SMS_SEND uses an embedded databuffer inside MBIM_SET_SMS_SEND which
wants to use a local offset (local to the databuffer structure) as
opposed to the offset from the start of the static buffer.
For zero element arrays we might inadvertently run past the end of the
iov buffer. Fix this by adding additional checks that n_elem > 0 and
don't call _iter_get_data unless needed.
In SimManager, the Retries property isn't used for gemalto modems.
The at command AT^SPIC is used to get the remaining retries left
for the current required password type.
This commit adds the implementation in the SIM driver of the retries
queries.
When modem does not answer or answers slowly to a discovery request,
a timeout occurs.
In timeout callback, request should be removed from queues to avoid
treating answer if it arrives later.
The Quectel EC21 does not provide the SMS PDU on the message event
notification.
This patch adds a call to 'raw read' on the message ID from the event
notification if the event notification does not already contain the
message data.
The message data begins with the SMSC length, type, and address so
the TPDU length is adjusted accordingly in the raw_read callback. This
differs from the way the raw message data is handled in the case
that it is included in the event notification itself. As I don't have
access to any other QMI modem at this time, I'm can not confirm that
this difference is reasonable.
Implemented the core API's needed for sim-auth:
list_apps: already implemented
open_channel: Opens a logical channel with +CCHO
close_channel: Closes logical channel with +CCHC
logical_access: Access an opened channel with +CGLA
==2941== Invalid read of size 4
==2941== at 0x69338: sim_state_cb (sim.c:1301)
==2941== by 0x71DCB: cpin_check_cb (atutil.c:567)
==2941== by 0xA602B: at_chat_finish_command (gatchat.c:459)
==2941== by 0xA6277: at_chat_handle_command_response (gatchat.c:521)
==2941== by 0xA6587: have_line (gatchat.c:600)
==2941== by 0xA6BB7: new_bytes (gatchat.c:759)
==2941== by 0xAAFAF: received_data (gatio.c:124)
==2941== by 0x4AF606F: g_main_dispatch (gmain.c:3154)
==2941== by 0x4AF606F: g_main_context_dispatch (gmain.c:3769)
==2941== by 0x4AF658F: g_main_loop_run (gmain.c:4034)
==2941== by 0xBDDBB: main (main.c:261)
==2941== Address 0x519c344 is 4 bytes inside a block of size 12 free'd
==2941== at 0x4840B28: free (vg_replace_malloc.c:530)
==2941== by 0x71F33: at_util_sim_state_query_free (atutil.c:613)
==2941== by 0x6930B: sim_state_cb (sim.c:1297)
==2941== by 0x71DCB: cpin_check_cb (atutil.c:567)
==2941== by 0xA602B: at_chat_finish_command (gatchat.c:459)
==2941== by 0xA6277: at_chat_handle_command_response (gatchat.c:521)
==2941== by 0xA6587: have_line (gatchat.c:600)
==2941== by 0xA6BB7: new_bytes (gatchat.c:759)
==2941== by 0xAAFAF: received_data (gatio.c:124)
==2941== by 0x4AF606F: g_main_dispatch (gmain.c:3154)
==2941== by 0x4AF606F: g_main_context_dispatch (gmain.c:3769)
==2941== by 0x4AF658F: g_main_loop_run (gmain.c:4034)
==2941== by 0xBDDBB: main (main.c:261)
Huawei LTE modems use AT^SYSCFGEX and AT^SYSINFOEX instead of
AT^SYSCFG and AT^SYSINFO.
If we want to be able to attach on LTE with this modem, we must use
AT^SYSCFGEX to configure rat mode and band. Using AT^SYSCFG, mode any
means UMTS or GSM.
Add support for automatic context activation by adding read_settings.
It also adds detach_shutdown to make sure context is cleaned up when
network registration is lost.
This is a rudimentary implementation that contains technology and RSSI
and BitErrorRate, plus RSRQ/RSRP for LTE networks. More data can be
added as needed.
This implementations uses the 'Get Signal Strength' QMI method to retrieve
the data. Operator fields (MNC, LAC, etc) can be gotten from the 'Serving
Cell' method if needed, but since this data is already provided in the
NetworkRegistration object it doesn't seem necessary to repeat it here
when an additional communication to the modem is required.
When registering callbacks before ofono_netreg_register(), callbacks
will use the netreg api which might lead into undefined behaviour,
because certain fields aren't yet initilized.
This provides the list of available technologies in the radio-settings
atom. The list is queried by the DMS Get Capabilities method; ofono
takes care of caching the available technologies for us so we don't need
to worry about this method being called excessively.
The QMI radio-settings atom was just a skeleton and did not even implement
the mandtory property TechnologyPreference. As such, it probably should
never even have been registered for the modem. Nonetheless, this patch
puts this mandatory property into place.
This is implemented via the 'Set System Selection' method by way of the
'mode' parameter. This seems to best reflect the intention of the Ofono
API and works as expected when tested with a Quectel EC21.
Some notes:
i) There is an alternative function called 'Set Technology Preference'
which provides similar functionality. This 'technology preference'
is updated automatically when the 'system selection mode' is modified
so everything seems to be in order.
ii) For the EC21, switching the underlying technology works seamlessly.
There are indications, however, that some modems _might_ require a
reset before changes take effect; that bridge will need to be crossed
if reached.
Previously, these drivers would check /sys/devices/virtual/misc/tun to
see if TUN is supported, and bail out otherwise. However, the tun module
can sometimes be autoloaded by opening the /dev/net/tun file. In this
case the /dev file already exists, but the /sys file only gets created
after the modul is loaded.
Additionally, the ppp code does not use the /sys file, but only the
/dev file, so checking for the existence of the latter seems a better
indicator of expected success.
When registering to an operator ofono uses the old RAT.
In the case the modem is not connected to any network, this would use
QMI_NAS_NETWORK_RAT_NONE which results in the error OP_DEVICE_UNSUPPORTED.
Use QMI_NAS_NETWORK_RAT_NO_CHANGE instead to not define any preference.
If the ME storage is full, the modem will reject new messages
with a SMPP RP-Error 'Protocol error, unspecific'.
It seems the qmimodem is first checking the ME storage for
free space, then deliver the SMS via QMI and not saving it
to the ME anyway.
Using QMI_WMS_STORAGE_TYPE_NONE it doesn't check for free space.
Tested-on: Quectel EC20
When qmi_device_shutdown is used and the callback provided utilizes
qmi_device_unref, an access into already freed memory is triggered.
Sequence of events is:
1. timeout fires
2. glib calls timeout callback (e.g. shutdown_callback) which in turn
calls shutdown_func (gobi shutdown_cb) which in turn calls
qmi_device_unref()
3. qmi_device_unref calls g_source_remove, which doesn't call the
destroy callback (it is blocked)
4. qmi_device_unref then frees the memory used by device
5. glib then calls the source destroy callback (e.g. shutdown_destroy)
which results in just freed memory being used.
glib appears to always call the destroy callback, even if the source has
been removed previously. So to work around the issue, delay the actual
g_free until the destroy callback is invoked.
Apparently, an empty APN in an ofono context means that that the context
cannot be activated. connman definitely interprets it this way.
This patch sets a default name of "automatic" for the default bearer if
no other LTE APN is supplied (which is currently the case as the LTE
atom is not in place yet). Without this, connman happily ignores the
context, even though it has been activated by ofono.
When the modem attaches to an LTE network, a default bearer is
automatically negotiated using the "defalt profile" settings. The
QMI modem, however, does not given any explicit indication that
the bearer exists; instead, we must assume its existence based on
the network registration state.
This patch extends the GPRS atom to signal the presence of a
default bearer when it detects network connectivity on an LTE
network.
Apparently it's not legal to create a QMI service multiple times for
a device. I've been testing with a Quectel EC21 and here it works fine
to do so, but the general case would require "shared" services across
atoms.
This patch switches the users of the NAS and WDS services over to using
a "shared" service instead of each instatiating their own instance.
There are three principal ways for a context to become disconnected:
i) deactivate_primary() is called
ii) the network registration is lost and the context is cleaned up
via _detach_shutdown() (via release_all_contexts())
iii) the network decides to disconnect the context
We need to watch the packet status in order to detect case iii). For
case i) and ii), stop_net will be called, the pkt_handle will be
cleared, and subsequent packet status notifications be ignored.
This patch makes it so that the packet status "disconnected" event
is only propagated when the pkt_handle has not been cleared, indicating
an unrequested disconnection.
This should fix a race reported by Christophe Ronco whereby the packet
status disconnect notification is called between activate_primary
(start_net) and it's callback (start_net_cb).
SMS reception is not working for Gemalto modems because of +CMT parsing.
PDU length is the first argument of +CMT URCs in Gemalto modems.
Add a switch case on vendor info to handle Gemalto case.
Also handle acknowledgment, +CNMA takes only one parameter.
CMT parsing is moved from at_parse_cmt() to at_cmt_notify(). This
function is modified to match the style of at_cmgr_notify() and it
includes a switch case for CINTERION modems.
The detach_shutdown method is invoked to unconditionally release
an active context. For QMI, this is equivalent to a call to
deactivate_primary.
This patch makes the callback to deactivate_primary optional and
implements detach_shutdown to simply call it. When there is no
callback, the stop_net callback notifies ofono about the context
release via an asynchronous ofono_gprs_context_deactivated() call.
For LTE networks, a default bearer is automatically activated when
the modem registers to the network. QMI modems, however, do not
automatically enable the network interface just because the bearer
exists; a call to "start network" needs to be made in order to
get the packet handle before get_settings will return any data and
the network interface can be configured.
This patch makes read_settings call "start network" in order to
enable the interface for the default bearer. No new bearer will
be created with this call and the settings for the bearer will come
from the default profile, irregardless of what parameters are passed
to the "start network" method.
For LTE, a context is created automatically when the modem registers
to the network. The read_settings function is called for these
automatic contexts to get their configuration.
The GPRS context needs to be configured with connection parameters when
the bearer has been established. This was only partially implemented, so
this patch adds additional parameters to those passed to the context.
Calling the ps_state/cs_state alternatives *ATTACH_STATUS* was confusing
because there is also a status field in the *serving_system structure.
This patch does a minor rename and adds the appropriate definitions for
the status field.
qmi_device_shutdown allocated a new orphaned data structure and kicked
off a timeout to wait for the shutdown to complete. The logic was quite
racy, but the main issue was that the timeouts could not be canceled
when the underlying qmi_device object was destroyed. This resulted in
crashes.
This patch switches to first-past-the-gate mechanism. Since only the
modem driver should be issuing a qmi_device_shutdown call, this should
not be a limitation. The shutdown source is then tracked on the
qmi_device object itself and is canceled when the qmi_device object is
freed.
As an added bonus, the shutdown_destroy callback should now actually
function. Before it was simply never called.
struct discovery was allocated for every discovery procedure that was
kicked off, which itself allocated a structure. This patch uses a
class/subclass concept to only allocate a single structure per discovery
procedure.
This function was never removing discovery instances because it was looking
them up in the wrong list. This led to some strangeness with the discovery
callbacks being invoked after the "failure" timeout of 5 seconds and
consequent failures with everything getting out of sync.
With this patch we fix the lookup to use the correct queue. There's also
a double-free in the function that was never being hit before because the
lookups never succeeded; fix that as well.
With this, service discovery and creation work as expected when testing with
an EC21.
Telit AT modem firmware (tested with UE910-EUR) generates
+CGREG: 0\r\n\r\n+CGEV: NW DETACH
after a context is de-activated and ppp connection closed.
Then, after a random amount of time (observed from a few seconds
to a few hours), an unsolicited +CGREG: 1 arrives.
Attempt to fix the problem, by sending AT+CGATT=1 once.
This does not re-activate the context, but if a network connection
is still correct, will generate an immediate +CGREG: 1.
There are various device & service discovery tasks that are initiated
based on a qmi_device object. qmi_device object does not currently
keep track of these tasks. Unfortunately the qmi_device object can
go away at any time, and these tasks can become orphaned.
The result of this can lead to crashes. E.g. a discovery task timeout fires
after the qmi_device object has been destroyed. Since the object is no
longer valid, any accesses to it will likely result in a SEGFAULT.
This patch attempts to track all discovery tasks on the qmi_device
object itself, so that they can be cleaned up properly. This patch does
not handle the qmi_device_shutdown functionality.
Telit QMI modems can return non-utf-8 characters in plmn-desc.
Observed with LE910-SVG and Verizon. When that happens, libdbus
will abort ofono.
If non-utf-8 characters are detected, use mccmnc string.
LTE modems (observed with Telit LE910 V1) can power on
already registered to a network. In that case, the SS_INFO
change notification will never arrive, and the gprs driver
will never be marked as attached.
To avoid this situation, read SS_INFO at probe time, and if
registered, mark the gprs driver as attached.
This was introduced by the previous patch:
drivers/qmimodem/devinfo.c: In function ‘get_ids_cb’:
drivers/qmimodem/devinfo.c:129:14: error: implicit declaration of function ‘strcmp’ [-Werror=implicit-function-declaration]
if (!str || strcmp(str, "0") == 0) {
Command read_file_info on MC7304 always fails.
Using qmicli or AT command, I am able to read file info.
Qmicli command is:
qmicli -d /dev/cdc-wdm0 --uim-get-file-attributes=0x3f00,0x7fff,0x6fad
[(null)] Successfully got file '/dev/cdc-wdm0' attributes from the UIM:
Card result:
SW1: '0x90'
SW2: '0x00'
File attributes:
File size: 4
File ID: 28589
File type: transparent
Record size: 0
Record count: 0
Read security attributes: (always) (null)
Write security attributes: (single) adm
Increase security attributes: (always) (null)
Deactivate security attributes: (single) adm
Activate security attributes: (single) adm
Raw: 62:17:82:02:41:21:83:02:6F:AD:8A:01:05:8B:...
After a check of parameters sent by qmimodem driver and qmicli,
the only difference is on parameter "Session Information".
Session type sent by qmimodem driver is 'Card on slot 1'.
Session type sent by qmicli command is 'primary-gw-provisioning'.
Changing session type in qmimodem driver fixed problem (on this modem).
Comparing with what is done by qmili command
Some modems do not support AT+CGDATA="PPP",X to enter data state.
Use AT+CGDATA=? to detect these modems and for them use ATD*99***X#
to enter data state.
drivers/rilmodem/stk.c: In function ‘ril_stk_probe’:
drivers/rilmodem/stk.c:210:18: error: ‘data’ is used uninitialized in
this function [-Werror=uninitialized]
struct cb_data *cbd = cb_data_new(stk, NULL, data);
sending RIL_REQUEST_REPORT_STK_SERVICE_IS_RUNNING after
stk atom is created so that modem will inititialize
sim toolkit by sending terminal profile to sim.
During gprs-context driver probe function, check kernel device driver
data format and modem low level data format.
If they are different, align kernel device driver data format on
modem low level data format.
If an error occurs during this process, continue probing without error.
This is inspired by what is done in qmicli and qmi-network (package
libqmi).
Add a way to get and set data format expected by kernel device driver.
This is inspired by what is done in qmicli (package libqmi).
It does not use QMI protocol but a sysfs exported by kernel driver.
To use this feature, kernel version must be equal or more than 4.5.
Network Control Model is a new Communication Device Class
protocol for exchanging Ethernet frames over USB.
NCM is intended to be used with high-speed network
attachments such as HSDPA and LTE data services.
Add a new location-reporting driver for Gemalto Cinterion modems based
on telit implementation + use it in gemalto plugin. It supports
activation of GNSS engine (Request) with command AT^SGPSC. This driver
is tested on PHS8. NMEA frames are accessible on /dev/ttyUSB1.
Retry command QMI_UIM_GET_CARD_STATUS during query_passwd_state if a
temporary error status has been detected.
This happens with a MC7430 modem when query_passwd_state is called just
after PIN is entered.
CGDCONT result parsing fails if first list contains several ranges. For
example with modem Cinterion PHS8:
AT+CGDCONT=?
+CGDCONT: (1-17,101-116),"IP",,,(0),(0-4)
Solution: read first range and jump to second list instead of trying to
close the brackets.
Password state and number of retries asked to modem using
QMI_UIM_GET_CARD_STATUS command rather than remembered after initial
QMI_UIM_GET_CARD_STATUS command.
Add read_imsi feature to qmimodem sim driver.
This is based on DMS service.
On MC7430, this is mandatory to be able to use this driver for GPRS
connection because reading IMSI via EF reads fails.
QMI notification messages handlers are never called on MC7430 without this fix.
- Do not test transaction id before calling notification handler. On MC7430,
notification messages contain a not null transaction id (starts with 1,
increased at each message for a particular client).
- On MC7304 transaction id in notification messages is always 0.
Get current signal strength (type: 0x01), not list of other signals strength
(0x10)
Without this fix:
- I can't get a signal strength on MC7430 because list does not exist
(only one signal strength).
- On MC7304, result is wrong
- useless return at the end of a function
- mixed tabs & spaces for indentation
- over 80 characters for the comment
- line > 80 characters due to access technology conversion. Replaced
with a direct assignment.
drivers/ubloxmodem/netmon.c: In function ‘req_cb_data_unref’:
drivers/ubloxmodem/netmon.c:131:10: error: ‘return’ with a value, in
function returning void [-Werror]
return NULL;
This adds a netmon driver for ublox. The driver support both +COPS and
+CESQ commands to return the previously added ofono netmon types:
RSCP: Received Signal Code Power
ECN0: Received Energy Ratio
RSRQ: Reference Signal Received Quality
RSRP: Reference Signal Received Power
Current revision makes the driver use ref countig when chaining multiple
AT commands.
The U-Blox documentation specifies the following:
* get interface ip and dns from +CGDCONTRDP
* get gw ip and netmask from +UIPADDR
However, different firmware versions have different befaviour:
* On newer firmware, +UIPADDR returns error. But it's possible to configure
gateway ip == ipterface ip (read from CGDCONTRDP).
* On older firmware, we can actually use the commands specified in the
docs.
This patch runs +CGDCONTRDP, configures everything and then tries to run
+UIPADDR. In that works, reconfigures gw ip and netmask.
Adds U-Blox Toby L2 driver for setting the default APN via the
+UCGDFLT command. Currently only IPv4 is supported. APN is
not stored to modem's non-volatile memory. oFono will manage this
default APN via it's config storage.
When receiving an empty default APN, the value is reset.
strtol clamps returned value between INT_MIN and INT_MAX, causing
invalid value (255.255.255.127) being reported for any address
if last octet > 127 when sizeof(long) == 4.
split ril_pin_change_state_cb based on functionality w.r.t.
facility lock, puk and pin. Rename ril_pin_change_state to
more appropriate name ril_set_facility_lock and rename
ril_pin_change_state_cb to ril_enter_sim_pin_cb.
addrs variable seems to be used whenever multiple addresses are being
references. Either as a strv or a compound string separated by a
separator. In these cases addrs was used for a single address, which
was confusing.
Some phones with an active and waiting call at the time of HFP SLC
establishment, may send call waiting notification before all calls
are synchronized. This will lead to call Id mismatch because call
object is created with assumed Id 1 and not Id assigned by the phone.
In example below waiting call is created with Id 1 but in AT+CLCC
this phone returns active call as call with Id 1, and waiting as 2.
< \r\n+CCWA: "+1234567890",145\r\n
< \r\n+CIEV: 2,1\r\n
drivers/hfpmodem/voicecall.c:ccwa_notify() ccwa_notify: +1234567890 145 0
src/voicecall.c:ofono_voicecall_notify() Got a voicecall event, status: 5, id: 1, number: +1234567890 called_number: , called_name
src/voicecall.c:ofono_voicecall_notify() Did not find a call with id: 1
> AT+CIND?\r
< \r\n+CIND: 1,1,1,4,0,2,0\r\n\r\nOK\r\n
src/network.c:ofono_netreg_status_notify() /hfp/org/bluez/hci0/dev_60_AF_6D_F7_8E_37 status 1 tech -1
> AT+VGS=7\r
< \r\nOK\r\n
> AT+VGM=7\r
< \r\nOK\r\n
> AT+CLCC\r
< \r\n+CLCC: 1,1,0,0,0,"+9876543210",145\r\n
< \r\n+CLCC: 2,1,5,0,0,"+1234567890",145\r\n\r\nOK\r\n
src/voicecall.c:ofono_voicecall_notify() Got a voicecall event, status: 0, id: 1, number: +9876543210 called_number: , called_name
src/voicecall.c:ofono_voicecall_notify() Found call with id: 1
src/voicecall.c:ofono_voicecall_notify() Got a voicecall event, status: 5, id: 2, number: +1234567890 called_number: , called_name
src/voicecall.c:ofono_voicecall_notify() Did not find a call with id: 2
src/voicecall.c:ofono_voicecall_mpty_hint() ids: 0
For now the driver works only with bridged mode for 2G/3G.
Once it activates the context it reads the ip, netmask,
gw, dns and sets them in the context settings.
Besides exceptions below, act like normal U-Blox devices.
gprs-context: don't set auth for TOBY L2. U-Blox Toby L2
doesn't support PAP/CHAP APN auth method.
atmodem: TOBY L2 supports only CMER mode 1. Also chaged original
mode variable to ind, which is a more appropriate name.
mode is what is being set first.
An issue with iPhone 5C iOS 9.2 triggers desynchronization in call
states. When an active call is put on hold and another call arrives,
it is in WAITING state. It should be possible to answer it by issuing
AT+CHLD=2 but the phone changes its state to INCOMING so ATA should be
used. This change is advertised by sending callheld:2 event, but it is
not handled. This event can be used to trigger CLCC poll to synchronize
call states.
+CIEV: 3,1 <- first call arrives
AT+CLCC
+CLCC: 1,1,4,0,0,"01234567890",129
OK
RING
+CLIP: "01234567890",129
ATA
OK
+CIEV: 2,1
+CIEV: 3,0.
AT+CHLD=2.$ <- first call is put on hold
OK
+CIEV: 7,2 <- notification confirming that call #1 is on hold
+CCWA: "09876543210",129,1 <- second call arrives
+CIEV: 7,2
+CIEV: 3,1
AT+CLCC
+CLCC: 1,1,1,0,0,"01234567890",129
+CLCC: 2,1,5,0,0,"09876543210",129 <- new call is still in WAITING state
OK
+CIEV: 7,2 <- phone iternally promotes WAITING call to INCOMING
AT+CHLD=2 <- there is no WAITING call anymore, ATA should be used
+CME ERROR:3
The return value from a RIL_REQUEST_GET_FACILITY_LOCK
is the TS 27.007 service class bit vector of services
for the specified barring facility. The value canf be
zero, which indicates "disabled for all".
During the re-factoring of rilmodem's sim atom
messaging code, the sim_status_cb function's
RIL tracing code was converted to DBG calls.
This change adds the same prefix to DBG/trace
calls when a single message's parameters span
more than one DBG call. This makes it easier
to filter out trace messages when looking at a
log file.
Denis Kenzior
James Prestwood
Gabriel Lucas
Philippe De Swert
Christophe Ronco
Slava Monich
Jonas Bonn
Ankit Navik
Joey Hewitt
Alexander Couzens
Nishanth V
Clayton Craft
Matthijs Kooijman
Marcel Holtmann
Vincent Cesson
Lukasz Nowak
Antara Borwankar
Piotr Haber
Marko Šulejić
Djalal Harouni
Dragos Tatulea
Santtu Lakkala
Samrat Guha Niyogi
Caiwen Zhang
Suman Mallela
John Ernberg
Kuba Pawlak
Kuba Pawlak
Anirudh Gargi
Tony Espy