1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Ethernet interface part of the LG VL600 LTE modem (4G dongle)
4 *
5 * Copyright (C) 2011 Intel Corporation
6 * Author: Andrzej Zaborowski <balrogg@gmail.com>
7 */
8 #include <linux/etherdevice.h>
9 #include <linux/ethtool.h>
10 #include <linux/mii.h>
11 #include <linux/usb.h>
12 #include <linux/usb/cdc.h>
13 #include <linux/usb/usbnet.h>
14 #include <linux/if_ether.h>
15 #include <linux/if_arp.h>
16 #include <linux/inetdevice.h>
17 #include <linux/module.h>
18
19 /*
20 * The device has a CDC ACM port for modem control (it claims to be
21 * CDC ACM anyway) and a CDC Ethernet port for actual network data.
22 * It will however ignore data on both ports that is not encapsulated
23 * in a specific way, any data returned is also encapsulated the same
24 * way. The headers don't seem to follow any popular standard.
25 *
26 * This driver adds and strips these headers from the ethernet frames
27 * sent/received from the CDC Ethernet port. The proprietary header
28 * replaces the standard ethernet header in a packet so only actual
29 * ethernet frames are allowed. The headers allow some form of
30 * multiplexing by using non standard values of the .h_proto field.
31 * Windows/Mac drivers do send a couple of such frames to the device
32 * during initialisation, with protocol set to 0x0906 or 0x0b06 and (what
33 * seems to be) a flag in the .dummy_flags. This doesn't seem necessary
34 * for modem operation but can possibly be used for GPS or other funcitons.
35 */
36
37 struct vl600_frame_hdr {
38 __le32 len;
39 __le32 serial;
40 __le32 pkt_cnt;
41 __le32 dummy_flags;
42 __le32 dummy;
43 __le32 magic;
44 } __attribute__((packed));
45
46 struct vl600_pkt_hdr {
47 __le32 dummy[2];
48 __le32 len;
49 __be16 h_proto;
50 } __attribute__((packed));
51
52 struct vl600_state {
53 struct sk_buff *current_rx_buf;
54 };
55
vl600_bind(struct usbnet * dev,struct usb_interface * intf)56 static int vl600_bind(struct usbnet *dev, struct usb_interface *intf)
57 {
58 int ret;
59 struct vl600_state *s = kzalloc(sizeof(struct vl600_state), GFP_KERNEL);
60
61 if (!s)
62 return -ENOMEM;
63
64 ret = usbnet_cdc_bind(dev, intf);
65 if (ret) {
66 kfree(s);
67 return ret;
68 }
69
70 dev->driver_priv = s;
71
72 /* ARP packets don't go through, but they're also of no use. The
73 * subnet has only two hosts anyway: us and the gateway / DHCP
74 * server (probably simulated by modem firmware or network operator)
75 * whose address changes everytime we connect to the intarwebz and
76 * who doesn't bother answering ARP requests either. So hardware
77 * addresses have no meaning, the destination and the source of every
78 * packet depend only on whether it is on the IN or OUT endpoint. */
79 dev->net->flags |= IFF_NOARP;
80 /* IPv6 NDP relies on multicast. Enable it by default. */
81 dev->net->flags |= IFF_MULTICAST;
82
83 return ret;
84 }
85
vl600_unbind(struct usbnet * dev,struct usb_interface * intf)86 static void vl600_unbind(struct usbnet *dev, struct usb_interface *intf)
87 {
88 struct vl600_state *s = dev->driver_priv;
89
90 dev_kfree_skb(s->current_rx_buf);
91 kfree(s);
92
93 return usbnet_cdc_unbind(dev, intf);
94 }
95
vl600_rx_fixup(struct usbnet * dev,struct sk_buff * skb)96 static int vl600_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
97 {
98 struct vl600_frame_hdr *frame;
99 struct vl600_pkt_hdr *packet;
100 struct ethhdr *ethhdr;
101 int packet_len, count;
102 struct sk_buff *buf = skb;
103 struct sk_buff *clone;
104 struct vl600_state *s = dev->driver_priv;
105
106 /* Frame lengths are generally 4B multiplies but every couple of
107 * hours there's an odd number of bytes sized yet correct frame,
108 * so don't require this. */
109
110 /* Allow a packet (or multiple packets batched together) to be
111 * split across many frames. We don't allow a new batch to
112 * begin in the same frame another one is ending however, and no
113 * leading or trailing pad bytes. */
114 if (s->current_rx_buf) {
115 frame = (struct vl600_frame_hdr *) s->current_rx_buf->data;
116 if (skb->len + s->current_rx_buf->len >
117 le32_to_cpup(&frame->len)) {
118 netif_err(dev, ifup, dev->net, "Fragment too long\n");
119 dev->net->stats.rx_length_errors++;
120 goto error;
121 }
122
123 buf = s->current_rx_buf;
124 skb_put_data(buf, skb->data, skb->len);
125 } else if (skb->len < 4) {
126 netif_err(dev, ifup, dev->net, "Frame too short\n");
127 dev->net->stats.rx_length_errors++;
128 goto error;
129 }
130
131 frame = (struct vl600_frame_hdr *) buf->data;
132 /* Yes, check that frame->magic == 0x53544448 (or 0x44544d48),
133 * otherwise we may run out of memory w/a bad packet */
134 if (ntohl(frame->magic) != 0x53544448 &&
135 ntohl(frame->magic) != 0x44544d48)
136 goto error;
137
138 if (buf->len < sizeof(*frame) ||
139 buf->len != le32_to_cpup(&frame->len)) {
140 /* Save this fragment for later assembly */
141 if (s->current_rx_buf)
142 return 0;
143
144 s->current_rx_buf = skb_copy_expand(skb, 0,
145 le32_to_cpup(&frame->len), GFP_ATOMIC);
146 if (!s->current_rx_buf)
147 dev->net->stats.rx_errors++;
148
149 return 0;
150 }
151
152 count = le32_to_cpup(&frame->pkt_cnt);
153
154 skb_pull(buf, sizeof(*frame));
155
156 while (count--) {
157 if (buf->len < sizeof(*packet)) {
158 netif_err(dev, ifup, dev->net, "Packet too short\n");
159 goto error;
160 }
161
162 packet = (struct vl600_pkt_hdr *) buf->data;
163 packet_len = sizeof(*packet) + le32_to_cpup(&packet->len);
164 if (packet_len > buf->len) {
165 netif_err(dev, ifup, dev->net,
166 "Bad packet length stored in header\n");
167 goto error;
168 }
169
170 /* Packet header is same size as the ethernet header
171 * (sizeof(*packet) == sizeof(*ethhdr)), additionally
172 * the h_proto field is in the same place so we just leave it
173 * alone and fill in the remaining fields.
174 */
175 ethhdr = (struct ethhdr *) skb->data;
176 if (be16_to_cpup(ðhdr->h_proto) == ETH_P_ARP &&
177 buf->len > 0x26) {
178 /* Copy the addresses from packet contents */
179 memcpy(ethhdr->h_source,
180 &buf->data[sizeof(*ethhdr) + 0x8],
181 ETH_ALEN);
182 memcpy(ethhdr->h_dest,
183 &buf->data[sizeof(*ethhdr) + 0x12],
184 ETH_ALEN);
185 } else {
186 eth_zero_addr(ethhdr->h_source);
187 memcpy(ethhdr->h_dest, dev->net->dev_addr, ETH_ALEN);
188
189 /* Inbound IPv6 packets have an IPv4 ethertype (0x800)
190 * for some reason. Peek at the L3 header to check
191 * for IPv6 packets, and set the ethertype to IPv6
192 * (0x86dd) so Linux can understand it.
193 */
194 if ((buf->data[sizeof(*ethhdr)] & 0xf0) == 0x60)
195 ethhdr->h_proto = htons(ETH_P_IPV6);
196 }
197
198 if (count) {
199 /* Not the last packet in this batch */
200 clone = skb_clone(buf, GFP_ATOMIC);
201 if (!clone)
202 goto error;
203
204 skb_trim(clone, packet_len);
205 usbnet_skb_return(dev, clone);
206
207 skb_pull(buf, (packet_len + 3) & ~3);
208 } else {
209 skb_trim(buf, packet_len);
210
211 if (s->current_rx_buf) {
212 usbnet_skb_return(dev, buf);
213 s->current_rx_buf = NULL;
214 return 0;
215 }
216
217 return 1;
218 }
219 }
220
221 error:
222 if (s->current_rx_buf) {
223 dev_kfree_skb_any(s->current_rx_buf);
224 s->current_rx_buf = NULL;
225 }
226 dev->net->stats.rx_errors++;
227 return 0;
228 }
229
vl600_tx_fixup(struct usbnet * dev,struct sk_buff * skb,gfp_t flags)230 static struct sk_buff *vl600_tx_fixup(struct usbnet *dev,
231 struct sk_buff *skb, gfp_t flags)
232 {
233 struct sk_buff *ret;
234 struct vl600_frame_hdr *frame;
235 struct vl600_pkt_hdr *packet;
236 static uint32_t serial = 1;
237 int orig_len = skb->len - sizeof(struct ethhdr);
238 int full_len = (skb->len + sizeof(struct vl600_frame_hdr) + 3) & ~3;
239
240 frame = (struct vl600_frame_hdr *) skb->data;
241 if (skb->len > sizeof(*frame) && skb->len == le32_to_cpup(&frame->len))
242 return skb; /* Already encapsulated? */
243
244 if (skb->len < sizeof(struct ethhdr))
245 /* Drop, device can only deal with ethernet packets */
246 return NULL;
247
248 if (!skb_cloned(skb)) {
249 int headroom = skb_headroom(skb);
250 int tailroom = skb_tailroom(skb);
251
252 if (tailroom >= full_len - skb->len - sizeof(*frame) &&
253 headroom >= sizeof(*frame))
254 /* There's enough head and tail room */
255 goto encapsulate;
256
257 if (headroom + tailroom + skb->len >= full_len) {
258 /* There's enough total room, just readjust */
259 skb->data = memmove(skb->head + sizeof(*frame),
260 skb->data, skb->len);
261 skb_set_tail_pointer(skb, skb->len);
262 goto encapsulate;
263 }
264 }
265
266 /* Alloc a new skb with the required size */
267 ret = skb_copy_expand(skb, sizeof(struct vl600_frame_hdr), full_len -
268 skb->len - sizeof(struct vl600_frame_hdr), flags);
269 dev_kfree_skb_any(skb);
270 if (!ret)
271 return ret;
272 skb = ret;
273
274 encapsulate:
275 /* Packet header is same size as ethernet packet header
276 * (sizeof(*packet) == sizeof(struct ethhdr)), additionally the
277 * h_proto field is in the same place so we just leave it alone and
278 * overwrite the remaining fields.
279 */
280 packet = (struct vl600_pkt_hdr *) skb->data;
281 /* The VL600 wants IPv6 packets to have an IPv4 ethertype
282 * Since this modem only supports IPv4 and IPv6, just set all
283 * frames to 0x0800 (ETH_P_IP)
284 */
285 packet->h_proto = htons(ETH_P_IP);
286 memset(&packet->dummy, 0, sizeof(packet->dummy));
287 packet->len = cpu_to_le32(orig_len);
288
289 frame = skb_push(skb, sizeof(*frame));
290 memset(frame, 0, sizeof(*frame));
291 frame->len = cpu_to_le32(full_len);
292 frame->serial = cpu_to_le32(serial++);
293 frame->pkt_cnt = cpu_to_le32(1);
294
295 if (skb->len < full_len) /* Pad */
296 skb_put(skb, full_len - skb->len);
297
298 return skb;
299 }
300
301 static const struct driver_info vl600_info = {
302 .description = "LG VL600 modem",
303 .flags = FLAG_RX_ASSEMBLE | FLAG_WWAN,
304 .bind = vl600_bind,
305 .unbind = vl600_unbind,
306 .status = usbnet_cdc_status,
307 .rx_fixup = vl600_rx_fixup,
308 .tx_fixup = vl600_tx_fixup,
309 };
310
311 static const struct usb_device_id products[] = {
312 {
313 USB_DEVICE_AND_INTERFACE_INFO(0x1004, 0x61aa, USB_CLASS_COMM,
314 USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
315 .driver_info = (unsigned long) &vl600_info,
316 },
317 {}, /* End */
318 };
319 MODULE_DEVICE_TABLE(usb, products);
320
321 static struct usb_driver lg_vl600_driver = {
322 .name = "lg-vl600",
323 .id_table = products,
324 .probe = usbnet_probe,
325 .disconnect = usbnet_disconnect,
326 .suspend = usbnet_suspend,
327 .resume = usbnet_resume,
328 .disable_hub_initiated_lpm = 1,
329 };
330
331 module_usb_driver(lg_vl600_driver);
332
333 MODULE_AUTHOR("Anrzej Zaborowski");
334 MODULE_DESCRIPTION("LG-VL600 modem's ethernet link");
335 MODULE_LICENSE("GPL");
336