1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * Ethernet interface part of the LG VL600 LTE modem (4G dongle) |
4 | * |
5 | * Copyright (C) 2011 Intel Corporation |
6 | * Author: Andrzej Zaborowski <balrogg@gmail.com> |
7 | */ |
8 | #include <linux/etherdevice.h> |
9 | #include <linux/ethtool.h> |
10 | #include <linux/mii.h> |
11 | #include <linux/usb.h> |
12 | #include <linux/usb/cdc.h> |
13 | #include <linux/usb/usbnet.h> |
14 | #include <linux/if_ether.h> |
15 | #include <linux/if_arp.h> |
16 | #include <linux/inetdevice.h> |
17 | #include <linux/module.h> |
18 | |
19 | /* |
20 | * The device has a CDC ACM port for modem control (it claims to be |
21 | * CDC ACM anyway) and a CDC Ethernet port for actual network data. |
22 | * It will however ignore data on both ports that is not encapsulated |
23 | * in a specific way, any data returned is also encapsulated the same |
24 | * way. The headers don't seem to follow any popular standard. |
25 | * |
26 | * This driver adds and strips these headers from the ethernet frames |
27 | * sent/received from the CDC Ethernet port. The proprietary header |
28 | * replaces the standard ethernet header in a packet so only actual |
29 | * ethernet frames are allowed. The headers allow some form of |
30 | * multiplexing by using non standard values of the .h_proto field. |
31 | * Windows/Mac drivers do send a couple of such frames to the device |
32 | * during initialisation, with protocol set to 0x0906 or 0x0b06 and (what |
33 | * seems to be) a flag in the .dummy_flags. This doesn't seem necessary |
34 | * for modem operation but can possibly be used for GPS or other functions. |
35 | */ |
36 | |
37 | struct vl600_frame_hdr { |
38 | __le32 len; |
39 | __le32 serial; |
40 | __le32 pkt_cnt; |
41 | __le32 dummy_flags; |
42 | __le32 dummy; |
43 | __le32 magic; |
44 | } __attribute__((packed)); |
45 | |
46 | struct vl600_pkt_hdr { |
47 | __le32 dummy[2]; |
48 | __le32 len; |
49 | __be16 h_proto; |
50 | } __attribute__((packed)); |
51 | |
52 | struct vl600_state { |
53 | struct sk_buff *current_rx_buf; |
54 | }; |
55 | |
56 | static int vl600_bind(struct usbnet *dev, struct usb_interface *intf) |
57 | { |
58 | int ret; |
59 | struct vl600_state *s = kzalloc(size: sizeof(struct vl600_state), GFP_KERNEL); |
60 | |
61 | if (!s) |
62 | return -ENOMEM; |
63 | |
64 | ret = usbnet_cdc_bind(dev, intf); |
65 | if (ret) { |
66 | kfree(objp: s); |
67 | return ret; |
68 | } |
69 | |
70 | dev->driver_priv = s; |
71 | |
72 | /* ARP packets don't go through, but they're also of no use. The |
73 | * subnet has only two hosts anyway: us and the gateway / DHCP |
74 | * server (probably simulated by modem firmware or network operator) |
75 | * whose address changes every time we connect to the intarwebz and |
76 | * who doesn't bother answering ARP requests either. So hardware |
77 | * addresses have no meaning, the destination and the source of every |
78 | * packet depend only on whether it is on the IN or OUT endpoint. */ |
79 | dev->net->flags |= IFF_NOARP; |
80 | /* IPv6 NDP relies on multicast. Enable it by default. */ |
81 | dev->net->flags |= IFF_MULTICAST; |
82 | |
83 | return ret; |
84 | } |
85 | |
86 | static void vl600_unbind(struct usbnet *dev, struct usb_interface *intf) |
87 | { |
88 | struct vl600_state *s = dev->driver_priv; |
89 | |
90 | dev_kfree_skb(s->current_rx_buf); |
91 | kfree(objp: s); |
92 | |
93 | return usbnet_cdc_unbind(dev, intf); |
94 | } |
95 | |
96 | static int vl600_rx_fixup(struct usbnet *dev, struct sk_buff *skb) |
97 | { |
98 | struct vl600_frame_hdr *frame; |
99 | struct vl600_pkt_hdr *packet; |
100 | struct ethhdr *ethhdr; |
101 | int packet_len, count; |
102 | struct sk_buff *buf = skb; |
103 | struct sk_buff *clone; |
104 | struct vl600_state *s = dev->driver_priv; |
105 | |
106 | /* Frame lengths are generally 4B multiplies but every couple of |
107 | * hours there's an odd number of bytes sized yet correct frame, |
108 | * so don't require this. */ |
109 | |
110 | /* Allow a packet (or multiple packets batched together) to be |
111 | * split across many frames. We don't allow a new batch to |
112 | * begin in the same frame another one is ending however, and no |
113 | * leading or trailing pad bytes. */ |
114 | if (s->current_rx_buf) { |
115 | frame = (struct vl600_frame_hdr *) s->current_rx_buf->data; |
116 | if (skb->len + s->current_rx_buf->len > |
117 | le32_to_cpup(p: &frame->len)) { |
118 | netif_err(dev, ifup, dev->net, "Fragment too long\n" ); |
119 | dev->net->stats.rx_length_errors++; |
120 | goto error; |
121 | } |
122 | |
123 | buf = s->current_rx_buf; |
124 | skb_put_data(skb: buf, data: skb->data, len: skb->len); |
125 | } else if (skb->len < 4) { |
126 | netif_err(dev, ifup, dev->net, "Frame too short\n" ); |
127 | dev->net->stats.rx_length_errors++; |
128 | goto error; |
129 | } |
130 | |
131 | frame = (struct vl600_frame_hdr *) buf->data; |
132 | /* Yes, check that frame->magic == 0x53544448 (or 0x44544d48), |
133 | * otherwise we may run out of memory w/a bad packet */ |
134 | if (ntohl(frame->magic) != 0x53544448 && |
135 | ntohl(frame->magic) != 0x44544d48) |
136 | goto error; |
137 | |
138 | if (buf->len < sizeof(*frame) || |
139 | buf->len != le32_to_cpup(p: &frame->len)) { |
140 | /* Save this fragment for later assembly */ |
141 | if (s->current_rx_buf) |
142 | return 0; |
143 | |
144 | s->current_rx_buf = skb_copy_expand(skb, newheadroom: 0, |
145 | le32_to_cpup(p: &frame->len), GFP_ATOMIC); |
146 | if (!s->current_rx_buf) |
147 | dev->net->stats.rx_errors++; |
148 | |
149 | return 0; |
150 | } |
151 | |
152 | count = le32_to_cpup(p: &frame->pkt_cnt); |
153 | |
154 | skb_pull(skb: buf, len: sizeof(*frame)); |
155 | |
156 | while (count--) { |
157 | if (buf->len < sizeof(*packet)) { |
158 | netif_err(dev, ifup, dev->net, "Packet too short\n" ); |
159 | goto error; |
160 | } |
161 | |
162 | packet = (struct vl600_pkt_hdr *) buf->data; |
163 | packet_len = sizeof(*packet) + le32_to_cpup(p: &packet->len); |
164 | if (packet_len > buf->len) { |
165 | netif_err(dev, ifup, dev->net, |
166 | "Bad packet length stored in header\n" ); |
167 | goto error; |
168 | } |
169 | |
170 | /* Packet header is same size as the ethernet header |
171 | * (sizeof(*packet) == sizeof(*ethhdr)), additionally |
172 | * the h_proto field is in the same place so we just leave it |
173 | * alone and fill in the remaining fields. |
174 | */ |
175 | ethhdr = (struct ethhdr *) skb->data; |
176 | if (be16_to_cpup(p: ðhdr->h_proto) == ETH_P_ARP && |
177 | buf->len > 0x26) { |
178 | /* Copy the addresses from packet contents */ |
179 | memcpy(ethhdr->h_source, |
180 | &buf->data[sizeof(*ethhdr) + 0x8], |
181 | ETH_ALEN); |
182 | memcpy(ethhdr->h_dest, |
183 | &buf->data[sizeof(*ethhdr) + 0x12], |
184 | ETH_ALEN); |
185 | } else { |
186 | eth_zero_addr(addr: ethhdr->h_source); |
187 | memcpy(ethhdr->h_dest, dev->net->dev_addr, ETH_ALEN); |
188 | |
189 | /* Inbound IPv6 packets have an IPv4 ethertype (0x800) |
190 | * for some reason. Peek at the L3 header to check |
191 | * for IPv6 packets, and set the ethertype to IPv6 |
192 | * (0x86dd) so Linux can understand it. |
193 | */ |
194 | if ((buf->data[sizeof(*ethhdr)] & 0xf0) == 0x60) |
195 | ethhdr->h_proto = htons(ETH_P_IPV6); |
196 | } |
197 | |
198 | if (count) { |
199 | /* Not the last packet in this batch */ |
200 | clone = skb_clone(skb: buf, GFP_ATOMIC); |
201 | if (!clone) |
202 | goto error; |
203 | |
204 | skb_trim(skb: clone, len: packet_len); |
205 | usbnet_skb_return(dev, clone); |
206 | |
207 | skb_pull(skb: buf, len: (packet_len + 3) & ~3); |
208 | } else { |
209 | skb_trim(skb: buf, len: packet_len); |
210 | |
211 | if (s->current_rx_buf) { |
212 | usbnet_skb_return(dev, buf); |
213 | s->current_rx_buf = NULL; |
214 | return 0; |
215 | } |
216 | |
217 | return 1; |
218 | } |
219 | } |
220 | |
221 | error: |
222 | if (s->current_rx_buf) { |
223 | dev_kfree_skb_any(skb: s->current_rx_buf); |
224 | s->current_rx_buf = NULL; |
225 | } |
226 | dev->net->stats.rx_errors++; |
227 | return 0; |
228 | } |
229 | |
230 | static struct sk_buff *vl600_tx_fixup(struct usbnet *dev, |
231 | struct sk_buff *skb, gfp_t flags) |
232 | { |
233 | struct sk_buff *ret; |
234 | struct vl600_frame_hdr *frame; |
235 | struct vl600_pkt_hdr *packet; |
236 | static uint32_t serial = 1; |
237 | int orig_len = skb->len - sizeof(struct ethhdr); |
238 | int full_len = (skb->len + sizeof(struct vl600_frame_hdr) + 3) & ~3; |
239 | |
240 | frame = (struct vl600_frame_hdr *) skb->data; |
241 | if (skb->len > sizeof(*frame) && skb->len == le32_to_cpup(p: &frame->len)) |
242 | return skb; /* Already encapsulated? */ |
243 | |
244 | if (skb->len < sizeof(struct ethhdr)) |
245 | /* Drop, device can only deal with ethernet packets */ |
246 | return NULL; |
247 | |
248 | if (!skb_cloned(skb)) { |
249 | int headroom = skb_headroom(skb); |
250 | int tailroom = skb_tailroom(skb); |
251 | |
252 | if (tailroom >= full_len - skb->len - sizeof(*frame) && |
253 | headroom >= sizeof(*frame)) |
254 | /* There's enough head and tail room */ |
255 | goto encapsulate; |
256 | |
257 | if (headroom + tailroom + skb->len >= full_len) { |
258 | /* There's enough total room, just readjust */ |
259 | skb->data = memmove(skb->head + sizeof(*frame), |
260 | skb->data, skb->len); |
261 | skb_set_tail_pointer(skb, offset: skb->len); |
262 | goto encapsulate; |
263 | } |
264 | } |
265 | |
266 | /* Alloc a new skb with the required size */ |
267 | ret = skb_copy_expand(skb, newheadroom: sizeof(struct vl600_frame_hdr), newtailroom: full_len - |
268 | skb->len - sizeof(struct vl600_frame_hdr), priority: flags); |
269 | dev_kfree_skb_any(skb); |
270 | if (!ret) |
271 | return ret; |
272 | skb = ret; |
273 | |
274 | encapsulate: |
275 | /* Packet header is same size as ethernet packet header |
276 | * (sizeof(*packet) == sizeof(struct ethhdr)), additionally the |
277 | * h_proto field is in the same place so we just leave it alone and |
278 | * overwrite the remaining fields. |
279 | */ |
280 | packet = (struct vl600_pkt_hdr *) skb->data; |
281 | /* The VL600 wants IPv6 packets to have an IPv4 ethertype |
282 | * Since this modem only supports IPv4 and IPv6, just set all |
283 | * frames to 0x0800 (ETH_P_IP) |
284 | */ |
285 | packet->h_proto = htons(ETH_P_IP); |
286 | memset(&packet->dummy, 0, sizeof(packet->dummy)); |
287 | packet->len = cpu_to_le32(orig_len); |
288 | |
289 | frame = skb_push(skb, len: sizeof(*frame)); |
290 | memset(frame, 0, sizeof(*frame)); |
291 | frame->len = cpu_to_le32(full_len); |
292 | frame->serial = cpu_to_le32(serial++); |
293 | frame->pkt_cnt = cpu_to_le32(1); |
294 | |
295 | if (skb->len < full_len) /* Pad */ |
296 | skb_put(skb, len: full_len - skb->len); |
297 | |
298 | return skb; |
299 | } |
300 | |
301 | static const struct driver_info vl600_info = { |
302 | .description = "LG VL600 modem" , |
303 | .flags = FLAG_RX_ASSEMBLE | FLAG_WWAN, |
304 | .bind = vl600_bind, |
305 | .unbind = vl600_unbind, |
306 | .status = usbnet_cdc_status, |
307 | .rx_fixup = vl600_rx_fixup, |
308 | .tx_fixup = vl600_tx_fixup, |
309 | }; |
310 | |
311 | static const struct usb_device_id products[] = { |
312 | { |
313 | USB_DEVICE_AND_INTERFACE_INFO(0x1004, 0x61aa, USB_CLASS_COMM, |
314 | USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), |
315 | .driver_info = (unsigned long) &vl600_info, |
316 | }, |
317 | {}, /* End */ |
318 | }; |
319 | MODULE_DEVICE_TABLE(usb, products); |
320 | |
321 | static struct usb_driver lg_vl600_driver = { |
322 | .name = "lg-vl600" , |
323 | .id_table = products, |
324 | .probe = usbnet_probe, |
325 | .disconnect = usbnet_disconnect, |
326 | .suspend = usbnet_suspend, |
327 | .resume = usbnet_resume, |
328 | .disable_hub_initiated_lpm = 1, |
329 | }; |
330 | |
331 | module_usb_driver(lg_vl600_driver); |
332 | |
333 | MODULE_AUTHOR("Anrzej Zaborowski" ); |
334 | MODULE_DESCRIPTION("LG-VL600 modem's ethernet link" ); |
335 | MODULE_LICENSE("GPL" ); |
336 | |