1/* $NetBSD: u3g.c,v 1.32 2016/04/23 10:15:32 skrll Exp $ */
2
3/*-
4 * Copyright (c) 2009 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
29 */
30
31/*
32 * Copyright (c) 2008 AnyWi Technologies
33 * Author: Andrea Guzzo <aguzzo@anywi.com>
34 * * based on uark.c 1.1 2006/08/14 08:30:22 jsg *
35 * * parts from ubsa.c 183348 2008-09-25 12:00:56Z phk *
36 *
37 * Permission to use, copy, modify, and distribute this software for any
38 * purpose with or without fee is hereby granted, provided that the above
39 * copyright notice and this permission notice appear in all copies.
40 *
41 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
42 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
43 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
44 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
45 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
46 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
47 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
48 *
49 * $FreeBSD$
50 */
51
52#include <sys/cdefs.h>
53__KERNEL_RCSID(0, "$NetBSD: u3g.c,v 1.32 2016/04/23 10:15:32 skrll Exp $");
54
55#include <sys/param.h>
56#include <sys/systm.h>
57#include <sys/kernel.h>
58#include <sys/kmem.h>
59#include <sys/bus.h>
60#include <sys/conf.h>
61#include <sys/tty.h>
62
63#include <dev/usb/usb.h>
64#include <dev/usb/usbdi.h>
65#include <dev/usb/usbdivar.h>
66#include <dev/usb/usbdi_util.h>
67
68#include <dev/usb/ucomvar.h>
69
70#include "usbdevs.h"
71
72/*
73 * We read/write data from/to the device in 4KB chunks to maximise
74 * performance.
75 */
76#define U3G_BUFF_SIZE 4096
77
78/*
79 * Some 3G devices (the Huawei E160/E220 springs to mind here) buffer up
80 * data internally even when the USB pipes are closed. So on first open,
81 * we can receive a large chunk of stale data.
82 *
83 * This causes a real problem because the default TTYDEF_LFLAG (applied
84 * on first open) has the ECHO flag set, resulting in all the stale data
85 * being echoed straight back to the device by the tty(4) layer. Some
86 * devices (again, the Huawei E160/E220 for example) react to this spew
87 * by going catatonic.
88 *
89 * All this happens before the application gets a chance to disable ECHO.
90 *
91 * We work around this by ignoring all data received from the device for
92 * a period of two seconds, or until the application starts sending data -
93 * whichever comes first.
94 */
95#define U3G_PURGE_SECS 2
96
97/*
98 * Define bits for the virtual modem control pins.
99 * The input pin states are reported via the interrupt pipe on some devices.
100 */
101#define U3G_OUTPIN_DTR (1u << 0)
102#define U3G_OUTPIN_RTS (1u << 1)
103#define U3G_INPIN_DCD (1u << 0)
104#define U3G_INPIN_DSR (1u << 1)
105#define U3G_INPIN_RI (1u << 3)
106
107/*
108 * USB request to set the output pin status
109 */
110#define U3G_SET_PIN 0x22
111
112struct u3g_softc {
113 device_t sc_dev;
114 struct usbd_device * sc_udev;
115 bool sc_dying; /* We're going away */
116 int sc_ifaceno; /* Device interface number */
117
118 struct u3g_com {
119 device_t c_dev; /* Child ucom(4) handle */
120
121 bool c_open; /* Device is in use */
122 bool c_purging; /* Purging stale data */
123 struct timeval c_purge_start; /* Control duration of purge */
124
125 u_char c_msr; /* Emulated 'msr' */
126 uint16_t c_outpins; /* Output pin state */
127 } sc_com[10];
128 size_t sc_ncom;
129
130 struct usbd_pipe * sc_intr_pipe; /* Interrupt pipe */
131 u_char *sc_intr_buff; /* Interrupt buffer */
132 size_t sc_intr_size; /* buffer size */
133};
134
135/*
136 * The device driver has two personalities. The first uses the 'usbdevif'
137 * interface attribute so that a match will claim the entire USB device
138 * for itself. This is used for when a device needs to be mode-switched
139 * and ensures any other interfaces present cannot be claimed by other
140 * drivers while the mode-switch is in progress.
141 *
142 * The second personality uses the 'usbifif' interface attribute so that
143 * it can claim the 3G modem interfaces for itself, leaving others (such
144 * as the mass storage interfaces on some devices) for other drivers.
145 */
146static int u3ginit_match(device_t, cfdata_t, void *);
147static void u3ginit_attach(device_t, device_t, void *);
148static int u3ginit_detach(device_t, int);
149
150CFATTACH_DECL2_NEW(u3ginit, 0, u3ginit_match,
151 u3ginit_attach, u3ginit_detach, NULL, NULL, NULL);
152
153
154static int u3g_match(device_t, cfdata_t, void *);
155static void u3g_attach(device_t, device_t, void *);
156static int u3g_detach(device_t, int);
157static int u3g_activate(device_t, enum devact);
158static void u3g_childdet(device_t, device_t);
159
160CFATTACH_DECL2_NEW(u3g, sizeof(struct u3g_softc), u3g_match,
161 u3g_attach, u3g_detach, u3g_activate, NULL, u3g_childdet);
162
163
164static void u3g_intr(struct usbd_xfer *, void *, usbd_status);
165static void u3g_get_status(void *, int, u_char *, u_char *);
166static void u3g_set(void *, int, int, int);
167static int u3g_open(void *, int);
168static void u3g_close(void *, int);
169static void u3g_read(void *, int, u_char **, uint32_t *);
170static void u3g_write(void *, int, u_char *, u_char *, uint32_t *);
171
172struct ucom_methods u3g_methods = {
173 .ucom_get_status = u3g_get_status,
174 .ucom_set = u3g_set,
175 .ucom_param = NULL,
176 .ucom_ioctl = NULL,
177 .ucom_open = u3g_open,
178 .ucom_close = u3g_close,
179 .ucom_read = u3g_read,
180 .ucom_write = u3g_write,
181};
182
183/*
184 * Allegedly supported devices
185 */
186static const struct usb_devno u3g_devs[] = {
187 { USB_VENDOR_DELL, USB_PRODUCT_DELL_W5500 },
188 /* OEM: Huawei */
189 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E1750 },
190 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E1820 },
191 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E220 },
192 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_EM770W },
193 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_K3765 },
194 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_MOBILE },
195 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E171 },
196 { USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E353 },
197 /* OEM: Merlin */
198 { USB_VENDOR_MERLIN, USB_PRODUCT_MERLIN_V620 },
199 /* OEM: Novatel */
200 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_ES620 },
201 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_EU8X0D },
202 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_MC950D },
203#if 0
204 /* These are matched in u3ginit_match() */
205 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_MC950D_DRIVER },
206 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_U760_DRIVER },
207#endif
208 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_MERLINU740 },
209 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_MERLINV620 },
210 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_S720 },
211 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_U720 },
212 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_U727 },
213 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_U740_2 },
214 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_U760 },
215 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_U870 },
216 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_V740 },
217 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_X950D },
218 { USB_VENDOR_NOVATEL2, USB_PRODUCT_NOVATEL2_XU870 },
219 /* OEM: Option N.V. */
220 { USB_VENDOR_OPTIONNV, USB_PRODUCT_OPTIONNV_QUADPLUSUMTS },
221 { USB_VENDOR_OPTIONNV, USB_PRODUCT_OPTIONNV_HSDPA },
222 { USB_VENDOR_OPTIONNV, USB_PRODUCT_OPTIONNV_GTMAXHSUPA },
223 /* OEM: Qualcomm, Inc. */
224 { USB_VENDOR_QUALCOMM, USB_PRODUCT_QUALCOMM_NTT_DOCOMO_L02C_MODEM },
225
226 /* OEM: Sierra Wireless: */
227 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC595U },
228 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC597E },
229 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC875U },
230 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC880 },
231 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC880E },
232 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC880U },
233 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC881 },
234 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC881E },
235 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AC881U },
236 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AIRCARD580 },
237 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AIRCARD595 },
238 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_AIRCARD875 },
239 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_C597 },
240 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_EM5625 },
241 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC5720 },
242 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC5720_2 },
243 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC5725 },
244 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC8755 },
245 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC8755_2 },
246 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC8755_3 },
247 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC8765 },
248 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC8775_2 },
249 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC8780 },
250 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MC8781 },
251 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_MINI5725 },
252 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_USB305 },
253 { USB_VENDOR_SIERRA, USB_PRODUCT_SIERRA_250U },
254 /* Toshiba */
255 { USB_VENDOR_TOSHIBA, USB_PRODUCT_TOSHIBA_HSDPA_MODEM_EU870DT1 },
256
257 /* ZTE */
258 { USB_VENDOR_ZTE, USB_PRODUCT_ZTE_MF622 },
259 { USB_VENDOR_ZTE, USB_PRODUCT_ZTE_MF626 },
260 { USB_VENDOR_ZTE, USB_PRODUCT_ZTE_MF628 },
261 { USB_VENDOR_ZTE, USB_PRODUCT_ZTE_MF820D },
262
263 /* 4G Systems */
264 { USB_VENDOR_4GSYSTEMS, USB_PRODUCT_4GSYSTEMS_XSSTICK_P14 },
265 { USB_VENDOR_4GSYSTEMS, USB_PRODUCT_4GSYSTEMS_XSSTICK_W14 },
266};
267
268static int
269send_bulkmsg(struct usbd_device *dev, void *cmd, size_t cmdlen)
270{
271 struct usbd_interface *iface;
272 usb_interface_descriptor_t *id;
273 usb_endpoint_descriptor_t *ed;
274 struct usbd_pipe *pipe;
275 struct usbd_xfer *xfer;
276 int err, i;
277
278 /* Move the device into the configured state. */
279 err = usbd_set_config_index(dev, 0, 0);
280 if (err) {
281 aprint_error("u3ginit: failed to set config index\n");
282 return UMATCH_NONE;
283 }
284
285 err = usbd_device2interface_handle(dev, 0, &iface);
286 if (err != 0) {
287 aprint_error("u3ginit: failed to get interface\n");
288 return UMATCH_NONE;
289 }
290
291 id = usbd_get_interface_descriptor(iface);
292 ed = NULL;
293 for (i = 0 ; i < id->bNumEndpoints ; i++) {
294 ed = usbd_interface2endpoint_descriptor(iface, i);
295 if (ed == NULL)
296 continue;
297 if (UE_GET_DIR(ed->bEndpointAddress) != UE_DIR_OUT)
298 continue;
299 if ((ed->bmAttributes & UE_XFERTYPE) == UE_BULK)
300 break;
301 }
302
303 if (i == id->bNumEndpoints)
304 return UMATCH_NONE;
305
306 err = usbd_open_pipe(iface, ed->bEndpointAddress,
307 USBD_EXCLUSIVE_USE, &pipe);
308 if (err != 0) {
309 aprint_error("u3ginit: failed to open bulk transfer pipe %d\n",
310 ed->bEndpointAddress);
311 return UMATCH_NONE;
312 }
313
314 int error = usbd_create_xfer(pipe, cmdlen, 0, 0, &xfer);
315 if (!error) {
316
317 usbd_setup_xfer(xfer, NULL, cmd, cmdlen,
318 USBD_SYNCHRONOUS, USBD_DEFAULT_TIMEOUT, NULL);
319
320 err = usbd_transfer(xfer);
321
322#if 0 /* XXXpooka: at least my huawei "fails" this always, but still detaches */
323 if (err)
324 aprint_error("u3ginit: transfer failed\n");
325#else
326 err = 0;
327#endif
328 usbd_destroy_xfer(xfer);
329 } else {
330 aprint_error("u3ginit: failed to allocate xfer\n");
331 err = USBD_NOMEM;
332 }
333
334 usbd_abort_pipe(pipe);
335 usbd_close_pipe(pipe);
336
337 return err == USBD_NORMAL_COMPLETION ? UMATCH_HIGHEST : UMATCH_NONE;
338}
339
340/* Byte 0..3: Command Block Wrapper (CBW) signature */
341static void
342set_cbw(unsigned char *cmd)
343{
344 cmd[0] = 0x55;
345 cmd[1] = 0x53;
346 cmd[2] = 0x42;
347 cmd[3] = 0x43;
348}
349
350static int
351u3g_bulk_scsi_eject(struct usbd_device *dev)
352{
353 unsigned char cmd[31];
354
355 memset(cmd, 0, sizeof(cmd));
356 /* Byte 0..3: Command Block Wrapper (CBW) signature */
357 set_cbw(cmd);
358 /* 4..7: CBW Tag, has to unique, but only a single transfer used. */
359 cmd[4] = 0x01;
360 /* 8..11: CBW Transfer Length, no data here */
361 /* 12: CBW Flag: output, so 0 */
362 /* 13: CBW Lun: 0 */
363 /* 14: CBW Length */
364 cmd[14] = 0x06;
365
366 /* Rest is the SCSI payload */
367
368 /* 0: SCSI START/STOP opcode */
369 cmd[15] = 0x1b;
370 /* 1..3 unused */
371 /* 4 Load/Eject command */
372 cmd[19] = 0x02;
373 /* 5: unused */
374
375 return send_bulkmsg(dev, cmd, sizeof(cmd));
376}
377
378static int
379u3g_bulk_ata_eject(struct usbd_device *dev)
380{
381 unsigned char cmd[31];
382
383 memset(cmd, 0, sizeof(cmd));
384 /* Byte 0..3: Command Block Wrapper (CBW) signature */
385 set_cbw(cmd);
386 /* 4..7: CBW Tag, has to unique, but only a single transfer used. */
387 cmd[4] = 0x01;
388 /* 8..11: CBW Transfer Length, no data here */
389 /* 12: CBW Flag: output, so 0 */
390 /* 13: CBW Lun: 0 */
391 /* 14: CBW Length */
392 cmd[14] = 0x06;
393
394 /* Rest is the SCSI payload */
395
396 /* 0: ATA pass-through */
397 cmd[15] = 0x85;
398 /* 1..3 unused */
399 /* 4 XXX What is this command? */
400 cmd[19] = 0x24;
401 /* 5: unused */
402
403 return send_bulkmsg(dev, cmd, sizeof(cmd));
404}
405
406static int
407u3g_huawei_reinit(struct usbd_device *dev)
408{
409 /*
410 * The Huawei device presents itself as a umass device with Windows
411 * drivers on it. After installation of the driver, it reinits into a
412 * 3G serial device.
413 */
414 usb_device_request_t req;
415 usb_config_descriptor_t *cdesc;
416
417 /* Get the config descriptor */
418 cdesc = usbd_get_config_descriptor(dev);
419 if (cdesc == NULL) {
420 usb_device_descriptor_t dd;
421
422 if (usbd_get_device_desc(dev, &dd) != 0)
423 return UMATCH_NONE;
424
425 if (dd.bNumConfigurations != 1)
426 return UMATCH_NONE;
427
428 if (usbd_set_config_index(dev, 0, 1) != 0)
429 return UMATCH_NONE;
430
431 cdesc = usbd_get_config_descriptor(dev);
432
433 if (cdesc == NULL)
434 return UMATCH_NONE;
435 }
436
437 /*
438 * One iface means umass mode, more than 1 (4 usually) means 3G mode.
439 *
440 * XXX: We should check the first interface's device class just to be
441 * sure. If it's a mass storage device, then we can be fairly certain
442 * it needs a mode-switch.
443 */
444 if (cdesc->bNumInterface > 1)
445 return UMATCH_NONE;
446
447 req.bmRequestType = UT_WRITE_DEVICE;
448 req.bRequest = UR_SET_FEATURE;
449 USETW(req.wValue, UF_DEVICE_REMOTE_WAKEUP);
450 USETW(req.wIndex, UHF_PORT_SUSPEND);
451 USETW(req.wLength, 0);
452
453 (void) usbd_do_request(dev, &req, 0);
454
455 return UMATCH_HIGHEST; /* Prevent umass from attaching */
456}
457
458static int
459u3g_huawei_k3765_reinit(struct usbd_device *dev)
460{
461 unsigned char cmd[31];
462
463 /* magic string adapted from some webpage */
464 memset(cmd, 0, sizeof(cmd));
465 /* Byte 0..3: Command Block Wrapper (CBW) signature */
466 set_cbw(cmd);
467
468 cmd[15]= 0x11;
469 cmd[16]= 0x06;
470
471 return send_bulkmsg(dev, cmd, sizeof(cmd));
472}
473static int
474u3g_huawei_e171_reinit(struct usbd_device *dev)
475{
476 unsigned char cmd[31];
477
478 /* magic string adapted from some webpage */
479 memset(cmd, 0, sizeof(cmd));
480 /* Byte 0..3: Command Block Wrapper (CBW) signature */
481 set_cbw(cmd);
482
483 cmd[15]= 0x11;
484 cmd[16]= 0x06;
485 cmd[17]= 0x20;
486 cmd[20]= 0x01;
487
488 return send_bulkmsg(dev, cmd, sizeof(cmd));
489}
490
491static int
492u3g_huawei_e353_reinit(struct usbd_device *dev)
493{
494 unsigned char cmd[31];
495
496 /* magic string adapted from some webpage */
497 memset(cmd, 0, sizeof(cmd));
498 /* Byte 0..3: Command Block Wrapper (CBW) signature */
499 set_cbw(cmd);
500
501 cmd[4] = 0x7f;
502 cmd[9] = 0x02;
503 cmd[12] = 0x80;
504 cmd[14] = 0x0a;
505 cmd[15] = 0x11;
506 cmd[16] = 0x06;
507 cmd[17] = 0x20;
508 cmd[23] = 0x01;
509
510 return send_bulkmsg(dev, cmd, sizeof(cmd));
511}
512
513static int
514u3g_sierra_reinit(struct usbd_device *dev)
515{
516 /* Some Sierra devices presents themselves as a umass device with
517 * Windows drivers on it. After installation of the driver, it
518 * reinits into a * 3G serial device.
519 */
520 usb_device_request_t req;
521
522 req.bmRequestType = UT_VENDOR;
523 req.bRequest = UR_SET_INTERFACE;
524 USETW(req.wValue, UF_DEVICE_REMOTE_WAKEUP);
525 USETW(req.wIndex, UHF_PORT_CONNECTION);
526 USETW(req.wLength, 0);
527
528 (void) usbd_do_request(dev, &req, 0);
529
530 return UMATCH_HIGHEST; /* Match to prevent umass from attaching */
531}
532
533static int
534u3g_4gsystems_reinit(struct usbd_device *dev)
535{
536 /* magic string adapted from usb_modeswitch database */
537 unsigned char cmd[31];
538
539 memset(cmd, 0, sizeof(cmd));
540 /* Byte 0..3: Command Block Wrapper (CBW) signature */
541 set_cbw(cmd);
542
543 cmd[4] = 0x12;
544 cmd[5] = 0x34;
545 cmd[6] = 0x56;
546 cmd[7] = 0x78;
547 cmd[8] = 0x80;
548 cmd[12] = 0x80;
549 cmd[14] = 0x06;
550 cmd[15] = 0x06;
551 cmd[16] = 0xf5;
552 cmd[17] = 0x04;
553 cmd[18] = 0x02;
554 cmd[19] = 0x52;
555 cmd[20] = 0x70;
556
557 return send_bulkmsg(dev, cmd, sizeof(cmd));
558}
559
560/*
561 * First personality:
562 *
563 * Claim the entire device if a mode-switch is required.
564 */
565
566static int
567u3ginit_match(device_t parent, cfdata_t match, void *aux)
568{
569 struct usb_attach_arg *uaa = aux;
570
571 /*
572 * Huawei changes product when it is configured as a modem.
573 */
574 switch (uaa->uaa_vendor) {
575 case USB_VENDOR_HUAWEI:
576 if (uaa->uaa_product == USB_PRODUCT_HUAWEI_K3765)
577 return UMATCH_NONE;
578
579 switch (uaa->uaa_product) {
580 case USB_PRODUCT_HUAWEI_E1750INIT:
581 case USB_PRODUCT_HUAWEI_K3765INIT:
582 return u3g_huawei_k3765_reinit(uaa->uaa_device);
583 break;
584 case USB_PRODUCT_HUAWEI_E171INIT:
585 return u3g_huawei_e171_reinit(uaa->uaa_device);
586 break;
587 case USB_PRODUCT_HUAWEI_E353INIT:
588 return u3g_huawei_e353_reinit(uaa->uaa_device);
589 break;
590 default:
591 return u3g_huawei_reinit(uaa->uaa_device);
592 break;
593 }
594 break;
595
596 case USB_VENDOR_NOVATEL2:
597 switch (uaa->uaa_product){
598 case USB_PRODUCT_NOVATEL2_MC950D_DRIVER:
599 case USB_PRODUCT_NOVATEL2_U760_DRIVER:
600 return u3g_bulk_scsi_eject(uaa->uaa_device);
601 break;
602 default:
603 break;
604 }
605 break;
606
607 case USB_VENDOR_SIERRA:
608 if (uaa->uaa_product == USB_PRODUCT_SIERRA_INSTALLER)
609 return u3g_sierra_reinit(uaa->uaa_device);
610 break;
611
612 case USB_VENDOR_QUALCOMM:
613 if (uaa->uaa_product == USB_PRODUCT_QUALCOMM_NTT_DOCOMO_L02C_STORAGE)
614 return u3g_bulk_scsi_eject(uaa->uaa_device);
615 break;
616
617 case USB_VENDOR_ZTE:
618 switch (uaa->uaa_product){
619 case USB_PRODUCT_ZTE_INSTALLER:
620 case USB_PRODUCT_ZTE_MF820D_INSTALLER:
621 (void)u3g_bulk_ata_eject(uaa->uaa_device);
622 (void)u3g_bulk_scsi_eject(uaa->uaa_device);
623 return UMATCH_HIGHEST;
624 default:
625 break;
626 }
627 break;
628
629 case USB_VENDOR_4GSYSTEMS:
630 if (uaa->uaa_product == USB_PRODUCT_4GSYSTEMS_XSSTICK_P14_INSTALLER)
631 return u3g_4gsystems_reinit(uaa->uaa_device);
632 break;
633
634 default:
635 break;
636 }
637
638 return UMATCH_NONE;
639}
640
641static void
642u3ginit_attach(device_t parent, device_t self, void *aux)
643{
644 struct usb_attach_arg *uaa = aux;
645
646 aprint_naive("\n");
647 aprint_normal(": Switching to 3G mode\n");
648
649 if (uaa->uaa_vendor == USB_VENDOR_NOVATEL2) {
650 switch (uaa->uaa_product) {
651 case USB_PRODUCT_NOVATEL2_MC950D_DRIVER:
652 case USB_PRODUCT_NOVATEL2_U760_DRIVER:
653 /* About to disappear... */
654 return;
655 break;
656 default:
657 break;
658 }
659 }
660
661 /* Move the device into the configured state. */
662 (void) usbd_set_config_index(uaa->uaa_device, 0, 1);
663}
664
665static int
666u3ginit_detach(device_t self, int flags)
667{
668
669 return 0;
670}
671
672
673/*
674 * Second personality:
675 *
676 * Claim only those interfaces required for 3G modem operation.
677 */
678
679static int
680u3g_match(device_t parent, cfdata_t match, void *aux)
681{
682 struct usbif_attach_arg *uiaa = aux;
683 struct usbd_interface *iface;
684 usb_interface_descriptor_t *id;
685 usbd_status error;
686
687 if (!usb_lookup(u3g_devs, uiaa->uiaa_vendor, uiaa->uiaa_product))
688 return UMATCH_NONE;
689
690 error = usbd_device2interface_handle(uiaa->uiaa_device,
691 uiaa->uiaa_ifaceno, &iface);
692 if (error) {
693 printf("u3g_match: failed to get interface, err=%s\n",
694 usbd_errstr(error));
695 return UMATCH_NONE;
696 }
697
698 id = usbd_get_interface_descriptor(iface);
699 if (id == NULL) {
700 printf("u3g_match: failed to get interface descriptor\n");
701 return UMATCH_NONE;
702 }
703
704 /*
705 * Huawei modems use the vendor-specific class for all interfaces,
706 * both tty and CDC NCM, which we should avoid attaching to.
707 */
708 if (uiaa->uiaa_vendor == USB_VENDOR_HUAWEI &&
709 id->bInterfaceSubClass == 2 &&
710 (id->bInterfaceProtocol & 0xf) == 6) /* 0x16, 0x46, 0x76 */
711 return UMATCH_NONE;
712
713 /*
714 * 3G modems generally report vendor-specific class
715 *
716 * XXX: this may be too generalised.
717 */
718 return id->bInterfaceClass == UICLASS_VENDOR ?
719 UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
720}
721
722static void
723u3g_attach(device_t parent, device_t self, void *aux)
724{
725 struct u3g_softc *sc = device_private(self);
726 struct usbif_attach_arg *uiaa = aux;
727 struct usbd_device *dev = uiaa->uiaa_device;
728 struct usbd_interface *iface;
729 usb_interface_descriptor_t *id;
730 usb_endpoint_descriptor_t *ed;
731 struct ucom_attach_args ucaa;
732 usbd_status error;
733 int n, intr_address, intr_size;
734
735 aprint_naive("\n");
736 aprint_normal("\n");
737
738 sc->sc_dev = self;
739 sc->sc_dying = false;
740 sc->sc_udev = dev;
741
742 error = usbd_device2interface_handle(dev, uiaa->uiaa_ifaceno, &iface);
743 if (error) {
744 aprint_error_dev(self, "failed to get interface, err=%s\n",
745 usbd_errstr(error));
746 return;
747 }
748
749 id = usbd_get_interface_descriptor(iface);
750
751 ucaa.ucaa_info = "3G Modem";
752 ucaa.ucaa_ibufsize = U3G_BUFF_SIZE;
753 ucaa.ucaa_obufsize = U3G_BUFF_SIZE;
754 ucaa.ucaa_ibufsizepad = U3G_BUFF_SIZE;
755 ucaa.ucaa_opkthdrlen = 0;
756 ucaa.ucaa_device = dev;
757 ucaa.ucaa_iface = iface;
758 ucaa.ucaa_methods = &u3g_methods;
759 ucaa.ucaa_arg = sc;
760 ucaa.ucaa_portno = -1;
761 ucaa.ucaa_bulkin = ucaa.ucaa_bulkout = -1;
762
763
764 sc->sc_ifaceno = uiaa->uiaa_ifaceno;
765 intr_address = -1;
766 intr_size = 0;
767
768 for (n = 0; n < id->bNumEndpoints; n++) {
769 ed = usbd_interface2endpoint_descriptor(iface, n);
770 if (ed == NULL) {
771 aprint_error_dev(self, "no endpoint descriptor "
772 "for %d (interface: %d)\n", n, sc->sc_ifaceno);
773 sc->sc_dying = true;
774 return;
775 }
776
777 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
778 UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT) {
779 intr_address = ed->bEndpointAddress;
780 intr_size = UGETW(ed->wMaxPacketSize);
781 } else
782 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
783 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) {
784 ucaa.ucaa_bulkin = ed->bEndpointAddress;
785 } else
786 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
787 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) {
788 ucaa.ucaa_bulkout = ed->bEndpointAddress;
789 }
790 if (ucaa.ucaa_bulkin != -1 && ucaa.ucaa_bulkout != -1) {
791 struct u3g_com *com;
792 if (sc->sc_ncom == __arraycount(sc->sc_com)) {
793 aprint_error_dev(self, "Need to configure "
794 "more than %zu ttys", sc->sc_ncom);
795 continue;
796 }
797 ucaa.ucaa_portno = sc->sc_ncom++;
798 com = &sc->sc_com[ucaa.ucaa_portno];
799 com->c_outpins = 0;
800 com->c_msr = UMSR_DSR | UMSR_CTS | UMSR_DCD;
801 com->c_open = false;
802 com->c_purging = false;
803 com->c_dev = config_found_sm_loc(self, "ucombus",
804 NULL, &ucaa, ucomprint, ucomsubmatch);
805 ucaa.ucaa_bulkin = -1;
806 ucaa.ucaa_bulkout = -1;
807 }
808 }
809
810 if (sc->sc_ncom == 0) {
811 aprint_error_dev(self, "Missing bulk in/out for interface %d\n",
812 sc->sc_ifaceno);
813 sc->sc_dying = true;
814 return;
815 }
816
817 /*
818 * If the interface has an interrupt pipe, open it immediately so
819 * that we can track input pin state changes regardless of whether
820 * the tty(4) device is open or not.
821 */
822 if (intr_address != -1) {
823 sc->sc_intr_size = intr_size;
824 sc->sc_intr_buff = kmem_alloc(intr_size, KM_SLEEP);
825 error = usbd_open_pipe_intr(iface, intr_address,
826 USBD_SHORT_XFER_OK, &sc->sc_intr_pipe, sc, sc->sc_intr_buff,
827 intr_size, u3g_intr, 100);
828 if (error) {
829 aprint_error_dev(self, "cannot open interrupt pipe "
830 "(addr %d)\n", intr_address);
831 return;
832 }
833 } else {
834 sc->sc_intr_pipe = NULL;
835 sc->sc_intr_buff = NULL;
836 }
837
838 if (!pmf_device_register(self, NULL, NULL))
839 aprint_error_dev(self, "couldn't establish power handler\n");
840}
841
842static int
843u3g_detach(device_t self, int flags)
844{
845 struct u3g_softc *sc = device_private(self);
846 int rv;
847
848 if (sc->sc_dying)
849 return 0;
850
851 pmf_device_deregister(self);
852
853 for (size_t i = 0; i < sc->sc_ncom; i++)
854 if (sc->sc_com[i].c_dev != NULL) {
855 rv = config_detach(sc->sc_com[i].c_dev, flags);
856 if (rv != 0) {
857 aprint_verbose_dev(self, "Can't deallocate "
858 "port (%d)", rv);
859 }
860 }
861
862 if (sc->sc_intr_pipe != NULL) {
863 (void) usbd_abort_pipe(sc->sc_intr_pipe);
864 (void) usbd_close_pipe(sc->sc_intr_pipe);
865 sc->sc_intr_pipe = NULL;
866 }
867 if (sc->sc_intr_buff != NULL) {
868 kmem_free(sc->sc_intr_buff, sc->sc_intr_size);
869 sc->sc_intr_buff = NULL;
870 }
871
872 return 0;
873}
874
875static void
876u3g_childdet(device_t self, device_t child)
877{
878 struct u3g_softc *sc = device_private(self);
879
880 for (size_t i = 0; i < sc->sc_ncom; i++)
881 if (sc->sc_com[i].c_dev == child)
882 sc->sc_com[i].c_dev = NULL;
883}
884
885static int
886u3g_activate(device_t self, enum devact act)
887{
888 struct u3g_softc *sc = device_private(self);
889 int rv = 0;
890
891 switch (act) {
892 case DVACT_DEACTIVATE:
893 for (size_t i = 0; i < sc->sc_ncom; i++)
894 if (sc->sc_com[i].c_dev != NULL &&
895 config_deactivate(sc->sc_com[i].c_dev) && rv == 0)
896 rv = -1;
897 else
898 rv = 0;
899 break;
900
901 default:
902 break;
903 }
904
905 return rv;
906}
907
908static void
909u3g_intr(struct usbd_xfer *xfer, void *priv, usbd_status status)
910{
911 struct u3g_softc *sc = (struct u3g_softc *)priv;
912 u_char *buf;
913 int portno = 0; /* XXX */
914 struct u3g_com *com = &sc->sc_com[portno];
915
916 if (sc->sc_dying)
917 return;
918
919 if (status != USBD_NORMAL_COMPLETION) {
920 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
921 return;
922 usbd_clear_endpoint_stall_async(sc->sc_intr_pipe);
923 return;
924 }
925
926 buf = sc->sc_intr_buff;
927 if (buf[0] == 0xa1 && buf[1] == 0x20) {
928 u_char msr;
929
930 msr = com->c_msr & ~(UMSR_DCD | UMSR_DSR | UMSR_RI);
931
932 if (buf[8] & U3G_INPIN_DCD)
933 msr |= UMSR_DCD;
934
935 if (buf[8] & U3G_INPIN_DSR)
936 msr |= UMSR_DSR;
937
938 if (buf[8] & U3G_INPIN_RI)
939 msr |= UMSR_RI;
940
941 if (msr != com->c_msr) {
942 com->c_msr = msr;
943 if (com->c_open)
944 ucom_status_change(device_private(com->c_dev));
945 }
946 }
947}
948
949/*ARGSUSED*/
950static void
951u3g_get_status(void *arg, int portno, u_char *lsr, u_char *msr)
952{
953 struct u3g_softc *sc = arg;
954
955 if (lsr != NULL)
956 *lsr = 0; /* LSR isn't supported */
957 if (msr != NULL)
958 *msr = sc->sc_com[portno].c_msr;
959}
960
961/*ARGSUSED*/
962static void
963u3g_set(void *arg, int portno, int reg, int onoff)
964{
965 struct u3g_softc *sc = arg;
966 usb_device_request_t req;
967 uint16_t mask, new_state;
968 usbd_status err;
969 struct u3g_com *com = &sc->sc_com[portno];
970
971 if (sc->sc_dying)
972 return;
973
974 switch (reg) {
975 case UCOM_SET_DTR:
976 mask = U3G_OUTPIN_DTR;
977 break;
978 case UCOM_SET_RTS:
979 mask = U3G_OUTPIN_RTS;
980 break;
981 default:
982 return;
983 }
984
985 new_state = com->c_outpins & ~mask;
986 if (onoff)
987 new_state |= mask;
988
989 if (new_state == com->c_outpins)
990 return;
991
992 com->c_outpins = new_state;
993
994 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
995 req.bRequest = U3G_SET_PIN;
996 USETW(req.wValue, new_state);
997 USETW(req.wIndex, sc->sc_ifaceno);
998 USETW(req.wLength, 0);
999
1000 err = usbd_do_request(sc->sc_udev, &req, 0);
1001 if (err == USBD_STALLED)
1002 usbd_clear_endpoint_stall(sc->sc_udev->ud_pipe0);
1003}
1004
1005/*ARGSUSED*/
1006static int
1007u3g_open(void *arg, int portno)
1008{
1009 struct u3g_softc *sc = arg;
1010 usb_device_request_t req;
1011 usb_endpoint_descriptor_t *ed;
1012 usb_interface_descriptor_t *id;
1013 struct usbd_interface *ih;
1014 usbd_status err;
1015 struct u3g_com *com = &sc->sc_com[portno];
1016 int i, nin;
1017
1018 if (sc->sc_dying)
1019 return 0;
1020
1021 err = usbd_device2interface_handle(sc->sc_udev, sc->sc_ifaceno, &ih);
1022 if (err)
1023 return EIO;
1024
1025 id = usbd_get_interface_descriptor(ih);
1026
1027 for (nin = i = 0; i < id->bNumEndpoints; i++) {
1028 ed = usbd_interface2endpoint_descriptor(ih, i);
1029 if (ed == NULL)
1030 return EIO;
1031
1032 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
1033 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
1034 nin++ == portno) {
1035 /* Issue ENDPOINT_HALT request */
1036 req.bmRequestType = UT_WRITE_ENDPOINT;
1037 req.bRequest = UR_CLEAR_FEATURE;
1038 USETW(req.wValue, UF_ENDPOINT_HALT);
1039 USETW(req.wIndex, ed->bEndpointAddress);
1040 USETW(req.wLength, 0);
1041 err = usbd_do_request(sc->sc_udev, &req, 0);
1042 if (err)
1043 return EIO;
1044 }
1045 }
1046
1047 com->c_open = true;
1048 com->c_purging = true;
1049 getmicrotime(&com->c_purge_start);
1050
1051 return 0;
1052}
1053
1054/*ARGSUSED*/
1055static void
1056u3g_close(void *arg, int portno)
1057{
1058 struct u3g_softc *sc = arg;
1059 struct u3g_com *com = &sc->sc_com[portno];
1060
1061 com->c_open = false;
1062}
1063
1064/*ARGSUSED*/
1065static void
1066u3g_read(void *arg, int portno, u_char **cpp, uint32_t *ccp)
1067{
1068 struct u3g_softc *sc = arg;
1069 struct timeval curr_tv, diff_tv;
1070 struct u3g_com *com = &sc->sc_com[portno];
1071
1072 /*
1073 * If we're not purging input data following first open, do nothing.
1074 */
1075 if (com->c_purging == false)
1076 return;
1077
1078 /*
1079 * Otherwise check if the purge timeout has expired
1080 */
1081 getmicrotime(&curr_tv);
1082 timersub(&curr_tv, &com->c_purge_start, &diff_tv);
1083
1084 if (diff_tv.tv_sec >= U3G_PURGE_SECS) {
1085 /* Timeout expired. */
1086 com->c_purging = false;
1087 } else {
1088 /* Still purging. Adjust the caller's byte count. */
1089 *ccp = 0;
1090 }
1091}
1092
1093/*ARGSUSED*/
1094static void
1095u3g_write(void *arg, int portno, u_char *to, u_char *from, uint32_t *count)
1096{
1097 struct u3g_softc *sc = arg;
1098 struct u3g_com *com = &sc->sc_com[portno];
1099
1100 /*
1101 * Stop purging as soon as the first data is written to the device.
1102 */
1103 com->c_purging = false;
1104 memcpy(to, from, *count);
1105}
1106