The driver vtables are read-only structures. This patch declares them as
'const' allowing the compiler to (optionally) put them in the RELRO
section. RELRO pages may be marked as read-only by the linker after
the relocations have been done ensuring that they aren't inadvertently
or maliciously altered at runtime.
Added the explicit support for auth NONE.
It needs to be added in all drivers/*/gprs-context.c atoms.
This method is already supported by all atoms that support
authentication (ie, all but Sierra' swmodem driver).
The behavior is left unchanged in case of inconsistent parameters:
if username is empty, then fallback to auth NONE.
QMI_UIM_GET_CARD_STATUS is retried in more error cases
when trying to get password type.
In case of failure, driver report an error instead of
OFONO_SIM_PASSWORD_INVALID. This avoids a crash.
Use right slot and application to get card status, PIN status and PIN
retries. Without this patch, SIMs where selected application and slot
numbers are different are not detected.
The way things are currently coded, the gobi plugin calls
qmi_device_discover and does nothing else until it succeeds. As such,
we can safely assume that the version_list is set up when we go to
create a service.
The only thing this output parameter is being used for now is for
getting the transaction ID. Return the TID directly from
__submit_requesta and drop the 'head' parameter altogether.
The only way request_alloc can fail is if one of the memory allocation
routines fail to allocate memory. However, Linux memory allocation
doesn't really fail in this manner; memory can be overcommited and the
out-of-memory reaper will take care of re-establishing the balance when
excess memory is actually accessed.
Given this, request_alloc will never return anything other than success
and the failure paths will never be exercised.
The service and control requests differ slightly in their headers, but
this difference is minor enough that we can handle it directly in the
request submission routine. This patch unifies the header setup for the
two request types.
After setting up the request structure, qmi_service_send makes no
further use of the 'param' and 'service' fields of the service_send_data
structure. This patch removes those fields and frees 'param'
immediately after the request has been allocated and the parameter data
thereby copied into the send buffer.
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4C2ED31: __memcmp_sse4_1 (vg_replace_strmem.c:972)
==2870== by 0x4F451A: sim_pin_retries_query_cb (sim.c:462)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==2870==
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4F451D: sim_pin_retries_query_cb (sim.c:462)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==2870==
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4F3DFB: get_pin_retries (sim.c:278)
==2870== by 0x4F4553: sim_pin_retries_query_cb (sim.c:467)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==2870==
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4F3E65: get_pin_retries (sim.c:288)
==2870== by 0x4F4553: sim_pin_retries_query_cb (sim.c:467)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==14399== 28 bytes in 4 blocks are definitely lost in loss record 151 of 390
==14399== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==14399== by 0x209065: convert_gsm_to_utf8_with_lang (util.c:651)
==14399== by 0x2091D1: convert_gsm_to_utf8 (util.c:690)
==14399== by 0x22DDA7: ussd_decode (smsutil.c:4738)
==14399== by 0x18BF71: qmi_ussd_request (ussd.c:233)
==14399== by 0x2183EA: ussd_initiate (ussd.c:614)
==14399== by 0x27B6C8: process_message (object.c:259)
==14399== by 0x27D1CD: generic_message (object.c:1070)
==14399== by 0x5170732: ??? (in /lib/x86_64-linux-gnu/libdbus-1.so.3.14.14)
==14399== by 0x5161D83: dbus_connection_dispatch (in /lib/x86_64-linux-gnu/libdbus-1.so.3.14.14)
==14399== by 0x27907C: message_dispatch (mainloop.c:72)
==14399== by 0x4E826A9: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== 16 bytes in 8 blocks are definitely lost in loss record 132 of 390
==14399== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==14399== by 0x59E03D9: strndup (strndup.c:43)
==14399== by 0x18277E: qmi_result_get_string (qmi.c:1794)
==14399== by 0x184221: get_ids_cb (devinfo.c:129)
==14399== by 0x18353B: service_send_callback (qmi.c:2286)
==14399== by 0x18093C: handle_packet (qmi.c:831)
==14399== by 0x180ADD: received_data (qmi.c:880)
==14399== by 0x4E826A9: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== by 0x4E82A5F: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== by 0x4E82D81: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== by 0x201900: main (main.c:306)
When an LTE modem registers with the network, a default bearer is
automatically established. The APN used for this bearer is taken from
whatever default settings the modem has.
The LTE atom takes cares of setting up the default context/profile with
the APN to use. From there, a default bearer will be established when
the modem registers with the network. This results in a call to 'Get
LTE Attach Parameters' which tells us what APN the gateway negotiated
with us.
If we can't get the APN, we do what the AT driver does: pretend the
bearer wasn't established. This is a reasonable fallback, currently,
because connman can't handle zero-length APN's anyway; the previous
approach of setting the APN to 'automatic' breaks connman badly when it
needs to switch between LTE and non-LTE networks.
This patch adds an LTE atom for QMI modems.
This atom sets the APN that the LTE default bearer should use when
establishing its PDP context. This APN needs to be set on the 'default'
profile so the atom queries which profile is the default and resets
it before allowing the APN to be set.
Once configured, the default profile settings are used when the
modem connects to the network; for this reason, the LTE atom needs
to be instantiated in post_sim, before the modem is set online.
Certain modems doesn't support manual registering (gobi 2000).
Translate the error code into ofono error to report a
more detailed debug error message.
When modem does not answer or answers slowly to a discovery request,
a timeout occurs.
In timeout callback, request should be removed from queues to avoid
treating answer if it arrives later.
The Quectel EC21 does not provide the SMS PDU on the message event
notification.
This patch adds a call to 'raw read' on the message ID from the event
notification if the event notification does not already contain the
message data.
The message data begins with the SMSC length, type, and address so
the TPDU length is adjusted accordingly in the raw_read callback. This
differs from the way the raw message data is handled in the case
that it is included in the event notification itself. As I don't have
access to any other QMI modem at this time, I'm can not confirm that
this difference is reasonable.
This is a rudimentary implementation that contains technology and RSSI
and BitErrorRate, plus RSRQ/RSRP for LTE networks. More data can be
added as needed.
This implementations uses the 'Get Signal Strength' QMI method to retrieve
the data. Operator fields (MNC, LAC, etc) can be gotten from the 'Serving
Cell' method if needed, but since this data is already provided in the
NetworkRegistration object it doesn't seem necessary to repeat it here
when an additional communication to the modem is required.
When registering callbacks before ofono_netreg_register(), callbacks
will use the netreg api which might lead into undefined behaviour,
because certain fields aren't yet initilized.
This provides the list of available technologies in the radio-settings
atom. The list is queried by the DMS Get Capabilities method; ofono
takes care of caching the available technologies for us so we don't need
to worry about this method being called excessively.
The QMI radio-settings atom was just a skeleton and did not even implement
the mandtory property TechnologyPreference. As such, it probably should
never even have been registered for the modem. Nonetheless, this patch
puts this mandatory property into place.
This is implemented via the 'Set System Selection' method by way of the
'mode' parameter. This seems to best reflect the intention of the Ofono
API and works as expected when tested with a Quectel EC21.
Some notes:
i) There is an alternative function called 'Set Technology Preference'
which provides similar functionality. This 'technology preference'
is updated automatically when the 'system selection mode' is modified
so everything seems to be in order.
ii) For the EC21, switching the underlying technology works seamlessly.
There are indications, however, that some modems _might_ require a
reset before changes take effect; that bridge will need to be crossed
if reached.
When registering to an operator ofono uses the old RAT.
In the case the modem is not connected to any network, this would use
QMI_NAS_NETWORK_RAT_NONE which results in the error OP_DEVICE_UNSUPPORTED.
Use QMI_NAS_NETWORK_RAT_NO_CHANGE instead to not define any preference.
If the ME storage is full, the modem will reject new messages
with a SMPP RP-Error 'Protocol error, unspecific'.
It seems the qmimodem is first checking the ME storage for
free space, then deliver the SMS via QMI and not saving it
to the ME anyway.
Using QMI_WMS_STORAGE_TYPE_NONE it doesn't check for free space.
Tested-on: Quectel EC20
When qmi_device_shutdown is used and the callback provided utilizes
qmi_device_unref, an access into already freed memory is triggered.
Sequence of events is:
1. timeout fires
2. glib calls timeout callback (e.g. shutdown_callback) which in turn
calls shutdown_func (gobi shutdown_cb) which in turn calls
qmi_device_unref()
3. qmi_device_unref calls g_source_remove, which doesn't call the
destroy callback (it is blocked)
4. qmi_device_unref then frees the memory used by device
5. glib then calls the source destroy callback (e.g. shutdown_destroy)
which results in just freed memory being used.
glib appears to always call the destroy callback, even if the source has
been removed previously. So to work around the issue, delay the actual
g_free until the destroy callback is invoked.
Apparently, an empty APN in an ofono context means that that the context
cannot be activated. connman definitely interprets it this way.
This patch sets a default name of "automatic" for the default bearer if
no other LTE APN is supplied (which is currently the case as the LTE
atom is not in place yet). Without this, connman happily ignores the
context, even though it has been activated by ofono.
When the modem attaches to an LTE network, a default bearer is
automatically negotiated using the "defalt profile" settings. The
QMI modem, however, does not given any explicit indication that
the bearer exists; instead, we must assume its existence based on
the network registration state.
This patch extends the GPRS atom to signal the presence of a
default bearer when it detects network connectivity on an LTE
network.
Apparently it's not legal to create a QMI service multiple times for
a device. I've been testing with a Quectel EC21 and here it works fine
to do so, but the general case would require "shared" services across
atoms.
This patch switches the users of the NAS and WDS services over to using
a "shared" service instead of each instatiating their own instance.
Jonas Bonn
Giacinto Cifelli
Christophe Ronco
Jonas Bonn
Denis Kenzior
Alexander Couzens
Joey Hewitt