356 lines · plain
1.. SPDX-License-Identifier: GPL-2.02 3======================================================4cdc_mbim - Driver for CDC MBIM Mobile Broadband modems5======================================================6 7The cdc_mbim driver supports USB devices conforming to the "Universal8Serial Bus Communications Class Subclass Specification for Mobile9Broadband Interface Model" [1], which is a further development of10"Universal Serial Bus Communications Class Subclass Specifications for11Network Control Model Devices" [2] optimized for Mobile Broadband12devices, aka "3G/LTE modems".13 14 15Command Line Parameters16=======================17 18The cdc_mbim driver has no parameters of its own. But the probing19behaviour for NCM 1.0 backwards compatible MBIM functions (an20"NCM/MBIM function" as defined in section 3.2 of [1]) is affected21by a cdc_ncm driver parameter:22 23prefer_mbim24-----------25:Type: Boolean26:Valid Range: N/Y (0-1)27:Default Value: Y (MBIM is preferred)28 29This parameter sets the system policy for NCM/MBIM functions. Such30functions will be handled by either the cdc_ncm driver or the cdc_mbim31driver depending on the prefer_mbim setting. Setting prefer_mbim=N32makes the cdc_mbim driver ignore these functions and lets the cdc_ncm33driver handle them instead.34 35The parameter is writable, and can be changed at any time. A manual36unbind/bind is required to make the change effective for NCM/MBIM37functions bound to the "wrong" driver38 39 40Basic usage41===========42 43MBIM functions are inactive when unmanaged. The cdc_mbim driver only44provides a userspace interface to the MBIM control channel, and will45not participate in the management of the function. This implies that a46userspace MBIM management application always is required to enable a47MBIM function.48 49Such userspace applications includes, but are not limited to:50 51 - mbimcli (included with the libmbim [3] library), and52 - ModemManager [4]53 54Establishing a MBIM IP session reequires at least these actions by the55management application:56 57 - open the control channel58 - configure network connection settings59 - connect to network60 - configure IP interface61 62Management application development63----------------------------------64The driver <-> userspace interfaces are described below. The MBIM65control channel protocol is described in [1].66 67 68MBIM control channel userspace ABI69==================================70 71/dev/cdc-wdmX character device72------------------------------73The driver creates a two-way pipe to the MBIM function control channel74using the cdc-wdm driver as a subdriver. The userspace end of the75control channel pipe is a /dev/cdc-wdmX character device.76 77The cdc_mbim driver does not process or police messages on the control78channel. The channel is fully delegated to the userspace management79application. It is therefore up to this application to ensure that it80complies with all the control channel requirements in [1].81 82The cdc-wdmX device is created as a child of the MBIM control83interface USB device. The character device associated with a specific84MBIM function can be looked up using sysfs. For example::85 86 bjorn@nemi:~$ ls /sys/bus/usb/drivers/cdc_mbim/2-4:2.12/usbmisc87 cdc-wdm088 89 bjorn@nemi:~$ grep . /sys/bus/usb/drivers/cdc_mbim/2-4:2.12/usbmisc/cdc-wdm0/dev90 180:091 92 93USB configuration descriptors94-----------------------------95The wMaxControlMessage field of the CDC MBIM functional descriptor96limits the maximum control message size. The management application is97responsible for negotiating a control message size complying with the98requirements in section 9.3.1 of [1], taking this descriptor field99into consideration.100 101The userspace application can access the CDC MBIM functional102descriptor of a MBIM function using either of the two USB103configuration descriptor kernel interfaces described in [6] or [7].104 105See also the ioctl documentation below.106 107 108Fragmentation109-------------110The userspace application is responsible for all control message111fragmentation and defragmentaion, as described in section 9.5 of [1].112 113 114/dev/cdc-wdmX write()115---------------------116The MBIM control messages from the management application *must not*117exceed the negotiated control message size.118 119 120/dev/cdc-wdmX read()121--------------------122The management application *must* accept control messages of up the123negotiated control message size.124 125 126/dev/cdc-wdmX ioctl()127---------------------128IOCTL_WDM_MAX_COMMAND: Get Maximum Command Size129This ioctl returns the wMaxControlMessage field of the CDC MBIM130functional descriptor for MBIM devices. This is intended as a131convenience, eliminating the need to parse the USB descriptors from132userspace.133 134::135 136 #include <stdio.h>137 #include <fcntl.h>138 #include <sys/ioctl.h>139 #include <linux/types.h>140 #include <linux/usb/cdc-wdm.h>141 int main()142 {143 __u16 max;144 int fd = open("/dev/cdc-wdm0", O_RDWR);145 if (!ioctl(fd, IOCTL_WDM_MAX_COMMAND, &max))146 printf("wMaxControlMessage is %d\n", max);147 }148 149 150Custom device services151----------------------152The MBIM specification allows vendors to freely define additional153services. This is fully supported by the cdc_mbim driver.154 155Support for new MBIM services, including vendor specified services, is156implemented entirely in userspace, like the rest of the MBIM control157protocol158 159New services should be registered in the MBIM Registry [5].160 161 162 163MBIM data channel userspace ABI164===============================165 166wwanY network device167--------------------168The cdc_mbim driver represents the MBIM data channel as a single169network device of the "wwan" type. This network device is initially170mapped to MBIM IP session 0.171 172 173Multiplexed IP sessions (IPS)174-----------------------------175MBIM allows multiplexing up to 256 IP sessions over a single USB data176channel. The cdc_mbim driver models such IP sessions as 802.1q VLAN177subdevices of the master wwanY device, mapping MBIM IP session Z to178VLAN ID Z for all values of Z greater than 0.179 180The device maximum Z is given in the MBIM_DEVICE_CAPS_INFO structure181described in section 10.5.1 of [1].182 183The userspace management application is responsible for adding new184VLAN links prior to establishing MBIM IP sessions where the SessionId185is greater than 0. These links can be added by using the normal VLAN186kernel interfaces, either ioctl or netlink.187 188For example, adding a link for a MBIM IP session with SessionId 3::189 190 ip link add link wwan0 name wwan0.3 type vlan id 3191 192The driver will automatically map the "wwan0.3" network device to MBIM193IP session 3.194 195 196Device Service Streams (DSS)197----------------------------198MBIM also allows up to 256 non-IP data streams to be multiplexed over199the same shared USB data channel. The cdc_mbim driver models these200sessions as another set of 802.1q VLAN subdevices of the master wwanY201device, mapping MBIM DSS session A to VLAN ID (256 + A) for all values202of A.203 204The device maximum A is given in the MBIM_DEVICE_SERVICES_INFO205structure described in section 10.5.29 of [1].206 207The DSS VLAN subdevices are used as a practical interface between the208shared MBIM data channel and a MBIM DSS aware userspace application.209It is not intended to be presented as-is to an end user. The210assumption is that a userspace application initiating a DSS session211also takes care of the necessary framing of the DSS data, presenting212the stream to the end user in an appropriate way for the stream type.213 214The network device ABI requires a dummy ethernet header for every DSS215data frame being transported. The contents of this header is216arbitrary, with the following exceptions:217 218 - TX frames using an IP protocol (0x0800 or 0x86dd) will be dropped219 - RX frames will have the protocol field set to ETH_P_802_3 (but will220 not be properly formatted 802.3 frames)221 - RX frames will have the destination address set to the hardware222 address of the master device223 224The DSS supporting userspace management application is responsible for225adding the dummy ethernet header on TX and stripping it on RX.226 227This is a simple example using tools commonly available, exporting228DssSessionId 5 as a pty character device pointed to by a /dev/nmea229symlink::230 231 ip link add link wwan0 name wwan0.dss5 type vlan id 261232 ip link set dev wwan0.dss5 up233 socat INTERFACE:wwan0.dss5,type=2 PTY:,echo=0,link=/dev/nmea234 235This is only an example, most suitable for testing out a DSS236service. Userspace applications supporting specific MBIM DSS services237are expected to use the tools and programming interfaces required by238that service.239 240Note that adding VLAN links for DSS sessions is entirely optional. A241management application may instead choose to bind a packet socket242directly to the master network device, using the received VLAN tags to243map frames to the correct DSS session and adding 18 byte VLAN ethernet244headers with the appropriate tag on TX. In this case using a socket245filter is recommended, matching only the DSS VLAN subset. This avoid246unnecessary copying of unrelated IP session data to userspace. For247example::248 249 static struct sock_filter dssfilter[] = {250 /* use special negative offsets to get VLAN tag */251 BPF_STMT(BPF_LD|BPF_B|BPF_ABS, SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT),252 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 1, 0, 6), /* true */253 254 /* verify DSS VLAN range */255 BPF_STMT(BPF_LD|BPF_H|BPF_ABS, SKF_AD_OFF + SKF_AD_VLAN_TAG),256 BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 256, 0, 4), /* 256 is first DSS VLAN */257 BPF_JUMP(BPF_JMP|BPF_JGE|BPF_K, 512, 3, 0), /* 511 is last DSS VLAN */258 259 /* verify ethertype */260 BPF_STMT(BPF_LD|BPF_H|BPF_ABS, 2 * ETH_ALEN),261 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, ETH_P_802_3, 0, 1),262 263 BPF_STMT(BPF_RET|BPF_K, (u_int)-1), /* accept */264 BPF_STMT(BPF_RET|BPF_K, 0), /* ignore */265 };266 267 268 269Tagged IP session 0 VLAN270------------------------271As described above, MBIM IP session 0 is treated as special by the272driver. It is initially mapped to untagged frames on the wwanY273network device.274 275This mapping implies a few restrictions on multiplexed IPS and DSS276sessions, which may not always be practical:277 278 - no IPS or DSS session can use a frame size greater than the MTU on279 IP session 0280 - no IPS or DSS session can be in the up state unless the network281 device representing IP session 0 also is up282 283These problems can be avoided by optionally making the driver map IP284session 0 to a VLAN subdevice, similar to all other IP sessions. This285behaviour is triggered by adding a VLAN link for the magic VLAN ID2864094. The driver will then immediately start mapping MBIM IP session2870 to this VLAN, and will drop untagged frames on the master wwanY288device.289 290Tip: It might be less confusing to the end user to name this VLAN291subdevice after the MBIM SessionID instead of the VLAN ID. For292example::293 294 ip link add link wwan0 name wwan0.0 type vlan id 4094295 296 297VLAN mapping298------------299 300Summarizing the cdc_mbim driver mapping described above, we have this301relationship between VLAN tags on the wwanY network device and MBIM302sessions on the shared USB data channel::303 304 VLAN ID MBIM type MBIM SessionID Notes305 ---------------------------------------------------------306 untagged IPS 0 a)307 1 - 255 IPS 1 - 255 <VLANID>308 256 - 511 DSS 0 - 255 <VLANID - 256>309 512 - 4093 b)310 4094 IPS 0 c)311 312 a) if no VLAN ID 4094 link exists, else dropped313 b) unsupported VLAN range, unconditionally dropped314 c) if a VLAN ID 4094 link exists, else dropped315 316 317 318 319References320==========321 322 1) USB Implementers Forum, Inc. - "Universal Serial Bus323 Communications Class Subclass Specification for Mobile Broadband324 Interface Model", Revision 1.0 (Errata 1), May 1, 2013325 326 - http://www.usb.org/developers/docs/devclass_docs/327 328 2) USB Implementers Forum, Inc. - "Universal Serial Bus329 Communications Class Subclass Specifications for Network Control330 Model Devices", Revision 1.0 (Errata 1), November 24, 2010331 332 - http://www.usb.org/developers/docs/devclass_docs/333 334 3) libmbim - "a glib-based library for talking to WWAN modems and335 devices which speak the Mobile Interface Broadband Model (MBIM)336 protocol"337 338 - http://www.freedesktop.org/wiki/Software/libmbim/339 340 4) ModemManager - "a DBus-activated daemon which controls mobile341 broadband (2G/3G/4G) devices and connections"342 343 - http://www.freedesktop.org/wiki/Software/ModemManager/344 345 5) "MBIM (Mobile Broadband Interface Model) Registry"346 347 - http://compliance.usb.org/mbim/348 349 6) "/sys/kernel/debug/usb/devices output format"350 351 - Documentation/driver-api/usb/usb.rst352 353 7) "/sys/bus/usb/devices/.../descriptors"354 355 - Documentation/ABI/stable/sysfs-bus-usb356