Defer the validity change (which triggers modem reprobe/removal) to an
idle callback in rdy_handler().
Calling mm_base_modem_set_valid(FALSE) synchronously from the URC
handler triggers the immediate destruction of the modem object while the
serial port is still iterating the unsolicited message handlers. Deferring
the operation to an idle callback and taking a reference to the modem
ensures the modem object is kept alive until parse_unsolicited() has
returned.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1072
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Disconnect the 'list-configs' indication handler immediately inside the
callback. If the modem sends a duplicate indication before the whole
config load sequence completes, it could overwrite the stored
'get-config-info' signal handler ID, orphaning the old handler and
leading to a Use-After-Free when the GTask is completed and the
orphaned handler eventually fires.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1071
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Use g_signal_connect_object() to connect to child list/object signals
in the 3GPP, Messaging, Voice, and Cell Broadcast interfaces.
Passing the raw D-Bus skeleton pointer as user_data to these signals
can lead to a Use-After-Free if the skeleton is disposed of (e.g. on
hot-unplug) while the parent object or child list survives. By using
g_signal_connect_object(), the signal handlers are automatically
disconnected when the D-Bus skeleton is destroyed.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1068
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Introduce a timezone poll session ID to validate timezone load
results. This ensures that when a pending timezone load completes, we
discard the result if a new poll session has been started (e.g. due to
registration state changes) or if polling has been stopped.
This prevents leaking GSource timeout sources and a subsequent
Use-After-Free if the modem is hot-unplugged while a poll is pending.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate the number parameter in Voice.CreateCall and Call.Deflect
D-Bus methods to ensure they do not contain control characters or
semicolons. This prevents AT command injection when the number is
later spliced into ATD or +CTFR commands.
Introduce a common helper mm_utils_is_valid_dial_number() to validate
dial numbers, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate preferred network operator codes in the SIM D-Bus interface
handler to ensure they are numeric. This prevents injecting AT
command delimiters (like CR) into this field, which is later spliced
into AT commands (+CPOL).
This change also plugs the network list leak, that was a problem on
its own.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Validate PIN and PUK codes in the SIM D-Bus interface handlers to
ensure they are numeric. This prevents injecting AT command
delimiters (like CR) into these fields, which are later spliced
into AT commands (+CPWD, +CLCK, +CPIN).
Introduce a common helper mm_utils_is_numeric() to check if a string
contains only digits, and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When sending an unencoded USSD command, the user-supplied string was
spliced directly into the +CUSD AT command. If the string contained
CR or semicolons, it could lead to AT command injection.
Use mm_at_quote_string() to properly quote and escape the USSD
command before sending it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1064
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
When parsing a SUPL address, if the host is not a valid IPv4 address,
validate it as a FQDN (allowing only alphanumeric characters, dots,
and hyphens). This prevents injecting AT command delimiters (like CR
or semicolon) into the host string, which is later spliced into
modem-specific AT commands (+XLCSSLP).
Introduce a common helper mm_utils_is_valid_fqdn() to validate FQDNs,
and add unit tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1063
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Alphanumeric SMS addresses decoded from GSM-7 could contain control
characters (like CR/LF), which could lead to AT command injection
if the address is later spliced into an AT+CMGS command during
stored SMS send fallback.
Sanitize the decoded address by removing all control characters.
Introduce a common helper mm_utils_remove_control_characters() to
remove control characters from a string in-place, and add unit
tests for it.
https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1062
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
ME910G1 supports decimal format for 4G bands and has also an empty
tdscdma slot between 4G and 4G extended bands commands/responses.
Change shared code and helpers to deal with these differences.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
The assumption that if a modem supports a given access tech, the band
settings for that specific tech should be always given is wrong for
4g, since the 4g bands can be disabled setting the value to 0 in
multi-tech modems like ME310M1.
For example, a 3g + 4g modem could have a setting in which all
the 4g bands are unset and only 3g bands are there: this scenario is
not supported by the current code, but it's legitimate.
Remove this limitation and adapt the code to support bands setting
for multi-tech modems.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Fix LN920 current bands test configuration by setting
modem_has_hex_format_4g_bands to TRUE.
The current wrong setting does not cause the test failure since the modem
supports also extended settings and function telit_get_ext_4g_mm_bands
considers both standard and extended bands as hex without checking
the flag, since decimal format for extended bands is not supported.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
The original code for xmm7360_byte_array_read_asn_int() returned
signed integers both from the function and from the returned
Xmm7360RpcMsgArg, but didn't handle sign extension on the
value returned from the function. That would lead to different
values between the function return and the Xmm7360RpcMsgArg
value, which seems wrong.
Make those two correspond and add checks in various places that
shouldn't ever see negative ints.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
That way UNKNOWN is the zero'd value instead of BYTE; it's easier
to test for and less error-prone if not explicitly set to the right
value.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
xmm7360_byte_array_read_asn_int() would keep bit-shifting a gint into
oblivion if the int's size was > 32-bit. It also didn't handle size 0
ints at all, and while size 24 ints would get stuffed into a 32-bit
variable those probably aren't a thing and if they actually are they
should get specifically handled.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
So we can unit-test all the parsing and building code more easily
without having to link to a bunch of serial port stuff.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
If the error matches, then a `+CIMI` command is sent to the device and
processing continues. However, the current error (for the `+CPIN?` command)
is not freed or propagated, fix that.
Fixes: 5c1fcbfe4a ("mtk-legacy: read IMSI if CPIN response is an error")
Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
The MTK specific modem object should be included in the 'mtk' shared
utils, so that they're available to other plugins.
Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
Current cell broadcast messages from missile warnings in Israel
have an addition `00` at the end to pad for an even byte number.
This breaks conversion making the whole message fail conversion. As this
is a 15 part message in 3 languages the whole notification is lost in
this case.
Try harder to convert the message and recover even partial bits.
Closes: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/1042
Signed-off-by: Guido Günther <agx@sigxcpu.org>
The port type hints for the RW101-cat6 and RW101-cat12 have been
updated, with USB interface #2 now designated as both the AT primary
port and fastboot port.
Signed-off-by: Wenbin <ywbjob@163.com>
only GGA NMEA sentences are supported by current implementation of
MMLocationGpsRaw. RMC and GLL messages are added, but currently test
are negative.
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
To be able to have quick position fix GNSS engine needs to know
- predicted orbits data,
- current time,
- approximate position.
Modem sends indications with requests, when it needs corresponding
information. Predicted orbits can be injected using
'mmcli -m any --location-inject-assistance-data=<file>'. But to
accelerate time to first fix after cold start extra information is
needed like time and coarse position.
Inject position requests are received, when GPS session is initiated
using QMI_LOC_START. In inject position request modem sends
information about its last known position. If last known position is
zero, when this is a cold start and inject position is needed to
improve TTFF.
Last position from the modem is cached in ModemManager and is injected
next time, when modem requests it. For example, if modem is restarted.
When timestamp on injected position is too old, than position is
ignored and location engine does cold start. Therefore current time is
used for injected position.
When injected position is far away the actual one (for example, after
flight), after some time location engine falls back to cold start.
Tested on Quectel EG25-G.
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
This class allows to preserve cached position across ModemManager restarts.
Cached location can be used to improve time to first fix after device
start by injecting coarse position into location engine. Since there
wasn't any fix yet, position in ModemManager is unknown. To fix this
cached location is saved on disk (/var/lib/ModemManager/location.ini)
when location session is stopped or ModemManager is stopped and loaded
on the next start from the file.
install_emptydir is introduced in meson 0.60.
Distributions has to create directory to store cached location in
packaging, because ModemManager runs under systemd isolation with
limited rights and it can't create this directory by itself.
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
To be able to have quick position fix GNSS engine needs to know
- predicted orbits data,
- current time,
- approximate position.
Modem sends indications with requests, when it needs corresponding
information. Predicted orbits can be injected using
'mmcli -m any --location-inject-assistance-data=<file>'. But to
accelerate time to first fix after cold start extra information is
needed like time and coarse position. This commit injects UTC time.
UTC time inject requests are received, when GPS session is initiated
using QMI_LOC_START.
Tested on Quectel EG25-G.
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
UML290 with firmware L0290VWBB12F.248 doesn't support QMI network
time and crashes when asked for AT network time too quickly after
being plugged in.
Signed-off-by: Dan Williams <dan@ioncontrol.co>
Qualcomm suggests to use mux id values >= 0x81: though this does not
seem a strict mandatory rule, there are scenarios in which the usage of
a specifix mux id is required otherwise various kind of issues could
happen (e.g. call failure, limited throughput...).
A new ID_MM_INITIAL_QMAP_MUX_ID udev tag allows setting the first initial
mux id value to be used when creating the multiplexed data connection.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
On SDM845 (OP6T) modem always starts with engine lock 'all'.
It doesn't allow to read assistance server settings at the beginning.
QMI call 'Get Predicted Orbits Data Source' (0x0036) fails with general
failure. As a result it's not possible to inject assistance data using
'mmcli -m any --location-inject-assistance-data=<file>'.
Commit 90843b7a0d ("shared-qmi: Lock and unlock GPS engine when
starting and stopping") unlocks engine on GNSS start, that allows
geolocation to work on SDM845, but it locks engine back on GNSS stop.
As a result after GNSS stop it's not possible to inject XTRA data again.
On EG25-G engine lock settings is stored in NV storage and is preserved after
modem restart. By default engine lock is 'none'. But currently on GNSS
stop this value is changed to 'all', that blocks location engine.
If previous ModemManager version is installed after
stopping geolocation and locking the engine, geolocation will not
work, since the engine is still locked and modem restart will not help.
This commit unlocks engine on modem start so all following operations
with an engine succeed. Engine isn't locked back.
Tested on SDM845 (OP6T) and Quectel EG25-G.
Fixes: 90843b7a0d ("shared-qmi: Lock and unlock GPS engine when starting and stopping")
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Since c2e3a8c10e, the generic plugin was
not able to attach to virtual ports, because they have no associated
driver, and the probe fails with "port filtered as couldn't retrieve
driver". It seems that this driver check was accidentially introduced
and is not really necessary, as there isn't a special "XMMRPC driver"
to blacklist.
Signed-off-by: Sonya Sireneva <sleirsgoevy@gmail.com>
Aleksander Morgado
Daniele Palmas
Lukas Voegl
Dan Williams
Barnabás Pőcze
Alexander Couzens
Wenbin
xuhongxing
Guido Günther
Lorenzo Medici
Andrey Skvortsov
Sonya Sireneva