1/*
2 * Ethernet interface part of the LG VL600 LTE modem (4G dongle)
3 *
4 * Copyright (C) 2011 Intel Corporation
5 * Author: Andrzej Zaborowski <balrogg@gmail.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20#include <linux/etherdevice.h>
21#include <linux/ethtool.h>
22#include <linux/mii.h>
23#include <linux/usb.h>
24#include <linux/usb/cdc.h>
25#include <linux/usb/usbnet.h>
26#include <linux/if_ether.h>
27#include <linux/if_arp.h>
28#include <linux/inetdevice.h>
29#include <linux/module.h>
30
31/*
32 * The device has a CDC ACM port for modem control (it claims to be
33 * CDC ACM anyway) and a CDC Ethernet port for actual network data.
34 * It will however ignore data on both ports that is not encapsulated
35 * in a specific way, any data returned is also encapsulated the same
36 * way.  The headers don't seem to follow any popular standard.
37 *
38 * This driver adds and strips these headers from the ethernet frames
39 * sent/received from the CDC Ethernet port.  The proprietary header
40 * replaces the standard ethernet header in a packet so only actual
41 * ethernet frames are allowed.  The headers allow some form of
42 * multiplexing by using non standard values of the .h_proto field.
43 * Windows/Mac drivers do send a couple of such frames to the device
44 * during initialisation, with protocol set to 0x0906 or 0x0b06 and (what
45 * seems to be) a flag in the .dummy_flags.  This doesn't seem necessary
46 * for modem operation but can possibly be used for GPS or other funcitons.
47 */
48
49struct vl600_frame_hdr {
50	__le32 len;
51	__le32 serial;
52	__le32 pkt_cnt;
53	__le32 dummy_flags;
54	__le32 dummy;
55	__le32 magic;
56} __attribute__((packed));
57
58struct vl600_pkt_hdr {
59	__le32 dummy[2];
60	__le32 len;
61	__be16 h_proto;
62} __attribute__((packed));
63
64struct vl600_state {
65	struct sk_buff *current_rx_buf;
66};
67
68static int vl600_bind(struct usbnet *dev, struct usb_interface *intf)
69{
70	int ret;
71	struct vl600_state *s = kzalloc(sizeof(struct vl600_state), GFP_KERNEL);
72
73	if (!s)
74		return -ENOMEM;
75
76	ret = usbnet_cdc_bind(dev, intf);
77	if (ret) {
78		kfree(s);
79		return ret;
80	}
81
82	dev->driver_priv = s;
83
84	/* ARP packets don't go through, but they're also of no use.  The
85	 * subnet has only two hosts anyway: us and the gateway / DHCP
86	 * server (probably simulated by modem firmware or network operator)
87	 * whose address changes everytime we connect to the intarwebz and
88	 * who doesn't bother answering ARP requests either.  So hardware
89	 * addresses have no meaning, the destination and the source of every
90	 * packet depend only on whether it is on the IN or OUT endpoint.  */
91	dev->net->flags |= IFF_NOARP;
92	/* IPv6 NDP relies on multicast.  Enable it by default. */
93	dev->net->flags |= IFF_MULTICAST;
94
95	return ret;
96}
97
98static void vl600_unbind(struct usbnet *dev, struct usb_interface *intf)
99{
100	struct vl600_state *s = dev->driver_priv;
101
102	if (s->current_rx_buf)
103		dev_kfree_skb(s->current_rx_buf);
104
105	kfree(s);
106
107	return usbnet_cdc_unbind(dev, intf);
108}
109
110static int vl600_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
111{
112	struct vl600_frame_hdr *frame;
113	struct vl600_pkt_hdr *packet;
114	struct ethhdr *ethhdr;
115	int packet_len, count;
116	struct sk_buff *buf = skb;
117	struct sk_buff *clone;
118	struct vl600_state *s = dev->driver_priv;
119
120	/* Frame lengths are generally 4B multiplies but every couple of
121	 * hours there's an odd number of bytes sized yet correct frame,
122	 * so don't require this.  */
123
124	/* Allow a packet (or multiple packets batched together) to be
125	 * split across many frames.  We don't allow a new batch to
126	 * begin in the same frame another one is ending however, and no
127	 * leading or trailing pad bytes.  */
128	if (s->current_rx_buf) {
129		frame = (struct vl600_frame_hdr *) s->current_rx_buf->data;
130		if (skb->len + s->current_rx_buf->len >
131				le32_to_cpup(&frame->len)) {
132			netif_err(dev, ifup, dev->net, "Fragment too long\n");
133			dev->net->stats.rx_length_errors++;
134			goto error;
135		}
136
137		buf = s->current_rx_buf;
138		memcpy(skb_put(buf, skb->len), skb->data, skb->len);
139	} else if (skb->len < 4) {
140		netif_err(dev, ifup, dev->net, "Frame too short\n");
141		dev->net->stats.rx_length_errors++;
142		goto error;
143	}
144
145	frame = (struct vl600_frame_hdr *) buf->data;
146	/* Yes, check that frame->magic == 0x53544448 (or 0x44544d48),
147	 * otherwise we may run out of memory w/a bad packet */
148	if (ntohl(frame->magic) != 0x53544448 &&
149			ntohl(frame->magic) != 0x44544d48)
150		goto error;
151
152	if (buf->len < sizeof(*frame) ||
153			buf->len != le32_to_cpup(&frame->len)) {
154		/* Save this fragment for later assembly */
155		if (s->current_rx_buf)
156			return 0;
157
158		s->current_rx_buf = skb_copy_expand(skb, 0,
159				le32_to_cpup(&frame->len), GFP_ATOMIC);
160		if (!s->current_rx_buf) {
161			netif_err(dev, ifup, dev->net, "Reserving %i bytes "
162					"for packet assembly failed.\n",
163					le32_to_cpup(&frame->len));
164			dev->net->stats.rx_errors++;
165		}
166
167		return 0;
168	}
169
170	count = le32_to_cpup(&frame->pkt_cnt);
171
172	skb_pull(buf, sizeof(*frame));
173
174	while (count--) {
175		if (buf->len < sizeof(*packet)) {
176			netif_err(dev, ifup, dev->net, "Packet too short\n");
177			goto error;
178		}
179
180		packet = (struct vl600_pkt_hdr *) buf->data;
181		packet_len = sizeof(*packet) + le32_to_cpup(&packet->len);
182		if (packet_len > buf->len) {
183			netif_err(dev, ifup, dev->net,
184					"Bad packet length stored in header\n");
185			goto error;
186		}
187
188		/* Packet header is same size as the ethernet header
189		 * (sizeof(*packet) == sizeof(*ethhdr)), additionally
190		 * the h_proto field is in the same place so we just leave it
191		 * alone and fill in the remaining fields.
192		 */
193		ethhdr = (struct ethhdr *) skb->data;
194		if (be16_to_cpup(&ethhdr->h_proto) == ETH_P_ARP &&
195				buf->len > 0x26) {
196			/* Copy the addresses from packet contents */
197			memcpy(ethhdr->h_source,
198					&buf->data[sizeof(*ethhdr) + 0x8],
199					ETH_ALEN);
200			memcpy(ethhdr->h_dest,
201					&buf->data[sizeof(*ethhdr) + 0x12],
202					ETH_ALEN);
203		} else {
204			eth_zero_addr(ethhdr->h_source);
205			memcpy(ethhdr->h_dest, dev->net->dev_addr, ETH_ALEN);
206
207			/* Inbound IPv6 packets have an IPv4 ethertype (0x800)
208			 * for some reason.  Peek at the L3 header to check
209			 * for IPv6 packets, and set the ethertype to IPv6
210			 * (0x86dd) so Linux can understand it.
211			 */
212			if ((buf->data[sizeof(*ethhdr)] & 0xf0) == 0x60)
213				ethhdr->h_proto = htons(ETH_P_IPV6);
214		}
215
216		if (count) {
217			/* Not the last packet in this batch */
218			clone = skb_clone(buf, GFP_ATOMIC);
219			if (!clone)
220				goto error;
221
222			skb_trim(clone, packet_len);
223			usbnet_skb_return(dev, clone);
224
225			skb_pull(buf, (packet_len + 3) & ~3);
226		} else {
227			skb_trim(buf, packet_len);
228
229			if (s->current_rx_buf) {
230				usbnet_skb_return(dev, buf);
231				s->current_rx_buf = NULL;
232				return 0;
233			}
234
235			return 1;
236		}
237	}
238
239error:
240	if (s->current_rx_buf) {
241		dev_kfree_skb_any(s->current_rx_buf);
242		s->current_rx_buf = NULL;
243	}
244	dev->net->stats.rx_errors++;
245	return 0;
246}
247
248static struct sk_buff *vl600_tx_fixup(struct usbnet *dev,
249		struct sk_buff *skb, gfp_t flags)
250{
251	struct sk_buff *ret;
252	struct vl600_frame_hdr *frame;
253	struct vl600_pkt_hdr *packet;
254	static uint32_t serial = 1;
255	int orig_len = skb->len - sizeof(struct ethhdr);
256	int full_len = (skb->len + sizeof(struct vl600_frame_hdr) + 3) & ~3;
257
258	frame = (struct vl600_frame_hdr *) skb->data;
259	if (skb->len > sizeof(*frame) && skb->len == le32_to_cpup(&frame->len))
260		return skb; /* Already encapsulated? */
261
262	if (skb->len < sizeof(struct ethhdr))
263		/* Drop, device can only deal with ethernet packets */
264		return NULL;
265
266	if (!skb_cloned(skb)) {
267		int headroom = skb_headroom(skb);
268		int tailroom = skb_tailroom(skb);
269
270		if (tailroom >= full_len - skb->len - sizeof(*frame) &&
271				headroom >= sizeof(*frame))
272			/* There's enough head and tail room */
273			goto encapsulate;
274
275		if (headroom + tailroom + skb->len >= full_len) {
276			/* There's enough total room, just readjust */
277			skb->data = memmove(skb->head + sizeof(*frame),
278					skb->data, skb->len);
279			skb_set_tail_pointer(skb, skb->len);
280			goto encapsulate;
281		}
282	}
283
284	/* Alloc a new skb with the required size */
285	ret = skb_copy_expand(skb, sizeof(struct vl600_frame_hdr), full_len -
286			skb->len - sizeof(struct vl600_frame_hdr), flags);
287	dev_kfree_skb_any(skb);
288	if (!ret)
289		return ret;
290	skb = ret;
291
292encapsulate:
293	/* Packet header is same size as ethernet packet header
294	 * (sizeof(*packet) == sizeof(struct ethhdr)), additionally the
295	 * h_proto field is in the same place so we just leave it alone and
296	 * overwrite the remaining fields.
297	 */
298	packet = (struct vl600_pkt_hdr *) skb->data;
299	/* The VL600 wants IPv6 packets to have an IPv4 ethertype
300	 * Since this modem only supports IPv4 and IPv6, just set all
301	 * frames to 0x0800 (ETH_P_IP)
302	 */
303	packet->h_proto = htons(ETH_P_IP);
304	memset(&packet->dummy, 0, sizeof(packet->dummy));
305	packet->len = cpu_to_le32(orig_len);
306
307	frame = (struct vl600_frame_hdr *) skb_push(skb, sizeof(*frame));
308	memset(frame, 0, sizeof(*frame));
309	frame->len = cpu_to_le32(full_len);
310	frame->serial = cpu_to_le32(serial++);
311	frame->pkt_cnt = cpu_to_le32(1);
312
313	if (skb->len < full_len) /* Pad */
314		skb_put(skb, full_len - skb->len);
315
316	return skb;
317}
318
319static const struct driver_info	vl600_info = {
320	.description	= "LG VL600 modem",
321	.flags		= FLAG_RX_ASSEMBLE | FLAG_WWAN,
322	.bind		= vl600_bind,
323	.unbind		= vl600_unbind,
324	.status		= usbnet_cdc_status,
325	.rx_fixup	= vl600_rx_fixup,
326	.tx_fixup	= vl600_tx_fixup,
327};
328
329static const struct usb_device_id products[] = {
330	{
331		USB_DEVICE_AND_INTERFACE_INFO(0x1004, 0x61aa, USB_CLASS_COMM,
332				USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
333		.driver_info	= (unsigned long) &vl600_info,
334	},
335	{},	/* End */
336};
337MODULE_DEVICE_TABLE(usb, products);
338
339static struct usb_driver lg_vl600_driver = {
340	.name		= "lg-vl600",
341	.id_table	= products,
342	.probe		= usbnet_probe,
343	.disconnect	= usbnet_disconnect,
344	.suspend	= usbnet_suspend,
345	.resume		= usbnet_resume,
346	.disable_hub_initiated_lpm = 1,
347};
348
349module_usb_driver(lg_vl600_driver);
350
351MODULE_AUTHOR("Anrzej Zaborowski");
352MODULE_DESCRIPTION("LG-VL600 modem's ethernet link");
353MODULE_LICENSE("GPL");
354