctrl_len); 597 sc->sc_ctrl_msg = NULL; 598 } 599 if (sc->sc_resp_buf) { 600 kmem_free(sc->sc_resp_buf, sc->sc_ctrl_len); 601 sc->sc_resp_buf = NULL; 602 } 603 if (ifp->if_softc) { 604 ifmedia_delete_instance(&sc->sc_im, IFM_INST_ANY); 605 } 606 if (sc->sc_attached) { 607 rnd_detach_source(&sc->sc_rnd_source); 608 bpf_detach(ifp); 609 if_detach(ifp); 610 } 611 612 sc->sc_attached = 0; 613 splx(s); 614 return 0; 615 } 616 617 Static int 618 umb_activate(device_t self, enum devact act) 619 { 620 struct umb_softc *sc = device_private(self); 621 622 switch (act) { 623 case DVACT_DEACTIVATE: 624 if_deactivate(GET_IFP(sc)); 625 sc->sc_dying = 1; 626 return 0; 627 default: 628 return EOPNOTSUPP; 629 } 630 } 631 632 Static void 633 umb_ncm_setup(struct umb_softc *sc) 634 { 635 usb_device_request_t req; 636 struct ncm_ntb_parameters np; 637 638 /* Query NTB tranfers sizes */ 639 req.bmRequestType = UT_READ_CLASS_INTERFACE; 640 req.bRequest = NCM_GET_NTB_PARAMETERS; 641 USETW(req.wValue, 0); 642 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 643 USETW(req.wLength, sizeof(np)); 644 if (usbd_do_request(sc->sc_udev, &req, &np) == USBD_NORMAL_COMPLETION && 645 UGETW(np.wLength) == sizeof(np)) { 646 sc->sc_rx_bufsz = UGETDW(np.dwNtbInMaxSize); 647 sc->sc_tx_bufsz = UGETDW(np.dwNtbOutMaxSize); 648 } else 649 sc->sc_rx_bufsz = sc->sc_tx_bufsz = 8 * 1024; 650 } 651 652 Static int 653 umb_alloc_xfers(struct umb_softc *sc) 654 { 655 int err = 0; 656 657 if (!sc->sc_rx_xfer) { 658 err |= usbd_create_xfer(sc->sc_rx_pipe, 659 sc->sc_rx_bufsz, 660 0, 0, &sc->sc_rx_xfer); 661 } 662 if (!sc->sc_tx_xfer) { 663 err |= usbd_create_xfer(sc->sc_tx_pipe, 664 sc->sc_tx_bufsz, 665 0, 0, &sc->sc_tx_xfer); 666 } 667 if (err) 668 return err; 669 670 sc->sc_rx_buf = usbd_get_buffer(sc->sc_rx_xfer); 671 sc->sc_tx_buf = usbd_get_buffer(sc->sc_tx_xfer); 672 673 return 0; 674 } 675 676 Static void 677 umb_free_xfers(struct umb_softc *sc) 678 { 679 if (sc->sc_rx_xfer) { 680 /* implicit usbd_free_buffer() */ 681 usbd_destroy_xfer(sc->sc_rx_xfer); 682 sc->sc_rx_xfer = NULL; 683 sc->sc_rx_buf = NULL; 684 } 685 if (sc->sc_tx_xfer) { 686 usbd_destroy_xfer(sc->sc_tx_xfer); 687 sc->sc_tx_xfer = NULL; 688 sc->sc_tx_buf = NULL; 689 } 690 if (sc->sc_tx_m) { 691 m_freem(sc->sc_tx_m); 692 sc->sc_tx_m = NULL; 693 } 694 } 695 696 Static int 697 umb_alloc_bulkpipes(struct umb_softc *sc) 698 { 699 struct ifnet *ifp = GET_IFP(sc); 700 int rv; 701 702 if (!(ifp->if_flags & IFF_RUNNING)) { 703 if ((rv = usbd_open_pipe(sc->sc_data_iface, sc->sc_rx_ep, 704 USBD_EXCLUSIVE_USE, &sc->sc_rx_pipe))) { 705 DPRINTFN(4, "usbd_open_pipe() failed (RX) %d\n", rv); 706 return 0; 707 } 708 if ((rv = usbd_open_pipe(sc->sc_data_iface, sc->sc_tx_ep, 709 USBD_EXCLUSIVE_USE, &sc->sc_tx_pipe))) { 710 DPRINTFN(4, "usbd_open_pipe() failed (TX) %d\n", rv); 711 return 0; 712 } 713 714 if ((rv = umb_alloc_xfers(sc)) != 0) { 715 DPRINTFN(4, "umb_alloc_xfers() failed %d\n", rv); 716 return 0; 717 } 718 719 ifp->if_flags |= IFF_RUNNING; 720 ifp->if_flags &= ~IFF_OACTIVE; 721 umb_rx(sc); 722 } 723 return 1; 724 } 725 726 Static void 727 umb_close_bulkpipes(struct umb_softc *sc) 728 { 729 struct ifnet *ifp = GET_IFP(sc); 730 731 ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE); 732 ifp->if_timer = 0; 733 if (sc->sc_rx_pipe) { 734 usbd_close_pipe(sc->sc_rx_pipe); 735 sc->sc_rx_pipe = NULL; 736 } 737 if (sc->sc_tx_pipe) { 738 usbd_close_pipe(sc->sc_tx_pipe); 739 sc->sc_tx_pipe = NULL; 740 } 741 } 742 743 Static int 744 umb_ioctl(struct ifnet *ifp, u_long cmd, void *data) 745 { 746 struct umb_softc *sc = ifp->if_softc; 747 struct ifaddr *ifa = (struct ifaddr *)data; 748 struct ifreq *ifr = (struct ifreq *)data; 749 int s, error = 0; 750 struct umb_parameter mp; 751 752 if (sc->sc_dying) 753 return EIO; 754 755 s = splnet(); 756 switch (cmd) { 757 case SIOCINITIFADDR: 758 ifp->if_flags |= IFF_UP; 759 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 760 switch (ifa->ifa_addr->sa_family) { 761 #ifdef INET 762 case AF_INET: 763 break; 764 #endif /* INET */ 765 #ifdef INET6 766 case AF_INET6: 767 break; 768 #endif /* INET6 */ 769 default: 770 error = EAFNOSUPPORT; 771 break; 772 } 773 ifa->ifa_rtrequest = p2p_rtrequest; 774 break; 775 case SIOCSIFFLAGS: 776 error = ifioctl_common(ifp, cmd, data); 777 if (error) 778 break; 779 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 780 break; 781 case SIOCGUMBINFO: 782 error = copyout(&sc->sc_info, ifr->ifr_data, 783 sizeof(sc->sc_info)); 784 break; 785 case SIOCSUMBPARAM: 786 error = kauth_authorize_network(curlwp->l_cred, 787 KAUTH_NETWORK_INTERFACE, 788 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, KAUTH_ARG(cmd), 789 NULL); 790 if (error) 791 break; 792 793 if ((error = copyin(ifr->ifr_data, &mp, sizeof(mp))) != 0) 794 break; 795 796 if ((error = umb_setpin(sc, mp.op, mp.is_puk, mp.pin, mp.pinlen, 797 mp.newpin, mp.newpinlen)) != 0) 798 break; 799 800 if (mp.apnlen < 0 || mp.apnlen > sizeof(sc->sc_info.apn)) { 801 error = EINVAL; 802 break; 803 } 804 sc->sc_roaming = mp.roaming ? 1 : 0; 805 memset(sc->sc_info.apn, 0, sizeof(sc->sc_info.apn)); 806 memcpy(sc->sc_info.apn, mp.apn, mp.apnlen); 807 sc->sc_info.apnlen = mp.apnlen; 808 memset(sc->sc_info.username, 0, sizeof(sc->sc_info.username)); 809 memcpy(sc->sc_info.username, mp.username, mp.usernamelen); 810 sc->sc_info.usernamelen = mp.usernamelen; 811 memset(sc->sc_info.password, 0, sizeof(sc->sc_info.password)); 812 memcpy(sc->sc_info.password, mp.password, mp.passwordlen); 813 sc->sc_info.passwordlen = mp.passwordlen; 814 sc->sc_info.preferredclasses = mp.preferredclasses; 815 umb_setdataclass(sc); 816 break; 817 case SIOCGUMBPARAM: 818 memset(&mp, 0, sizeof(mp)); 819 memcpy(mp.apn, sc->sc_info.apn, sc->sc_info.apnlen); 820 mp.apnlen = sc->sc_info.apnlen; 821 mp.roaming = sc->sc_roaming; 822 mp.preferredclasses = sc->sc_info.preferredclasses; 823 error = copyout(&mp, ifr->ifr_data, sizeof(mp)); 824 break; 825 case SIOCSIFMTU: 826 /* Does this include the NCM headers and tail? */ 827 if (ifr->ifr_mtu > ifp->if_mtu) { 828 error = EINVAL; 829 break; 830 } 831 ifp->if_mtu = ifr->ifr_mtu; 832 break; 833 case SIOCSIFADDR: 834 case SIOCAIFADDR: 835 case SIOCSIFDSTADDR: 836 case SIOCADDMULTI: 837 case SIOCDELMULTI: 838 break; 839 case SIOCGIFMEDIA: 840 error = ifmedia_ioctl(ifp, ifr, &sc->sc_im, cmd); 841 break; 842 default: 843 error = ifioctl_common(ifp, cmd, data); 844 break; 845 } 846 splx(s); 847 return error; 848 } 849 850 Static int 851 umb_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 852 const struct rtentry *rtp) 853 { 854 int error; 855 856 DPRINTFN(10, "%s: %s: enter\n", 857 device_xname(((struct umb_softc *)ifp->if_softc)->sc_dev), 858 __func__); 859 860 /* 861 * if the queueing discipline needs packet classification, 862 * do it now. 863 */ 864 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family); 865 866 /* 867 * Queue message on interface, and start output if interface 868 * not yet active. 869 */ 870 error = if_transmit_lock(ifp, m); 871 872 return error; 873 } 874 875 Static void 876 umb_input(struct ifnet *ifp, struct mbuf *m) 877 { 878 size_t pktlen = m->m_len; 879 int s; 880 881 if ((ifp->if_flags & IFF_UP) == 0) { 882 m_freem(m); 883 return; 884 } 885 if (pktlen < sizeof(struct ip)) { 886 ifp->if_ierrors++; 887 DPRINTFN(4, "%s: dropping short packet (len %zd)\n", __func__, 888 pktlen); 889 m_freem(m); 890 return; 891 } 892 s = splnet(); 893 if (__predict_false(!pktq_enqueue(ip_pktq, m, 0))) { 894 ifp->if_iqdrops++; 895 m_freem(m); 896 } else { 897 ifp->if_ipackets++; 898 ifp->if_ibytes += pktlen; 899 } 900 splx(s); 901 } 902 903 Static void 904 umb_start(struct ifnet *ifp) 905 { 906 struct umb_softc *sc = ifp->if_softc; 907 struct mbuf *m_head = NULL; 908 909 if (sc->sc_dying || (ifp->if_flags & IFF_OACTIVE)) 910 return; 911 912 IFQ_POLL(&ifp->if_snd, m_head); 913 if (m_head == NULL) 914 return; 915 916 if (!umb_encap(sc, m_head)) { 917 ifp->if_flags |= IFF_OACTIVE; 918 return; 919 } 920 IFQ_DEQUEUE(&ifp->if_snd, m_head); 921 922 bpf_mtap(ifp, m_head, BPF_D_OUT); 923 924 ifp->if_flags |= IFF_OACTIVE; 925 ifp->if_timer = (2 * umb_xfer_tout) / 1000; 926 } 927 928 Static void 929 umb_watchdog(struct ifnet *ifp) 930 { 931 struct umb_softc *sc = ifp->if_softc; 932 933 if (sc->sc_dying) 934 return; 935 936 ifp->if_oerrors++; 937 printf("%s: watchdog timeout\n", DEVNAM(sc)); 938 usbd_abort_pipe(sc->sc_tx_pipe); 939 return; 940 } 941 942 Static void 943 umb_statechg_timeout(void *arg) 944 { 945 struct umb_softc *sc = arg; 946 947 if (sc->sc_info.regstate != MBIM_REGSTATE_ROAMING || sc->sc_roaming) 948 printf("%s: state change timeout\n",DEVNAM(sc)); 949 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 950 } 951 952 Static int 953 umb_mediachange(struct ifnet * ifp) 954 { 955 return 0; 956 } 957 958 Static void 959 umb_mediastatus(struct ifnet * ifp, struct ifmediareq * imr) 960 { 961 switch (ifp->if_link_state) { 962 case LINK_STATE_UP: 963 imr->ifm_status = IFM_AVALID | IFM_ACTIVE; 964 break; 965 case LINK_STATE_DOWN: 966 imr->ifm_status = IFM_AVALID; 967 break; 968 default: 969 imr->ifm_status = 0; 970 break; 971 } 972 } 973 974 Static void 975 umb_newstate(struct umb_softc *sc, enum umb_state newstate, int flags) 976 { 977 struct ifnet *ifp = GET_IFP(sc); 978 979 if (newstate == sc->sc_state) 980 return; 981 if (((flags & UMB_NS_DONT_DROP) && newstate < sc->sc_state) || 982 ((flags & UMB_NS_DONT_RAISE) && newstate > sc->sc_state)) 983 return; 984 if (ifp->if_flags & IFF_DEBUG) 985 log(LOG_DEBUG, "%s: state going %s from '%s' to '%s'\n", 986 DEVNAM(sc), newstate > sc->sc_state ? "up" : "down", 987 umb_istate(sc->sc_state), umb_istate(newstate)); 988 sc->sc_state = newstate; 989 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 990 } 991 992 Static void 993 umb_state_task(void *arg) 994 { 995 struct umb_softc *sc = arg; 996 struct ifnet *ifp = GET_IFP(sc); 997 struct ifreq ifr; 998 int s; 999 int state; 1000 1001 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) { 1002 /* 1003 * Query the registration state until we're with the home 1004 * network again. 1005 */ 1006 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, NULL, 0); 1007 return; 1008 } 1009 1010 s = splnet(); 1011 if (ifp->if_flags & IFF_UP) 1012 umb_up(sc); 1013 else 1014 umb_down(sc, 0); 1015 1016 state = sc->sc_state == UMB_S_UP ? LINK_STATE_UP : LINK_STATE_DOWN; 1017 if (ifp->if_link_state != state) { 1018 if (ifp->if_flags & IFF_DEBUG) 1019 log(LOG_DEBUG, "%s: link state changed from %s to %s\n", 1020 DEVNAM(sc), 1021 (ifp->if_link_state == LINK_STATE_UP) 1022 ? "up" : "down", 1023 (state == LINK_STATE_UP) ? "up" : "down"); 1024 ifp->if_link_state = state; 1025 if (state != LINK_STATE_UP) { 1026 /* 1027 * Purge any existing addresses 1028 */ 1029 memset(sc->sc_info.ipv4dns, 0, 1030 sizeof(sc->sc_info.ipv4dns)); 1031 if (in_control(NULL, SIOCGIFADDR, &ifr, ifp) == 0 && 1032 satosin(&ifr.ifr_addr)->sin_addr.s_addr != 1033 INADDR_ANY) { 1034 in_control(NULL, SIOCDIFADDR, &ifr, ifp); 1035 } 1036 } 1037 if_link_state_change(ifp, state); 1038 } 1039 splx(s); 1040 } 1041 1042 Static void 1043 umb_up(struct umb_softc *sc) 1044 { 1045 switch (sc->sc_state) { 1046 case UMB_S_DOWN: 1047 DPRINTF("%s: init: opening ...\n", DEVNAM(sc)); 1048 umb_open(sc); 1049 break; 1050 case UMB_S_OPEN: 1051 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED) { 1052 if (sc->sc_cid == -1) { 1053 DPRINTF("%s: init: allocating CID ...\n", 1054 DEVNAM(sc)); 1055 umb_allocate_cid(sc); 1056 break; 1057 } else 1058 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP); 1059 } else { 1060 DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc)); 1061 umb_radio(sc, 1); 1062 break; 1063 } 1064 /*FALLTHROUGH*/ 1065 case UMB_S_CID: 1066 DPRINTF("%s: init: sending FCC auth ...\n", DEVNAM(sc)); 1067 umb_send_fcc_auth(sc); 1068 break; 1069 case UMB_S_RADIO: 1070 DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc)); 1071 umb_cmd(sc, MBIM_CID_SUBSCRIBER_READY_STATUS, MBIM_CMDOP_QRY, 1072 NULL, 0); 1073 break; 1074 case UMB_S_SIMREADY: 1075 DPRINTF("%s: init: attaching ...\n", DEVNAM(sc)); 1076 umb_packet_service(sc, 1); 1077 break; 1078 case UMB_S_ATTACHED: 1079 sc->sc_tx_seq = 0; 1080 DPRINTF("%s: init: connecting ...\n", DEVNAM(sc)); 1081 umb_connect(sc); 1082 break; 1083 case UMB_S_CONNECTED: 1084 DPRINTF("%s: init: getting IP config ...\n", DEVNAM(sc)); 1085 umb_qry_ipconfig(sc); 1086 break; 1087 case UMB_S_UP: 1088 DPRINTF("%s: init: reached state UP\n", DEVNAM(sc)); 1089 if (!umb_alloc_bulkpipes(sc)) { 1090 printf("%s: opening bulk pipes failed\n", DEVNAM(sc)); 1091 umb_down(sc, 1); 1092 } 1093 break; 1094 } 1095 if (sc->sc_state < UMB_S_UP) 1096 callout_schedule(&sc->sc_statechg_timer, 1097 UMB_STATE_CHANGE_TIMEOUT * hz); 1098 else 1099 callout_stop(&sc->sc_statechg_timer); 1100 return; 1101 } 1102 1103 Static void 1104 umb_down(struct umb_softc *sc, int force) 1105 { 1106 umb_close_bulkpipes(sc); 1107 if (sc->sc_state < UMB_S_CONNECTED) 1108 umb_free_xfers(sc); 1109 1110 switch (sc->sc_state) { 1111 case UMB_S_UP: 1112 case UMB_S_CONNECTED: 1113 DPRINTF("%s: stop: disconnecting ...\n", DEVNAM(sc)); 1114 umb_disconnect(sc); 1115 if (!force) 1116 break; 1117 /*FALLTHROUGH*/ 1118 case UMB_S_ATTACHED: 1119 DPRINTF("%s: stop: detaching ...\n", DEVNAM(sc)); 1120 umb_packet_service(sc, 0); 1121 if (!force) 1122 break; 1123 /*FALLTHROUGH*/ 1124 case UMB_S_SIMREADY: 1125 case UMB_S_RADIO: 1126 DPRINTF("%s: stop: turning radio off ...\n", DEVNAM(sc)); 1127 umb_radio(sc, 0); 1128 if (!force) 1129 break; 1130 /*FALLTHROUGH*/ 1131 case UMB_S_CID: 1132 case UMB_S_OPEN: 1133 case UMB_S_DOWN: 1134 /* Do not close the device */ 1135 DPRINTF("%s: stop: reached state DOWN\n", DEVNAM(sc)); 1136 break; 1137 } 1138 if (force) 1139 sc->sc_state = UMB_S_OPEN; 1140 1141 if (sc->sc_state > UMB_S_OPEN) 1142 callout_schedule(&sc->sc_statechg_timer, 1143 UMB_STATE_CHANGE_TIMEOUT * hz); 1144 else 1145 callout_stop(&sc->sc_statechg_timer); 1146 } 1147 1148 Static void 1149 umb_get_response_task(void *arg) 1150 { 1151 struct umb_softc *sc = arg; 1152 int len; 1153 int s; 1154 1155 /* 1156 * Function is required to send on RESPONSE_AVAILABLE notification for 1157 * each encapsulated response that is to be processed by the host. 1158 * But of course, we can receive multiple notifications before the 1159 * response task is run. 1160 */ 1161 s = splusb(); 1162 while (sc->sc_nresp > 0) { 1163 --sc->sc_nresp; 1164 len = sc->sc_ctrl_len; 1165 if (umb_get_encap_response(sc, sc->sc_resp_buf, &len)) 1166 umb_decode_response(sc, sc->sc_resp_buf, len); 1167 } 1168 splx(s); 1169 } 1170 1171 Static void 1172 umb_decode_response(struct umb_softc *sc, void *response, int len) 1173 { 1174 struct mbim_msghdr *hdr = response; 1175 struct mbim_fragmented_msg_hdr *fraghdr; 1176 uint32_t type; 1177 1178 DPRINTFN(3, "%s: got response: len %d\n", DEVNAM(sc), len); 1179 DDUMPN(4, response, len); 1180 1181 if (len < sizeof(*hdr) || le32toh(hdr->len) != len) { 1182 /* 1183 * We should probably cancel a transaction, but since the 1184 * message is too short, we cannot decode the transaction 1185 * id (tid) and hence don't know, whom to cancel. Must wait 1186 * for the timeout. 1187 */ 1188 DPRINTF("%s: received short response (len %d)\n", 1189 DEVNAM(sc), len); 1190 return; 1191 } 1192 1193 /* 1194 * XXX FIXME: if message is fragmented, store it until last frag 1195 * is received and then re-assemble all fragments. 1196 */ 1197 type = le32toh(hdr->type); 1198 switch (type) { 1199 case MBIM_INDICATE_STATUS_MSG: 1200 case MBIM_COMMAND_DONE: 1201 fraghdr = response; 1202 if (le32toh(fraghdr->frag.nfrag) != 1) { 1203 DPRINTF("%s: discarding fragmented messages\n", 1204 DEVNAM(sc)); 1205 return; 1206 } 1207 break; 1208 default: 1209 break; 1210 } 1211 1212 DPRINTF("%s: <- rcv %s (tid %u)\n", DEVNAM(sc), umb_request2str(type), 1213 le32toh(hdr->tid)); 1214 switch (type) { 1215 case MBIM_FUNCTION_ERROR_MSG: 1216 case MBIM_HOST_ERROR_MSG: 1217 { 1218 struct mbim_f2h_hosterr *e; 1219 int err; 1220 1221 if (len >= sizeof(*e)) { 1222 e = response; 1223 err = le32toh(e->err); 1224 1225 DPRINTF("%s: %s message, error %s (tid %u)\n", 1226 DEVNAM(sc), umb_request2str(type), 1227 umb_error2str(err), le32toh(hdr->tid)); 1228 if (err == MBIM_ERROR_NOT_OPENED) 1229 umb_newstate(sc, UMB_S_DOWN, 0); 1230 } 1231 break; 1232 } 1233 case MBIM_INDICATE_STATUS_MSG: 1234 umb_handle_indicate_status_msg(sc, response, len); 1235 break; 1236 case MBIM_OPEN_DONE: 1237 umb_handle_opendone_msg(sc, response, len); 1238 break; 1239 case MBIM_CLOSE_DONE: 1240 umb_handle_closedone_msg(sc, response, len); 1241 break; 1242 case MBIM_COMMAND_DONE: 1243 umb_command_done(sc, response, len); 1244 break; 1245 default: 1246 DPRINTF("%s: discard message %s\n", DEVNAM(sc), 1247 umb_request2str(type)); 1248 break; 1249 } 1250 } 1251 1252 Static void 1253 umb_handle_indicate_status_msg(struct umb_softc *sc, void *data, int len) 1254 { 1255 struct mbim_f2h_indicate_status *m = data; 1256 uint32_t infolen; 1257 uint32_t cid; 1258 1259 if (len < sizeof(*m)) { 1260 DPRINTF("%s: discard short %s message\n", DEVNAM(sc), 1261 umb_request2str(le32toh(m->hdr.type))); 1262 return; 1263 } 1264 if (memcmp(m->devid, umb_uuid_basic_connect, sizeof(m->devid))) { 1265 DPRINTF("%s: discard %s message for other UUID '%s'\n", 1266 DEVNAM(sc), umb_request2str(le32toh(m->hdr.type)), 1267 umb_uuid2str(m->devid)); 1268 return; 1269 } 1270 infolen = le32toh(m->infolen); 1271 if (len < sizeof(*m) + infolen) { 1272 DPRINTF("%s: discard truncated %s message (want %d, got %d)\n", 1273 DEVNAM(sc), umb_request2str(le32toh(m->hdr.type)), 1274 (int)sizeof(*m) + infolen, len); 1275 return; 1276 } 1277 1278 cid = le32toh(m->cid); 1279 DPRINTF("%s: indicate %s status\n", DEVNAM(sc), umb_cid2str(cid)); 1280 umb_decode_cid(sc, cid, m->info, infolen); 1281 } 1282 1283 Static void 1284 umb_handle_opendone_msg(struct umb_softc *sc, void *data, int len) 1285 { 1286 struct mbim_f2h_openclosedone *resp = data; 1287 struct ifnet *ifp = GET_IFP(sc); 1288 uint32_t status; 1289 1290 status = le32toh(resp->status); 1291 if (status == MBIM_STATUS_SUCCESS) { 1292 if (sc->sc_maxsessions == 0) { 1293 umb_cmd(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_QRY, NULL, 1294 0); 1295 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_QRY, NULL, 0); 1296 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, 1297 NULL, 0); 1298 } 1299 umb_newstate(sc, UMB_S_OPEN, UMB_NS_DONT_DROP); 1300 } else if (ifp->if_flags & IFF_DEBUG) 1301 log(LOG_ERR, "%s: open error: %s\n", DEVNAM(sc), 1302 umb_status2str(status)); 1303 return; 1304 } 1305 1306 Static void 1307 umb_handle_closedone_msg(struct umb_softc *sc, void *data, int len) 1308 { 1309 struct mbim_f2h_openclosedone *resp = data; 1310 uint32_t status; 1311 1312 status = le32toh(resp->status); 1313 if (status == MBIM_STATUS_SUCCESS) 1314 umb_newstate(sc, UMB_S_DOWN, 0); 1315 else 1316 DPRINTF("%s: close error: %s\n", DEVNAM(sc), 1317 umb_status2str(status)); 1318 return; 1319 } 1320 1321 static inline void 1322 umb_getinfobuf(char *in, int inlen, uint32_t offs, uint32_t sz, 1323 void *out, size_t outlen) 1324 { 1325 offs = le32toh(offs); 1326 sz = le32toh(sz); 1327 if (inlen >= offs + sz) { 1328 memset(out, 0, outlen); 1329 memcpy(out, in + offs, MIN(sz, outlen)); 1330 } 1331 } 1332 1333 static inline int 1334 umb_padding(void *data, int len, size_t sz) 1335 { 1336 char *p = data; 1337 int np = 0; 1338 1339 while (len < sz && (len % 4) != 0) { 1340 *p++ = '\0'; 1341 len++; 1342 np++; 1343 } 1344 return np; 1345 } 1346 1347 static inline int 1348 umb_addstr(void *buf, size_t bufsz, int *offs, void *str, int slen, 1349 uint32_t *offsmember, uint32_t *sizemember) 1350 { 1351 if (*offs + slen > bufsz) 1352 return 0; 1353 1354 *sizemember = htole32((uint32_t)slen); 1355 if (slen && str) { 1356 *offsmember = htole32((uint32_t)*offs); 1357 memcpy((char *)buf + *offs, str, slen); 1358 *offs += slen; 1359 *offs += umb_padding(buf, *offs, bufsz); 1360 } else 1361 *offsmember = htole32(0); 1362 return 1; 1363 } 1364 1365 static void 1366 umb_in_len2mask(struct in_addr *mask, int len) 1367 { 1368 int i; 1369 u_char *p; 1370 1371 p = (u_char *)mask; 1372 memset(mask, 0, sizeof(*mask)); 1373 for (i = 0; i < len / 8; i++) 1374 p[i] = 0xff; 1375 if (len % 8) 1376 p[i] = (0xff00 >> (len % 8)) & 0xff; 1377 } 1378 1379 Static int 1380 umb_decode_register_state(struct umb_softc *sc, void *data, int len) 1381 { 1382 struct mbim_cid_registration_state_info *rs = data; 1383 struct ifnet *ifp = GET_IFP(sc); 1384 1385 if (len < sizeof(*rs)) 1386 return 0; 1387 sc->sc_info.nwerror = le32toh(rs->nwerror); 1388 sc->sc_info.regstate = le32toh(rs->regstate); 1389 sc->sc_info.regmode = le32toh(rs->regmode); 1390 sc->sc_info.cellclass = le32toh(rs->curcellclass); 1391 1392 /* XXX should we remember the provider_id? */ 1393 umb_getinfobuf(data, len, rs->provname_offs, rs->provname_size, 1394 sc->sc_info.provider, sizeof(sc->sc_info.provider)); 1395 umb_getinfobuf(data, len, rs->roamingtxt_offs, rs->roamingtxt_size, 1396 sc->sc_info.roamingtxt, sizeof(sc->sc_info.roamingtxt)); 1397 1398 DPRINTFN(2, "%s: %s, availclass 0x%x, class 0x%x, regmode %d\n", 1399 DEVNAM(sc), umb_regstate(sc->sc_info.regstate), 1400 le32toh(rs->availclasses), sc->sc_info.cellclass, 1401 sc->sc_info.regmode); 1402 1403 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && 1404 !sc->sc_roaming && 1405 sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED) { 1406 if (ifp->if_flags & IFF_DEBUG) 1407 log(LOG_INFO, 1408 "%s: disconnecting from roaming network\n", 1409 DEVNAM(sc)); 1410 umb_disconnect(sc); 1411 } 1412 return 1; 1413 } 1414 1415 Static int 1416 umb_decode_devices_caps(struct umb_softc *sc, void *data, int len) 1417 { 1418 struct mbim_cid_device_caps *dc = data; 1419 1420 if (len < sizeof(*dc)) 1421 return 0; 1422 sc->sc_maxsessions = le32toh(dc->max_sessions); 1423 sc->sc_info.supportedclasses = le32toh(dc->dataclass); 1424 umb_getinfobuf(data, len, dc->devid_offs, dc->devid_size, 1425 sc->sc_info.devid, sizeof(sc->sc_info.devid)); 1426 umb_getinfobuf(data, len, dc->fwinfo_offs, dc->fwinfo_size, 1427 sc->sc_info.fwinfo, sizeof(sc->sc_info.fwinfo)); 1428 umb_getinfobuf(data, len, dc->hwinfo_offs, dc->hwinfo_size, 1429 sc->sc_info.hwinfo, sizeof(sc->sc_info.hwinfo)); 1430 DPRINTFN(2, "%s: max sessions %d, supported classes 0x%x\n", 1431 DEVNAM(sc), sc->sc_maxsessions, sc->sc_info.supportedclasses); 1432 return 1; 1433 } 1434 1435 Static int 1436 umb_decode_subscriber_status(struct umb_softc *sc, void *data, int len) 1437 { 1438 struct mbim_cid_subscriber_ready_info *si = data; 1439 struct ifnet *ifp = GET_IFP(sc); 1440 int npn; 1441 1442 if (len < sizeof(*si)) 1443 return 0; 1444 sc->sc_info.sim_state = le32toh(si->ready); 1445 1446 umb_getinfobuf(data, len, si->sid_offs, si->sid_size, 1447 sc->sc_info.sid, sizeof(sc->sc_info.sid)); 1448 umb_getinfobuf(data, len, si->icc_offs, si->icc_size, 1449 sc->sc_info.iccid, sizeof(sc->sc_info.iccid)); 1450 1451 npn = le32toh(si->no_pn); 1452 if (npn > 0) 1453 umb_getinfobuf(data, len, si->pn[0].offs, si->pn[0].size, 1454 sc->sc_info.pn, sizeof(sc->sc_info.pn)); 1455 else 1456 memset(sc->sc_info.pn, 0, sizeof(sc->sc_info.pn)); 1457 1458 if (sc->sc_info.sim_state == MBIM_SIMSTATE_LOCKED) 1459 sc->sc_info.pin_state = UMB_PUK_REQUIRED; 1460 if (ifp->if_flags & IFF_DEBUG) 1461 log(LOG_INFO, "%s: SIM %s\n", DEVNAM(sc), 1462 umb_simstate(sc->sc_info.sim_state)); 1463 if (sc->sc_info.sim_state == MBIM_SIMSTATE_INITIALIZED) 1464 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_DROP); 1465 return 1; 1466 } 1467 1468 Static int 1469 umb_decode_radio_state(struct umb_softc *sc, void *data, int len) 1470 { 1471 struct mbim_cid_radio_state_info *rs = data; 1472 struct ifnet *ifp = GET_IFP(sc); 1473 1474 if (len < sizeof(*rs)) 1475 return 0; 1476 1477 sc->sc_info.hw_radio_on = 1478 (le32toh(rs->hw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0; 1479 sc->sc_info.sw_radio_on = 1480 (le32toh(rs->sw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0; 1481 if (!sc->sc_info.hw_radio_on) { 1482 printf("%s: radio is disabled by hardware switch\n", 1483 DEVNAM(sc)); 1484 /* 1485 * XXX do we need a time to poll the state of the rfkill switch 1486 * or will the device send an unsolicited notification 1487 * in case the state changes? 1488 */ 1489 umb_newstate(sc, UMB_S_OPEN, 0); 1490 } else if (!sc->sc_info.sw_radio_on) { 1491 if (ifp->if_flags & IFF_DEBUG) 1492 log(LOG_INFO, "%s: radio is off\n", DEVNAM(sc)); 1493 umb_newstate(sc, UMB_S_OPEN, 0); 1494 } else 1495 umb_newstate(sc, UMB_S_RADIO, UMB_NS_DONT_DROP); 1496 return 1; 1497 } 1498 1499 Static int 1500 umb_decode_pin(struct umb_softc *sc, void *data, int len) 1501 { 1502 struct mbim_cid_pin_info *pi = data; 1503 struct ifnet *ifp = GET_IFP(sc); 1504 uint32_t attempts_left; 1505 1506 if (len < sizeof(*pi)) 1507 return 0; 1508 1509 attempts_left = le32toh(pi->remaining_attempts); 1510 if (attempts_left != 0xffffffff) 1511 sc->sc_info.pin_attempts_left = attempts_left; 1512 1513 switch (le32toh(pi->state)) { 1514 case MBIM_PIN_STATE_UNLOCKED: 1515 sc->sc_info.pin_state = UMB_PIN_UNLOCKED; 1516 break; 1517 case MBIM_PIN_STATE_LOCKED: 1518 switch (le32toh(pi->type)) { 1519 case MBIM_PIN_TYPE_PIN1: 1520 sc->sc_info.pin_state = UMB_PIN_REQUIRED; 1521 break; 1522 case MBIM_PIN_TYPE_PUK1: 1523 sc->sc_info.pin_state = UMB_PUK_REQUIRED; 1524 break; 1525 case MBIM_PIN_TYPE_PIN2: 1526 case MBIM_PIN_TYPE_PUK2: 1527 /* Assume that PIN1 was accepted */ 1528 sc->sc_info.pin_state = UMB_PIN_UNLOCKED; 1529 break; 1530 } 1531 break; 1532 } 1533 if (ifp->if_flags & IFF_DEBUG) 1534 log(LOG_INFO, "%s: %s state %s (%d attempts left)\n", 1535 DEVNAM(sc), umb_pin_type(le32toh(pi->type)), 1536 (le32toh(pi->state) == MBIM_PIN_STATE_UNLOCKED) ? 1537 "unlocked" : "locked", 1538 le32toh(pi->remaining_attempts)); 1539 1540 /* 1541 * In case the PIN was set after IFF_UP, retrigger the state machine 1542 */ 1543 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER); 1544 return 1; 1545 } 1546 1547 Static int 1548 umb_decode_packet_service(struct umb_softc *sc, void *data, int len) 1549 { 1550 struct mbim_cid_packet_service_info *psi = data; 1551 int state, highestclass; 1552 uint64_t up_speed, down_speed; 1553 struct ifnet *ifp = GET_IFP(sc); 1554 1555 if (len < sizeof(*psi)) 1556 return 0; 1557 1558 sc->sc_info.nwerror = le32toh(psi->nwerror); 1559 state = le32toh(psi->state); 1560 highestclass = le32toh(psi->highest_dataclass); 1561 up_speed = le64toh(psi->uplink_speed); 1562 down_speed = le64toh(psi->downlink_speed); 1563 if (sc->sc_info.packetstate != state || 1564 sc->sc_info.uplink_speed != up_speed || 1565 sc->sc_info.downlink_speed != down_speed) { 1566 if (ifp->if_flags & IFF_DEBUG) { 1567 log(LOG_INFO, "%s: packet service ", DEVNAM(sc)); 1568 if (sc->sc_info.packetstate != state) 1569 addlog("changed from %s to ", 1570 umb_packet_state(sc->sc_info.packetstate)); 1571 addlog("%s, class %s, speed: %" PRIu64 " up / %" PRIu64 " down\n", 1572 umb_packet_state(state), 1573 umb_dataclass(highestclass), up_speed, down_speed); 1574 } 1575 } 1576 sc->sc_info.packetstate = state; 1577 sc->sc_info.highestclass = highestclass; 1578 sc->sc_info.uplink_speed = up_speed; 1579 sc->sc_info.downlink_speed = down_speed; 1580 1581 if (sc->sc_info.regmode == MBIM_REGMODE_AUTOMATIC) { 1582 /* 1583 * For devices using automatic registration mode, just proceed, 1584 * once registration has completed. 1585 */ 1586 if (ifp->if_flags & IFF_UP) { 1587 switch (sc->sc_info.regstate) { 1588 case MBIM_REGSTATE_HOME: 1589 case MBIM_REGSTATE_ROAMING: 1590 case MBIM_REGSTATE_PARTNER: 1591 umb_newstate(sc, UMB_S_ATTACHED, 1592 UMB_NS_DONT_DROP); 1593 break; 1594 default: 1595 break; 1596 } 1597 } else 1598 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE); 1599 } else switch (sc->sc_info.packetstate) { 1600 case MBIM_PKTSERVICE_STATE_ATTACHED: 1601 umb_newstate(sc, UMB_S_ATTACHED, UMB_NS_DONT_DROP); 1602 break; 1603 case MBIM_PKTSERVICE_STATE_DETACHED: 1604 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE); 1605 break; 1606 } 1607 return 1; 1608 } 1609 1610 Static int 1611 umb_decode_signal_state(struct umb_softc *sc, void *data, int len) 1612 { 1613 struct mbim_cid_signal_state *ss = data; 1614 struct ifnet *ifp = GET_IFP(sc); 1615 int rssi; 1616 1617 if (len < sizeof(*ss)) 1618 return 0; 1619 1620 if (le32toh(ss->rssi) == 99) 1621 rssi = UMB_VALUE_UNKNOWN; 1622 else { 1623 rssi = -113 + 2 * le32toh(ss->rssi); 1624 if ((ifp->if_flags & IFF_DEBUG) && sc->sc_info.rssi != rssi && 1625 sc->sc_state >= UMB_S_CONNECTED) 1626 log(LOG_INFO, "%s: rssi %d dBm\n", DEVNAM(sc), rssi); 1627 } 1628 sc->sc_info.rssi = rssi; 1629 sc->sc_info.ber = le32toh(ss->err_rate); 1630 if (sc->sc_info.ber == -99) 1631 sc->sc_info.ber = UMB_VALUE_UNKNOWN; 1632 return 1; 1633 } 1634 1635 Static int 1636 umb_decode_connect_info(struct umb_softc *sc, void *data, int len) 1637 { 1638 struct mbim_cid_connect_info *ci = data; 1639 struct ifnet *ifp = GET_IFP(sc); 1640 int act; 1641 1642 if (len < sizeof(*ci)) 1643 return 0; 1644 1645 if (le32toh(ci->sessionid) != umb_session_id) { 1646 DPRINTF("%s: discard connection info for session %u\n", 1647 DEVNAM(sc), le32toh(ci->sessionid)); 1648 return 1; 1649 } 1650 if (memcmp(ci->context, umb_uuid_context_internet, 1651 sizeof(ci->context))) { 1652 DPRINTF("%s: discard connection info for other context\n", 1653 DEVNAM(sc)); 1654 return 1; 1655 } 1656 act = le32toh(ci->activation); 1657 if (sc->sc_info.activation != act) { 1658 if (ifp->if_flags & IFF_DEBUG) 1659 log(LOG_INFO, "%s: connection %s\n", DEVNAM(sc), 1660 umb_activation(act)); 1661 if ((ifp->if_flags & IFF_DEBUG) && 1662 le32toh(ci->iptype) != MBIM_CONTEXT_IPTYPE_DEFAULT && 1663 le32toh(ci->iptype) != MBIM_CONTEXT_IPTYPE_IPV4) 1664 log(LOG_DEBUG, "%s: got iptype %d connection\n", 1665 DEVNAM(sc), le32toh(ci->iptype)); 1666 1667 sc->sc_info.activation = act; 1668 sc->sc_info.nwerror = le32toh(ci->nwerror); 1669 1670 if (sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED) 1671 umb_newstate(sc, UMB_S_CONNECTED, UMB_NS_DONT_DROP); 1672 else if (sc->sc_info.activation == 1673 MBIM_ACTIVATION_STATE_DEACTIVATED) 1674 umb_newstate(sc, UMB_S_ATTACHED, 0); 1675 /* else: other states are purely transitional */ 1676 } 1677 return 1; 1678 } 1679 1680 Static int 1681 umb_decode_ip_configuration(struct umb_softc *sc, void *data, int len) 1682 { 1683 struct mbim_cid_ip_configuration_info *ic = data; 1684 struct ifnet *ifp = GET_IFP(sc); 1685 int s; 1686 uint32_t avail; 1687 uint32_t val; 1688 int n, i; 1689 int off; 1690 struct mbim_cid_ipv4_element ipv4elem; 1691 struct in_aliasreq ifra; 1692 struct sockaddr_in *sin; 1693 int state = -1; 1694 int rv; 1695 1696 if (len < sizeof(*ic)) 1697 return 0; 1698 if (le32toh(ic->sessionid) != umb_session_id) { 1699 DPRINTF("%s: ignore IP configuration for session id %d\n", 1700 DEVNAM(sc), le32toh(ic->sessionid)); 1701 return 0; 1702 } 1703 s = splnet(); 1704 1705 /* 1706 * IPv4 configuration 1707 */ 1708 avail = le32toh(ic->ipv4_available); 1709 if (avail & MBIM_IPCONF_HAS_ADDRINFO) { 1710 n = le32toh(ic->ipv4_naddr); 1711 off = le32toh(ic->ipv4_addroffs); 1712 1713 if (n == 0 || off + sizeof(ipv4elem) > len) 1714 goto done; 1715 1716 /* Only pick the first one */ 1717 memcpy(&ipv4elem, (char *)data + off, sizeof(ipv4elem)); 1718 ipv4elem.prefixlen = le32toh(ipv4elem.prefixlen); 1719 1720 memset(&ifra, 0, sizeof(ifra)); 1721 sin = (struct sockaddr_in *)&ifra.ifra_addr; 1722 sin->sin_family = AF_INET; 1723 sin->sin_len = sizeof(ifra.ifra_addr); 1724 sin->sin_addr.s_addr = ipv4elem.addr; 1725 1726 sin = (struct sockaddr_in *)&ifra.ifra_dstaddr; 1727 sin->sin_family = AF_INET; 1728 sin->sin_len = sizeof(ifra.ifra_dstaddr); 1729 if (avail & MBIM_IPCONF_HAS_GWINFO) { 1730 off = le32toh(ic->ipv4_gwoffs); 1731 sin->sin_addr.s_addr = *((uint32_t *)((char *)data + off)); 1732 } 1733 1734 sin = (struct sockaddr_in *)&ifra.ifra_mask; 1735 sin->sin_family = AF_INET; 1736 sin->sin_len = sizeof(ifra.ifra_mask); 1737 umb_in_len2mask(&sin->sin_addr, ipv4elem.prefixlen); 1738 1739 rv = in_control(NULL, SIOCAIFADDR, &ifra, ifp); 1740 if (rv == 0) { 1741 if (ifp->if_flags & IFF_DEBUG) 1742 log(LOG_INFO, "%s: IPv4 addr %s, mask %s, " 1743 "gateway %s\n", device_xname(sc->sc_dev), 1744 umb_ntop(sintosa(&ifra.ifra_addr)), 1745 umb_ntop(sintosa(&ifra.ifra_mask)), 1746 umb_ntop(sintosa(&ifra.ifra_dstaddr))); 1747 state = UMB_S_UP; 1748 } else 1749 printf("%s: unable to set IPv4 address, error %d\n", 1750 device_xname(sc->sc_dev), rv); 1751 } 1752 1753 memset(sc->sc_info.ipv4dns, 0, sizeof(sc->sc_info.ipv4dns)); 1754 if (avail & MBIM_IPCONF_HAS_DNSINFO) { 1755 n = le32toh(ic->ipv4_ndnssrv); 1756 off = le32toh(ic->ipv4_dnssrvoffs); 1757 i = 0; 1758 while (n-- > 0) { 1759 if (off + sizeof(uint32_t) > len) 1760 break; 1761 val = *((uint32_t *)((char *)data + off)); 1762 if (i < UMB_MAX_DNSSRV) 1763 sc->sc_info.ipv4dns[i++] = val; 1764 off += sizeof(uint32_t); 1765 } 1766 } 1767 1768 if ((avail & MBIM_IPCONF_HAS_MTUINFO)) { 1769 val = le32toh(ic->ipv4_mtu); 1770 if (ifp->if_mtu != val && val <= sc->sc_maxpktlen) { 1771 ifp->if_mtu = val; 1772 if (ifp->if_mtu > val) 1773 ifp->if_mtu = val; 1774 if (ifp->if_flags & IFF_DEBUG) 1775 log(LOG_INFO, "%s: MTU %d\n", DEVNAM(sc), val); 1776 } 1777 } 1778 1779 avail = le32toh(ic->ipv6_available); 1780 if ((ifp->if_flags & IFF_DEBUG) && avail & MBIM_IPCONF_HAS_ADDRINFO) { 1781 /* XXX FIXME: IPv6 configuration missing */ 1782 log(LOG_INFO, "%s: ignoring IPv6 configuration\n", DEVNAM(sc)); 1783 } 1784 if (state != -1) 1785 umb_newstate(sc, state, 0); 1786 1787 done: 1788 splx(s); 1789 return 1; 1790 } 1791 1792 Static void 1793 umb_rx(struct umb_softc *sc) 1794 { 1795 usbd_setup_xfer(sc->sc_rx_xfer, sc, sc->sc_rx_buf, 1796 sc->sc_rx_bufsz, USBD_SHORT_XFER_OK, 1797 USBD_NO_TIMEOUT, umb_rxeof); 1798 usbd_transfer(sc->sc_rx_xfer); 1799 } 1800 1801 Static void 1802 umb_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status) 1803 { 1804 struct umb_softc *sc = priv; 1805 struct ifnet *ifp = GET_IFP(sc); 1806 1807 if (sc->sc_dying || !(ifp->if_flags & IFF_RUNNING)) 1808 return; 1809 1810 if (status != USBD_NORMAL_COMPLETION) { 1811 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED) 1812 return; 1813 DPRINTF("%s: rx error: %s\n", DEVNAM(sc), usbd_errstr(status)); 1814 if (status == USBD_STALLED) 1815 usbd_clear_endpoint_stall_async(sc->sc_rx_pipe); 1816 if (++sc->sc_rx_nerr > 100) { 1817 log(LOG_ERR, "%s: too many rx errors, disabling\n", 1818 DEVNAM(sc)); 1819 umb_activate(sc->sc_dev, DVACT_DEACTIVATE); 1820 } 1821 } else { 1822 sc->sc_rx_nerr = 0; 1823 umb_decap(sc, xfer); 1824 } 1825 1826 umb_rx(sc); 1827 return; 1828 } 1829 1830 Static int 1831 umb_encap(struct umb_softc *sc, struct mbuf *m) 1832 { 1833 struct ncm_header16 *hdr; 1834 struct ncm_pointer16 *ptr; 1835 usbd_status err; 1836 int len; 1837 1838 /* All size constraints have been validated by the caller! */ 1839 hdr = (struct ncm_header16 *)sc->sc_tx_buf; 1840 ptr = (struct ncm_pointer16 *)(hdr + 1); 1841 USETDW(hdr->dwSignature, NCM_HDR16_SIG); 1842 USETW(hdr->wHeaderLength, sizeof(*hdr)); 1843 USETW(hdr->wSequence, sc->sc_tx_seq); 1844 sc->sc_tx_seq++; 1845 1846 len = m->m_pkthdr.len; 1847 1848 USETDW(ptr->dwSignature, MBIM_NCM_NTH16_SIG(umb_session_id)); 1849 USETW(ptr->wLength, sizeof(*ptr)); 1850 USETW(ptr->wNextNdpIndex, 0); 1851 USETW(ptr->dgram[0].wDatagramIndex, MBIM_HDR16_LEN); 1852 USETW(ptr->dgram[0].wDatagramLen, len); 1853 USETW(ptr->dgram[1].wDatagramIndex, 0); 1854 USETW(ptr->dgram[1].wDatagramLen, 0); 1855 1856 KASSERT(len <= sc->sc_tx_bufsz - sizeof(*hdr) - sizeof(*ptr)); 1857 m_copydata(m, 0, len, ptr + 1); 1858 sc->sc_tx_m = m; 1859 len += MBIM_HDR16_LEN; 1860 USETW(hdr->wBlockLength, len); 1861 1862 DPRINTFN(3, "%s: encap %d bytes\n", DEVNAM(sc), len); 1863 DDUMPN(5, sc->sc_tx_buf, len); 1864 usbd_setup_xfer(sc->sc_tx_xfer, sc, sc->sc_tx_buf, len, 1865 USBD_FORCE_SHORT_XFER, umb_xfer_tout, umb_txeof); 1866 err = usbd_transfer(sc->sc_tx_xfer); 1867 if (err != USBD_IN_PROGRESS) { 1868 DPRINTF("%s: start tx error: %s\n", DEVNAM(sc), 1869 usbd_errstr(err)); 1870 return 0; 1871 } 1872 return 1; 1873 } 1874 1875 Static void 1876 umb_txeof(struct usbd_xfer *xfer, void *priv, usbd_status status) 1877 { 1878 struct umb_softc *sc = priv; 1879 struct ifnet *ifp = GET_IFP(sc); 1880 int s; 1881 1882 s = splnet(); 1883 ifp->if_flags &= ~IFF_OACTIVE; 1884 ifp->if_timer = 0; 1885 1886 m_freem(sc->sc_tx_m); 1887 sc->sc_tx_m = NULL; 1888 1889 if (status != USBD_NORMAL_COMPLETION) { 1890 if (status != USBD_NOT_STARTED && status != USBD_CANCELLED) { 1891 ifp->if_oerrors++; 1892 DPRINTF("%s: tx error: %s\n", DEVNAM(sc), 1893 usbd_errstr(status)); 1894 if (status == USBD_STALLED) 1895 usbd_clear_endpoint_stall_async(sc->sc_tx_pipe); 1896 } 1897 } 1898 if (IFQ_IS_EMPTY(&ifp->if_snd) == 0) 1899 umb_start(ifp); 1900 1901 splx(s); 1902 } 1903 1904 Static void 1905 umb_decap(struct umb_softc *sc, struct usbd_xfer *xfer) 1906 { 1907 struct ifnet *ifp = GET_IFP(sc); 1908 int s; 1909 char *buf; 1910 uint32_t len; 1911 char *dp; 1912 struct ncm_header16 *hdr16; 1913 struct ncm_header32 *hdr32; 1914 struct ncm_pointer16 *ptr16; 1915 struct ncm_pointer16_dgram *dgram16; 1916 struct ncm_pointer32_dgram *dgram32; 1917 uint32_t hsig, psig; 1918 int hlen, blen; 1919 int ptrlen, ptroff, dgentryoff; 1920 uint32_t doff, dlen; 1921 struct mbuf *m; 1922 1923 usbd_get_xfer_status(xfer, NULL, (void **)&buf, &len, NULL); 1924 DPRINTFN(4, "%s: recv %d bytes\n", DEVNAM(sc), len); 1925 DDUMPN(5, buf, len); 1926 s = splnet(); 1927 if (len < sizeof(*hdr16)) 1928 goto toosmall; 1929 1930 hdr16 = (struct ncm_header16 *)buf; 1931 hsig = UGETDW(hdr16->dwSignature); 1932 hlen = UGETW(hdr16->wHeaderLength); 1933 if (len < hlen) 1934 goto toosmall; 1935 if (len > sc->sc_rx_bufsz) { 1936 DPRINTF("%s: packet too large (%d)\n", DEVNAM(sc), len); 1937 goto fail; 1938 } 1939 switch (hsig) { 1940 case NCM_HDR16_SIG: 1941 blen = UGETW(hdr16->wBlockLength); 1942 ptroff = UGETW(hdr16->wNdpIndex); 1943 if (hlen != sizeof(*hdr16)) { 1944 DPRINTF("%s: bad header len %d for NTH16 (exp %zu)\n", 1945 DEVNAM(sc), hlen, sizeof(*hdr16)); 1946 goto fail; 1947 } 1948 break; 1949 case NCM_HDR32_SIG: 1950 hdr32 = (struct ncm_header32 *)hdr16; 1951 blen = UGETDW(hdr32->dwBlockLength); 1952 ptroff = UGETDW(hdr32->dwNdpIndex); 1953 if (hlen != sizeof(*hdr32)) { 1954 DPRINTF("%s: bad header len %d for NTH32 (exp %zu)\n", 1955 DEVNAM(sc), hlen, sizeof(*hdr32)); 1956 goto fail; 1957 } 1958 break; 1959 default: 1960 DPRINTF("%s: unsupported NCM header signature (0x%08x)\n", 1961 DEVNAM(sc), hsig); 1962 goto fail; 1963 } 1964 if (len < blen) { 1965 DPRINTF("%s: bad NTB len (%d) for %d bytes of data\n", 1966 DEVNAM(sc), blen, len); 1967 goto fail; 1968 } 1969 1970 ptr16 = (struct ncm_pointer16 *)(buf + ptroff); 1971 psig = UGETDW(ptr16->dwSignature); 1972 ptrlen = UGETW(ptr16->wLength); 1973 if (len < ptrlen + ptroff) 1974 goto toosmall; 1975 if (!MBIM_NCM_NTH16_ISISG(psig) && !MBIM_NCM_NTH32_ISISG(psig)) { 1976 DPRINTF("%s: unsupported NCM pointer signature (0x%08x)\n", 1977 DEVNAM(sc), psig); 1978 goto fail; 1979 } 1980 1981 switch (hsig) { 1982 case NCM_HDR16_SIG: 1983 dgentryoff = offsetof(struct ncm_pointer16, dgram); 1984 break; 1985 case NCM_HDR32_SIG: 1986 dgentryoff = offsetof(struct ncm_pointer32, dgram); 1987 break; 1988 default: 1989 goto fail; 1990 } 1991 1992 while (dgentryoff < ptrlen) { 1993 switch (hsig) { 1994 case NCM_HDR16_SIG: 1995 if (ptroff + dgentryoff < sizeof(*dgram16)) 1996 goto done; 1997 dgram16 = (struct ncm_pointer16_dgram *) 1998 (buf + ptroff + dgentryoff); 1999 dgentryoff += sizeof(*dgram16); 2000 dlen = UGETW(dgram16->wDatagramLen); 2001 doff = UGETW(dgram16->wDatagramIndex); 2002 break; 2003 case NCM_HDR32_SIG: 2004 if (ptroff + dgentryoff < sizeof(*dgram32)) 2005 goto done; 2006 dgram32 = (struct ncm_pointer32_dgram *) 2007 (buf + ptroff + dgentryoff); 2008 dgentryoff += sizeof(*dgram32); 2009 dlen = UGETDW(dgram32->dwDatagramLen); 2010 doff = UGETDW(dgram32->dwDatagramIndex); 2011 break; 2012 default: 2013 ifp->if_ierrors++; 2014 goto done; 2015 } 2016 2017 /* Terminating zero entry */ 2018 if (dlen == 0 || doff == 0) 2019 break; 2020 if (len < dlen + doff) { 2021 /* Skip giant datagram but continue processing */ 2022 DPRINTF("%s: datagram too large (%d @ off %d)\n", 2023 DEVNAM(sc), dlen, doff); 2024 continue; 2025 } 2026 2027 dp = buf + doff; 2028 DPRINTFN(3, "%s: decap %d bytes\n", DEVNAM(sc), dlen); 2029 m = m_devget(dp, dlen, 0, ifp); 2030 if (m == NULL) { 2031 ifp->if_iqdrops++; 2032 continue; 2033 } 2034 2035 if_percpuq_enqueue((ifp)->if_percpuq, (m)); 2036 } 2037 done: 2038 splx(s); 2039 return; 2040 toosmall: 2041 DPRINTF("%s: packet too small (%d)\n", DEVNAM(sc), len); 2042 fail: 2043 ifp->if_ierrors++; 2044 splx(s); 2045 } 2046 2047 Static usbd_status 2048 umb_send_encap_command(struct umb_softc *sc, void *data, int len) 2049 { 2050 struct usbd_xfer *xfer; 2051 usb_device_request_t req; 2052 char *buf; 2053 2054 if (len > sc->sc_ctrl_len) 2055 return USBD_INVAL; 2056 2057 if (usbd_create_xfer(sc->sc_udev->ud_pipe0, len, 0, 0, &xfer) != 0) 2058 return USBD_NOMEM; 2059 buf = usbd_get_buffer(xfer); 2060 memcpy(buf, data, len); 2061 2062 /* XXX FIXME: if (total len > sc->sc_ctrl_len) => must fragment */ 2063 req.bmRequestType = UT_WRITE_CLASS_INTERFACE; 2064 req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND; 2065 USETW(req.wValue, 0); 2066 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 2067 USETW(req.wLength, len); 2068 DELAY(umb_delay); 2069 return usbd_request_async(sc->sc_udev, xfer, &req, NULL, NULL); 2070 } 2071 2072 Static int 2073 umb_get_encap_response(struct umb_softc *sc, void *buf, int *len) 2074 { 2075 usb_device_request_t req; 2076 usbd_status err; 2077 2078 req.bmRequestType = UT_READ_CLASS_INTERFACE; 2079 req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE; 2080 USETW(req.wValue, 0); 2081 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 2082 USETW(req.wLength, *len); 2083 /* XXX FIXME: re-assemble fragments */ 2084 2085 DELAY(umb_delay); 2086 err = usbd_do_request_flags(sc->sc_udev, &req, buf, USBD_SHORT_XFER_OK, 2087 len, umb_xfer_tout); 2088 if (err == USBD_NORMAL_COMPLETION) 2089 return 1; 2090 DPRINTF("%s: ctrl recv: %s\n", DEVNAM(sc), usbd_errstr(err)); 2091 return 0; 2092 } 2093 2094 Static void 2095 umb_ctrl_msg(struct umb_softc *sc, uint32_t req, void *data, int len) 2096 { 2097 struct ifnet *ifp = GET_IFP(sc); 2098 uint32_t tid; 2099 struct mbim_msghdr *hdr = data; 2100 usbd_status err; 2101 int s; 2102 2103 if (sc->sc_dying) 2104 return; 2105 if (len < sizeof(*hdr)) 2106 return; 2107 tid = ++sc->sc_tid; 2108 2109 hdr->type = htole32(req); 2110 hdr->len = htole32(len); 2111 hdr->tid = htole32(tid); 2112 2113 #ifdef UMB_DEBUG 2114 if (umb_debug) { 2115 const char *op, *str; 2116 if (req == MBIM_COMMAND_MSG) { 2117 struct mbim_h2f_cmd *c = data; 2118 if (le32toh(c->op) == MBIM_CMDOP_SET) 2119 op = "set"; 2120 else 2121 op = "qry"; 2122 str = umb_cid2str(le32toh(c->cid)); 2123 } else { 2124 op = "snd"; 2125 str = umb_request2str(req); 2126 } 2127 DPRINTF("%s: -> %s %s (tid %u)\n", DEVNAM(sc), op, str, tid); 2128 } 2129 #endif 2130 s = splusb(); 2131 err = umb_send_encap_command(sc, data, len); 2132 splx(s); 2133 if (err != USBD_NORMAL_COMPLETION) { 2134 if (ifp->if_flags & IFF_DEBUG) 2135 log(LOG_ERR, "%s: send %s msg (tid %u) failed: %s\n", 2136 DEVNAM(sc), umb_request2str(req), tid, 2137 usbd_errstr(err)); 2138 2139 /* will affect other transactions, too */ 2140 usbd_abort_pipe(sc->sc_udev->ud_pipe0); 2141 } else { 2142 DPRINTFN(2, "%s: sent %s (tid %u)\n", DEVNAM(sc), 2143 umb_request2str(req), tid); 2144 DDUMPN(3, data, len); 2145 } 2146 return; 2147 } 2148 2149 Static void 2150 umb_open(struct umb_softc *sc) 2151 { 2152 struct mbim_h2f_openmsg msg; 2153 2154 memset(&msg, 0, sizeof(msg)); 2155 msg.maxlen = htole32(sc->sc_ctrl_len); 2156 umb_ctrl_msg(sc, MBIM_OPEN_MSG, &msg, sizeof(msg)); 2157 return; 2158 } 2159 2160 Static void 2161 umb_close(struct umb_softc *sc) 2162 { 2163 struct mbim_h2f_closemsg msg; 2164 2165 memset(&msg, 0, sizeof(msg)); 2166 umb_ctrl_msg(sc, MBIM_CLOSE_MSG, &msg, sizeof(msg)); 2167 } 2168 2169 Static int 2170 umb_setpin(struct umb_softc *sc, int op, int is_puk, void *pin, int pinlen, 2171 void *newpin, int newpinlen) 2172 { 2173 struct mbim_cid_pin cp; 2174 int off; 2175 2176 if (pinlen == 0) 2177 return 0; 2178 if (pinlen < 0 || pinlen > MBIM_PIN_MAXLEN || 2179 newpinlen < 0 || newpinlen > MBIM_PIN_MAXLEN || 2180 op < 0 || op > MBIM_PIN_OP_CHANGE || 2181 (is_puk && op != MBIM_PIN_OP_ENTER)) 2182 return EINVAL; 2183 2184 memset(&cp, 0, sizeof(cp)); 2185 cp.type = htole32(is_puk ? MBIM_PIN_TYPE_PUK1 : MBIM_PIN_TYPE_PIN1); 2186 2187 off = offsetof(struct mbim_cid_pin, data); 2188 if (!umb_addstr(&cp, sizeof(cp), &off, pin, pinlen, 2189 &cp.pin_offs, &cp.pin_size)) 2190 return EINVAL; 2191 2192 cp.op = htole32(op); 2193 if (newpinlen) { 2194 if (!umb_addstr(&cp, sizeof(cp), &off, newpin, newpinlen, 2195 &cp.newpin_offs, &cp.newpin_size)) 2196 return EINVAL; 2197 } else { 2198 if ((op == MBIM_PIN_OP_CHANGE) || is_puk) 2199 return EINVAL; 2200 if (!umb_addstr(&cp, sizeof(cp), &off, NULL, 0, 2201 &cp.newpin_offs, &cp.newpin_size)) 2202 return EINVAL; 2203 } 2204 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_SET, &cp, off); 2205 return 0; 2206 } 2207 2208 Static void 2209 umb_setdataclass(struct umb_softc *sc) 2210 { 2211 struct mbim_cid_registration_state rs; 2212 uint32_t classes; 2213 2214 if (sc->sc_info.supportedclasses == MBIM_DATACLASS_NONE) 2215 return; 2216 2217 memset(&rs, 0, sizeof(rs)); 2218 rs.regaction = htole32(MBIM_REGACTION_AUTOMATIC); 2219 classes = sc->sc_info.supportedclasses; 2220 if (sc->sc_info.preferredclasses != MBIM_DATACLASS_NONE) 2221 classes &= sc->sc_info.preferredclasses; 2222 rs.data_class = htole32(classes); 2223 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_SET, &rs, sizeof(rs)); 2224 } 2225 2226 Static void 2227 umb_radio(struct umb_softc *sc, int on) 2228 { 2229 struct mbim_cid_radio_state s; 2230 2231 DPRINTF("%s: set radio %s\n", DEVNAM(sc), on ? "on" : "off"); 2232 memset(&s, 0, sizeof(s)); 2233 s.state = htole32(on ? MBIM_RADIO_STATE_ON : MBIM_RADIO_STATE_OFF); 2234 umb_cmd(sc, MBIM_CID_RADIO_STATE, MBIM_CMDOP_SET, &s, sizeof(s)); 2235 } 2236 2237 Static void 2238 umb_allocate_cid(struct umb_softc *sc) 2239 { 2240 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET, 2241 umb_qmi_alloc_cid, sizeof(umb_qmi_alloc_cid), umb_uuid_qmi_mbim); 2242 } 2243 2244 Static void 2245 umb_send_fcc_auth(struct umb_softc *sc) 2246 { 2247 uint8_t fccauth[sizeof(umb_qmi_fcc_auth)]; 2248 2249 if (sc->sc_cid == -1) { 2250 DPRINTF("%s: missing CID, cannot send FCC auth\n", DEVNAM(sc)); 2251 umb_allocate_cid(sc); 2252 return; 2253 } 2254 memcpy(fccauth, umb_qmi_fcc_auth, sizeof(fccauth)); 2255 fccauth[UMB_QMI_CID_OFFS] = sc->sc_cid; 2256 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET, 2257 fccauth, sizeof(fccauth), umb_uuid_qmi_mbim); 2258 } 2259 2260 Static void 2261 umb_packet_service(struct umb_softc *sc, int attach) 2262 { 2263 struct mbim_cid_packet_service s; 2264 2265 DPRINTF("%s: %s packet service\n", DEVNAM(sc), 2266 attach ? "attach" : "detach"); 2267 memset(&s, 0, sizeof(s)); 2268 s.action = htole32(attach ? 2269 MBIM_PKTSERVICE_ACTION_ATTACH : MBIM_PKTSERVICE_ACTION_DETACH); 2270 umb_cmd(sc, MBIM_CID_PACKET_SERVICE, MBIM_CMDOP_SET, &s, sizeof(s)); 2271 } 2272 2273 Static void 2274 umb_connect(struct umb_softc *sc) 2275 { 2276 struct ifnet *ifp = GET_IFP(sc); 2277 2278 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) { 2279 log(LOG_INFO, "%s: connection disabled in roaming network\n", 2280 DEVNAM(sc)); 2281 return; 2282 } 2283 if (ifp->if_flags & IFF_DEBUG) 2284 log(LOG_DEBUG, "%s: connecting ...\n", DEVNAM(sc)); 2285 umb_send_connect(sc, MBIM_CONNECT_ACTIVATE); 2286 } 2287 2288 Static void 2289 umb_disconnect(struct umb_softc *sc) 2290 { 2291 struct ifnet *ifp = GET_IFP(sc); 2292 2293 if (ifp->if_flags & IFF_DEBUG) 2294 log(LOG_DEBUG, "%s: disconnecting ...\n", DEVNAM(sc)); 2295 umb_send_connect(sc, MBIM_CONNECT_DEACTIVATE); 2296 } 2297 2298 Static void 2299 umb_send_connect(struct umb_softc *sc, int command) 2300 { 2301 struct mbim_cid_connect *c; 2302 int off; 2303 2304 /* Too large or the stack */ 2305 c = kmem_zalloc(sizeof(*c), KM_SLEEP); 2306 c->sessionid = htole32(umb_session_id); 2307 c->command = htole32(command); 2308 off = offsetof(struct mbim_cid_connect, data); 2309 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.apn, 2310 sc->sc_info.apnlen, &c->access_offs, &c->access_size)) 2311 goto done; 2312 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.username, 2313 sc->sc_info.usernamelen, &c->user_offs, &c->user_size)) 2314 goto done; 2315 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.password, 2316 sc->sc_info.passwordlen, &c->passwd_offs, &c->passwd_size)) 2317 goto done; 2318 c->authprot = htole32(MBIM_AUTHPROT_NONE); 2319 c->compression = htole32(MBIM_COMPRESSION_NONE); 2320 c->iptype = htole32(MBIM_CONTEXT_IPTYPE_IPV4); 2321 memcpy(c->context, umb_uuid_context_internet, sizeof(c->context)); 2322 umb_cmd(sc, MBIM_CID_CONNECT, MBIM_CMDOP_SET, c, off); 2323 done: 2324 kmem_free(c, sizeof(*c)); 2325 return; 2326 } 2327 2328 Static void 2329 umb_qry_ipconfig(struct umb_softc *sc) 2330 { 2331 struct mbim_cid_ip_configuration_info ipc; 2332 2333 memset(&ipc, 0, sizeof(ipc)); 2334 ipc.sessionid = htole32(umb_session_id); 2335 umb_cmd(sc, MBIM_CID_IP_CONFIGURATION, MBIM_CMDOP_QRY, 2336 &ipc, sizeof(ipc)); 2337 } 2338 2339 Static void 2340 umb_cmd(struct umb_softc *sc, int cid, int op, const void *data, int len) 2341 { 2342 umb_cmd1(sc, cid, op, data, len, umb_uuid_basic_connect); 2343 } 2344 2345 Static void 2346 umb_cmd1(struct umb_softc *sc, int cid, int op, const void *data, int len, 2347 uint8_t *uuid) 2348 { 2349 struct mbim_h2f_cmd *cmd; 2350 int totlen; 2351 2352 /* XXX FIXME support sending fragments */ 2353 if (sizeof(*cmd) + len > sc->sc_ctrl_len) { 2354 DPRINTF("%s: set %s msg too long: cannot send\n", 2355 DEVNAM(sc), umb_cid2str(cid)); 2356 return; 2357 } 2358 cmd = sc->sc_ctrl_msg; 2359 memset(cmd, 0, sizeof(*cmd)); 2360 cmd->frag.nfrag = htole32(1); 2361 memcpy(cmd->devid, uuid, sizeof(cmd->devid)); 2362 cmd->cid = htole32(cid); 2363 cmd->op = htole32(op); 2364 cmd->infolen = htole32(len); 2365 totlen = sizeof(*cmd); 2366 if (len > 0) { 2367 memcpy(cmd + 1, data, len); 2368 totlen += len; 2369 } 2370 umb_ctrl_msg(sc, MBIM_COMMAND_MSG, cmd, totlen); 2371 } 2372 2373 Static void 2374 umb_command_done(struct umb_softc *sc, void *data, int len) 2375 { 2376 struct mbim_f2h_cmddone *cmd = data; 2377 struct ifnet *ifp = GET_IFP(sc); 2378 uint32_t status; 2379 uint32_t cid; 2380 uint32_t infolen; 2381 int qmimsg = 0; 2382 2383 if (len < sizeof(*cmd)) { 2384 DPRINTF("%s: discard short %s message\n", DEVNAM(sc), 2385 umb_request2str(le32toh(cmd->hdr.type))); 2386 return; 2387 } 2388 cid = le32toh(cmd->cid); 2389 if (memcmp(cmd->devid, umb_uuid_basic_connect, sizeof(cmd->devid))) { 2390 if (memcmp(cmd->devid, umb_uuid_qmi_mbim, 2391 sizeof(cmd->devid))) { 2392 DPRINTF("%s: discard %s message for other UUID '%s'\n", 2393 DEVNAM(sc), umb_request2str(le32toh(cmd->hdr.type)), 2394 umb_uuid2str(cmd->devid)); 2395 return; 2396 } else 2397 qmimsg = 1; 2398 } 2399 2400 status = le32toh(cmd->status); 2401 switch (status) { 2402 case MBIM_STATUS_SUCCESS: 2403 break; 2404 case MBIM_STATUS_NOT_INITIALIZED: 2405 if (ifp->if_flags & IFF_DEBUG) 2406 log(LOG_ERR, "%s: SIM not initialized (PIN missing)\n", 2407 DEVNAM(sc)); 2408 return; 2409 case MBIM_STATUS_PIN_REQUIRED: 2410 sc->sc_info.pin_state = UMB_PIN_REQUIRED; 2411 /*FALLTHROUGH*/ 2412 default: 2413 if (ifp->if_flags & IFF_DEBUG) 2414 log(LOG_ERR, "%s: set/qry %s failed: %s\n", DEVNAM(sc), 2415 umb_cid2str(cid), umb_status2str(status)); 2416 return; 2417 } 2418 2419 infolen = le32toh(cmd->infolen); 2420 if (len < sizeof(*cmd) + infolen) { 2421 DPRINTF("%s: discard truncated %s message (want %d, got %d)\n", 2422 DEVNAM(sc), umb_cid2str(cid), 2423 (int)sizeof(*cmd) + infolen, len); 2424 return; 2425 } 2426 if (qmimsg) { 2427 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED) 2428 umb_decode_qmi(sc, cmd->info, infolen); 2429 } else { 2430 DPRINTFN(2, "%s: set/qry %s done\n", DEVNAM(sc), 2431 umb_cid2str(cid)); 2432 umb_decode_cid(sc, cid, cmd->info, infolen); 2433 } 2434 } 2435 2436 Static void 2437 umb_decode_cid(struct umb_softc *sc, uint32_t cid, void *data, int len) 2438 { 2439 int ok = 1; 2440 2441 switch (cid) { 2442 case MBIM_CID_DEVICE_CAPS: 2443 ok = umb_decode_devices_caps(sc, data, len); 2444 break; 2445 case MBIM_CID_SUBSCRIBER_READY_STATUS: 2446 ok = umb_decode_subscriber_status(sc, data, len); 2447 break; 2448 case MBIM_CID_RADIO_STATE: 2449 ok = umb_decode_radio_state(sc, data, len); 2450 break; 2451 case MBIM_CID_PIN: 2452 ok = umb_decode_pin(sc, data, len); 2453 break; 2454 case MBIM_CID_REGISTER_STATE: 2455 ok = umb_decode_register_state(sc, data, len); 2456 break; 2457 case MBIM_CID_PACKET_SERVICE: 2458 ok = umb_decode_packet_service(sc, data, len); 2459 break; 2460 case MBIM_CID_SIGNAL_STATE: 2461 ok = umb_decode_signal_state(sc, data, len); 2462 break; 2463 case MBIM_CID_CONNECT: 2464 ok = umb_decode_connect_info(sc, data, len); 2465 break; 2466 case MBIM_CID_IP_CONFIGURATION: 2467 ok = umb_decode_ip_configuration(sc, data, len); 2468 break; 2469 default: 2470 /* 2471 * Note: the above list is incomplete and only contains 2472 * mandatory CIDs from the BASIC_CONNECT set. 2473 * So alternate values are not unusual. 2474 */ 2475 DPRINTFN(4, "%s: ignore %s\n", DEVNAM(sc), umb_cid2str(cid)); 2476 break; 2477 } 2478 if (!ok) 2479 DPRINTF("%s: discard %s with bad info length %d\n", 2480 DEVNAM(sc), umb_cid2str(cid), len); 2481 return; 2482 } 2483 2484 Static void 2485 umb_decode_qmi(struct umb_softc *sc, uint8_t *data, int len) 2486 { 2487 uint8_t srv; 2488 uint16_t msg, tlvlen; 2489 uint32_t val; 2490 2491 #define UMB_QMI_QMUXLEN 6 2492 if (len < UMB_QMI_QMUXLEN) 2493 goto tooshort; 2494 2495 srv = data[4]; 2496 data += UMB_QMI_QMUXLEN; 2497 len -= UMB_QMI_QMUXLEN; 2498 2499 #define UMB_GET16(p) ((uint16_t)*p | (uint16_t)*(p + 1) << 8) 2500 #define UMB_GET32(p) ((uint32_t)*p | (uint32_t)*(p + 1) << 8 | \ 2501 (uint32_t)*(p + 2) << 16 |(uint32_t)*(p + 3) << 24) 2502 switch (srv) { 2503 case 0: /* ctl */ 2504 #define UMB_QMI_CTLLEN 6 2505 if (len < UMB_QMI_CTLLEN) 2506 goto tooshort; 2507 msg = UMB_GET16(&data[2]); 2508 tlvlen = UMB_GET16(&data[4]); 2509 data += UMB_QMI_CTLLEN; 2510 len -= UMB_QMI_CTLLEN; 2511 break; 2512 case 2: /* dms */ 2513 #define UMB_QMI_DMSLEN 7 2514 if (len < UMB_QMI_DMSLEN) 2515 goto tooshort; 2516 msg = UMB_GET16(&data[3]); 2517 tlvlen = UMB_GET16(&data[5]); 2518 data += UMB_QMI_DMSLEN; 2519 len -= UMB_QMI_DMSLEN; 2520 break; 2521 default: 2522 DPRINTF("%s: discard QMI message for unknown service type %d\n", 2523 DEVNAM(sc), srv); 2524 return; 2525 } 2526 2527 if (len < tlvlen) 2528 goto tooshort; 2529 2530 #define UMB_QMI_TLVLEN 3 2531 while (len > 0) { 2532 if (len < UMB_QMI_TLVLEN) 2533 goto tooshort; 2534 tlvlen = UMB_GET16(&data[1]); 2535 if (len < UMB_QMI_TLVLEN + tlvlen) 2536 goto tooshort; 2537 switch (data[0]) { 2538 case 1: /* allocation info */ 2539 if (msg == 0x0022) { /* Allocate CID */ 2540 if (tlvlen != 2 || data[3] != 2) /* dms */ 2541 break; 2542 sc->sc_cid = data[4]; 2543 DPRINTF("%s: QMI CID %d allocated\n", 2544 DEVNAM(sc), sc->sc_cid); 2545 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP); 2546 } 2547 break; 2548 case 2: /* response */ 2549 if (tlvlen != sizeof(val)) 2550 break; 2551 val = UMB_GET32(&data[3]); 2552 switch (msg) { 2553 case 0x0022: /* Allocate CID */ 2554 if (val != 0) { 2555 log(LOG_ERR, "%s: allocation of QMI CID" 2556 " failed, error 0x%x\n", DEVNAM(sc), 2557 val); 2558 /* XXX how to proceed? */ 2559 return; 2560 } 2561 break; 2562 case 0x555f: /* Send FCC Authentication */ 2563 if (val == 0) 2564 log(LOG_INFO, "%s: send FCC " 2565 "Authentication succeeded\n", 2566 DEVNAM(sc)); 2567 else if (val == 0x001a0001) 2568 log(LOG_INFO, "%s: FCC Authentication " 2569 "not required\n", DEVNAM(sc)); 2570 else 2571 log(LOG_INFO, "%s: send FCC " 2572 "Authentication failed, " 2573 "error 0x%x\n", DEVNAM(sc), val); 2574 2575 /* FCC Auth is needed only once after power-on*/ 2576 sc->sc_flags &= ~UMBFLG_FCC_AUTH_REQUIRED; 2577 2578 /* Try to proceed anyway */ 2579 DPRINTF("%s: init: turning radio on ...\n", 2580 DEVNAM(sc)); 2581 umb_radio(sc, 1); 2582 break; 2583 default: 2584 break; 2585 } 2586 break; 2587 default: 2588 break; 2589 } 2590 data += UMB_QMI_TLVLEN + tlvlen; 2591 len -= UMB_QMI_TLVLEN + tlvlen; 2592 } 2593 return; 2594 2595 tooshort: 2596 DPRINTF("%s: discard short QMI message\n", DEVNAM(sc)); 2597 return; 2598 } 2599 2600 Static void 2601 umb_intr(struct usbd_xfer *xfer, void *priv, usbd_status status) 2602 { 2603 struct umb_softc *sc = priv; 2604 struct ifnet *ifp = GET_IFP(sc); 2605 int total_len; 2606 2607 if (status != USBD_NORMAL_COMPLETION) { 2608 DPRINTF("%s: notification error: %s\n", DEVNAM(sc), 2609 usbd_errstr(status)); 2610 if (status == USBD_STALLED) 2611 usbd_clear_endpoint_stall_async(sc->sc_ctrl_pipe); 2612 return; 2613 } 2614 usbd_get_xfer_status(xfer, NULL, NULL, &total_len, NULL); 2615 if (total_len < UCDC_NOTIFICATION_LENGTH) { 2616 DPRINTF("%s: short notification (%d<%d)\n", DEVNAM(sc), 2617 total_len, UCDC_NOTIFICATION_LENGTH); 2618 return; 2619 } 2620 if (sc->sc_intr_msg.bmRequestType != UCDC_NOTIFICATION) { 2621 DPRINTF("%s: unexpected notification (type=0x%02x)\n", 2622 DEVNAM(sc), sc->sc_intr_msg.bmRequestType); 2623 return; 2624 } 2625 2626 switch (sc->sc_intr_msg.bNotification) { 2627 case UCDC_N_NETWORK_CONNECTION: 2628 if (ifp->if_flags & IFF_DEBUG) 2629 log(LOG_DEBUG, "%s: network %sconnected\n", DEVNAM(sc), 2630 UGETW(sc->sc_intr_msg.wValue) ? "" : "dis"); 2631 break; 2632 case UCDC_N_RESPONSE_AVAILABLE: 2633 DPRINTFN(2, "%s: umb_intr: response available\n", DEVNAM(sc)); 2634 ++sc->sc_nresp; 2635 usb_add_task(sc->sc_udev, &sc->sc_get_response_task, USB_TASKQ_DRIVER); 2636 break; 2637 case UCDC_N_CONNECTION_SPEED_CHANGE: 2638 DPRINTFN(2, "%s: umb_intr: connection speed changed\n", 2639 DEVNAM(sc)); 2640 break; 2641 default: 2642 DPRINTF("%s: unexpected notification (0x%02x)\n", 2643 DEVNAM(sc), sc->sc_intr_msg.bNotification); 2644 break; 2645 } 2646 } 2647 2648 /* 2649 * Diagnostic routines 2650 */ 2651 Static char * 2652 umb_ntop(struct sockaddr *sa) 2653 { 2654 #define NUMBUFS 4 2655 static char astr[NUMBUFS][INET_ADDRSTRLEN]; 2656 static unsigned nbuf = 0; 2657 char *s; 2658 2659 s = astr[nbuf++]; 2660 if (nbuf >= NUMBUFS) 2661 nbuf = 0; 2662 2663 switch (sa->sa_family) { 2664 case AF_INET: 2665 default: 2666 inet_ntop(AF_INET, &satosin(sa)->sin_addr, s, sizeof(astr[0])); 2667 break; 2668 case AF_INET6: 2669 inet_ntop(AF_INET6, &satosin6(sa)->sin6_addr, s, 2670 sizeof(astr[0])); 2671 break; 2672 } 2673 return s; 2674 } 2675 2676 #ifdef UMB_DEBUG 2677 Static char * 2678 umb_uuid2str(uint8_t uuid[MBIM_UUID_LEN]) 2679 { 2680 static char uuidstr[2 * MBIM_UUID_LEN + 5]; 2681 2682 #define UUID_BFMT "%02X" 2683 #define UUID_SEP "-" 2684 snprintf(uuidstr, sizeof(uuidstr), 2685 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_SEP 2686 UUID_BFMT UUID_BFMT UUID_SEP 2687 UUID_BFMT UUID_BFMT UUID_SEP 2688 UUID_BFMT UUID_BFMT UUID_SEP 2689 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT, 2690 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5], 2691 uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11], 2692 uuid[12], uuid[13], uuid[14], uuid[15]); 2693 return uuidstr; 2694 } 2695 2696 Static void 2697 umb_dump(void *buf, int len) 2698 { 2699 int i = 0; 2700 uint8_t *c = buf; 2701 2702 if (len == 0) 2703 return; 2704 while (i < len) { 2705 if ((i % 16) == 0) { 2706 if (i > 0) 2707 addlog("\n"); 2708 log(LOG_DEBUG, "%4d: ", i); 2709 } 2710 addlog(" %02x", *c); 2711 c++; 2712 i++; 2713 } 2714 addlog("\n"); 2715 } 2716 #endif /* UMB_DEBUG */ 2717 2718 /* char * 2719 * inet_ntop(af, src, dst, size) 2720 * convert a network format address to presentation format. 2721 * return: 2722 * pointer to presentation format address (`dst'), or NULL (see errno). 2723 * author: 2724 * Paul Vixie, 1996. 2725 */ 2726 Static const char * 2727 inet_ntop(int af, const void *src, char *dst, socklen_t size) 2728 { 2729 switch (af) { 2730 case AF_INET: 2731 return inet_ntop4(src, dst, (size_t)size); 2732 #ifdef INET6 2733 case AF_INET6: 2734 return inet_ntop6(src, dst, (size_t)size); 2735 #endif /* INET6 */ 2736 default: 2737 return NULL; 2738 } 2739 /* NOTREACHED */ 2740 } 2741 2742 /* const char * 2743 * inet_ntop4(src, dst, size) 2744 * format an IPv4 address, more or less like inet_ntoa() 2745 * return: 2746 * `dst' (as a const) 2747 * notes: 2748 * (1) uses no statics 2749 * (2) takes a u_char* not an in_addr as input 2750 * author: 2751 * Paul Vixie, 1996. 2752 */ 2753 Static const char * 2754 inet_ntop4(const u_char *src, char *dst, size_t size) 2755 { 2756 char tmp[sizeof "255.255.255.255"]; 2757 int l; 2758 2759 l = snprintf(tmp, sizeof(tmp), "%u.%u.%u.%u", 2760 src[0], src[1], src[2], src[3]); 2761 if (l <= 0 || l >= size) { 2762 return NULL; 2763 } 2764 strlcpy(dst, tmp, size); 2765 return dst; 2766 } 2767 2768 #ifdef INET6 2769 /* const char * 2770 * inet_ntop6(src, dst, size) 2771 * convert IPv6 binary address into presentation (printable) format 2772 * author: 2773 * Paul Vixie, 1996. 2774 */ 2775 Static const char * 2776 inet_ntop6(const u_char *src, char *dst, size_t size) 2777 { 2778 /* 2779 * Note that int32_t and int16_t need only be "at least" large enough 2780 * to contain a value of the specified size. On some systems, like 2781 * Crays, there is no such thing as an integer variable with 16 bits. 2782 * Keep this in mind if you think this function should have been coded 2783 * to use pointer overlays. All the world's not a VAX. 2784 */ 2785 char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"]; 2786 char *tp, *ep; 2787 struct { int base, len; } best, cur; 2788 #define IN6ADDRSZ 16 2789 #define INT16SZ 2 2790 u_int words[IN6ADDRSZ / INT16SZ]; 2791 int i; 2792 int advance; 2793 2794 /* 2795 * Preprocess: 2796 * Copy the input (bytewise) array into a wordwise array. 2797 * Find the longest run of 0x00's in src[] for :: shorthanding. 2798 */ 2799 memset(words, '\0', sizeof words); 2800 for (i = 0; i < IN6ADDRSZ; i++) 2801 words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3)); 2802 best.base = -1; 2803 best.len = 0; 2804 cur.base = -1; 2805 cur.len = 0; 2806 for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) { 2807 if (words[i] == 0) { 2808 if (cur.base == -1) 2809 cur.base = i, cur.len = 1; 2810 else 2811 cur.len++; 2812 } else { 2813 if (cur.base != -1) { 2814 if (best.base == -1 || cur.len > best.len) 2815 best = cur; 2816 cur.base = -1; 2817 } 2818 } 2819 } 2820 if (cur.base != -1) { 2821 if (best.base == -1 || cur.len > best.len) 2822 best = cur; 2823 } 2824 if (best.base != -1 && best.len < 2) 2825 best.base = -1; 2826 2827 /* 2828 * Format the result. 2829 */ 2830 tp = tmp; 2831 ep = tmp + sizeof(tmp); 2832 for (i = 0; i < (IN6ADDRSZ / INT16SZ) && tp < ep; i++) { 2833 /* Are we inside the best run of 0x00's? */ 2834 if (best.base != -1 && i >= best.base && 2835 i < (best.base + best.len)) { 2836 if (i == best.base) { 2837 if (tp + 1 >= ep) 2838 return NULL; 2839 *tp++ = ':'; 2840 } 2841 continue; 2842 } 2843 /* Are we following an initial run of 0x00s or any real hex? */ 2844 if (i != 0) { 2845 if (tp + 1 >= ep) 2846 return NULL; 2847 *tp++ = ':'; 2848 } 2849 /* Is this address an encapsulated IPv4? */ 2850 if (i == 6 && best.base == 0 && 2851 (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) { 2852 if (!inet_ntop4(src+12, tp, (size_t)(ep - tp))) 2853 return NULL; 2854 tp += strlen(tp); 2855 break; 2856 } 2857 advance = snprintf(tp, ep - tp, "%x", words[i]); 2858 if (advance <= 0 || advance >= ep - tp) 2859 return NULL; 2860 tp += advance; 2861 } 2862 /* Was it a trailing run of 0x00's? */ 2863 if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ)) { 2864 if (tp + 1 >= ep) 2865 return NULL; 2866 *tp++ = ':'; 2867 } 2868 if (tp + 1 >= ep) 2869 return NULL; 2870 *tp++ = '\0'; 2871 2872 /* 2873 * Check for overflow, copy, and we're done. 2874 */ 2875 if ((size_t)(tp - tmp) > size) { 2876 return NULL; 2877 } 2878 strlcpy(dst, tmp, size); 2879 return dst; 2880 } 2881 #endif /* INET6 */ 2882