2 * ipheth.c - Apple iPhone USB Ethernet driver
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of GIAGIO.COM nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
19 * Alternatively, provided that this notice is retained in full, this
20 * software may be distributed under the terms of the GNU General
21 * Public License ("GPL") version 2, in which case the provisions of the
22 * GPL apply INSTEAD OF those given above.
24 * The provided data structures and external interfaces from this code
25 * are not restricted to be used by modules with a GPL compatible license.
27 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
28 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
29 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
30 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
31 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
32 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
33 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
37 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
41 * Attention: iPhone device must be paired, otherwise it won't respond to our
42 * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
46 #include <linux/kernel.h>
47 #include <linux/errno.h>
48 #include <linux/slab.h>
49 #include <linux/module.h>
50 #include <linux/netdevice.h>
51 #include <linux/etherdevice.h>
52 #include <linux/ethtool.h>
53 #include <linux/usb.h>
54 #include <linux/workqueue.h>
55 #include <linux/usb/cdc.h>
57 #define USB_VENDOR_APPLE 0x05ac
59 #define IPHETH_USBINTF_CLASS 255
60 #define IPHETH_USBINTF_SUBCLASS 253
61 #define IPHETH_USBINTF_PROTO 1
63 #define IPHETH_IP_ALIGN 2 /* padding at front of URB */
64 #define IPHETH_NCM_HEADER_SIZE (12 + 96) /* NCMH + NCM0 */
65 #define IPHETH_TX_BUF_SIZE ETH_FRAME_LEN
66 #define IPHETH_RX_BUF_SIZE_LEGACY (IPHETH_IP_ALIGN + ETH_FRAME_LEN)
67 #define IPHETH_RX_BUF_SIZE_NCM 65536
69 #define IPHETH_TX_TIMEOUT (5 * HZ)
71 #define IPHETH_INTFNUM 2
72 #define IPHETH_ALT_INTFNUM 1
74 #define IPHETH_CTRL_ENDP 0x00
75 #define IPHETH_CTRL_BUF_SIZE 0x40
76 #define IPHETH_CTRL_TIMEOUT (5 * HZ)
78 #define IPHETH_CMD_GET_MACADDR 0x00
79 #define IPHETH_CMD_ENABLE_NCM 0x04
80 #define IPHETH_CMD_CARRIER_CHECK 0x45
82 #define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
83 #define IPHETH_CARRIER_ON 0x04
85 static const struct usb_device_id ipheth_table[] = {
86 { USB_VENDOR_AND_INTERFACE_INFO(USB_VENDOR_APPLE, IPHETH_USBINTF_CLASS,
87 IPHETH_USBINTF_SUBCLASS,
88 IPHETH_USBINTF_PROTO) },
91 MODULE_DEVICE_TABLE(usb, ipheth_table);
93 struct ipheth_device {
94 struct usb_device *udev;
95 struct usb_interface *intf;
96 struct net_device *net;
99 unsigned char *tx_buf;
100 unsigned char *rx_buf;
101 unsigned char *ctrl_buf;
104 struct delayed_work carrier_work;
105 bool confirmed_pairing;
106 int (*rcvbulk_callback)(struct urb *urb);
110 static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
112 static int ipheth_alloc_urbs(struct ipheth_device *iphone)
114 struct urb *tx_urb = NULL;
115 struct urb *rx_urb = NULL;
119 tx_urb = usb_alloc_urb(0, GFP_KERNEL);
123 rx_urb = usb_alloc_urb(0, GFP_KERNEL);
127 tx_buf = usb_alloc_coherent(iphone->udev, IPHETH_TX_BUF_SIZE,
128 GFP_KERNEL, &tx_urb->transfer_dma);
132 rx_buf = usb_alloc_coherent(iphone->udev, iphone->rx_buf_len,
133 GFP_KERNEL, &rx_urb->transfer_dma);
138 iphone->tx_urb = tx_urb;
139 iphone->rx_urb = rx_urb;
140 iphone->tx_buf = tx_buf;
141 iphone->rx_buf = rx_buf;
145 usb_free_coherent(iphone->udev, IPHETH_TX_BUF_SIZE, tx_buf,
146 tx_urb->transfer_dma);
148 usb_free_urb(rx_urb);
150 usb_free_urb(tx_urb);
155 static void ipheth_free_urbs(struct ipheth_device *iphone)
157 usb_free_coherent(iphone->udev, iphone->rx_buf_len, iphone->rx_buf,
158 iphone->rx_urb->transfer_dma);
159 usb_free_coherent(iphone->udev, IPHETH_TX_BUF_SIZE, iphone->tx_buf,
160 iphone->tx_urb->transfer_dma);
161 usb_free_urb(iphone->rx_urb);
162 usb_free_urb(iphone->tx_urb);
165 static void ipheth_kill_urbs(struct ipheth_device *dev)
167 usb_kill_urb(dev->tx_urb);
168 usb_kill_urb(dev->rx_urb);
171 static int ipheth_consume_skb(char *buf, int len, struct ipheth_device *dev)
175 skb = dev_alloc_skb(len);
177 dev->net->stats.rx_dropped++;
181 skb_put_data(skb, buf, len);
183 skb->protocol = eth_type_trans(skb, dev->net);
185 dev->net->stats.rx_packets++;
186 dev->net->stats.rx_bytes += len;
192 static int ipheth_rcvbulk_callback_legacy(struct urb *urb)
194 struct ipheth_device *dev;
200 if (urb->actual_length <= IPHETH_IP_ALIGN) {
201 dev->net->stats.rx_length_errors++;
204 len = urb->actual_length - IPHETH_IP_ALIGN;
205 buf = urb->transfer_buffer + IPHETH_IP_ALIGN;
207 return ipheth_consume_skb(buf, len, dev);
210 static int ipheth_rcvbulk_callback_ncm(struct urb *urb)
212 struct usb_cdc_ncm_nth16 *ncmh;
213 struct usb_cdc_ncm_ndp16 *ncm0;
214 struct usb_cdc_ncm_dpe16 *dpe;
215 struct ipheth_device *dev;
216 int retval = -EINVAL;
222 if (urb->actual_length < IPHETH_NCM_HEADER_SIZE) {
223 dev->net->stats.rx_length_errors++;
227 ncmh = urb->transfer_buffer;
228 if (ncmh->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH16_SIGN) ||
229 le16_to_cpu(ncmh->wNdpIndex) >= urb->actual_length) {
230 dev->net->stats.rx_errors++;
234 ncm0 = urb->transfer_buffer + le16_to_cpu(ncmh->wNdpIndex);
235 if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN) ||
236 le16_to_cpu(ncmh->wHeaderLength) + le16_to_cpu(ncm0->wLength) >=
237 urb->actual_length) {
238 dev->net->stats.rx_errors++;
243 while (le16_to_cpu(dpe->wDatagramIndex) != 0 &&
244 le16_to_cpu(dpe->wDatagramLength) != 0) {
245 if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length ||
246 le16_to_cpu(dpe->wDatagramIndex) +
247 le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) {
248 dev->net->stats.rx_length_errors++;
252 buf = urb->transfer_buffer + le16_to_cpu(dpe->wDatagramIndex);
253 len = le16_to_cpu(dpe->wDatagramLength);
255 retval = ipheth_consume_skb(buf, len, dev);
265 static void ipheth_rcvbulk_callback(struct urb *urb)
267 struct ipheth_device *dev;
274 status = urb->status;
284 dev_err(&dev->intf->dev, "%s: urb status: %d\n",
289 /* iPhone may periodically send URBs with no payload
290 * on the "bulk in" endpoint. It is safe to ignore them.
292 if (urb->actual_length == 0)
295 /* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames,
296 * but rather are control frames. Their purpose is not documented, and
297 * they don't affect driver functionality, okay to drop them.
298 * There is usually just one 4-byte control frame as the very first
299 * URB received from the bulk IN endpoint.
302 (urb->actual_length == 4 &&
303 ((char *)urb->transfer_buffer)[0] == 0 &&
304 ((char *)urb->transfer_buffer)[1] == 1))
307 retval = dev->rcvbulk_callback(urb);
309 dev_err(&dev->intf->dev, "%s: callback retval: %d\n",
314 dev->confirmed_pairing = true;
315 ipheth_rx_submit(dev, GFP_ATOMIC);
318 static void ipheth_sndbulk_callback(struct urb *urb)
320 struct ipheth_device *dev;
321 int status = urb->status;
329 status != -ECONNRESET &&
330 status != -ESHUTDOWN)
331 dev_err(&dev->intf->dev, "%s: urb status: %d\n",
335 netif_wake_queue(dev->net);
337 // on URB error, trigger immediate poll
338 schedule_delayed_work(&dev->carrier_work, 0);
341 static int ipheth_carrier_set(struct ipheth_device *dev)
343 struct usb_device *udev;
346 if (!dev->confirmed_pairing)
350 retval = usb_control_msg(udev,
351 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
352 IPHETH_CMD_CARRIER_CHECK, /* request */
353 0xc0, /* request type */
356 dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
357 IPHETH_CTRL_TIMEOUT);
359 dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
364 if ((retval == 1 && dev->ctrl_buf[0] == IPHETH_CARRIER_ON) ||
365 (retval >= 2 && dev->ctrl_buf[1] == IPHETH_CARRIER_ON)) {
366 netif_carrier_on(dev->net);
367 if (dev->tx_urb->status != -EINPROGRESS)
368 netif_wake_queue(dev->net);
370 netif_carrier_off(dev->net);
371 netif_stop_queue(dev->net);
376 static void ipheth_carrier_check_work(struct work_struct *work)
378 struct ipheth_device *dev = container_of(work, struct ipheth_device,
381 ipheth_carrier_set(dev);
382 schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
385 static int ipheth_get_macaddr(struct ipheth_device *dev)
387 struct usb_device *udev = dev->udev;
388 struct net_device *net = dev->net;
391 retval = usb_control_msg(udev,
392 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
393 IPHETH_CMD_GET_MACADDR, /* request */
394 0xc0, /* request type */
398 IPHETH_CTRL_BUF_SIZE,
399 IPHETH_CTRL_TIMEOUT);
401 dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
403 } else if (retval < ETH_ALEN) {
404 dev_err(&dev->intf->dev,
405 "%s: usb_control_msg: short packet: %d bytes\n",
409 eth_hw_addr_set(net, dev->ctrl_buf);
416 static int ipheth_enable_ncm(struct ipheth_device *dev)
418 struct usb_device *udev = dev->udev;
421 retval = usb_control_msg(udev,
422 usb_sndctrlpipe(udev, IPHETH_CTRL_ENDP),
423 IPHETH_CMD_ENABLE_NCM, /* request */
424 0x41, /* request type */
429 IPHETH_CTRL_TIMEOUT);
431 dev_info(&dev->intf->dev, "%s: usb_control_msg: %d\n",
437 static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
439 struct usb_device *udev = dev->udev;
442 usb_fill_bulk_urb(dev->rx_urb, udev,
443 usb_rcvbulkpipe(udev, dev->bulk_in),
444 dev->rx_buf, dev->rx_buf_len,
445 ipheth_rcvbulk_callback,
447 dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
449 retval = usb_submit_urb(dev->rx_urb, mem_flags);
451 dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
456 static int ipheth_open(struct net_device *net)
458 struct ipheth_device *dev = netdev_priv(net);
459 struct usb_device *udev = dev->udev;
462 usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
464 retval = ipheth_carrier_set(dev);
468 retval = ipheth_rx_submit(dev, GFP_KERNEL);
472 schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
476 static int ipheth_close(struct net_device *net)
478 struct ipheth_device *dev = netdev_priv(net);
480 netif_stop_queue(net);
481 cancel_delayed_work_sync(&dev->carrier_work);
485 static netdev_tx_t ipheth_tx(struct sk_buff *skb, struct net_device *net)
487 struct ipheth_device *dev = netdev_priv(net);
488 struct usb_device *udev = dev->udev;
492 if (skb->len > IPHETH_TX_BUF_SIZE) {
493 WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len);
494 dev->net->stats.tx_dropped++;
495 dev_kfree_skb_any(skb);
499 memcpy(dev->tx_buf, skb->data, skb->len);
501 usb_fill_bulk_urb(dev->tx_urb, udev,
502 usb_sndbulkpipe(udev, dev->bulk_out),
503 dev->tx_buf, skb->len,
504 ipheth_sndbulk_callback,
506 dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
508 netif_stop_queue(net);
509 retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
511 dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
513 dev->net->stats.tx_errors++;
514 dev_kfree_skb_any(skb);
515 netif_wake_queue(net);
517 dev->net->stats.tx_packets++;
518 dev->net->stats.tx_bytes += skb->len;
519 dev_consume_skb_any(skb);
525 static void ipheth_tx_timeout(struct net_device *net, unsigned int txqueue)
527 struct ipheth_device *dev = netdev_priv(net);
529 dev_err(&dev->intf->dev, "%s: TX timeout\n", __func__);
530 dev->net->stats.tx_errors++;
531 usb_unlink_urb(dev->tx_urb);
534 static u32 ipheth_ethtool_op_get_link(struct net_device *net)
536 struct ipheth_device *dev = netdev_priv(net);
537 return netif_carrier_ok(dev->net);
540 static const struct ethtool_ops ops = {
541 .get_link = ipheth_ethtool_op_get_link
544 static const struct net_device_ops ipheth_netdev_ops = {
545 .ndo_open = ipheth_open,
546 .ndo_stop = ipheth_close,
547 .ndo_start_xmit = ipheth_tx,
548 .ndo_tx_timeout = ipheth_tx_timeout,
551 static int ipheth_probe(struct usb_interface *intf,
552 const struct usb_device_id *id)
554 struct usb_device *udev = interface_to_usbdev(intf);
555 struct usb_host_interface *hintf;
556 struct usb_endpoint_descriptor *endp;
557 struct ipheth_device *dev;
558 struct net_device *netdev;
562 netdev = alloc_etherdev(sizeof(struct ipheth_device));
566 netdev->netdev_ops = &ipheth_netdev_ops;
567 netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
568 strscpy(netdev->name, "eth%d", sizeof(netdev->name));
570 dev = netdev_priv(netdev);
574 dev->confirmed_pairing = false;
575 dev->rx_buf_len = IPHETH_RX_BUF_SIZE_LEGACY;
576 dev->rcvbulk_callback = ipheth_rcvbulk_callback_legacy;
577 /* Set up endpoints */
578 hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
581 dev_err(&intf->dev, "Unable to find alternate settings interface\n");
585 for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
586 endp = &hintf->endpoint[i].desc;
587 if (usb_endpoint_is_bulk_in(endp))
588 dev->bulk_in = endp->bEndpointAddress;
589 else if (usb_endpoint_is_bulk_out(endp))
590 dev->bulk_out = endp->bEndpointAddress;
592 if (!(dev->bulk_in && dev->bulk_out)) {
594 dev_err(&intf->dev, "Unable to find endpoints\n");
598 dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
599 if (dev->ctrl_buf == NULL) {
601 goto err_alloc_ctrl_buf;
604 retval = ipheth_get_macaddr(dev);
606 goto err_get_macaddr;
608 retval = ipheth_enable_ncm(dev);
610 dev->rx_buf_len = IPHETH_RX_BUF_SIZE_NCM;
611 dev->rcvbulk_callback = ipheth_rcvbulk_callback_ncm;
614 INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
616 retval = ipheth_alloc_urbs(dev);
618 dev_err(&intf->dev, "error allocating urbs: %d\n", retval);
622 usb_set_intfdata(intf, dev);
624 SET_NETDEV_DEV(netdev, &intf->dev);
625 netdev->ethtool_ops = &ops;
627 retval = register_netdev(netdev);
629 dev_err(&intf->dev, "error registering netdev: %d\n", retval);
631 goto err_register_netdev;
633 // carrier down and transmit queues stopped until packet from device
634 netif_carrier_off(netdev);
635 netif_tx_stop_all_queues(netdev);
636 dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
640 ipheth_free_urbs(dev);
643 kfree(dev->ctrl_buf);
650 static void ipheth_disconnect(struct usb_interface *intf)
652 struct ipheth_device *dev;
654 dev = usb_get_intfdata(intf);
656 unregister_netdev(dev->net);
657 ipheth_kill_urbs(dev);
658 ipheth_free_urbs(dev);
659 kfree(dev->ctrl_buf);
660 free_netdev(dev->net);
662 usb_set_intfdata(intf, NULL);
663 dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
666 static struct usb_driver ipheth_driver = {
668 .probe = ipheth_probe,
669 .disconnect = ipheth_disconnect,
670 .id_table = ipheth_table,
671 .disable_hub_initiated_lpm = 1,
674 module_usb_driver(ipheth_driver);
677 MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
678 MODULE_LICENSE("Dual BSD/GPL");