1 /* $OpenBSD: if_upgt.c,v 1.90 2024/05/23 03:21:09 jsg Exp $ */
2
3 /*
4 * Copyright (c) 2007 Marcus Glocker <mglocker@openbsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 #include "bpfilter.h"
20
21 #include <sys/param.h>
22 #include <sys/sockio.h>
23 #include <sys/mbuf.h>
24 #include <sys/systm.h>
25 #include <sys/timeout.h>
26 #include <sys/device.h>
27 #include <sys/endian.h>
28
29 #include <machine/intr.h>
30
31 #if NBPFILTER > 0
32 #include <net/bpf.h>
33 #endif
34 #include <net/if.h>
35 #include <net/if_dl.h>
36 #include <net/if_media.h>
37
38 #include <netinet/in.h>
39 #include <netinet/if_ether.h>
40
41 #include <net80211/ieee80211_var.h>
42 #include <net80211/ieee80211_radiotap.h>
43
44 #include <dev/usb/usb.h>
45 #include <dev/usb/usbdi.h>
46 #include <dev/usb/usbdi_util.h>
47 #include <dev/usb/usbdevs.h>
48
49 #include <dev/usb/if_upgtvar.h>
50
51 /*
52 * Driver for the USB PrismGT devices.
53 *
54 * For now just USB 2.0 devices with the GW3887 chipset are supported.
55 * The driver has been written based on the firmware version 2.13.1.0_LM87.
56 *
57 * TODO's:
58 * - Fix MONITOR mode (MAC filter).
59 * - Add HOSTAP mode.
60 * - Add IBSS mode.
61 * - Support the USB 1.0 devices (NET2280, ISL3880, ISL3886 chipsets).
62 *
63 * Parts of this driver has been influenced by reading the p54u driver
64 * written by Jean-Baptiste Note <jean-baptiste.note@m4x.org> and
65 * Sebastien Bourdeauducq <lekernel@prism54.org>.
66 */
67
68 #ifdef UPGT_DEBUG
69 int upgt_debug = 2;
70 #define DPRINTF(l, x...) do { if ((l) <= upgt_debug) printf(x); } while (0)
71 #else
72 #define DPRINTF(l, x...)
73 #endif
74
75 /*
76 * Prototypes.
77 */
78 int upgt_match(struct device *, void *, void *);
79 void upgt_attach(struct device *, struct device *, void *);
80 void upgt_attach_hook(struct device *);
81 int upgt_detach(struct device *, int);
82
83 int upgt_device_type(struct upgt_softc *, uint16_t, uint16_t);
84 int upgt_device_init(struct upgt_softc *);
85 int upgt_mem_init(struct upgt_softc *);
86 uint32_t upgt_mem_alloc(struct upgt_softc *);
87 void upgt_mem_free(struct upgt_softc *, uint32_t);
88 int upgt_fw_alloc(struct upgt_softc *);
89 void upgt_fw_free(struct upgt_softc *);
90 int upgt_fw_verify(struct upgt_softc *);
91 int upgt_fw_load(struct upgt_softc *);
92 int upgt_fw_copy(char *, char *, int);
93 int upgt_eeprom_read(struct upgt_softc *);
94 int upgt_eeprom_parse(struct upgt_softc *);
95 void upgt_eeprom_parse_hwrx(struct upgt_softc *, uint8_t *);
96 void upgt_eeprom_parse_freq3(struct upgt_softc *, uint8_t *, int);
97 void upgt_eeprom_parse_freq4(struct upgt_softc *, uint8_t *, int);
98 void upgt_eeprom_parse_freq6(struct upgt_softc *, uint8_t *, int);
99
100 int upgt_ioctl(struct ifnet *, u_long, caddr_t);
101 int upgt_init(struct ifnet *);
102 void upgt_stop(struct upgt_softc *);
103 int upgt_media_change(struct ifnet *);
104 void upgt_newassoc(struct ieee80211com *, struct ieee80211_node *,
105 int);
106 int upgt_newstate(struct ieee80211com *, enum ieee80211_state, int);
107 void upgt_newstate_task(void *);
108 void upgt_next_scan(void *);
109 void upgt_start(struct ifnet *);
110 void upgt_watchdog(struct ifnet *);
111 void upgt_tx_task(void *);
112 void upgt_tx_done(struct upgt_softc *, uint8_t *);
113 void upgt_rx_cb(struct usbd_xfer *, void *, usbd_status);
114 void upgt_rx(struct upgt_softc *, uint8_t *, int);
115 void upgt_setup_rates(struct upgt_softc *);
116 uint8_t upgt_rx_rate(struct upgt_softc *, const int);
117 int upgt_set_macfilter(struct upgt_softc *, uint8_t state);
118 int upgt_set_channel(struct upgt_softc *, unsigned);
119 void upgt_set_led(struct upgt_softc *, int);
120 void upgt_set_led_blink(void *);
121 int upgt_get_stats(struct upgt_softc *);
122
123 int upgt_alloc_tx(struct upgt_softc *);
124 int upgt_alloc_rx(struct upgt_softc *);
125 int upgt_alloc_cmd(struct upgt_softc *);
126 void upgt_free_tx(struct upgt_softc *);
127 void upgt_free_rx(struct upgt_softc *);
128 void upgt_free_cmd(struct upgt_softc *);
129 int upgt_bulk_xmit(struct upgt_softc *, struct upgt_data *,
130 struct usbd_pipe *, uint32_t *, int);
131
132 void upgt_hexdump(void *, int);
133 uint32_t upgt_crc32_le(const void *, size_t);
134 uint32_t upgt_chksum_le(const uint32_t *, size_t);
135
136 struct cfdriver upgt_cd = {
137 NULL, "upgt", DV_IFNET
138 };
139
140 const struct cfattach upgt_ca = {
141 sizeof(struct upgt_softc), upgt_match, upgt_attach, upgt_detach
142 };
143
144 static const struct usb_devno upgt_devs_1[] = {
145 /* version 1 devices */
146 { USB_VENDOR_ALCATELT, USB_PRODUCT_ALCATELT_ST120G }
147 };
148
149 static const struct usb_devno upgt_devs_2[] = {
150 /* version 2 devices */
151 { USB_VENDOR_ACCTON, USB_PRODUCT_ACCTON_PRISM_GT },
152 { USB_VENDOR_ALCATELT, USB_PRODUCT_ALCATELT_ST121G },
153 { USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050 },
154 { USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54AG },
155 { USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GV2 },
156 { USB_VENDOR_CONCEPTRONIC, USB_PRODUCT_CONCEPTRONIC_PRISM_GT },
157 { USB_VENDOR_DELL, USB_PRODUCT_DELL_PRISM_GT_1 },
158 { USB_VENDOR_DELL, USB_PRODUCT_DELL_PRISM_GT_2 },
159 { USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122A2 },
160 { USB_VENDOR_FSC, USB_PRODUCT_FSC_E5400 },
161 { USB_VENDOR_GLOBESPAN, USB_PRODUCT_GLOBESPAN_PRISM_GT_1 },
162 { USB_VENDOR_GLOBESPAN, USB_PRODUCT_GLOBESPAN_PRISM_GT_2 },
163 { USB_VENDOR_INTERSIL, USB_PRODUCT_INTERSIL_PRISM_GT },
164 { USB_VENDOR_PHEENET, USB_PRODUCT_PHEENET_GWU513 },
165 { USB_VENDOR_PHILIPS, USB_PRODUCT_PHILIPS_CPWUA054 },
166 { USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG },
167 { USB_VENDOR_USR, USB_PRODUCT_USR_USR5422 },
168 { USB_VENDOR_WISTRONNEWEB, USB_PRODUCT_WISTRONNEWEB_UR045G },
169 { USB_VENDOR_XYRATEX, USB_PRODUCT_XYRATEX_PRISM_GT_1 },
170 { USB_VENDOR_XYRATEX, USB_PRODUCT_XYRATEX_PRISM_GT_2 },
171 { USB_VENDOR_ZCOM, USB_PRODUCT_ZCOM_MD40900 },
172 { USB_VENDOR_ZCOM, USB_PRODUCT_ZCOM_XG703A }
173 };
174
175 int
upgt_match(struct device * parent,void * match,void * aux)176 upgt_match(struct device *parent, void *match, void *aux)
177 {
178 struct usb_attach_arg *uaa = aux;
179
180 if (uaa->iface == NULL || uaa->configno != UPGT_CONFIG_NO)
181 return (UMATCH_NONE);
182
183 if (usb_lookup(upgt_devs_1, uaa->vendor, uaa->product) != NULL)
184 return (UMATCH_VENDOR_PRODUCT);
185
186 if (usb_lookup(upgt_devs_2, uaa->vendor, uaa->product) != NULL)
187 return (UMATCH_VENDOR_PRODUCT);
188
189 return (UMATCH_NONE);
190 }
191
192 void
upgt_attach(struct device * parent,struct device * self,void * aux)193 upgt_attach(struct device *parent, struct device *self, void *aux)
194 {
195 struct upgt_softc *sc = (struct upgt_softc *)self;
196 struct usb_attach_arg *uaa = aux;
197 usb_interface_descriptor_t *id;
198 usb_endpoint_descriptor_t *ed;
199 usbd_status error;
200 int i;
201
202 /*
203 * Attach USB device.
204 */
205 sc->sc_udev = uaa->device;
206
207 /* check device type */
208 if (upgt_device_type(sc, uaa->vendor, uaa->product) != 0)
209 return;
210
211 /* get the first interface handle */
212 error = usbd_device2interface_handle(sc->sc_udev, UPGT_IFACE_INDEX,
213 &sc->sc_iface);
214 if (error != 0) {
215 printf("%s: could not get interface handle!\n",
216 sc->sc_dev.dv_xname);
217 return;
218 }
219
220 /* find endpoints */
221 id = usbd_get_interface_descriptor(sc->sc_iface);
222 sc->sc_rx_no = sc->sc_tx_no = -1;
223 for (i = 0; i < id->bNumEndpoints; i++) {
224 ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
225 if (ed == NULL) {
226 printf("%s: no endpoint descriptor for iface %d!\n",
227 sc->sc_dev.dv_xname, i);
228 return;
229 }
230
231 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
232 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
233 sc->sc_tx_no = ed->bEndpointAddress;
234 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
235 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
236 sc->sc_rx_no = ed->bEndpointAddress;
237
238 /*
239 * 0x01 TX pipe
240 * 0x81 RX pipe
241 *
242 * Deprecated scheme (not used with fw version >2.5.6.x):
243 * 0x02 TX MGMT pipe
244 * 0x82 TX MGMT pipe
245 */
246 if (sc->sc_tx_no != -1 && sc->sc_rx_no != -1)
247 break;
248 }
249 if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) {
250 printf("%s: missing endpoint!\n", sc->sc_dev.dv_xname);
251 return;
252 }
253
254 /* setup tasks and timeouts */
255 usb_init_task(&sc->sc_task_newstate, upgt_newstate_task, sc,
256 USB_TASK_TYPE_GENERIC);
257 usb_init_task(&sc->sc_task_tx, upgt_tx_task, sc, USB_TASK_TYPE_GENERIC);
258 timeout_set(&sc->scan_to, upgt_next_scan, sc);
259 timeout_set(&sc->led_to, upgt_set_led_blink, sc);
260
261 /*
262 * Open TX and RX USB bulk pipes.
263 */
264 error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE,
265 &sc->sc_tx_pipeh);
266 if (error != 0) {
267 printf("%s: could not open TX pipe: %s!\n",
268 sc->sc_dev.dv_xname, usbd_errstr(error));
269 goto fail;
270 }
271 error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE,
272 &sc->sc_rx_pipeh);
273 if (error != 0) {
274 printf("%s: could not open RX pipe: %s!\n",
275 sc->sc_dev.dv_xname, usbd_errstr(error));
276 goto fail;
277 }
278
279 /*
280 * Allocate TX, RX, and CMD xfers.
281 */
282 if (upgt_alloc_tx(sc) != 0)
283 goto fail;
284 if (upgt_alloc_rx(sc) != 0)
285 goto fail;
286 if (upgt_alloc_cmd(sc) != 0)
287 goto fail;
288
289 /*
290 * We need the firmware loaded to complete the attach.
291 */
292 config_mountroot(self, upgt_attach_hook);
293
294 return;
295 fail:
296 printf("%s: %s failed!\n", sc->sc_dev.dv_xname, __func__);
297 }
298
299 void
upgt_attach_hook(struct device * self)300 upgt_attach_hook(struct device *self)
301 {
302 struct upgt_softc *sc = (struct upgt_softc *)self;
303 struct ieee80211com *ic = &sc->sc_ic;
304 struct ifnet *ifp = &ic->ic_if;
305 usbd_status error;
306 int i;
307
308 /*
309 * Load firmware file into memory.
310 */
311 if (upgt_fw_alloc(sc) != 0)
312 goto fail;
313
314 /*
315 * Initialize the device.
316 */
317 if (upgt_device_init(sc) != 0)
318 goto fail;
319
320 /*
321 * Verify the firmware.
322 */
323 if (upgt_fw_verify(sc) != 0)
324 goto fail;
325
326 /*
327 * Calculate device memory space.
328 */
329 if (sc->sc_memaddr_frame_start == 0 || sc->sc_memaddr_frame_end == 0) {
330 printf("%s: could not find memory space addresses on FW!\n",
331 sc->sc_dev.dv_xname);
332 goto fail;
333 }
334 sc->sc_memaddr_frame_end -= UPGT_MEMSIZE_RX + 1;
335 sc->sc_memaddr_rx_start = sc->sc_memaddr_frame_end + 1;
336
337 DPRINTF(1, "%s: memory address frame start=0x%08x\n",
338 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_start);
339 DPRINTF(1, "%s: memory address frame end=0x%08x\n",
340 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_end);
341 DPRINTF(1, "%s: memory address rx start=0x%08x\n",
342 sc->sc_dev.dv_xname, sc->sc_memaddr_rx_start);
343
344 upgt_mem_init(sc);
345
346 /*
347 * Load the firmware.
348 */
349 if (upgt_fw_load(sc) != 0)
350 goto fail;
351
352 /*
353 * Startup the RX pipe.
354 */
355 struct upgt_data *data_rx = &sc->rx_data;
356
357 usbd_setup_xfer(data_rx->xfer, sc->sc_rx_pipeh, data_rx, data_rx->buf,
358 MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, upgt_rx_cb);
359 error = usbd_transfer(data_rx->xfer);
360 if (error != 0 && error != USBD_IN_PROGRESS) {
361 printf("%s: could not queue RX transfer!\n",
362 sc->sc_dev.dv_xname);
363 goto fail;
364 }
365 usbd_delay_ms(sc->sc_udev, 100);
366
367 /*
368 * Read the whole EEPROM content and parse it.
369 */
370 if (upgt_eeprom_read(sc) != 0)
371 goto fail;
372 if (upgt_eeprom_parse(sc) != 0)
373 goto fail;
374
375 /*
376 * Setup the 802.11 device.
377 */
378 ic->ic_phytype = IEEE80211_T_OFDM;
379 ic->ic_opmode = IEEE80211_M_STA;
380 ic->ic_state = IEEE80211_S_INIT;
381 ic->ic_caps =
382 IEEE80211_C_MONITOR |
383 IEEE80211_C_SHPREAMBLE |
384 IEEE80211_C_SHSLOT |
385 IEEE80211_C_WEP |
386 IEEE80211_C_RSN;
387
388 ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
389 ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
390
391 for (i = 1; i <= 14; i++) {
392 ic->ic_channels[i].ic_freq =
393 ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
394 ic->ic_channels[i].ic_flags =
395 IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
396 IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
397 }
398
399 ifp->if_softc = sc;
400 ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
401 ifp->if_ioctl = upgt_ioctl;
402 ifp->if_start = upgt_start;
403 ifp->if_watchdog = upgt_watchdog;
404 memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
405
406 if_attach(ifp);
407 ieee80211_ifattach(ifp);
408 ic->ic_newassoc = upgt_newassoc;
409
410 sc->sc_newstate = ic->ic_newstate;
411 ic->ic_newstate = upgt_newstate;
412 ieee80211_media_init(ifp, upgt_media_change, ieee80211_media_status);
413
414 #if NBPFILTER > 0
415 bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
416 sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
417
418 sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
419 sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
420 sc->sc_rxtap.wr_ihdr.it_present = htole32(UPGT_RX_RADIOTAP_PRESENT);
421
422 sc->sc_txtap_len = sizeof(sc->sc_txtapu);
423 sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
424 sc->sc_txtap.wt_ihdr.it_present = htole32(UPGT_TX_RADIOTAP_PRESENT);
425 #endif
426
427 printf("%s: address %s\n",
428 sc->sc_dev.dv_xname, ether_sprintf(ic->ic_myaddr));
429
430 return;
431 fail:
432 printf("%s: %s failed!\n", sc->sc_dev.dv_xname, __func__);
433 }
434
435 int
upgt_detach(struct device * self,int flags)436 upgt_detach(struct device *self, int flags)
437 {
438 struct upgt_softc *sc = (struct upgt_softc *)self;
439 struct ifnet *ifp = &sc->sc_ic.ic_if;
440 int s;
441
442 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
443
444 s = splusb();
445
446 /* abort and close TX / RX pipes */
447 if (sc->sc_tx_pipeh != NULL)
448 usbd_close_pipe(sc->sc_tx_pipeh);
449 if (sc->sc_rx_pipeh != NULL)
450 usbd_close_pipe(sc->sc_rx_pipeh);
451
452 /* remove tasks and timeouts */
453 usb_rem_task(sc->sc_udev, &sc->sc_task_newstate);
454 usb_rem_task(sc->sc_udev, &sc->sc_task_tx);
455 if (timeout_initialized(&sc->scan_to))
456 timeout_del(&sc->scan_to);
457 if (timeout_initialized(&sc->led_to))
458 timeout_del(&sc->led_to);
459
460 /* free xfers */
461 upgt_free_tx(sc);
462 upgt_free_rx(sc);
463 upgt_free_cmd(sc);
464
465 /* free firmware */
466 upgt_fw_free(sc);
467
468 if (ifp->if_softc != NULL) {
469 /* detach interface */
470 ieee80211_ifdetach(ifp);
471 if_detach(ifp);
472 }
473
474 splx(s);
475
476 return (0);
477 }
478
479 int
upgt_device_type(struct upgt_softc * sc,uint16_t vendor,uint16_t product)480 upgt_device_type(struct upgt_softc *sc, uint16_t vendor, uint16_t product)
481 {
482 if (usb_lookup(upgt_devs_1, vendor, product) != NULL) {
483 sc->sc_device_type = 1;
484 /* XXX */
485 printf("%s: version 1 devices not supported yet!\n",
486 sc->sc_dev.dv_xname);
487 return (1);
488 } else {
489 sc->sc_device_type = 2;
490 }
491
492 return (0);
493 }
494
495 int
upgt_device_init(struct upgt_softc * sc)496 upgt_device_init(struct upgt_softc *sc)
497 {
498 struct upgt_data *data_cmd = &sc->cmd_data;
499 char init_cmd[] = { 0x7e, 0x7e, 0x7e, 0x7e };
500 int len;
501
502 len = sizeof(init_cmd);
503 bcopy(init_cmd, data_cmd->buf, len);
504 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
505 printf("%s: could not send device init string!\n",
506 sc->sc_dev.dv_xname);
507 return (EIO);
508 }
509 usbd_delay_ms(sc->sc_udev, 100);
510
511 DPRINTF(1, "%s: device initialized\n", sc->sc_dev.dv_xname);
512
513 return (0);
514 }
515
516 int
upgt_mem_init(struct upgt_softc * sc)517 upgt_mem_init(struct upgt_softc *sc)
518 {
519 int i;
520
521 for (i = 0; i < UPGT_MEMORY_MAX_PAGES; i++) {
522 sc->sc_memory.page[i].used = 0;
523
524 if (i == 0) {
525 /*
526 * The first memory page is always reserved for
527 * command data.
528 */
529 sc->sc_memory.page[i].addr =
530 sc->sc_memaddr_frame_start + MCLBYTES;
531 } else {
532 sc->sc_memory.page[i].addr =
533 sc->sc_memory.page[i - 1].addr + MCLBYTES;
534 }
535
536 if (sc->sc_memory.page[i].addr + MCLBYTES >=
537 sc->sc_memaddr_frame_end)
538 break;
539
540 DPRINTF(2, "%s: memory address page %d=0x%08x\n",
541 sc->sc_dev.dv_xname, i, sc->sc_memory.page[i].addr);
542 }
543
544 sc->sc_memory.pages = i;
545
546 DPRINTF(2, "%s: memory pages=%d\n",
547 sc->sc_dev.dv_xname, sc->sc_memory.pages);
548
549 return (0);
550 }
551
552 uint32_t
upgt_mem_alloc(struct upgt_softc * sc)553 upgt_mem_alloc(struct upgt_softc *sc)
554 {
555 int i;
556
557 for (i = 0; i < sc->sc_memory.pages; i++) {
558 if (sc->sc_memory.page[i].used == 0) {
559 sc->sc_memory.page[i].used = 1;
560 return (sc->sc_memory.page[i].addr);
561 }
562 }
563
564 return (0);
565 }
566
567 void
upgt_mem_free(struct upgt_softc * sc,uint32_t addr)568 upgt_mem_free(struct upgt_softc *sc, uint32_t addr)
569 {
570 int i;
571
572 for (i = 0; i < sc->sc_memory.pages; i++) {
573 if (sc->sc_memory.page[i].addr == addr) {
574 sc->sc_memory.page[i].used = 0;
575 return;
576 }
577 }
578
579 printf("%s: could not free memory address 0x%08x!\n",
580 sc->sc_dev.dv_xname, addr);
581 }
582
583
584 int
upgt_fw_alloc(struct upgt_softc * sc)585 upgt_fw_alloc(struct upgt_softc *sc)
586 {
587 const char *name = "upgt-gw3887";
588 int error;
589
590 if (sc->sc_fw == NULL) {
591 error = loadfirmware(name, &sc->sc_fw, &sc->sc_fw_size);
592 if (error != 0) {
593 printf("%s: error %d, could not read firmware %s!\n",
594 sc->sc_dev.dv_xname, error, name);
595 return (EIO);
596 }
597 }
598
599 DPRINTF(1, "%s: firmware %s allocated\n", sc->sc_dev.dv_xname, name);
600
601 return (0);
602 }
603
604 void
upgt_fw_free(struct upgt_softc * sc)605 upgt_fw_free(struct upgt_softc *sc)
606 {
607 if (sc->sc_fw != NULL) {
608 free(sc->sc_fw, M_DEVBUF, sc->sc_fw_size);
609 sc->sc_fw = NULL;
610 DPRINTF(1, "%s: firmware freed\n", sc->sc_dev.dv_xname);
611 }
612 }
613
614 int
upgt_fw_verify(struct upgt_softc * sc)615 upgt_fw_verify(struct upgt_softc *sc)
616 {
617 struct upgt_fw_bra_option *bra_option;
618 uint32_t bra_option_type, bra_option_len;
619 uint32_t *uc;
620 int offset, bra_end = 0;
621
622 /*
623 * Seek to beginning of Boot Record Area (BRA).
624 */
625 for (offset = 0; offset < sc->sc_fw_size; offset += sizeof(*uc)) {
626 uc = (uint32_t *)(sc->sc_fw + offset);
627 if (*uc == 0)
628 break;
629 }
630 for (; offset < sc->sc_fw_size; offset += sizeof(*uc)) {
631 uc = (uint32_t *)(sc->sc_fw + offset);
632 if (*uc != 0)
633 break;
634 }
635 if (offset == sc->sc_fw_size) {
636 printf("%s: firmware Boot Record Area not found!\n",
637 sc->sc_dev.dv_xname);
638 return (EIO);
639 }
640 DPRINTF(1, "%s: firmware Boot Record Area found at offset %d\n",
641 sc->sc_dev.dv_xname, offset);
642
643 /*
644 * Parse Boot Record Area (BRA) options.
645 */
646 while (offset < sc->sc_fw_size && bra_end == 0) {
647 /* get current BRA option */
648 bra_option = (struct upgt_fw_bra_option *)(sc->sc_fw + offset);
649 bra_option_type = letoh32(bra_option->type);
650 bra_option_len = letoh32(bra_option->len) * sizeof(*uc);
651
652 switch (bra_option_type) {
653 case UPGT_BRA_TYPE_FW:
654 DPRINTF(1, "%s: UPGT_BRA_TYPE_FW len=%d\n",
655 sc->sc_dev.dv_xname, bra_option_len);
656
657 if (bra_option_len != UPGT_BRA_FWTYPE_SIZE) {
658 printf("%s: wrong UPGT_BRA_TYPE_FW len!\n",
659 sc->sc_dev.dv_xname);
660 return (EIO);
661 }
662 if (memcmp(UPGT_BRA_FWTYPE_LM86, bra_option->data,
663 bra_option_len) == 0) {
664 sc->sc_fw_type = UPGT_FWTYPE_LM86;
665 break;
666 }
667 if (memcmp(UPGT_BRA_FWTYPE_LM87, bra_option->data,
668 bra_option_len) == 0) {
669 sc->sc_fw_type = UPGT_FWTYPE_LM87;
670 break;
671 }
672 if (memcmp(UPGT_BRA_FWTYPE_FMAC, bra_option->data,
673 bra_option_len) == 0) {
674 sc->sc_fw_type = UPGT_FWTYPE_FMAC;
675 break;
676 }
677 printf("%s: unsupported firmware type!\n",
678 sc->sc_dev.dv_xname);
679 return (EIO);
680 case UPGT_BRA_TYPE_VERSION:
681 DPRINTF(1, "%s: UPGT_BRA_TYPE_VERSION len=%d\n",
682 sc->sc_dev.dv_xname, bra_option_len);
683 break;
684 case UPGT_BRA_TYPE_DEPIF:
685 DPRINTF(1, "%s: UPGT_BRA_TYPE_DEPIF len=%d\n",
686 sc->sc_dev.dv_xname, bra_option_len);
687 break;
688 case UPGT_BRA_TYPE_EXPIF:
689 DPRINTF(1, "%s: UPGT_BRA_TYPE_EXPIF len=%d\n",
690 sc->sc_dev.dv_xname, bra_option_len);
691 break;
692 case UPGT_BRA_TYPE_DESCR:
693 DPRINTF(1, "%s: UPGT_BRA_TYPE_DESCR len=%d\n",
694 sc->sc_dev.dv_xname, bra_option_len);
695
696 struct upgt_fw_bra_descr *descr =
697 (struct upgt_fw_bra_descr *)bra_option->data;
698
699 sc->sc_memaddr_frame_start =
700 letoh32(descr->memaddr_space_start);
701 sc->sc_memaddr_frame_end =
702 letoh32(descr->memaddr_space_end);
703
704 DPRINTF(2, "%s: memory address space start=0x%08x\n",
705 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_start);
706 DPRINTF(2, "%s: memory address space end=0x%08x\n",
707 sc->sc_dev.dv_xname, sc->sc_memaddr_frame_end);
708 break;
709 case UPGT_BRA_TYPE_END:
710 DPRINTF(1, "%s: UPGT_BRA_TYPE_END len=%d\n",
711 sc->sc_dev.dv_xname, bra_option_len);
712 bra_end = 1;
713 break;
714 default:
715 DPRINTF(1, "%s: unknown BRA option len=%d\n",
716 sc->sc_dev.dv_xname, bra_option_len);
717 return (EIO);
718 }
719
720 /* jump to next BRA option */
721 offset += sizeof(struct upgt_fw_bra_option) + bra_option_len;
722 }
723
724 DPRINTF(1, "%s: firmware verified\n", sc->sc_dev.dv_xname);
725
726 return (0);
727 }
728
729 int
upgt_fw_load(struct upgt_softc * sc)730 upgt_fw_load(struct upgt_softc *sc)
731 {
732 struct upgt_data *data_cmd = &sc->cmd_data;
733 struct upgt_data *data_rx = &sc->rx_data;
734 char start_fwload_cmd[] = { 0x3c, 0x0d };
735 int offset, bsize, n, i, len;
736 uint32_t crc32;
737
738 /* send firmware start load command */
739 len = sizeof(start_fwload_cmd);
740 bcopy(start_fwload_cmd, data_cmd->buf, len);
741 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
742 printf("%s: could not send start_firmware_load command!\n",
743 sc->sc_dev.dv_xname);
744 return (EIO);
745 }
746
747 /* send X2 header */
748 len = sizeof(struct upgt_fw_x2_header);
749 struct upgt_fw_x2_header *x2 = data_cmd->buf;
750 bcopy(UPGT_X2_SIGNATURE, x2->signature, UPGT_X2_SIGNATURE_SIZE);
751 x2->startaddr = htole32(UPGT_MEMADDR_FIRMWARE_START);
752 x2->len = htole32(sc->sc_fw_size);
753 x2->crc = upgt_crc32_le(data_cmd->buf + UPGT_X2_SIGNATURE_SIZE,
754 sizeof(struct upgt_fw_x2_header) - UPGT_X2_SIGNATURE_SIZE -
755 sizeof(uint32_t));
756 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
757 printf("%s: could not send firmware X2 header!\n",
758 sc->sc_dev.dv_xname);
759 return (EIO);
760 }
761
762 /* download firmware */
763 for (offset = 0; offset < sc->sc_fw_size; offset += bsize) {
764 if (sc->sc_fw_size - offset > UPGT_FW_BLOCK_SIZE)
765 bsize = UPGT_FW_BLOCK_SIZE;
766 else
767 bsize = sc->sc_fw_size - offset;
768
769 n = upgt_fw_copy(sc->sc_fw + offset, data_cmd->buf, bsize);
770
771 DPRINTF(1, "%s: FW offset=%d, read=%d, sent=%d\n",
772 sc->sc_dev.dv_xname, offset, n, bsize);
773
774 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &bsize, 0)
775 != 0) {
776 printf("%s: error while downloading firmware block!\n",
777 sc->sc_dev.dv_xname);
778 return (EIO);
779 }
780
781 bsize = n;
782 }
783 DPRINTF(1, "%s: firmware downloaded\n", sc->sc_dev.dv_xname);
784
785 /* load firmware */
786 crc32 = upgt_crc32_le(sc->sc_fw, sc->sc_fw_size);
787 *((uint32_t *)(data_cmd->buf) ) = crc32;
788 *((uint8_t *)(data_cmd->buf) + 4) = 'g';
789 *((uint8_t *)(data_cmd->buf) + 5) = '\r';
790 len = 6;
791 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
792 printf("%s: could not send load_firmware command!\n",
793 sc->sc_dev.dv_xname);
794 return (EIO);
795 }
796
797 for (i = 0; i < UPGT_FIRMWARE_TIMEOUT; i++) {
798 len = UPGT_FW_BLOCK_SIZE;
799 bzero(data_rx->buf, MCLBYTES);
800 if (upgt_bulk_xmit(sc, data_rx, sc->sc_rx_pipeh, &len,
801 USBD_SHORT_XFER_OK) != 0) {
802 printf("%s: could not read firmware response!\n",
803 sc->sc_dev.dv_xname);
804 return (EIO);
805 }
806
807 if (memcmp(data_rx->buf, "OK", 2) == 0)
808 break; /* firmware load was successful */
809 }
810 if (i == UPGT_FIRMWARE_TIMEOUT) {
811 printf("%s: firmware load failed!\n", sc->sc_dev.dv_xname);
812 return (EIO);
813 }
814 DPRINTF(1, "%s: firmware loaded\n", sc->sc_dev.dv_xname);
815
816 return (0);
817 }
818
819 /*
820 * While copying the version 2 firmware, we need to replace two characters:
821 *
822 * 0x7e -> 0x7d 0x5e
823 * 0x7d -> 0x7d 0x5d
824 */
825 int
upgt_fw_copy(char * src,char * dst,int size)826 upgt_fw_copy(char *src, char *dst, int size)
827 {
828 int i, j;
829
830 for (i = 0, j = 0; i < size && j < size; i++) {
831 switch (src[i]) {
832 case 0x7e:
833 dst[j] = 0x7d;
834 j++;
835 dst[j] = 0x5e;
836 j++;
837 break;
838 case 0x7d:
839 dst[j] = 0x7d;
840 j++;
841 dst[j] = 0x5d;
842 j++;
843 break;
844 default:
845 dst[j] = src[i];
846 j++;
847 break;
848 }
849 }
850
851 return (i);
852 }
853
854 int
upgt_eeprom_read(struct upgt_softc * sc)855 upgt_eeprom_read(struct upgt_softc *sc)
856 {
857 struct upgt_data *data_cmd = &sc->cmd_data;
858 struct upgt_lmac_mem *mem;
859 struct upgt_lmac_eeprom *eeprom;
860 int offset, block, len;
861
862 offset = 0;
863 block = UPGT_EEPROM_BLOCK_SIZE;
864 while (offset < UPGT_EEPROM_SIZE) {
865 DPRINTF(1, "%s: request EEPROM block (offset=%d, len=%d)\n",
866 sc->sc_dev.dv_xname, offset, block);
867
868 /*
869 * Transmit the URB containing the CMD data.
870 */
871 bzero(data_cmd->buf, MCLBYTES);
872
873 mem = (struct upgt_lmac_mem *)data_cmd->buf;
874 mem->addr = htole32(sc->sc_memaddr_frame_start +
875 UPGT_MEMSIZE_FRAME_HEAD);
876
877 eeprom = (struct upgt_lmac_eeprom *)(mem + 1);
878 eeprom->header1.flags = 0;
879 eeprom->header1.type = UPGT_H1_TYPE_CTRL;
880 eeprom->header1.len = htole16((
881 sizeof(struct upgt_lmac_eeprom) -
882 sizeof(struct upgt_lmac_header)) + block);
883
884 eeprom->header2.reqid = htole32(sc->sc_memaddr_frame_start);
885 eeprom->header2.type = htole16(UPGT_H2_TYPE_EEPROM);
886 eeprom->header2.flags = 0;
887
888 eeprom->offset = htole16(offset);
889 eeprom->len = htole16(block);
890
891 len = sizeof(*mem) + sizeof(*eeprom) + block;
892
893 mem->chksum = upgt_chksum_le((uint32_t *)eeprom,
894 len - sizeof(*mem));
895
896 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len,
897 USBD_FORCE_SHORT_XFER) != 0) {
898 printf("%s: could not transmit EEPROM data URB!\n",
899 sc->sc_dev.dv_xname);
900 return (EIO);
901 }
902 if (tsleep_nsec(sc, 0, "eeprom_request",
903 MSEC_TO_NSEC(UPGT_USB_TIMEOUT))) {
904 printf("%s: timeout while waiting for EEPROM data!\n",
905 sc->sc_dev.dv_xname);
906 return (EIO);
907 }
908
909 offset += block;
910 if (UPGT_EEPROM_SIZE - offset < block)
911 block = UPGT_EEPROM_SIZE - offset;
912 }
913
914 return (0);
915 }
916
917 int
upgt_eeprom_parse(struct upgt_softc * sc)918 upgt_eeprom_parse(struct upgt_softc *sc)
919 {
920 struct ieee80211com *ic = &sc->sc_ic;
921 struct upgt_eeprom_header *eeprom_header;
922 struct upgt_eeprom_option *eeprom_option;
923 uint16_t option_len;
924 uint16_t option_type;
925 uint16_t preamble_len;
926 int option_end = 0;
927
928 /* calculate eeprom options start offset */
929 eeprom_header = (struct upgt_eeprom_header *)sc->sc_eeprom;
930 preamble_len = letoh16(eeprom_header->preamble_len);
931 eeprom_option = (struct upgt_eeprom_option *)(sc->sc_eeprom +
932 (sizeof(struct upgt_eeprom_header) + preamble_len));
933
934 while (!option_end) {
935 /* the eeprom option length is stored in words */
936 option_len =
937 (letoh16(eeprom_option->len) - 1) * sizeof(uint16_t);
938 option_type =
939 letoh16(eeprom_option->type);
940
941 switch (option_type) {
942 case UPGT_EEPROM_TYPE_NAME:
943 DPRINTF(1, "%s: EEPROM name len=%d\n",
944 sc->sc_dev.dv_xname, option_len);
945 break;
946 case UPGT_EEPROM_TYPE_SERIAL:
947 DPRINTF(1, "%s: EEPROM serial len=%d\n",
948 sc->sc_dev.dv_xname, option_len);
949 break;
950 case UPGT_EEPROM_TYPE_MAC:
951 DPRINTF(1, "%s: EEPROM mac len=%d\n",
952 sc->sc_dev.dv_xname, option_len);
953
954 IEEE80211_ADDR_COPY(ic->ic_myaddr, eeprom_option->data);
955 break;
956 case UPGT_EEPROM_TYPE_HWRX:
957 DPRINTF(1, "%s: EEPROM hwrx len=%d\n",
958 sc->sc_dev.dv_xname, option_len);
959
960 upgt_eeprom_parse_hwrx(sc, eeprom_option->data);
961 break;
962 case UPGT_EEPROM_TYPE_CHIP:
963 DPRINTF(1, "%s: EEPROM chip len=%d\n",
964 sc->sc_dev.dv_xname, option_len);
965 break;
966 case UPGT_EEPROM_TYPE_FREQ3:
967 DPRINTF(1, "%s: EEPROM freq3 len=%d\n",
968 sc->sc_dev.dv_xname, option_len);
969
970 upgt_eeprom_parse_freq3(sc, eeprom_option->data,
971 option_len);
972 break;
973 case UPGT_EEPROM_TYPE_FREQ4:
974 DPRINTF(1, "%s: EEPROM freq4 len=%d\n",
975 sc->sc_dev.dv_xname, option_len);
976
977 upgt_eeprom_parse_freq4(sc, eeprom_option->data,
978 option_len);
979 break;
980 case UPGT_EEPROM_TYPE_FREQ5:
981 DPRINTF(1, "%s: EEPROM freq5 len=%d\n",
982 sc->sc_dev.dv_xname, option_len);
983 break;
984 case UPGT_EEPROM_TYPE_FREQ6:
985 DPRINTF(1, "%s: EEPROM freq6 len=%d\n",
986 sc->sc_dev.dv_xname, option_len);
987
988 upgt_eeprom_parse_freq6(sc, eeprom_option->data,
989 option_len);
990 break;
991 case UPGT_EEPROM_TYPE_END:
992 DPRINTF(1, "%s: EEPROM end len=%d\n",
993 sc->sc_dev.dv_xname, option_len);
994 option_end = 1;
995 break;
996 case UPGT_EEPROM_TYPE_OFF:
997 DPRINTF(1, "%s: EEPROM off without end option!\n",
998 sc->sc_dev.dv_xname);
999 return (EIO);
1000 default:
1001 DPRINTF(1, "%s: EEPROM unknown type 0x%04x len=%d\n",
1002 sc->sc_dev.dv_xname, option_type, option_len);
1003 break;
1004 }
1005
1006 /* jump to next EEPROM option */
1007 eeprom_option = (struct upgt_eeprom_option *)
1008 (eeprom_option->data + option_len);
1009 }
1010
1011 return (0);
1012 }
1013
1014 void
upgt_eeprom_parse_hwrx(struct upgt_softc * sc,uint8_t * data)1015 upgt_eeprom_parse_hwrx(struct upgt_softc *sc, uint8_t *data)
1016 {
1017 struct upgt_eeprom_option_hwrx *option_hwrx;
1018
1019 option_hwrx = (struct upgt_eeprom_option_hwrx *)data;
1020
1021 sc->sc_eeprom_hwrx = option_hwrx->rxfilter - UPGT_EEPROM_RX_CONST;
1022
1023 DPRINTF(2, "%s: hwrx option value=0x%04x\n",
1024 sc->sc_dev.dv_xname, sc->sc_eeprom_hwrx);
1025 }
1026
1027 void
upgt_eeprom_parse_freq3(struct upgt_softc * sc,uint8_t * data,int len)1028 upgt_eeprom_parse_freq3(struct upgt_softc *sc, uint8_t *data, int len)
1029 {
1030 struct upgt_eeprom_freq3_header *freq3_header;
1031 struct upgt_lmac_freq3 *freq3;
1032 int i, elements, flags;
1033 unsigned channel;
1034
1035 freq3_header = (struct upgt_eeprom_freq3_header *)data;
1036 freq3 = (struct upgt_lmac_freq3 *)(freq3_header + 1);
1037
1038 flags = freq3_header->flags;
1039 elements = freq3_header->elements;
1040
1041 DPRINTF(2, "%s: flags=0x%02x\n", sc->sc_dev.dv_xname, flags);
1042 DPRINTF(2, "%s: elements=%d\n", sc->sc_dev.dv_xname, elements);
1043
1044 for (i = 0; i < elements; i++) {
1045 channel = ieee80211_mhz2ieee(letoh16(freq3[i].freq), 0);
1046
1047 sc->sc_eeprom_freq3[channel] = freq3[i];
1048
1049 DPRINTF(2, "%s: frequency=%d, channel=%d\n",
1050 sc->sc_dev.dv_xname,
1051 letoh16(sc->sc_eeprom_freq3[channel].freq), channel);
1052 }
1053 }
1054
1055 void
upgt_eeprom_parse_freq4(struct upgt_softc * sc,uint8_t * data,int len)1056 upgt_eeprom_parse_freq4(struct upgt_softc *sc, uint8_t *data, int len)
1057 {
1058 struct upgt_eeprom_freq4_header *freq4_header;
1059 struct upgt_eeprom_freq4_1 *freq4_1;
1060 struct upgt_eeprom_freq4_2 *freq4_2;
1061 int i, j, elements, settings, flags;
1062 unsigned channel;
1063
1064 freq4_header = (struct upgt_eeprom_freq4_header *)data;
1065 freq4_1 = (struct upgt_eeprom_freq4_1 *)(freq4_header + 1);
1066
1067 flags = freq4_header->flags;
1068 elements = freq4_header->elements;
1069 settings = freq4_header->settings;
1070
1071 /* we need this value later */
1072 sc->sc_eeprom_freq6_settings = freq4_header->settings;
1073
1074 DPRINTF(2, "%s: flags=0x%02x\n", sc->sc_dev.dv_xname, flags);
1075 DPRINTF(2, "%s: elements=%d\n", sc->sc_dev.dv_xname, elements);
1076 DPRINTF(2, "%s: settings=%d\n", sc->sc_dev.dv_xname, settings);
1077
1078 for (i = 0; i < elements; i++) {
1079 channel = ieee80211_mhz2ieee(letoh16(freq4_1[i].freq), 0);
1080
1081 freq4_2 = (struct upgt_eeprom_freq4_2 *)freq4_1[i].data;
1082
1083 for (j = 0; j < settings; j++) {
1084 sc->sc_eeprom_freq4[channel][j].cmd = freq4_2[j];
1085 sc->sc_eeprom_freq4[channel][j].pad = 0;
1086 }
1087
1088 DPRINTF(2, "%s: frequency=%d, channel=%d\n",
1089 sc->sc_dev.dv_xname,
1090 letoh16(freq4_1[i].freq), channel);
1091 }
1092 }
1093
1094 void
upgt_eeprom_parse_freq6(struct upgt_softc * sc,uint8_t * data,int len)1095 upgt_eeprom_parse_freq6(struct upgt_softc *sc, uint8_t *data, int len)
1096 {
1097 struct upgt_lmac_freq6 *freq6;
1098 int i, elements;
1099 unsigned channel;
1100
1101 freq6 = (struct upgt_lmac_freq6 *)data;
1102
1103 elements = len / sizeof(struct upgt_lmac_freq6);
1104
1105 DPRINTF(2, "%s: elements=%d\n", sc->sc_dev.dv_xname, elements);
1106
1107 for (i = 0; i < elements; i++) {
1108 channel = ieee80211_mhz2ieee(letoh16(freq6[i].freq), 0);
1109
1110 sc->sc_eeprom_freq6[channel] = freq6[i];
1111
1112 DPRINTF(2, "%s: frequency=%d, channel=%d\n",
1113 sc->sc_dev.dv_xname,
1114 letoh16(sc->sc_eeprom_freq6[channel].freq), channel);
1115 }
1116 }
1117
1118 int
upgt_ioctl(struct ifnet * ifp,u_long cmd,caddr_t data)1119 upgt_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1120 {
1121 struct upgt_softc *sc = ifp->if_softc;
1122 struct ieee80211com *ic = &sc->sc_ic;
1123 int s, error = 0;
1124 uint8_t chan;
1125
1126 s = splnet();
1127
1128 switch (cmd) {
1129 case SIOCSIFADDR:
1130 ifp->if_flags |= IFF_UP;
1131 /* FALLTHROUGH */
1132 case SIOCSIFFLAGS:
1133 if (ifp->if_flags & IFF_UP) {
1134 if ((ifp->if_flags & IFF_RUNNING) == 0)
1135 upgt_init(ifp);
1136 } else {
1137 if (ifp->if_flags & IFF_RUNNING)
1138 upgt_stop(sc);
1139 }
1140 break;
1141 case SIOCS80211CHANNEL:
1142 /* allow fast channel switching in monitor mode */
1143 error = ieee80211_ioctl(ifp, cmd, data);
1144 if (error == ENETRESET &&
1145 ic->ic_opmode == IEEE80211_M_MONITOR) {
1146 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1147 (IFF_UP | IFF_RUNNING)) {
1148 ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1149 chan = ieee80211_chan2ieee(ic,
1150 ic->ic_bss->ni_chan);
1151 upgt_set_channel(sc, chan);
1152 }
1153 error = 0;
1154 }
1155 break;
1156 default:
1157 error = ieee80211_ioctl(ifp, cmd, data);
1158 break;
1159 }
1160
1161 if (error == ENETRESET) {
1162 if (ifp->if_flags & (IFF_UP | IFF_RUNNING))
1163 upgt_init(ifp);
1164 error = 0;
1165 }
1166
1167 splx(s);
1168
1169 return (error);
1170 }
1171
1172 int
upgt_init(struct ifnet * ifp)1173 upgt_init(struct ifnet *ifp)
1174 {
1175 struct upgt_softc *sc = ifp->if_softc;
1176 struct ieee80211com *ic = &sc->sc_ic;
1177
1178 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
1179
1180 IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1181
1182 /* select default channel */
1183 ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1184 sc->sc_cur_chan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1185
1186 /* setup device rates */
1187 upgt_setup_rates(sc);
1188
1189 ifp->if_flags |= IFF_RUNNING;
1190 ifq_clr_oactive(&ifp->if_snd);
1191
1192 upgt_set_macfilter(sc, IEEE80211_S_SCAN);
1193
1194 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1195 upgt_set_channel(sc, sc->sc_cur_chan);
1196 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1197 } else
1198 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1199
1200 return (0);
1201 }
1202
1203 void
upgt_stop(struct upgt_softc * sc)1204 upgt_stop(struct upgt_softc *sc)
1205 {
1206 struct ieee80211com *ic = &sc->sc_ic;
1207 struct ifnet *ifp = &ic->ic_if;
1208
1209 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
1210
1211 /* device down */
1212 ifp->if_timer = 0;
1213 ifp->if_flags &= ~IFF_RUNNING;
1214 ifq_clr_oactive(&ifp->if_snd);
1215
1216 upgt_set_led(sc, UPGT_LED_OFF);
1217
1218 /* change device back to initial state */
1219 ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1220 }
1221
1222 int
upgt_media_change(struct ifnet * ifp)1223 upgt_media_change(struct ifnet *ifp)
1224 {
1225 struct upgt_softc *sc = ifp->if_softc;
1226 int error;
1227
1228 DPRINTF(1, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
1229
1230 if ((error = ieee80211_media_change(ifp)) != ENETRESET)
1231 return (error);
1232
1233 if (ifp->if_flags & (IFF_UP | IFF_RUNNING)) {
1234 /* give pending USB transfers a chance to finish */
1235 usbd_delay_ms(sc->sc_udev, 100);
1236 upgt_init(ifp);
1237 }
1238
1239 return (error);
1240 }
1241
1242 void
upgt_newassoc(struct ieee80211com * ic,struct ieee80211_node * ni,int isnew)1243 upgt_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
1244 {
1245 ni->ni_txrate = 0;
1246 }
1247
1248 int
upgt_newstate(struct ieee80211com * ic,enum ieee80211_state nstate,int arg)1249 upgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1250 {
1251 struct upgt_softc *sc = ic->ic_if.if_softc;
1252
1253 usb_rem_task(sc->sc_udev, &sc->sc_task_newstate);
1254 timeout_del(&sc->scan_to);
1255
1256 /* do it in a process context */
1257 sc->sc_state = nstate;
1258 sc->sc_arg = arg;
1259 usb_add_task(sc->sc_udev, &sc->sc_task_newstate);
1260
1261 return (0);
1262 }
1263
1264 void
upgt_newstate_task(void * arg)1265 upgt_newstate_task(void *arg)
1266 {
1267 struct upgt_softc *sc = arg;
1268 struct ieee80211com *ic = &sc->sc_ic;
1269 struct ieee80211_node *ni;
1270 unsigned channel;
1271
1272 switch (sc->sc_state) {
1273 case IEEE80211_S_INIT:
1274 DPRINTF(1, "%s: newstate is IEEE80211_S_INIT\n",
1275 sc->sc_dev.dv_xname);
1276
1277 /* do not accept any frames if the device is down */
1278 upgt_set_macfilter(sc, IEEE80211_S_INIT);
1279 upgt_set_led(sc, UPGT_LED_OFF);
1280 break;
1281 case IEEE80211_S_SCAN:
1282 DPRINTF(1, "%s: newstate is IEEE80211_S_SCAN\n",
1283 sc->sc_dev.dv_xname);
1284
1285 channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1286 upgt_set_channel(sc, channel);
1287 timeout_add_msec(&sc->scan_to, 200);
1288 break;
1289 case IEEE80211_S_AUTH:
1290 DPRINTF(1, "%s: newstate is IEEE80211_S_AUTH\n",
1291 sc->sc_dev.dv_xname);
1292
1293 channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1294 upgt_set_channel(sc, channel);
1295 break;
1296 case IEEE80211_S_ASSOC:
1297 DPRINTF(1, "%s: newstate is IEEE80211_S_ASSOC\n",
1298 sc->sc_dev.dv_xname);
1299 break;
1300 case IEEE80211_S_RUN:
1301 DPRINTF(1, "%s: newstate is IEEE80211_S_RUN\n",
1302 sc->sc_dev.dv_xname);
1303
1304 ni = ic->ic_bss;
1305
1306 /*
1307 * TX rate control is done by the firmware.
1308 * Report the maximum rate which is available therefore.
1309 */
1310 ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
1311
1312 if (ic->ic_opmode != IEEE80211_M_MONITOR)
1313 upgt_set_macfilter(sc, IEEE80211_S_RUN);
1314 upgt_set_led(sc, UPGT_LED_ON);
1315 break;
1316 }
1317
1318 sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
1319 }
1320
1321 void
upgt_next_scan(void * arg)1322 upgt_next_scan(void *arg)
1323 {
1324 struct upgt_softc *sc = arg;
1325 struct ieee80211com *ic = &sc->sc_ic;
1326 struct ifnet *ifp = &ic->ic_if;
1327
1328 DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
1329
1330 if (ic->ic_state == IEEE80211_S_SCAN)
1331 ieee80211_next_scan(ifp);
1332 }
1333
1334 void
upgt_start(struct ifnet * ifp)1335 upgt_start(struct ifnet *ifp)
1336 {
1337 struct upgt_softc *sc = ifp->if_softc;
1338 struct ieee80211com *ic = &sc->sc_ic;
1339 struct ieee80211_node *ni;
1340 struct mbuf *m;
1341 int i;
1342
1343 /* don't transmit packets if interface is busy or down */
1344 if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
1345 return;
1346
1347 DPRINTF(2, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
1348
1349 for (i = 0; i < UPGT_TX_COUNT; i++) {
1350 struct upgt_data *data_tx = &sc->tx_data[i];
1351
1352 m = mq_dequeue(&ic->ic_mgtq);
1353 if (m != NULL) {
1354 /* management frame */
1355 ni = m->m_pkthdr.ph_cookie;
1356 #if NBPFILTER > 0
1357 if (ic->ic_rawbpf != NULL)
1358 bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1359 #endif
1360 if ((data_tx->addr = upgt_mem_alloc(sc)) == 0) {
1361 printf("%s: no free prism memory!\n",
1362 sc->sc_dev.dv_xname);
1363 return;
1364 }
1365 data_tx->ni = ni;
1366 data_tx->m = m;
1367 sc->tx_queued++;
1368 } else {
1369 /* data frame */
1370 if (ic->ic_state != IEEE80211_S_RUN)
1371 break;
1372
1373 m = ifq_dequeue(&ifp->if_snd);
1374 if (m == NULL)
1375 break;
1376
1377 #if NBPFILTER > 0
1378 if (ifp->if_bpf != NULL)
1379 bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1380 #endif
1381 m = ieee80211_encap(ifp, m, &ni);
1382 if (m == NULL)
1383 continue;
1384 #if NBPFILTER > 0
1385 if (ic->ic_rawbpf != NULL)
1386 bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1387 #endif
1388 if ((data_tx->addr = upgt_mem_alloc(sc)) == 0) {
1389 printf("%s: no free prism memory!\n",
1390 sc->sc_dev.dv_xname);
1391 return;
1392 }
1393 data_tx->ni = ni;
1394 data_tx->m = m;
1395 sc->tx_queued++;
1396 }
1397 }
1398
1399 if (sc->tx_queued > 0) {
1400 DPRINTF(2, "%s: tx_queued=%d\n",
1401 sc->sc_dev.dv_xname, sc->tx_queued);
1402 /* process the TX queue in process context */
1403 ifp->if_timer = 5;
1404 ifq_set_oactive(&ifp->if_snd);
1405 usb_rem_task(sc->sc_udev, &sc->sc_task_tx);
1406 usb_add_task(sc->sc_udev, &sc->sc_task_tx);
1407 }
1408 }
1409
1410 void
upgt_watchdog(struct ifnet * ifp)1411 upgt_watchdog(struct ifnet *ifp)
1412 {
1413 struct upgt_softc *sc = ifp->if_softc;
1414 struct ieee80211com *ic = &sc->sc_ic;
1415
1416 if (ic->ic_state == IEEE80211_S_INIT)
1417 return;
1418
1419 printf("%s: watchdog timeout!\n", sc->sc_dev.dv_xname);
1420
1421 /* TODO: what shall we do on TX timeout? */
1422
1423 ieee80211_watchdog(ifp);
1424 }
1425
1426 void
upgt_tx_task(void * arg)1427 upgt_tx_task(void *arg)
1428 {
1429 struct upgt_softc *sc = arg;
1430 struct ieee80211com *ic = &sc->sc_ic;
1431 struct ieee80211_frame *wh;
1432 struct ieee80211_key *k;
1433 struct upgt_lmac_mem *mem;
1434 struct upgt_lmac_tx_desc *txdesc;
1435 struct mbuf *m;
1436 uint32_t addr;
1437 int len, i, s;
1438 usbd_status error;
1439
1440 s = splusb();
1441
1442 upgt_set_led(sc, UPGT_LED_BLINK);
1443
1444 for (i = 0; i < UPGT_TX_COUNT; i++) {
1445 struct upgt_data *data_tx = &sc->tx_data[i];
1446
1447 if (data_tx->m == NULL) {
1448 DPRINTF(2, "%s: %d: m is NULL\n",
1449 sc->sc_dev.dv_xname, i);
1450 continue;
1451 }
1452
1453 m = data_tx->m;
1454 addr = data_tx->addr + UPGT_MEMSIZE_FRAME_HEAD;
1455
1456 /*
1457 * Software crypto.
1458 */
1459 wh = mtod(m, struct ieee80211_frame *);
1460
1461 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1462 k = ieee80211_get_txkey(ic, wh, ic->ic_bss);
1463
1464 if ((m = ieee80211_encrypt(ic, m, k)) == NULL) {
1465 splx(s);
1466 return;
1467 }
1468
1469 /* in case packet header moved, reset pointer */
1470 wh = mtod(m, struct ieee80211_frame *);
1471 }
1472
1473 /*
1474 * Transmit the URB containing the TX data.
1475 */
1476 bzero(data_tx->buf, MCLBYTES);
1477
1478 mem = (struct upgt_lmac_mem *)data_tx->buf;
1479 mem->addr = htole32(addr);
1480
1481 txdesc = (struct upgt_lmac_tx_desc *)(mem + 1);
1482
1483 /* XXX differ between data and mgmt frames? */
1484 txdesc->header1.flags = UPGT_H1_FLAGS_TX_DATA;
1485 txdesc->header1.type = UPGT_H1_TYPE_TX_DATA;
1486 txdesc->header1.len = htole16(m->m_pkthdr.len);
1487
1488 txdesc->header2.reqid = htole32(data_tx->addr);
1489 txdesc->header2.type = htole16(UPGT_H2_TYPE_TX_ACK_YES);
1490 txdesc->header2.flags = htole16(UPGT_H2_FLAGS_TX_ACK_YES);
1491
1492 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1493 IEEE80211_FC0_TYPE_MGT) {
1494 /* always send mgmt frames at lowest rate (DS1) */
1495 memset(txdesc->rates, 0x10, sizeof(txdesc->rates));
1496 } else {
1497 bcopy(sc->sc_cur_rateset, txdesc->rates,
1498 sizeof(txdesc->rates));
1499 }
1500 txdesc->type = htole32(UPGT_TX_DESC_TYPE_DATA);
1501 txdesc->pad3[0] = UPGT_TX_DESC_PAD3_SIZE;
1502
1503 #if NBPFILTER > 0
1504 if (sc->sc_drvbpf != NULL) {
1505 struct mbuf mb;
1506 struct upgt_tx_radiotap_header *tap = &sc->sc_txtap;
1507
1508 tap->wt_flags = 0;
1509 tap->wt_rate = 0; /* TODO: where to get from? */
1510 tap->wt_chan_freq =
1511 htole16(ic->ic_bss->ni_chan->ic_freq);
1512 tap->wt_chan_flags =
1513 htole16(ic->ic_bss->ni_chan->ic_flags);
1514
1515 mb.m_data = (caddr_t)tap;
1516 mb.m_len = sc->sc_txtap_len;
1517 mb.m_next = m;
1518 mb.m_nextpkt = NULL;
1519 mb.m_type = 0;
1520 mb.m_flags = 0;
1521 bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1522 }
1523 #endif
1524 /* copy frame below our TX descriptor header */
1525 m_copydata(m, 0, m->m_pkthdr.len,
1526 data_tx->buf + (sizeof(*mem) + sizeof(*txdesc)));
1527
1528 /* calculate frame size */
1529 len = sizeof(*mem) + sizeof(*txdesc) + m->m_pkthdr.len;
1530
1531 /* we need to align the frame to a 4 byte boundary */
1532 len = (len + 3) & ~3;
1533
1534 /* calculate frame checksum */
1535 mem->chksum = upgt_chksum_le((uint32_t *)txdesc,
1536 len - sizeof(*mem));
1537
1538 /* we do not need the mbuf anymore */
1539 m_freem(m);
1540 data_tx->m = NULL;
1541
1542 DPRINTF(2, "%s: TX start data sending\n", sc->sc_dev.dv_xname);
1543
1544 usbd_setup_xfer(data_tx->xfer, sc->sc_tx_pipeh, data_tx,
1545 data_tx->buf, len, USBD_FORCE_SHORT_XFER | USBD_NO_COPY,
1546 UPGT_USB_TIMEOUT, NULL);
1547 error = usbd_transfer(data_tx->xfer);
1548 if (error != 0 && error != USBD_IN_PROGRESS) {
1549 printf("%s: could not transmit TX data URB!\n",
1550 sc->sc_dev.dv_xname);
1551 splx(s);
1552 return;
1553 }
1554
1555 DPRINTF(2, "%s: TX sent (%d bytes)\n",
1556 sc->sc_dev.dv_xname, len);
1557 }
1558
1559 /*
1560 * If we don't regularly read the device statistics, the RX queue
1561 * will stall. It's strange, but it works, so we keep reading
1562 * the statistics here. *shrug*
1563 */
1564 upgt_get_stats(sc);
1565
1566 splx(s);
1567 }
1568
1569 void
upgt_tx_done(struct upgt_softc * sc,uint8_t * data)1570 upgt_tx_done(struct upgt_softc *sc, uint8_t *data)
1571 {
1572 struct ieee80211com *ic = &sc->sc_ic;
1573 struct ifnet *ifp = &ic->ic_if;
1574 struct upgt_lmac_tx_done_desc *desc;
1575 int i, s;
1576
1577 s = splnet();
1578
1579 desc = (struct upgt_lmac_tx_done_desc *)data;
1580
1581 for (i = 0; i < UPGT_TX_COUNT; i++) {
1582 struct upgt_data *data_tx = &sc->tx_data[i];
1583
1584 if (data_tx->addr == letoh32(desc->header2.reqid)) {
1585 upgt_mem_free(sc, data_tx->addr);
1586 ieee80211_release_node(ic, data_tx->ni);
1587 data_tx->ni = NULL;
1588 data_tx->addr = 0;
1589
1590 sc->tx_queued--;
1591
1592 DPRINTF(2, "%s: TX done: ", sc->sc_dev.dv_xname);
1593 DPRINTF(2, "memaddr=0x%08x, status=0x%04x, rssi=%d, ",
1594 letoh32(desc->header2.reqid),
1595 letoh16(desc->status),
1596 letoh16(desc->rssi));
1597 DPRINTF(2, "seq=%d\n", letoh16(desc->seq));
1598 break;
1599 }
1600 }
1601
1602 if (sc->tx_queued == 0) {
1603 /* TX queued was processed, continue */
1604 ifp->if_timer = 0;
1605 ifq_clr_oactive(&ifp->if_snd);
1606 upgt_start(ifp);
1607 }
1608
1609 splx(s);
1610 }
1611
1612 void
upgt_rx_cb(struct usbd_xfer * xfer,void * priv,usbd_status status)1613 upgt_rx_cb(struct usbd_xfer *xfer, void *priv, usbd_status status)
1614 {
1615 struct upgt_data *data_rx = priv;
1616 struct upgt_softc *sc = data_rx->sc;
1617 int len;
1618 struct upgt_lmac_header *header;
1619 struct upgt_lmac_eeprom *eeprom;
1620 uint8_t h1_type;
1621 uint16_t h2_type;
1622
1623 DPRINTF(3, "%s: %s\n", sc->sc_dev.dv_xname, __func__);
1624
1625 if (status != USBD_NORMAL_COMPLETION) {
1626 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
1627 return;
1628 if (status == USBD_STALLED)
1629 usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh);
1630 goto skip;
1631 }
1632 usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
1633
1634 /*
1635 * Check what type of frame came in.
1636 */
1637 header = (struct upgt_lmac_header *)(data_rx->buf + 4);
1638
1639 h1_type = header->header1.type;
1640 h2_type = letoh16(header->header2.type);
1641
1642 if (h1_type == UPGT_H1_TYPE_CTRL &&
1643 h2_type == UPGT_H2_TYPE_EEPROM) {
1644 eeprom = (struct upgt_lmac_eeprom *)(data_rx->buf + 4);
1645 uint16_t eeprom_offset = letoh16(eeprom->offset);
1646 uint16_t eeprom_len = letoh16(eeprom->len);
1647
1648 DPRINTF(2, "%s: received EEPROM block (offset=%d, len=%d)\n",
1649 sc->sc_dev.dv_xname, eeprom_offset, eeprom_len);
1650
1651 bcopy(data_rx->buf + sizeof(struct upgt_lmac_eeprom) + 4,
1652 sc->sc_eeprom + eeprom_offset, eeprom_len);
1653
1654 /* EEPROM data has arrived in time, wakeup tsleep() */
1655 wakeup(sc);
1656 } else
1657 if (h1_type == UPGT_H1_TYPE_CTRL &&
1658 h2_type == UPGT_H2_TYPE_TX_DONE) {
1659 DPRINTF(2, "%s: received 802.11 TX done\n",
1660 sc->sc_dev.dv_xname);
1661
1662 upgt_tx_done(sc, data_rx->buf + 4);
1663 } else
1664 if (h1_type == UPGT_H1_TYPE_RX_DATA ||
1665 h1_type == UPGT_H1_TYPE_RX_DATA_MGMT) {
1666 DPRINTF(3, "%s: received 802.11 RX data\n",
1667 sc->sc_dev.dv_xname);
1668
1669 upgt_rx(sc, data_rx->buf + 4, letoh16(header->header1.len));
1670 } else
1671 if (h1_type == UPGT_H1_TYPE_CTRL &&
1672 h2_type == UPGT_H2_TYPE_STATS) {
1673 DPRINTF(2, "%s: received statistic data\n",
1674 sc->sc_dev.dv_xname);
1675
1676 /* TODO: what could we do with the statistic data? */
1677 } else {
1678 /* ignore unknown frame types */
1679 DPRINTF(1, "%s: received unknown frame type 0x%02x\n",
1680 sc->sc_dev.dv_xname, header->header1.type);
1681 }
1682
1683 skip: /* setup new transfer */
1684 usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data_rx, data_rx->buf, MCLBYTES,
1685 USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, upgt_rx_cb);
1686 (void)usbd_transfer(xfer);
1687 }
1688
1689 void
upgt_rx(struct upgt_softc * sc,uint8_t * data,int pkglen)1690 upgt_rx(struct upgt_softc *sc, uint8_t *data, int pkglen)
1691 {
1692 struct ieee80211com *ic = &sc->sc_ic;
1693 struct ifnet *ifp = &ic->ic_if;
1694 struct upgt_lmac_rx_desc *rxdesc;
1695 struct ieee80211_frame *wh;
1696 struct ieee80211_rxinfo rxi;
1697 struct ieee80211_node *ni;
1698 struct mbuf *m;
1699 int s;
1700
1701 /* access RX packet descriptor */
1702 rxdesc = (struct upgt_lmac_rx_desc *)data;
1703
1704 /* create mbuf which is suitable for strict alignment archs */
1705 m = m_devget(rxdesc->data, pkglen, ETHER_ALIGN);
1706 if (m == NULL) {
1707 DPRINTF(1, "%s: could not create RX mbuf!\n", sc->sc_dev.dv_xname);
1708 ifp->if_ierrors++;
1709 return;
1710 }
1711
1712 s = splnet();
1713
1714 #if NBPFILTER > 0
1715 if (sc->sc_drvbpf != NULL) {
1716 struct mbuf mb;
1717 struct upgt_rx_radiotap_header *tap = &sc->sc_rxtap;
1718
1719 tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1720 tap->wr_rate = upgt_rx_rate(sc, rxdesc->rate);
1721 tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1722 tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1723 tap->wr_antsignal = rxdesc->rssi;
1724
1725 mb.m_data = (caddr_t)tap;
1726 mb.m_len = sc->sc_rxtap_len;
1727 mb.m_next = m;
1728 mb.m_nextpkt = NULL;
1729 mb.m_type = 0;
1730 mb.m_flags = 0;
1731 bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1732 }
1733 #endif
1734 /* trim FCS */
1735 m_adj(m, -IEEE80211_CRC_LEN);
1736
1737 wh = mtod(m, struct ieee80211_frame *);
1738 ni = ieee80211_find_rxnode(ic, wh);
1739
1740 /* push the frame up to the 802.11 stack */
1741 memset(&rxi, 0, sizeof(rxi));
1742 rxi.rxi_flags = 0;
1743 rxi.rxi_rssi = rxdesc->rssi;
1744 ieee80211_input(ifp, m, ni, &rxi);
1745
1746 /* node is no longer needed */
1747 ieee80211_release_node(ic, ni);
1748
1749 splx(s);
1750
1751 DPRINTF(3, "%s: RX done\n", sc->sc_dev.dv_xname);
1752 }
1753
1754 void
upgt_setup_rates(struct upgt_softc * sc)1755 upgt_setup_rates(struct upgt_softc *sc)
1756 {
1757 struct ieee80211com *ic = &sc->sc_ic;
1758
1759 /*
1760 * 0x01 = OFMD6 0x10 = DS1
1761 * 0x04 = OFDM9 0x11 = DS2
1762 * 0x06 = OFDM12 0x12 = DS5
1763 * 0x07 = OFDM18 0x13 = DS11
1764 * 0x08 = OFDM24
1765 * 0x09 = OFDM36
1766 * 0x0a = OFDM48
1767 * 0x0b = OFDM54
1768 */
1769 const uint8_t rateset_auto_11b[] =
1770 { 0x13, 0x13, 0x12, 0x11, 0x11, 0x10, 0x10, 0x10 };
1771 const uint8_t rateset_auto_11g[] =
1772 { 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x04, 0x01 };
1773 const uint8_t rateset_fix_11bg[] =
1774 { 0x10, 0x11, 0x12, 0x13, 0x01, 0x04, 0x06, 0x07,
1775 0x08, 0x09, 0x0a, 0x0b };
1776
1777 if (ic->ic_fixed_rate == -1) {
1778 /*
1779 * Automatic rate control is done by the device.
1780 * We just pass the rateset from which the device
1781 * will pickup a rate.
1782 */
1783 if (ic->ic_curmode == IEEE80211_MODE_11B)
1784 bcopy(rateset_auto_11b, sc->sc_cur_rateset,
1785 sizeof(sc->sc_cur_rateset));
1786 if (ic->ic_curmode == IEEE80211_MODE_11G ||
1787 ic->ic_curmode == IEEE80211_MODE_AUTO)
1788 bcopy(rateset_auto_11g, sc->sc_cur_rateset,
1789 sizeof(sc->sc_cur_rateset));
1790 } else {
1791 /* set a fixed rate */
1792 memset(sc->sc_cur_rateset, rateset_fix_11bg[ic->ic_fixed_rate],
1793 sizeof(sc->sc_cur_rateset));
1794 }
1795 }
1796
1797 uint8_t
upgt_rx_rate(struct upgt_softc * sc,const int rate)1798 upgt_rx_rate(struct upgt_softc *sc, const int rate)
1799 {
1800 struct ieee80211com *ic = &sc->sc_ic;
1801
1802 if (ic->ic_curmode == IEEE80211_MODE_11B) {
1803 if (rate < 0 || rate > 3)
1804 /* invalid rate */
1805 return (0);
1806
1807 switch (rate) {
1808 case 0:
1809 return (2);
1810 case 1:
1811 return (4);
1812 case 2:
1813 return (11);
1814 case 3:
1815 return (22);
1816 default:
1817 return (0);
1818 }
1819 }
1820
1821 if (ic->ic_curmode == IEEE80211_MODE_11G) {
1822 if (rate < 0 || rate > 11)
1823 /* invalid rate */
1824 return (0);
1825
1826 switch (rate) {
1827 case 0:
1828 return (2);
1829 case 1:
1830 return (4);
1831 case 2:
1832 return (11);
1833 case 3:
1834 return (22);
1835 case 4:
1836 return (12);
1837 case 5:
1838 return (18);
1839 case 6:
1840 return (24);
1841 case 7:
1842 return (36);
1843 case 8:
1844 return (48);
1845 case 9:
1846 return (72);
1847 case 10:
1848 return (96);
1849 case 11:
1850 return (108);
1851 default:
1852 return (0);
1853 }
1854 }
1855
1856 return (0);
1857 }
1858
1859 int
upgt_set_macfilter(struct upgt_softc * sc,uint8_t state)1860 upgt_set_macfilter(struct upgt_softc *sc, uint8_t state)
1861 {
1862 struct ieee80211com *ic = &sc->sc_ic;
1863 struct ieee80211_node *ni = ic->ic_bss;
1864 struct upgt_data *data_cmd = &sc->cmd_data;
1865 struct upgt_lmac_mem *mem;
1866 struct upgt_lmac_filter *filter;
1867 int len;
1868 uint8_t broadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1869
1870 /*
1871 * Transmit the URB containing the CMD data.
1872 */
1873 bzero(data_cmd->buf, MCLBYTES);
1874
1875 mem = (struct upgt_lmac_mem *)data_cmd->buf;
1876 mem->addr = htole32(sc->sc_memaddr_frame_start +
1877 UPGT_MEMSIZE_FRAME_HEAD);
1878
1879 filter = (struct upgt_lmac_filter *)(mem + 1);
1880
1881 filter->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK;
1882 filter->header1.type = UPGT_H1_TYPE_CTRL;
1883 filter->header1.len = htole16(
1884 sizeof(struct upgt_lmac_filter) -
1885 sizeof(struct upgt_lmac_header));
1886
1887 filter->header2.reqid = htole32(sc->sc_memaddr_frame_start);
1888 filter->header2.type = htole16(UPGT_H2_TYPE_MACFILTER);
1889 filter->header2.flags = 0;
1890
1891 switch (state) {
1892 case IEEE80211_S_INIT:
1893 DPRINTF(1, "%s: set MAC filter to INIT\n",
1894 sc->sc_dev.dv_xname);
1895
1896 filter->type = htole16(UPGT_FILTER_TYPE_RESET);
1897 break;
1898 case IEEE80211_S_SCAN:
1899 DPRINTF(1, "%s: set MAC filter to SCAN (bssid %s)\n",
1900 sc->sc_dev.dv_xname, ether_sprintf(broadcast));
1901
1902 filter->type = htole16(UPGT_FILTER_TYPE_NONE);
1903 IEEE80211_ADDR_COPY(filter->dst, ic->ic_myaddr);
1904 IEEE80211_ADDR_COPY(filter->src, broadcast);
1905 filter->unknown1 = htole16(UPGT_FILTER_UNKNOWN1);
1906 filter->rxaddr = htole32(sc->sc_memaddr_rx_start);
1907 filter->unknown2 = htole16(UPGT_FILTER_UNKNOWN2);
1908 filter->rxhw = htole32(sc->sc_eeprom_hwrx);
1909 filter->unknown3 = htole16(UPGT_FILTER_UNKNOWN3);
1910 break;
1911 case IEEE80211_S_RUN:
1912 DPRINTF(1, "%s: set MAC filter to RUN (bssid %s)\n",
1913 sc->sc_dev.dv_xname, ether_sprintf(ni->ni_bssid));
1914
1915 filter->type = htole16(UPGT_FILTER_TYPE_STA);
1916 IEEE80211_ADDR_COPY(filter->dst, ic->ic_myaddr);
1917 IEEE80211_ADDR_COPY(filter->src, ni->ni_bssid);
1918 filter->unknown1 = htole16(UPGT_FILTER_UNKNOWN1);
1919 filter->rxaddr = htole32(sc->sc_memaddr_rx_start);
1920 filter->unknown2 = htole16(UPGT_FILTER_UNKNOWN2);
1921 filter->rxhw = htole32(sc->sc_eeprom_hwrx);
1922 filter->unknown3 = htole16(UPGT_FILTER_UNKNOWN3);
1923 break;
1924 default:
1925 printf("%s: MAC filter does not know that state!\n",
1926 sc->sc_dev.dv_xname);
1927 break;
1928 }
1929
1930 len = sizeof(*mem) + sizeof(*filter);
1931
1932 mem->chksum = upgt_chksum_le((uint32_t *)filter,
1933 len - sizeof(*mem));
1934
1935 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
1936 printf("%s: could not transmit macfilter CMD data URB!\n",
1937 sc->sc_dev.dv_xname);
1938 return (EIO);
1939 }
1940
1941 return (0);
1942 }
1943
1944 int
upgt_set_channel(struct upgt_softc * sc,unsigned channel)1945 upgt_set_channel(struct upgt_softc *sc, unsigned channel)
1946 {
1947 struct upgt_data *data_cmd = &sc->cmd_data;
1948 struct upgt_lmac_mem *mem;
1949 struct upgt_lmac_channel *chan;
1950 int len;
1951
1952 DPRINTF(1, "%s: %s: %d\n", sc->sc_dev.dv_xname, __func__, channel);
1953
1954 /*
1955 * Transmit the URB containing the CMD data.
1956 */
1957 bzero(data_cmd->buf, MCLBYTES);
1958
1959 mem = (struct upgt_lmac_mem *)data_cmd->buf;
1960 mem->addr = htole32(sc->sc_memaddr_frame_start +
1961 UPGT_MEMSIZE_FRAME_HEAD);
1962
1963 chan = (struct upgt_lmac_channel *)(mem + 1);
1964
1965 chan->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK;
1966 chan->header1.type = UPGT_H1_TYPE_CTRL;
1967 chan->header1.len = htole16(
1968 sizeof(struct upgt_lmac_channel) -
1969 sizeof(struct upgt_lmac_header));
1970
1971 chan->header2.reqid = htole32(sc->sc_memaddr_frame_start);
1972 chan->header2.type = htole16(UPGT_H2_TYPE_CHANNEL);
1973 chan->header2.flags = 0;
1974
1975 chan->unknown1 = htole16(UPGT_CHANNEL_UNKNOWN1);
1976 chan->unknown2 = htole16(UPGT_CHANNEL_UNKNOWN2);
1977 chan->freq6 = sc->sc_eeprom_freq6[channel];
1978 chan->settings = sc->sc_eeprom_freq6_settings;
1979 chan->unknown3 = UPGT_CHANNEL_UNKNOWN3;
1980
1981 bcopy(&sc->sc_eeprom_freq3[channel].data, chan->freq3_1,
1982 sizeof(chan->freq3_1));
1983
1984 bcopy(&sc->sc_eeprom_freq4[channel], chan->freq4,
1985 sizeof(sc->sc_eeprom_freq4[channel]));
1986
1987 bcopy(&sc->sc_eeprom_freq3[channel].data, chan->freq3_2,
1988 sizeof(chan->freq3_2));
1989
1990 len = sizeof(*mem) + sizeof(*chan);
1991
1992 mem->chksum = upgt_chksum_le((uint32_t *)chan,
1993 len - sizeof(*mem));
1994
1995 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
1996 printf("%s: could not transmit channel CMD data URB!\n",
1997 sc->sc_dev.dv_xname);
1998 return (EIO);
1999 }
2000
2001 return (0);
2002 }
2003
2004 void
upgt_set_led(struct upgt_softc * sc,int action)2005 upgt_set_led(struct upgt_softc *sc, int action)
2006 {
2007 struct ieee80211com *ic = &sc->sc_ic;
2008 struct upgt_data *data_cmd = &sc->cmd_data;
2009 struct upgt_lmac_mem *mem;
2010 struct upgt_lmac_led *led;
2011 int len;
2012
2013 /*
2014 * Transmit the URB containing the CMD data.
2015 */
2016 bzero(data_cmd->buf, MCLBYTES);
2017
2018 mem = (struct upgt_lmac_mem *)data_cmd->buf;
2019 mem->addr = htole32(sc->sc_memaddr_frame_start +
2020 UPGT_MEMSIZE_FRAME_HEAD);
2021
2022 led = (struct upgt_lmac_led *)(mem + 1);
2023
2024 led->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK;
2025 led->header1.type = UPGT_H1_TYPE_CTRL;
2026 led->header1.len = htole16(
2027 sizeof(struct upgt_lmac_led) -
2028 sizeof(struct upgt_lmac_header));
2029
2030 led->header2.reqid = htole32(sc->sc_memaddr_frame_start);
2031 led->header2.type = htole16(UPGT_H2_TYPE_LED);
2032 led->header2.flags = 0;
2033
2034 switch (action) {
2035 case UPGT_LED_OFF:
2036 led->mode = htole16(UPGT_LED_MODE_SET);
2037 led->action_fix = 0;
2038 led->action_tmp = htole16(UPGT_LED_ACTION_OFF);
2039 led->action_tmp_dur = 0;
2040 break;
2041 case UPGT_LED_ON:
2042 led->mode = htole16(UPGT_LED_MODE_SET);
2043 led->action_fix = 0;
2044 led->action_tmp = htole16(UPGT_LED_ACTION_ON);
2045 led->action_tmp_dur = 0;
2046 break;
2047 case UPGT_LED_BLINK:
2048 if (ic->ic_state != IEEE80211_S_RUN)
2049 return;
2050 if (sc->sc_led_blink)
2051 /* previous blink was not finished */
2052 return;
2053 led->mode = htole16(UPGT_LED_MODE_SET);
2054 led->action_fix = htole16(UPGT_LED_ACTION_OFF);
2055 led->action_tmp = htole16(UPGT_LED_ACTION_ON);
2056 led->action_tmp_dur = htole16(UPGT_LED_ACTION_TMP_DUR);
2057 /* lock blink */
2058 sc->sc_led_blink = 1;
2059 timeout_add_msec(&sc->led_to, UPGT_LED_ACTION_TMP_DUR);
2060 break;
2061 default:
2062 return;
2063 }
2064
2065 len = sizeof(*mem) + sizeof(*led);
2066
2067 mem->chksum = upgt_chksum_le((uint32_t *)led,
2068 len - sizeof(*mem));
2069
2070 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
2071 printf("%s: could not transmit led CMD URB!\n",
2072 sc->sc_dev.dv_xname);
2073 }
2074 }
2075
2076 void
upgt_set_led_blink(void * arg)2077 upgt_set_led_blink(void *arg)
2078 {
2079 struct upgt_softc *sc = arg;
2080
2081 /* blink finished, we are ready for a next one */
2082 sc->sc_led_blink = 0;
2083 timeout_del(&sc->led_to);
2084 }
2085
2086 int
upgt_get_stats(struct upgt_softc * sc)2087 upgt_get_stats(struct upgt_softc *sc)
2088 {
2089 struct upgt_data *data_cmd = &sc->cmd_data;
2090 struct upgt_lmac_mem *mem;
2091 struct upgt_lmac_stats *stats;
2092 int len;
2093
2094 /*
2095 * Transmit the URB containing the CMD data.
2096 */
2097 bzero(data_cmd->buf, MCLBYTES);
2098
2099 mem = (struct upgt_lmac_mem *)data_cmd->buf;
2100 mem->addr = htole32(sc->sc_memaddr_frame_start +
2101 UPGT_MEMSIZE_FRAME_HEAD);
2102
2103 stats = (struct upgt_lmac_stats *)(mem + 1);
2104
2105 stats->header1.flags = 0;
2106 stats->header1.type = UPGT_H1_TYPE_CTRL;
2107 stats->header1.len = htole16(
2108 sizeof(struct upgt_lmac_stats) -
2109 sizeof(struct upgt_lmac_header));
2110
2111 stats->header2.reqid = htole32(sc->sc_memaddr_frame_start);
2112 stats->header2.type = htole16(UPGT_H2_TYPE_STATS);
2113 stats->header2.flags = 0;
2114
2115 len = sizeof(*mem) + sizeof(*stats);
2116
2117 mem->chksum = upgt_chksum_le((uint32_t *)stats,
2118 len - sizeof(*mem));
2119
2120 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) {
2121 printf("%s: could not transmit statistics CMD data URB!\n",
2122 sc->sc_dev.dv_xname);
2123 return (EIO);
2124 }
2125
2126 return (0);
2127
2128 }
2129
2130 int
upgt_alloc_tx(struct upgt_softc * sc)2131 upgt_alloc_tx(struct upgt_softc *sc)
2132 {
2133 int i;
2134
2135 sc->tx_queued = 0;
2136
2137 for (i = 0; i < UPGT_TX_COUNT; i++) {
2138 struct upgt_data *data_tx = &sc->tx_data[i];
2139
2140 data_tx->sc = sc;
2141
2142 data_tx->xfer = usbd_alloc_xfer(sc->sc_udev);
2143 if (data_tx->xfer == NULL) {
2144 printf("%s: could not allocate TX xfer!\n",
2145 sc->sc_dev.dv_xname);
2146 return (ENOMEM);
2147 }
2148
2149 data_tx->buf = usbd_alloc_buffer(data_tx->xfer, MCLBYTES);
2150 if (data_tx->buf == NULL) {
2151 printf("%s: could not allocate TX buffer!\n",
2152 sc->sc_dev.dv_xname);
2153 return (ENOMEM);
2154 }
2155
2156 bzero(data_tx->buf, MCLBYTES);
2157 }
2158
2159 return (0);
2160 }
2161
2162 int
upgt_alloc_rx(struct upgt_softc * sc)2163 upgt_alloc_rx(struct upgt_softc *sc)
2164 {
2165 struct upgt_data *data_rx = &sc->rx_data;
2166
2167 data_rx->sc = sc;
2168
2169 data_rx->xfer = usbd_alloc_xfer(sc->sc_udev);
2170 if (data_rx->xfer == NULL) {
2171 printf("%s: could not allocate RX xfer!\n",
2172 sc->sc_dev.dv_xname);
2173 return (ENOMEM);
2174 }
2175
2176 data_rx->buf = usbd_alloc_buffer(data_rx->xfer, MCLBYTES);
2177 if (data_rx->buf == NULL) {
2178 printf("%s: could not allocate RX buffer!\n",
2179 sc->sc_dev.dv_xname);
2180 return (ENOMEM);
2181 }
2182
2183 bzero(data_rx->buf, MCLBYTES);
2184
2185 return (0);
2186 }
2187
2188 int
upgt_alloc_cmd(struct upgt_softc * sc)2189 upgt_alloc_cmd(struct upgt_softc *sc)
2190 {
2191 struct upgt_data *data_cmd = &sc->cmd_data;
2192
2193 data_cmd->sc = sc;
2194
2195 data_cmd->xfer = usbd_alloc_xfer(sc->sc_udev);
2196 if (data_cmd->xfer == NULL) {
2197 printf("%s: could not allocate RX xfer!\n",
2198 sc->sc_dev.dv_xname);
2199 return (ENOMEM);
2200 }
2201
2202 data_cmd->buf = usbd_alloc_buffer(data_cmd->xfer, MCLBYTES);
2203 if (data_cmd->buf == NULL) {
2204 printf("%s: could not allocate RX buffer!\n",
2205 sc->sc_dev.dv_xname);
2206 return (ENOMEM);
2207 }
2208
2209 bzero(data_cmd->buf, MCLBYTES);
2210
2211 return (0);
2212 }
2213
2214 void
upgt_free_tx(struct upgt_softc * sc)2215 upgt_free_tx(struct upgt_softc *sc)
2216 {
2217 int i;
2218
2219 for (i = 0; i < UPGT_TX_COUNT; i++) {
2220 struct upgt_data *data_tx = &sc->tx_data[i];
2221
2222 if (data_tx->xfer != NULL) {
2223 usbd_free_xfer(data_tx->xfer);
2224 data_tx->xfer = NULL;
2225 }
2226
2227 data_tx->ni = NULL;
2228 }
2229 }
2230
2231 void
upgt_free_rx(struct upgt_softc * sc)2232 upgt_free_rx(struct upgt_softc *sc)
2233 {
2234 struct upgt_data *data_rx = &sc->rx_data;
2235
2236 if (data_rx->xfer != NULL) {
2237 usbd_free_xfer(data_rx->xfer);
2238 data_rx->xfer = NULL;
2239 }
2240
2241 data_rx->ni = NULL;
2242 }
2243
2244 void
upgt_free_cmd(struct upgt_softc * sc)2245 upgt_free_cmd(struct upgt_softc *sc)
2246 {
2247 struct upgt_data *data_cmd = &sc->cmd_data;
2248
2249 if (data_cmd->xfer != NULL) {
2250 usbd_free_xfer(data_cmd->xfer);
2251 data_cmd->xfer = NULL;
2252 }
2253 }
2254
2255 int
upgt_bulk_xmit(struct upgt_softc * sc,struct upgt_data * data,struct usbd_pipe * pipeh,uint32_t * size,int flags)2256 upgt_bulk_xmit(struct upgt_softc *sc, struct upgt_data *data,
2257 struct usbd_pipe *pipeh, uint32_t *size, int flags)
2258 {
2259 usbd_status status;
2260
2261 usbd_setup_xfer(data->xfer, pipeh, 0, data->buf, *size,
2262 USBD_NO_COPY | USBD_SYNCHRONOUS | flags, UPGT_USB_TIMEOUT, NULL);
2263 status = usbd_transfer(data->xfer);
2264 if (status != USBD_NORMAL_COMPLETION) {
2265 printf("%s: %s: error %s!\n",
2266 sc->sc_dev.dv_xname, __func__, usbd_errstr(status));
2267 return (EIO);
2268 }
2269
2270 return (0);
2271 }
2272
2273 void
upgt_hexdump(void * buf,int len)2274 upgt_hexdump(void *buf, int len)
2275 {
2276 int i;
2277
2278 for (i = 0; i < len; i++) {
2279 if (i % 16 == 0)
2280 printf("%s%5i:", i ? "\n" : "", i);
2281 if (i % 4 == 0)
2282 printf(" ");
2283 printf("%02x", (int)*((u_char *)buf + i));
2284 }
2285 printf("\n");
2286 }
2287
2288 uint32_t
upgt_crc32_le(const void * buf,size_t size)2289 upgt_crc32_le(const void *buf, size_t size)
2290 {
2291 uint32_t crc;
2292
2293 crc = ether_crc32_le(buf, size);
2294
2295 /* apply final XOR value as common for CRC-32 */
2296 crc = htole32(crc ^ 0xffffffffU);
2297
2298 return (crc);
2299 }
2300
2301 /*
2302 * The firmware awaits a checksum for each frame we send to it.
2303 * The algorithm used therefor is uncommon but somehow similar to CRC32.
2304 */
2305 uint32_t
upgt_chksum_le(const uint32_t * buf,size_t size)2306 upgt_chksum_le(const uint32_t *buf, size_t size)
2307 {
2308 int i;
2309 uint32_t crc = 0;
2310
2311 for (i = 0; i < size; i += sizeof(uint32_t)) {
2312 crc = htole32(crc ^ *buf++);
2313 crc = htole32((crc >> 5) ^ (crc << 3));
2314 }
2315
2316 return (crc);
2317 }
2318