1 /* $OpenBSD: if_upgt.c,v 1.64 2014/07/13 15:52:49 mpi Exp $ */ 2 3 /* 4 * Copyright (c) 2007 Marcus Glocker <mglocker@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include "bpfilter.h" 20 21 #include <sys/param.h> 22 #include <sys/sockio.h> 23 #include <sys/mbuf.h> 24 #include <sys/kernel.h> 25 #include <sys/socket.h> 26 #include <sys/systm.h> 27 #include <sys/timeout.h> 28 #include <sys/conf.h> 29 #include <sys/device.h> 30 31 #include <machine/bus.h> 32 #include <machine/endian.h> 33 #include <machine/intr.h> 34 35 #if NBPFILTER > 0 36 #include <net/bpf.h> 37 #endif 38 #include <net/if.h> 39 #include <net/if_arp.h> 40 #include <net/if_dl.h> 41 #include <net/if_media.h> 42 #include <net/if_types.h> 43 44 #include <netinet/in.h> 45 #include <netinet/if_ether.h> 46 47 #include <net80211/ieee80211_var.h> 48 #include <net80211/ieee80211_radiotap.h> 49 50 #include <dev/usb/usb.h> 51 #include <dev/usb/usbdi.h> 52 #include <dev/usb/usbdi_util.h> 53 #include <dev/usb/usbdevs.h> 54 55 #include <dev/usb/if_upgtvar.h> 56 57 /* 58 * Driver for the USB PrismGT devices. 59 * 60 * For now just USB 2.0 devices with the GW3887 chipset are supported. 61 * The driver has been written based on the firmware version 2.13.1.0_LM87. 62 * 63 * TODO's: 64 * - Fix MONITOR mode (MAC filter). 65 * - Add HOSTAP mode. 66 * - Add IBSS mode. 67 * - Support the USB 1.0 devices (NET2280, ISL3880, ISL3886 chipsets). 68 * 69 * Parts of this driver has been influenced by reading the p54u driver 70 * written by Jean-Baptiste Note <jean-baptiste.note@m4x.org> and 71 * Sebastien Bourdeauducq <lekernel@prism54.org>. 72 */ 73 74 #ifdef UPGT_DEBUG 75 int upgt_debug = 2; 76 #define DPRINTF(l, x...) do { if ((l) <= upgt_debug) printf(x); } while (0) 77 #else 78 #define DPRINTF(l, x...) 79 #endif 80 81 /* 82 * Prototypes. 83 */ 84 int upgt_match(struct device *, void *, void *); 85 void upgt_attach(struct device *, struct device *, void *); 86 void upgt_attach_hook(void *); 87 int upgt_detach(struct device *, int); 88 89 int upgt_device_type(struct upgt_softc *, uint16_t, uint16_t); 90 int upgt_device_init(struct upgt_softc *); 91 int upgt_mem_init(struct upgt_softc *); 92 uint32_t upgt_mem_alloc(struct upgt_softc *); 93 void upgt_mem_free(struct upgt_softc *, uint32_t); 94 int upgt_fw_alloc(struct upgt_softc *); 95 void upgt_fw_free(struct upgt_softc *); 96 int upgt_fw_verify(struct upgt_softc *); 97 int upgt_fw_load(struct upgt_softc *); 98 int upgt_fw_copy(char *, char *, int); 99 int upgt_eeprom_read(struct upgt_softc *); 100 int upgt_eeprom_parse(struct upgt_softc *); 101 void upgt_eeprom_parse_hwrx(struct upgt_softc *, uint8_t *); 102 void upgt_eeprom_parse_freq3(struct upgt_softc *, uint8_t *, int); 103 void upgt_eeprom_parse_freq4(struct upgt_softc *, uint8_t *, int); 104 void upgt_eeprom_parse_freq6(struct upgt_softc *, uint8_t *, int); 105 106 int upgt_ioctl(struct ifnet *, u_long, caddr_t); 107 int upgt_init(struct ifnet *); 108 void upgt_stop(struct upgt_softc *); 109 int upgt_media_change(struct ifnet *); 110 void upgt_newassoc(struct ieee80211com *, struct ieee80211_node *, 111 int); 112 int upgt_newstate(struct ieee80211com *, enum ieee80211_state, int); 113 void upgt_newstate_task(void *); 114 void upgt_next_scan(void *); 115 void upgt_start(struct ifnet *); 116 void upgt_watchdog(struct ifnet *); 117 void upgt_tx_task(void *); 118 void upgt_tx_done(struct upgt_softc *, uint8_t *); 119 void upgt_rx_cb(struct usbd_xfer *, void *, usbd_status); 120 void upgt_rx(struct upgt_softc *, uint8_t *, int); 121 void upgt_setup_rates(struct upgt_softc *); 122 uint8_t upgt_rx_rate(struct upgt_softc *, const int); 123 int upgt_set_macfilter(struct upgt_softc *, uint8_t state); 124 int upgt_set_channel(struct upgt_softc *, unsigned); 125 void upgt_set_led(struct upgt_softc *, int); 126 void upgt_set_led_blink(void *); 127 int upgt_get_stats(struct upgt_softc *); 128 129 int upgt_alloc_tx(struct upgt_softc *); 130 int upgt_alloc_rx(struct upgt_softc *); 131 int upgt_alloc_cmd(struct upgt_softc *); 132 void upgt_free_tx(struct upgt_softc *); 133 void upgt_free_rx(struct upgt_softc *); 134 void upgt_free_cmd(struct upgt_softc *); 135 int upgt_bulk_xmit(struct upgt_softc *, struct upgt_data *, 136 struct usbd_pipe *, uint32_t *, int); 137 138 void upgt_hexdump(void *, int); 139 uint32_t upgt_crc32_le(const void *, size_t); 140 uint32_t upgt_chksum_le(const uint32_t *, size_t); 141 142 struct cfdriver upgt_cd = { 143 NULL, "upgt", DV_IFNET 144 }; 145 146 const struct cfattach upgt_ca = { 147 sizeof(struct upgt_softc), upgt_match, upgt_attach, upgt_detach 148 }; 149 150 static const struct usb_devno upgt_devs_1[] = { 151 /* version 1 devices */ 152 { USB_VENDOR_ALCATELT, USB_PRODUCT_ALCATELT_ST120G } 153 }; 154 155 static const struct usb_devno upgt_devs_2[] = { 156 /* version 2 devices */ 157 { USB_VENDOR_ACCTON, USB_PRODUCT_ACCTON_PRISM_GT }, 158 { USB_VENDOR_ALCATELT, USB_PRODUCT_ALCATELT_ST121G }, 159 { USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050 }, 160 { USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54AG }, 161 { USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GV2 }, 162 { USB_VENDOR_CONCEPTRONIC, USB_PRODUCT_CONCEPTRONIC_PRISM_GT }, 163 { USB_VENDOR_DELL, USB_PRODUCT_DELL_PRISM_GT_1 }, 164 { USB_VENDOR_DELL, USB_PRODUCT_DELL_PRISM_GT_2 }, 165 { USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122A2 }, 166 { USB_VENDOR_FSC, USB_PRODUCT_FSC_E5400 }, 167 { USB_VENDOR_GLOBESPAN, USB_PRODUCT_GLOBESPAN_PRISM_GT_1 }, 168 { USB_VENDOR_GLOBESPAN, USB_PRODUCT_GLOBESPAN_PRISM_GT_2 }, 169 { USB_VENDOR_INTERSIL, USB_PRODUCT_INTERSIL_PRISM_GT }, 170 { USB_VENDOR_PHEENET, USB_PRODUCT_PHEENET_GWU513 }, 171 { USB_VENDOR_PHILIPS, USB_PRODUCT_PHILIPS_CPWUA054 }, 172 { USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG }, 173 { USB_VENDOR_USR, USB_PRODUCT_USR_USR5422 }, 174 { USB_VENDOR_WISTRONNEWEB, USB_PRODUCT_WISTRONNEWEB_UR045G }, 175 { USB_VENDOR_XYRATEX, USB_PRODUCT_XYRATEX_PRISM_GT_1 }, 176 { USB_VENDOR_XYRATEX, USB_PRODUCT_XYRATEX_PRISM_GT_2 }, 177 { USB_VENDOR_ZCOM, USB_PRODUCT_ZCOM_MD40900 }, 178 { USB_VENDOR_ZCOM, USB_PRODUCT_ZCOM_XG703A } 179 }; 180 181 int 182 upgt_match(struct device *parent, void *match, void *aux) 183 { 184 struct usb_attach_arg *uaa = aux; 185 186 if (uaa->iface != NULL) 187 return (UMATCH_NONE); 188 189 if (usb_lookup(upgt_devs_1, uaa->vendor, uaa->product) != NULL) 190 return (UMATCH_VENDOR_PRODUCT); 191 192 if (usb_lookup(upgt_devs_2, uaa->vendor, uaa->product) != NULL) 193 return (UMATCH_VENDOR_PRODUCT); 194 195 return (UMATCH_NONE); 196 } 197 198 void 199 upgt_attach(struct device *parent, struct device *self, void *aux) 200 { 201 struct upgt_softc *sc = (struct upgt_softc *)self; 202 struct usb_attach_arg *uaa = aux; 203 usb_interface_descriptor_t *id; 204 usb_endpoint_descriptor_t *ed; 205 usbd_status error; 206 int i; 207 208 /* 209 * Attach USB device. 210 */ 211 sc->sc_udev = uaa->device; 212 213 /* check device type */ 214 if (upgt_device_type(sc, uaa->vendor, uaa->product) != 0) 215 return; 216 217 /* set configuration number */ 218 if (usbd_set_config_no(sc->sc_udev, UPGT_CONFIG_NO, 0) != 0) { 219 printf("%s: could not set configuration no!\n", 220 sc->sc_dev.dv_xname); 221 return; 222 } 223 224 /* get the first interface handle */ 225 error = usbd_device2interface_handle(sc->sc_udev, UPGT_IFACE_INDEX, 226 &sc->sc_iface); 227 if (error != 0) { 228 printf("%s: could not get interface handle!\n", 229 sc->sc_dev.dv_xname); 230 return; 231 } 232 233 /* find endpoints */ 234 id = usbd_get_interface_descriptor(sc->sc_iface); 235 sc->sc_rx_no = sc->sc_tx_no = -1; 236 for (i = 0; i < id->bNumEndpoints; i++) { 237 ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i); 238 if (ed == NULL) { 239 printf("%s: no endpoint descriptor for iface %d!\n", 240 sc->sc_dev.dv_xname, i); 241 return; 242 } 243 244 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT && 245 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) 246 sc->sc_tx_no = ed->bEndpointAddress; 247 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN && 248 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) 249 sc->sc_rx_no = ed->bEndpointAddress; 250 251 /* 252 * 0x01 TX pipe 253 * 0x81 RX pipe 254 * 255 * Deprecated scheme (not used with fw version >2.5.6.x): 256 * 0x02 TX MGMT pipe 257 * 0x82 TX MGMT pipe 258 */ 259 if (sc->sc_tx_no != -1 && sc->sc_rx_no != -1) 260 break; 261 } 262 if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) { 263 printf("%s: missing endpoint!\n", sc->sc_dev.dv_xname); 264 return; 265 } 266 267 /* setup tasks and timeouts */ 268 usb_init_task(&sc->sc_task_newstate, upgt_newstate_task, sc, 269 USB_TASK_TYPE_GENERIC); 270 usb_init_task(&sc->sc_task_tx, upgt_tx_task, sc, USB_TASK_TYPE_GENERIC); 271 timeout_set(&sc->scan_to, upgt_next_scan, sc); 272 timeout_set(&sc->led_to, upgt_set_led_blink, sc); 273 274 /* 275 * Open TX and RX USB bulk pipes. 276 */ 277 error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE, 278 &sc->sc_tx_pipeh); 279 if (error != 0) { 280 printf("%s: could not open TX pipe: %s!\n", 281 sc->sc_dev.dv_xname, usbd_errstr(error)); 282 goto fail; 283 } 284 error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE, 285 &sc->sc_rx_pipeh); 286 if (error != 0) { 287 printf("%s: could not open RX pipe: %s!\n", 288 sc->sc_dev.dv_xname, usbd_errstr(error)); 289 goto fail; 290 } 291 292 /* 293 * Allocate TX, RX, and CMD xfers. 294 */ 295 if (upgt_alloc_tx(sc) != 0) 296 goto fail; 297 if (upgt_alloc_rx(sc) != 0) 298 goto fail; 299 if (upgt_alloc_cmd(sc) != 0) 300 goto fail; 301 302 /* 303 * We need the firmware loaded to complete the attach. 304 */ 305 if (rootvp == NULL) 306 mountroothook_establish(upgt_attach_hook, sc); 307 else 308 upgt_attach_hook(sc); 309 310 return; 311 fail: 312 printf("%s: %s failed!\n", sc->sc_dev.dv_xname, __func__); 313 } 314 315 void 316 upgt_attach_hook(void *arg) 317 { 318 struct upgt_softc *sc = arg; 319 struct ieee80211com *ic = &sc->sc_ic; 320 struct ifnet *ifp = &ic->ic_if; 321 usbd_status error; 322 int i; 323 324 /* 325 * Load firmware file into memory. 326 */ 327 if (upgt_fw_alloc(sc) != 0) 328 goto fail; 329 330 /* 331 * Initialize the device. 332 */ 333 if (upgt_device_init(sc) != 0) 334 goto fail; 335 336 /* 337 * Verify the firmware. 338 */ 339 if (upgt_fw_verify(sc) != 0) 340 goto fail; 341 342 /* 343 * Calculate device memory space. 344 */ 345 if (sc->sc_memaddr_frame_start == 0 || sc->sc_memaddr_frame_end == 0) { 346 printf("%s: could not find memory space addresses on FW!\n", 347 sc->sc_dev.dv_xname); 348 goto fail; 349 } 350 sc->sc_memaddr_frame_end -= UPGT_MEMSIZE_RX + 1; 351 sc->sc_memaddr_rx_start = sc->sc_memaddr_frame_end + 1; 352 353 DPRINTF(1, "%s: memory address frame start=0x%08x\n", 354 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_start); 355 DPRINTF(1, "%s: memory address frame end=0x%08x\n", 356 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_end); 357 DPRINTF(1, "%s: memory address rx start=0x%08x\n", 358 sc->sc_dev.dv_xname, sc->sc_memaddr_rx_start); 359 360 upgt_mem_init(sc); 361 362 /* 363 * Load the firmware. 364 */ 365 if (upgt_fw_load(sc) != 0) 366 goto fail; 367 368 /* 369 * Startup the RX pipe. 370 */ 371 struct upgt_data *data_rx = &sc->rx_data; 372 373 usbd_setup_xfer(data_rx->xfer, sc->sc_rx_pipeh, data_rx, data_rx->buf, 374 MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, upgt_rx_cb); 375 error = usbd_transfer(data_rx->xfer); 376 if (error != 0 && error != USBD_IN_PROGRESS) { 377 printf("%s: could not queue RX transfer!\n", 378 sc->sc_dev.dv_xname); 379 goto fail; 380 } 381 usbd_delay_ms(sc->sc_udev, 100); 382 383 /* 384 * Read the whole EEPROM content and parse it. 385 */ 386 if (upgt_eeprom_read(sc) != 0) 387 goto fail; 388 if (upgt_eeprom_parse(sc) != 0) 389 goto fail; 390 391 /* 392 * Setup the 802.11 device. 393 */ 394 ic->ic_phytype = IEEE80211_T_OFDM; 395 ic->ic_opmode = IEEE80211_M_STA; 396 ic->ic_state = IEEE80211_S_INIT; 397 ic->ic_caps = 398 IEEE80211_C_MONITOR | 399 IEEE80211_C_SHPREAMBLE | 400 IEEE80211_C_SHSLOT | 401 IEEE80211_C_WEP | 402 IEEE80211_C_RSN; 403 404 ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b; 405 ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g; 406 407 for (i = 1; i <= 14; i++) { 408 ic->ic_channels[i].ic_freq = 409 ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ); 410 ic->ic_channels[i].ic_flags = 411 IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM | 412 IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 413 } 414 415 ifp->if_softc = sc; 416 ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST; 417 ifp->if_ioctl = upgt_ioctl; 418 ifp->if_start = upgt_start; 419 ifp->if_watchdog = upgt_watchdog; 420 IFQ_SET_READY(&ifp->if_snd); 421 memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ); 422 423 if_attach(ifp); 424 ieee80211_ifattach(ifp); 425 ic->ic_newassoc = upgt_newassoc; 426 427 sc->sc_newstate = ic->ic_newstate; 428 ic->ic_newstate = upgt_newstate; 429 ieee80211_media_init(ifp, upgt_media_change, ieee80211_media_status); 430 431 #if NBPFILTER > 0 432 bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO, 433 sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN); 434 435 sc->sc_rxtap_len = sizeof(sc->sc_rxtapu); 436 sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len); 437 sc->sc_rxtap.wr_ihdr.it_present = htole32(UPGT_RX_RADIOTAP_PRESENT); 438 439 sc->sc_txtap_len = sizeof(sc->sc_txtapu); 440 sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len); 441 sc->sc_txtap.wt_ihdr.it_present = htole32(UPGT_TX_RADIOTAP_PRESENT); 442 #endif 443 444 printf("%s: address %s\n", 445 sc->sc_dev.dv_xname, ether_sprintf(ic->ic_myaddr)); 446 447 return; 448 fail: 449 printf("%s: %s failed!\n", sc->sc_dev.dv_xname, __func__); 450 } 451 452 int 453 upgt_detach(struct device *self, int flags) 454 { 455 struct upgt_softc *sc = (struct upgt_softc *)self; 456 struct ifnet *ifp = &sc->sc_ic.ic_if; 457 int s; 458 459 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__); 460 461 s = splusb(); 462 463 /* abort and close TX / RX pipes */ 464 if (sc->sc_tx_pipeh != NULL) { 465 usbd_abort_pipe(sc->sc_tx_pipeh); 466 usbd_close_pipe(sc->sc_tx_pipeh); 467 } 468 if (sc->sc_rx_pipeh != NULL) { 469 usbd_abort_pipe(sc->sc_rx_pipeh); 470 usbd_close_pipe(sc->sc_rx_pipeh); 471 } 472 473 /* remove tasks and timeouts */ 474 usb_rem_task(sc->sc_udev, &sc->sc_task_newstate); 475 usb_rem_task(sc->sc_udev, &sc->sc_task_tx); 476 if (timeout_initialized(&sc->scan_to)) 477 timeout_del(&sc->scan_to); 478 if (timeout_initialized(&sc->led_to)) 479 timeout_del(&sc->led_to); 480 481 /* free xfers */ 482 upgt_free_tx(sc); 483 upgt_free_rx(sc); 484 upgt_free_cmd(sc); 485 486 /* free firmware */ 487 upgt_fw_free(sc); 488 489 if (ifp->if_softc != NULL) { 490 /* detach interface */ 491 ieee80211_ifdetach(ifp); 492 if_detach(ifp); 493 } 494 495 splx(s); 496 497 return (0); 498 } 499 500 int 501 upgt_device_type(struct upgt_softc *sc, uint16_t vendor, uint16_t product) 502 { 503 if (usb_lookup(upgt_devs_1, vendor, product) != NULL) { 504 sc->sc_device_type = 1; 505 /* XXX */ 506 printf("%s: version 1 devices not supported yet!\n", 507 sc->sc_dev.dv_xname); 508 return (1); 509 } else { 510 sc->sc_device_type = 2; 511 } 512 513 return (0); 514 } 515 516 int 517 upgt_device_init(struct upgt_softc *sc) 518 { 519 struct upgt_data *data_cmd = &sc->cmd_data; 520 char init_cmd[] = { 0x7e, 0x7e, 0x7e, 0x7e }; 521 int len; 522 523 len = sizeof(init_cmd); 524 bcopy(init_cmd, data_cmd->buf, len); 525 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 526 printf("%s: could not send device init string!\n", 527 sc->sc_dev.dv_xname); 528 return (EIO); 529 } 530 usbd_delay_ms(sc->sc_udev, 100); 531 532 DPRINTF(1, "%s: device initialized\n", sc->sc_dev.dv_xname); 533 534 return (0); 535 } 536 537 int 538 upgt_mem_init(struct upgt_softc *sc) 539 { 540 int i; 541 542 for (i = 0; i < UPGT_MEMORY_MAX_PAGES; i++) { 543 sc->sc_memory.page[i].used = 0; 544 545 if (i == 0) { 546 /* 547 * The first memory page is always reserved for 548 * command data. 549 */ 550 sc->sc_memory.page[i].addr = 551 sc->sc_memaddr_frame_start + MCLBYTES; 552 } else { 553 sc->sc_memory.page[i].addr = 554 sc->sc_memory.page[i - 1].addr + MCLBYTES; 555 } 556 557 if (sc->sc_memory.page[i].addr + MCLBYTES >= 558 sc->sc_memaddr_frame_end) 559 break; 560 561 DPRINTF(2, "%s: memory address page %d=0x%08x\n", 562 sc->sc_dev.dv_xname, i, sc->sc_memory.page[i].addr); 563 } 564 565 sc->sc_memory.pages = i; 566 567 DPRINTF(2, "%s: memory pages=%d\n", 568 sc->sc_dev.dv_xname, sc->sc_memory.pages); 569 570 return (0); 571 } 572 573 uint32_t 574 upgt_mem_alloc(struct upgt_softc *sc) 575 { 576 int i; 577 578 for (i = 0; i < sc->sc_memory.pages; i++) { 579 if (sc->sc_memory.page[i].used == 0) { 580 sc->sc_memory.page[i].used = 1; 581 return (sc->sc_memory.page[i].addr); 582 } 583 } 584 585 return (0); 586 } 587 588 void 589 upgt_mem_free(struct upgt_softc *sc, uint32_t addr) 590 { 591 int i; 592 593 for (i = 0; i < sc->sc_memory.pages; i++) { 594 if (sc->sc_memory.page[i].addr == addr) { 595 sc->sc_memory.page[i].used = 0; 596 return; 597 } 598 } 599 600 printf("%s: could not free memory address 0x%08x!\n", 601 sc->sc_dev.dv_xname, addr); 602 } 603 604 605 int 606 upgt_fw_alloc(struct upgt_softc *sc) 607 { 608 const char *name = "upgt-gw3887"; 609 int error; 610 611 if (sc->sc_fw == NULL) { 612 error = loadfirmware(name, &sc->sc_fw, &sc->sc_fw_size); 613 if (error != 0) { 614 printf("%s: error %d, could not read firmware %s!\n", 615 sc->sc_dev.dv_xname, error, name); 616 return (EIO); 617 } 618 } 619 620 DPRINTF(1, "%s: firmware %s allocated\n", sc->sc_dev.dv_xname, name); 621 622 return (0); 623 } 624 625 void 626 upgt_fw_free(struct upgt_softc *sc) 627 { 628 if (sc->sc_fw != NULL) { 629 free(sc->sc_fw, M_DEVBUF, 0); 630 sc->sc_fw = NULL; 631 DPRINTF(1, "%s: firmware freed\n", sc->sc_dev.dv_xname); 632 } 633 } 634 635 int 636 upgt_fw_verify(struct upgt_softc *sc) 637 { 638 struct upgt_fw_bra_option *bra_option; 639 uint32_t bra_option_type, bra_option_len; 640 uint32_t *uc; 641 int offset, bra_end = 0; 642 643 /* 644 * Seek to beginning of Boot Record Area (BRA). 645 */ 646 for (offset = 0; offset < sc->sc_fw_size; offset += sizeof(*uc)) { 647 uc = (uint32_t *)(sc->sc_fw + offset); 648 if (*uc == 0) 649 break; 650 } 651 for (; offset < sc->sc_fw_size; offset += sizeof(*uc)) { 652 uc = (uint32_t *)(sc->sc_fw + offset); 653 if (*uc != 0) 654 break; 655 } 656 if (offset == sc->sc_fw_size) { 657 printf("%s: firmware Boot Record Area not found!\n", 658 sc->sc_dev.dv_xname); 659 return (EIO); 660 } 661 DPRINTF(1, "%s: firmware Boot Record Area found at offset %d\n", 662 sc->sc_dev.dv_xname, offset); 663 664 /* 665 * Parse Boot Record Area (BRA) options. 666 */ 667 while (offset < sc->sc_fw_size && bra_end == 0) { 668 /* get current BRA option */ 669 bra_option = (struct upgt_fw_bra_option *)(sc->sc_fw + offset); 670 bra_option_type = letoh32(bra_option->type); 671 bra_option_len = letoh32(bra_option->len) * sizeof(*uc); 672 673 switch (bra_option_type) { 674 case UPGT_BRA_TYPE_FW: 675 DPRINTF(1, "%s: UPGT_BRA_TYPE_FW len=%d\n", 676 sc->sc_dev.dv_xname, bra_option_len); 677 678 if (bra_option_len != UPGT_BRA_FWTYPE_SIZE) { 679 printf("%s: wrong UPGT_BRA_TYPE_FW len!\n", 680 sc->sc_dev.dv_xname); 681 return (EIO); 682 } 683 if (memcmp(UPGT_BRA_FWTYPE_LM86, bra_option->data, 684 bra_option_len) == 0) { 685 sc->sc_fw_type = UPGT_FWTYPE_LM86; 686 break; 687 } 688 if (memcmp(UPGT_BRA_FWTYPE_LM87, bra_option->data, 689 bra_option_len) == 0) { 690 sc->sc_fw_type = UPGT_FWTYPE_LM87; 691 break; 692 } 693 if (memcmp(UPGT_BRA_FWTYPE_FMAC, bra_option->data, 694 bra_option_len) == 0) { 695 sc->sc_fw_type = UPGT_FWTYPE_FMAC; 696 break; 697 } 698 printf("%s: unsupported firmware type!\n", 699 sc->sc_dev.dv_xname); 700 return (EIO); 701 case UPGT_BRA_TYPE_VERSION: 702 DPRINTF(1, "%s: UPGT_BRA_TYPE_VERSION len=%d\n", 703 sc->sc_dev.dv_xname, bra_option_len); 704 break; 705 case UPGT_BRA_TYPE_DEPIF: 706 DPRINTF(1, "%s: UPGT_BRA_TYPE_DEPIF len=%d\n", 707 sc->sc_dev.dv_xname, bra_option_len); 708 break; 709 case UPGT_BRA_TYPE_EXPIF: 710 DPRINTF(1, "%s: UPGT_BRA_TYPE_EXPIF len=%d\n", 711 sc->sc_dev.dv_xname, bra_option_len); 712 break; 713 case UPGT_BRA_TYPE_DESCR: 714 DPRINTF(1, "%s: UPGT_BRA_TYPE_DESCR len=%d\n", 715 sc->sc_dev.dv_xname, bra_option_len); 716 717 struct upgt_fw_bra_descr *descr = 718 (struct upgt_fw_bra_descr *)bra_option->data; 719 720 sc->sc_memaddr_frame_start = 721 letoh32(descr->memaddr_space_start); 722 sc->sc_memaddr_frame_end = 723 letoh32(descr->memaddr_space_end); 724 725 DPRINTF(2, "%s: memory address space start=0x%08x\n", 726 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_start); 727 DPRINTF(2, "%s: memory address space end=0x%08x\n", 728 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_end); 729 break; 730 case UPGT_BRA_TYPE_END: 731 DPRINTF(1, "%s: UPGT_BRA_TYPE_END len=%d\n", 732 sc->sc_dev.dv_xname, bra_option_len); 733 bra_end = 1; 734 break; 735 default: 736 DPRINTF(1, "%s: unknown BRA option len=%d\n", 737 sc->sc_dev.dv_xname, bra_option_len); 738 return (EIO); 739 } 740 741 /* jump to next BRA option */ 742 offset += sizeof(struct upgt_fw_bra_option) + bra_option_len; 743 } 744 745 DPRINTF(1, "%s: firmware verified\n", sc->sc_dev.dv_xname); 746 747 return (0); 748 } 749 750 int 751 upgt_fw_load(struct upgt_softc *sc) 752 { 753 struct upgt_data *data_cmd = &sc->cmd_data; 754 struct upgt_data *data_rx = &sc->rx_data; 755 char start_fwload_cmd[] = { 0x3c, 0x0d }; 756 int offset, bsize, n, i, len; 757 uint32_t crc32; 758 759 /* send firmware start load command */ 760 len = sizeof(start_fwload_cmd); 761 bcopy(start_fwload_cmd, data_cmd->buf, len); 762 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 763 printf("%s: could not send start_firmware_load command!\n", 764 sc->sc_dev.dv_xname); 765 return (EIO); 766 } 767 768 /* send X2 header */ 769 len = sizeof(struct upgt_fw_x2_header); 770 struct upgt_fw_x2_header *x2 = data_cmd->buf; 771 bcopy(UPGT_X2_SIGNATURE, x2->signature, UPGT_X2_SIGNATURE_SIZE); 772 x2->startaddr = htole32(UPGT_MEMADDR_FIRMWARE_START); 773 x2->len = htole32(sc->sc_fw_size); 774 x2->crc = upgt_crc32_le(data_cmd->buf + UPGT_X2_SIGNATURE_SIZE, 775 sizeof(struct upgt_fw_x2_header) - UPGT_X2_SIGNATURE_SIZE - 776 sizeof(uint32_t)); 777 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 778 printf("%s: could not send firmware X2 header!\n", 779 sc->sc_dev.dv_xname); 780 return (EIO); 781 } 782 783 /* download firmware */ 784 for (offset = 0; offset < sc->sc_fw_size; offset += bsize) { 785 if (sc->sc_fw_size - offset > UPGT_FW_BLOCK_SIZE) 786 bsize = UPGT_FW_BLOCK_SIZE; 787 else 788 bsize = sc->sc_fw_size - offset; 789 790 n = upgt_fw_copy(sc->sc_fw + offset, data_cmd->buf, bsize); 791 792 DPRINTF(1, "%s: FW offset=%d, read=%d, sent=%d\n", 793 sc->sc_dev.dv_xname, offset, n, bsize); 794 795 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &bsize, 0) 796 != 0) { 797 printf("%s: error while downloading firmware block!\n", 798 sc->sc_dev.dv_xname); 799 return (EIO); 800 } 801 802 bsize = n; 803 } 804 DPRINTF(1, "%s: firmware downloaded\n", sc->sc_dev.dv_xname); 805 806 /* load firmware */ 807 crc32 = upgt_crc32_le(sc->sc_fw, sc->sc_fw_size); 808 *((uint32_t *)(data_cmd->buf) ) = crc32; 809 *((uint8_t *)(data_cmd->buf) + 4) = 'g'; 810 *((uint8_t *)(data_cmd->buf) + 5) = '\r'; 811 len = 6; 812 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 813 printf("%s: could not send load_firmware command!\n", 814 sc->sc_dev.dv_xname); 815 return (EIO); 816 } 817 818 for (i = 0; i < UPGT_FIRMWARE_TIMEOUT; i++) { 819 len = UPGT_FW_BLOCK_SIZE; 820 bzero(data_rx->buf, MCLBYTES); 821 if (upgt_bulk_xmit(sc, data_rx, sc->sc_rx_pipeh, &len, 822 USBD_SHORT_XFER_OK) != 0) { 823 printf("%s: could not read firmware response!\n", 824 sc->sc_dev.dv_xname); 825 return (EIO); 826 } 827 828 if (memcmp(data_rx->buf, "OK", 2) == 0) 829 break; /* firmware load was successful */ 830 } 831 if (i == UPGT_FIRMWARE_TIMEOUT) { 832 printf("%s: firmware load failed!\n", sc->sc_dev.dv_xname); 833 return (EIO); 834 } 835 DPRINTF(1, "%s: firmware loaded\n", sc->sc_dev.dv_xname); 836 837 return (0); 838 } 839 840 /* 841 * While copying the version 2 firmware, we need to replace two characters: 842 * 843 * 0x7e -> 0x7d 0x5e 844 * 0x7d -> 0x7d 0x5d 845 */ 846 int 847 upgt_fw_copy(char *src, char *dst, int size) 848 { 849 int i, j; 850 851 for (i = 0, j = 0; i < size && j < size; i++) { 852 switch (src[i]) { 853 case 0x7e: 854 dst[j] = 0x7d; 855 j++; 856 dst[j] = 0x5e; 857 j++; 858 break; 859 case 0x7d: 860 dst[j] = 0x7d; 861 j++; 862 dst[j] = 0x5d; 863 j++; 864 break; 865 default: 866 dst[j] = src[i]; 867 j++; 868 break; 869 } 870 } 871 872 return (i); 873 } 874 875 int 876 upgt_eeprom_read(struct upgt_softc *sc) 877 { 878 struct upgt_data *data_cmd = &sc->cmd_data; 879 struct upgt_lmac_mem *mem; 880 struct upgt_lmac_eeprom *eeprom; 881 int offset, block, len; 882 883 offset = 0; 884 block = UPGT_EEPROM_BLOCK_SIZE; 885 while (offset < UPGT_EEPROM_SIZE) { 886 DPRINTF(1, "%s: request EEPROM block (offset=%d, len=%d)\n", 887 sc->sc_dev.dv_xname, offset, block); 888 889 /* 890 * Transmit the URB containing the CMD data. 891 */ 892 bzero(data_cmd->buf, MCLBYTES); 893 894 mem = (struct upgt_lmac_mem *)data_cmd->buf; 895 mem->addr = htole32(sc->sc_memaddr_frame_start + 896 UPGT_MEMSIZE_FRAME_HEAD); 897 898 eeprom = (struct upgt_lmac_eeprom *)(mem + 1); 899 eeprom->header1.flags = 0; 900 eeprom->header1.type = UPGT_H1_TYPE_CTRL; 901 eeprom->header1.len = htole16(( 902 sizeof(struct upgt_lmac_eeprom) - 903 sizeof(struct upgt_lmac_header)) + block); 904 905 eeprom->header2.reqid = htole32(sc->sc_memaddr_frame_start); 906 eeprom->header2.type = htole16(UPGT_H2_TYPE_EEPROM); 907 eeprom->header2.flags = 0; 908 909 eeprom->offset = htole16(offset); 910 eeprom->len = htole16(block); 911 912 len = sizeof(*mem) + sizeof(*eeprom) + block; 913 914 mem->chksum = upgt_chksum_le((uint32_t *)eeprom, 915 len - sizeof(*mem)); 916 917 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 918 USBD_FORCE_SHORT_XFER) != 0) { 919 printf("%s: could not transmit EEPROM data URB!\n", 920 sc->sc_dev.dv_xname); 921 return (EIO); 922 } 923 if (tsleep(sc, 0, "eeprom_request", UPGT_USB_TIMEOUT)) { 924 printf("%s: timeout while waiting for EEPROM data!\n", 925 sc->sc_dev.dv_xname); 926 return (EIO); 927 } 928 929 offset += block; 930 if (UPGT_EEPROM_SIZE - offset < block) 931 block = UPGT_EEPROM_SIZE - offset; 932 } 933 934 return (0); 935 } 936 937 int 938 upgt_eeprom_parse(struct upgt_softc *sc) 939 { 940 struct ieee80211com *ic = &sc->sc_ic; 941 struct upgt_eeprom_header *eeprom_header; 942 struct upgt_eeprom_option *eeprom_option; 943 uint16_t option_len; 944 uint16_t option_type; 945 uint16_t preamble_len; 946 int option_end = 0; 947 948 /* calculate eeprom options start offset */ 949 eeprom_header = (struct upgt_eeprom_header *)sc->sc_eeprom; 950 preamble_len = letoh16(eeprom_header->preamble_len); 951 eeprom_option = (struct upgt_eeprom_option *)(sc->sc_eeprom + 952 (sizeof(struct upgt_eeprom_header) + preamble_len)); 953 954 while (!option_end) { 955 /* the eeprom option length is stored in words */ 956 option_len = 957 (letoh16(eeprom_option->len) - 1) * sizeof(uint16_t); 958 option_type = 959 letoh16(eeprom_option->type); 960 961 switch (option_type) { 962 case UPGT_EEPROM_TYPE_NAME: 963 DPRINTF(1, "%s: EEPROM name len=%d\n", 964 sc->sc_dev.dv_xname, option_len); 965 break; 966 case UPGT_EEPROM_TYPE_SERIAL: 967 DPRINTF(1, "%s: EEPROM serial len=%d\n", 968 sc->sc_dev.dv_xname, option_len); 969 break; 970 case UPGT_EEPROM_TYPE_MAC: 971 DPRINTF(1, "%s: EEPROM mac len=%d\n", 972 sc->sc_dev.dv_xname, option_len); 973 974 IEEE80211_ADDR_COPY(ic->ic_myaddr, eeprom_option->data); 975 break; 976 case UPGT_EEPROM_TYPE_HWRX: 977 DPRINTF(1, "%s: EEPROM hwrx len=%d\n", 978 sc->sc_dev.dv_xname, option_len); 979 980 upgt_eeprom_parse_hwrx(sc, eeprom_option->data); 981 break; 982 case UPGT_EEPROM_TYPE_CHIP: 983 DPRINTF(1, "%s: EEPROM chip len=%d\n", 984 sc->sc_dev.dv_xname, option_len); 985 break; 986 case UPGT_EEPROM_TYPE_FREQ3: 987 DPRINTF(1, "%s: EEPROM freq3 len=%d\n", 988 sc->sc_dev.dv_xname, option_len); 989 990 upgt_eeprom_parse_freq3(sc, eeprom_option->data, 991 option_len); 992 break; 993 case UPGT_EEPROM_TYPE_FREQ4: 994 DPRINTF(1, "%s: EEPROM freq4 len=%d\n", 995 sc->sc_dev.dv_xname, option_len); 996 997 upgt_eeprom_parse_freq4(sc, eeprom_option->data, 998 option_len); 999 break; 1000 case UPGT_EEPROM_TYPE_FREQ5: 1001 DPRINTF(1, "%s: EEPROM freq5 len=%d\n", 1002 sc->sc_dev.dv_xname, option_len); 1003 break; 1004 case UPGT_EEPROM_TYPE_FREQ6: 1005 DPRINTF(1, "%s: EEPROM freq6 len=%d\n", 1006 sc->sc_dev.dv_xname, option_len); 1007 1008 upgt_eeprom_parse_freq6(sc, eeprom_option->data, 1009 option_len); 1010 break; 1011 case UPGT_EEPROM_TYPE_END: 1012 DPRINTF(1, "%s: EEPROM end len=%d\n", 1013 sc->sc_dev.dv_xname, option_len); 1014 option_end = 1; 1015 break; 1016 case UPGT_EEPROM_TYPE_OFF: 1017 DPRINTF(1, "%s: EEPROM off without end option!\n", 1018 sc->sc_dev.dv_xname); 1019 return (EIO); 1020 default: 1021 DPRINTF(1, "%s: EEPROM unknown type 0x%04x len=%d\n", 1022 sc->sc_dev.dv_xname, option_type, option_len); 1023 break; 1024 } 1025 1026 /* jump to next EEPROM option */ 1027 eeprom_option = (struct upgt_eeprom_option *) 1028 (eeprom_option->data + option_len); 1029 } 1030 1031 return (0); 1032 } 1033 1034 void 1035 upgt_eeprom_parse_hwrx(struct upgt_softc *sc, uint8_t *data) 1036 { 1037 struct upgt_eeprom_option_hwrx *option_hwrx; 1038 1039 option_hwrx = (struct upgt_eeprom_option_hwrx *)data; 1040 1041 sc->sc_eeprom_hwrx = option_hwrx->rxfilter - UPGT_EEPROM_RX_CONST; 1042 1043 DPRINTF(2, "%s: hwrx option value=0x%04x\n", 1044 sc->sc_dev.dv_xname, sc->sc_eeprom_hwrx); 1045 } 1046 1047 void 1048 upgt_eeprom_parse_freq3(struct upgt_softc *sc, uint8_t *data, int len) 1049 { 1050 struct upgt_eeprom_freq3_header *freq3_header; 1051 struct upgt_lmac_freq3 *freq3; 1052 int i, elements, flags; 1053 unsigned channel; 1054 1055 freq3_header = (struct upgt_eeprom_freq3_header *)data; 1056 freq3 = (struct upgt_lmac_freq3 *)(freq3_header + 1); 1057 1058 flags = freq3_header->flags; 1059 elements = freq3_header->elements; 1060 1061 DPRINTF(2, "%s: flags=0x%02x\n", sc->sc_dev.dv_xname, flags); 1062 DPRINTF(2, "%s: elements=%d\n", sc->sc_dev.dv_xname, elements); 1063 1064 for (i = 0; i < elements; i++) { 1065 channel = ieee80211_mhz2ieee(letoh16(freq3[i].freq), 0); 1066 1067 sc->sc_eeprom_freq3[channel] = freq3[i]; 1068 1069 DPRINTF(2, "%s: frequence=%d, channel=%d\n", 1070 sc->sc_dev.dv_xname, 1071 letoh16(sc->sc_eeprom_freq3[channel].freq), channel); 1072 } 1073 } 1074 1075 void 1076 upgt_eeprom_parse_freq4(struct upgt_softc *sc, uint8_t *data, int len) 1077 { 1078 struct upgt_eeprom_freq4_header *freq4_header; 1079 struct upgt_eeprom_freq4_1 *freq4_1; 1080 struct upgt_eeprom_freq4_2 *freq4_2; 1081 int i, j, elements, settings, flags; 1082 unsigned channel; 1083 1084 freq4_header = (struct upgt_eeprom_freq4_header *)data; 1085 freq4_1 = (struct upgt_eeprom_freq4_1 *)(freq4_header + 1); 1086 1087 flags = freq4_header->flags; 1088 elements = freq4_header->elements; 1089 settings = freq4_header->settings; 1090 1091 /* we need this value later */ 1092 sc->sc_eeprom_freq6_settings = freq4_header->settings; 1093 1094 DPRINTF(2, "%s: flags=0x%02x\n", sc->sc_dev.dv_xname, flags); 1095 DPRINTF(2, "%s: elements=%d\n", sc->sc_dev.dv_xname, elements); 1096 DPRINTF(2, "%s: settings=%d\n", sc->sc_dev.dv_xname, settings); 1097 1098 for (i = 0; i < elements; i++) { 1099 channel = ieee80211_mhz2ieee(letoh16(freq4_1[i].freq), 0); 1100 1101 freq4_2 = (struct upgt_eeprom_freq4_2 *)freq4_1[i].data; 1102 1103 for (j = 0; j < settings; j++) { 1104 sc->sc_eeprom_freq4[channel][j].cmd = freq4_2[j]; 1105 sc->sc_eeprom_freq4[channel][j].pad = 0; 1106 } 1107 1108 DPRINTF(2, "%s: frequence=%d, channel=%d\n", 1109 sc->sc_dev.dv_xname, 1110 letoh16(freq4_1[i].freq), channel); 1111 } 1112 } 1113 1114 void 1115 upgt_eeprom_parse_freq6(struct upgt_softc *sc, uint8_t *data, int len) 1116 { 1117 struct upgt_lmac_freq6 *freq6; 1118 int i, elements; 1119 unsigned channel; 1120 1121 freq6 = (struct upgt_lmac_freq6 *)data; 1122 1123 elements = len / sizeof(struct upgt_lmac_freq6); 1124 1125 DPRINTF(2, "%s: elements=%d\n", sc->sc_dev.dv_xname, elements); 1126 1127 for (i = 0; i < elements; i++) { 1128 channel = ieee80211_mhz2ieee(letoh16(freq6[i].freq), 0); 1129 1130 sc->sc_eeprom_freq6[channel] = freq6[i]; 1131 1132 DPRINTF(2, "%s: frequence=%d, channel=%d\n", 1133 sc->sc_dev.dv_xname, 1134 letoh16(sc->sc_eeprom_freq6[channel].freq), channel); 1135 } 1136 } 1137 1138 int 1139 upgt_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 1140 { 1141 struct upgt_softc *sc = ifp->if_softc; 1142 struct ieee80211com *ic = &sc->sc_ic; 1143 struct ifaddr *ifa; 1144 struct ifreq *ifr; 1145 int s, error = 0; 1146 uint8_t chan; 1147 1148 s = splnet(); 1149 1150 switch (cmd) { 1151 case SIOCSIFADDR: 1152 ifa = (struct ifaddr *)data; 1153 ifp->if_flags |= IFF_UP; 1154 #ifdef INET 1155 if (ifa->ifa_addr->sa_family == AF_INET) 1156 arp_ifinit(&ic->ic_ac, ifa); 1157 #endif 1158 /* FALLTHROUGH */ 1159 case SIOCSIFFLAGS: 1160 if (ifp->if_flags & IFF_UP) { 1161 if ((ifp->if_flags & IFF_RUNNING) == 0) 1162 upgt_init(ifp); 1163 } else { 1164 if (ifp->if_flags & IFF_RUNNING) 1165 upgt_stop(sc); 1166 } 1167 break; 1168 case SIOCADDMULTI: 1169 case SIOCDELMULTI: 1170 ifr = (struct ifreq *)data; 1171 error = (cmd == SIOCADDMULTI) ? 1172 ether_addmulti(ifr, &ic->ic_ac) : 1173 ether_delmulti(ifr, &ic->ic_ac); 1174 if (error == ENETRESET) 1175 error = 0; 1176 break; 1177 case SIOCS80211CHANNEL: 1178 /* allow fast channel switching in monitor mode */ 1179 error = ieee80211_ioctl(ifp, cmd, data); 1180 if (error == ENETRESET && 1181 ic->ic_opmode == IEEE80211_M_MONITOR) { 1182 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == 1183 (IFF_UP | IFF_RUNNING)) { 1184 ic->ic_bss->ni_chan = ic->ic_ibss_chan; 1185 chan = ieee80211_chan2ieee(ic, 1186 ic->ic_bss->ni_chan); 1187 upgt_set_channel(sc, chan); 1188 } 1189 error = 0; 1190 } 1191 break; 1192 default: 1193 error = ieee80211_ioctl(ifp, cmd, data); 1194 break; 1195 } 1196 1197 if (error == ENETRESET) { 1198 if (ifp->if_flags & (IFF_UP | IFF_RUNNING)) 1199 upgt_init(ifp); 1200 error = 0; 1201 } 1202 1203 splx(s); 1204 1205 return (error); 1206 } 1207 1208 int 1209 upgt_init(struct ifnet *ifp) 1210 { 1211 struct upgt_softc *sc = ifp->if_softc; 1212 struct ieee80211com *ic = &sc->sc_ic; 1213 1214 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__); 1215 1216 IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl)); 1217 1218 /* select default channel */ 1219 ic->ic_bss->ni_chan = ic->ic_ibss_chan; 1220 sc->sc_cur_chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan); 1221 1222 /* setup device rates */ 1223 upgt_setup_rates(sc); 1224 1225 ifp->if_flags |= IFF_RUNNING; 1226 ifp->if_flags &= ~IFF_OACTIVE; 1227 1228 upgt_set_macfilter(sc, IEEE80211_S_SCAN); 1229 1230 if (ic->ic_opmode == IEEE80211_M_MONITOR) { 1231 upgt_set_channel(sc, sc->sc_cur_chan); 1232 ieee80211_new_state(ic, IEEE80211_S_RUN, -1); 1233 } else 1234 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1); 1235 1236 return (0); 1237 } 1238 1239 void 1240 upgt_stop(struct upgt_softc *sc) 1241 { 1242 struct ieee80211com *ic = &sc->sc_ic; 1243 struct ifnet *ifp = &ic->ic_if; 1244 1245 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__); 1246 1247 /* device down */ 1248 ifp->if_timer = 0; 1249 ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE); 1250 1251 upgt_set_led(sc, UPGT_LED_OFF); 1252 1253 /* change device back to initial state */ 1254 ieee80211_new_state(ic, IEEE80211_S_INIT, -1); 1255 } 1256 1257 int 1258 upgt_media_change(struct ifnet *ifp) 1259 { 1260 struct upgt_softc *sc = ifp->if_softc; 1261 int error; 1262 1263 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__); 1264 1265 if ((error = ieee80211_media_change(ifp) != ENETRESET)) 1266 return (error); 1267 1268 if (ifp->if_flags & (IFF_UP | IFF_RUNNING)) { 1269 /* give pending USB transfers a chance to finish */ 1270 usbd_delay_ms(sc->sc_udev, 100); 1271 upgt_init(ifp); 1272 } 1273 1274 return (0); 1275 } 1276 1277 void 1278 upgt_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew) 1279 { 1280 ni->ni_txrate = 0; 1281 } 1282 1283 int 1284 upgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg) 1285 { 1286 struct upgt_softc *sc = ic->ic_if.if_softc; 1287 1288 usb_rem_task(sc->sc_udev, &sc->sc_task_newstate); 1289 timeout_del(&sc->scan_to); 1290 1291 /* do it in a process context */ 1292 sc->sc_state = nstate; 1293 sc->sc_arg = arg; 1294 usb_add_task(sc->sc_udev, &sc->sc_task_newstate); 1295 1296 return (0); 1297 } 1298 1299 void 1300 upgt_newstate_task(void *arg) 1301 { 1302 struct upgt_softc *sc = arg; 1303 struct ieee80211com *ic = &sc->sc_ic; 1304 struct ieee80211_node *ni; 1305 unsigned channel; 1306 1307 switch (sc->sc_state) { 1308 case IEEE80211_S_INIT: 1309 DPRINTF(1, "%s: newstate is IEEE80211_S_INIT\n", 1310 sc->sc_dev.dv_xname); 1311 1312 /* do not accept any frames if the device is down */ 1313 upgt_set_macfilter(sc, IEEE80211_S_INIT); 1314 upgt_set_led(sc, UPGT_LED_OFF); 1315 break; 1316 case IEEE80211_S_SCAN: 1317 DPRINTF(1, "%s: newstate is IEEE80211_S_SCAN\n", 1318 sc->sc_dev.dv_xname); 1319 1320 channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan); 1321 upgt_set_channel(sc, channel); 1322 timeout_add_msec(&sc->scan_to, 200); 1323 break; 1324 case IEEE80211_S_AUTH: 1325 DPRINTF(1, "%s: newstate is IEEE80211_S_AUTH\n", 1326 sc->sc_dev.dv_xname); 1327 1328 channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan); 1329 upgt_set_channel(sc, channel); 1330 break; 1331 case IEEE80211_S_ASSOC: 1332 DPRINTF(1, "%s: newstate is IEEE80211_S_ASSOC\n", 1333 sc->sc_dev.dv_xname); 1334 break; 1335 case IEEE80211_S_RUN: 1336 DPRINTF(1, "%s: newstate is IEEE80211_S_RUN\n", 1337 sc->sc_dev.dv_xname); 1338 1339 ni = ic->ic_bss; 1340 1341 /* 1342 * TX rate control is done by the firmware. 1343 * Report the maximum rate which is available therefore. 1344 */ 1345 ni->ni_txrate = ni->ni_rates.rs_nrates - 1; 1346 1347 if (ic->ic_opmode != IEEE80211_M_MONITOR) 1348 upgt_set_macfilter(sc, IEEE80211_S_RUN); 1349 upgt_set_led(sc, UPGT_LED_ON); 1350 break; 1351 } 1352 1353 sc->sc_newstate(ic, sc->sc_state, sc->sc_arg); 1354 } 1355 1356 void 1357 upgt_next_scan(void *arg) 1358 { 1359 struct upgt_softc *sc = arg; 1360 struct ieee80211com *ic = &sc->sc_ic; 1361 struct ifnet *ifp = &ic->ic_if; 1362 1363 DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__); 1364 1365 if (ic->ic_state == IEEE80211_S_SCAN) 1366 ieee80211_next_scan(ifp); 1367 } 1368 1369 void 1370 upgt_start(struct ifnet *ifp) 1371 { 1372 struct upgt_softc *sc = ifp->if_softc; 1373 struct ieee80211com *ic = &sc->sc_ic; 1374 struct ieee80211_node *ni; 1375 struct mbuf *m; 1376 int i; 1377 1378 /* don't transmit packets if interface is busy or down */ 1379 if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING) 1380 return; 1381 1382 DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__); 1383 1384 for (i = 0; i < UPGT_TX_COUNT; i++) { 1385 struct upgt_data *data_tx = &sc->tx_data[i]; 1386 1387 IF_POLL(&ic->ic_mgtq, m); 1388 if (m != NULL) { 1389 /* management frame */ 1390 IF_DEQUEUE(&ic->ic_mgtq, m); 1391 1392 ni = m->m_pkthdr.ph_cookie; 1393 #if NBPFILTER > 0 1394 if (ic->ic_rawbpf != NULL) 1395 bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT); 1396 #endif 1397 if ((data_tx->addr = upgt_mem_alloc(sc)) == 0) { 1398 printf("%s: no free prism memory!\n", 1399 sc->sc_dev.dv_xname); 1400 return; 1401 } 1402 data_tx->ni = ni; 1403 data_tx->m = m; 1404 sc->tx_queued++; 1405 } else { 1406 /* data frame */ 1407 if (ic->ic_state != IEEE80211_S_RUN) 1408 break; 1409 1410 IFQ_POLL(&ifp->if_snd, m); 1411 if (m == NULL) 1412 break; 1413 1414 IFQ_DEQUEUE(&ifp->if_snd, m); 1415 #if NBPFILTER > 0 1416 if (ifp->if_bpf != NULL) 1417 bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT); 1418 #endif 1419 m = ieee80211_encap(ifp, m, &ni); 1420 if (m == NULL) 1421 continue; 1422 #if NBPFILTER > 0 1423 if (ic->ic_rawbpf != NULL) 1424 bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT); 1425 #endif 1426 if ((data_tx->addr = upgt_mem_alloc(sc)) == 0) { 1427 printf("%s: no free prism memory!\n", 1428 sc->sc_dev.dv_xname); 1429 return; 1430 } 1431 data_tx->ni = ni; 1432 data_tx->m = m; 1433 sc->tx_queued++; 1434 } 1435 } 1436 1437 if (sc->tx_queued > 0) { 1438 DPRINTF(2, "%s: tx_queued=%d\n", 1439 sc->sc_dev.dv_xname, sc->tx_queued); 1440 /* process the TX queue in process context */ 1441 ifp->if_timer = 5; 1442 ifp->if_flags |= IFF_OACTIVE; 1443 usb_rem_task(sc->sc_udev, &sc->sc_task_tx); 1444 usb_add_task(sc->sc_udev, &sc->sc_task_tx); 1445 } 1446 } 1447 1448 void 1449 upgt_watchdog(struct ifnet *ifp) 1450 { 1451 struct upgt_softc *sc = ifp->if_softc; 1452 struct ieee80211com *ic = &sc->sc_ic; 1453 1454 if (ic->ic_state == IEEE80211_S_INIT) 1455 return; 1456 1457 printf("%s: watchdog timeout!\n", sc->sc_dev.dv_xname); 1458 1459 /* TODO: what shall we do on TX timeout? */ 1460 1461 ieee80211_watchdog(ifp); 1462 } 1463 1464 void 1465 upgt_tx_task(void *arg) 1466 { 1467 struct upgt_softc *sc = arg; 1468 struct ieee80211com *ic = &sc->sc_ic; 1469 struct ieee80211_frame *wh; 1470 struct ieee80211_key *k; 1471 struct upgt_lmac_mem *mem; 1472 struct upgt_lmac_tx_desc *txdesc; 1473 struct mbuf *m; 1474 uint32_t addr; 1475 int len, i, s; 1476 usbd_status error; 1477 1478 s = splusb(); 1479 1480 upgt_set_led(sc, UPGT_LED_BLINK); 1481 1482 for (i = 0; i < UPGT_TX_COUNT; i++) { 1483 struct upgt_data *data_tx = &sc->tx_data[i]; 1484 1485 if (data_tx->m == NULL) { 1486 DPRINTF(2, "%s: %d: m is NULL\n", 1487 sc->sc_dev.dv_xname, i); 1488 continue; 1489 } 1490 1491 m = data_tx->m; 1492 addr = data_tx->addr + UPGT_MEMSIZE_FRAME_HEAD; 1493 1494 /* 1495 * Software crypto. 1496 */ 1497 wh = mtod(m, struct ieee80211_frame *); 1498 1499 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) { 1500 k = ieee80211_get_txkey(ic, wh, ic->ic_bss); 1501 1502 if ((m = ieee80211_encrypt(ic, m, k)) == NULL) 1503 return; 1504 1505 /* in case packet header moved, reset pointer */ 1506 wh = mtod(m, struct ieee80211_frame *); 1507 } 1508 1509 /* 1510 * Transmit the URB containing the TX data. 1511 */ 1512 bzero(data_tx->buf, MCLBYTES); 1513 1514 mem = (struct upgt_lmac_mem *)data_tx->buf; 1515 mem->addr = htole32(addr); 1516 1517 txdesc = (struct upgt_lmac_tx_desc *)(mem + 1); 1518 1519 /* XXX differ between data and mgmt frames? */ 1520 txdesc->header1.flags = UPGT_H1_FLAGS_TX_DATA; 1521 txdesc->header1.type = UPGT_H1_TYPE_TX_DATA; 1522 txdesc->header1.len = htole16(m->m_pkthdr.len); 1523 1524 txdesc->header2.reqid = htole32(data_tx->addr); 1525 txdesc->header2.type = htole16(UPGT_H2_TYPE_TX_ACK_YES); 1526 txdesc->header2.flags = htole16(UPGT_H2_FLAGS_TX_ACK_YES); 1527 1528 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == 1529 IEEE80211_FC0_TYPE_MGT) { 1530 /* always send mgmt frames at lowest rate (DS1) */ 1531 memset(txdesc->rates, 0x10, sizeof(txdesc->rates)); 1532 } else { 1533 bcopy(sc->sc_cur_rateset, txdesc->rates, 1534 sizeof(txdesc->rates)); 1535 } 1536 txdesc->type = htole32(UPGT_TX_DESC_TYPE_DATA); 1537 txdesc->pad3[0] = UPGT_TX_DESC_PAD3_SIZE; 1538 1539 #if NBPFILTER > 0 1540 if (sc->sc_drvbpf != NULL) { 1541 struct mbuf mb; 1542 struct upgt_tx_radiotap_header *tap = &sc->sc_txtap; 1543 1544 tap->wt_flags = 0; 1545 tap->wt_rate = 0; /* TODO: where to get from? */ 1546 tap->wt_chan_freq = 1547 htole16(ic->ic_bss->ni_chan->ic_freq); 1548 tap->wt_chan_flags = 1549 htole16(ic->ic_bss->ni_chan->ic_flags); 1550 1551 mb.m_data = (caddr_t)tap; 1552 mb.m_len = sc->sc_txtap_len; 1553 mb.m_next = m; 1554 mb.m_nextpkt = NULL; 1555 mb.m_type = 0; 1556 mb.m_flags = 0; 1557 bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT); 1558 } 1559 #endif 1560 /* copy frame below our TX descriptor header */ 1561 m_copydata(m, 0, m->m_pkthdr.len, 1562 data_tx->buf + (sizeof(*mem) + sizeof(*txdesc))); 1563 1564 /* calculate frame size */ 1565 len = sizeof(*mem) + sizeof(*txdesc) + m->m_pkthdr.len; 1566 1567 /* we need to align the frame to a 4 byte boundary */ 1568 len = (len + 3) & ~3; 1569 1570 /* calculate frame checksum */ 1571 mem->chksum = upgt_chksum_le((uint32_t *)txdesc, 1572 len - sizeof(*mem)); 1573 1574 /* we do not need the mbuf anymore */ 1575 m_freem(m); 1576 data_tx->m = NULL; 1577 1578 DPRINTF(2, "%s: TX start data sending\n", sc->sc_dev.dv_xname); 1579 1580 usbd_setup_xfer(data_tx->xfer, sc->sc_tx_pipeh, data_tx, 1581 data_tx->buf, len, USBD_FORCE_SHORT_XFER | USBD_NO_COPY, 1582 UPGT_USB_TIMEOUT, NULL); 1583 error = usbd_transfer(data_tx->xfer); 1584 if (error != 0 && error != USBD_IN_PROGRESS) { 1585 printf("%s: could not transmit TX data URB!\n", 1586 sc->sc_dev.dv_xname); 1587 return; 1588 } 1589 1590 DPRINTF(2, "%s: TX sent (%d bytes)\n", 1591 sc->sc_dev.dv_xname, len); 1592 } 1593 1594 /* 1595 * If we don't regulary read the device statistics, the RX queue 1596 * will stall. It's strange, but it works, so we keep reading 1597 * the statistics here. *shrug* 1598 */ 1599 upgt_get_stats(sc); 1600 1601 splx(s); 1602 } 1603 1604 void 1605 upgt_tx_done(struct upgt_softc *sc, uint8_t *data) 1606 { 1607 struct ieee80211com *ic = &sc->sc_ic; 1608 struct ifnet *ifp = &ic->ic_if; 1609 struct upgt_lmac_tx_done_desc *desc; 1610 int i, s; 1611 1612 s = splnet(); 1613 1614 desc = (struct upgt_lmac_tx_done_desc *)data; 1615 1616 for (i = 0; i < UPGT_TX_COUNT; i++) { 1617 struct upgt_data *data_tx = &sc->tx_data[i]; 1618 1619 if (data_tx->addr == letoh32(desc->header2.reqid)) { 1620 upgt_mem_free(sc, data_tx->addr); 1621 ieee80211_release_node(ic, data_tx->ni); 1622 data_tx->ni = NULL; 1623 data_tx->addr = 0; 1624 1625 sc->tx_queued--; 1626 ifp->if_opackets++; 1627 1628 DPRINTF(2, "%s: TX done: ", sc->sc_dev.dv_xname); 1629 DPRINTF(2, "memaddr=0x%08x, status=0x%04x, rssi=%d, ", 1630 letoh32(desc->header2.reqid), 1631 letoh16(desc->status), 1632 letoh16(desc->rssi)); 1633 DPRINTF(2, "seq=%d\n", letoh16(desc->seq)); 1634 break; 1635 } 1636 } 1637 1638 if (sc->tx_queued == 0) { 1639 /* TX queued was processed, continue */ 1640 ifp->if_timer = 0; 1641 ifp->if_flags &= ~IFF_OACTIVE; 1642 upgt_start(ifp); 1643 } 1644 1645 splx(s); 1646 } 1647 1648 void 1649 upgt_rx_cb(struct usbd_xfer *xfer, void *priv, usbd_status status) 1650 { 1651 struct upgt_data *data_rx = priv; 1652 struct upgt_softc *sc = data_rx->sc; 1653 int len; 1654 struct upgt_lmac_header *header; 1655 struct upgt_lmac_eeprom *eeprom; 1656 uint8_t h1_type; 1657 uint16_t h2_type; 1658 1659 DPRINTF(3, "%s: %s\n", sc->sc_dev.dv_xname, __func__); 1660 1661 if (status != USBD_NORMAL_COMPLETION) { 1662 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED) 1663 return; 1664 if (status == USBD_STALLED) 1665 usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh); 1666 goto skip; 1667 } 1668 usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL); 1669 1670 /* 1671 * Check what type of frame came in. 1672 */ 1673 header = (struct upgt_lmac_header *)(data_rx->buf + 4); 1674 1675 h1_type = header->header1.type; 1676 h2_type = letoh16(header->header2.type); 1677 1678 if (h1_type == UPGT_H1_TYPE_CTRL && 1679 h2_type == UPGT_H2_TYPE_EEPROM) { 1680 eeprom = (struct upgt_lmac_eeprom *)(data_rx->buf + 4); 1681 uint16_t eeprom_offset = letoh16(eeprom->offset); 1682 uint16_t eeprom_len = letoh16(eeprom->len); 1683 1684 DPRINTF(2, "%s: received EEPROM block (offset=%d, len=%d)\n", 1685 sc->sc_dev.dv_xname, eeprom_offset, eeprom_len); 1686 1687 bcopy(data_rx->buf + sizeof(struct upgt_lmac_eeprom) + 4, 1688 sc->sc_eeprom + eeprom_offset, eeprom_len); 1689 1690 /* EEPROM data has arrived in time, wakeup tsleep() */ 1691 wakeup(sc); 1692 } else 1693 if (h1_type == UPGT_H1_TYPE_CTRL && 1694 h2_type == UPGT_H2_TYPE_TX_DONE) { 1695 DPRINTF(2, "%s: received 802.11 TX done\n", 1696 sc->sc_dev.dv_xname); 1697 1698 upgt_tx_done(sc, data_rx->buf + 4); 1699 } else 1700 if (h1_type == UPGT_H1_TYPE_RX_DATA || 1701 h1_type == UPGT_H1_TYPE_RX_DATA_MGMT) { 1702 DPRINTF(3, "%s: received 802.11 RX data\n", 1703 sc->sc_dev.dv_xname); 1704 1705 upgt_rx(sc, data_rx->buf + 4, letoh16(header->header1.len)); 1706 } else 1707 if (h1_type == UPGT_H1_TYPE_CTRL && 1708 h2_type == UPGT_H2_TYPE_STATS) { 1709 DPRINTF(2, "%s: received statistic data\n", 1710 sc->sc_dev.dv_xname); 1711 1712 /* TODO: what could we do with the statistic data? */ 1713 } else { 1714 /* ignore unknown frame types */ 1715 DPRINTF(1, "%s: received unknown frame type 0x%02x\n", 1716 sc->sc_dev.dv_xname, header->header1.type); 1717 } 1718 1719 skip: /* setup new transfer */ 1720 usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data_rx, data_rx->buf, MCLBYTES, 1721 USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, upgt_rx_cb); 1722 (void)usbd_transfer(xfer); 1723 } 1724 1725 void 1726 upgt_rx(struct upgt_softc *sc, uint8_t *data, int pkglen) 1727 { 1728 struct ieee80211com *ic = &sc->sc_ic; 1729 struct ifnet *ifp = &ic->ic_if; 1730 struct upgt_lmac_rx_desc *rxdesc; 1731 struct ieee80211_frame *wh; 1732 struct ieee80211_rxinfo rxi; 1733 struct ieee80211_node *ni; 1734 struct mbuf *m; 1735 int s; 1736 1737 /* access RX packet descriptor */ 1738 rxdesc = (struct upgt_lmac_rx_desc *)data; 1739 1740 /* create mbuf which is suitable for strict alignment archs */ 1741 m = m_devget(rxdesc->data, pkglen, ETHER_ALIGN, ifp); 1742 if (m == NULL) { 1743 DPRINTF(1, "%s: could not create RX mbuf!\n", sc->sc_dev.dv_xname); 1744 ifp->if_ierrors++; 1745 return; 1746 } 1747 1748 s = splnet(); 1749 1750 #if NBPFILTER > 0 1751 if (sc->sc_drvbpf != NULL) { 1752 struct mbuf mb; 1753 struct upgt_rx_radiotap_header *tap = &sc->sc_rxtap; 1754 1755 tap->wr_flags = IEEE80211_RADIOTAP_F_FCS; 1756 tap->wr_rate = upgt_rx_rate(sc, rxdesc->rate); 1757 tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq); 1758 tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags); 1759 tap->wr_antsignal = rxdesc->rssi; 1760 1761 mb.m_data = (caddr_t)tap; 1762 mb.m_len = sc->sc_rxtap_len; 1763 mb.m_next = m; 1764 mb.m_nextpkt = NULL; 1765 mb.m_type = 0; 1766 mb.m_flags = 0; 1767 bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN); 1768 } 1769 #endif 1770 /* trim FCS */ 1771 m_adj(m, -IEEE80211_CRC_LEN); 1772 1773 wh = mtod(m, struct ieee80211_frame *); 1774 ni = ieee80211_find_rxnode(ic, wh); 1775 1776 /* push the frame up to the 802.11 stack */ 1777 rxi.rxi_flags = 0; 1778 rxi.rxi_rssi = rxdesc->rssi; 1779 rxi.rxi_tstamp = 0; /* unused */ 1780 ieee80211_input(ifp, m, ni, &rxi); 1781 1782 /* node is no longer needed */ 1783 ieee80211_release_node(ic, ni); 1784 1785 splx(s); 1786 1787 DPRINTF(3, "%s: RX done\n", sc->sc_dev.dv_xname); 1788 } 1789 1790 void 1791 upgt_setup_rates(struct upgt_softc *sc) 1792 { 1793 struct ieee80211com *ic = &sc->sc_ic; 1794 1795 /* 1796 * 0x01 = OFMD6 0x10 = DS1 1797 * 0x04 = OFDM9 0x11 = DS2 1798 * 0x06 = OFDM12 0x12 = DS5 1799 * 0x07 = OFDM18 0x13 = DS11 1800 * 0x08 = OFDM24 1801 * 0x09 = OFDM36 1802 * 0x0a = OFDM48 1803 * 0x0b = OFDM54 1804 */ 1805 const uint8_t rateset_auto_11b[] = 1806 { 0x13, 0x13, 0x12, 0x11, 0x11, 0x10, 0x10, 0x10 }; 1807 const uint8_t rateset_auto_11g[] = 1808 { 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x04, 0x01 }; 1809 const uint8_t rateset_fix_11bg[] = 1810 { 0x10, 0x11, 0x12, 0x13, 0x01, 0x04, 0x06, 0x07, 1811 0x08, 0x09, 0x0a, 0x0b }; 1812 1813 if (ic->ic_fixed_rate == -1) { 1814 /* 1815 * Automatic rate control is done by the device. 1816 * We just pass the rateset from which the device 1817 * will pickup a rate. 1818 */ 1819 if (ic->ic_curmode == IEEE80211_MODE_11B) 1820 bcopy(rateset_auto_11b, sc->sc_cur_rateset, 1821 sizeof(sc->sc_cur_rateset)); 1822 if (ic->ic_curmode == IEEE80211_MODE_11G || 1823 ic->ic_curmode == IEEE80211_MODE_AUTO) 1824 bcopy(rateset_auto_11g, sc->sc_cur_rateset, 1825 sizeof(sc->sc_cur_rateset)); 1826 } else { 1827 /* set a fixed rate */ 1828 memset(sc->sc_cur_rateset, rateset_fix_11bg[ic->ic_fixed_rate], 1829 sizeof(sc->sc_cur_rateset)); 1830 } 1831 } 1832 1833 uint8_t 1834 upgt_rx_rate(struct upgt_softc *sc, const int rate) 1835 { 1836 struct ieee80211com *ic = &sc->sc_ic; 1837 1838 if (ic->ic_curmode == IEEE80211_MODE_11B) { 1839 if (rate < 0 || rate > 3) 1840 /* invalid rate */ 1841 return (0); 1842 1843 switch (rate) { 1844 case 0: 1845 return (2); 1846 case 1: 1847 return (4); 1848 case 2: 1849 return (11); 1850 case 3: 1851 return (22); 1852 default: 1853 return (0); 1854 } 1855 } 1856 1857 if (ic->ic_curmode == IEEE80211_MODE_11G) { 1858 if (rate < 0 || rate > 11) 1859 /* invalid rate */ 1860 return (0); 1861 1862 switch (rate) { 1863 case 0: 1864 return (2); 1865 case 1: 1866 return (4); 1867 case 2: 1868 return (11); 1869 case 3: 1870 return (22); 1871 case 4: 1872 return (12); 1873 case 5: 1874 return (18); 1875 case 6: 1876 return (24); 1877 case 7: 1878 return (36); 1879 case 8: 1880 return (48); 1881 case 9: 1882 return (72); 1883 case 10: 1884 return (96); 1885 case 11: 1886 return (108); 1887 default: 1888 return (0); 1889 } 1890 } 1891 1892 return (0); 1893 } 1894 1895 int 1896 upgt_set_macfilter(struct upgt_softc *sc, uint8_t state) 1897 { 1898 struct ieee80211com *ic = &sc->sc_ic; 1899 struct ieee80211_node *ni = ic->ic_bss; 1900 struct upgt_data *data_cmd = &sc->cmd_data; 1901 struct upgt_lmac_mem *mem; 1902 struct upgt_lmac_filter *filter; 1903 int len; 1904 uint8_t broadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 1905 1906 /* 1907 * Transmit the URB containing the CMD data. 1908 */ 1909 bzero(data_cmd->buf, MCLBYTES); 1910 1911 mem = (struct upgt_lmac_mem *)data_cmd->buf; 1912 mem->addr = htole32(sc->sc_memaddr_frame_start + 1913 UPGT_MEMSIZE_FRAME_HEAD); 1914 1915 filter = (struct upgt_lmac_filter *)(mem + 1); 1916 1917 filter->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK; 1918 filter->header1.type = UPGT_H1_TYPE_CTRL; 1919 filter->header1.len = htole16( 1920 sizeof(struct upgt_lmac_filter) - 1921 sizeof(struct upgt_lmac_header)); 1922 1923 filter->header2.reqid = htole32(sc->sc_memaddr_frame_start); 1924 filter->header2.type = htole16(UPGT_H2_TYPE_MACFILTER); 1925 filter->header2.flags = 0; 1926 1927 switch (state) { 1928 case IEEE80211_S_INIT: 1929 DPRINTF(1, "%s: set MAC filter to INIT\n", 1930 sc->sc_dev.dv_xname); 1931 1932 filter->type = htole16(UPGT_FILTER_TYPE_RESET); 1933 break; 1934 case IEEE80211_S_SCAN: 1935 DPRINTF(1, "%s: set MAC filter to SCAN (bssid %s)\n", 1936 sc->sc_dev.dv_xname, ether_sprintf(broadcast)); 1937 1938 filter->type = htole16(UPGT_FILTER_TYPE_NONE); 1939 IEEE80211_ADDR_COPY(filter->dst, ic->ic_myaddr); 1940 IEEE80211_ADDR_COPY(filter->src, broadcast); 1941 filter->unknown1 = htole16(UPGT_FILTER_UNKNOWN1); 1942 filter->rxaddr = htole32(sc->sc_memaddr_rx_start); 1943 filter->unknown2 = htole16(UPGT_FILTER_UNKNOWN2); 1944 filter->rxhw = htole32(sc->sc_eeprom_hwrx); 1945 filter->unknown3 = htole16(UPGT_FILTER_UNKNOWN3); 1946 break; 1947 case IEEE80211_S_RUN: 1948 DPRINTF(1, "%s: set MAC filter to RUN (bssid %s)\n", 1949 sc->sc_dev.dv_xname, ether_sprintf(ni->ni_bssid)); 1950 1951 filter->type = htole16(UPGT_FILTER_TYPE_STA); 1952 IEEE80211_ADDR_COPY(filter->dst, ic->ic_myaddr); 1953 IEEE80211_ADDR_COPY(filter->src, ni->ni_bssid); 1954 filter->unknown1 = htole16(UPGT_FILTER_UNKNOWN1); 1955 filter->rxaddr = htole32(sc->sc_memaddr_rx_start); 1956 filter->unknown2 = htole16(UPGT_FILTER_UNKNOWN2); 1957 filter->rxhw = htole32(sc->sc_eeprom_hwrx); 1958 filter->unknown3 = htole16(UPGT_FILTER_UNKNOWN3); 1959 break; 1960 default: 1961 printf("%s: MAC filter does not know that state!\n", 1962 sc->sc_dev.dv_xname); 1963 break; 1964 } 1965 1966 len = sizeof(*mem) + sizeof(*filter); 1967 1968 mem->chksum = upgt_chksum_le((uint32_t *)filter, 1969 len - sizeof(*mem)); 1970 1971 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 1972 printf("%s: could not transmit macfilter CMD data URB!\n", 1973 sc->sc_dev.dv_xname); 1974 return (EIO); 1975 } 1976 1977 return (0); 1978 } 1979 1980 int 1981 upgt_set_channel(struct upgt_softc *sc, unsigned channel) 1982 { 1983 struct upgt_data *data_cmd = &sc->cmd_data; 1984 struct upgt_lmac_mem *mem; 1985 struct upgt_lmac_channel *chan; 1986 int len; 1987 1988 DPRINTF(1, "%s: %s: %d\n", sc->sc_dev.dv_xname, __func__, channel); 1989 1990 /* 1991 * Transmit the URB containing the CMD data. 1992 */ 1993 bzero(data_cmd->buf, MCLBYTES); 1994 1995 mem = (struct upgt_lmac_mem *)data_cmd->buf; 1996 mem->addr = htole32(sc->sc_memaddr_frame_start + 1997 UPGT_MEMSIZE_FRAME_HEAD); 1998 1999 chan = (struct upgt_lmac_channel *)(mem + 1); 2000 2001 chan->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK; 2002 chan->header1.type = UPGT_H1_TYPE_CTRL; 2003 chan->header1.len = htole16( 2004 sizeof(struct upgt_lmac_channel) - 2005 sizeof(struct upgt_lmac_header)); 2006 2007 chan->header2.reqid = htole32(sc->sc_memaddr_frame_start); 2008 chan->header2.type = htole16(UPGT_H2_TYPE_CHANNEL); 2009 chan->header2.flags = 0; 2010 2011 chan->unknown1 = htole16(UPGT_CHANNEL_UNKNOWN1); 2012 chan->unknown2 = htole16(UPGT_CHANNEL_UNKNOWN2); 2013 chan->freq6 = sc->sc_eeprom_freq6[channel]; 2014 chan->settings = sc->sc_eeprom_freq6_settings; 2015 chan->unknown3 = UPGT_CHANNEL_UNKNOWN3; 2016 2017 bcopy(&sc->sc_eeprom_freq3[channel].data, chan->freq3_1, 2018 sizeof(chan->freq3_1)); 2019 2020 bcopy(&sc->sc_eeprom_freq4[channel], chan->freq4, 2021 sizeof(sc->sc_eeprom_freq4[channel])); 2022 2023 bcopy(&sc->sc_eeprom_freq3[channel].data, chan->freq3_2, 2024 sizeof(chan->freq3_2)); 2025 2026 len = sizeof(*mem) + sizeof(*chan); 2027 2028 mem->chksum = upgt_chksum_le((uint32_t *)chan, 2029 len - sizeof(*mem)); 2030 2031 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 2032 printf("%s: could not transmit channel CMD data URB!\n", 2033 sc->sc_dev.dv_xname); 2034 return (EIO); 2035 } 2036 2037 return (0); 2038 } 2039 2040 void 2041 upgt_set_led(struct upgt_softc *sc, int action) 2042 { 2043 struct ieee80211com *ic = &sc->sc_ic; 2044 struct upgt_data *data_cmd = &sc->cmd_data; 2045 struct upgt_lmac_mem *mem; 2046 struct upgt_lmac_led *led; 2047 struct timeval t; 2048 int len; 2049 2050 /* 2051 * Transmit the URB containing the CMD data. 2052 */ 2053 bzero(data_cmd->buf, MCLBYTES); 2054 2055 mem = (struct upgt_lmac_mem *)data_cmd->buf; 2056 mem->addr = htole32(sc->sc_memaddr_frame_start + 2057 UPGT_MEMSIZE_FRAME_HEAD); 2058 2059 led = (struct upgt_lmac_led *)(mem + 1); 2060 2061 led->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK; 2062 led->header1.type = UPGT_H1_TYPE_CTRL; 2063 led->header1.len = htole16( 2064 sizeof(struct upgt_lmac_led) - 2065 sizeof(struct upgt_lmac_header)); 2066 2067 led->header2.reqid = htole32(sc->sc_memaddr_frame_start); 2068 led->header2.type = htole16(UPGT_H2_TYPE_LED); 2069 led->header2.flags = 0; 2070 2071 switch (action) { 2072 case UPGT_LED_OFF: 2073 led->mode = htole16(UPGT_LED_MODE_SET); 2074 led->action_fix = 0; 2075 led->action_tmp = htole16(UPGT_LED_ACTION_OFF); 2076 led->action_tmp_dur = 0; 2077 break; 2078 case UPGT_LED_ON: 2079 led->mode = htole16(UPGT_LED_MODE_SET); 2080 led->action_fix = 0; 2081 led->action_tmp = htole16(UPGT_LED_ACTION_ON); 2082 led->action_tmp_dur = 0; 2083 break; 2084 case UPGT_LED_BLINK: 2085 if (ic->ic_state != IEEE80211_S_RUN) 2086 return; 2087 if (sc->sc_led_blink) 2088 /* previous blink was not finished */ 2089 return; 2090 led->mode = htole16(UPGT_LED_MODE_SET); 2091 led->action_fix = htole16(UPGT_LED_ACTION_OFF); 2092 led->action_tmp = htole16(UPGT_LED_ACTION_ON); 2093 led->action_tmp_dur = htole16(UPGT_LED_ACTION_TMP_DUR); 2094 /* lock blink */ 2095 sc->sc_led_blink = 1; 2096 t.tv_sec = 0; 2097 t.tv_usec = UPGT_LED_ACTION_TMP_DUR * 1000L; 2098 timeout_add(&sc->led_to, tvtohz(&t)); 2099 break; 2100 default: 2101 return; 2102 } 2103 2104 len = sizeof(*mem) + sizeof(*led); 2105 2106 mem->chksum = upgt_chksum_le((uint32_t *)led, 2107 len - sizeof(*mem)); 2108 2109 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 2110 printf("%s: could not transmit led CMD URB!\n", 2111 sc->sc_dev.dv_xname); 2112 } 2113 } 2114 2115 void 2116 upgt_set_led_blink(void *arg) 2117 { 2118 struct upgt_softc *sc = arg; 2119 2120 /* blink finished, we are ready for a next one */ 2121 sc->sc_led_blink = 0; 2122 timeout_del(&sc->led_to); 2123 } 2124 2125 int 2126 upgt_get_stats(struct upgt_softc *sc) 2127 { 2128 struct upgt_data *data_cmd = &sc->cmd_data; 2129 struct upgt_lmac_mem *mem; 2130 struct upgt_lmac_stats *stats; 2131 int len; 2132 2133 /* 2134 * Transmit the URB containing the CMD data. 2135 */ 2136 bzero(data_cmd->buf, MCLBYTES); 2137 2138 mem = (struct upgt_lmac_mem *)data_cmd->buf; 2139 mem->addr = htole32(sc->sc_memaddr_frame_start + 2140 UPGT_MEMSIZE_FRAME_HEAD); 2141 2142 stats = (struct upgt_lmac_stats *)(mem + 1); 2143 2144 stats->header1.flags = 0; 2145 stats->header1.type = UPGT_H1_TYPE_CTRL; 2146 stats->header1.len = htole16( 2147 sizeof(struct upgt_lmac_stats) - 2148 sizeof(struct upgt_lmac_header)); 2149 2150 stats->header2.reqid = htole32(sc->sc_memaddr_frame_start); 2151 stats->header2.type = htole16(UPGT_H2_TYPE_STATS); 2152 stats->header2.flags = 0; 2153 2154 len = sizeof(*mem) + sizeof(*stats); 2155 2156 mem->chksum = upgt_chksum_le((uint32_t *)stats, 2157 len - sizeof(*mem)); 2158 2159 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 2160 printf("%s: could not transmit statistics CMD data URB!\n", 2161 sc->sc_dev.dv_xname); 2162 return (EIO); 2163 } 2164 2165 return (0); 2166 2167 } 2168 2169 int 2170 upgt_alloc_tx(struct upgt_softc *sc) 2171 { 2172 int i; 2173 2174 sc->tx_queued = 0; 2175 2176 for (i = 0; i < UPGT_TX_COUNT; i++) { 2177 struct upgt_data *data_tx = &sc->tx_data[i]; 2178 2179 data_tx->sc = sc; 2180 2181 data_tx->xfer = usbd_alloc_xfer(sc->sc_udev); 2182 if (data_tx->xfer == NULL) { 2183 printf("%s: could not allocate TX xfer!\n", 2184 sc->sc_dev.dv_xname); 2185 return (ENOMEM); 2186 } 2187 2188 data_tx->buf = usbd_alloc_buffer(data_tx->xfer, MCLBYTES); 2189 if (data_tx->buf == NULL) { 2190 printf("%s: could not allocate TX buffer!\n", 2191 sc->sc_dev.dv_xname); 2192 return (ENOMEM); 2193 } 2194 2195 bzero(data_tx->buf, MCLBYTES); 2196 } 2197 2198 return (0); 2199 } 2200 2201 int 2202 upgt_alloc_rx(struct upgt_softc *sc) 2203 { 2204 struct upgt_data *data_rx = &sc->rx_data; 2205 2206 data_rx->sc = sc; 2207 2208 data_rx->xfer = usbd_alloc_xfer(sc->sc_udev); 2209 if (data_rx->xfer == NULL) { 2210 printf("%s: could not allocate RX xfer!\n", 2211 sc->sc_dev.dv_xname); 2212 return (ENOMEM); 2213 } 2214 2215 data_rx->buf = usbd_alloc_buffer(data_rx->xfer, MCLBYTES); 2216 if (data_rx->buf == NULL) { 2217 printf("%s: could not allocate RX buffer!\n", 2218 sc->sc_dev.dv_xname); 2219 return (ENOMEM); 2220 } 2221 2222 bzero(data_rx->buf, MCLBYTES); 2223 2224 return (0); 2225 } 2226 2227 int 2228 upgt_alloc_cmd(struct upgt_softc *sc) 2229 { 2230 struct upgt_data *data_cmd = &sc->cmd_data; 2231 2232 data_cmd->sc = sc; 2233 2234 data_cmd->xfer = usbd_alloc_xfer(sc->sc_udev); 2235 if (data_cmd->xfer == NULL) { 2236 printf("%s: could not allocate RX xfer!\n", 2237 sc->sc_dev.dv_xname); 2238 return (ENOMEM); 2239 } 2240 2241 data_cmd->buf = usbd_alloc_buffer(data_cmd->xfer, MCLBYTES); 2242 if (data_cmd->buf == NULL) { 2243 printf("%s: could not allocate RX buffer!\n", 2244 sc->sc_dev.dv_xname); 2245 return (ENOMEM); 2246 } 2247 2248 bzero(data_cmd->buf, MCLBYTES); 2249 2250 return (0); 2251 } 2252 2253 void 2254 upgt_free_tx(struct upgt_softc *sc) 2255 { 2256 int i; 2257 2258 for (i = 0; i < UPGT_TX_COUNT; i++) { 2259 struct upgt_data *data_tx = &sc->tx_data[i]; 2260 2261 if (data_tx->xfer != NULL) { 2262 usbd_free_xfer(data_tx->xfer); 2263 data_tx->xfer = NULL; 2264 } 2265 2266 data_tx->ni = NULL; 2267 } 2268 } 2269 2270 void 2271 upgt_free_rx(struct upgt_softc *sc) 2272 { 2273 struct upgt_data *data_rx = &sc->rx_data; 2274 2275 if (data_rx->xfer != NULL) { 2276 usbd_free_xfer(data_rx->xfer); 2277 data_rx->xfer = NULL; 2278 } 2279 2280 data_rx->ni = NULL; 2281 } 2282 2283 void 2284 upgt_free_cmd(struct upgt_softc *sc) 2285 { 2286 struct upgt_data *data_cmd = &sc->cmd_data; 2287 2288 if (data_cmd->xfer != NULL) { 2289 usbd_free_xfer(data_cmd->xfer); 2290 data_cmd->xfer = NULL; 2291 } 2292 } 2293 2294 int 2295 upgt_bulk_xmit(struct upgt_softc *sc, struct upgt_data *data, 2296 struct usbd_pipe *pipeh, uint32_t *size, int flags) 2297 { 2298 usbd_status status; 2299 2300 usbd_setup_xfer(data->xfer, pipeh, 0, data->buf, *size, 2301 USBD_NO_COPY | USBD_SYNCHRONOUS | flags, UPGT_USB_TIMEOUT, NULL); 2302 status = usbd_transfer(data->xfer); 2303 if (status != USBD_NORMAL_COMPLETION) { 2304 printf("%s: %s: error %s!\n", 2305 sc->sc_dev.dv_xname, __func__, usbd_errstr(status)); 2306 return (EIO); 2307 } 2308 2309 return (0); 2310 } 2311 2312 void 2313 upgt_hexdump(void *buf, int len) 2314 { 2315 int i; 2316 2317 for (i = 0; i < len; i++) { 2318 if (i % 16 == 0) 2319 printf("%s%5i:", i ? "\n" : "", i); 2320 if (i % 4 == 0) 2321 printf(" "); 2322 printf("%02x", (int)*((u_char *)buf + i)); 2323 } 2324 printf("\n"); 2325 } 2326 2327 uint32_t 2328 upgt_crc32_le(const void *buf, size_t size) 2329 { 2330 uint32_t crc; 2331 2332 crc = ether_crc32_le(buf, size); 2333 2334 /* apply final XOR value as common for CRC-32 */ 2335 crc = htole32(crc ^ 0xffffffffU); 2336 2337 return (crc); 2338 } 2339 2340 /* 2341 * The firmware awaits a checksum for each frame we send to it. 2342 * The algorithm used therefor is uncommon but somehow similar to CRC32. 2343 */ 2344 uint32_t 2345 upgt_chksum_le(const uint32_t *buf, size_t size) 2346 { 2347 int i; 2348 uint32_t crc = 0; 2349 2350 for (i = 0; i < size; i += sizeof(uint32_t)) { 2351 crc = htole32(crc ^ *buf++); 2352 crc = htole32((crc >> 5) ^ (crc << 3)); 2353 } 2354 2355 return (crc); 2356 } 2357