1 /* $OpenBSD: if_umb.c,v 1.17 2017/10/23 15:23:13 gerhard Exp $ */ 2 3 /* 4 * Copyright (c) 2016 genua mbH 5 * All rights reserved. 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 /* 21 * Mobile Broadband Interface Model specification: 22 * http://www.usb.org/developers/docs/devclass_docs/MBIM10Errata1_073013.zip 23 * Compliance testing guide 24 * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf 25 */ 26 #include "bpfilter.h" 27 28 #include <sys/param.h> 29 #include <sys/mbuf.h> 30 #include <sys/socket.h> 31 #include <sys/systm.h> 32 #include <sys/syslog.h> 33 34 #if NBPFILTER > 0 35 #include <net/bpf.h> 36 #endif 37 #include <net/if.h> 38 #include <net/if_var.h> 39 #include <net/if_types.h> 40 41 #include <netinet/in.h> 42 #include <netinet/in_var.h> 43 #include <netinet/ip.h> 44 45 #include <machine/bus.h> 46 47 #include <dev/usb/usb.h> 48 #include <dev/usb/usbdi.h> 49 #include <dev/usb/usbdivar.h> 50 #include <dev/usb/usbdi_util.h> 51 #include <dev/usb/usbdevs.h> 52 #include <dev/usb/usbcdc.h> 53 54 #include <dev/usb/mbim.h> 55 #include <dev/usb/if_umb.h> 56 57 #ifdef UMB_DEBUG 58 #define DPRINTF(x...) \ 59 do { if (umb_debug) log(LOG_DEBUG, x); } while (0) 60 61 #define DPRINTFN(n, x...) \ 62 do { if (umb_debug >= (n)) log(LOG_DEBUG, x); } while (0) 63 64 #define DDUMPN(n, b, l) \ 65 do { \ 66 if (umb_debug >= (n)) \ 67 umb_dump((b), (l)); \ 68 } while (0) 69 70 int umb_debug = 0; 71 char *umb_uuid2str(uint8_t [MBIM_UUID_LEN]); 72 void umb_dump(void *, int); 73 74 #else 75 #define DPRINTF(x...) do { } while (0) 76 #define DPRINTFN(n, x...) do { } while (0) 77 #define DDUMPN(n, b, l) do { } while (0) 78 #endif 79 80 #define DEVNAM(sc) (((struct umb_softc *)(sc))->sc_dev.dv_xname) 81 82 /* 83 * State change timeout 84 */ 85 #define UMB_STATE_CHANGE_TIMEOUT 30 86 87 /* 88 * State change flags 89 */ 90 #define UMB_NS_DONT_DROP 0x0001 /* do not drop below current state */ 91 #define UMB_NS_DONT_RAISE 0x0002 /* do not raise below current state */ 92 93 /* 94 * Diagnostic macros 95 */ 96 const struct umb_valdescr umb_regstates[] = MBIM_REGSTATE_DESCRIPTIONS; 97 const struct umb_valdescr umb_dataclasses[] = MBIM_DATACLASS_DESCRIPTIONS; 98 const struct umb_valdescr umb_simstate[] = MBIM_SIMSTATE_DESCRIPTIONS; 99 const struct umb_valdescr umb_messages[] = MBIM_MESSAGES_DESCRIPTIONS; 100 const struct umb_valdescr umb_status[] = MBIM_STATUS_DESCRIPTIONS; 101 const struct umb_valdescr umb_cids[] = MBIM_CID_DESCRIPTIONS; 102 const struct umb_valdescr umb_pktstate[] = MBIM_PKTSRV_STATE_DESCRIPTIONS; 103 const struct umb_valdescr umb_actstate[] = MBIM_ACTIVATION_STATE_DESCRIPTIONS; 104 const struct umb_valdescr umb_error[] = MBIM_ERROR_DESCRIPTIONS; 105 const struct umb_valdescr umb_pintype[] = MBIM_PINTYPE_DESCRIPTIONS; 106 const struct umb_valdescr umb_istate[] = UMB_INTERNAL_STATE_DESCRIPTIONS; 107 108 #define umb_regstate(c) umb_val2descr(umb_regstates, (c)) 109 #define umb_dataclass(c) umb_val2descr(umb_dataclasses, (c)) 110 #define umb_simstate(s) umb_val2descr(umb_simstate, (s)) 111 #define umb_request2str(m) umb_val2descr(umb_messages, (m)) 112 #define umb_status2str(s) umb_val2descr(umb_status, (s)) 113 #define umb_cid2str(c) umb_val2descr(umb_cids, (c)) 114 #define umb_packet_state(s) umb_val2descr(umb_pktstate, (s)) 115 #define umb_activation(s) umb_val2descr(umb_actstate, (s)) 116 #define umb_error2str(e) umb_val2descr(umb_error, (e)) 117 #define umb_pin_type(t) umb_val2descr(umb_pintype, (t)) 118 #define umb_istate(s) umb_val2descr(umb_istate, (s)) 119 120 int umb_match(struct device *, void *, void *); 121 void umb_attach(struct device *, struct device *, void *); 122 int umb_detach(struct device *, int); 123 void umb_ncm_setup(struct umb_softc *); 124 int umb_alloc_xfers(struct umb_softc *); 125 void umb_free_xfers(struct umb_softc *); 126 int umb_alloc_bulkpipes(struct umb_softc *); 127 void umb_close_bulkpipes(struct umb_softc *); 128 int umb_ioctl(struct ifnet *, u_long, caddr_t); 129 int umb_output(struct ifnet *, struct mbuf *, struct sockaddr *, 130 struct rtentry *); 131 int umb_input(struct ifnet *, struct mbuf *, void *); 132 void umb_start(struct ifnet *); 133 void umb_watchdog(struct ifnet *); 134 void umb_statechg_timeout(void *); 135 136 void umb_newstate(struct umb_softc *, enum umb_state, int); 137 void umb_state_task(void *); 138 void umb_up(struct umb_softc *); 139 void umb_down(struct umb_softc *, int); 140 141 void umb_get_response_task(void *); 142 143 void umb_decode_response(struct umb_softc *, void *, int); 144 void umb_handle_indicate_status_msg(struct umb_softc *, void *, 145 int); 146 void umb_handle_opendone_msg(struct umb_softc *, void *, int); 147 void umb_handle_closedone_msg(struct umb_softc *, void *, int); 148 int umb_decode_register_state(struct umb_softc *, void *, int); 149 int umb_decode_devices_caps(struct umb_softc *, void *, int); 150 int umb_decode_subscriber_status(struct umb_softc *, void *, int); 151 int umb_decode_radio_state(struct umb_softc *, void *, int); 152 int umb_decode_pin(struct umb_softc *, void *, int); 153 int umb_decode_packet_service(struct umb_softc *, void *, int); 154 int umb_decode_signal_state(struct umb_softc *, void *, int); 155 int umb_decode_connect_info(struct umb_softc *, void *, int); 156 int umb_decode_ip_configuration(struct umb_softc *, void *, int); 157 void umb_rx(struct umb_softc *); 158 void umb_rxeof(struct usbd_xfer *, void *, usbd_status); 159 int umb_encap(struct umb_softc *); 160 void umb_txeof(struct usbd_xfer *, void *, usbd_status); 161 void umb_decap(struct umb_softc *, struct usbd_xfer *); 162 163 usbd_status umb_send_encap_command(struct umb_softc *, void *, int); 164 int umb_get_encap_response(struct umb_softc *, void *, int *); 165 void umb_ctrl_msg(struct umb_softc *, uint32_t, void *, int); 166 167 void umb_open(struct umb_softc *); 168 void umb_close(struct umb_softc *); 169 170 int umb_setpin(struct umb_softc *, int, int, void *, int, void *, 171 int); 172 void umb_setdataclass(struct umb_softc *); 173 void umb_radio(struct umb_softc *, int); 174 void umb_allocate_cid(struct umb_softc *); 175 void umb_send_fcc_auth(struct umb_softc *); 176 void umb_packet_service(struct umb_softc *, int); 177 void umb_connect(struct umb_softc *); 178 void umb_disconnect(struct umb_softc *); 179 void umb_send_connect(struct umb_softc *, int); 180 181 void umb_qry_ipconfig(struct umb_softc *); 182 void umb_cmd(struct umb_softc *, int, int, void *, int); 183 void umb_cmd1(struct umb_softc *, int, int, void *, int, uint8_t *); 184 void umb_command_done(struct umb_softc *, void *, int); 185 void umb_decode_cid(struct umb_softc *, uint32_t, void *, int); 186 void umb_decode_qmi(struct umb_softc *, uint8_t *, int); 187 188 void umb_intr(struct usbd_xfer *, void *, usbd_status); 189 190 char *umb_ntop(struct sockaddr *); 191 192 int umb_xfer_tout = USBD_DEFAULT_TIMEOUT; 193 194 uint8_t umb_uuid_basic_connect[] = MBIM_UUID_BASIC_CONNECT; 195 uint8_t umb_uuid_context_internet[] = MBIM_UUID_CONTEXT_INTERNET; 196 uint8_t umb_uuid_qmi_mbim[] = MBIM_UUID_QMI_MBIM; 197 uint32_t umb_session_id = 0; 198 199 struct cfdriver umb_cd = { 200 NULL, "umb", DV_DULL 201 }; 202 203 const struct cfattach umb_ca = { 204 sizeof (struct umb_softc), 205 umb_match, 206 umb_attach, 207 umb_detach, 208 NULL, 209 }; 210 211 int umb_delay = 4000; 212 213 /* 214 * These devices require an "FCC Authentication" command. 215 */ 216 const struct usb_devno umb_fccauth_devs[] = { 217 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_EM7455 }, 218 }; 219 220 uint8_t umb_qmi_alloc_cid[] = { 221 0x01, 222 0x0f, 0x00, /* len */ 223 0x00, /* QMUX flags */ 224 0x00, /* service "ctl" */ 225 0x00, /* CID */ 226 0x00, /* QMI flags */ 227 0x01, /* transaction */ 228 0x22, 0x00, /* msg "Allocate CID" */ 229 0x04, 0x00, /* TLV len */ 230 0x01, 0x01, 0x00, 0x02 /* TLV */ 231 }; 232 233 uint8_t umb_qmi_fcc_auth[] = { 234 0x01, 235 0x0c, 0x00, /* len */ 236 0x00, /* QMUX flags */ 237 0x02, /* service "dms" */ 238 #define UMB_QMI_CID_OFFS 5 239 0x00, /* CID (filled in later) */ 240 0x00, /* QMI flags */ 241 0x01, 0x00, /* transaction */ 242 0x5f, 0x55, /* msg "Send FCC Authentication" */ 243 0x00, 0x00 /* TLV len */ 244 }; 245 246 int 247 umb_match(struct device *parent, void *match, void *aux) 248 { 249 struct usb_attach_arg *uaa = aux; 250 usb_interface_descriptor_t *id; 251 252 if (!uaa->iface) 253 return UMATCH_NONE; 254 if ((id = usbd_get_interface_descriptor(uaa->iface)) == NULL) 255 return UMATCH_NONE; 256 257 /* 258 * If this function implements NCM, check if alternate setting 259 * 1 implements MBIM. 260 */ 261 if (id->bInterfaceClass == UICLASS_CDC && 262 id->bInterfaceSubClass == 263 UISUBCLASS_NETWORK_CONTROL_MODEL) 264 id = usbd_find_idesc(uaa->device->cdesc, uaa->iface->index, 1); 265 if (id == NULL) 266 return UMATCH_NONE; 267 268 if (id->bInterfaceClass == UICLASS_CDC && 269 id->bInterfaceSubClass == 270 UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL && 271 id->bInterfaceProtocol == 0) 272 return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO; 273 274 return UMATCH_NONE; 275 } 276 277 void 278 umb_attach(struct device *parent, struct device *self, void *aux) 279 { 280 struct umb_softc *sc = (struct umb_softc *)self; 281 struct usb_attach_arg *uaa = aux; 282 usbd_status status; 283 struct usbd_desc_iter iter; 284 const usb_descriptor_t *desc; 285 int v; 286 struct usb_cdc_union_descriptor *ud; 287 struct mbim_descriptor *md; 288 int i; 289 int ctrl_ep; 290 usb_interface_descriptor_t *id; 291 usb_config_descriptor_t *cd; 292 usb_endpoint_descriptor_t *ed; 293 usb_interface_assoc_descriptor_t *ad; 294 int current_ifaceno = -1; 295 int data_ifaceno = -1; 296 int altnum; 297 int s; 298 struct ifnet *ifp; 299 300 sc->sc_udev = uaa->device; 301 sc->sc_ctrl_ifaceno = uaa->ifaceno; 302 ml_init(&sc->sc_tx_ml); 303 304 /* 305 * Some MBIM hardware does not provide the mandatory CDC Union 306 * Descriptor, so we also look at matching Interface 307 * Association Descriptors to find out the MBIM Data Interface 308 * number. 309 */ 310 sc->sc_ver_maj = sc->sc_ver_min = -1; 311 sc->sc_maxpktlen = MBIM_MAXSEGSZ_MINVAL; 312 usbd_desc_iter_init(sc->sc_udev, &iter); 313 while ((desc = usbd_desc_iter_next(&iter))) { 314 if (desc->bDescriptorType == UDESC_IFACE_ASSOC) { 315 ad = (usb_interface_assoc_descriptor_t *)desc; 316 if (ad->bFirstInterface == uaa->ifaceno && 317 ad->bInterfaceCount > 1) 318 data_ifaceno = uaa->ifaceno + 1; 319 continue; 320 } 321 if (desc->bDescriptorType == UDESC_INTERFACE) { 322 id = (usb_interface_descriptor_t *)desc; 323 current_ifaceno = id->bInterfaceNumber; 324 continue; 325 } 326 if (current_ifaceno != uaa->ifaceno) 327 continue; 328 if (desc->bDescriptorType != UDESC_CS_INTERFACE) 329 continue; 330 switch (desc->bDescriptorSubtype) { 331 case UDESCSUB_CDC_UNION: 332 ud = (struct usb_cdc_union_descriptor *)desc; 333 data_ifaceno = ud->bSlaveInterface[0]; 334 break; 335 case UDESCSUB_MBIM: 336 md = (struct mbim_descriptor *)desc; 337 v = UGETW(md->bcdMBIMVersion); 338 sc->sc_ver_maj = MBIM_VER_MAJOR(v); 339 sc->sc_ver_min = MBIM_VER_MINOR(v); 340 sc->sc_ctrl_len = UGETW(md->wMaxControlMessage); 341 /* Never trust a USB device! Could try to exploit us */ 342 if (sc->sc_ctrl_len < MBIM_CTRLMSG_MINLEN || 343 sc->sc_ctrl_len > MBIM_CTRLMSG_MAXLEN) { 344 DPRINTF("%s: control message len %d out of " 345 "bounds [%d .. %d]\n", DEVNAM(sc), 346 sc->sc_ctrl_len, MBIM_CTRLMSG_MINLEN, 347 MBIM_CTRLMSG_MAXLEN); 348 /* cont. anyway */ 349 } 350 sc->sc_maxpktlen = UGETW(md->wMaxSegmentSize); 351 DPRINTFN(2, "%s: ctrl_len=%d, maxpktlen=%d, cap=0x%x\n", 352 DEVNAM(sc), sc->sc_ctrl_len, sc->sc_maxpktlen, 353 md->bmNetworkCapabilities); 354 break; 355 default: 356 break; 357 } 358 } 359 if (sc->sc_ver_maj < 0) { 360 printf("%s: missing MBIM descriptor\n", DEVNAM(sc)); 361 goto fail; 362 } 363 if (usb_lookup(umb_fccauth_devs, uaa->vendor, uaa->product)) { 364 sc->sc_flags |= UMBFLG_FCC_AUTH_REQUIRED; 365 sc->sc_cid = -1; 366 } 367 368 for (i = 0; i < uaa->nifaces; i++) { 369 if (usbd_iface_claimed(sc->sc_udev, i)) 370 continue; 371 id = usbd_get_interface_descriptor(uaa->ifaces[i]); 372 if (id != NULL && id->bInterfaceNumber == data_ifaceno) { 373 sc->sc_data_iface = uaa->ifaces[i]; 374 usbd_claim_iface(sc->sc_udev, i); 375 } 376 } 377 if (sc->sc_data_iface == NULL) { 378 printf("%s: no data interface found\n", DEVNAM(sc)); 379 goto fail; 380 } 381 382 /* 383 * If this is a combined NCM/MBIM function, switch to 384 * alternate setting one to enable MBIM. 385 */ 386 id = usbd_get_interface_descriptor(uaa->iface); 387 if (id->bInterfaceClass == UICLASS_CDC && 388 id->bInterfaceSubClass == 389 UISUBCLASS_NETWORK_CONTROL_MODEL) 390 usbd_set_interface(uaa->iface, 1); 391 392 id = usbd_get_interface_descriptor(uaa->iface); 393 ctrl_ep = -1; 394 for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) { 395 ed = usbd_interface2endpoint_descriptor(uaa->iface, i); 396 if (ed == NULL) 397 break; 398 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT && 399 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) 400 ctrl_ep = ed->bEndpointAddress; 401 } 402 if (ctrl_ep == -1) { 403 printf("%s: missing interrupt endpoint\n", DEVNAM(sc)); 404 goto fail; 405 } 406 407 /* 408 * For the MBIM Data Interface, select the appropriate 409 * alternate setting by looking for a matching descriptor that 410 * has two endpoints. 411 */ 412 cd = usbd_get_config_descriptor(sc->sc_udev); 413 altnum = usbd_get_no_alts(cd, data_ifaceno); 414 for (i = 0; i < altnum; i++) { 415 id = usbd_find_idesc(cd, sc->sc_data_iface->index, i); 416 if (id == NULL) 417 continue; 418 if (id->bInterfaceClass == UICLASS_CDC_DATA && 419 id->bInterfaceSubClass == UISUBCLASS_DATA && 420 id->bInterfaceProtocol == UIPROTO_DATA_MBIM && 421 id->bNumEndpoints == 2) 422 break; 423 } 424 if (i == altnum || id == NULL) { 425 printf("%s: missing alt setting for interface #%d\n", 426 DEVNAM(sc), data_ifaceno); 427 goto fail; 428 } 429 status = usbd_set_interface(sc->sc_data_iface, i); 430 if (status) { 431 printf("%s: select alt setting %d for interface #%d " 432 "failed: %s\n", DEVNAM(sc), i, data_ifaceno, 433 usbd_errstr(status)); 434 goto fail; 435 } 436 437 id = usbd_get_interface_descriptor(sc->sc_data_iface); 438 sc->sc_rx_ep = sc->sc_tx_ep = -1; 439 for (i = 0; i < id->bNumEndpoints; i++) { 440 if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface, 441 i)) == NULL) 442 break; 443 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK && 444 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) 445 sc->sc_rx_ep = ed->bEndpointAddress; 446 else if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK && 447 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT) 448 sc->sc_tx_ep = ed->bEndpointAddress; 449 } 450 if (sc->sc_rx_ep == -1 || sc->sc_tx_ep == -1) { 451 printf("%s: missing bulk endpoints\n", DEVNAM(sc)); 452 goto fail; 453 } 454 455 DPRINTFN(2, "%s: ctrl-ifno#%d: ep-ctrl=%d, data-ifno#%d: ep-rx=%d, " 456 "ep-tx=%d\n", DEVNAM(sc), sc->sc_ctrl_ifaceno, 457 UE_GET_ADDR(ctrl_ep), data_ifaceno, 458 UE_GET_ADDR(sc->sc_rx_ep), UE_GET_ADDR(sc->sc_tx_ep)); 459 460 usb_init_task(&sc->sc_umb_task, umb_state_task, sc, 461 USB_TASK_TYPE_GENERIC); 462 usb_init_task(&sc->sc_get_response_task, umb_get_response_task, sc, 463 USB_TASK_TYPE_GENERIC); 464 timeout_set(&sc->sc_statechg_timer, umb_statechg_timeout, sc); 465 466 if (usbd_open_pipe_intr(uaa->iface, ctrl_ep, USBD_SHORT_XFER_OK, 467 &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof (sc->sc_intr_msg), 468 umb_intr, USBD_DEFAULT_INTERVAL)) { 469 printf("%s: failed to open control pipe\n", DEVNAM(sc)); 470 goto fail; 471 } 472 sc->sc_resp_buf = malloc(sc->sc_ctrl_len, M_USBDEV, M_NOWAIT); 473 if (sc->sc_resp_buf == NULL) { 474 printf("%s: allocation of resp buffer failed\n", DEVNAM(sc)); 475 goto fail; 476 } 477 sc->sc_ctrl_msg = malloc(sc->sc_ctrl_len, M_USBDEV, M_NOWAIT); 478 if (sc->sc_ctrl_msg == NULL) { 479 printf("%s: allocation of ctrl msg buffer failed\n", 480 DEVNAM(sc)); 481 goto fail; 482 } 483 484 sc->sc_info.regstate = MBIM_REGSTATE_UNKNOWN; 485 sc->sc_info.pin_attempts_left = UMB_VALUE_UNKNOWN; 486 sc->sc_info.rssi = UMB_VALUE_UNKNOWN; 487 sc->sc_info.ber = UMB_VALUE_UNKNOWN; 488 489 umb_ncm_setup(sc); 490 DPRINTFN(2, "%s: rx/tx size %d/%d\n", DEVNAM(sc), 491 sc->sc_rx_bufsz, sc->sc_tx_bufsz); 492 493 s = splnet(); 494 ifp = GET_IFP(sc); 495 ifp->if_flags = IFF_SIMPLEX | IFF_MULTICAST | IFF_POINTOPOINT; 496 ifp->if_ioctl = umb_ioctl; 497 ifp->if_start = umb_start; 498 ifp->if_rtrequest = p2p_rtrequest; 499 500 ifp->if_watchdog = umb_watchdog; 501 strlcpy(ifp->if_xname, DEVNAM(sc), IFNAMSIZ); 502 ifp->if_link_state = LINK_STATE_DOWN; 503 504 ifp->if_type = IFT_MBIM; 505 ifp->if_addrlen = 0; 506 ifp->if_hdrlen = sizeof (struct ncm_header16) + 507 sizeof (struct ncm_pointer16); 508 ifp->if_mtu = 1500; /* use a common default */ 509 ifp->if_hardmtu = sc->sc_maxpktlen; 510 ifp->if_output = umb_output; 511 if_attach(ifp); 512 if_ih_insert(ifp, umb_input, NULL); 513 if_alloc_sadl(ifp); 514 ifp->if_softc = sc; 515 #if NBPFILTER > 0 516 bpfattach(&ifp->if_bpf, ifp, DLT_RAW, 0); 517 #endif 518 /* 519 * Open the device now so that we are able to query device information. 520 * XXX maybe close when done? 521 */ 522 umb_open(sc); 523 splx(s); 524 525 DPRINTF("%s: vers %d.%d\n", DEVNAM(sc), sc->sc_ver_maj, sc->sc_ver_min); 526 return; 527 528 fail: 529 usbd_deactivate(sc->sc_udev); 530 return; 531 } 532 533 int 534 umb_detach(struct device *self, int flags) 535 { 536 struct umb_softc *sc = (struct umb_softc *)self; 537 struct ifnet *ifp = GET_IFP(sc); 538 int s; 539 540 s = splnet(); 541 if (ifp->if_flags & IFF_RUNNING) 542 umb_down(sc, 1); 543 umb_close(sc); 544 545 usb_rem_wait_task(sc->sc_udev, &sc->sc_get_response_task); 546 if (timeout_initialized(&sc->sc_statechg_timer)) 547 timeout_del(&sc->sc_statechg_timer); 548 sc->sc_nresp = 0; 549 usb_rem_wait_task(sc->sc_udev, &sc->sc_umb_task); 550 if (sc->sc_ctrl_pipe) { 551 usbd_close_pipe(sc->sc_ctrl_pipe); 552 sc->sc_ctrl_pipe = NULL; 553 } 554 if (sc->sc_ctrl_msg) { 555 free(sc->sc_ctrl_msg, M_USBDEV, sc->sc_ctrl_len); 556 sc->sc_ctrl_msg = NULL; 557 } 558 if (sc->sc_resp_buf) { 559 free(sc->sc_resp_buf, M_USBDEV, sc->sc_ctrl_len); 560 sc->sc_resp_buf = NULL; 561 } 562 if (ifp->if_softc != NULL) { 563 if_ih_remove(ifp, umb_input, NULL); 564 if_detach(ifp); 565 } 566 567 splx(s); 568 return 0; 569 } 570 571 void 572 umb_ncm_setup(struct umb_softc *sc) 573 { 574 usb_device_request_t req; 575 struct ncm_ntb_parameters np; 576 577 /* Query NTB tranfers sizes */ 578 req.bmRequestType = UT_READ_CLASS_INTERFACE; 579 req.bRequest = NCM_GET_NTB_PARAMETERS; 580 USETW(req.wValue, 0); 581 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 582 USETW(req.wLength, sizeof (np)); 583 if (usbd_do_request(sc->sc_udev, &req, &np) == USBD_NORMAL_COMPLETION && 584 UGETW(np.wLength) == sizeof (np)) { 585 sc->sc_rx_bufsz = UGETDW(np.dwNtbInMaxSize); 586 sc->sc_tx_bufsz = UGETDW(np.dwNtbOutMaxSize); 587 sc->sc_maxdgram = UGETW(np.wNtbOutMaxDatagrams); 588 sc->sc_align = UGETW(np.wNdpOutAlignment); 589 sc->sc_ndp_div = UGETW(np.wNdpOutDivisor); 590 sc->sc_ndp_remainder = UGETW(np.wNdpOutPayloadRemainder); 591 /* Validate values */ 592 if (!powerof2(sc->sc_align) || sc->sc_align == 0 || 593 sc->sc_align >= sc->sc_tx_bufsz) 594 sc->sc_align = sizeof (uint32_t); 595 if (!powerof2(sc->sc_ndp_div) || sc->sc_ndp_div == 0 || 596 sc->sc_ndp_div >= sc->sc_tx_bufsz) 597 sc->sc_ndp_div = sizeof (uint32_t); 598 if (sc->sc_ndp_remainder >= sc->sc_ndp_div) 599 sc->sc_ndp_remainder = 0; 600 } else { 601 sc->sc_rx_bufsz = sc->sc_tx_bufsz = 8 * 1024; 602 sc->sc_maxdgram = 0; 603 sc->sc_align = sc->sc_ndp_div = sizeof (uint32_t); 604 sc->sc_ndp_remainder = 0; 605 } 606 } 607 608 int 609 umb_alloc_xfers(struct umb_softc *sc) 610 { 611 if (!sc->sc_rx_xfer) { 612 if ((sc->sc_rx_xfer = usbd_alloc_xfer(sc->sc_udev)) != NULL) 613 sc->sc_rx_buf = usbd_alloc_buffer(sc->sc_rx_xfer, 614 sc->sc_rx_bufsz); 615 } 616 if (!sc->sc_tx_xfer) { 617 if ((sc->sc_tx_xfer = usbd_alloc_xfer(sc->sc_udev)) != NULL) 618 sc->sc_tx_buf = usbd_alloc_buffer(sc->sc_tx_xfer, 619 sc->sc_tx_bufsz); 620 } 621 return (sc->sc_rx_buf && sc->sc_tx_buf) ? 1 : 0; 622 } 623 624 void 625 umb_free_xfers(struct umb_softc *sc) 626 { 627 if (sc->sc_rx_xfer) { 628 /* implicit usbd_free_buffer() */ 629 usbd_free_xfer(sc->sc_rx_xfer); 630 sc->sc_rx_xfer = NULL; 631 sc->sc_rx_buf = NULL; 632 } 633 if (sc->sc_tx_xfer) { 634 usbd_free_xfer(sc->sc_tx_xfer); 635 sc->sc_tx_xfer = NULL; 636 sc->sc_tx_buf = NULL; 637 } 638 ml_purge(&sc->sc_tx_ml); 639 } 640 641 int 642 umb_alloc_bulkpipes(struct umb_softc *sc) 643 { 644 struct ifnet *ifp = GET_IFP(sc); 645 646 if (!(ifp->if_flags & IFF_RUNNING)) { 647 if (usbd_open_pipe(sc->sc_data_iface, sc->sc_rx_ep, 648 USBD_EXCLUSIVE_USE, &sc->sc_rx_pipe)) 649 return 0; 650 if (usbd_open_pipe(sc->sc_data_iface, sc->sc_tx_ep, 651 USBD_EXCLUSIVE_USE, &sc->sc_tx_pipe)) 652 return 0; 653 654 ifp->if_flags |= IFF_RUNNING; 655 ifq_clr_oactive(&ifp->if_snd); 656 umb_rx(sc); 657 } 658 return 1; 659 } 660 661 void 662 umb_close_bulkpipes(struct umb_softc *sc) 663 { 664 struct ifnet *ifp = GET_IFP(sc); 665 666 ifp->if_flags &= ~IFF_RUNNING; 667 ifq_clr_oactive(&ifp->if_snd); 668 ifp->if_timer = 0; 669 if (sc->sc_rx_pipe) { 670 usbd_close_pipe(sc->sc_rx_pipe); 671 sc->sc_rx_pipe = NULL; 672 } 673 if (sc->sc_tx_pipe) { 674 usbd_close_pipe(sc->sc_tx_pipe); 675 sc->sc_tx_pipe = NULL; 676 } 677 } 678 679 int 680 umb_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 681 { 682 struct proc *p = curproc; 683 struct umb_softc *sc = ifp->if_softc; 684 struct ifreq *ifr = (struct ifreq *)data; 685 int s, error = 0; 686 struct umb_parameter mp; 687 688 if (usbd_is_dying(sc->sc_udev)) 689 return EIO; 690 691 s = splnet(); 692 switch (cmd) { 693 case SIOCSIFFLAGS: 694 usb_add_task(sc->sc_udev, &sc->sc_umb_task); 695 break; 696 case SIOCGUMBINFO: 697 error = copyout(&sc->sc_info, ifr->ifr_data, 698 sizeof (sc->sc_info)); 699 break; 700 case SIOCSUMBPARAM: 701 if ((error = suser(p, 0)) != 0) 702 break; 703 if ((error = copyin(ifr->ifr_data, &mp, sizeof (mp))) != 0) 704 break; 705 706 if ((error = umb_setpin(sc, mp.op, mp.is_puk, mp.pin, mp.pinlen, 707 mp.newpin, mp.newpinlen)) != 0) 708 break; 709 710 if (mp.apnlen < 0 || mp.apnlen > sizeof (sc->sc_info.apn)) { 711 error = EINVAL; 712 break; 713 } 714 sc->sc_roaming = mp.roaming ? 1 : 0; 715 memset(sc->sc_info.apn, 0, sizeof (sc->sc_info.apn)); 716 memcpy(sc->sc_info.apn, mp.apn, mp.apnlen); 717 sc->sc_info.apnlen = mp.apnlen; 718 sc->sc_info.preferredclasses = mp.preferredclasses; 719 umb_setdataclass(sc); 720 break; 721 case SIOCGUMBPARAM: 722 memset(&mp, 0, sizeof (mp)); 723 memcpy(mp.apn, sc->sc_info.apn, sc->sc_info.apnlen); 724 mp.apnlen = sc->sc_info.apnlen; 725 mp.roaming = sc->sc_roaming; 726 mp.preferredclasses = sc->sc_info.preferredclasses; 727 error = copyout(&mp, ifr->ifr_data, sizeof (mp)); 728 break; 729 case SIOCSIFMTU: 730 /* Does this include the NCM headers and tail? */ 731 if (ifr->ifr_mtu > ifp->if_hardmtu) { 732 error = EINVAL; 733 break; 734 } 735 ifp->if_mtu = ifr->ifr_mtu; 736 break; 737 case SIOCSIFADDR: 738 case SIOCAIFADDR: 739 case SIOCSIFDSTADDR: 740 case SIOCADDMULTI: 741 case SIOCDELMULTI: 742 break; 743 default: 744 error = ENOTTY; 745 break; 746 } 747 splx(s); 748 return error; 749 } 750 751 int 752 umb_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 753 struct rtentry *rtp) 754 { 755 if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) != (IFF_UP|IFF_RUNNING)) { 756 m_freem(m); 757 return ENETDOWN; 758 } 759 return if_enqueue(ifp, m); 760 } 761 762 int 763 umb_input(struct ifnet *ifp, struct mbuf *m, void *cookie) 764 { 765 uint8_t ipv; 766 767 if ((ifp->if_flags & IFF_UP) == 0) { 768 m_freem(m); 769 return 1; 770 } 771 if (m->m_pkthdr.len < sizeof (struct ip)) { 772 ifp->if_ierrors++; 773 DPRINTFN(4, "%s: dropping short packet (len %d)\n", __func__, 774 m->m_pkthdr.len); 775 m_freem(m); 776 return 1; 777 } 778 m->m_pkthdr.ph_rtableid = ifp->if_rdomain; 779 m_copydata(m, 0, sizeof (ipv), &ipv); 780 ipv >>= 4; 781 782 ifp->if_ibytes += m->m_pkthdr.len; 783 switch (ipv) { 784 case 4: 785 ipv4_input(ifp, m); 786 return 1; 787 #ifdef INET6 788 case 6: 789 ipv6_input(ifp, m); 790 return 1; 791 #endif /* INET6 */ 792 default: 793 ifp->if_ierrors++; 794 DPRINTFN(4, "%s: dropping packet with bad IP version (%d)\n", 795 __func__, ipv); 796 m_freem(m); 797 return 1; 798 } 799 return 1; 800 } 801 802 static inline int 803 umb_align(size_t bufsz, int offs, int alignment, int remainder) 804 { 805 size_t m = alignment - 1; 806 int align; 807 808 align = (((size_t)offs + m) & ~m) - alignment + remainder; 809 if (align < offs) 810 align += alignment; 811 if (align > bufsz) 812 align = bufsz; 813 return align - offs; 814 } 815 816 static inline int 817 umb_padding(void *buf, size_t bufsz, int offs, int alignment, int remainder) 818 { 819 int nb; 820 821 nb = umb_align(bufsz, offs, alignment, remainder); 822 if (nb > 0) 823 memset(buf + offs, 0, nb); 824 return nb; 825 } 826 827 void 828 umb_start(struct ifnet *ifp) 829 { 830 struct umb_softc *sc = ifp->if_softc; 831 struct mbuf *m = NULL; 832 int ndgram = 0; 833 int offs, plen, len, mlen; 834 int maxalign; 835 836 if (usbd_is_dying(sc->sc_udev) || 837 !(ifp->if_flags & IFF_RUNNING) || 838 ifq_is_oactive(&ifp->if_snd)) 839 return; 840 841 KASSERT(ml_empty(&sc->sc_tx_ml)); 842 843 offs = sizeof (struct ncm_header16); 844 offs += umb_align(sc->sc_tx_bufsz, offs, sc->sc_align, 0); 845 846 /* 847 * Note that 'struct ncm_pointer16' already includes space for the 848 * terminating zero pointer. 849 */ 850 offs += sizeof (struct ncm_pointer16); 851 plen = sizeof (struct ncm_pointer16_dgram); 852 maxalign = (sc->sc_ndp_div - 1) + sc->sc_ndp_remainder; 853 len = 0; 854 while (1) { 855 m = ifq_deq_begin(&ifp->if_snd); 856 if (m == NULL) 857 break; 858 859 /* 860 * Check if mbuf plus required NCM pointer still fits into 861 * xfer buffers. Assume maximal padding. 862 */ 863 plen += sizeof (struct ncm_pointer16_dgram); 864 mlen = maxalign + m->m_pkthdr.len; 865 if ((sc->sc_maxdgram != 0 && ndgram >= sc->sc_maxdgram) || 866 (offs + plen + len + mlen > sc->sc_tx_bufsz)) { 867 ifq_deq_rollback(&ifp->if_snd, m); 868 break; 869 } 870 ifq_deq_commit(&ifp->if_snd, m); 871 872 ndgram++; 873 len += mlen; 874 ml_enqueue(&sc->sc_tx_ml, m); 875 876 #if NBPFILTER > 0 877 if (ifp->if_bpf) 878 bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT); 879 #endif 880 } 881 if (ml_empty(&sc->sc_tx_ml)) 882 return; 883 if (umb_encap(sc)) { 884 ifq_set_oactive(&ifp->if_snd); 885 ifp->if_timer = (2 * umb_xfer_tout) / 1000; 886 } 887 } 888 889 void 890 umb_watchdog(struct ifnet *ifp) 891 { 892 struct umb_softc *sc = ifp->if_softc; 893 894 if (usbd_is_dying(sc->sc_udev)) 895 return; 896 897 ifp->if_oerrors++; 898 printf("%s: watchdog timeout\n", DEVNAM(sc)); 899 usbd_abort_pipe(sc->sc_tx_pipe); 900 return; 901 } 902 903 void 904 umb_statechg_timeout(void *arg) 905 { 906 struct umb_softc *sc = arg; 907 908 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) { 909 /* 910 * Query the registration state until we're with the home 911 * network again. 912 */ 913 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, NULL, 0); 914 } else 915 printf("%s: state change timeout\n",DEVNAM(sc)); 916 usb_add_task(sc->sc_udev, &sc->sc_umb_task); 917 } 918 919 void 920 umb_newstate(struct umb_softc *sc, enum umb_state newstate, int flags) 921 { 922 struct ifnet *ifp = GET_IFP(sc); 923 924 if (newstate == sc->sc_state) 925 return; 926 if (((flags & UMB_NS_DONT_DROP) && newstate < sc->sc_state) || 927 ((flags & UMB_NS_DONT_RAISE) && newstate > sc->sc_state)) 928 return; 929 if (ifp->if_flags & IFF_DEBUG) 930 log(LOG_DEBUG, "%s: state going %s from '%s' to '%s'\n", 931 DEVNAM(sc), newstate > sc->sc_state ? "up" : "down", 932 umb_istate(sc->sc_state), umb_istate(newstate)); 933 sc->sc_state = newstate; 934 usb_add_task(sc->sc_udev, &sc->sc_umb_task); 935 } 936 937 void 938 umb_state_task(void *arg) 939 { 940 struct umb_softc *sc = arg; 941 struct ifnet *ifp = GET_IFP(sc); 942 struct ifreq ifr; 943 struct in_aliasreq ifra; 944 int s; 945 int state; 946 947 s = splnet(); 948 if (ifp->if_flags & IFF_UP) 949 umb_up(sc); 950 else 951 umb_down(sc, 0); 952 953 state = sc->sc_state == UMB_S_UP ? LINK_STATE_UP : LINK_STATE_DOWN; 954 if (ifp->if_link_state != state) { 955 if (ifp->if_flags & IFF_DEBUG) 956 log(LOG_DEBUG, "%s: link state changed from %s to %s\n", 957 DEVNAM(sc), 958 LINK_STATE_IS_UP(ifp->if_link_state) 959 ? "up" : "down", 960 LINK_STATE_IS_UP(state) ? "up" : "down"); 961 ifp->if_link_state = state; 962 if (!LINK_STATE_IS_UP(state)) { 963 /* 964 * Purge any existing addresses 965 */ 966 memset(sc->sc_info.ipv4dns, 0, 967 sizeof (sc->sc_info.ipv4dns)); 968 NET_LOCK(); 969 if (in_ioctl(SIOCGIFADDR, (caddr_t)&ifr, ifp, 1) == 0 && 970 satosin(&ifr.ifr_addr)->sin_addr.s_addr != 971 INADDR_ANY) { 972 memset(&ifra, 0, sizeof (ifra)); 973 memcpy(&ifra.ifra_addr, &ifr.ifr_addr, 974 sizeof (ifra.ifra_addr)); 975 in_ioctl(SIOCDIFADDR, (caddr_t)&ifra, ifp, 1); 976 } 977 NET_UNLOCK(); 978 } 979 if_link_state_change(ifp); 980 } 981 splx(s); 982 } 983 984 void 985 umb_up(struct umb_softc *sc) 986 { 987 splassert(IPL_NET); 988 989 switch (sc->sc_state) { 990 case UMB_S_DOWN: 991 DPRINTF("%s: init: opening ...\n", DEVNAM(sc)); 992 umb_open(sc); 993 break; 994 case UMB_S_OPEN: 995 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED) { 996 if (sc->sc_cid == -1) { 997 DPRINTF("%s: init: allocating CID ...\n", 998 DEVNAM(sc)); 999 umb_allocate_cid(sc); 1000 break; 1001 } else 1002 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP); 1003 } else { 1004 DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc)); 1005 umb_radio(sc, 1); 1006 break; 1007 } 1008 /*FALLTHROUGH*/ 1009 case UMB_S_CID: 1010 DPRINTF("%s: init: sending FCC auth ...\n", DEVNAM(sc)); 1011 umb_send_fcc_auth(sc); 1012 break; 1013 case UMB_S_RADIO: 1014 DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc)); 1015 umb_cmd(sc, MBIM_CID_SUBSCRIBER_READY_STATUS, MBIM_CMDOP_QRY, 1016 NULL, 0); 1017 break; 1018 case UMB_S_SIMREADY: 1019 DPRINTF("%s: init: attaching ...\n", DEVNAM(sc)); 1020 umb_packet_service(sc, 1); 1021 break; 1022 case UMB_S_ATTACHED: 1023 sc->sc_tx_seq = 0; 1024 if (!umb_alloc_xfers(sc)) { 1025 umb_free_xfers(sc); 1026 printf("%s: allocation of xfers failed\n", DEVNAM(sc)); 1027 break; 1028 } 1029 DPRINTF("%s: init: connecting ...\n", DEVNAM(sc)); 1030 umb_connect(sc); 1031 break; 1032 case UMB_S_CONNECTED: 1033 DPRINTF("%s: init: getting IP config ...\n", DEVNAM(sc)); 1034 umb_qry_ipconfig(sc); 1035 break; 1036 case UMB_S_UP: 1037 DPRINTF("%s: init: reached state UP\n", DEVNAM(sc)); 1038 if (!umb_alloc_bulkpipes(sc)) { 1039 printf("%s: opening bulk pipes failed\n", DEVNAM(sc)); 1040 umb_down(sc, 1); 1041 } 1042 break; 1043 } 1044 if (sc->sc_state < UMB_S_UP) 1045 timeout_add_sec(&sc->sc_statechg_timer, 1046 UMB_STATE_CHANGE_TIMEOUT); 1047 else 1048 timeout_del(&sc->sc_statechg_timer); 1049 return; 1050 } 1051 1052 void 1053 umb_down(struct umb_softc *sc, int force) 1054 { 1055 splassert(IPL_NET); 1056 1057 umb_close_bulkpipes(sc); 1058 if (sc->sc_state < UMB_S_CONNECTED) 1059 umb_free_xfers(sc); 1060 1061 switch (sc->sc_state) { 1062 case UMB_S_UP: 1063 case UMB_S_CONNECTED: 1064 DPRINTF("%s: stop: disconnecting ...\n", DEVNAM(sc)); 1065 umb_disconnect(sc); 1066 if (!force) 1067 break; 1068 /*FALLTHROUGH*/ 1069 case UMB_S_ATTACHED: 1070 DPRINTF("%s: stop: detaching ...\n", DEVNAM(sc)); 1071 umb_packet_service(sc, 0); 1072 if (!force) 1073 break; 1074 /*FALLTHROUGH*/ 1075 case UMB_S_SIMREADY: 1076 case UMB_S_RADIO: 1077 DPRINTF("%s: stop: turning radio off ...\n", DEVNAM(sc)); 1078 umb_radio(sc, 0); 1079 if (!force) 1080 break; 1081 /*FALLTHROUGH*/ 1082 case UMB_S_CID: 1083 case UMB_S_OPEN: 1084 case UMB_S_DOWN: 1085 /* Do not close the device */ 1086 DPRINTF("%s: stop: reached state DOWN\n", DEVNAM(sc)); 1087 break; 1088 } 1089 if (force) 1090 sc->sc_state = UMB_S_OPEN; 1091 1092 if (sc->sc_state > UMB_S_OPEN) 1093 timeout_add_sec(&sc->sc_statechg_timer, 1094 UMB_STATE_CHANGE_TIMEOUT); 1095 else 1096 timeout_del(&sc->sc_statechg_timer); 1097 } 1098 1099 void 1100 umb_get_response_task(void *arg) 1101 { 1102 struct umb_softc *sc = arg; 1103 int len; 1104 int s; 1105 1106 /* 1107 * Function is required to send on RESPONSE_AVAILABLE notification for 1108 * each encapsulated response that is to be processed by the host. 1109 * But of course, we can receive multiple notifications before the 1110 * response task is run. 1111 */ 1112 s = splusb(); 1113 while (sc->sc_nresp > 0) { 1114 --sc->sc_nresp; 1115 len = sc->sc_ctrl_len; 1116 if (umb_get_encap_response(sc, sc->sc_resp_buf, &len)) 1117 umb_decode_response(sc, sc->sc_resp_buf, len); 1118 } 1119 splx(s); 1120 } 1121 1122 void 1123 umb_decode_response(struct umb_softc *sc, void *response, int len) 1124 { 1125 struct mbim_msghdr *hdr = response; 1126 struct mbim_fragmented_msg_hdr *fraghdr; 1127 uint32_t type; 1128 uint32_t tid; 1129 1130 DPRINTFN(3, "%s: got response: len %d\n", DEVNAM(sc), len); 1131 DDUMPN(4, response, len); 1132 1133 if (len < sizeof (*hdr) || letoh32(hdr->len) != len) { 1134 /* 1135 * We should probably cancel a transaction, but since the 1136 * message is too short, we cannot decode the transaction 1137 * id (tid) and hence don't know, whom to cancel. Must wait 1138 * for the timeout. 1139 */ 1140 DPRINTF("%s: received short response (len %d)\n", 1141 DEVNAM(sc), len); 1142 return; 1143 } 1144 1145 /* 1146 * XXX FIXME: if message is fragmented, store it until last frag 1147 * is received and then re-assemble all fragments. 1148 */ 1149 type = letoh32(hdr->type); 1150 tid = letoh32(hdr->tid); 1151 switch (type) { 1152 case MBIM_INDICATE_STATUS_MSG: 1153 case MBIM_COMMAND_DONE: 1154 fraghdr = response; 1155 if (letoh32(fraghdr->frag.nfrag) != 1) { 1156 DPRINTF("%s: discarding fragmented messages\n", 1157 DEVNAM(sc)); 1158 return; 1159 } 1160 break; 1161 default: 1162 break; 1163 } 1164 1165 DPRINTF("%s: <- rcv %s (tid %u)\n", DEVNAM(sc), umb_request2str(type), 1166 tid); 1167 switch (type) { 1168 case MBIM_FUNCTION_ERROR_MSG: 1169 case MBIM_HOST_ERROR_MSG: 1170 { 1171 struct mbim_f2h_hosterr *e; 1172 int err; 1173 1174 if (len >= sizeof (*e)) { 1175 e = response; 1176 err = letoh32(e->err); 1177 1178 DPRINTF("%s: %s message, error %s (tid %u)\n", 1179 DEVNAM(sc), umb_request2str(type), 1180 umb_error2str(err), tid); 1181 if (err == MBIM_ERROR_NOT_OPENED) 1182 umb_newstate(sc, UMB_S_DOWN, 0); 1183 } 1184 break; 1185 } 1186 case MBIM_INDICATE_STATUS_MSG: 1187 umb_handle_indicate_status_msg(sc, response, len); 1188 break; 1189 case MBIM_OPEN_DONE: 1190 umb_handle_opendone_msg(sc, response, len); 1191 break; 1192 case MBIM_CLOSE_DONE: 1193 umb_handle_closedone_msg(sc, response, len); 1194 break; 1195 case MBIM_COMMAND_DONE: 1196 umb_command_done(sc, response, len); 1197 break; 1198 default: 1199 DPRINTF("%s: discard messsage %s\n", DEVNAM(sc), 1200 umb_request2str(type)); 1201 break; 1202 } 1203 } 1204 1205 void 1206 umb_handle_indicate_status_msg(struct umb_softc *sc, void *data, int len) 1207 { 1208 struct mbim_f2h_indicate_status *m = data; 1209 uint32_t infolen; 1210 uint32_t cid; 1211 1212 if (len < sizeof (*m)) { 1213 DPRINTF("%s: discard short %s messsage\n", DEVNAM(sc), 1214 umb_request2str(letoh32(m->hdr.type))); 1215 return; 1216 } 1217 if (memcmp(m->devid, umb_uuid_basic_connect, sizeof (m->devid))) { 1218 DPRINTF("%s: discard %s messsage for other UUID '%s'\n", 1219 DEVNAM(sc), umb_request2str(letoh32(m->hdr.type)), 1220 umb_uuid2str(m->devid)); 1221 return; 1222 } 1223 infolen = letoh32(m->infolen); 1224 if (len < sizeof (*m) + infolen) { 1225 DPRINTF("%s: discard truncated %s messsage (want %d, got %d)\n", 1226 DEVNAM(sc), umb_request2str(letoh32(m->hdr.type)), 1227 (int)sizeof (*m) + infolen, len); 1228 return; 1229 } 1230 1231 cid = letoh32(m->cid); 1232 DPRINTF("%s: indicate %s status\n", DEVNAM(sc), umb_cid2str(cid)); 1233 umb_decode_cid(sc, cid, m->info, infolen); 1234 } 1235 1236 void 1237 umb_handle_opendone_msg(struct umb_softc *sc, void *data, int len) 1238 { 1239 struct mbim_f2h_openclosedone *resp = data; 1240 struct ifnet *ifp = GET_IFP(sc); 1241 uint32_t status; 1242 1243 status = letoh32(resp->status); 1244 if (status == MBIM_STATUS_SUCCESS) { 1245 if (sc->sc_maxsessions == 0) { 1246 umb_cmd(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_QRY, NULL, 1247 0); 1248 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_QRY, NULL, 0); 1249 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, 1250 NULL, 0); 1251 } 1252 umb_newstate(sc, UMB_S_OPEN, UMB_NS_DONT_DROP); 1253 } else if (ifp->if_flags & IFF_DEBUG) 1254 log(LOG_ERR, "%s: open error: %s\n", DEVNAM(sc), 1255 umb_status2str(status)); 1256 return; 1257 } 1258 1259 void 1260 umb_handle_closedone_msg(struct umb_softc *sc, void *data, int len) 1261 { 1262 struct mbim_f2h_openclosedone *resp = data; 1263 uint32_t status; 1264 1265 status = letoh32(resp->status); 1266 if (status == MBIM_STATUS_SUCCESS) 1267 umb_newstate(sc, UMB_S_DOWN, 0); 1268 else 1269 DPRINTF("%s: close error: %s\n", DEVNAM(sc), 1270 umb_status2str(status)); 1271 return; 1272 } 1273 1274 static inline void 1275 umb_getinfobuf(void *in, int inlen, uint32_t offs, uint32_t sz, 1276 void *out, size_t outlen) 1277 { 1278 offs = letoh32(offs); 1279 sz = letoh32(sz); 1280 if (inlen >= offs + sz) { 1281 memset(out, 0, outlen); 1282 memcpy(out, in + offs, MIN(sz, outlen)); 1283 } 1284 } 1285 1286 static inline int 1287 umb_addstr(void *buf, size_t bufsz, int *offs, void *str, int slen, 1288 uint32_t *offsmember, uint32_t *sizemember) 1289 { 1290 if (*offs + slen > bufsz) 1291 return 0; 1292 1293 *sizemember = htole32((uint32_t)slen); 1294 if (slen && str) { 1295 *offsmember = htole32((uint32_t)*offs); 1296 memcpy(buf + *offs, str, slen); 1297 *offs += slen; 1298 *offs += umb_padding(buf, bufsz, *offs, sizeof (uint32_t), 0); 1299 } else 1300 *offsmember = htole32(0); 1301 return 1; 1302 } 1303 1304 int 1305 umb_decode_register_state(struct umb_softc *sc, void *data, int len) 1306 { 1307 struct mbim_cid_registration_state_info *rs = data; 1308 struct ifnet *ifp = GET_IFP(sc); 1309 1310 if (len < sizeof (*rs)) 1311 return 0; 1312 sc->sc_info.nwerror = letoh32(rs->nwerror); 1313 sc->sc_info.regstate = letoh32(rs->regstate); 1314 sc->sc_info.regmode = letoh32(rs->regmode); 1315 sc->sc_info.cellclass = letoh32(rs->curcellclass); 1316 1317 /* XXX should we remember the provider_id? */ 1318 umb_getinfobuf(data, len, rs->provname_offs, rs->provname_size, 1319 sc->sc_info.provider, sizeof (sc->sc_info.provider)); 1320 umb_getinfobuf(data, len, rs->roamingtxt_offs, rs->roamingtxt_size, 1321 sc->sc_info.roamingtxt, sizeof (sc->sc_info.roamingtxt)); 1322 1323 DPRINTFN(2, "%s: %s, availclass 0x%x, class 0x%x, regmode %d\n", 1324 DEVNAM(sc), umb_regstate(sc->sc_info.regstate), 1325 letoh32(rs->availclasses), sc->sc_info.cellclass, 1326 sc->sc_info.regmode); 1327 1328 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && 1329 !sc->sc_roaming && 1330 sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED) { 1331 if (ifp->if_flags & IFF_DEBUG) 1332 log(LOG_INFO, 1333 "%s: disconnecting from roaming network\n", 1334 DEVNAM(sc)); 1335 umb_disconnect(sc); 1336 } 1337 return 1; 1338 } 1339 1340 int 1341 umb_decode_devices_caps(struct umb_softc *sc, void *data, int len) 1342 { 1343 struct mbim_cid_device_caps *dc = data; 1344 1345 if (len < sizeof (*dc)) 1346 return 0; 1347 sc->sc_maxsessions = letoh32(dc->max_sessions); 1348 sc->sc_info.supportedclasses = letoh32(dc->dataclass); 1349 umb_getinfobuf(data, len, dc->devid_offs, dc->devid_size, 1350 sc->sc_info.devid, sizeof (sc->sc_info.devid)); 1351 umb_getinfobuf(data, len, dc->fwinfo_offs, dc->fwinfo_size, 1352 sc->sc_info.fwinfo, sizeof (sc->sc_info.fwinfo)); 1353 umb_getinfobuf(data, len, dc->hwinfo_offs, dc->hwinfo_size, 1354 sc->sc_info.hwinfo, sizeof (sc->sc_info.hwinfo)); 1355 DPRINTFN(2, "%s: max sessions %d, supported classes 0x%x\n", 1356 DEVNAM(sc), sc->sc_maxsessions, sc->sc_info.supportedclasses); 1357 return 1; 1358 } 1359 1360 int 1361 umb_decode_subscriber_status(struct umb_softc *sc, void *data, int len) 1362 { 1363 struct mbim_cid_subscriber_ready_info *si = data; 1364 struct ifnet *ifp = GET_IFP(sc); 1365 int npn; 1366 1367 if (len < sizeof (*si)) 1368 return 0; 1369 sc->sc_info.sim_state = letoh32(si->ready); 1370 1371 umb_getinfobuf(data, len, si->sid_offs, si->sid_size, 1372 sc->sc_info.sid, sizeof (sc->sc_info.sid)); 1373 umb_getinfobuf(data, len, si->icc_offs, si->icc_size, 1374 sc->sc_info.iccid, sizeof (sc->sc_info.iccid)); 1375 1376 npn = letoh32(si->no_pn); 1377 if (npn > 0) 1378 umb_getinfobuf(data, len, si->pn[0].offs, si->pn[0].size, 1379 sc->sc_info.pn, sizeof (sc->sc_info.pn)); 1380 else 1381 memset(sc->sc_info.pn, 0, sizeof (sc->sc_info.pn)); 1382 1383 if (sc->sc_info.sim_state == MBIM_SIMSTATE_LOCKED) 1384 sc->sc_info.pin_state = UMB_PUK_REQUIRED; 1385 if (ifp->if_flags & IFF_DEBUG) 1386 log(LOG_INFO, "%s: SIM %s\n", DEVNAM(sc), 1387 umb_simstate(sc->sc_info.sim_state)); 1388 if (sc->sc_info.sim_state == MBIM_SIMSTATE_INITIALIZED) 1389 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_DROP); 1390 return 1; 1391 } 1392 1393 int 1394 umb_decode_radio_state(struct umb_softc *sc, void *data, int len) 1395 { 1396 struct mbim_cid_radio_state_info *rs = data; 1397 struct ifnet *ifp = GET_IFP(sc); 1398 1399 if (len < sizeof (*rs)) 1400 return 0; 1401 1402 sc->sc_info.hw_radio_on = 1403 (letoh32(rs->hw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0; 1404 sc->sc_info.sw_radio_on = 1405 (letoh32(rs->sw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0; 1406 if (!sc->sc_info.hw_radio_on) { 1407 printf("%s: radio is disabled by hardware switch\n", 1408 DEVNAM(sc)); 1409 /* 1410 * XXX do we need a time to poll the state of the rfkill switch 1411 * or will the device send an unsolicited notification 1412 * in case the state changes? 1413 */ 1414 umb_newstate(sc, UMB_S_OPEN, 0); 1415 } else if (!sc->sc_info.sw_radio_on) { 1416 if (ifp->if_flags & IFF_DEBUG) 1417 log(LOG_INFO, "%s: radio is off\n", DEVNAM(sc)); 1418 umb_newstate(sc, UMB_S_OPEN, 0); 1419 } else 1420 umb_newstate(sc, UMB_S_RADIO, UMB_NS_DONT_DROP); 1421 return 1; 1422 } 1423 1424 int 1425 umb_decode_pin(struct umb_softc *sc, void *data, int len) 1426 { 1427 struct mbim_cid_pin_info *pi = data; 1428 struct ifnet *ifp = GET_IFP(sc); 1429 uint32_t attempts_left; 1430 1431 if (len < sizeof (*pi)) 1432 return 0; 1433 1434 attempts_left = letoh32(pi->remaining_attempts); 1435 if (attempts_left != 0xffffffff) 1436 sc->sc_info.pin_attempts_left = attempts_left; 1437 1438 switch (letoh32(pi->state)) { 1439 case MBIM_PIN_STATE_UNLOCKED: 1440 sc->sc_info.pin_state = UMB_PIN_UNLOCKED; 1441 break; 1442 case MBIM_PIN_STATE_LOCKED: 1443 switch (letoh32(pi->type)) { 1444 case MBIM_PIN_TYPE_PIN1: 1445 sc->sc_info.pin_state = UMB_PIN_REQUIRED; 1446 break; 1447 case MBIM_PIN_TYPE_PUK1: 1448 sc->sc_info.pin_state = UMB_PUK_REQUIRED; 1449 break; 1450 case MBIM_PIN_TYPE_PIN2: 1451 case MBIM_PIN_TYPE_PUK2: 1452 /* Assume that PIN1 was accepted */ 1453 sc->sc_info.pin_state = UMB_PIN_UNLOCKED; 1454 break; 1455 } 1456 break; 1457 } 1458 if (ifp->if_flags & IFF_DEBUG) 1459 log(LOG_INFO, "%s: %s state %s (%d attempts left)\n", 1460 DEVNAM(sc), umb_pin_type(letoh32(pi->type)), 1461 (letoh32(pi->state) == MBIM_PIN_STATE_UNLOCKED) ? 1462 "unlocked" : "locked", 1463 letoh32(pi->remaining_attempts)); 1464 1465 /* 1466 * In case the PIN was set after IFF_UP, retrigger the state machine 1467 */ 1468 usb_add_task(sc->sc_udev, &sc->sc_umb_task); 1469 return 1; 1470 } 1471 1472 int 1473 umb_decode_packet_service(struct umb_softc *sc, void *data, int len) 1474 { 1475 struct mbim_cid_packet_service_info *psi = data; 1476 int state, highestclass; 1477 uint64_t up_speed, down_speed; 1478 struct ifnet *ifp = GET_IFP(sc); 1479 1480 if (len < sizeof (*psi)) 1481 return 0; 1482 1483 sc->sc_info.nwerror = letoh32(psi->nwerror); 1484 state = letoh32(psi->state); 1485 highestclass = letoh32(psi->highest_dataclass); 1486 up_speed = letoh64(psi->uplink_speed); 1487 down_speed = letoh64(psi->downlink_speed); 1488 if (sc->sc_info.packetstate != state || 1489 sc->sc_info.uplink_speed != up_speed || 1490 sc->sc_info.downlink_speed != down_speed) { 1491 if (ifp->if_flags & IFF_DEBUG) { 1492 log(LOG_INFO, "%s: packet service ", DEVNAM(sc)); 1493 if (sc->sc_info.packetstate != state) 1494 addlog("changed from %s to ", 1495 umb_packet_state(sc->sc_info.packetstate)); 1496 addlog("%s, class %s, speed: %llu up / %llu down\n", 1497 umb_packet_state(state), 1498 umb_dataclass(highestclass), up_speed, down_speed); 1499 } 1500 } 1501 sc->sc_info.packetstate = state; 1502 sc->sc_info.highestclass = highestclass; 1503 sc->sc_info.uplink_speed = up_speed; 1504 sc->sc_info.downlink_speed = down_speed; 1505 1506 if (sc->sc_info.regmode == MBIM_REGMODE_AUTOMATIC) { 1507 /* 1508 * For devices using automatic registration mode, just proceed, 1509 * once registration has completed. 1510 */ 1511 if (ifp->if_flags & IFF_UP) { 1512 switch (sc->sc_info.regstate) { 1513 case MBIM_REGSTATE_HOME: 1514 case MBIM_REGSTATE_ROAMING: 1515 case MBIM_REGSTATE_PARTNER: 1516 umb_newstate(sc, UMB_S_ATTACHED, 1517 UMB_NS_DONT_DROP); 1518 break; 1519 default: 1520 break; 1521 } 1522 } else 1523 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE); 1524 } else switch (sc->sc_info.packetstate) { 1525 case MBIM_PKTSERVICE_STATE_ATTACHED: 1526 umb_newstate(sc, UMB_S_ATTACHED, UMB_NS_DONT_DROP); 1527 break; 1528 case MBIM_PKTSERVICE_STATE_DETACHED: 1529 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE); 1530 break; 1531 } 1532 return 1; 1533 } 1534 1535 int 1536 umb_decode_signal_state(struct umb_softc *sc, void *data, int len) 1537 { 1538 struct mbim_cid_signal_state *ss = data; 1539 struct ifnet *ifp = GET_IFP(sc); 1540 int rssi; 1541 1542 if (len < sizeof (*ss)) 1543 return 0; 1544 1545 if (letoh32(ss->rssi) == 99) 1546 rssi = UMB_VALUE_UNKNOWN; 1547 else { 1548 rssi = -113 + 2 * letoh32(ss->rssi); 1549 if ((ifp->if_flags & IFF_DEBUG) && sc->sc_info.rssi != rssi && 1550 sc->sc_state >= UMB_S_CONNECTED) 1551 log(LOG_INFO, "%s: rssi %d dBm\n", DEVNAM(sc), rssi); 1552 } 1553 sc->sc_info.rssi = rssi; 1554 sc->sc_info.ber = letoh32(ss->err_rate); 1555 if (sc->sc_info.ber == -99) 1556 sc->sc_info.ber = UMB_VALUE_UNKNOWN; 1557 return 1; 1558 } 1559 1560 int 1561 umb_decode_connect_info(struct umb_softc *sc, void *data, int len) 1562 { 1563 struct mbim_cid_connect_info *ci = data; 1564 struct ifnet *ifp = GET_IFP(sc); 1565 int act; 1566 1567 if (len < sizeof (*ci)) 1568 return 0; 1569 1570 if (letoh32(ci->sessionid) != umb_session_id) { 1571 DPRINTF("%s: discard connection info for session %u\n", 1572 DEVNAM(sc), letoh32(ci->sessionid)); 1573 return 1; 1574 } 1575 if (memcmp(ci->context, umb_uuid_context_internet, 1576 sizeof (ci->context))) { 1577 DPRINTF("%s: discard connection info for other context\n", 1578 DEVNAM(sc)); 1579 return 1; 1580 } 1581 act = letoh32(ci->activation); 1582 if (sc->sc_info.activation != act) { 1583 if (ifp->if_flags & IFF_DEBUG) 1584 log(LOG_INFO, "%s: connection %s\n", DEVNAM(sc), 1585 umb_activation(act)); 1586 if ((ifp->if_flags & IFF_DEBUG) && 1587 letoh32(ci->iptype) != MBIM_CONTEXT_IPTYPE_DEFAULT && 1588 letoh32(ci->iptype) != MBIM_CONTEXT_IPTYPE_IPV4) 1589 log(LOG_DEBUG, "%s: got iptype %d connection\n", 1590 DEVNAM(sc), letoh32(ci->iptype)); 1591 1592 sc->sc_info.activation = act; 1593 sc->sc_info.nwerror = letoh32(ci->nwerror); 1594 1595 if (sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED) 1596 umb_newstate(sc, UMB_S_CONNECTED, UMB_NS_DONT_DROP); 1597 else if (sc->sc_info.activation == 1598 MBIM_ACTIVATION_STATE_DEACTIVATED) 1599 umb_newstate(sc, UMB_S_ATTACHED, 0); 1600 /* else: other states are purely transitional */ 1601 } 1602 return 1; 1603 } 1604 1605 int 1606 umb_decode_ip_configuration(struct umb_softc *sc, void *data, int len) 1607 { 1608 struct mbim_cid_ip_configuration_info *ic = data; 1609 struct ifnet *ifp = GET_IFP(sc); 1610 int s; 1611 uint32_t avail; 1612 uint32_t val; 1613 int n, i; 1614 int off; 1615 struct mbim_cid_ipv4_element ipv4elem; 1616 struct in_aliasreq ifra; 1617 struct sockaddr_in *sin; 1618 int state = -1; 1619 int rv; 1620 1621 if (len < sizeof (*ic)) 1622 return 0; 1623 if (letoh32(ic->sessionid) != umb_session_id) { 1624 DPRINTF("%s: ignore IP configration for session id %d\n", 1625 DEVNAM(sc), letoh32(ic->sessionid)); 1626 return 0; 1627 } 1628 s = splnet(); 1629 1630 /* 1631 * IPv4 configuation 1632 */ 1633 avail = letoh32(ic->ipv4_available); 1634 if (avail & MBIM_IPCONF_HAS_ADDRINFO) { 1635 n = letoh32(ic->ipv4_naddr); 1636 off = letoh32(ic->ipv4_addroffs); 1637 1638 if (n == 0 || off + sizeof (ipv4elem) > len) 1639 goto done; 1640 1641 /* Only pick the first one */ 1642 memcpy(&ipv4elem, data + off, sizeof (ipv4elem)); 1643 ipv4elem.prefixlen = letoh32(ipv4elem.prefixlen); 1644 1645 memset(&ifra, 0, sizeof (ifra)); 1646 sin = (struct sockaddr_in *)&ifra.ifra_addr; 1647 sin->sin_family = AF_INET; 1648 sin->sin_len = sizeof (ifra.ifra_addr); 1649 sin->sin_addr.s_addr = ipv4elem.addr; 1650 1651 sin = (struct sockaddr_in *)&ifra.ifra_dstaddr; 1652 sin->sin_family = AF_INET; 1653 sin->sin_len = sizeof (ifra.ifra_dstaddr); 1654 if (avail & MBIM_IPCONF_HAS_GWINFO) { 1655 off = letoh32(ic->ipv4_gwoffs); 1656 sin->sin_addr.s_addr = *((uint32_t *)(data + off)); 1657 } 1658 1659 sin = (struct sockaddr_in *)&ifra.ifra_mask; 1660 sin->sin_family = AF_INET; 1661 sin->sin_len = sizeof (ifra.ifra_mask); 1662 in_len2mask(&sin->sin_addr, ipv4elem.prefixlen); 1663 1664 NET_LOCK(); 1665 rv = in_ioctl(SIOCAIFADDR, (caddr_t)&ifra, ifp, 1); 1666 NET_UNLOCK(); 1667 if (rv == 0) { 1668 if (ifp->if_flags & IFF_DEBUG) 1669 log(LOG_INFO, "%s: IPv4 addr %s, mask %s, " 1670 "gateway %s\n", DEVNAM(ifp->if_softc), 1671 umb_ntop(sintosa(&ifra.ifra_addr)), 1672 umb_ntop(sintosa(&ifra.ifra_mask)), 1673 umb_ntop(sintosa(&ifra.ifra_dstaddr))); 1674 state = UMB_S_UP; 1675 } else 1676 printf("%s: unable to set IPv4 address, error %d\n", 1677 DEVNAM(ifp->if_softc), rv); 1678 } 1679 1680 memset(sc->sc_info.ipv4dns, 0, sizeof (sc->sc_info.ipv4dns)); 1681 if (avail & MBIM_IPCONF_HAS_DNSINFO) { 1682 n = letoh32(ic->ipv4_ndnssrv); 1683 off = letoh32(ic->ipv4_dnssrvoffs); 1684 i = 0; 1685 while (n-- > 0) { 1686 if (off + sizeof (uint32_t) > len) 1687 break; 1688 val = *((uint32_t *)(data + off)); 1689 if (i < UMB_MAX_DNSSRV) 1690 sc->sc_info.ipv4dns[i++] = val; 1691 off += sizeof (uint32_t); 1692 } 1693 } 1694 1695 if ((avail & MBIM_IPCONF_HAS_MTUINFO)) { 1696 val = letoh32(ic->ipv4_mtu); 1697 if (ifp->if_hardmtu != val && val <= sc->sc_maxpktlen) { 1698 ifp->if_hardmtu = val; 1699 if (ifp->if_mtu > val) 1700 ifp->if_mtu = val; 1701 if (ifp->if_flags & IFF_DEBUG) 1702 log(LOG_INFO, "%s: MTU %d\n", DEVNAM(sc), val); 1703 } 1704 } 1705 1706 avail = letoh32(ic->ipv6_available); 1707 if ((ifp->if_flags & IFF_DEBUG) && avail & MBIM_IPCONF_HAS_ADDRINFO) { 1708 /* XXX FIXME: IPv6 configuation missing */ 1709 log(LOG_INFO, "%s: ignoring IPv6 configuration\n", DEVNAM(sc)); 1710 } 1711 if (state != -1) 1712 umb_newstate(sc, state, 0); 1713 1714 done: 1715 splx(s); 1716 return 1; 1717 } 1718 1719 void 1720 umb_rx(struct umb_softc *sc) 1721 { 1722 usbd_setup_xfer(sc->sc_rx_xfer, sc->sc_rx_pipe, sc, sc->sc_rx_buf, 1723 sc->sc_rx_bufsz, USBD_SHORT_XFER_OK | USBD_NO_COPY, 1724 USBD_NO_TIMEOUT, umb_rxeof); 1725 usbd_transfer(sc->sc_rx_xfer); 1726 } 1727 1728 void 1729 umb_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status) 1730 { 1731 struct umb_softc *sc = priv; 1732 struct ifnet *ifp = GET_IFP(sc); 1733 1734 if (usbd_is_dying(sc->sc_udev) || !(ifp->if_flags & IFF_RUNNING)) 1735 return; 1736 1737 if (status != USBD_NORMAL_COMPLETION) { 1738 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED) 1739 return; 1740 DPRINTF("%s: rx error: %s\n", DEVNAM(sc), usbd_errstr(status)); 1741 if (status == USBD_STALLED) 1742 usbd_clear_endpoint_stall_async(sc->sc_rx_pipe); 1743 if (++sc->sc_rx_nerr > 100) { 1744 log(LOG_ERR, "%s: too many rx errors, disabling\n", 1745 DEVNAM(sc)); 1746 usbd_deactivate(sc->sc_udev); 1747 } 1748 } else { 1749 sc->sc_rx_nerr = 0; 1750 umb_decap(sc, xfer); 1751 } 1752 1753 umb_rx(sc); 1754 return; 1755 } 1756 1757 int 1758 umb_encap(struct umb_softc *sc) 1759 { 1760 struct ncm_header16 *hdr; 1761 struct ncm_pointer16 *ptr; 1762 struct ncm_pointer16_dgram *dgram; 1763 int offs, poffs; 1764 struct mbuf_list tmpml = MBUF_LIST_INITIALIZER(); 1765 struct mbuf *m; 1766 usbd_status err; 1767 1768 /* All size constraints have been validated by the caller! */ 1769 hdr = sc->sc_tx_buf; 1770 USETDW(hdr->dwSignature, NCM_HDR16_SIG); 1771 USETW(hdr->wHeaderLength, sizeof (*hdr)); 1772 USETW(hdr->wBlockLength, 0); 1773 USETW(hdr->wSequence, sc->sc_tx_seq); 1774 sc->sc_tx_seq++; 1775 offs = sizeof (*hdr); 1776 offs += umb_padding(sc->sc_tx_buf, sc->sc_tx_bufsz, offs, 1777 sc->sc_align, 0); 1778 USETW(hdr->wNdpIndex, offs); 1779 1780 poffs = offs; 1781 ptr = (struct ncm_pointer16 *)(sc->sc_tx_buf + offs); 1782 USETDW(ptr->dwSignature, MBIM_NCM_NTH16_SIG(umb_session_id)); 1783 USETW(ptr->wNextNdpIndex, 0); 1784 dgram = &ptr->dgram[0]; 1785 offs = (caddr_t)dgram - (caddr_t)sc->sc_tx_buf; 1786 1787 /* Leave space for dgram pointers */ 1788 while ((m = ml_dequeue(&sc->sc_tx_ml)) != NULL) { 1789 offs += sizeof (*dgram); 1790 ml_enqueue(&tmpml, m); 1791 } 1792 offs += sizeof (*dgram); /* one more to terminate pointer list */ 1793 USETW(ptr->wLength, offs - poffs); 1794 1795 /* Encap mbufs */ 1796 while ((m = ml_dequeue(&tmpml)) != NULL) { 1797 offs += umb_padding(sc->sc_tx_buf, sc->sc_tx_bufsz, offs, 1798 sc->sc_ndp_div, sc->sc_ndp_remainder); 1799 USETW(dgram->wDatagramIndex, offs); 1800 USETW(dgram->wDatagramLen, m->m_pkthdr.len); 1801 dgram++; 1802 m_copydata(m, 0, m->m_pkthdr.len, sc->sc_tx_buf + offs); 1803 offs += m->m_pkthdr.len; 1804 ml_enqueue(&sc->sc_tx_ml, m); 1805 } 1806 1807 /* Terminating pointer */ 1808 USETW(dgram->wDatagramIndex, 0); 1809 USETW(dgram->wDatagramLen, 0); 1810 USETW(hdr->wBlockLength, offs); 1811 1812 DPRINTFN(3, "%s: encap %d bytes\n", DEVNAM(sc), offs); 1813 DDUMPN(5, sc->sc_tx_buf, offs); 1814 KASSERT(offs <= sc->sc_tx_bufsz); 1815 1816 usbd_setup_xfer(sc->sc_tx_xfer, sc->sc_tx_pipe, sc, sc->sc_tx_buf, offs, 1817 USBD_FORCE_SHORT_XFER | USBD_NO_COPY, umb_xfer_tout, umb_txeof); 1818 err = usbd_transfer(sc->sc_tx_xfer); 1819 if (err != USBD_IN_PROGRESS) { 1820 DPRINTF("%s: start tx error: %s\n", DEVNAM(sc), 1821 usbd_errstr(err)); 1822 ml_purge(&sc->sc_tx_ml); 1823 return 0; 1824 } 1825 return 1; 1826 } 1827 1828 void 1829 umb_txeof(struct usbd_xfer *xfer, void *priv, usbd_status status) 1830 { 1831 struct umb_softc *sc = priv; 1832 struct ifnet *ifp = GET_IFP(sc); 1833 int s; 1834 1835 s = splnet(); 1836 ml_purge(&sc->sc_tx_ml); 1837 ifq_clr_oactive(&ifp->if_snd); 1838 ifp->if_timer = 0; 1839 1840 if (status != USBD_NORMAL_COMPLETION) { 1841 if (status != USBD_NOT_STARTED && status != USBD_CANCELLED) { 1842 ifp->if_oerrors++; 1843 DPRINTF("%s: tx error: %s\n", DEVNAM(sc), 1844 usbd_errstr(status)); 1845 if (status == USBD_STALLED) 1846 usbd_clear_endpoint_stall_async(sc->sc_tx_pipe); 1847 } 1848 } 1849 if (IFQ_IS_EMPTY(&ifp->if_snd) == 0) 1850 umb_start(ifp); 1851 1852 splx(s); 1853 } 1854 1855 void 1856 umb_decap(struct umb_softc *sc, struct usbd_xfer *xfer) 1857 { 1858 struct ifnet *ifp = GET_IFP(sc); 1859 int s; 1860 void *buf; 1861 uint32_t len; 1862 char *dp; 1863 struct ncm_header16 *hdr16; 1864 struct ncm_header32 *hdr32; 1865 struct ncm_pointer16 *ptr16; 1866 struct ncm_pointer16_dgram *dgram16; 1867 struct ncm_pointer32_dgram *dgram32; 1868 uint32_t hsig, psig; 1869 int hlen, blen; 1870 int ptrlen, ptroff, dgentryoff; 1871 uint32_t doff, dlen; 1872 struct mbuf_list ml = MBUF_LIST_INITIALIZER(); 1873 struct mbuf *m; 1874 1875 usbd_get_xfer_status(xfer, NULL, &buf, &len, NULL); 1876 DPRINTFN(4, "%s: recv %d bytes\n", DEVNAM(sc), len); 1877 DDUMPN(5, buf, len); 1878 s = splnet(); 1879 if (len < sizeof (*hdr16)) 1880 goto toosmall; 1881 1882 hdr16 = (struct ncm_header16 *)buf; 1883 hsig = UGETDW(hdr16->dwSignature); 1884 hlen = UGETW(hdr16->wHeaderLength); 1885 if (len < hlen) 1886 goto toosmall; 1887 1888 switch (hsig) { 1889 case NCM_HDR16_SIG: 1890 blen = UGETW(hdr16->wBlockLength); 1891 ptroff = UGETW(hdr16->wNdpIndex); 1892 if (hlen != sizeof (*hdr16)) { 1893 DPRINTF("%s: bad header len %d for NTH16 (exp %zu)\n", 1894 DEVNAM(sc), hlen, sizeof (*hdr16)); 1895 goto fail; 1896 } 1897 break; 1898 case NCM_HDR32_SIG: 1899 hdr32 = (struct ncm_header32 *)hdr16; 1900 blen = UGETDW(hdr32->dwBlockLength); 1901 ptroff = UGETDW(hdr32->dwNdpIndex); 1902 if (hlen != sizeof (*hdr32)) { 1903 DPRINTF("%s: bad header len %d for NTH32 (exp %zu)\n", 1904 DEVNAM(sc), hlen, sizeof (*hdr32)); 1905 goto fail; 1906 } 1907 break; 1908 default: 1909 DPRINTF("%s: unsupported NCM header signature (0x%08x)\n", 1910 DEVNAM(sc), hsig); 1911 goto fail; 1912 } 1913 if (blen != 0 && len < blen) { 1914 DPRINTF("%s: bad NTB len (%d) for %d bytes of data\n", 1915 DEVNAM(sc), blen, len); 1916 goto fail; 1917 } 1918 1919 ptr16 = (struct ncm_pointer16 *)(buf + ptroff); 1920 psig = UGETDW(ptr16->dwSignature); 1921 ptrlen = UGETW(ptr16->wLength); 1922 if (len < ptrlen + ptroff) 1923 goto toosmall; 1924 if (!MBIM_NCM_NTH16_ISISG(psig) && !MBIM_NCM_NTH32_ISISG(psig)) { 1925 DPRINTF("%s: unsupported NCM pointer signature (0x%08x)\n", 1926 DEVNAM(sc), psig); 1927 goto fail; 1928 } 1929 1930 switch (hsig) { 1931 case NCM_HDR16_SIG: 1932 dgentryoff = offsetof(struct ncm_pointer16, dgram); 1933 break; 1934 case NCM_HDR32_SIG: 1935 dgentryoff = offsetof(struct ncm_pointer32, dgram); 1936 break; 1937 default: 1938 goto fail; 1939 } 1940 1941 while (dgentryoff < ptrlen) { 1942 switch (hsig) { 1943 case NCM_HDR16_SIG: 1944 if (ptroff + dgentryoff < sizeof (*dgram16)) 1945 goto done; 1946 dgram16 = (struct ncm_pointer16_dgram *) 1947 (buf + ptroff + dgentryoff); 1948 dgentryoff += sizeof (*dgram16); 1949 dlen = UGETW(dgram16->wDatagramLen); 1950 doff = UGETW(dgram16->wDatagramIndex); 1951 break; 1952 case NCM_HDR32_SIG: 1953 if (ptroff + dgentryoff < sizeof (*dgram32)) 1954 goto done; 1955 dgram32 = (struct ncm_pointer32_dgram *) 1956 (buf + ptroff + dgentryoff); 1957 dgentryoff += sizeof (*dgram32); 1958 dlen = UGETDW(dgram32->dwDatagramLen); 1959 doff = UGETDW(dgram32->dwDatagramIndex); 1960 break; 1961 default: 1962 ifp->if_ierrors++; 1963 goto done; 1964 } 1965 1966 /* Terminating zero entry */ 1967 if (dlen == 0 || doff == 0) 1968 break; 1969 if (len < dlen + doff) { 1970 /* Skip giant datagram but continue processing */ 1971 DPRINTF("%s: datagram too large (%d @ off %d)\n", 1972 DEVNAM(sc), dlen, doff); 1973 continue; 1974 } 1975 1976 dp = buf + doff; 1977 DPRINTFN(3, "%s: decap %d bytes\n", DEVNAM(sc), dlen); 1978 m = m_devget(dp, dlen, 0); 1979 if (m == NULL) { 1980 ifp->if_iqdrops++; 1981 continue; 1982 } 1983 1984 ml_enqueue(&ml, m); 1985 } 1986 done: 1987 if_input(ifp, &ml); 1988 splx(s); 1989 return; 1990 toosmall: 1991 DPRINTF("%s: packet too small (%d)\n", DEVNAM(sc), len); 1992 fail: 1993 ifp->if_ierrors++; 1994 splx(s); 1995 } 1996 1997 usbd_status 1998 umb_send_encap_command(struct umb_softc *sc, void *data, int len) 1999 { 2000 struct usbd_xfer *xfer; 2001 usb_device_request_t req; 2002 char *buf; 2003 2004 if (len > sc->sc_ctrl_len) 2005 return USBD_INVAL; 2006 2007 if ((xfer = usbd_alloc_xfer(sc->sc_udev)) == NULL) 2008 return USBD_NOMEM; 2009 if ((buf = usbd_alloc_buffer(xfer, len)) == NULL) { 2010 usbd_free_xfer(xfer); 2011 return USBD_NOMEM; 2012 } 2013 memcpy(buf, data, len); 2014 2015 /* XXX FIXME: if (total len > sc->sc_ctrl_len) => must fragment */ 2016 req.bmRequestType = UT_WRITE_CLASS_INTERFACE; 2017 req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND; 2018 USETW(req.wValue, 0); 2019 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 2020 USETW(req.wLength, len); 2021 DELAY(umb_delay); 2022 return usbd_request_async(xfer, &req, NULL, NULL); 2023 } 2024 2025 int 2026 umb_get_encap_response(struct umb_softc *sc, void *buf, int *len) 2027 { 2028 usb_device_request_t req; 2029 usbd_status err; 2030 2031 req.bmRequestType = UT_READ_CLASS_INTERFACE; 2032 req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE; 2033 USETW(req.wValue, 0); 2034 USETW(req.wIndex, sc->sc_ctrl_ifaceno); 2035 USETW(req.wLength, *len); 2036 /* XXX FIXME: re-assemble fragments */ 2037 2038 DELAY(umb_delay); 2039 err = usbd_do_request_flags(sc->sc_udev, &req, buf, USBD_SHORT_XFER_OK, 2040 len, umb_xfer_tout); 2041 if (err == USBD_NORMAL_COMPLETION) 2042 return 1; 2043 DPRINTF("%s: ctrl recv: %s\n", DEVNAM(sc), usbd_errstr(err)); 2044 return 0; 2045 } 2046 2047 void 2048 umb_ctrl_msg(struct umb_softc *sc, uint32_t req, void *data, int len) 2049 { 2050 struct ifnet *ifp = GET_IFP(sc); 2051 uint32_t tid; 2052 struct mbim_msghdr *hdr = data; 2053 usbd_status err; 2054 int s; 2055 2056 assertwaitok(); 2057 if (usbd_is_dying(sc->sc_udev)) 2058 return; 2059 if (len < sizeof (*hdr)) 2060 return; 2061 tid = ++sc->sc_tid; 2062 2063 hdr->type = htole32(req); 2064 hdr->len = htole32(len); 2065 hdr->tid = htole32(tid); 2066 2067 #ifdef UMB_DEBUG 2068 if (umb_debug) { 2069 const char *op, *str; 2070 if (req == MBIM_COMMAND_MSG) { 2071 struct mbim_h2f_cmd *c = data; 2072 if (letoh32(c->op) == MBIM_CMDOP_SET) 2073 op = "set"; 2074 else 2075 op = "qry"; 2076 str = umb_cid2str(letoh32(c->cid)); 2077 } else { 2078 op = "snd"; 2079 str = umb_request2str(req); 2080 } 2081 DPRINTF("%s: -> %s %s (tid %u)\n", DEVNAM(sc), op, str, tid); 2082 } 2083 #endif 2084 s = splusb(); 2085 err = umb_send_encap_command(sc, data, len); 2086 splx(s); 2087 if (err != USBD_NORMAL_COMPLETION) { 2088 if (ifp->if_flags & IFF_DEBUG) 2089 log(LOG_ERR, "%s: send %s msg (tid %u) failed: %s\n", 2090 DEVNAM(sc), umb_request2str(req), tid, 2091 usbd_errstr(err)); 2092 2093 /* will affect other transactions, too */ 2094 usbd_abort_pipe(sc->sc_udev->default_pipe); 2095 } else { 2096 DPRINTFN(2, "%s: sent %s (tid %u)\n", DEVNAM(sc), 2097 umb_request2str(req), tid); 2098 DDUMPN(3, data, len); 2099 } 2100 return; 2101 } 2102 2103 void 2104 umb_open(struct umb_softc *sc) 2105 { 2106 struct mbim_h2f_openmsg msg; 2107 2108 memset(&msg, 0, sizeof (msg)); 2109 msg.maxlen = htole32(sc->sc_ctrl_len); 2110 umb_ctrl_msg(sc, MBIM_OPEN_MSG, &msg, sizeof (msg)); 2111 return; 2112 } 2113 2114 void 2115 umb_close(struct umb_softc *sc) 2116 { 2117 struct mbim_h2f_closemsg msg; 2118 2119 memset(&msg, 0, sizeof (msg)); 2120 umb_ctrl_msg(sc, MBIM_CLOSE_MSG, &msg, sizeof (msg)); 2121 } 2122 2123 int 2124 umb_setpin(struct umb_softc *sc, int op, int is_puk, void *pin, int pinlen, 2125 void *newpin, int newpinlen) 2126 { 2127 struct mbim_cid_pin cp; 2128 int off; 2129 2130 if (pinlen == 0) 2131 return 0; 2132 if (pinlen < 0 || pinlen > MBIM_PIN_MAXLEN || 2133 newpinlen < 0 || newpinlen > MBIM_PIN_MAXLEN || 2134 op < 0 || op > MBIM_PIN_OP_CHANGE || 2135 (is_puk && op != MBIM_PIN_OP_ENTER)) 2136 return EINVAL; 2137 2138 memset(&cp, 0, sizeof (cp)); 2139 cp.type = htole32(is_puk ? MBIM_PIN_TYPE_PUK1 : MBIM_PIN_TYPE_PIN1); 2140 2141 off = offsetof(struct mbim_cid_pin, data); 2142 if (!umb_addstr(&cp, sizeof (cp), &off, pin, pinlen, 2143 &cp.pin_offs, &cp.pin_size)) 2144 return EINVAL; 2145 2146 cp.op = htole32(op); 2147 if (newpinlen) { 2148 if (!umb_addstr(&cp, sizeof (cp), &off, newpin, newpinlen, 2149 &cp.newpin_offs, &cp.newpin_size)) 2150 return EINVAL; 2151 } else { 2152 if ((op == MBIM_PIN_OP_CHANGE) || is_puk) 2153 return EINVAL; 2154 if (!umb_addstr(&cp, sizeof (cp), &off, NULL, 0, 2155 &cp.newpin_offs, &cp.newpin_size)) 2156 return EINVAL; 2157 } 2158 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_SET, &cp, off); 2159 return 0; 2160 } 2161 2162 void 2163 umb_setdataclass(struct umb_softc *sc) 2164 { 2165 struct mbim_cid_registration_state rs; 2166 uint32_t classes; 2167 2168 if (sc->sc_info.supportedclasses == MBIM_DATACLASS_NONE) 2169 return; 2170 2171 memset(&rs, 0, sizeof (rs)); 2172 rs.regaction = htole32(MBIM_REGACTION_AUTOMATIC); 2173 classes = sc->sc_info.supportedclasses; 2174 if (sc->sc_info.preferredclasses != MBIM_DATACLASS_NONE) 2175 classes &= sc->sc_info.preferredclasses; 2176 rs.data_class = htole32(classes); 2177 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_SET, &rs, sizeof (rs)); 2178 } 2179 2180 void 2181 umb_radio(struct umb_softc *sc, int on) 2182 { 2183 struct mbim_cid_radio_state s; 2184 2185 DPRINTF("%s: set radio %s\n", DEVNAM(sc), on ? "on" : "off"); 2186 memset(&s, 0, sizeof (s)); 2187 s.state = htole32(on ? MBIM_RADIO_STATE_ON : MBIM_RADIO_STATE_OFF); 2188 umb_cmd(sc, MBIM_CID_RADIO_STATE, MBIM_CMDOP_SET, &s, sizeof (s)); 2189 } 2190 2191 void 2192 umb_allocate_cid(struct umb_softc *sc) 2193 { 2194 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET, 2195 umb_qmi_alloc_cid, sizeof (umb_qmi_alloc_cid), umb_uuid_qmi_mbim); 2196 } 2197 2198 void 2199 umb_send_fcc_auth(struct umb_softc *sc) 2200 { 2201 uint8_t fccauth[sizeof (umb_qmi_fcc_auth)]; 2202 2203 if (sc->sc_cid == -1) { 2204 DPRINTF("%s: missing CID, cannot send FCC auth\n", DEVNAM(sc)); 2205 umb_allocate_cid(sc); 2206 return; 2207 } 2208 memcpy(fccauth, umb_qmi_fcc_auth, sizeof (fccauth)); 2209 fccauth[UMB_QMI_CID_OFFS] = sc->sc_cid; 2210 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET, 2211 fccauth, sizeof (fccauth), umb_uuid_qmi_mbim); 2212 } 2213 2214 void 2215 umb_packet_service(struct umb_softc *sc, int attach) 2216 { 2217 struct mbim_cid_packet_service s; 2218 2219 DPRINTF("%s: %s packet service\n", DEVNAM(sc), 2220 attach ? "attach" : "detach"); 2221 memset(&s, 0, sizeof (s)); 2222 s.action = htole32(attach ? 2223 MBIM_PKTSERVICE_ACTION_ATTACH : MBIM_PKTSERVICE_ACTION_DETACH); 2224 umb_cmd(sc, MBIM_CID_PACKET_SERVICE, MBIM_CMDOP_SET, &s, sizeof (s)); 2225 } 2226 2227 void 2228 umb_connect(struct umb_softc *sc) 2229 { 2230 struct ifnet *ifp = GET_IFP(sc); 2231 2232 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) { 2233 log(LOG_INFO, "%s: connection disabled in roaming network\n", 2234 DEVNAM(sc)); 2235 return; 2236 } 2237 if (ifp->if_flags & IFF_DEBUG) 2238 log(LOG_DEBUG, "%s: connecting ...\n", DEVNAM(sc)); 2239 umb_send_connect(sc, MBIM_CONNECT_ACTIVATE); 2240 } 2241 2242 void 2243 umb_disconnect(struct umb_softc *sc) 2244 { 2245 struct ifnet *ifp = GET_IFP(sc); 2246 2247 if (ifp->if_flags & IFF_DEBUG) 2248 log(LOG_DEBUG, "%s: disconnecting ...\n", DEVNAM(sc)); 2249 umb_send_connect(sc, MBIM_CONNECT_DEACTIVATE); 2250 } 2251 2252 void 2253 umb_send_connect(struct umb_softc *sc, int command) 2254 { 2255 struct mbim_cid_connect *c; 2256 int off; 2257 2258 /* Too large or the stack */ 2259 c = malloc(sizeof (*c), M_USBDEV, M_WAIT|M_ZERO); 2260 c->sessionid = htole32(umb_session_id); 2261 c->command = htole32(command); 2262 off = offsetof(struct mbim_cid_connect, data); 2263 if (!umb_addstr(c, sizeof (*c), &off, sc->sc_info.apn, 2264 sc->sc_info.apnlen, &c->access_offs, &c->access_size)) 2265 goto done; 2266 /* XXX FIXME: support user name and passphrase */ 2267 c->user_offs = htole32(0); 2268 c->user_size = htole32(0); 2269 c->passwd_offs = htole32(0); 2270 c->passwd_size = htole32(0); 2271 c->authprot = htole32(MBIM_AUTHPROT_NONE); 2272 c->compression = htole32(MBIM_COMPRESSION_NONE); 2273 c->iptype = htole32(MBIM_CONTEXT_IPTYPE_IPV4); 2274 memcpy(c->context, umb_uuid_context_internet, sizeof (c->context)); 2275 umb_cmd(sc, MBIM_CID_CONNECT, MBIM_CMDOP_SET, c, off); 2276 done: 2277 free(c, M_USBDEV, sizeof (*c)); 2278 return; 2279 } 2280 2281 void 2282 umb_qry_ipconfig(struct umb_softc *sc) 2283 { 2284 struct mbim_cid_ip_configuration_info ipc; 2285 2286 memset(&ipc, 0, sizeof (ipc)); 2287 ipc.sessionid = htole32(umb_session_id); 2288 umb_cmd(sc, MBIM_CID_IP_CONFIGURATION, MBIM_CMDOP_QRY, 2289 &ipc, sizeof (ipc)); 2290 } 2291 2292 void 2293 umb_cmd(struct umb_softc *sc, int cid, int op, void *data, int len) 2294 { 2295 umb_cmd1(sc, cid, op, data, len, umb_uuid_basic_connect); 2296 } 2297 2298 void 2299 umb_cmd1(struct umb_softc *sc, int cid, int op, void *data, int len, 2300 uint8_t *uuid) 2301 { 2302 struct mbim_h2f_cmd *cmd; 2303 int totlen; 2304 2305 /* XXX FIXME support sending fragments */ 2306 if (sizeof (*cmd) + len > sc->sc_ctrl_len) { 2307 DPRINTF("%s: set %s msg too long: cannot send\n", 2308 DEVNAM(sc), umb_cid2str(cid)); 2309 return; 2310 } 2311 cmd = sc->sc_ctrl_msg; 2312 memset(cmd, 0, sizeof (*cmd)); 2313 cmd->frag.nfrag = htole32(1); 2314 memcpy(cmd->devid, uuid, sizeof (cmd->devid)); 2315 cmd->cid = htole32(cid); 2316 cmd->op = htole32(op); 2317 cmd->infolen = htole32(len); 2318 totlen = sizeof (*cmd); 2319 if (len > 0) { 2320 memcpy(cmd + 1, data, len); 2321 totlen += len; 2322 } 2323 umb_ctrl_msg(sc, MBIM_COMMAND_MSG, cmd, totlen); 2324 } 2325 2326 void 2327 umb_command_done(struct umb_softc *sc, void *data, int len) 2328 { 2329 struct mbim_f2h_cmddone *cmd = data; 2330 struct ifnet *ifp = GET_IFP(sc); 2331 uint32_t status; 2332 uint32_t cid; 2333 uint32_t infolen; 2334 int qmimsg = 0; 2335 2336 if (len < sizeof (*cmd)) { 2337 DPRINTF("%s: discard short %s messsage\n", DEVNAM(sc), 2338 umb_request2str(letoh32(cmd->hdr.type))); 2339 return; 2340 } 2341 cid = letoh32(cmd->cid); 2342 if (memcmp(cmd->devid, umb_uuid_basic_connect, sizeof (cmd->devid))) { 2343 if (memcmp(cmd->devid, umb_uuid_qmi_mbim, 2344 sizeof (cmd->devid))) { 2345 DPRINTF("%s: discard %s messsage for other UUID '%s'\n", 2346 DEVNAM(sc), umb_request2str(letoh32(cmd->hdr.type)), 2347 umb_uuid2str(cmd->devid)); 2348 return; 2349 } else 2350 qmimsg = 1; 2351 } 2352 2353 status = letoh32(cmd->status); 2354 switch (status) { 2355 case MBIM_STATUS_SUCCESS: 2356 break; 2357 case MBIM_STATUS_NOT_INITIALIZED: 2358 if (ifp->if_flags & IFF_DEBUG) 2359 log(LOG_ERR, "%s: SIM not initialized (PIN missing)\n", 2360 DEVNAM(sc)); 2361 return; 2362 case MBIM_STATUS_PIN_REQUIRED: 2363 sc->sc_info.pin_state = UMB_PIN_REQUIRED; 2364 /*FALLTHROUGH*/ 2365 default: 2366 if (ifp->if_flags & IFF_DEBUG) 2367 log(LOG_ERR, "%s: set/qry %s failed: %s\n", DEVNAM(sc), 2368 umb_cid2str(cid), umb_status2str(status)); 2369 return; 2370 } 2371 2372 infolen = letoh32(cmd->infolen); 2373 if (len < sizeof (*cmd) + infolen) { 2374 DPRINTF("%s: discard truncated %s messsage (want %d, got %d)\n", 2375 DEVNAM(sc), umb_cid2str(cid), 2376 (int)sizeof (*cmd) + infolen, len); 2377 return; 2378 } 2379 if (qmimsg) { 2380 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED) 2381 umb_decode_qmi(sc, cmd->info, infolen); 2382 } else { 2383 DPRINTFN(2, "%s: set/qry %s done\n", DEVNAM(sc), 2384 umb_cid2str(cid)); 2385 umb_decode_cid(sc, cid, cmd->info, infolen); 2386 } 2387 } 2388 2389 void 2390 umb_decode_cid(struct umb_softc *sc, uint32_t cid, void *data, int len) 2391 { 2392 int ok = 1; 2393 2394 switch (cid) { 2395 case MBIM_CID_DEVICE_CAPS: 2396 ok = umb_decode_devices_caps(sc, data, len); 2397 break; 2398 case MBIM_CID_SUBSCRIBER_READY_STATUS: 2399 ok = umb_decode_subscriber_status(sc, data, len); 2400 break; 2401 case MBIM_CID_RADIO_STATE: 2402 ok = umb_decode_radio_state(sc, data, len); 2403 break; 2404 case MBIM_CID_PIN: 2405 ok = umb_decode_pin(sc, data, len); 2406 break; 2407 case MBIM_CID_REGISTER_STATE: 2408 ok = umb_decode_register_state(sc, data, len); 2409 break; 2410 case MBIM_CID_PACKET_SERVICE: 2411 ok = umb_decode_packet_service(sc, data, len); 2412 break; 2413 case MBIM_CID_SIGNAL_STATE: 2414 ok = umb_decode_signal_state(sc, data, len); 2415 break; 2416 case MBIM_CID_CONNECT: 2417 ok = umb_decode_connect_info(sc, data, len); 2418 break; 2419 case MBIM_CID_IP_CONFIGURATION: 2420 ok = umb_decode_ip_configuration(sc, data, len); 2421 break; 2422 default: 2423 /* 2424 * Note: the above list is incomplete and only contains 2425 * mandatory CIDs from the BASIC_CONNECT set. 2426 * So alternate values are not unusual. 2427 */ 2428 DPRINTFN(4, "%s: ignore %s\n", DEVNAM(sc), umb_cid2str(cid)); 2429 break; 2430 } 2431 if (!ok) 2432 DPRINTF("%s: discard %s with bad info length %d\n", 2433 DEVNAM(sc), umb_cid2str(cid), len); 2434 return; 2435 } 2436 2437 void 2438 umb_decode_qmi(struct umb_softc *sc, uint8_t *data, int len) 2439 { 2440 uint8_t srv; 2441 uint16_t msg, tlvlen; 2442 uint32_t val; 2443 2444 #define UMB_QMI_QMUXLEN 6 2445 if (len < UMB_QMI_QMUXLEN) 2446 goto tooshort; 2447 2448 srv = data[4]; 2449 data += UMB_QMI_QMUXLEN; 2450 len -= UMB_QMI_QMUXLEN; 2451 2452 #define UMB_GET16(p) ((uint16_t)*p | (uint16_t)*(p + 1) << 8) 2453 #define UMB_GET32(p) ((uint32_t)*p | (uint32_t)*(p + 1) << 8 | \ 2454 (uint32_t)*(p + 2) << 16 |(uint32_t)*(p + 3) << 24) 2455 switch (srv) { 2456 case 0: /* ctl */ 2457 #define UMB_QMI_CTLLEN 6 2458 if (len < UMB_QMI_CTLLEN) 2459 goto tooshort; 2460 msg = UMB_GET16(&data[2]); 2461 tlvlen = UMB_GET16(&data[4]); 2462 data += UMB_QMI_CTLLEN; 2463 len -= UMB_QMI_CTLLEN; 2464 break; 2465 case 2: /* dms */ 2466 #define UMB_QMI_DMSLEN 7 2467 if (len < UMB_QMI_DMSLEN) 2468 goto tooshort; 2469 msg = UMB_GET16(&data[3]); 2470 tlvlen = UMB_GET16(&data[5]); 2471 data += UMB_QMI_DMSLEN; 2472 len -= UMB_QMI_DMSLEN; 2473 break; 2474 default: 2475 DPRINTF("%s: discard QMI message for unknown service type %d\n", 2476 DEVNAM(sc), srv); 2477 return; 2478 } 2479 2480 if (len < tlvlen) 2481 goto tooshort; 2482 2483 #define UMB_QMI_TLVLEN 3 2484 while (len > 0) { 2485 if (len < UMB_QMI_TLVLEN) 2486 goto tooshort; 2487 tlvlen = UMB_GET16(&data[1]); 2488 if (len < UMB_QMI_TLVLEN + tlvlen) 2489 goto tooshort; 2490 switch (data[0]) { 2491 case 1: /* allocation info */ 2492 if (msg == 0x0022) { /* Allocate CID */ 2493 if (tlvlen != 2 || data[3] != 2) /* dms */ 2494 break; 2495 sc->sc_cid = data[4]; 2496 DPRINTF("%s: QMI CID %d allocated\n", 2497 DEVNAM(sc), sc->sc_cid); 2498 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP); 2499 } 2500 break; 2501 case 2: /* response */ 2502 if (tlvlen != sizeof (val)) 2503 break; 2504 val = UMB_GET32(&data[3]); 2505 switch (msg) { 2506 case 0x0022: /* Allocate CID */ 2507 if (val != 0) { 2508 log(LOG_ERR, "%s: allocation of QMI CID" 2509 " failed, error 0x%x\n", DEVNAM(sc), 2510 val); 2511 /* XXX how to proceed? */ 2512 return; 2513 } 2514 break; 2515 case 0x555f: /* Send FCC Authentication */ 2516 if (val == 0) 2517 log(LOG_INFO, "%s: send FCC " 2518 "Authentication succeeded\n", 2519 DEVNAM(sc)); 2520 else if (val == 0x001a0001) 2521 log(LOG_INFO, "%s: FCC Authentication " 2522 "not required\n", DEVNAM(sc)); 2523 else 2524 log(LOG_INFO, "%s: send FCC " 2525 "Authentication failed, " 2526 "error 0x%x\n", DEVNAM(sc), val); 2527 2528 /* FCC Auth is needed only once after power-on*/ 2529 sc->sc_flags &= ~UMBFLG_FCC_AUTH_REQUIRED; 2530 2531 /* Try to proceed anyway */ 2532 DPRINTF("%s: init: turning radio on ...\n", 2533 DEVNAM(sc)); 2534 umb_radio(sc, 1); 2535 break; 2536 default: 2537 break; 2538 } 2539 break; 2540 default: 2541 break; 2542 } 2543 data += UMB_QMI_TLVLEN + tlvlen; 2544 len -= UMB_QMI_TLVLEN + tlvlen; 2545 } 2546 return; 2547 2548 tooshort: 2549 DPRINTF("%s: discard short QMI message\n", DEVNAM(sc)); 2550 return; 2551 } 2552 2553 void 2554 umb_intr(struct usbd_xfer *xfer, void *priv, usbd_status status) 2555 { 2556 struct umb_softc *sc = priv; 2557 struct ifnet *ifp = GET_IFP(sc); 2558 int total_len; 2559 2560 if (status != USBD_NORMAL_COMPLETION) { 2561 DPRINTF("%s: notification error: %s\n", DEVNAM(sc), 2562 usbd_errstr(status)); 2563 if (status == USBD_STALLED) 2564 usbd_clear_endpoint_stall_async(sc->sc_ctrl_pipe); 2565 return; 2566 } 2567 usbd_get_xfer_status(xfer, NULL, NULL, &total_len, NULL); 2568 if (total_len < UCDC_NOTIFICATION_LENGTH) { 2569 DPRINTF("%s: short notification (%d<%d)\n", DEVNAM(sc), 2570 total_len, UCDC_NOTIFICATION_LENGTH); 2571 return; 2572 } 2573 if (sc->sc_intr_msg.bmRequestType != UCDC_NOTIFICATION) { 2574 DPRINTF("%s: unexpected notification (type=0x%02x)\n", 2575 DEVNAM(sc), sc->sc_intr_msg.bmRequestType); 2576 return; 2577 } 2578 2579 switch (sc->sc_intr_msg.bNotification) { 2580 case UCDC_N_NETWORK_CONNECTION: 2581 if (ifp->if_flags & IFF_DEBUG) 2582 log(LOG_DEBUG, "%s: network %sconnected\n", DEVNAM(sc), 2583 UGETW(sc->sc_intr_msg.wValue) ? "" : "dis"); 2584 break; 2585 case UCDC_N_RESPONSE_AVAILABLE: 2586 DPRINTFN(2, "%s: umb_intr: response available\n", DEVNAM(sc)); 2587 ++sc->sc_nresp; 2588 usb_add_task(sc->sc_udev, &sc->sc_get_response_task); 2589 break; 2590 case UCDC_N_CONNECTION_SPEED_CHANGE: 2591 DPRINTFN(2, "%s: umb_intr: connection speed changed\n", 2592 DEVNAM(sc)); 2593 break; 2594 default: 2595 DPRINTF("%s: unexpected notifiation (0x%02x)\n", 2596 DEVNAM(sc), sc->sc_intr_msg.bNotification); 2597 break; 2598 } 2599 } 2600 2601 /* 2602 * Diagnostic routines 2603 */ 2604 char * 2605 umb_ntop(struct sockaddr *sa) 2606 { 2607 #define NUMBUFS 4 2608 static char astr[NUMBUFS][INET_ADDRSTRLEN]; 2609 static unsigned nbuf = 0; 2610 char *s; 2611 2612 s = astr[nbuf++]; 2613 if (nbuf >= NUMBUFS) 2614 nbuf = 0; 2615 2616 switch (sa->sa_family) { 2617 case AF_INET: 2618 default: 2619 inet_ntop(AF_INET, &satosin(sa)->sin_addr, s, sizeof (astr[0])); 2620 break; 2621 case AF_INET6: 2622 inet_ntop(AF_INET6, &satosin6(sa)->sin6_addr, s, 2623 sizeof (astr[0])); 2624 break; 2625 } 2626 return s; 2627 } 2628 2629 #ifdef UMB_DEBUG 2630 char * 2631 umb_uuid2str(uint8_t uuid[MBIM_UUID_LEN]) 2632 { 2633 static char uuidstr[2 * MBIM_UUID_LEN + 5]; 2634 2635 #define UUID_BFMT "%02X" 2636 #define UUID_SEP "-" 2637 snprintf(uuidstr, sizeof (uuidstr), 2638 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_SEP 2639 UUID_BFMT UUID_BFMT UUID_SEP 2640 UUID_BFMT UUID_BFMT UUID_SEP 2641 UUID_BFMT UUID_BFMT UUID_SEP 2642 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT, 2643 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5], 2644 uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11], 2645 uuid[12], uuid[13], uuid[14], uuid[15]); 2646 return uuidstr; 2647 } 2648 2649 void 2650 umb_dump(void *buf, int len) 2651 { 2652 int i = 0; 2653 uint8_t *c = buf; 2654 2655 if (len == 0) 2656 return; 2657 while (i < len) { 2658 if ((i % 16) == 0) { 2659 if (i > 0) 2660 addlog("\n"); 2661 log(LOG_DEBUG, "%4d: ", i); 2662 } 2663 addlog(" %02x", *c); 2664 c++; 2665 i++; 2666 } 2667 addlog("\n"); 2668 } 2669 #endif /* UMB_DEBUG */ 2670