2 * ipheth.c - Apple iPhone USB Ethernet driver
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of GIAGIO.COM nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
19 * Alternatively, provided that this notice is retained in full, this
20 * software may be distributed under the terms of the GNU General
21 * Public License ("GPL") version 2, in which case the provisions of the
22 * GPL apply INSTEAD OF those given above.
24 * The provided data structures and external interfaces from this code
25 * are not restricted to be used by modules with a GPL compatible license.
27 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
28 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
29 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
30 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
31 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
32 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
33 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
37 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
41 * Attention: iPhone device must be paired, otherwise it won't respond to our
42 * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
46 #include <linux/kernel.h>
47 #include <linux/errno.h>
48 #include <linux/slab.h>
49 #include <linux/module.h>
50 #include <linux/netdevice.h>
51 #include <linux/etherdevice.h>
52 #include <linux/ethtool.h>
53 #include <linux/usb.h>
54 #include <linux/workqueue.h>
55 #include <linux/usb/cdc.h>
57 #define USB_VENDOR_APPLE 0x05ac
59 #define IPHETH_USBINTF_CLASS 255
60 #define IPHETH_USBINTF_SUBCLASS 253
61 #define IPHETH_USBINTF_PROTO 1
63 #define IPHETH_IP_ALIGN 2 /* padding at front of URB */
64 #define IPHETH_NCM_HEADER_SIZE (12 + 96) /* NCMH + NCM0 */
65 #define IPHETH_TX_BUF_SIZE ETH_FRAME_LEN
66 #define IPHETH_RX_BUF_SIZE_LEGACY (IPHETH_IP_ALIGN + ETH_FRAME_LEN)
67 #define IPHETH_RX_BUF_SIZE_NCM 65536
69 #define IPHETH_TX_TIMEOUT (5 * HZ)
71 #define IPHETH_INTFNUM 2
72 #define IPHETH_ALT_INTFNUM 1
74 #define IPHETH_CTRL_ENDP 0x00
75 #define IPHETH_CTRL_BUF_SIZE 0x40
76 #define IPHETH_CTRL_TIMEOUT (5 * HZ)
78 #define IPHETH_CMD_GET_MACADDR 0x00
79 #define IPHETH_CMD_ENABLE_NCM 0x04
80 #define IPHETH_CMD_CARRIER_CHECK 0x45
82 #define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
83 #define IPHETH_CARRIER_ON 0x04
85 static const struct usb_device_id ipheth_table[] = {
86 { USB_VENDOR_AND_INTERFACE_INFO(USB_VENDOR_APPLE, IPHETH_USBINTF_CLASS,
87 IPHETH_USBINTF_SUBCLASS,
88 IPHETH_USBINTF_PROTO) },
91 MODULE_DEVICE_TABLE(usb, ipheth_table);
93 struct ipheth_device {
94 struct usb_device *udev;
95 struct usb_interface *intf;
96 struct net_device *net;
99 unsigned char *tx_buf;
100 unsigned char *rx_buf;
101 unsigned char *ctrl_buf;
104 struct delayed_work carrier_work;
105 bool confirmed_pairing;
106 int (*rcvbulk_callback)(struct urb *urb);
110 static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
112 static int ipheth_alloc_urbs(struct ipheth_device *iphone)
114 struct urb *tx_urb = NULL;
115 struct urb *rx_urb = NULL;
119 tx_urb = usb_alloc_urb(0, GFP_KERNEL);
123 rx_urb = usb_alloc_urb(0, GFP_KERNEL);
127 tx_buf = usb_alloc_coherent(iphone->udev, IPHETH_TX_BUF_SIZE,
128 GFP_KERNEL, &tx_urb->transfer_dma);
132 rx_buf = usb_alloc_coherent(iphone->udev, iphone->rx_buf_len,
133 GFP_KERNEL, &rx_urb->transfer_dma);
138 iphone->tx_urb = tx_urb;
139 iphone->rx_urb = rx_urb;
140 iphone->tx_buf = tx_buf;
141 iphone->rx_buf = rx_buf;
145 usb_free_coherent(iphone->udev, IPHETH_TX_BUF_SIZE, tx_buf,
146 tx_urb->transfer_dma);
148 usb_free_urb(rx_urb);
150 usb_free_urb(tx_urb);
155 static void ipheth_free_urbs(struct ipheth_device *iphone)
157 usb_free_coherent(iphone->udev, iphone->rx_buf_len, iphone->rx_buf,
158 iphone->rx_urb->transfer_dma);
159 usb_free_coherent(iphone->udev, IPHETH_TX_BUF_SIZE, iphone->tx_buf,
160 iphone->tx_urb->transfer_dma);
161 usb_free_urb(iphone->rx_urb);
162 usb_free_urb(iphone->tx_urb);
165 static void ipheth_kill_urbs(struct ipheth_device *dev)
167 usb_kill_urb(dev->tx_urb);
168 usb_kill_urb(dev->rx_urb);
171 static int ipheth_consume_skb(char *buf, int len, struct ipheth_device *dev)
175 skb = dev_alloc_skb(len);
177 dev->net->stats.rx_dropped++;
181 skb_put_data(skb, buf, len);
183 skb->protocol = eth_type_trans(skb, dev->net);
185 dev->net->stats.rx_packets++;
186 dev->net->stats.rx_bytes += len;
192 static int ipheth_rcvbulk_callback_legacy(struct urb *urb)
194 struct ipheth_device *dev;
200 if (urb->actual_length <= IPHETH_IP_ALIGN) {
201 dev->net->stats.rx_length_errors++;
204 len = urb->actual_length - IPHETH_IP_ALIGN;
205 buf = urb->transfer_buffer + IPHETH_IP_ALIGN;
207 return ipheth_consume_skb(buf, len, dev);
210 static int ipheth_rcvbulk_callback_ncm(struct urb *urb)
212 struct usb_cdc_ncm_nth16 *ncmh;
213 struct usb_cdc_ncm_ndp16 *ncm0;
214 struct usb_cdc_ncm_dpe16 *dpe;
215 struct ipheth_device *dev;
216 int retval = -EINVAL;
222 if (urb->actual_length < IPHETH_NCM_HEADER_SIZE) {
223 dev->net->stats.rx_length_errors++;
227 ncmh = urb->transfer_buffer;
228 if (ncmh->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH16_SIGN) ||
229 le16_to_cpu(ncmh->wNdpIndex) >= urb->actual_length) {
230 dev->net->stats.rx_errors++;
234 ncm0 = urb->transfer_buffer + le16_to_cpu(ncmh->wNdpIndex);
235 if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN) ||
236 le16_to_cpu(ncmh->wHeaderLength) + le16_to_cpu(ncm0->wLength) >=
237 urb->actual_length) {
238 dev->net->stats.rx_errors++;
243 while (le16_to_cpu(dpe->wDatagramIndex) != 0 &&
244 le16_to_cpu(dpe->wDatagramLength) != 0) {
245 if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length ||
246 le16_to_cpu(dpe->wDatagramIndex) +
247 le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) {
248 dev->net->stats.rx_length_errors++;
252 buf = urb->transfer_buffer + le16_to_cpu(dpe->wDatagramIndex);
253 len = le16_to_cpu(dpe->wDatagramLength);
255 retval = ipheth_consume_skb(buf, len, dev);
265 static void ipheth_rcvbulk_callback(struct urb *urb)
267 struct ipheth_device *dev;
274 status = urb->status;
284 dev_err(&dev->intf->dev, "%s: urb status: %d\n",
289 if (urb->actual_length <= IPHETH_IP_ALIGN) {
290 dev->net->stats.rx_length_errors++;
294 /* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames,
295 * but rather are control frames. Their purpose is not documented, and
296 * they don't affect driver functionality, okay to drop them.
297 * There is usually just one 4-byte control frame as the very first
298 * URB received from the bulk IN endpoint.
301 (((char *)urb->transfer_buffer)[0] == 0 &&
302 ((char *)urb->transfer_buffer)[1] == 1))
305 retval = dev->rcvbulk_callback(urb);
307 dev_err(&dev->intf->dev, "%s: callback retval: %d\n",
313 dev->confirmed_pairing = true;
314 ipheth_rx_submit(dev, GFP_ATOMIC);
317 static void ipheth_sndbulk_callback(struct urb *urb)
319 struct ipheth_device *dev;
320 int status = urb->status;
328 status != -ECONNRESET &&
329 status != -ESHUTDOWN)
330 dev_err(&dev->intf->dev, "%s: urb status: %d\n",
334 netif_wake_queue(dev->net);
336 // on URB error, trigger immediate poll
337 schedule_delayed_work(&dev->carrier_work, 0);
340 static int ipheth_carrier_set(struct ipheth_device *dev)
342 struct usb_device *udev;
345 if (!dev->confirmed_pairing)
349 retval = usb_control_msg(udev,
350 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
351 IPHETH_CMD_CARRIER_CHECK, /* request */
352 0xc0, /* request type */
355 dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
356 IPHETH_CTRL_TIMEOUT);
358 dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
363 if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) {
364 netif_carrier_on(dev->net);
365 if (dev->tx_urb->status != -EINPROGRESS)
366 netif_wake_queue(dev->net);
368 netif_carrier_off(dev->net);
369 netif_stop_queue(dev->net);
374 static void ipheth_carrier_check_work(struct work_struct *work)
376 struct ipheth_device *dev = container_of(work, struct ipheth_device,
379 ipheth_carrier_set(dev);
380 schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
383 static int ipheth_get_macaddr(struct ipheth_device *dev)
385 struct usb_device *udev = dev->udev;
386 struct net_device *net = dev->net;
389 retval = usb_control_msg(udev,
390 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
391 IPHETH_CMD_GET_MACADDR, /* request */
392 0xc0, /* request type */
396 IPHETH_CTRL_BUF_SIZE,
397 IPHETH_CTRL_TIMEOUT);
399 dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
401 } else if (retval < ETH_ALEN) {
402 dev_err(&dev->intf->dev,
403 "%s: usb_control_msg: short packet: %d bytes\n",
407 eth_hw_addr_set(net, dev->ctrl_buf);
414 static int ipheth_enable_ncm(struct ipheth_device *dev)
416 struct usb_device *udev = dev->udev;
419 retval = usb_control_msg(udev,
420 usb_sndctrlpipe(udev, IPHETH_CTRL_ENDP),
421 IPHETH_CMD_ENABLE_NCM, /* request */
422 0x41, /* request type */
427 IPHETH_CTRL_TIMEOUT);
429 dev_info(&dev->intf->dev, "%s: usb_control_msg: %d\n",
435 static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
437 struct usb_device *udev = dev->udev;
440 usb_fill_bulk_urb(dev->rx_urb, udev,
441 usb_rcvbulkpipe(udev, dev->bulk_in),
442 dev->rx_buf, dev->rx_buf_len,
443 ipheth_rcvbulk_callback,
445 dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
447 retval = usb_submit_urb(dev->rx_urb, mem_flags);
449 dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
454 static int ipheth_open(struct net_device *net)
456 struct ipheth_device *dev = netdev_priv(net);
457 struct usb_device *udev = dev->udev;
460 usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
462 retval = ipheth_carrier_set(dev);
466 retval = ipheth_rx_submit(dev, GFP_KERNEL);
470 schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
474 static int ipheth_close(struct net_device *net)
476 struct ipheth_device *dev = netdev_priv(net);
478 cancel_delayed_work_sync(&dev->carrier_work);
479 netif_stop_queue(net);
483 static netdev_tx_t ipheth_tx(struct sk_buff *skb, struct net_device *net)
485 struct ipheth_device *dev = netdev_priv(net);
486 struct usb_device *udev = dev->udev;
490 if (skb->len > IPHETH_TX_BUF_SIZE) {
491 WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len);
492 dev->net->stats.tx_dropped++;
493 dev_kfree_skb_any(skb);
497 memcpy(dev->tx_buf, skb->data, skb->len);
499 usb_fill_bulk_urb(dev->tx_urb, udev,
500 usb_sndbulkpipe(udev, dev->bulk_out),
501 dev->tx_buf, skb->len,
502 ipheth_sndbulk_callback,
504 dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
506 netif_stop_queue(net);
507 retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
509 dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
511 dev->net->stats.tx_errors++;
512 dev_kfree_skb_any(skb);
513 netif_wake_queue(net);
515 dev->net->stats.tx_packets++;
516 dev->net->stats.tx_bytes += skb->len;
517 dev_consume_skb_any(skb);
523 static void ipheth_tx_timeout(struct net_device *net, unsigned int txqueue)
525 struct ipheth_device *dev = netdev_priv(net);
527 dev_err(&dev->intf->dev, "%s: TX timeout\n", __func__);
528 dev->net->stats.tx_errors++;
529 usb_unlink_urb(dev->tx_urb);
532 static u32 ipheth_ethtool_op_get_link(struct net_device *net)
534 struct ipheth_device *dev = netdev_priv(net);
535 return netif_carrier_ok(dev->net);
538 static const struct ethtool_ops ops = {
539 .get_link = ipheth_ethtool_op_get_link
542 static const struct net_device_ops ipheth_netdev_ops = {
543 .ndo_open = ipheth_open,
544 .ndo_stop = ipheth_close,
545 .ndo_start_xmit = ipheth_tx,
546 .ndo_tx_timeout = ipheth_tx_timeout,
549 static int ipheth_probe(struct usb_interface *intf,
550 const struct usb_device_id *id)
552 struct usb_device *udev = interface_to_usbdev(intf);
553 struct usb_host_interface *hintf;
554 struct usb_endpoint_descriptor *endp;
555 struct ipheth_device *dev;
556 struct net_device *netdev;
560 netdev = alloc_etherdev(sizeof(struct ipheth_device));
564 netdev->netdev_ops = &ipheth_netdev_ops;
565 netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
566 strscpy(netdev->name, "eth%d", sizeof(netdev->name));
568 dev = netdev_priv(netdev);
572 dev->confirmed_pairing = false;
573 dev->rx_buf_len = IPHETH_RX_BUF_SIZE_LEGACY;
574 dev->rcvbulk_callback = ipheth_rcvbulk_callback_legacy;
575 /* Set up endpoints */
576 hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
579 dev_err(&intf->dev, "Unable to find alternate settings interface\n");
583 for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
584 endp = &hintf->endpoint[i].desc;
585 if (usb_endpoint_is_bulk_in(endp))
586 dev->bulk_in = endp->bEndpointAddress;
587 else if (usb_endpoint_is_bulk_out(endp))
588 dev->bulk_out = endp->bEndpointAddress;
590 if (!(dev->bulk_in && dev->bulk_out)) {
592 dev_err(&intf->dev, "Unable to find endpoints\n");
596 dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
597 if (dev->ctrl_buf == NULL) {
599 goto err_alloc_ctrl_buf;
602 retval = ipheth_get_macaddr(dev);
604 goto err_get_macaddr;
606 retval = ipheth_enable_ncm(dev);
608 dev->rx_buf_len = IPHETH_RX_BUF_SIZE_NCM;
609 dev->rcvbulk_callback = ipheth_rcvbulk_callback_ncm;
612 INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
614 retval = ipheth_alloc_urbs(dev);
616 dev_err(&intf->dev, "error allocating urbs: %d\n", retval);
620 usb_set_intfdata(intf, dev);
622 SET_NETDEV_DEV(netdev, &intf->dev);
623 netdev->ethtool_ops = &ops;
625 retval = register_netdev(netdev);
627 dev_err(&intf->dev, "error registering netdev: %d\n", retval);
629 goto err_register_netdev;
631 // carrier down and transmit queues stopped until packet from device
632 netif_carrier_off(netdev);
633 netif_tx_stop_all_queues(netdev);
634 dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
638 ipheth_free_urbs(dev);
641 kfree(dev->ctrl_buf);
648 static void ipheth_disconnect(struct usb_interface *intf)
650 struct ipheth_device *dev;
652 dev = usb_get_intfdata(intf);
654 unregister_netdev(dev->net);
655 ipheth_kill_urbs(dev);
656 ipheth_free_urbs(dev);
657 kfree(dev->ctrl_buf);
658 free_netdev(dev->net);
660 usb_set_intfdata(intf, NULL);
661 dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
664 static struct usb_driver ipheth_driver = {
666 .probe = ipheth_probe,
667 .disconnect = ipheth_disconnect,
668 .id_table = ipheth_table,
669 .disable_hub_initiated_lpm = 1,
672 module_usb_driver(ipheth_driver);
675 MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
676 MODULE_LICENSE("Dual BSD/GPL");