The AT command reference for Quectel M95 specifies that remaining SIM
pin retires can be queried using AT+QTRPIN, which responds with one
count for each pin-type:
+QTRPIN: 3,3,10,10
After entering the PIN code, enable an extra AT+CPIN? for the M95
vendor.
When ofono dies while connected using PPP, modem AT channel is not put
back to command mode (tested with HUAWEI modems E3372 and MS2372).
If ofono is restarted, it won't be able to connect as it gets no answer
to AT commands on this AT channel.
This patch adds a quirk to immediately send escape sequence on modem
channel when gprs-context atom is removed.
It seems that the function at_pin_send_puk should have been changed
along with at_pin_send, because it's also refering to the
at_pin_send_cb callback
See this commit : ba9f126716
On the SIMCom SIM7100E, setting AT+COLP=1 causes there to be no
response at all from "ATD...;" commands until the call is answered.
The results in oFono stalling rather than creating a new VoiceCall
object.
We fix this by adding SIMCOM to the list of vendors for whom we set
AT+COLP=0 rather than AT+COLP=1.
QMI_UIM_GET_CARD_STATUS is retried in more error cases
when trying to get password type.
In case of failure, driver report an error instead of
OFONO_SIM_PASSWORD_INVALID. This avoids a crash.
Use right slot and application to get card status, PIN status and PIN
retries. Without this patch, SIMs where selected application and slot
numbers are different are not detected.
The way things are currently coded, the gobi plugin calls
qmi_device_discover and does nothing else until it succeeds. As such,
we can safely assume that the version_list is set up when we go to
create a service.
The only thing this output parameter is being used for now is for
getting the transaction ID. Return the TID directly from
__submit_requesta and drop the 'head' parameter altogether.
The only way request_alloc can fail is if one of the memory allocation
routines fail to allocate memory. However, Linux memory allocation
doesn't really fail in this manner; memory can be overcommited and the
out-of-memory reaper will take care of re-establishing the balance when
excess memory is actually accessed.
Given this, request_alloc will never return anything other than success
and the failure paths will never be exercised.
The service and control requests differ slightly in their headers, but
this difference is minor enough that we can handle it directly in the
request submission routine. This patch unifies the header setup for the
two request types.
After setting up the request structure, qmi_service_send makes no
further use of the 'param' and 'service' fields of the service_send_data
structure. This patch removes those fields and frees 'param'
immediately after the request has been allocated and the parameter data
thereby copied into the send buffer.
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4C2ED31: __memcmp_sse4_1 (vg_replace_strmem.c:972)
==2870== by 0x4F451A: sim_pin_retries_query_cb (sim.c:462)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==2870==
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4F451D: sim_pin_retries_query_cb (sim.c:462)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==2870==
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4F3DFB: get_pin_retries (sim.c:278)
==2870== by 0x4F4553: sim_pin_retries_query_cb (sim.c:467)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==2870==
==2870== Conditional jump or move depends on uninitialised value(s)
==2870== at 0x4F3E65: get_pin_retries (sim.c:288)
==2870== by 0x4F4553: sim_pin_retries_query_cb (sim.c:467)
==2870== by 0x459BDD: query_pin_retries_cb (sim.c:544)
==2870== by 0x45544A: service_send_callback (qmi.c:2143)
==2870== by 0x452D00: handle_packet (qmi.c:815)
==2870== by 0x452E85: received_data (qmi.c:863)
==2870== by 0x508DB6C: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508DF47: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x508E271: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4200.1)
==2870== by 0x4C680B: main (main.c:256)
==2870== Uninitialised value was created by a stack allocation
==2870== at 0x459B1A: query_pin_retries_cb (sim.c:531)
==14399== 28 bytes in 4 blocks are definitely lost in loss record 151 of 390
==14399== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==14399== by 0x209065: convert_gsm_to_utf8_with_lang (util.c:651)
==14399== by 0x2091D1: convert_gsm_to_utf8 (util.c:690)
==14399== by 0x22DDA7: ussd_decode (smsutil.c:4738)
==14399== by 0x18BF71: qmi_ussd_request (ussd.c:233)
==14399== by 0x2183EA: ussd_initiate (ussd.c:614)
==14399== by 0x27B6C8: process_message (object.c:259)
==14399== by 0x27D1CD: generic_message (object.c:1070)
==14399== by 0x5170732: ??? (in /lib/x86_64-linux-gnu/libdbus-1.so.3.14.14)
==14399== by 0x5161D83: dbus_connection_dispatch (in /lib/x86_64-linux-gnu/libdbus-1.so.3.14.14)
==14399== by 0x27907C: message_dispatch (mainloop.c:72)
==14399== by 0x4E826A9: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== 16 bytes in 8 blocks are definitely lost in loss record 132 of 390
==14399== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==14399== by 0x59E03D9: strndup (strndup.c:43)
==14399== by 0x18277E: qmi_result_get_string (qmi.c:1794)
==14399== by 0x184221: get_ids_cb (devinfo.c:129)
==14399== by 0x18353B: service_send_callback (qmi.c:2286)
==14399== by 0x18093C: handle_packet (qmi.c:831)
==14399== by 0x180ADD: received_data (qmi.c:880)
==14399== by 0x4E826A9: g_main_context_dispatch (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== by 0x4E82A5F: ??? (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== by 0x4E82D81: g_main_loop_run (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.5000.3)
==14399== by 0x201900: main (main.c:306)
When an LTE modem registers with the network, a default bearer is
automatically established. The APN used for this bearer is taken from
whatever default settings the modem has.
The LTE atom takes cares of setting up the default context/profile with
the APN to use. From there, a default bearer will be established when
the modem registers with the network. This results in a call to 'Get
LTE Attach Parameters' which tells us what APN the gateway negotiated
with us.
If we can't get the APN, we do what the AT driver does: pretend the
bearer wasn't established. This is a reasonable fallback, currently,
because connman can't handle zero-length APN's anyway; the previous
approach of setting the APN to 'automatic' breaks connman badly when it
needs to switch between LTE and non-LTE networks.
This patch adds an LTE atom for QMI modems.
This atom sets the APN that the LTE default bearer should use when
establishing its PDP context. This APN needs to be set on the 'default'
profile so the atom queries which profile is the default and resets
it before allowing the APN to be set.
Once configured, the default profile settings are used when the
modem connects to the network; for this reason, the LTE atom needs
to be instantiated in post_sim, before the modem is set online.
Certain modems doesn't support manual registering (gobi 2000).
Translate the error code into ofono error to report a
more detailed debug error message.
The IP Configuration data structure does not match any of the existing
data structure serialization conventions in the rest of the MBIM
specification. So add IPv4 / v6 specific extractors for IPV4 address
and IPV4 Element structures.
Instead of delaying the cpin entry callback until the sim is found to be
'ready', call back into the core right away. The core will wait until
the initialized notification is called from the driver before proceeding
with the rest of the initialization procedure.
The sim state query is now being done in the background and potential
leaking of cbd is now fixed.
SMS_SEND uses an embedded databuffer inside MBIM_SET_SMS_SEND which
wants to use a local offset (local to the databuffer structure) as
opposed to the offset from the start of the static buffer.
For zero element arrays we might inadvertently run past the end of the
iov buffer. Fix this by adding additional checks that n_elem > 0 and
don't call _iter_get_data unless needed.
In SimManager, the Retries property isn't used for gemalto modems.
The at command AT^SPIC is used to get the remaining retries left
for the current required password type.
This commit adds the implementation in the SIM driver of the retries
queries.
When modem does not answer or answers slowly to a discovery request,
a timeout occurs.
In timeout callback, request should be removed from queues to avoid
treating answer if it arrives later.
The Quectel EC21 does not provide the SMS PDU on the message event
notification.
This patch adds a call to 'raw read' on the message ID from the event
notification if the event notification does not already contain the
message data.
The message data begins with the SMSC length, type, and address so
the TPDU length is adjusted accordingly in the raw_read callback. This
differs from the way the raw message data is handled in the case
that it is included in the event notification itself. As I don't have
access to any other QMI modem at this time, I'm can not confirm that
this difference is reasonable.
Implemented the core API's needed for sim-auth:
list_apps: already implemented
open_channel: Opens a logical channel with +CCHO
close_channel: Closes logical channel with +CCHC
logical_access: Access an opened channel with +CGLA
==2941== Invalid read of size 4
==2941== at 0x69338: sim_state_cb (sim.c:1301)
==2941== by 0x71DCB: cpin_check_cb (atutil.c:567)
==2941== by 0xA602B: at_chat_finish_command (gatchat.c:459)
==2941== by 0xA6277: at_chat_handle_command_response (gatchat.c:521)
==2941== by 0xA6587: have_line (gatchat.c:600)
==2941== by 0xA6BB7: new_bytes (gatchat.c:759)
==2941== by 0xAAFAF: received_data (gatio.c:124)
==2941== by 0x4AF606F: g_main_dispatch (gmain.c:3154)
==2941== by 0x4AF606F: g_main_context_dispatch (gmain.c:3769)
==2941== by 0x4AF658F: g_main_loop_run (gmain.c:4034)
==2941== by 0xBDDBB: main (main.c:261)
==2941== Address 0x519c344 is 4 bytes inside a block of size 12 free'd
==2941== at 0x4840B28: free (vg_replace_malloc.c:530)
==2941== by 0x71F33: at_util_sim_state_query_free (atutil.c:613)
==2941== by 0x6930B: sim_state_cb (sim.c:1297)
==2941== by 0x71DCB: cpin_check_cb (atutil.c:567)
==2941== by 0xA602B: at_chat_finish_command (gatchat.c:459)
==2941== by 0xA6277: at_chat_handle_command_response (gatchat.c:521)
==2941== by 0xA6587: have_line (gatchat.c:600)
==2941== by 0xA6BB7: new_bytes (gatchat.c:759)
==2941== by 0xAAFAF: received_data (gatio.c:124)
==2941== by 0x4AF606F: g_main_dispatch (gmain.c:3154)
==2941== by 0x4AF606F: g_main_context_dispatch (gmain.c:3769)
==2941== by 0x4AF658F: g_main_loop_run (gmain.c:4034)
==2941== by 0xBDDBB: main (main.c:261)
Huawei LTE modems use AT^SYSCFGEX and AT^SYSINFOEX instead of
AT^SYSCFG and AT^SYSINFO.
If we want to be able to attach on LTE with this modem, we must use
AT^SYSCFGEX to configure rat mode and band. Using AT^SYSCFG, mode any
means UMTS or GSM.
Add support for automatic context activation by adding read_settings.
It also adds detach_shutdown to make sure context is cleaned up when
network registration is lost.
This is a rudimentary implementation that contains technology and RSSI
and BitErrorRate, plus RSRQ/RSRP for LTE networks. More data can be
added as needed.
This implementations uses the 'Get Signal Strength' QMI method to retrieve
the data. Operator fields (MNC, LAC, etc) can be gotten from the 'Serving
Cell' method if needed, but since this data is already provided in the
NetworkRegistration object it doesn't seem necessary to repeat it here
when an additional communication to the modem is required.
When registering callbacks before ofono_netreg_register(), callbacks
will use the netreg api which might lead into undefined behaviour,
because certain fields aren't yet initilized.
This provides the list of available technologies in the radio-settings
atom. The list is queried by the DMS Get Capabilities method; ofono
takes care of caching the available technologies for us so we don't need
to worry about this method being called excessively.
The QMI radio-settings atom was just a skeleton and did not even implement
the mandtory property TechnologyPreference. As such, it probably should
never even have been registered for the modem. Nonetheless, this patch
puts this mandatory property into place.
This is implemented via the 'Set System Selection' method by way of the
'mode' parameter. This seems to best reflect the intention of the Ofono
API and works as expected when tested with a Quectel EC21.
Some notes:
i) There is an alternative function called 'Set Technology Preference'
which provides similar functionality. This 'technology preference'
is updated automatically when the 'system selection mode' is modified
so everything seems to be in order.
ii) For the EC21, switching the underlying technology works seamlessly.
There are indications, however, that some modems _might_ require a
reset before changes take effect; that bridge will need to be crossed
if reached.
Previously, these drivers would check /sys/devices/virtual/misc/tun to
see if TUN is supported, and bail out otherwise. However, the tun module
can sometimes be autoloaded by opening the /dev/net/tun file. In this
case the /dev file already exists, but the /sys file only gets created
after the modul is loaded.
Additionally, the ppp code does not use the /sys file, but only the
/dev file, so checking for the existence of the latter seems a better
indicator of expected success.
When registering to an operator ofono uses the old RAT.
In the case the modem is not connected to any network, this would use
QMI_NAS_NETWORK_RAT_NONE which results in the error OP_DEVICE_UNSUPPORTED.
Use QMI_NAS_NETWORK_RAT_NO_CHANGE instead to not define any preference.
If the ME storage is full, the modem will reject new messages
with a SMPP RP-Error 'Protocol error, unspecific'.
It seems the qmimodem is first checking the ME storage for
free space, then deliver the SMS via QMI and not saving it
to the ME anyway.
Using QMI_WMS_STORAGE_TYPE_NONE it doesn't check for free space.
Tested-on: Quectel EC20
Martin Hundebøll
Christophe Ronco
Marcel Holtmann
Antara Borwankar
Florent Beillonnet
Bob Ham
Jonas Bonn
Denis Kenzior
Mariem Cherif
Philippe De Swert
Alexander Couzens
James Prestwood
Gabriel Lucas
Philippe De Swert
Slava Monich
Ankit Navik
Joey Hewitt
Nishanth V
Clayton Craft
Matthijs Kooijman