1 /* $NetBSD: if_umb.c,v 1.26 2024/07/05 04:31:52 rin Exp $ */
2 /* $OpenBSD: if_umb.c,v 1.20 2018/09/10 17:00:45 gerhard Exp $ */
3
4 /*
5 * Copyright (c) 2016 genua mbH
6 * All rights reserved.
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21 /*
22 * Mobile Broadband Interface Model specification:
23 * http://www.usb.org/developers/docs/devclass_docs/MBIM10Errata1_073013.zip
24 * Compliance testing guide
25 * http://www.usb.org/developers/docs/devclass_docs/MBIM-Compliance-1.0.pdf
26 */
27
28 #include <sys/cdefs.h>
29 __KERNEL_RCSID(0, "$NetBSD: if_umb.c,v 1.26 2024/07/05 04:31:52 rin Exp $");
30
31 #ifdef _KERNEL_OPT
32 #include "opt_inet.h"
33 #endif
34
35 #include <sys/param.h>
36 #include <sys/device.h>
37 #include <sys/endian.h>
38 #include <sys/kauth.h>
39 #include <sys/kernel.h>
40 #include <sys/kmem.h>
41 #include <sys/mbuf.h>
42 #include <sys/rndsource.h>
43 #include <sys/socket.h>
44 #include <sys/syslog.h>
45 #include <sys/systm.h>
46
47 #include <net/bpf.h>
48 #include <net/if.h>
49 #include <net/if_media.h>
50 #include <net/if_types.h>
51
52 #ifdef INET
53 #include <netinet/in.h>
54 #include <netinet/if_inarp.h>
55 #include <netinet/in_var.h>
56 #include <netinet/ip.h>
57 #endif
58
59 #include <dev/usb/usb.h>
60 #include <dev/usb/usbdi.h>
61 #include <dev/usb/usbdivar.h>
62 #include <dev/usb/usbdi_util.h>
63 #include <dev/usb/usbdevs.h>
64 #include <dev/usb/usbcdc.h>
65
66 #include <dev/usb/mbim.h>
67 #include <dev/usb/if_umbreg.h>
68
69 #ifdef UMB_DEBUG
70 #define DPRINTF(x...) \
71 do { if (umb_debug) log(LOG_DEBUG, x); } while (0)
72
73 #define DPRINTFN(n, x...) \
74 do { if (umb_debug >= (n)) log(LOG_DEBUG, x); } while (0)
75
76 #define DDUMPN(n, b, l) \
77 do { \
78 if (umb_debug >= (n)) \
79 umb_dump((b), (l)); \
80 } while (0)
81
82 int umb_debug = 0;
83 Static char *umb_uuid2str(uint8_t [MBIM_UUID_LEN]);
84 Static void umb_dump(void *, int);
85
86 #else
87 #define DPRINTF(x...) do { } while (0)
88 #define DPRINTFN(n, x...) do { } while (0)
89 #define DDUMPN(n, b, l) do { } while (0)
90 #endif
91
92 #define DEVNAM(sc) device_xname((sc)->sc_dev)
93
94 /*
95 * State change timeout
96 */
97 #define UMB_STATE_CHANGE_TIMEOUT 30
98
99 /*
100 * State change flags
101 */
102 #define UMB_NS_DONT_DROP 0x0001 /* do not drop below current state */
103 #define UMB_NS_DONT_RAISE 0x0002 /* do not raise below current state */
104
105 /*
106 * Diagnostic macros
107 */
108 const struct umb_valdescr umb_regstates[] = MBIM_REGSTATE_DESCRIPTIONS;
109 const struct umb_valdescr umb_dataclasses[] = MBIM_DATACLASS_DESCRIPTIONS;
110 const struct umb_valdescr umb_simstate[] = MBIM_SIMSTATE_DESCRIPTIONS;
111 const struct umb_valdescr umb_messages[] = MBIM_MESSAGES_DESCRIPTIONS;
112 const struct umb_valdescr umb_status[] = MBIM_STATUS_DESCRIPTIONS;
113 const struct umb_valdescr umb_cids[] = MBIM_CID_DESCRIPTIONS;
114 const struct umb_valdescr umb_pktstate[] = MBIM_PKTSRV_STATE_DESCRIPTIONS;
115 const struct umb_valdescr umb_actstate[] = MBIM_ACTIVATION_STATE_DESCRIPTIONS;
116 const struct umb_valdescr umb_error[] = MBIM_ERROR_DESCRIPTIONS;
117 const struct umb_valdescr umb_pintype[] = MBIM_PINTYPE_DESCRIPTIONS;
118 const struct umb_valdescr umb_istate[] = UMB_INTERNAL_STATE_DESCRIPTIONS;
119
120 #define umb_regstate(c) umb_val2descr(umb_regstates, (c))
121 #define umb_dataclass(c) umb_val2descr(umb_dataclasses, (c))
122 #define umb_simstate(s) umb_val2descr(umb_simstate, (s))
123 #define umb_request2str(m) umb_val2descr(umb_messages, (m))
124 #define umb_status2str(s) umb_val2descr(umb_status, (s))
125 #define umb_cid2str(c) umb_val2descr(umb_cids, (c))
126 #define umb_packet_state(s) umb_val2descr(umb_pktstate, (s))
127 #define umb_activation(s) umb_val2descr(umb_actstate, (s))
128 #define umb_error2str(e) umb_val2descr(umb_error, (e))
129 #define umb_pin_type(t) umb_val2descr(umb_pintype, (t))
130 #define umb_istate(s) umb_val2descr(umb_istate, (s))
131
132 Static int umb_match(device_t, cfdata_t, void *);
133 Static void umb_attach(device_t, device_t, void *);
134 Static int umb_detach(device_t, int);
135 Static int umb_activate(device_t, enum devact);
136 Static void umb_ncm_setup(struct umb_softc *);
137 Static int umb_alloc_xfers(struct umb_softc *);
138 Static void umb_free_xfers(struct umb_softc *);
139 Static int umb_alloc_bulkpipes(struct umb_softc *);
140 Static void umb_close_bulkpipes(struct umb_softc *);
141 Static int umb_ioctl(struct ifnet *, u_long, void *);
142 Static int umb_output(struct ifnet *, struct mbuf *,
143 const struct sockaddr *, const struct rtentry *);
144 Static void umb_input(struct ifnet *, struct mbuf *);
145 Static void umb_start(struct ifnet *);
146 Static void umb_watchdog(struct ifnet *);
147 Static void umb_statechg_timeout(void *);
148
149 Static int umb_mediachange(struct ifnet *);
150 Static void umb_mediastatus(struct ifnet *, struct ifmediareq *);
151
152 Static void umb_newstate(struct umb_softc *, enum umb_state, int);
153 Static void umb_state_task(void *);
154 Static void umb_up(struct umb_softc *);
155 Static void umb_down(struct umb_softc *, int);
156
157 Static void umb_get_response_task(void *);
158
159 Static void umb_decode_response(struct umb_softc *, void *, int);
160 Static void umb_handle_indicate_status_msg(struct umb_softc *, void *,
161 int);
162 Static void umb_handle_opendone_msg(struct umb_softc *, void *, int);
163 Static void umb_handle_closedone_msg(struct umb_softc *, void *, int);
164 Static int umb_decode_register_state(struct umb_softc *, void *, int);
165 Static int umb_decode_devices_caps(struct umb_softc *, void *, int);
166 Static int umb_decode_subscriber_status(struct umb_softc *, void *, int);
167 Static int umb_decode_radio_state(struct umb_softc *, void *, int);
168 Static int umb_decode_pin(struct umb_softc *, void *, int);
169 Static int umb_decode_packet_service(struct umb_softc *, void *, int);
170 Static int umb_decode_signal_state(struct umb_softc *, void *, int);
171 Static int umb_decode_connect_info(struct umb_softc *, void *, int);
172 Static int umb_decode_ip_configuration(struct umb_softc *, void *, int);
173 Static void umb_rx(struct umb_softc *);
174 Static void umb_rxeof(struct usbd_xfer *, void *, usbd_status);
175 Static int umb_encap(struct umb_softc *, struct mbuf *);
176 Static void umb_txeof(struct usbd_xfer *, void *, usbd_status);
177 Static void umb_decap(struct umb_softc *, struct usbd_xfer *);
178
179 Static usbd_status umb_send_encap_command(struct umb_softc *, void *, int);
180 Static int umb_get_encap_response(struct umb_softc *, void *, int *);
181 Static void umb_ctrl_msg(struct umb_softc *, uint32_t, void *, int);
182
183 Static void umb_open(struct umb_softc *);
184 Static void umb_close(struct umb_softc *);
185
186 Static int umb_setpin(struct umb_softc *, int, int, void *, int, void *,
187 int);
188 Static void umb_setdataclass(struct umb_softc *);
189 Static void umb_radio(struct umb_softc *, int);
190 Static void umb_allocate_cid(struct umb_softc *);
191 Static void umb_send_fcc_auth(struct umb_softc *);
192 Static void umb_packet_service(struct umb_softc *, int);
193 Static void umb_connect(struct umb_softc *);
194 Static void umb_disconnect(struct umb_softc *);
195 Static void umb_send_connect(struct umb_softc *, int);
196
197 Static void umb_qry_ipconfig(struct umb_softc *);
198 Static void umb_cmd(struct umb_softc *, int, int, const void *, int);
199 Static void umb_cmd1(struct umb_softc *, int, int, const void *, int, uint8_t *);
200 Static void umb_command_done(struct umb_softc *, void *, int);
201 Static void umb_decode_cid(struct umb_softc *, uint32_t, void *, int);
202 Static void umb_decode_qmi(struct umb_softc *, uint8_t *, int);
203
204 Static void umb_intr(struct usbd_xfer *, void *, usbd_status);
205
206 Static char *umb_ntop(struct sockaddr *);
207
208 Static const char *
209 inet_ntop(int af, const void *src, char *dst, socklen_t size);
210 static const char *inet_ntop4(const u_char *src, char *dst, size_t size);
211 #ifdef INET6
212 static const char *inet_ntop6(const u_char *src, char *dst, size_t size);
213 #endif /* INET6 */
214
215 Static int umb_xfer_tout = USBD_DEFAULT_TIMEOUT;
216
217 Static uint8_t umb_uuid_basic_connect[] = MBIM_UUID_BASIC_CONNECT;
218 Static uint8_t umb_uuid_context_internet[] = MBIM_UUID_CONTEXT_INTERNET;
219 Static uint8_t umb_uuid_qmi_mbim[] = MBIM_UUID_QMI_MBIM;
220 Static uint32_t umb_session_id = 0;
221
222 CFATTACH_DECL_NEW(umb, sizeof(struct umb_softc), umb_match, umb_attach,
223 umb_detach, umb_activate);
224
225 const int umb_delay = 4000;
226
227 /*
228 * These devices require an "FCC Authentication" command.
229 */
230 const struct usb_devno umb_fccauth_devs[] = {
231 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_EM7455 },
232 };
233
234 Static const uint8_t umb_qmi_alloc_cid[] = {
235 0x01,
236 0x0f, 0x00, /* len */
237 0x00, /* QMUX flags */
238 0x00, /* service "ctl" */
239 0x00, /* CID */
240 0x00, /* QMI flags */
241 0x01, /* transaction */
242 0x22, 0x00, /* msg "Allocate CID" */
243 0x04, 0x00, /* TLV len */
244 0x01, 0x01, 0x00, 0x02 /* TLV */
245 };
246
247 Static const uint8_t umb_qmi_fcc_auth[] = {
248 0x01,
249 0x0c, 0x00, /* len */
250 0x00, /* QMUX flags */
251 0x02, /* service "dms" */
252 #define UMB_QMI_CID_OFFS 5
253 0x00, /* CID (filled in later) */
254 0x00, /* QMI flags */
255 0x01, 0x00, /* transaction */
256 0x5f, 0x55, /* msg "Send FCC Authentication" */
257 0x00, 0x00 /* TLV len */
258 };
259
260 Static int
umb_match(device_t parent,cfdata_t match,void * aux)261 umb_match(device_t parent, cfdata_t match, void *aux)
262 {
263 struct usbif_attach_arg *uiaa = aux;
264 usb_interface_descriptor_t *id;
265
266 if (!uiaa->uiaa_iface)
267 return UMATCH_NONE;
268 if ((id = usbd_get_interface_descriptor(uiaa->uiaa_iface)) == NULL)
269 return UMATCH_NONE;
270
271 /*
272 * If this function implements NCM, check if alternate setting
273 * 1 implements MBIM.
274 */
275 if (id->bInterfaceClass == UICLASS_CDC &&
276 id->bInterfaceSubClass ==
277 UISUBCLASS_NETWORK_CONTROL_MODEL)
278 id = usbd_find_idesc(uiaa->uiaa_device->ud_cdesc, uiaa->uiaa_iface->ui_index, 1);
279 if (id == NULL)
280 return UMATCH_NONE;
281
282 if (id->bInterfaceClass == UICLASS_CDC &&
283 id->bInterfaceSubClass ==
284 UISUBCLASS_MOBILE_BROADBAND_INTERFACE_MODEL &&
285 id->bInterfaceProtocol == 0)
286 return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO;
287
288 return UMATCH_NONE;
289 }
290
291 Static void
umb_attach(device_t parent,device_t self,void * aux)292 umb_attach(device_t parent, device_t self, void *aux)
293 {
294 struct umb_softc *sc = device_private(self);
295 struct usbif_attach_arg *uiaa = aux;
296 char *devinfop;
297 usbd_status status;
298 usbd_desc_iter_t iter;
299 const usb_descriptor_t *desc;
300 const usb_cdc_descriptor_t *csdesc;
301 int v;
302 const usb_cdc_union_descriptor_t *ud;
303 const struct mbim_descriptor *md;
304 int i;
305 int ctrl_ep;
306 const usb_interface_descriptor_t *id;
307 usb_config_descriptor_t *cd;
308 usb_endpoint_descriptor_t *ed;
309 const usb_interface_assoc_descriptor_t *ad;
310 int current_ifaceno = -1;
311 int data_ifaceno = -1;
312 int altnum;
313 int s;
314 struct ifnet *ifp;
315
316 sc->sc_dev = self;
317 sc->sc_udev = uiaa->uiaa_device;
318
319 aprint_naive("\n");
320 aprint_normal("\n");
321
322 devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
323 aprint_normal_dev(self, "%s\n", devinfop);
324 usbd_devinfo_free(devinfop);
325
326 sc->sc_ctrl_ifaceno = uiaa->uiaa_ifaceno;
327
328 /*
329 * Some MBIM hardware does not provide the mandatory CDC Union
330 * Descriptor, so we also look at matching Interface
331 * Association Descriptors to find out the MBIM Data Interface
332 * number.
333 */
334 sc->sc_ver_maj = sc->sc_ver_min = -1;
335 sc->sc_maxpktlen = MBIM_MAXSEGSZ_MINVAL;
336 usb_desc_iter_init(sc->sc_udev, &iter);
337 while ((desc = usb_desc_iter_next(&iter))) {
338 if (desc->bDescriptorType == UDESC_INTERFACE_ASSOC) {
339 if (desc->bLength < sizeof(*ad))
340 continue;
341 ad = (const usb_interface_assoc_descriptor_t *)desc;
342 if (ad->bFirstInterface == uiaa->uiaa_ifaceno &&
343 ad->bInterfaceCount > 1)
344 data_ifaceno = uiaa->uiaa_ifaceno + 1;
345 continue;
346 }
347 if (desc->bDescriptorType == UDESC_INTERFACE) {
348 if (desc->bLength < sizeof(*id))
349 continue;
350 id = (const usb_interface_descriptor_t *)desc;
351 current_ifaceno = id->bInterfaceNumber;
352 continue;
353 }
354 if (current_ifaceno != uiaa->uiaa_ifaceno)
355 continue;
356 if (desc->bDescriptorType != UDESC_CS_INTERFACE)
357 continue;
358 if (desc->bLength < sizeof(*csdesc))
359 continue;
360 csdesc = (const usb_cdc_descriptor_t *)desc;
361 switch (csdesc->bDescriptorSubtype) {
362 case UDESCSUB_CDC_UNION:
363 if (desc->bLength < sizeof(*ud))
364 continue;
365 ud = (const usb_cdc_union_descriptor_t *)desc;
366 data_ifaceno = ud->bSlaveInterface[0];
367 break;
368 case UDESCSUB_MBIM:
369 if (desc->bLength < sizeof(*md))
370 continue;
371 md = (const struct mbim_descriptor *)desc;
372 v = UGETW(md->bcdMBIMVersion);
373 sc->sc_ver_maj = MBIM_VER_MAJOR(v);
374 sc->sc_ver_min = MBIM_VER_MINOR(v);
375 sc->sc_ctrl_len = UGETW(md->wMaxControlMessage);
376 /* Never trust a USB device! Could try to exploit us */
377 if (sc->sc_ctrl_len < MBIM_CTRLMSG_MINLEN ||
378 sc->sc_ctrl_len > MBIM_CTRLMSG_MAXLEN) {
379 DPRINTF("%s: control message len %d out of "
380 "bounds [%d .. %d]\n", DEVNAM(sc),
381 sc->sc_ctrl_len, MBIM_CTRLMSG_MINLEN,
382 MBIM_CTRLMSG_MAXLEN);
383 /* cont. anyway */
384 }
385 sc->sc_maxpktlen = UGETW(md->wMaxSegmentSize);
386 DPRINTFN(2, "%s: ctrl_len=%d, maxpktlen=%d, cap=%#x\n",
387 DEVNAM(sc), sc->sc_ctrl_len, sc->sc_maxpktlen,
388 md->bmNetworkCapabilities);
389 break;
390 default:
391 break;
392 }
393 }
394 if (sc->sc_ver_maj < 0) {
395 aprint_error_dev(self, "missing MBIM descriptor\n");
396 goto fail;
397 }
398
399 aprint_normal_dev(self, "version %d.%d\n", sc->sc_ver_maj,
400 sc->sc_ver_min);
401
402 if (usb_lookup(umb_fccauth_devs, uiaa->uiaa_vendor, uiaa->uiaa_product)) {
403 sc->sc_flags |= UMBFLG_FCC_AUTH_REQUIRED;
404 sc->sc_cid = -1;
405 }
406
407 for (i = 0; i < uiaa->uiaa_nifaces; i++) {
408 id = usbd_get_interface_descriptor(uiaa->uiaa_ifaces[i]);
409 if (id != NULL && id->bInterfaceNumber == data_ifaceno) {
410 sc->sc_data_iface = uiaa->uiaa_ifaces[i];
411 }
412 }
413 if (sc->sc_data_iface == NULL) {
414 aprint_error_dev(self, "no data interface found\n");
415 goto fail;
416 }
417
418 /*
419 * If this is a combined NCM/MBIM function, switch to
420 * alternate setting one to enable MBIM.
421 */
422 id = usbd_get_interface_descriptor(uiaa->uiaa_iface);
423 if (id->bInterfaceClass == UICLASS_CDC &&
424 id->bInterfaceSubClass ==
425 UISUBCLASS_NETWORK_CONTROL_MODEL)
426 usbd_set_interface(uiaa->uiaa_iface, 1);
427
428 id = usbd_get_interface_descriptor(uiaa->uiaa_iface);
429 ctrl_ep = -1;
430 for (i = 0; i < id->bNumEndpoints && ctrl_ep == -1; i++) {
431 ed = usbd_interface2endpoint_descriptor(uiaa->uiaa_iface, i);
432 if (ed == NULL)
433 break;
434 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT &&
435 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN)
436 ctrl_ep = ed->bEndpointAddress;
437 }
438 if (ctrl_ep == -1) {
439 aprint_error_dev(self, "missing interrupt endpoint\n");
440 goto fail;
441 }
442
443 /*
444 * For the MBIM Data Interface, select the appropriate
445 * alternate setting by looking for a matching descriptor that
446 * has two endpoints.
447 */
448 cd = usbd_get_config_descriptor(sc->sc_udev);
449 altnum = usbd_get_no_alts(cd, data_ifaceno);
450 for (i = 0; i < altnum; i++) {
451 id = usbd_find_idesc(cd, sc->sc_data_iface->ui_index, i);
452 if (id == NULL)
453 continue;
454 if (id->bInterfaceClass == UICLASS_CDC_DATA &&
455 id->bInterfaceSubClass == UISUBCLASS_DATA &&
456 id->bInterfaceProtocol == UIPROTO_DATA_MBIM &&
457 id->bNumEndpoints == 2)
458 break;
459 }
460 if (i == altnum || id == NULL) {
461 aprint_error_dev(self, "missing alt setting for interface #%d\n",
462 data_ifaceno);
463 goto fail;
464 }
465 status = usbd_set_interface(sc->sc_data_iface, i);
466 if (status) {
467 aprint_error_dev(self, "select alt setting %d for interface #%d "
468 "failed: %s\n", i, data_ifaceno, usbd_errstr(status));
469 goto fail;
470 }
471
472 id = usbd_get_interface_descriptor(sc->sc_data_iface);
473 sc->sc_rx_ep = sc->sc_tx_ep = -1;
474 for (i = 0; i < id->bNumEndpoints; i++) {
475 if ((ed = usbd_interface2endpoint_descriptor(sc->sc_data_iface,
476 i)) == NULL)
477 break;
478 if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
479 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN)
480 sc->sc_rx_ep = ed->bEndpointAddress;
481 else if (UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
482 UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT)
483 sc->sc_tx_ep = ed->bEndpointAddress;
484 }
485 if (sc->sc_rx_ep == -1 || sc->sc_tx_ep == -1) {
486 aprint_error_dev(self, "missing bulk endpoints\n");
487 goto fail;
488 }
489
490 DPRINTFN(2, "%s: ctrl-ifno#%d: ep-ctrl=%d, data-ifno#%d: ep-rx=%d, "
491 "ep-tx=%d\n", DEVNAM(sc), sc->sc_ctrl_ifaceno,
492 UE_GET_ADDR(ctrl_ep), data_ifaceno,
493 UE_GET_ADDR(sc->sc_rx_ep), UE_GET_ADDR(sc->sc_tx_ep));
494
495 usb_init_task(&sc->sc_umb_task, umb_state_task, sc,
496 0);
497 usb_init_task(&sc->sc_get_response_task, umb_get_response_task, sc,
498 0);
499 callout_init(&sc->sc_statechg_timer, 0);
500 callout_setfunc(&sc->sc_statechg_timer, umb_statechg_timeout, sc);
501
502 if (usbd_open_pipe_intr(uiaa->uiaa_iface, ctrl_ep, USBD_SHORT_XFER_OK,
503 &sc->sc_ctrl_pipe, sc, &sc->sc_intr_msg, sizeof(sc->sc_intr_msg),
504 umb_intr, USBD_DEFAULT_INTERVAL)) {
505 aprint_error_dev(self, "failed to open control pipe\n");
506 goto fail;
507 }
508
509 sc->sc_resp_buf = kmem_alloc(sc->sc_ctrl_len, KM_SLEEP);
510 sc->sc_ctrl_msg = kmem_alloc(sc->sc_ctrl_len, KM_SLEEP);
511
512 sc->sc_info.regstate = MBIM_REGSTATE_UNKNOWN;
513 sc->sc_info.pin_attempts_left = UMB_VALUE_UNKNOWN;
514 sc->sc_info.rssi = UMB_VALUE_UNKNOWN;
515 sc->sc_info.ber = UMB_VALUE_UNKNOWN;
516
517 umb_ncm_setup(sc);
518 DPRINTFN(2, "%s: rx/tx size %d/%d\n", DEVNAM(sc),
519 sc->sc_rx_bufsz, sc->sc_tx_bufsz);
520
521 s = splnet();
522
523 /* initialize the interface */
524 ifp = GET_IFP(sc);
525 ifp->if_softc = sc;
526 ifp->if_flags = IFF_SIMPLEX | IFF_MULTICAST | IFF_POINTOPOINT;
527 ifp->if_ioctl = umb_ioctl;
528 ifp->if_start = umb_start;
529
530 ifp->if_watchdog = umb_watchdog;
531 strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
532 ifp->if_link_state = LINK_STATE_DOWN;
533 ifmedia_init(&sc->sc_im, 0, umb_mediachange, umb_mediastatus);
534
535 ifp->if_type = IFT_MBIM;
536 ifp->if_addrlen = 0;
537 ifp->if_hdrlen = sizeof(struct ncm_header16) +
538 sizeof(struct ncm_pointer16);
539 ifp->if_mtu = 1500; /* use a common default */
540 ifp->if_mtu = sc->sc_maxpktlen;
541 ifp->if_output = umb_output;
542 ifp->_if_input = umb_input;
543 IFQ_SET_READY(&ifp->if_snd);
544
545 /* attach the interface */
546 if_initialize(ifp);
547 if_register(ifp);
548 if_alloc_sadl(ifp);
549
550 bpf_attach(ifp, DLT_RAW, 0);
551 rnd_attach_source(&sc->sc_rnd_source, device_xname(sc->sc_dev),
552 RND_TYPE_NET, RND_FLAG_DEFAULT);
553
554 /*
555 * Open the device now so that we are able to query device information.
556 * XXX maybe close when done?
557 */
558 umb_open(sc);
559
560 sc->sc_attached = 1;
561 splx(s);
562
563 usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev);
564
565 if (!pmf_device_register(self, NULL, NULL))
566 aprint_error_dev(self, "couldn't establish power handler\n");
567
568 return;
569
570 fail:
571 umb_activate(sc->sc_dev, DVACT_DEACTIVATE);
572 return;
573 }
574
575 Static int
umb_detach(device_t self,int flags)576 umb_detach(device_t self, int flags)
577 {
578 struct umb_softc *sc = device_private(self);
579 struct ifnet *ifp = GET_IFP(sc);
580 int s;
581
582 pmf_device_deregister(self);
583
584 s = splnet();
585 if (ifp->if_flags & IFF_RUNNING)
586 umb_down(sc, 1);
587 umb_close(sc);
588
589 usb_rem_task_wait(sc->sc_udev, &sc->sc_get_response_task,
590 USB_TASKQ_DRIVER, NULL);
591 sc->sc_nresp = 0;
592 if (sc->sc_rx_ep != -1 && sc->sc_tx_ep != -1) {
593 callout_destroy(&sc->sc_statechg_timer);
594 usb_rem_task_wait(sc->sc_udev, &sc->sc_umb_task,
595 USB_TASKQ_DRIVER, NULL);
596 }
597 if (sc->sc_ctrl_pipe) {
598 usbd_close_pipe(sc->sc_ctrl_pipe);
599 sc->sc_ctrl_pipe = NULL;
600 }
601 if (sc->sc_ctrl_msg) {
602 kmem_free(sc->sc_ctrl_msg, sc->sc_ctrl_len);
603 sc->sc_ctrl_msg = NULL;
604 }
605 if (sc->sc_resp_buf) {
606 kmem_free(sc->sc_resp_buf, sc->sc_ctrl_len);
607 sc->sc_resp_buf = NULL;
608 }
609 if (ifp->if_softc) {
610 ifmedia_fini(&sc->sc_im);
611 }
612 if (sc->sc_attached) {
613 rnd_detach_source(&sc->sc_rnd_source);
614 bpf_detach(ifp);
615 if_detach(ifp);
616 }
617
618 sc->sc_attached = 0;
619 splx(s);
620 return 0;
621 }
622
623 Static int
umb_activate(device_t self,enum devact act)624 umb_activate(device_t self, enum devact act)
625 {
626 struct umb_softc *sc = device_private(self);
627
628 switch (act) {
629 case DVACT_DEACTIVATE:
630 if_deactivate(GET_IFP(sc));
631 sc->sc_dying = 1;
632 return 0;
633 default:
634 return EOPNOTSUPP;
635 }
636 }
637
638 Static void
umb_ncm_setup(struct umb_softc * sc)639 umb_ncm_setup(struct umb_softc *sc)
640 {
641 usb_device_request_t req;
642 struct ncm_ntb_parameters np;
643
644 /* Query NTB tranfers sizes */
645 req.bmRequestType = UT_READ_CLASS_INTERFACE;
646 req.bRequest = NCM_GET_NTB_PARAMETERS;
647 USETW(req.wValue, 0);
648 USETW(req.wIndex, sc->sc_ctrl_ifaceno);
649 USETW(req.wLength, sizeof(np));
650 if (usbd_do_request(sc->sc_udev, &req, &np) == USBD_NORMAL_COMPLETION &&
651 UGETW(np.wLength) == sizeof(np)) {
652 sc->sc_rx_bufsz = UGETDW(np.dwNtbInMaxSize);
653 sc->sc_tx_bufsz = UGETDW(np.dwNtbOutMaxSize);
654 } else
655 sc->sc_rx_bufsz = sc->sc_tx_bufsz = 8 * 1024;
656 }
657
658 Static int
umb_alloc_xfers(struct umb_softc * sc)659 umb_alloc_xfers(struct umb_softc *sc)
660 {
661 int err = 0;
662
663 if (!sc->sc_rx_xfer) {
664 err |= usbd_create_xfer(sc->sc_rx_pipe,
665 sc->sc_rx_bufsz,
666 0, 0, &sc->sc_rx_xfer);
667 }
668 if (!sc->sc_tx_xfer) {
669 err |= usbd_create_xfer(sc->sc_tx_pipe,
670 sc->sc_tx_bufsz,
671 0, 0, &sc->sc_tx_xfer);
672 }
673 if (err)
674 return err;
675
676 sc->sc_rx_buf = usbd_get_buffer(sc->sc_rx_xfer);
677 sc->sc_tx_buf = usbd_get_buffer(sc->sc_tx_xfer);
678
679 return 0;
680 }
681
682 Static void
umb_free_xfers(struct umb_softc * sc)683 umb_free_xfers(struct umb_softc *sc)
684 {
685 if (sc->sc_rx_xfer) {
686 /* implicit usbd_free_buffer() */
687 usbd_destroy_xfer(sc->sc_rx_xfer);
688 sc->sc_rx_xfer = NULL;
689 sc->sc_rx_buf = NULL;
690 }
691 if (sc->sc_tx_xfer) {
692 usbd_destroy_xfer(sc->sc_tx_xfer);
693 sc->sc_tx_xfer = NULL;
694 sc->sc_tx_buf = NULL;
695 }
696 m_freem(sc->sc_tx_m);
697 sc->sc_tx_m = NULL;
698 }
699
700 Static int
umb_alloc_bulkpipes(struct umb_softc * sc)701 umb_alloc_bulkpipes(struct umb_softc *sc)
702 {
703 struct ifnet *ifp = GET_IFP(sc);
704 int rv;
705
706 if (!(ifp->if_flags & IFF_RUNNING)) {
707 if ((rv = usbd_open_pipe(sc->sc_data_iface, sc->sc_rx_ep,
708 USBD_EXCLUSIVE_USE, &sc->sc_rx_pipe))) {
709 DPRINTFN(4, "usbd_open_pipe() failed (RX) %d\n", rv);
710 return 0;
711 }
712 if ((rv = usbd_open_pipe(sc->sc_data_iface, sc->sc_tx_ep,
713 USBD_EXCLUSIVE_USE, &sc->sc_tx_pipe))) {
714 DPRINTFN(4, "usbd_open_pipe() failed (TX) %d\n", rv);
715 return 0;
716 }
717
718 if ((rv = umb_alloc_xfers(sc)) != 0) {
719 DPRINTFN(4, "umb_alloc_xfers() failed %d\n", rv);
720 return 0;
721 }
722
723 ifp->if_flags |= IFF_RUNNING;
724 ifp->if_flags &= ~IFF_OACTIVE;
725 umb_rx(sc);
726 }
727 return 1;
728 }
729
730 Static void
umb_close_bulkpipes(struct umb_softc * sc)731 umb_close_bulkpipes(struct umb_softc *sc)
732 {
733 struct ifnet *ifp = GET_IFP(sc);
734
735 ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
736 ifp->if_timer = 0;
737 if (sc->sc_rx_pipe) {
738 usbd_close_pipe(sc->sc_rx_pipe);
739 sc->sc_rx_pipe = NULL;
740 }
741 if (sc->sc_tx_pipe) {
742 usbd_close_pipe(sc->sc_tx_pipe);
743 sc->sc_tx_pipe = NULL;
744 }
745 }
746
747 Static int
umb_ioctl(struct ifnet * ifp,u_long cmd,void * data)748 umb_ioctl(struct ifnet *ifp, u_long cmd, void *data)
749 {
750 struct umb_softc *sc = ifp->if_softc;
751 struct ifaddr *ifa = (struct ifaddr *)data;
752 struct ifreq *ifr = (struct ifreq *)data;
753 int s, error = 0;
754 struct umb_parameter mp;
755
756 if (sc->sc_dying)
757 return EIO;
758
759 s = splnet();
760 switch (cmd) {
761 case SIOCINITIFADDR:
762 ifp->if_flags |= IFF_UP;
763 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER);
764 switch (ifa->ifa_addr->sa_family) {
765 #ifdef INET
766 case AF_INET:
767 break;
768 #endif /* INET */
769 #ifdef INET6
770 case AF_INET6:
771 break;
772 #endif /* INET6 */
773 default:
774 error = EAFNOSUPPORT;
775 break;
776 }
777 ifa->ifa_rtrequest = p2p_rtrequest;
778 break;
779 case SIOCSIFFLAGS:
780 error = ifioctl_common(ifp, cmd, data);
781 if (error)
782 break;
783 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER);
784 break;
785 case SIOCGUMBINFO:
786 error = kauth_authorize_network(kauth_cred_get(),
787 KAUTH_NETWORK_INTERFACE,
788 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, KAUTH_ARG(cmd),
789 NULL);
790 if (error)
791 break;
792 error = copyout(&sc->sc_info, ifr->ifr_data,
793 sizeof(sc->sc_info));
794 break;
795 case SIOCSUMBPARAM:
796 error = kauth_authorize_network(kauth_cred_get(),
797 KAUTH_NETWORK_INTERFACE,
798 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, KAUTH_ARG(cmd),
799 NULL);
800 if (error)
801 break;
802
803 if ((error = copyin(ifr->ifr_data, &mp, sizeof(mp))) != 0)
804 break;
805
806 if ((error = umb_setpin(sc, mp.op, mp.is_puk, mp.pin, mp.pinlen,
807 mp.newpin, mp.newpinlen)) != 0)
808 break;
809
810 if (mp.apnlen < 0 || mp.apnlen > sizeof(sc->sc_info.apn)) {
811 error = EINVAL;
812 break;
813 }
814 sc->sc_roaming = mp.roaming ? 1 : 0;
815 memset(sc->sc_info.apn, 0, sizeof(sc->sc_info.apn));
816 memcpy(sc->sc_info.apn, mp.apn, mp.apnlen);
817 sc->sc_info.apnlen = mp.apnlen;
818 memset(sc->sc_info.username, 0, sizeof(sc->sc_info.username));
819 memcpy(sc->sc_info.username, mp.username, mp.usernamelen);
820 sc->sc_info.usernamelen = mp.usernamelen;
821 memset(sc->sc_info.password, 0, sizeof(sc->sc_info.password));
822 memcpy(sc->sc_info.password, mp.password, mp.passwordlen);
823 sc->sc_info.passwordlen = mp.passwordlen;
824 sc->sc_info.preferredclasses = mp.preferredclasses;
825 umb_setdataclass(sc);
826 break;
827 case SIOCGUMBPARAM:
828 memset(&mp, 0, sizeof(mp));
829 memcpy(mp.apn, sc->sc_info.apn, sc->sc_info.apnlen);
830 mp.apnlen = sc->sc_info.apnlen;
831 mp.roaming = sc->sc_roaming;
832 mp.preferredclasses = sc->sc_info.preferredclasses;
833 error = copyout(&mp, ifr->ifr_data, sizeof(mp));
834 break;
835 case SIOCSIFMTU:
836 /* Does this include the NCM headers and tail? */
837 if (ifr->ifr_mtu > ifp->if_mtu) {
838 error = EINVAL;
839 break;
840 }
841 ifp->if_mtu = ifr->ifr_mtu;
842 break;
843 case SIOCSIFADDR:
844 case SIOCAIFADDR:
845 case SIOCSIFDSTADDR:
846 case SIOCADDMULTI:
847 case SIOCDELMULTI:
848 break;
849 case SIOCGIFMEDIA:
850 error = ifmedia_ioctl(ifp, ifr, &sc->sc_im, cmd);
851 break;
852 default:
853 error = ifioctl_common(ifp, cmd, data);
854 break;
855 }
856 splx(s);
857 return error;
858 }
859
860 Static int
umb_output(struct ifnet * ifp,struct mbuf * m,const struct sockaddr * dst,const struct rtentry * rtp)861 umb_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
862 const struct rtentry *rtp)
863 {
864 int error;
865
866 DPRINTFN(10, "%s: %s: enter\n",
867 device_xname(((struct umb_softc *)ifp->if_softc)->sc_dev),
868 __func__);
869
870 /*
871 * if the queueing discipline needs packet classification,
872 * do it now.
873 */
874 IFQ_CLASSIFY(&ifp->if_snd, m, dst->sa_family);
875
876 /*
877 * Queue message on interface, and start output if interface
878 * not yet active.
879 */
880 error = if_transmit_lock(ifp, m);
881
882 return error;
883 }
884
885 Static void
umb_input(struct ifnet * ifp,struct mbuf * m)886 umb_input(struct ifnet *ifp, struct mbuf *m)
887 {
888 size_t pktlen = m->m_len;
889 int s;
890
891 if ((ifp->if_flags & IFF_UP) == 0) {
892 m_freem(m);
893 return;
894 }
895 if (pktlen < sizeof(struct ip)) {
896 if_statinc(ifp, if_ierrors);
897 DPRINTFN(4, "%s: dropping short packet (len %zd)\n", __func__,
898 pktlen);
899 m_freem(m);
900 return;
901 }
902 s = splnet();
903 if (__predict_false(!pktq_enqueue(ip_pktq, m, 0))) {
904 if_statinc(ifp, if_iqdrops);
905 m_freem(m);
906 } else {
907 if_statadd2(ifp, if_ipackets, 1, if_ibytes, pktlen);
908 }
909 splx(s);
910 }
911
912 Static void
umb_start(struct ifnet * ifp)913 umb_start(struct ifnet *ifp)
914 {
915 struct umb_softc *sc = ifp->if_softc;
916 struct mbuf *m_head = NULL;
917
918 if (sc->sc_dying || (ifp->if_flags & IFF_OACTIVE))
919 return;
920
921 IFQ_POLL(&ifp->if_snd, m_head);
922 if (m_head == NULL)
923 return;
924
925 if (!umb_encap(sc, m_head)) {
926 ifp->if_flags |= IFF_OACTIVE;
927 return;
928 }
929 IFQ_DEQUEUE(&ifp->if_snd, m_head);
930
931 bpf_mtap(ifp, m_head, BPF_D_OUT);
932
933 ifp->if_flags |= IFF_OACTIVE;
934 ifp->if_timer = (2 * umb_xfer_tout) / 1000;
935 }
936
937 Static void
umb_watchdog(struct ifnet * ifp)938 umb_watchdog(struct ifnet *ifp)
939 {
940 struct umb_softc *sc = ifp->if_softc;
941
942 if (sc->sc_dying)
943 return;
944
945 if_statinc(ifp, if_oerrors);
946 printf("%s: watchdog timeout\n", DEVNAM(sc));
947 usbd_abort_pipe(sc->sc_tx_pipe);
948 return;
949 }
950
951 Static void
umb_statechg_timeout(void * arg)952 umb_statechg_timeout(void *arg)
953 {
954 struct umb_softc *sc = arg;
955 struct ifnet *ifp = GET_IFP(sc);
956
957 if (sc->sc_info.regstate != MBIM_REGSTATE_ROAMING || sc->sc_roaming)
958 if (ifp->if_flags & IFF_DEBUG)
959 log(LOG_DEBUG, "%s: state change timeout\n",
960 DEVNAM(sc));
961 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER);
962 }
963
964 Static int
umb_mediachange(struct ifnet * ifp)965 umb_mediachange(struct ifnet * ifp)
966 {
967 return 0;
968 }
969
970 Static void
umb_mediastatus(struct ifnet * ifp,struct ifmediareq * imr)971 umb_mediastatus(struct ifnet * ifp, struct ifmediareq * imr)
972 {
973 switch (ifp->if_link_state) {
974 case LINK_STATE_UP:
975 imr->ifm_status = IFM_AVALID | IFM_ACTIVE;
976 break;
977 case LINK_STATE_DOWN:
978 imr->ifm_status = IFM_AVALID;
979 break;
980 default:
981 imr->ifm_status = 0;
982 break;
983 }
984 }
985
986 Static void
umb_newstate(struct umb_softc * sc,enum umb_state newstate,int flags)987 umb_newstate(struct umb_softc *sc, enum umb_state newstate, int flags)
988 {
989 struct ifnet *ifp = GET_IFP(sc);
990
991 if (newstate == sc->sc_state)
992 return;
993 if (((flags & UMB_NS_DONT_DROP) && newstate < sc->sc_state) ||
994 ((flags & UMB_NS_DONT_RAISE) && newstate > sc->sc_state))
995 return;
996 if (ifp->if_flags & IFF_DEBUG)
997 log(LOG_DEBUG, "%s: state going %s from '%s' to '%s'\n",
998 DEVNAM(sc), newstate > sc->sc_state ? "up" : "down",
999 umb_istate(sc->sc_state), umb_istate(newstate));
1000 sc->sc_state = newstate;
1001 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER);
1002 }
1003
1004 Static void
umb_state_task(void * arg)1005 umb_state_task(void *arg)
1006 {
1007 struct umb_softc *sc = arg;
1008 struct ifnet *ifp = GET_IFP(sc);
1009 struct ifreq ifr;
1010 int s;
1011 int state;
1012
1013 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) {
1014 /*
1015 * Query the registration state until we're with the home
1016 * network again.
1017 */
1018 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, NULL, 0);
1019 return;
1020 }
1021
1022 s = splnet();
1023 if (ifp->if_flags & IFF_UP)
1024 umb_up(sc);
1025 else
1026 umb_down(sc, 0);
1027
1028 state = sc->sc_state == UMB_S_UP ? LINK_STATE_UP : LINK_STATE_DOWN;
1029 if (ifp->if_link_state != state) {
1030 if (ifp->if_flags & IFF_DEBUG)
1031 log(LOG_DEBUG, "%s: link state changed from %s to %s\n",
1032 DEVNAM(sc),
1033 (ifp->if_link_state == LINK_STATE_UP)
1034 ? "up" : "down",
1035 (state == LINK_STATE_UP) ? "up" : "down");
1036 ifp->if_link_state = state;
1037 if (state != LINK_STATE_UP) {
1038 /*
1039 * Purge any existing addresses
1040 */
1041 memset(sc->sc_info.ipv4dns, 0,
1042 sizeof(sc->sc_info.ipv4dns));
1043 if (in_control(NULL, SIOCGIFADDR, &ifr, ifp) == 0 &&
1044 satosin(&ifr.ifr_addr)->sin_addr.s_addr !=
1045 INADDR_ANY) {
1046 in_control(NULL, SIOCDIFADDR, &ifr, ifp);
1047 }
1048 }
1049 if_link_state_change(ifp, state);
1050 }
1051 splx(s);
1052 }
1053
1054 Static void
umb_up(struct umb_softc * sc)1055 umb_up(struct umb_softc *sc)
1056 {
1057 switch (sc->sc_state) {
1058 case UMB_S_DOWN:
1059 DPRINTF("%s: init: opening ...\n", DEVNAM(sc));
1060 umb_open(sc);
1061 break;
1062 case UMB_S_OPEN:
1063 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED) {
1064 if (sc->sc_cid == -1) {
1065 DPRINTF("%s: init: allocating CID ...\n",
1066 DEVNAM(sc));
1067 umb_allocate_cid(sc);
1068 break;
1069 } else
1070 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP);
1071 } else {
1072 DPRINTF("%s: init: turning radio on ...\n", DEVNAM(sc));
1073 umb_radio(sc, 1);
1074 break;
1075 }
1076 /*FALLTHROUGH*/
1077 case UMB_S_CID:
1078 DPRINTF("%s: init: sending FCC auth ...\n", DEVNAM(sc));
1079 umb_send_fcc_auth(sc);
1080 break;
1081 case UMB_S_RADIO:
1082 DPRINTF("%s: init: checking SIM state ...\n", DEVNAM(sc));
1083 umb_cmd(sc, MBIM_CID_SUBSCRIBER_READY_STATUS, MBIM_CMDOP_QRY,
1084 NULL, 0);
1085 break;
1086 case UMB_S_SIMREADY:
1087 DPRINTF("%s: init: attaching ...\n", DEVNAM(sc));
1088 umb_packet_service(sc, 1);
1089 break;
1090 case UMB_S_ATTACHED:
1091 sc->sc_tx_seq = 0;
1092 DPRINTF("%s: init: connecting ...\n", DEVNAM(sc));
1093 umb_connect(sc);
1094 break;
1095 case UMB_S_CONNECTED:
1096 DPRINTF("%s: init: getting IP config ...\n", DEVNAM(sc));
1097 umb_qry_ipconfig(sc);
1098 break;
1099 case UMB_S_UP:
1100 DPRINTF("%s: init: reached state UP\n", DEVNAM(sc));
1101 if (!umb_alloc_bulkpipes(sc)) {
1102 printf("%s: opening bulk pipes failed\n", DEVNAM(sc));
1103 umb_down(sc, 1);
1104 }
1105 break;
1106 }
1107 if (sc->sc_state < UMB_S_UP)
1108 callout_schedule(&sc->sc_statechg_timer,
1109 UMB_STATE_CHANGE_TIMEOUT * hz);
1110 else
1111 callout_stop(&sc->sc_statechg_timer);
1112 return;
1113 }
1114
1115 Static void
umb_down(struct umb_softc * sc,int force)1116 umb_down(struct umb_softc *sc, int force)
1117 {
1118 umb_close_bulkpipes(sc);
1119 if (sc->sc_state < UMB_S_CONNECTED)
1120 umb_free_xfers(sc);
1121
1122 switch (sc->sc_state) {
1123 case UMB_S_UP:
1124 case UMB_S_CONNECTED:
1125 DPRINTF("%s: stop: disconnecting ...\n", DEVNAM(sc));
1126 umb_disconnect(sc);
1127 if (!force)
1128 break;
1129 /*FALLTHROUGH*/
1130 case UMB_S_ATTACHED:
1131 DPRINTF("%s: stop: detaching ...\n", DEVNAM(sc));
1132 umb_packet_service(sc, 0);
1133 if (!force)
1134 break;
1135 /*FALLTHROUGH*/
1136 case UMB_S_SIMREADY:
1137 case UMB_S_RADIO:
1138 DPRINTF("%s: stop: turning radio off ...\n", DEVNAM(sc));
1139 umb_radio(sc, 0);
1140 if (!force)
1141 break;
1142 /*FALLTHROUGH*/
1143 case UMB_S_CID:
1144 case UMB_S_OPEN:
1145 case UMB_S_DOWN:
1146 /* Do not close the device */
1147 DPRINTF("%s: stop: reached state DOWN\n", DEVNAM(sc));
1148 break;
1149 }
1150 if (force)
1151 sc->sc_state = UMB_S_OPEN;
1152
1153 if (sc->sc_state > UMB_S_OPEN)
1154 callout_schedule(&sc->sc_statechg_timer,
1155 UMB_STATE_CHANGE_TIMEOUT * hz);
1156 else
1157 callout_stop(&sc->sc_statechg_timer);
1158 }
1159
1160 Static void
umb_get_response_task(void * arg)1161 umb_get_response_task(void *arg)
1162 {
1163 struct umb_softc *sc = arg;
1164 int len;
1165 int s;
1166
1167 /*
1168 * Function is required to send on RESPONSE_AVAILABLE notification for
1169 * each encapsulated response that is to be processed by the host.
1170 * But of course, we can receive multiple notifications before the
1171 * response task is run.
1172 */
1173 s = splusb();
1174 while (sc->sc_nresp > 0) {
1175 --sc->sc_nresp;
1176 len = sc->sc_ctrl_len;
1177 if (umb_get_encap_response(sc, sc->sc_resp_buf, &len))
1178 umb_decode_response(sc, sc->sc_resp_buf, len);
1179 }
1180 splx(s);
1181 }
1182
1183 Static void
umb_decode_response(struct umb_softc * sc,void * response,int len)1184 umb_decode_response(struct umb_softc *sc, void *response, int len)
1185 {
1186 struct mbim_msghdr *hdr = response;
1187 struct mbim_fragmented_msg_hdr *fraghdr;
1188 uint32_t type;
1189
1190 DPRINTFN(3, "%s: got response: len %d\n", DEVNAM(sc), len);
1191 DDUMPN(4, response, len);
1192
1193 if (len < sizeof(*hdr) || le32toh(hdr->len) != len) {
1194 /*
1195 * We should probably cancel a transaction, but since the
1196 * message is too short, we cannot decode the transaction
1197 * id (tid) and hence don't know, whom to cancel. Must wait
1198 * for the timeout.
1199 */
1200 DPRINTF("%s: received short response (len %d)\n",
1201 DEVNAM(sc), len);
1202 return;
1203 }
1204
1205 /*
1206 * XXX FIXME: if message is fragmented, store it until last frag
1207 * is received and then re-assemble all fragments.
1208 */
1209 type = le32toh(hdr->type);
1210 switch (type) {
1211 case MBIM_INDICATE_STATUS_MSG:
1212 case MBIM_COMMAND_DONE:
1213 fraghdr = response;
1214 if (le32toh(fraghdr->frag.nfrag) != 1) {
1215 DPRINTF("%s: discarding fragmented messages\n",
1216 DEVNAM(sc));
1217 return;
1218 }
1219 break;
1220 default:
1221 break;
1222 }
1223
1224 DPRINTF("%s: <- rcv %s (tid %u)\n", DEVNAM(sc), umb_request2str(type),
1225 le32toh(hdr->tid));
1226 switch (type) {
1227 case MBIM_FUNCTION_ERROR_MSG:
1228 case MBIM_HOST_ERROR_MSG:
1229 {
1230 struct mbim_f2h_hosterr *e;
1231 int err;
1232
1233 if (len >= sizeof(*e)) {
1234 e = response;
1235 err = le32toh(e->err);
1236
1237 DPRINTF("%s: %s message, error %s (tid %u)\n",
1238 DEVNAM(sc), umb_request2str(type),
1239 umb_error2str(err), le32toh(hdr->tid));
1240 if (err == MBIM_ERROR_NOT_OPENED)
1241 umb_newstate(sc, UMB_S_DOWN, 0);
1242 }
1243 break;
1244 }
1245 case MBIM_INDICATE_STATUS_MSG:
1246 umb_handle_indicate_status_msg(sc, response, len);
1247 break;
1248 case MBIM_OPEN_DONE:
1249 umb_handle_opendone_msg(sc, response, len);
1250 break;
1251 case MBIM_CLOSE_DONE:
1252 umb_handle_closedone_msg(sc, response, len);
1253 break;
1254 case MBIM_COMMAND_DONE:
1255 umb_command_done(sc, response, len);
1256 break;
1257 default:
1258 DPRINTF("%s: discard message %s\n", DEVNAM(sc),
1259 umb_request2str(type));
1260 break;
1261 }
1262 }
1263
1264 Static void
umb_handle_indicate_status_msg(struct umb_softc * sc,void * data,int len)1265 umb_handle_indicate_status_msg(struct umb_softc *sc, void *data, int len)
1266 {
1267 struct mbim_f2h_indicate_status *m = data;
1268 uint32_t infolen;
1269 uint32_t cid;
1270
1271 if (len < sizeof(*m)) {
1272 DPRINTF("%s: discard short %s message\n", DEVNAM(sc),
1273 umb_request2str(le32toh(m->hdr.type)));
1274 return;
1275 }
1276 if (memcmp(m->devid, umb_uuid_basic_connect, sizeof(m->devid))) {
1277 DPRINTF("%s: discard %s message for other UUID '%s'\n",
1278 DEVNAM(sc), umb_request2str(le32toh(m->hdr.type)),
1279 umb_uuid2str(m->devid));
1280 return;
1281 }
1282 infolen = le32toh(m->infolen);
1283 if (len < sizeof(*m) + infolen) {
1284 DPRINTF("%s: discard truncated %s message (want %d, got %d)\n",
1285 DEVNAM(sc), umb_request2str(le32toh(m->hdr.type)),
1286 (int)sizeof(*m) + infolen, len);
1287 return;
1288 }
1289
1290 cid = le32toh(m->cid);
1291 DPRINTF("%s: indicate %s status\n", DEVNAM(sc), umb_cid2str(cid));
1292 umb_decode_cid(sc, cid, m->info, infolen);
1293 }
1294
1295 Static void
umb_handle_opendone_msg(struct umb_softc * sc,void * data,int len)1296 umb_handle_opendone_msg(struct umb_softc *sc, void *data, int len)
1297 {
1298 struct mbim_f2h_openclosedone *resp = data;
1299 struct ifnet *ifp = GET_IFP(sc);
1300 uint32_t status;
1301
1302 status = le32toh(resp->status);
1303 if (status == MBIM_STATUS_SUCCESS) {
1304 if (sc->sc_maxsessions == 0) {
1305 umb_cmd(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_QRY, NULL,
1306 0);
1307 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_QRY, NULL, 0);
1308 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY,
1309 NULL, 0);
1310 }
1311 umb_newstate(sc, UMB_S_OPEN, UMB_NS_DONT_DROP);
1312 } else if (ifp->if_flags & IFF_DEBUG)
1313 log(LOG_ERR, "%s: open error: %s\n", DEVNAM(sc),
1314 umb_status2str(status));
1315 return;
1316 }
1317
1318 Static void
umb_handle_closedone_msg(struct umb_softc * sc,void * data,int len)1319 umb_handle_closedone_msg(struct umb_softc *sc, void *data, int len)
1320 {
1321 struct mbim_f2h_openclosedone *resp = data;
1322 uint32_t status;
1323
1324 status = le32toh(resp->status);
1325 if (status == MBIM_STATUS_SUCCESS)
1326 umb_newstate(sc, UMB_S_DOWN, 0);
1327 else
1328 DPRINTF("%s: close error: %s\n", DEVNAM(sc),
1329 umb_status2str(status));
1330 return;
1331 }
1332
1333 static inline void
umb_getinfobuf(char * in,int inlen,uint32_t offs,uint32_t sz,void * out,size_t outlen)1334 umb_getinfobuf(char *in, int inlen, uint32_t offs, uint32_t sz,
1335 void *out, size_t outlen)
1336 {
1337 offs = le32toh(offs);
1338 sz = le32toh(sz);
1339 if (inlen >= offs + sz) {
1340 memset(out, 0, outlen);
1341 memcpy(out, in + offs, MIN(sz, outlen));
1342 }
1343 }
1344
1345 static inline int
umb_padding(void * data,int len,size_t sz)1346 umb_padding(void *data, int len, size_t sz)
1347 {
1348 char *p = data;
1349 int np = 0;
1350
1351 while (len < sz && (len % 4) != 0) {
1352 *p++ = '\0';
1353 len++;
1354 np++;
1355 }
1356 return np;
1357 }
1358
1359 static inline int
umb_addstr(void * buf,size_t bufsz,int * offs,void * str,int slen,uint32_t * offsmember,uint32_t * sizemember)1360 umb_addstr(void *buf, size_t bufsz, int *offs, void *str, int slen,
1361 uint32_t *offsmember, uint32_t *sizemember)
1362 {
1363 if (*offs + slen > bufsz)
1364 return 0;
1365
1366 *sizemember = htole32((uint32_t)slen);
1367 if (slen && str) {
1368 *offsmember = htole32((uint32_t)*offs);
1369 memcpy((char *)buf + *offs, str, slen);
1370 *offs += slen;
1371 *offs += umb_padding(buf, *offs, bufsz);
1372 } else
1373 *offsmember = htole32(0);
1374 return 1;
1375 }
1376
1377 static void
umb_in_len2mask(struct in_addr * mask,int len)1378 umb_in_len2mask(struct in_addr *mask, int len)
1379 {
1380 int i;
1381 u_char *p;
1382
1383 p = (u_char *)mask;
1384 memset(mask, 0, sizeof(*mask));
1385 for (i = 0; i < len / 8; i++)
1386 p[i] = 0xff;
1387 if (len % 8)
1388 p[i] = (0xff00 >> (len % 8)) & 0xff;
1389 }
1390
1391 Static int
umb_decode_register_state(struct umb_softc * sc,void * data,int len)1392 umb_decode_register_state(struct umb_softc *sc, void *data, int len)
1393 {
1394 struct mbim_cid_registration_state_info *rs = data;
1395 struct ifnet *ifp = GET_IFP(sc);
1396
1397 if (len < sizeof(*rs))
1398 return 0;
1399 sc->sc_info.nwerror = le32toh(rs->nwerror);
1400 sc->sc_info.regstate = le32toh(rs->regstate);
1401 sc->sc_info.regmode = le32toh(rs->regmode);
1402 sc->sc_info.cellclass = le32toh(rs->curcellclass);
1403
1404 /* XXX should we remember the provider_id? */
1405 umb_getinfobuf(data, len, rs->provname_offs, rs->provname_size,
1406 sc->sc_info.provider, sizeof(sc->sc_info.provider));
1407 umb_getinfobuf(data, len, rs->roamingtxt_offs, rs->roamingtxt_size,
1408 sc->sc_info.roamingtxt, sizeof(sc->sc_info.roamingtxt));
1409
1410 DPRINTFN(2, "%s: %s, availclass %#x, class %#x, regmode %d\n",
1411 DEVNAM(sc), umb_regstate(sc->sc_info.regstate),
1412 le32toh(rs->availclasses), sc->sc_info.cellclass,
1413 sc->sc_info.regmode);
1414
1415 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING &&
1416 !sc->sc_roaming &&
1417 sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED) {
1418 if (ifp->if_flags & IFF_DEBUG)
1419 log(LOG_INFO,
1420 "%s: disconnecting from roaming network\n",
1421 DEVNAM(sc));
1422 umb_disconnect(sc);
1423 }
1424 return 1;
1425 }
1426
1427 Static int
umb_decode_devices_caps(struct umb_softc * sc,void * data,int len)1428 umb_decode_devices_caps(struct umb_softc *sc, void *data, int len)
1429 {
1430 struct mbim_cid_device_caps *dc = data;
1431
1432 if (len < sizeof(*dc))
1433 return 0;
1434 sc->sc_maxsessions = le32toh(dc->max_sessions);
1435 sc->sc_info.supportedclasses = le32toh(dc->dataclass);
1436 umb_getinfobuf(data, len, dc->devid_offs, dc->devid_size,
1437 sc->sc_info.devid, sizeof(sc->sc_info.devid));
1438 umb_getinfobuf(data, len, dc->fwinfo_offs, dc->fwinfo_size,
1439 sc->sc_info.fwinfo, sizeof(sc->sc_info.fwinfo));
1440 umb_getinfobuf(data, len, dc->hwinfo_offs, dc->hwinfo_size,
1441 sc->sc_info.hwinfo, sizeof(sc->sc_info.hwinfo));
1442 DPRINTFN(2, "%s: max sessions %d, supported classes %#x\n",
1443 DEVNAM(sc), sc->sc_maxsessions, sc->sc_info.supportedclasses);
1444 return 1;
1445 }
1446
1447 Static int
umb_decode_subscriber_status(struct umb_softc * sc,void * data,int len)1448 umb_decode_subscriber_status(struct umb_softc *sc, void *data, int len)
1449 {
1450 struct mbim_cid_subscriber_ready_info *si = data;
1451 struct ifnet *ifp = GET_IFP(sc);
1452 int npn;
1453
1454 if (len < sizeof(*si))
1455 return 0;
1456 sc->sc_info.sim_state = le32toh(si->ready);
1457
1458 umb_getinfobuf(data, len, si->sid_offs, si->sid_size,
1459 sc->sc_info.sid, sizeof(sc->sc_info.sid));
1460 umb_getinfobuf(data, len, si->icc_offs, si->icc_size,
1461 sc->sc_info.iccid, sizeof(sc->sc_info.iccid));
1462
1463 npn = le32toh(si->no_pn);
1464 if (npn > 0)
1465 umb_getinfobuf(data, len, si->pn[0].offs, si->pn[0].size,
1466 sc->sc_info.pn, sizeof(sc->sc_info.pn));
1467 else
1468 memset(sc->sc_info.pn, 0, sizeof(sc->sc_info.pn));
1469
1470 if (sc->sc_info.sim_state == MBIM_SIMSTATE_LOCKED)
1471 sc->sc_info.pin_state = UMB_PUK_REQUIRED;
1472 if (ifp->if_flags & IFF_DEBUG)
1473 log(LOG_INFO, "%s: SIM %s\n", DEVNAM(sc),
1474 umb_simstate(sc->sc_info.sim_state));
1475 if (sc->sc_info.sim_state == MBIM_SIMSTATE_INITIALIZED)
1476 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_DROP);
1477 return 1;
1478 }
1479
1480 Static int
umb_decode_radio_state(struct umb_softc * sc,void * data,int len)1481 umb_decode_radio_state(struct umb_softc *sc, void *data, int len)
1482 {
1483 struct mbim_cid_radio_state_info *rs = data;
1484 struct ifnet *ifp = GET_IFP(sc);
1485
1486 if (len < sizeof(*rs))
1487 return 0;
1488
1489 sc->sc_info.hw_radio_on =
1490 (le32toh(rs->hw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0;
1491 sc->sc_info.sw_radio_on =
1492 (le32toh(rs->sw_state) == MBIM_RADIO_STATE_ON) ? 1 : 0;
1493 if (!sc->sc_info.hw_radio_on) {
1494 printf("%s: radio is disabled by hardware switch\n",
1495 DEVNAM(sc));
1496 /*
1497 * XXX do we need a time to poll the state of the rfkill switch
1498 * or will the device send an unsolicited notification
1499 * in case the state changes?
1500 */
1501 umb_newstate(sc, UMB_S_OPEN, 0);
1502 } else if (!sc->sc_info.sw_radio_on) {
1503 if (ifp->if_flags & IFF_DEBUG)
1504 log(LOG_INFO, "%s: radio is off\n", DEVNAM(sc));
1505 umb_newstate(sc, UMB_S_OPEN, 0);
1506 } else
1507 umb_newstate(sc, UMB_S_RADIO, UMB_NS_DONT_DROP);
1508 return 1;
1509 }
1510
1511 Static int
umb_decode_pin(struct umb_softc * sc,void * data,int len)1512 umb_decode_pin(struct umb_softc *sc, void *data, int len)
1513 {
1514 struct mbim_cid_pin_info *pi = data;
1515 struct ifnet *ifp = GET_IFP(sc);
1516 uint32_t attempts_left;
1517
1518 if (len < sizeof(*pi))
1519 return 0;
1520
1521 attempts_left = le32toh(pi->remaining_attempts);
1522 if (attempts_left != 0xffffffff)
1523 sc->sc_info.pin_attempts_left = attempts_left;
1524
1525 switch (le32toh(pi->state)) {
1526 case MBIM_PIN_STATE_UNLOCKED:
1527 sc->sc_info.pin_state = UMB_PIN_UNLOCKED;
1528 break;
1529 case MBIM_PIN_STATE_LOCKED:
1530 switch (le32toh(pi->type)) {
1531 case MBIM_PIN_TYPE_PIN1:
1532 sc->sc_info.pin_state = UMB_PIN_REQUIRED;
1533 break;
1534 case MBIM_PIN_TYPE_PUK1:
1535 sc->sc_info.pin_state = UMB_PUK_REQUIRED;
1536 break;
1537 case MBIM_PIN_TYPE_PIN2:
1538 case MBIM_PIN_TYPE_PUK2:
1539 /* Assume that PIN1 was accepted */
1540 sc->sc_info.pin_state = UMB_PIN_UNLOCKED;
1541 break;
1542 }
1543 break;
1544 }
1545 if (ifp->if_flags & IFF_DEBUG)
1546 log(LOG_INFO, "%s: %s state %s (%d attempts left)\n",
1547 DEVNAM(sc), umb_pin_type(le32toh(pi->type)),
1548 (le32toh(pi->state) == MBIM_PIN_STATE_UNLOCKED) ?
1549 "unlocked" : "locked",
1550 le32toh(pi->remaining_attempts));
1551
1552 /*
1553 * In case the PIN was set after IFF_UP, retrigger the state machine
1554 */
1555 usb_add_task(sc->sc_udev, &sc->sc_umb_task, USB_TASKQ_DRIVER);
1556 return 1;
1557 }
1558
1559 Static int
umb_decode_packet_service(struct umb_softc * sc,void * data,int len)1560 umb_decode_packet_service(struct umb_softc *sc, void *data, int len)
1561 {
1562 struct mbim_cid_packet_service_info *psi = data;
1563 int state, highestclass;
1564 uint64_t up_speed, down_speed;
1565 struct ifnet *ifp = GET_IFP(sc);
1566
1567 if (len < sizeof(*psi))
1568 return 0;
1569
1570 sc->sc_info.nwerror = le32toh(psi->nwerror);
1571 state = le32toh(psi->state);
1572 highestclass = le32toh(psi->highest_dataclass);
1573 up_speed = le64toh(psi->uplink_speed);
1574 down_speed = le64toh(psi->downlink_speed);
1575 if (sc->sc_info.packetstate != state ||
1576 sc->sc_info.uplink_speed != up_speed ||
1577 sc->sc_info.downlink_speed != down_speed) {
1578 if (ifp->if_flags & IFF_DEBUG) {
1579 log(LOG_INFO, "%s: packet service ", DEVNAM(sc));
1580 if (sc->sc_info.packetstate != state)
1581 addlog("changed from %s to ",
1582 umb_packet_state(sc->sc_info.packetstate));
1583 addlog("%s, class %s, speed: %" PRIu64 " up / %" PRIu64 " down\n",
1584 umb_packet_state(state),
1585 umb_dataclass(highestclass), up_speed, down_speed);
1586 }
1587 }
1588 sc->sc_info.packetstate = state;
1589 sc->sc_info.highestclass = highestclass;
1590 sc->sc_info.uplink_speed = up_speed;
1591 sc->sc_info.downlink_speed = down_speed;
1592
1593 if (sc->sc_info.regmode == MBIM_REGMODE_AUTOMATIC) {
1594 /*
1595 * For devices using automatic registration mode, just proceed,
1596 * once registration has completed.
1597 */
1598 if (ifp->if_flags & IFF_UP) {
1599 switch (sc->sc_info.regstate) {
1600 case MBIM_REGSTATE_HOME:
1601 case MBIM_REGSTATE_ROAMING:
1602 case MBIM_REGSTATE_PARTNER:
1603 umb_newstate(sc, UMB_S_ATTACHED,
1604 UMB_NS_DONT_DROP);
1605 break;
1606 default:
1607 break;
1608 }
1609 } else
1610 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE);
1611 } else switch (sc->sc_info.packetstate) {
1612 case MBIM_PKTSERVICE_STATE_ATTACHED:
1613 umb_newstate(sc, UMB_S_ATTACHED, UMB_NS_DONT_DROP);
1614 break;
1615 case MBIM_PKTSERVICE_STATE_DETACHED:
1616 umb_newstate(sc, UMB_S_SIMREADY, UMB_NS_DONT_RAISE);
1617 break;
1618 }
1619 return 1;
1620 }
1621
1622 Static int
umb_decode_signal_state(struct umb_softc * sc,void * data,int len)1623 umb_decode_signal_state(struct umb_softc *sc, void *data, int len)
1624 {
1625 struct mbim_cid_signal_state *ss = data;
1626 struct ifnet *ifp = GET_IFP(sc);
1627 int rssi;
1628
1629 if (len < sizeof(*ss))
1630 return 0;
1631
1632 if (le32toh(ss->rssi) == 99)
1633 rssi = UMB_VALUE_UNKNOWN;
1634 else {
1635 rssi = -113 + 2 * le32toh(ss->rssi);
1636 if ((ifp->if_flags & IFF_DEBUG) && sc->sc_info.rssi != rssi &&
1637 sc->sc_state >= UMB_S_CONNECTED)
1638 log(LOG_INFO, "%s: rssi %d dBm\n", DEVNAM(sc), rssi);
1639 }
1640 sc->sc_info.rssi = rssi;
1641 sc->sc_info.ber = le32toh(ss->err_rate);
1642 if (sc->sc_info.ber == -99)
1643 sc->sc_info.ber = UMB_VALUE_UNKNOWN;
1644 return 1;
1645 }
1646
1647 Static int
umb_decode_connect_info(struct umb_softc * sc,void * data,int len)1648 umb_decode_connect_info(struct umb_softc *sc, void *data, int len)
1649 {
1650 struct mbim_cid_connect_info *ci = data;
1651 struct ifnet *ifp = GET_IFP(sc);
1652 int act;
1653
1654 if (len < sizeof(*ci))
1655 return 0;
1656
1657 if (le32toh(ci->sessionid) != umb_session_id) {
1658 DPRINTF("%s: discard connection info for session %u\n",
1659 DEVNAM(sc), le32toh(ci->sessionid));
1660 return 1;
1661 }
1662 if (memcmp(ci->context, umb_uuid_context_internet,
1663 sizeof(ci->context))) {
1664 DPRINTF("%s: discard connection info for other context\n",
1665 DEVNAM(sc));
1666 return 1;
1667 }
1668 act = le32toh(ci->activation);
1669 if (sc->sc_info.activation != act) {
1670 if (ifp->if_flags & IFF_DEBUG)
1671 log(LOG_INFO, "%s: connection %s\n", DEVNAM(sc),
1672 umb_activation(act));
1673 if ((ifp->if_flags & IFF_DEBUG) &&
1674 le32toh(ci->iptype) != MBIM_CONTEXT_IPTYPE_DEFAULT &&
1675 le32toh(ci->iptype) != MBIM_CONTEXT_IPTYPE_IPV4)
1676 log(LOG_DEBUG, "%s: got iptype %d connection\n",
1677 DEVNAM(sc), le32toh(ci->iptype));
1678
1679 sc->sc_info.activation = act;
1680 sc->sc_info.nwerror = le32toh(ci->nwerror);
1681
1682 if (sc->sc_info.activation == MBIM_ACTIVATION_STATE_ACTIVATED)
1683 umb_newstate(sc, UMB_S_CONNECTED, UMB_NS_DONT_DROP);
1684 else if (sc->sc_info.activation ==
1685 MBIM_ACTIVATION_STATE_DEACTIVATED)
1686 umb_newstate(sc, UMB_S_ATTACHED, 0);
1687 /* else: other states are purely transitional */
1688 }
1689 return 1;
1690 }
1691
1692 Static int
umb_decode_ip_configuration(struct umb_softc * sc,void * data,int len)1693 umb_decode_ip_configuration(struct umb_softc *sc, void *data, int len)
1694 {
1695 struct mbim_cid_ip_configuration_info *ic = data;
1696 struct ifnet *ifp = GET_IFP(sc);
1697 int s;
1698 uint32_t avail;
1699 uint32_t val;
1700 int n, i;
1701 int off;
1702 struct mbim_cid_ipv4_element ipv4elem;
1703 struct in_aliasreq ifra;
1704 struct sockaddr_in *sin;
1705 int state = -1;
1706 int rv;
1707
1708 if (len < sizeof(*ic))
1709 return 0;
1710 if (le32toh(ic->sessionid) != umb_session_id) {
1711 DPRINTF("%s: ignore IP configuration for session id %d\n",
1712 DEVNAM(sc), le32toh(ic->sessionid));
1713 return 0;
1714 }
1715 s = splnet();
1716
1717 /*
1718 * IPv4 configuration
1719 */
1720 avail = le32toh(ic->ipv4_available);
1721 if ((avail & (MBIM_IPCONF_HAS_ADDRINFO | MBIM_IPCONF_HAS_GWINFO)) ==
1722 (MBIM_IPCONF_HAS_ADDRINFO | MBIM_IPCONF_HAS_GWINFO)) {
1723 n = le32toh(ic->ipv4_naddr);
1724 off = le32toh(ic->ipv4_addroffs);
1725
1726 if (n == 0 || off + sizeof(ipv4elem) > len)
1727 goto done;
1728
1729 /* Only pick the first one */
1730 memcpy(&ipv4elem, (char *)data + off, sizeof(ipv4elem));
1731 ipv4elem.prefixlen = le32toh(ipv4elem.prefixlen);
1732
1733 memset(&ifra, 0, sizeof(ifra));
1734 sin = (struct sockaddr_in *)&ifra.ifra_addr;
1735 sin->sin_family = AF_INET;
1736 sin->sin_len = sizeof(ifra.ifra_addr);
1737 sin->sin_addr.s_addr = ipv4elem.addr;
1738
1739 sin = (struct sockaddr_in *)&ifra.ifra_dstaddr;
1740 sin->sin_family = AF_INET;
1741 sin->sin_len = sizeof(ifra.ifra_dstaddr);
1742 off = le32toh(ic->ipv4_gwoffs);
1743 memcpy(&sin->sin_addr.s_addr, (const char *)data + off,
1744 sizeof(sin->sin_addr.s_addr));
1745
1746 sin = (struct sockaddr_in *)&ifra.ifra_mask;
1747 sin->sin_family = AF_INET;
1748 sin->sin_len = sizeof(ifra.ifra_mask);
1749 umb_in_len2mask(&sin->sin_addr, ipv4elem.prefixlen);
1750
1751 rv = in_control(NULL, SIOCAIFADDR, &ifra, ifp);
1752 if (rv == 0) {
1753 if (ifp->if_flags & IFF_DEBUG)
1754 log(LOG_INFO, "%s: IPv4 addr %s, mask %s, "
1755 "gateway %s\n", device_xname(sc->sc_dev),
1756 umb_ntop(sintosa(&ifra.ifra_addr)),
1757 umb_ntop(sintosa(&ifra.ifra_mask)),
1758 umb_ntop(sintosa(&ifra.ifra_dstaddr)));
1759 state = UMB_S_UP;
1760 } else
1761 printf("%s: unable to set IPv4 address, error %d\n",
1762 device_xname(sc->sc_dev), rv);
1763 }
1764
1765 memset(sc->sc_info.ipv4dns, 0, sizeof(sc->sc_info.ipv4dns));
1766 if (avail & MBIM_IPCONF_HAS_DNSINFO) {
1767 n = le32toh(ic->ipv4_ndnssrv);
1768 off = le32toh(ic->ipv4_dnssrvoffs);
1769 i = 0;
1770 while (n-- > 0) {
1771 if (off + sizeof(uint32_t) > len)
1772 break;
1773 memcpy(&val, (const char *)data + off, sizeof(val));
1774 if (i < UMB_MAX_DNSSRV)
1775 sc->sc_info.ipv4dns[i++] = val;
1776 off += sizeof(uint32_t);
1777 }
1778 }
1779
1780 if ((avail & MBIM_IPCONF_HAS_MTUINFO)) {
1781 val = le32toh(ic->ipv4_mtu);
1782 if (ifp->if_mtu != val && val <= sc->sc_maxpktlen) {
1783 ifp->if_mtu = val;
1784 if (ifp->if_mtu > val)
1785 ifp->if_mtu = val;
1786 if (ifp->if_flags & IFF_DEBUG)
1787 log(LOG_INFO, "%s: MTU %d\n", DEVNAM(sc), val);
1788 }
1789 }
1790
1791 avail = le32toh(ic->ipv6_available);
1792 if ((ifp->if_flags & IFF_DEBUG) && avail & MBIM_IPCONF_HAS_ADDRINFO) {
1793 /* XXX FIXME: IPv6 configuration missing */
1794 log(LOG_INFO, "%s: ignoring IPv6 configuration\n", DEVNAM(sc));
1795 }
1796 if (state != -1)
1797 umb_newstate(sc, state, 0);
1798
1799 done:
1800 splx(s);
1801 return 1;
1802 }
1803
1804 Static void
umb_rx(struct umb_softc * sc)1805 umb_rx(struct umb_softc *sc)
1806 {
1807 usbd_setup_xfer(sc->sc_rx_xfer, sc, sc->sc_rx_buf,
1808 sc->sc_rx_bufsz, USBD_SHORT_XFER_OK,
1809 USBD_NO_TIMEOUT, umb_rxeof);
1810 usbd_transfer(sc->sc_rx_xfer);
1811 }
1812
1813 Static void
umb_rxeof(struct usbd_xfer * xfer,void * priv,usbd_status status)1814 umb_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
1815 {
1816 struct umb_softc *sc = priv;
1817 struct ifnet *ifp = GET_IFP(sc);
1818
1819 if (sc->sc_dying || !(ifp->if_flags & IFF_RUNNING))
1820 return;
1821
1822 if (status != USBD_NORMAL_COMPLETION) {
1823 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
1824 return;
1825 DPRINTF("%s: rx error: %s\n", DEVNAM(sc), usbd_errstr(status));
1826 if (status == USBD_STALLED)
1827 usbd_clear_endpoint_stall_async(sc->sc_rx_pipe);
1828 if (++sc->sc_rx_nerr > 100) {
1829 log(LOG_ERR, "%s: too many rx errors, disabling\n",
1830 DEVNAM(sc));
1831 umb_activate(sc->sc_dev, DVACT_DEACTIVATE);
1832 }
1833 } else {
1834 sc->sc_rx_nerr = 0;
1835 umb_decap(sc, xfer);
1836 }
1837
1838 umb_rx(sc);
1839 return;
1840 }
1841
1842 Static int
umb_encap(struct umb_softc * sc,struct mbuf * m)1843 umb_encap(struct umb_softc *sc, struct mbuf *m)
1844 {
1845 struct ncm_header16 *hdr;
1846 struct ncm_pointer16 *ptr;
1847 usbd_status err;
1848 int len;
1849
1850 /* All size constraints have been validated by the caller! */
1851 hdr = (struct ncm_header16 *)sc->sc_tx_buf;
1852 ptr = (struct ncm_pointer16 *)(hdr + 1);
1853 USETDW(hdr->dwSignature, NCM_HDR16_SIG);
1854 USETW(hdr->wHeaderLength, sizeof(*hdr));
1855 USETW(hdr->wSequence, sc->sc_tx_seq);
1856 sc->sc_tx_seq++;
1857
1858 len = m->m_pkthdr.len;
1859
1860 USETDW(ptr->dwSignature, MBIM_NCM_NTH16_SIG(umb_session_id));
1861 USETW(ptr->wLength, sizeof(*ptr));
1862 USETW(ptr->wNextNdpIndex, 0);
1863 USETW(ptr->dgram[0].wDatagramIndex, MBIM_HDR16_LEN);
1864 USETW(ptr->dgram[0].wDatagramLen, len);
1865 USETW(ptr->dgram[1].wDatagramIndex, 0);
1866 USETW(ptr->dgram[1].wDatagramLen, 0);
1867
1868 KASSERT(len <= sc->sc_tx_bufsz - sizeof(*hdr) - sizeof(*ptr));
1869 m_copydata(m, 0, len, ptr + 1);
1870 sc->sc_tx_m = m;
1871 len += MBIM_HDR16_LEN;
1872 USETW(hdr->wBlockLength, len);
1873
1874 DPRINTFN(3, "%s: encap %d bytes\n", DEVNAM(sc), len);
1875 DDUMPN(5, sc->sc_tx_buf, len);
1876 usbd_setup_xfer(sc->sc_tx_xfer, sc, sc->sc_tx_buf, len,
1877 USBD_FORCE_SHORT_XFER, umb_xfer_tout, umb_txeof);
1878 err = usbd_transfer(sc->sc_tx_xfer);
1879 if (err != USBD_IN_PROGRESS) {
1880 DPRINTF("%s: start tx error: %s\n", DEVNAM(sc),
1881 usbd_errstr(err));
1882 return 0;
1883 }
1884 return 1;
1885 }
1886
1887 Static void
umb_txeof(struct usbd_xfer * xfer,void * priv,usbd_status status)1888 umb_txeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
1889 {
1890 struct umb_softc *sc = priv;
1891 struct ifnet *ifp = GET_IFP(sc);
1892 int s;
1893
1894 s = splnet();
1895 ifp->if_flags &= ~IFF_OACTIVE;
1896 ifp->if_timer = 0;
1897
1898 m_freem(sc->sc_tx_m);
1899 sc->sc_tx_m = NULL;
1900
1901 if (status != USBD_NORMAL_COMPLETION) {
1902 if (status != USBD_NOT_STARTED && status != USBD_CANCELLED) {
1903 if_statinc(ifp, if_oerrors);
1904 DPRINTF("%s: tx error: %s\n", DEVNAM(sc),
1905 usbd_errstr(status));
1906 if (status == USBD_STALLED)
1907 usbd_clear_endpoint_stall_async(sc->sc_tx_pipe);
1908 }
1909 }
1910 if (IFQ_IS_EMPTY(&ifp->if_snd) == 0)
1911 umb_start(ifp);
1912
1913 splx(s);
1914 }
1915
1916 Static void
umb_decap(struct umb_softc * sc,struct usbd_xfer * xfer)1917 umb_decap(struct umb_softc *sc, struct usbd_xfer *xfer)
1918 {
1919 struct ifnet *ifp = GET_IFP(sc);
1920 int s;
1921 char *buf;
1922 uint32_t len;
1923 char *dp;
1924 struct ncm_header16 *hdr16;
1925 struct ncm_header32 *hdr32;
1926 struct ncm_pointer16 *ptr16;
1927 struct ncm_pointer16_dgram *dgram16;
1928 struct ncm_pointer32_dgram *dgram32;
1929 uint32_t hsig, psig;
1930 int hlen, blen;
1931 int ptrlen, ptroff, dgentryoff;
1932 uint32_t doff, dlen;
1933 struct mbuf *m;
1934
1935 usbd_get_xfer_status(xfer, NULL, (void **)&buf, &len, NULL);
1936 DPRINTFN(4, "%s: recv %d bytes\n", DEVNAM(sc), len);
1937 DDUMPN(5, buf, len);
1938 s = splnet();
1939 if (len < sizeof(*hdr16))
1940 goto toosmall;
1941
1942 hdr16 = (struct ncm_header16 *)buf;
1943 hsig = UGETDW(hdr16->dwSignature);
1944 hlen = UGETW(hdr16->wHeaderLength);
1945 if (len < hlen)
1946 goto toosmall;
1947 if (len > sc->sc_rx_bufsz) {
1948 DPRINTF("%s: packet too large (%d)\n", DEVNAM(sc), len);
1949 goto fail;
1950 }
1951 switch (hsig) {
1952 case NCM_HDR16_SIG:
1953 blen = UGETW(hdr16->wBlockLength);
1954 ptroff = UGETW(hdr16->wNdpIndex);
1955 if (hlen != sizeof(*hdr16)) {
1956 DPRINTF("%s: bad header len %d for NTH16 (exp %zu)\n",
1957 DEVNAM(sc), hlen, sizeof(*hdr16));
1958 goto fail;
1959 }
1960 break;
1961 case NCM_HDR32_SIG:
1962 hdr32 = (struct ncm_header32 *)hdr16;
1963 blen = UGETDW(hdr32->dwBlockLength);
1964 ptroff = UGETDW(hdr32->dwNdpIndex);
1965 if (hlen != sizeof(*hdr32)) {
1966 DPRINTF("%s: bad header len %d for NTH32 (exp %zu)\n",
1967 DEVNAM(sc), hlen, sizeof(*hdr32));
1968 goto fail;
1969 }
1970 break;
1971 default:
1972 DPRINTF("%s: unsupported NCM header signature (0x%08x)\n",
1973 DEVNAM(sc), hsig);
1974 goto fail;
1975 }
1976 if (len < blen) {
1977 DPRINTF("%s: bad NTB len (%d) for %d bytes of data\n",
1978 DEVNAM(sc), blen, len);
1979 goto fail;
1980 }
1981
1982 ptr16 = (struct ncm_pointer16 *)(buf + ptroff);
1983 psig = UGETDW(ptr16->dwSignature);
1984 ptrlen = UGETW(ptr16->wLength);
1985 if (len < ptrlen + ptroff)
1986 goto toosmall;
1987 if (!MBIM_NCM_NTH16_ISISG(psig) && !MBIM_NCM_NTH32_ISISG(psig)) {
1988 DPRINTF("%s: unsupported NCM pointer signature (0x%08x)\n",
1989 DEVNAM(sc), psig);
1990 goto fail;
1991 }
1992
1993 switch (hsig) {
1994 case NCM_HDR16_SIG:
1995 dgentryoff = offsetof(struct ncm_pointer16, dgram);
1996 break;
1997 case NCM_HDR32_SIG:
1998 dgentryoff = offsetof(struct ncm_pointer32, dgram);
1999 break;
2000 default:
2001 goto fail;
2002 }
2003
2004 while (dgentryoff < ptrlen) {
2005 switch (hsig) {
2006 case NCM_HDR16_SIG:
2007 if (ptroff + dgentryoff < sizeof(*dgram16))
2008 goto done;
2009 dgram16 = (struct ncm_pointer16_dgram *)
2010 (buf + ptroff + dgentryoff);
2011 dgentryoff += sizeof(*dgram16);
2012 dlen = UGETW(dgram16->wDatagramLen);
2013 doff = UGETW(dgram16->wDatagramIndex);
2014 break;
2015 case NCM_HDR32_SIG:
2016 if (ptroff + dgentryoff < sizeof(*dgram32))
2017 goto done;
2018 dgram32 = (struct ncm_pointer32_dgram *)
2019 (buf + ptroff + dgentryoff);
2020 dgentryoff += sizeof(*dgram32);
2021 dlen = UGETDW(dgram32->dwDatagramLen);
2022 doff = UGETDW(dgram32->dwDatagramIndex);
2023 break;
2024 default:
2025 if_statinc(ifp, if_ierrors);
2026 goto done;
2027 }
2028
2029 /* Terminating zero entry */
2030 if (dlen == 0 || doff == 0)
2031 break;
2032 if (len < dlen + doff) {
2033 /* Skip giant datagram but continue processing */
2034 DPRINTF("%s: datagram too large (%d @ off %d)\n",
2035 DEVNAM(sc), dlen, doff);
2036 continue;
2037 }
2038
2039 dp = buf + doff;
2040 DPRINTFN(3, "%s: decap %d bytes\n", DEVNAM(sc), dlen);
2041 m = m_devget(dp, dlen, 0, ifp);
2042 if (m == NULL) {
2043 if_statinc(ifp, if_iqdrops);
2044 continue;
2045 }
2046
2047 if_percpuq_enqueue((ifp)->if_percpuq, (m));
2048 }
2049 done:
2050 splx(s);
2051 return;
2052 toosmall:
2053 DPRINTF("%s: packet too small (%d)\n", DEVNAM(sc), len);
2054 fail:
2055 if_statinc(ifp, if_ierrors);
2056 splx(s);
2057 }
2058
2059 Static usbd_status
umb_send_encap_command(struct umb_softc * sc,void * data,int len)2060 umb_send_encap_command(struct umb_softc *sc, void *data, int len)
2061 {
2062 usb_device_request_t req;
2063
2064 if (len > sc->sc_ctrl_len)
2065 return USBD_INVAL;
2066
2067 /* XXX FIXME: if (total len > sc->sc_ctrl_len) => must fragment */
2068 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
2069 req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
2070 USETW(req.wValue, 0);
2071 USETW(req.wIndex, sc->sc_ctrl_ifaceno);
2072 USETW(req.wLength, len);
2073 DELAY(umb_delay);
2074 return usbd_do_request(sc->sc_udev, &req, data);
2075 }
2076
2077 Static int
umb_get_encap_response(struct umb_softc * sc,void * buf,int * len)2078 umb_get_encap_response(struct umb_softc *sc, void *buf, int *len)
2079 {
2080 usb_device_request_t req;
2081 usbd_status err;
2082
2083 req.bmRequestType = UT_READ_CLASS_INTERFACE;
2084 req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
2085 USETW(req.wValue, 0);
2086 USETW(req.wIndex, sc->sc_ctrl_ifaceno);
2087 USETW(req.wLength, *len);
2088 /* XXX FIXME: re-assemble fragments */
2089
2090 DELAY(umb_delay);
2091 err = usbd_do_request_flags(sc->sc_udev, &req, buf, USBD_SHORT_XFER_OK,
2092 len, umb_xfer_tout);
2093 if (err == USBD_NORMAL_COMPLETION)
2094 return 1;
2095 DPRINTF("%s: ctrl recv: %s\n", DEVNAM(sc), usbd_errstr(err));
2096 return 0;
2097 }
2098
2099 Static void
umb_ctrl_msg(struct umb_softc * sc,uint32_t req,void * data,int len)2100 umb_ctrl_msg(struct umb_softc *sc, uint32_t req, void *data, int len)
2101 {
2102 struct ifnet *ifp = GET_IFP(sc);
2103 uint32_t tid;
2104 struct mbim_msghdr *hdr = data;
2105 usbd_status err;
2106 int s;
2107
2108 if (sc->sc_dying)
2109 return;
2110 if (len < sizeof(*hdr))
2111 return;
2112 tid = ++sc->sc_tid;
2113
2114 hdr->type = htole32(req);
2115 hdr->len = htole32(len);
2116 hdr->tid = htole32(tid);
2117
2118 #ifdef UMB_DEBUG
2119 if (umb_debug) {
2120 const char *op, *str;
2121 if (req == MBIM_COMMAND_MSG) {
2122 struct mbim_h2f_cmd *c = data;
2123 if (le32toh(c->op) == MBIM_CMDOP_SET)
2124 op = "set";
2125 else
2126 op = "qry";
2127 str = umb_cid2str(le32toh(c->cid));
2128 } else {
2129 op = "snd";
2130 str = umb_request2str(req);
2131 }
2132 DPRINTF("%s: -> %s %s (tid %u)\n", DEVNAM(sc), op, str, tid);
2133 }
2134 #endif
2135 s = splusb();
2136 err = umb_send_encap_command(sc, data, len);
2137 splx(s);
2138 if (err != USBD_NORMAL_COMPLETION) {
2139 if (ifp->if_flags & IFF_DEBUG)
2140 log(LOG_ERR, "%s: send %s msg (tid %u) failed: %s\n",
2141 DEVNAM(sc), umb_request2str(req), tid,
2142 usbd_errstr(err));
2143
2144 /* will affect other transactions, too */
2145 usbd_abort_pipe(sc->sc_udev->ud_pipe0);
2146 } else {
2147 DPRINTFN(2, "%s: sent %s (tid %u)\n", DEVNAM(sc),
2148 umb_request2str(req), tid);
2149 DDUMPN(3, data, len);
2150 }
2151 return;
2152 }
2153
2154 Static void
umb_open(struct umb_softc * sc)2155 umb_open(struct umb_softc *sc)
2156 {
2157 struct mbim_h2f_openmsg msg;
2158
2159 memset(&msg, 0, sizeof(msg));
2160 msg.maxlen = htole32(sc->sc_ctrl_len);
2161 umb_ctrl_msg(sc, MBIM_OPEN_MSG, &msg, sizeof(msg));
2162 return;
2163 }
2164
2165 Static void
umb_close(struct umb_softc * sc)2166 umb_close(struct umb_softc *sc)
2167 {
2168 struct mbim_h2f_closemsg msg;
2169
2170 memset(&msg, 0, sizeof(msg));
2171 umb_ctrl_msg(sc, MBIM_CLOSE_MSG, &msg, sizeof(msg));
2172 }
2173
2174 Static int
umb_setpin(struct umb_softc * sc,int op,int is_puk,void * pin,int pinlen,void * newpin,int newpinlen)2175 umb_setpin(struct umb_softc *sc, int op, int is_puk, void *pin, int pinlen,
2176 void *newpin, int newpinlen)
2177 {
2178 struct mbim_cid_pin cp;
2179 int off;
2180
2181 if (pinlen == 0)
2182 return 0;
2183 if (pinlen < 0 || pinlen > MBIM_PIN_MAXLEN ||
2184 newpinlen < 0 || newpinlen > MBIM_PIN_MAXLEN ||
2185 op < 0 || op > MBIM_PIN_OP_CHANGE ||
2186 (is_puk && op != MBIM_PIN_OP_ENTER))
2187 return EINVAL;
2188
2189 memset(&cp, 0, sizeof(cp));
2190 cp.type = htole32(is_puk ? MBIM_PIN_TYPE_PUK1 : MBIM_PIN_TYPE_PIN1);
2191
2192 off = offsetof(struct mbim_cid_pin, data);
2193 if (!umb_addstr(&cp, sizeof(cp), &off, pin, pinlen,
2194 &cp.pin_offs, &cp.pin_size))
2195 return EINVAL;
2196
2197 cp.op = htole32(op);
2198 if (newpinlen) {
2199 if (!umb_addstr(&cp, sizeof(cp), &off, newpin, newpinlen,
2200 &cp.newpin_offs, &cp.newpin_size))
2201 return EINVAL;
2202 } else {
2203 if ((op == MBIM_PIN_OP_CHANGE) || is_puk)
2204 return EINVAL;
2205 if (!umb_addstr(&cp, sizeof(cp), &off, NULL, 0,
2206 &cp.newpin_offs, &cp.newpin_size))
2207 return EINVAL;
2208 }
2209 umb_cmd(sc, MBIM_CID_PIN, MBIM_CMDOP_SET, &cp, off);
2210 return 0;
2211 }
2212
2213 Static void
umb_setdataclass(struct umb_softc * sc)2214 umb_setdataclass(struct umb_softc *sc)
2215 {
2216 struct mbim_cid_registration_state rs;
2217 uint32_t classes;
2218
2219 if (sc->sc_info.supportedclasses == MBIM_DATACLASS_NONE)
2220 return;
2221
2222 memset(&rs, 0, sizeof(rs));
2223 rs.regaction = htole32(MBIM_REGACTION_AUTOMATIC);
2224 classes = sc->sc_info.supportedclasses;
2225 if (sc->sc_info.preferredclasses != MBIM_DATACLASS_NONE)
2226 classes &= sc->sc_info.preferredclasses;
2227 rs.data_class = htole32(classes);
2228 umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_SET, &rs, sizeof(rs));
2229 }
2230
2231 Static void
umb_radio(struct umb_softc * sc,int on)2232 umb_radio(struct umb_softc *sc, int on)
2233 {
2234 struct mbim_cid_radio_state s;
2235
2236 DPRINTF("%s: set radio %s\n", DEVNAM(sc), on ? "on" : "off");
2237 memset(&s, 0, sizeof(s));
2238 s.state = htole32(on ? MBIM_RADIO_STATE_ON : MBIM_RADIO_STATE_OFF);
2239 umb_cmd(sc, MBIM_CID_RADIO_STATE, MBIM_CMDOP_SET, &s, sizeof(s));
2240 }
2241
2242 Static void
umb_allocate_cid(struct umb_softc * sc)2243 umb_allocate_cid(struct umb_softc *sc)
2244 {
2245 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET,
2246 umb_qmi_alloc_cid, sizeof(umb_qmi_alloc_cid), umb_uuid_qmi_mbim);
2247 }
2248
2249 Static void
umb_send_fcc_auth(struct umb_softc * sc)2250 umb_send_fcc_auth(struct umb_softc *sc)
2251 {
2252 uint8_t fccauth[sizeof(umb_qmi_fcc_auth)];
2253
2254 if (sc->sc_cid == -1) {
2255 DPRINTF("%s: missing CID, cannot send FCC auth\n", DEVNAM(sc));
2256 umb_allocate_cid(sc);
2257 return;
2258 }
2259 memcpy(fccauth, umb_qmi_fcc_auth, sizeof(fccauth));
2260 fccauth[UMB_QMI_CID_OFFS] = sc->sc_cid;
2261 umb_cmd1(sc, MBIM_CID_DEVICE_CAPS, MBIM_CMDOP_SET,
2262 fccauth, sizeof(fccauth), umb_uuid_qmi_mbim);
2263 }
2264
2265 Static void
umb_packet_service(struct umb_softc * sc,int attach)2266 umb_packet_service(struct umb_softc *sc, int attach)
2267 {
2268 struct mbim_cid_packet_service s;
2269
2270 DPRINTF("%s: %s packet service\n", DEVNAM(sc),
2271 attach ? "attach" : "detach");
2272 memset(&s, 0, sizeof(s));
2273 s.action = htole32(attach ?
2274 MBIM_PKTSERVICE_ACTION_ATTACH : MBIM_PKTSERVICE_ACTION_DETACH);
2275 umb_cmd(sc, MBIM_CID_PACKET_SERVICE, MBIM_CMDOP_SET, &s, sizeof(s));
2276 }
2277
2278 Static void
umb_connect(struct umb_softc * sc)2279 umb_connect(struct umb_softc *sc)
2280 {
2281 struct ifnet *ifp = GET_IFP(sc);
2282
2283 if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) {
2284 log(LOG_INFO, "%s: connection disabled in roaming network\n",
2285 DEVNAM(sc));
2286 return;
2287 }
2288 if (ifp->if_flags & IFF_DEBUG)
2289 log(LOG_DEBUG, "%s: connecting ...\n", DEVNAM(sc));
2290 umb_send_connect(sc, MBIM_CONNECT_ACTIVATE);
2291 }
2292
2293 Static void
umb_disconnect(struct umb_softc * sc)2294 umb_disconnect(struct umb_softc *sc)
2295 {
2296 struct ifnet *ifp = GET_IFP(sc);
2297
2298 if (ifp->if_flags & IFF_DEBUG)
2299 log(LOG_DEBUG, "%s: disconnecting ...\n", DEVNAM(sc));
2300 umb_send_connect(sc, MBIM_CONNECT_DEACTIVATE);
2301 }
2302
2303 Static void
umb_send_connect(struct umb_softc * sc,int command)2304 umb_send_connect(struct umb_softc *sc, int command)
2305 {
2306 struct mbim_cid_connect *c;
2307 int off;
2308
2309 /* Too large or the stack */
2310 c = kmem_zalloc(sizeof(*c), KM_SLEEP);
2311 c->sessionid = htole32(umb_session_id);
2312 c->command = htole32(command);
2313 off = offsetof(struct mbim_cid_connect, data);
2314 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.apn,
2315 sc->sc_info.apnlen, &c->access_offs, &c->access_size))
2316 goto done;
2317 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.username,
2318 sc->sc_info.usernamelen, &c->user_offs, &c->user_size))
2319 goto done;
2320 if (!umb_addstr(c, sizeof(*c), &off, sc->sc_info.password,
2321 sc->sc_info.passwordlen, &c->passwd_offs, &c->passwd_size))
2322 goto done;
2323 c->authprot = htole32(MBIM_AUTHPROT_NONE);
2324 c->compression = htole32(MBIM_COMPRESSION_NONE);
2325 c->iptype = htole32(MBIM_CONTEXT_IPTYPE_IPV4);
2326 memcpy(c->context, umb_uuid_context_internet, sizeof(c->context));
2327 umb_cmd(sc, MBIM_CID_CONNECT, MBIM_CMDOP_SET, c, off);
2328 done:
2329 kmem_free(c, sizeof(*c));
2330 return;
2331 }
2332
2333 Static void
umb_qry_ipconfig(struct umb_softc * sc)2334 umb_qry_ipconfig(struct umb_softc *sc)
2335 {
2336 struct mbim_cid_ip_configuration_info ipc;
2337
2338 memset(&ipc, 0, sizeof(ipc));
2339 ipc.sessionid = htole32(umb_session_id);
2340 umb_cmd(sc, MBIM_CID_IP_CONFIGURATION, MBIM_CMDOP_QRY,
2341 &ipc, sizeof(ipc));
2342 }
2343
2344 Static void
umb_cmd(struct umb_softc * sc,int cid,int op,const void * data,int len)2345 umb_cmd(struct umb_softc *sc, int cid, int op, const void *data, int len)
2346 {
2347 umb_cmd1(sc, cid, op, data, len, umb_uuid_basic_connect);
2348 }
2349
2350 Static void
umb_cmd1(struct umb_softc * sc,int cid,int op,const void * data,int len,uint8_t * uuid)2351 umb_cmd1(struct umb_softc *sc, int cid, int op, const void *data, int len,
2352 uint8_t *uuid)
2353 {
2354 struct mbim_h2f_cmd *cmd;
2355 int totlen;
2356
2357 /* XXX FIXME support sending fragments */
2358 if (sizeof(*cmd) + len > sc->sc_ctrl_len) {
2359 DPRINTF("%s: set %s msg too long: cannot send\n",
2360 DEVNAM(sc), umb_cid2str(cid));
2361 return;
2362 }
2363 cmd = sc->sc_ctrl_msg;
2364 memset(cmd, 0, sizeof(*cmd));
2365 cmd->frag.nfrag = htole32(1);
2366 memcpy(cmd->devid, uuid, sizeof(cmd->devid));
2367 cmd->cid = htole32(cid);
2368 cmd->op = htole32(op);
2369 cmd->infolen = htole32(len);
2370 totlen = sizeof(*cmd);
2371 if (len > 0) {
2372 memcpy(cmd + 1, data, len);
2373 totlen += len;
2374 }
2375 umb_ctrl_msg(sc, MBIM_COMMAND_MSG, cmd, totlen);
2376 }
2377
2378 Static void
umb_command_done(struct umb_softc * sc,void * data,int len)2379 umb_command_done(struct umb_softc *sc, void *data, int len)
2380 {
2381 struct mbim_f2h_cmddone *cmd = data;
2382 struct ifnet *ifp = GET_IFP(sc);
2383 uint32_t status;
2384 uint32_t cid;
2385 uint32_t infolen;
2386 int qmimsg = 0;
2387
2388 if (len < sizeof(*cmd)) {
2389 DPRINTF("%s: discard short %s message\n", DEVNAM(sc),
2390 umb_request2str(le32toh(cmd->hdr.type)));
2391 return;
2392 }
2393 cid = le32toh(cmd->cid);
2394 if (memcmp(cmd->devid, umb_uuid_basic_connect, sizeof(cmd->devid))) {
2395 if (memcmp(cmd->devid, umb_uuid_qmi_mbim,
2396 sizeof(cmd->devid))) {
2397 DPRINTF("%s: discard %s message for other UUID '%s'\n",
2398 DEVNAM(sc), umb_request2str(le32toh(cmd->hdr.type)),
2399 umb_uuid2str(cmd->devid));
2400 return;
2401 } else
2402 qmimsg = 1;
2403 }
2404
2405 status = le32toh(cmd->status);
2406 switch (status) {
2407 case MBIM_STATUS_SUCCESS:
2408 break;
2409 case MBIM_STATUS_NOT_INITIALIZED:
2410 if (ifp->if_flags & IFF_DEBUG)
2411 log(LOG_ERR, "%s: SIM not initialized (PIN missing)\n",
2412 DEVNAM(sc));
2413 return;
2414 case MBIM_STATUS_PIN_REQUIRED:
2415 sc->sc_info.pin_state = UMB_PIN_REQUIRED;
2416 /*FALLTHROUGH*/
2417 default:
2418 if (ifp->if_flags & IFF_DEBUG)
2419 log(LOG_ERR, "%s: set/qry %s failed: %s\n", DEVNAM(sc),
2420 umb_cid2str(cid), umb_status2str(status));
2421 return;
2422 }
2423
2424 infolen = le32toh(cmd->infolen);
2425 if (len < sizeof(*cmd) + infolen) {
2426 DPRINTF("%s: discard truncated %s message (want %d, got %d)\n",
2427 DEVNAM(sc), umb_cid2str(cid),
2428 (int)sizeof(*cmd) + infolen, len);
2429 return;
2430 }
2431 if (qmimsg) {
2432 if (sc->sc_flags & UMBFLG_FCC_AUTH_REQUIRED)
2433 umb_decode_qmi(sc, cmd->info, infolen);
2434 } else {
2435 DPRINTFN(2, "%s: set/qry %s done\n", DEVNAM(sc),
2436 umb_cid2str(cid));
2437 umb_decode_cid(sc, cid, cmd->info, infolen);
2438 }
2439 }
2440
2441 Static void
umb_decode_cid(struct umb_softc * sc,uint32_t cid,void * data,int len)2442 umb_decode_cid(struct umb_softc *sc, uint32_t cid, void *data, int len)
2443 {
2444 int ok = 1;
2445
2446 switch (cid) {
2447 case MBIM_CID_DEVICE_CAPS:
2448 ok = umb_decode_devices_caps(sc, data, len);
2449 break;
2450 case MBIM_CID_SUBSCRIBER_READY_STATUS:
2451 ok = umb_decode_subscriber_status(sc, data, len);
2452 break;
2453 case MBIM_CID_RADIO_STATE:
2454 ok = umb_decode_radio_state(sc, data, len);
2455 break;
2456 case MBIM_CID_PIN:
2457 ok = umb_decode_pin(sc, data, len);
2458 break;
2459 case MBIM_CID_REGISTER_STATE:
2460 ok = umb_decode_register_state(sc, data, len);
2461 break;
2462 case MBIM_CID_PACKET_SERVICE:
2463 ok = umb_decode_packet_service(sc, data, len);
2464 break;
2465 case MBIM_CID_SIGNAL_STATE:
2466 ok = umb_decode_signal_state(sc, data, len);
2467 break;
2468 case MBIM_CID_CONNECT:
2469 ok = umb_decode_connect_info(sc, data, len);
2470 break;
2471 case MBIM_CID_IP_CONFIGURATION:
2472 ok = umb_decode_ip_configuration(sc, data, len);
2473 break;
2474 default:
2475 /*
2476 * Note: the above list is incomplete and only contains
2477 * mandatory CIDs from the BASIC_CONNECT set.
2478 * So alternate values are not unusual.
2479 */
2480 DPRINTFN(4, "%s: ignore %s\n", DEVNAM(sc), umb_cid2str(cid));
2481 break;
2482 }
2483 if (!ok)
2484 DPRINTF("%s: discard %s with bad info length %d\n",
2485 DEVNAM(sc), umb_cid2str(cid), len);
2486 return;
2487 }
2488
2489 Static void
umb_decode_qmi(struct umb_softc * sc,uint8_t * data,int len)2490 umb_decode_qmi(struct umb_softc *sc, uint8_t *data, int len)
2491 {
2492 uint8_t srv;
2493 uint16_t msg, tlvlen;
2494 uint32_t val;
2495
2496 #define UMB_QMI_QMUXLEN 6
2497 if (len < UMB_QMI_QMUXLEN)
2498 goto tooshort;
2499
2500 srv = data[4];
2501 data += UMB_QMI_QMUXLEN;
2502 len -= UMB_QMI_QMUXLEN;
2503
2504 #define UMB_GET16(p) ((uint16_t)*p | (uint16_t)*(p + 1) << 8)
2505 #define UMB_GET32(p) ((uint32_t)*p | (uint32_t)*(p + 1) << 8 | \
2506 (uint32_t)*(p + 2) << 16 |(uint32_t)*(p + 3) << 24)
2507 switch (srv) {
2508 case 0: /* ctl */
2509 #define UMB_QMI_CTLLEN 6
2510 if (len < UMB_QMI_CTLLEN)
2511 goto tooshort;
2512 msg = UMB_GET16(&data[2]);
2513 tlvlen = UMB_GET16(&data[4]);
2514 data += UMB_QMI_CTLLEN;
2515 len -= UMB_QMI_CTLLEN;
2516 break;
2517 case 2: /* dms */
2518 #define UMB_QMI_DMSLEN 7
2519 if (len < UMB_QMI_DMSLEN)
2520 goto tooshort;
2521 msg = UMB_GET16(&data[3]);
2522 tlvlen = UMB_GET16(&data[5]);
2523 data += UMB_QMI_DMSLEN;
2524 len -= UMB_QMI_DMSLEN;
2525 break;
2526 default:
2527 DPRINTF("%s: discard QMI message for unknown service type %d\n",
2528 DEVNAM(sc), srv);
2529 return;
2530 }
2531
2532 if (len < tlvlen)
2533 goto tooshort;
2534
2535 #define UMB_QMI_TLVLEN 3
2536 while (len > 0) {
2537 if (len < UMB_QMI_TLVLEN)
2538 goto tooshort;
2539 tlvlen = UMB_GET16(&data[1]);
2540 if (len < UMB_QMI_TLVLEN + tlvlen)
2541 goto tooshort;
2542 switch (data[0]) {
2543 case 1: /* allocation info */
2544 if (msg == 0x0022) { /* Allocate CID */
2545 if (tlvlen != 2 || data[3] != 2) /* dms */
2546 break;
2547 sc->sc_cid = data[4];
2548 DPRINTF("%s: QMI CID %d allocated\n",
2549 DEVNAM(sc), sc->sc_cid);
2550 umb_newstate(sc, UMB_S_CID, UMB_NS_DONT_DROP);
2551 }
2552 break;
2553 case 2: /* response */
2554 if (tlvlen != sizeof(val))
2555 break;
2556 val = UMB_GET32(&data[3]);
2557 switch (msg) {
2558 case 0x0022: /* Allocate CID */
2559 if (val != 0) {
2560 log(LOG_ERR, "%s: allocation of QMI CID"
2561 " failed, error %#x\n", DEVNAM(sc),
2562 val);
2563 /* XXX how to proceed? */
2564 return;
2565 }
2566 break;
2567 case 0x555f: /* Send FCC Authentication */
2568 if (val == 0)
2569 DPRINTF("%s: send FCC "
2570 "Authentication succeeded\n",
2571 DEVNAM(sc));
2572 else if (val == 0x001a0001)
2573 DPRINTF("%s: FCC Authentication "
2574 "not required\n", DEVNAM(sc));
2575 else
2576 log(LOG_INFO, "%s: send FCC "
2577 "Authentication failed, "
2578 "error %#x\n", DEVNAM(sc), val);
2579
2580 /* FCC Auth is needed only once after power-on*/
2581 sc->sc_flags &= ~UMBFLG_FCC_AUTH_REQUIRED;
2582
2583 /* Try to proceed anyway */
2584 DPRINTF("%s: init: turning radio on ...\n",
2585 DEVNAM(sc));
2586 umb_radio(sc, 1);
2587 break;
2588 default:
2589 break;
2590 }
2591 break;
2592 default:
2593 break;
2594 }
2595 data += UMB_QMI_TLVLEN + tlvlen;
2596 len -= UMB_QMI_TLVLEN + tlvlen;
2597 }
2598 return;
2599
2600 tooshort:
2601 DPRINTF("%s: discard short QMI message\n", DEVNAM(sc));
2602 return;
2603 }
2604
2605 Static void
umb_intr(struct usbd_xfer * xfer,void * priv,usbd_status status)2606 umb_intr(struct usbd_xfer *xfer, void *priv, usbd_status status)
2607 {
2608 struct umb_softc *sc = priv;
2609 struct ifnet *ifp = GET_IFP(sc);
2610 int total_len;
2611
2612 if (status != USBD_NORMAL_COMPLETION) {
2613 DPRINTF("%s: notification error: %s\n", DEVNAM(sc),
2614 usbd_errstr(status));
2615 if (status == USBD_STALLED)
2616 usbd_clear_endpoint_stall_async(sc->sc_ctrl_pipe);
2617 return;
2618 }
2619 usbd_get_xfer_status(xfer, NULL, NULL, &total_len, NULL);
2620 if (total_len < UCDC_NOTIFICATION_LENGTH) {
2621 DPRINTF("%s: short notification (%d<%d)\n", DEVNAM(sc),
2622 total_len, UCDC_NOTIFICATION_LENGTH);
2623 return;
2624 }
2625 if (sc->sc_intr_msg.bmRequestType != UCDC_NOTIFICATION) {
2626 DPRINTF("%s: unexpected notification (type=0x%02x)\n",
2627 DEVNAM(sc), sc->sc_intr_msg.bmRequestType);
2628 return;
2629 }
2630
2631 switch (sc->sc_intr_msg.bNotification) {
2632 case UCDC_N_NETWORK_CONNECTION:
2633 if (ifp->if_flags & IFF_DEBUG)
2634 log(LOG_DEBUG, "%s: network %sconnected\n", DEVNAM(sc),
2635 UGETW(sc->sc_intr_msg.wValue) ? "" : "dis");
2636 break;
2637 case UCDC_N_RESPONSE_AVAILABLE:
2638 DPRINTFN(2, "%s: umb_intr: response available\n", DEVNAM(sc));
2639 ++sc->sc_nresp;
2640 usb_add_task(sc->sc_udev, &sc->sc_get_response_task, USB_TASKQ_DRIVER);
2641 break;
2642 case UCDC_N_CONNECTION_SPEED_CHANGE:
2643 DPRINTFN(2, "%s: umb_intr: connection speed changed\n",
2644 DEVNAM(sc));
2645 break;
2646 default:
2647 DPRINTF("%s: unexpected notification (0x%02x)\n",
2648 DEVNAM(sc), sc->sc_intr_msg.bNotification);
2649 break;
2650 }
2651 }
2652
2653 /*
2654 * Diagnostic routines
2655 */
2656 Static char *
umb_ntop(struct sockaddr * sa)2657 umb_ntop(struct sockaddr *sa)
2658 {
2659 #define NUMBUFS 4
2660 static char astr[NUMBUFS][INET_ADDRSTRLEN];
2661 static unsigned nbuf = 0;
2662 char *s;
2663
2664 s = astr[nbuf++];
2665 if (nbuf >= NUMBUFS)
2666 nbuf = 0;
2667
2668 switch (sa->sa_family) {
2669 case AF_INET:
2670 default:
2671 inet_ntop(AF_INET, &satosin(sa)->sin_addr, s, sizeof(astr[0]));
2672 break;
2673 case AF_INET6:
2674 inet_ntop(AF_INET6, &satosin6(sa)->sin6_addr, s,
2675 sizeof(astr[0]));
2676 break;
2677 }
2678 return s;
2679 }
2680
2681 #ifdef UMB_DEBUG
2682 Static char *
umb_uuid2str(uint8_t uuid[MBIM_UUID_LEN])2683 umb_uuid2str(uint8_t uuid[MBIM_UUID_LEN])
2684 {
2685 static char uuidstr[2 * MBIM_UUID_LEN + 5];
2686
2687 #define UUID_BFMT "%02X"
2688 #define UUID_SEP "-"
2689 snprintf(uuidstr, sizeof(uuidstr),
2690 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_SEP
2691 UUID_BFMT UUID_BFMT UUID_SEP
2692 UUID_BFMT UUID_BFMT UUID_SEP
2693 UUID_BFMT UUID_BFMT UUID_SEP
2694 UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT UUID_BFMT,
2695 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5],
2696 uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11],
2697 uuid[12], uuid[13], uuid[14], uuid[15]);
2698 return uuidstr;
2699 }
2700
2701 Static void
umb_dump(void * buf,int len)2702 umb_dump(void *buf, int len)
2703 {
2704 int i = 0;
2705 uint8_t *c = buf;
2706
2707 if (len == 0)
2708 return;
2709 while (i < len) {
2710 if ((i % 16) == 0) {
2711 if (i > 0)
2712 addlog("\n");
2713 log(LOG_DEBUG, "%4d: ", i);
2714 }
2715 addlog(" %02x", *c);
2716 c++;
2717 i++;
2718 }
2719 addlog("\n");
2720 }
2721 #endif /* UMB_DEBUG */
2722
2723 /* char *
2724 * inet_ntop(af, src, dst, size)
2725 * convert a network format address to presentation format.
2726 * return:
2727 * pointer to presentation format address (`dst'), or NULL (see errno).
2728 * author:
2729 * Paul Vixie, 1996.
2730 */
2731 Static const char *
inet_ntop(int af,const void * src,char * dst,socklen_t size)2732 inet_ntop(int af, const void *src, char *dst, socklen_t size)
2733 {
2734 switch (af) {
2735 case AF_INET:
2736 return inet_ntop4(src, dst, (size_t)size);
2737 #ifdef INET6
2738 case AF_INET6:
2739 return inet_ntop6(src, dst, (size_t)size);
2740 #endif /* INET6 */
2741 default:
2742 return NULL;
2743 }
2744 /* NOTREACHED */
2745 }
2746
2747 /* const char *
2748 * inet_ntop4(src, dst, size)
2749 * format an IPv4 address, more or less like inet_ntoa()
2750 * return:
2751 * `dst' (as a const)
2752 * notes:
2753 * (1) uses no statics
2754 * (2) takes a u_char* not an in_addr as input
2755 * author:
2756 * Paul Vixie, 1996.
2757 */
2758 Static const char *
inet_ntop4(const u_char * src,char * dst,size_t size)2759 inet_ntop4(const u_char *src, char *dst, size_t size)
2760 {
2761 char tmp[sizeof("255.255.255.255")];
2762 int l;
2763
2764 l = snprintf(tmp, sizeof(tmp), "%u.%u.%u.%u",
2765 src[0], src[1], src[2], src[3]);
2766 if (l <= 0 || l >= size) {
2767 return NULL;
2768 }
2769 strlcpy(dst, tmp, size);
2770 return dst;
2771 }
2772
2773 #ifdef INET6
2774 /* const char *
2775 * inet_ntop6(src, dst, size)
2776 * convert IPv6 binary address into presentation (printable) format
2777 * author:
2778 * Paul Vixie, 1996.
2779 */
2780 Static const char *
inet_ntop6(const u_char * src,char * dst,size_t size)2781 inet_ntop6(const u_char *src, char *dst, size_t size)
2782 {
2783 /*
2784 * Note that int32_t and int16_t need only be "at least" large enough
2785 * to contain a value of the specified size. On some systems, like
2786 * Crays, there is no such thing as an integer variable with 16 bits.
2787 * Keep this in mind if you think this function should have been coded
2788 * to use pointer overlays. All the world's not a VAX.
2789 */
2790 char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
2791 char *tp, *ep;
2792 struct { int base, len; } best, cur;
2793 #define IN6ADDRSZ 16
2794 #define INT16SZ 2
2795 u_int words[IN6ADDRSZ / INT16SZ];
2796 int i;
2797 int advance;
2798
2799 /*
2800 * Preprocess:
2801 * Copy the input (bytewise) array into a wordwise array.
2802 * Find the longest run of 0x00's in src[] for :: shorthanding.
2803 */
2804 memset(words, '\0', sizeof(words));
2805 for (i = 0; i < IN6ADDRSZ; i++)
2806 words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
2807 best.base = -1;
2808 best.len = 0;
2809 cur.base = -1;
2810 cur.len = 0;
2811 for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
2812 if (words[i] == 0) {
2813 if (cur.base == -1)
2814 cur.base = i, cur.len = 1;
2815 else
2816 cur.len++;
2817 } else {
2818 if (cur.base != -1) {
2819 if (best.base == -1 || cur.len > best.len)
2820 best = cur;
2821 cur.base = -1;
2822 }
2823 }
2824 }
2825 if (cur.base != -1) {
2826 if (best.base == -1 || cur.len > best.len)
2827 best = cur;
2828 }
2829 if (best.base != -1 && best.len < 2)
2830 best.base = -1;
2831
2832 /*
2833 * Format the result.
2834 */
2835 tp = tmp;
2836 ep = tmp + sizeof(tmp);
2837 for (i = 0; i < (IN6ADDRSZ / INT16SZ) && tp < ep; i++) {
2838 /* Are we inside the best run of 0x00's? */
2839 if (best.base != -1 && i >= best.base &&
2840 i < (best.base + best.len)) {
2841 if (i == best.base) {
2842 if (tp + 1 >= ep)
2843 return NULL;
2844 *tp++ = ':';
2845 }
2846 continue;
2847 }
2848 /* Are we following an initial run of 0x00s or any real hex? */
2849 if (i != 0) {
2850 if (tp + 1 >= ep)
2851 return NULL;
2852 *tp++ = ':';
2853 }
2854 /* Is this address an encapsulated IPv4? */
2855 if (i == 6 && best.base == 0 &&
2856 (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) {
2857 if (!inet_ntop4(src+12, tp, (size_t)(ep - tp)))
2858 return NULL;
2859 tp += strlen(tp);
2860 break;
2861 }
2862 advance = snprintf(tp, ep - tp, "%x", words[i]);
2863 if (advance <= 0 || advance >= ep - tp)
2864 return NULL;
2865 tp += advance;
2866 }
2867 /* Was it a trailing run of 0x00's? */
2868 if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ)) {
2869 if (tp + 1 >= ep)
2870 return NULL;
2871 *tp++ = ':';
2872 }
2873 if (tp + 1 >= ep)
2874 return NULL;
2875 *tp++ = '\0';
2876
2877 /*
2878 * Check for overflow, copy, and we're done.
2879 */
2880 if ((size_t)(tp - tmp) > size) {
2881 return NULL;
2882 }
2883 strlcpy(dst, tmp, size);
2884 return dst;
2885 }
2886 #endif /* INET6 */
2887