1/* $NetBSD: if_upgt.c,v 1.33 2022/07/01 01:07:32 riastradh Exp $ */ 2/* $OpenBSD: if_upgt.c,v 1.49 2010/04/20 22:05:43 tedu Exp $ */ 3 4/* 5 * Copyright (c) 2007 Marcus Glocker <mglocker@openbsd.org> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20#include <sys/cdefs.h> 21__KERNEL_RCSID(0, "$NetBSD: if_upgt.c,v 1.33 2022/07/01 01:07:32 riastradh Exp $"); 22 23#ifdef _KERNEL_OPT 24#include "opt_usb.h" 25#endif 26 27#include <sys/param.h> 28#include <sys/callout.h> 29#include <sys/device.h> 30#include <sys/errno.h> 31#include <sys/kernel.h> 32#include <sys/kthread.h> 33#include <sys/mbuf.h> 34#include <sys/proc.h> 35#include <sys/sockio.h> 36#include <sys/systm.h> 37#include <sys/vnode.h> 38#include <sys/bus.h> 39#include <sys/endian.h> 40#include <sys/intr.h> 41 42#include <net/bpf.h> 43#include <net/if.h> 44#include <net/if_arp.h> 45#include <net/if_dl.h> 46#include <net/if_ether.h> 47#include <net/if_media.h> 48#include <net/if_types.h> 49 50#include <net80211/ieee80211_var.h> 51#include <net80211/ieee80211_radiotap.h> 52 53#include <dev/firmload.h> 54 55#include <dev/usb/usb.h> 56#include <dev/usb/usbdi.h> 57#include <dev/usb/usbdi_util.h> 58#include <dev/usb/usbdivar.h> 59#include <dev/usb/usbdevs.h> 60 61#include <dev/usb/if_upgtvar.h> 62 63/* 64 * Driver for the USB PrismGT devices. 65 * 66 * For now just USB 2.0 devices with the GW3887 chipset are supported. 67 * The driver has been written based on the firmware version 2.13.1.0_LM87. 68 * 69 * TODO's: 70 * - Fix MONITOR mode (MAC filter). 71 * - Add HOSTAP mode. 72 * - Add IBSS mode. 73 * - Support the USB 1.0 devices (NET2280, ISL3880, ISL3886 chipsets). 74 * 75 * Parts of this driver has been influenced by reading the p54u driver 76 * written by Jean-Baptiste Note <jean-baptiste.note@m4x.org> and 77 * Sebastien Bourdeauducq <lekernel@prism54.org>. 78 */ 79 80#ifdef UPGT_DEBUG 81int upgt_debug = 2; 82#define DPRINTF(l, x...) do { if ((l) <= upgt_debug) printf(x); } while (0) 83#else 84#define DPRINTF(l, x...) 85#endif 86 87/* 88 * Prototypes. 89 */ 90static int upgt_match(device_t, cfdata_t, void *); 91static void upgt_attach(device_t, device_t, void *); 92static int upgt_detach(device_t, int); 93static int upgt_activate(device_t, devact_t); 94 95static void upgt_attach_hook(device_t); 96static int upgt_device_type(struct upgt_softc *, uint16_t, uint16_t); 97static int upgt_device_init(struct upgt_softc *); 98static int upgt_mem_init(struct upgt_softc *); 99static uint32_t upgt_mem_alloc(struct upgt_softc *); 100static void upgt_mem_free(struct upgt_softc *, uint32_t); 101static int upgt_fw_alloc(struct upgt_softc *); 102static void upgt_fw_free(struct upgt_softc *); 103static int upgt_fw_verify(struct upgt_softc *); 104static int upgt_fw_load(struct upgt_softc *); 105static int upgt_fw_copy(char *, char *, int); 106static int upgt_eeprom_read(struct upgt_softc *); 107static int upgt_eeprom_parse(struct upgt_softc *); 108static void upgt_eeprom_parse_hwrx(struct upgt_softc *, uint8_t *); 109static void upgt_eeprom_parse_freq3(struct upgt_softc *, uint8_t *, int); 110static void upgt_eeprom_parse_freq4(struct upgt_softc *, uint8_t *, int); 111static void upgt_eeprom_parse_freq6(struct upgt_softc *, uint8_t *, int); 112 113static int upgt_ioctl(struct ifnet *, u_long, void *); 114static int upgt_init(struct ifnet *); 115static void upgt_stop(struct upgt_softc *); 116static int upgt_media_change(struct ifnet *); 117static void upgt_newassoc(struct ieee80211_node *, int); 118static int upgt_newstate(struct ieee80211com *, enum ieee80211_state, 119 int); 120static void upgt_newstate_task(void *); 121static void upgt_next_scan(void *); 122static void upgt_start(struct ifnet *); 123static void upgt_watchdog(struct ifnet *); 124static void upgt_tx_task(void *); 125static void upgt_tx_done(struct upgt_softc *, uint8_t *); 126static void upgt_rx_cb(struct usbd_xfer *, void *, usbd_status); 127static void upgt_rx(struct upgt_softc *, uint8_t *, int); 128static void upgt_setup_rates(struct upgt_softc *); 129static uint8_t upgt_rx_rate(struct upgt_softc *, const int); 130static int upgt_set_macfilter(struct upgt_softc *, uint8_t); 131static int upgt_set_channel(struct upgt_softc *, unsigned); 132static void upgt_set_led(struct upgt_softc *, int); 133static void upgt_set_led_blink(void *); 134static int upgt_get_stats(struct upgt_softc *); 135 136static int upgt_alloc_tx(struct upgt_softc *); 137static int upgt_alloc_rx(struct upgt_softc *); 138static int upgt_alloc_cmd(struct upgt_softc *); 139static void upgt_free_tx(struct upgt_softc *); 140static void upgt_free_rx(struct upgt_softc *); 141static void upgt_free_cmd(struct upgt_softc *); 142static int upgt_bulk_xmit(struct upgt_softc *, struct upgt_data *, 143 struct usbd_pipe *, uint32_t *, int); 144 145#if 0 146static void upgt_hexdump(void *, int); 147#endif 148static uint32_t upgt_crc32_le(const void *, size_t); 149static uint32_t upgt_chksum_le(const uint32_t *, size_t); 150 151CFATTACH_DECL_NEW(upgt, sizeof(struct upgt_softc), 152 upgt_match, upgt_attach, upgt_detach, upgt_activate); 153 154static const struct usb_devno upgt_devs_1[] = { 155 /* version 1 devices */ 156 { USB_VENDOR_ALCATELT, USB_PRODUCT_ALCATELT_ST120G }, 157 { USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG_V1 } 158}; 159 160static const struct usb_devno upgt_devs_2[] = { 161 /* version 2 devices */ 162 { USB_VENDOR_ACCTON, USB_PRODUCT_ACCTON_PRISM_GT }, 163 { USB_VENDOR_ALCATELT, USB_PRODUCT_ALCATELT_ST121G }, 164 { USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050 }, 165 { USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54AG }, 166 { USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GV2 }, 167 { USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_PRISM_GT }, 168 { USB_VENDOR_COREGA, USB_PRODUCT_COREGA_CGWLUSB2GTST }, 169 { USB_VENDOR_DELL, USB_PRODUCT_DELL_PRISM_GT_1 }, 170 { USB_VENDOR_DELL, USB_PRODUCT_DELL_PRISM_GT_2 }, 171 { USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122A2 }, 172 { USB_VENDOR_FSC, USB_PRODUCT_FSC_E5400 }, 173 { USB_VENDOR_GLOBESPAN, USB_PRODUCT_GLOBESPAN_PRISM_GT_1 }, 174 { USB_VENDOR_GLOBESPAN, USB_PRODUCT_GLOBESPAN_PRISM_GT_2 }, 175 { USB_VENDOR_INTERSIL, USB_PRODUCT_INTERSIL_PRISM_GT }, 176 { USB_VENDOR_PHEENET, USB_PRODUCT_PHEENET_GWU513 }, 177 { USB_VENDOR_PHILIPS, USB_PRODUCT_PHILIPS_CPWUA054 }, 178 { USB_VENDOR_SHARP, USB_PRODUCT_SHARP_RUITZ1016YCZZ }, 179 { USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG }, 180 { USB_VENDOR_USR, USB_PRODUCT_USR_USR5422 }, 181 { USB_VENDOR_WISTRONNEWEB, USB_PRODUCT_WISTRONNEWEB_UR045G }, 182 { USB_VENDOR_CONEXANT, USB_PRODUCT_CONEXANT_PRISM_GT_1 }, 183 { USB_VENDOR_CONEXANT, USB_PRODUCT_CONEXANT_PRISM_GT_2 }, 184 { USB_VENDOR_ZCOM, USB_PRODUCT_ZCOM_MD40900 }, 185 { USB_VENDOR_ZCOM, USB_PRODUCT_ZCOM_XG703A } 186}; 187 188static int 189firmware_load(const char *dname, const char *iname, uint8_t **ucodep, 190 size_t *sizep) 191{ 192 firmware_handle_t fh; 193 int error; 194 195 if ((error = firmware_open(dname, iname, &fh)) != 0) 196 return error; 197 *sizep = firmware_get_size(fh); 198 if ((*ucodep = firmware_malloc(*sizep)) == NULL) { 199 firmware_close(fh); 200 return ENOMEM; 201 } 202 if ((error = firmware_read(fh, 0, *ucodep, *sizep)) != 0) 203 firmware_free(*ucodep, *sizep); 204 firmware_close(fh); 205 206 return error; 207} 208 209static int 210upgt_match(device_t parent, cfdata_t match, void *aux) 211{ 212 struct usb_attach_arg *uaa = aux; 213 214 if (usb_lookup(upgt_devs_1, uaa->uaa_vendor, uaa->uaa_product) != NULL) 215 return UMATCH_VENDOR_PRODUCT; 216 217 if (usb_lookup(upgt_devs_2, uaa->uaa_vendor, uaa->uaa_product) != NULL) 218 return UMATCH_VENDOR_PRODUCT; 219 220 return UMATCH_NONE; 221} 222 223static void 224upgt_attach(device_t parent, device_t self, void *aux) 225{ 226 struct upgt_softc *sc = device_private(self); 227 struct usb_attach_arg *uaa = aux; 228 usb_interface_descriptor_t *id; 229 usb_endpoint_descriptor_t *ed; 230 usbd_status error; 231 char *devinfop; 232 int i; 233 234 aprint_naive("\n"); 235 aprint_normal("\n"); 236 237 /* 238 * Attach USB device. 239 */ 240 sc->sc_dev = self; 241 sc->sc_udev = uaa->uaa_device; 242 sc->sc_init_state = UPGT_INIT_NONE; 243 244 devinfop = usbd_devinfo_alloc(sc->sc_udev, 0); 245 aprint_normal_dev(sc->sc_dev, "%s\n", devinfop); 246 usbd_devinfo_free(devinfop); 247 248 /* check device type */ 249 if (upgt_device_type(sc, uaa->uaa_vendor, uaa->uaa_product) != 0) 250 return; 251 252 /* set configuration number */ 253 error = usbd_set_config_no(sc->sc_udev, UPGT_CONFIG_NO, 0); 254 if (error != 0) { 255 aprint_error_dev(sc->sc_dev, "failed to set configuration" 256 ", err=%s\n", usbd_errstr(error)); 257 return; 258 } 259 260 /* get the first interface handle */ 261 error = usbd_device2interface_handle(sc->sc_udev, UPGT_IFACE_INDEX, 262 &sc->sc_iface); 263 if (error != 0) { 264 aprint_error_dev(sc->sc_dev, 265 "could not get interface handle\n"); 266 return; 267 } 268 269 /* find endpoints */ 270 id = usbd_get_interface_descriptor(sc->sc_iface); 271 sc->sc_rx_no = sc->sc_tx_no = -1; 272 for (i = 0; i < id->bNumEndpoints; i++) { 273 ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i); 274 if (ed == NULL) { 275 aprint_error_dev(sc->sc_dev, 276 "no endpoint descriptor for iface %d\n", i); 277 return; 278 } 279 280 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT && 281 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) 282 sc->sc_tx_no = ed->bEndpointAddress; 283 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN && 284 UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK) 285 sc->sc_rx_no = ed->bEndpointAddress; 286 287 /* 288 * 0x01 TX pipe 289 * 0x81 RX pipe 290 * 291 * Deprecated scheme (not used with fw version >2.5.6.x): 292 * 0x02 TX MGMT pipe 293 * 0x82 TX MGMT pipe 294 */ 295 if (sc->sc_tx_no != -1 && sc->sc_rx_no != -1) 296 break; 297 } 298 if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) { 299 aprint_error_dev(sc->sc_dev, "missing endpoint\n"); 300 return; 301 } 302 303 /* setup tasks and timeouts */ 304 usb_init_task(&sc->sc_task_newstate, upgt_newstate_task, sc, 0); 305 usb_init_task(&sc->sc_task_tx, upgt_tx_task, sc, 0); 306 callout_init(&sc->scan_to, 0); 307 callout_setfunc(&sc->scan_to, upgt_next_scan, sc); 308 callout_init(&sc->led_to, 0); 309 callout_setfunc(&sc->led_to, upgt_set_led_blink, sc); 310 sc->sc_init_state = UPGT_INIT_INITED; 311 312 /* 313 * Open TX and RX USB bulk pipes. 314 */ 315 error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE, 316 &sc->sc_tx_pipeh); 317 if (error != 0) { 318 aprint_error_dev(sc->sc_dev, 319 "could not open TX pipe: %s\n", usbd_errstr(error)); 320 goto fail; 321 } 322 error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE, 323 &sc->sc_rx_pipeh); 324 if (error != 0) { 325 aprint_error_dev(sc->sc_dev, "could not open RX pipe: %s\n", 326 usbd_errstr(error)); 327 goto fail; 328 } 329 330 /* 331 * Allocate TX, RX, and CMD xfers. 332 */ 333 if (upgt_alloc_tx(sc) != 0) 334 goto fail; 335 if (upgt_alloc_rx(sc) != 0) 336 goto fail; 337 if (upgt_alloc_cmd(sc) != 0) 338 goto fail; 339 340 /* 341 * We need the firmware loaded from file system to complete the attach. 342 */ 343 config_mountroot(self, upgt_attach_hook); 344 345 return; 346fail: 347 aprint_error_dev(sc->sc_dev, "%s failed\n", __func__); 348} 349 350static void 351upgt_attach_hook(device_t arg) 352{ 353 struct upgt_softc *sc = device_private(arg); 354 struct ieee80211com *ic = &sc->sc_ic; 355 struct ifnet *ifp = &sc->sc_if; 356 usbd_status error; 357 int i; 358 359 /* 360 * Load firmware file into memory. 361 */ 362 if (upgt_fw_alloc(sc) != 0) 363 goto fail; 364 365 /* 366 * Initialize the device. 367 */ 368 if (upgt_device_init(sc) != 0) 369 goto fail; 370 371 /* 372 * Verify the firmware. 373 */ 374 if (upgt_fw_verify(sc) != 0) 375 goto fail; 376 377 /* 378 * Calculate device memory space. 379 */ 380 if (sc->sc_memaddr_frame_start == 0 || sc->sc_memaddr_frame_end == 0) { 381 aprint_error_dev(sc->sc_dev, 382 "could not find memory space addresses on FW\n"); 383 goto fail; 384 } 385 sc->sc_memaddr_frame_end -= UPGT_MEMSIZE_RX + 1; 386 sc->sc_memaddr_rx_start = sc->sc_memaddr_frame_end + 1; 387 388 DPRINTF(1, "%s: memory address frame start=0x%08x\n", 389 device_xname(sc->sc_dev), sc->sc_memaddr_frame_start); 390 DPRINTF(1, "%s: memory address frame end=0x%08x\n", 391 device_xname(sc->sc_dev), sc->sc_memaddr_frame_end); 392 DPRINTF(1, "%s: memory address rx start=0x%08x\n", 393 device_xname(sc->sc_dev), sc->sc_memaddr_rx_start); 394 395 upgt_mem_init(sc); 396 397 /* 398 * Load the firmware. 399 */ 400 if (upgt_fw_load(sc) != 0) 401 goto fail; 402 403 /* 404 * Startup the RX pipe. 405 */ 406 struct upgt_data *data_rx = &sc->rx_data; 407 408 usbd_setup_xfer(data_rx->xfer, data_rx, data_rx->buf, 409 MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, upgt_rx_cb); 410 error = usbd_transfer(data_rx->xfer); 411 if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) { 412 aprint_error_dev(sc->sc_dev, 413 "could not queue RX transfer\n"); 414 goto fail; 415 } 416 usbd_delay_ms(sc->sc_udev, 100); 417 418 /* 419 * Read the whole EEPROM content and parse it. 420 */ 421 if (upgt_eeprom_read(sc) != 0) 422 goto fail; 423 if (upgt_eeprom_parse(sc) != 0) 424 goto fail; 425 426 /* 427 * Setup the 802.11 device. 428 */ 429 ic->ic_ifp = ifp; 430 ic->ic_phytype = IEEE80211_T_OFDM; 431 ic->ic_opmode = IEEE80211_M_STA; 432 ic->ic_state = IEEE80211_S_INIT; 433 ic->ic_caps = 434 IEEE80211_C_MONITOR | 435 IEEE80211_C_SHPREAMBLE | 436 IEEE80211_C_SHSLOT; 437 438 ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b; 439 ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g; 440 441 for (i = 1; i <= 14; i++) { 442 ic->ic_channels[i].ic_freq = 443 ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ); 444 ic->ic_channels[i].ic_flags = 445 IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM | 446 IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 447 } 448 449 ifp->if_softc = sc; 450 ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST; 451 ifp->if_init = upgt_init; 452 ifp->if_ioctl = upgt_ioctl; 453 ifp->if_start = upgt_start; 454 ifp->if_watchdog = upgt_watchdog; 455 IFQ_SET_READY(&ifp->if_snd); 456 memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ); 457 458 if_attach(ifp); 459 ieee80211_ifattach(ic); 460 ic->ic_newassoc = upgt_newassoc; 461 462 sc->sc_newstate = ic->ic_newstate; 463 ic->ic_newstate = upgt_newstate; 464 465 /* XXX media locking needs revisiting */ 466 mutex_init(&sc->sc_media_mtx, MUTEX_DEFAULT, IPL_SOFTUSB); 467 ieee80211_media_init_with_lock(ic, 468 upgt_media_change, ieee80211_media_status, &sc->sc_media_mtx); 469 470 bpf_attach2(ifp, DLT_IEEE802_11_RADIO, 471 sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN, 472 &sc->sc_drvbpf); 473 474 sc->sc_rxtap_len = sizeof(sc->sc_rxtapu); 475 sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len); 476 sc->sc_rxtap.wr_ihdr.it_present = htole32(UPGT_RX_RADIOTAP_PRESENT); 477 478 sc->sc_txtap_len = sizeof(sc->sc_txtapu); 479 sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len); 480 sc->sc_txtap.wt_ihdr.it_present = htole32(UPGT_TX_RADIOTAP_PRESENT); 481 482 aprint_normal_dev(sc->sc_dev, "address %s\n", 483 ether_sprintf(ic->ic_myaddr)); 484 485 ieee80211_announce(ic); 486 487 usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev); 488 489 /* device attached */ 490 sc->sc_flags |= UPGT_DEVICE_ATTACHED; 491 492 return; 493fail: 494 aprint_error_dev(sc->sc_dev, "%s failed\n", __func__); 495} 496 497static int 498upgt_detach(device_t self, int flags) 499{ 500 struct upgt_softc *sc = device_private(self); 501 struct ifnet *ifp = &sc->sc_if; 502 struct ieee80211com *ic = &sc->sc_ic; 503 int s; 504 505 DPRINTF(1, "%s: %s\n", device_xname(sc->sc_dev), __func__); 506 507 if (sc->sc_init_state < UPGT_INIT_INITED) 508 return 0; 509 510 s = splnet(); 511 512 if (ifp->if_flags & IFF_RUNNING) 513 upgt_stop(sc); 514 515 /* remove tasks and timeouts */ 516 callout_halt(&sc->scan_to, NULL); 517 callout_halt(&sc->led_to, NULL); 518 usb_rem_task_wait(sc->sc_udev, &sc->sc_task_newstate, USB_TASKQ_DRIVER, 519 NULL); 520 usb_rem_task_wait(sc->sc_udev, &sc->sc_task_tx, USB_TASKQ_DRIVER, 521 NULL); 522 callout_destroy(&sc->scan_to); 523 callout_destroy(&sc->led_to); 524 525 /* abort and close TX / RX pipes */ 526 if (sc->sc_tx_pipeh != NULL) { 527 usbd_abort_pipe(sc->sc_tx_pipeh); 528 } 529 if (sc->sc_rx_pipeh != NULL) { 530 usbd_abort_pipe(sc->sc_rx_pipeh); 531 } 532 533 /* free xfers */ 534 upgt_free_tx(sc); 535 upgt_free_rx(sc); 536 upgt_free_cmd(sc); 537 538 /* Close TX / RX pipes */ 539 if (sc->sc_tx_pipeh != NULL) { 540 usbd_close_pipe(sc->sc_tx_pipeh); 541 } 542 if (sc->sc_rx_pipeh != NULL) { 543 usbd_close_pipe(sc->sc_rx_pipeh); 544 } 545 546 /* free firmware */ 547 upgt_fw_free(sc); 548 549 if (sc->sc_flags & UPGT_DEVICE_ATTACHED) { 550 /* detach interface */ 551 bpf_detach(ifp); 552 ieee80211_ifdetach(ic); 553 if_detach(ifp); 554 } 555 556 splx(s); 557 558 usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev, sc->sc_dev); 559 560 return 0; 561} 562 563static int 564upgt_activate(device_t self, devact_t act) 565{ 566 struct upgt_softc *sc = device_private(self); 567 568 switch (act) { 569 case DVACT_DEACTIVATE: 570 if_deactivate(&sc->sc_if); 571 return 0; 572 default: 573 return EOPNOTSUPP; 574 } 575} 576 577static int 578upgt_device_type(struct upgt_softc *sc, uint16_t vendor, uint16_t product) 579{ 580 581 if (usb_lookup(upgt_devs_1, vendor, product) != NULL) { 582 sc->sc_device_type = 1; 583 /* XXX */ 584 aprint_error_dev(sc->sc_dev, 585 "version 1 devices not supported yet\n"); 586 return 1; 587 } else 588 sc->sc_device_type = 2; 589 590 return 0; 591} 592 593static int 594upgt_device_init(struct upgt_softc *sc) 595{ 596 struct upgt_data *data_cmd = &sc->cmd_data; 597 const uint8_t init_cmd[] = { 0x7e, 0x7e, 0x7e, 0x7e }; 598 int len; 599 600 len = sizeof(init_cmd); 601 memcpy(data_cmd->buf, init_cmd, len); 602 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 603 aprint_error_dev(sc->sc_dev, 604 "could not send device init string\n"); 605 return EIO; 606 } 607 usbd_delay_ms(sc->sc_udev, 100); 608 609 DPRINTF(1, "%s: device initialized\n", device_xname(sc->sc_dev)); 610 611 return 0; 612} 613 614static int 615upgt_mem_init(struct upgt_softc *sc) 616{ 617 int i; 618 619 for (i = 0; i < UPGT_MEMORY_MAX_PAGES; i++) { 620 sc->sc_memory.page[i].used = 0; 621 622 if (i == 0) { 623 /* 624 * The first memory page is always reserved for 625 * command data. 626 */ 627 sc->sc_memory.page[i].addr = 628 sc->sc_memaddr_frame_start + MCLBYTES; 629 } else { 630 sc->sc_memory.page[i].addr = 631 sc->sc_memory.page[i - 1].addr + MCLBYTES; 632 } 633 634 if (sc->sc_memory.page[i].addr + MCLBYTES >= 635 sc->sc_memaddr_frame_end) 636 break; 637 638 DPRINTF(2, "%s: memory address page %d=0x%08x\n", 639 device_xname(sc->sc_dev), i, sc->sc_memory.page[i].addr); 640 } 641 642 sc->sc_memory.pages = i; 643 644 DPRINTF(2, "%s: memory pages=%d\n", 645 device_xname(sc->sc_dev), sc->sc_memory.pages); 646 647 return 0; 648} 649 650static uint32_t 651upgt_mem_alloc(struct upgt_softc *sc) 652{ 653 int i; 654 655 for (i = 0; i < sc->sc_memory.pages; i++) { 656 if (sc->sc_memory.page[i].used == 0) { 657 sc->sc_memory.page[i].used = 1; 658 return sc->sc_memory.page[i].addr; 659 } 660 } 661 662 return 0; 663} 664 665static void 666upgt_mem_free(struct upgt_softc *sc, uint32_t addr) 667{ 668 int i; 669 670 for (i = 0; i < sc->sc_memory.pages; i++) { 671 if (sc->sc_memory.page[i].addr == addr) { 672 sc->sc_memory.page[i].used = 0; 673 return; 674 } 675 } 676 677 aprint_error_dev(sc->sc_dev, "could not free memory address 0x%08x\n", 678 addr); 679} 680 681 682static int 683upgt_fw_alloc(struct upgt_softc *sc) 684{ 685 const char *name = "upgt-gw3887"; 686 int error; 687 688 if (sc->sc_fw == NULL) { 689 error = firmware_load("upgt", name, &sc->sc_fw, 690 &sc->sc_fw_size); 691 if (error != 0) { 692 if (error == ENOENT) { 693 /* 694 * The firmware file for upgt(4) is not in 695 * the default distribution due to its lisence 696 * so explicitly notify it if the firmware file 697 * is not found. 698 */ 699 aprint_error_dev(sc->sc_dev, 700 "firmware file %s is not installed\n", 701 name); 702 aprint_error_dev(sc->sc_dev, 703 "(it is not included in the default" 704 " distribution)\n"); 705 aprint_error_dev(sc->sc_dev, 706 "see upgt(4) man page for details about " 707 "firmware installation\n"); 708 } else { 709 aprint_error_dev(sc->sc_dev, 710 "could not read firmware %s\n", name); 711 } 712 return EIO; 713 } 714 } 715 716 DPRINTF(1, "%s: firmware %s allocated\n", device_xname(sc->sc_dev), 717 name); 718 719 return 0; 720} 721 722static void 723upgt_fw_free(struct upgt_softc *sc) 724{ 725 726 if (sc->sc_fw != NULL) { 727 firmware_free(sc->sc_fw, sc->sc_fw_size); 728 sc->sc_fw = NULL; 729 DPRINTF(1, "%s: firmware freed\n", device_xname(sc->sc_dev)); 730 } 731} 732 733static int 734upgt_fw_verify(struct upgt_softc *sc) 735{ 736 struct upgt_fw_bra_option *bra_option; 737 uint32_t bra_option_type, bra_option_len; 738 uint32_t *uc; 739 int offset, bra_end = 0; 740 741 /* 742 * Seek to beginning of Boot Record Area (BRA). 743 */ 744 for (offset = 0; offset < sc->sc_fw_size; offset += sizeof(*uc)) { 745 uc = (uint32_t *)(sc->sc_fw + offset); 746 if (*uc == 0) 747 break; 748 } 749 for (; offset < sc->sc_fw_size; offset += sizeof(*uc)) { 750 uc = (uint32_t *)(sc->sc_fw + offset); 751 if (*uc != 0) 752 break; 753 } 754 if (offset == sc->sc_fw_size) { 755 aprint_error_dev(sc->sc_dev, 756 "firmware Boot Record Area not found\n"); 757 return EIO; 758 } 759 DPRINTF(1, "%s: firmware Boot Record Area found at offset %d\n", 760 device_xname(sc->sc_dev), offset); 761 762 /* 763 * Parse Boot Record Area (BRA) options. 764 */ 765 while (offset < sc->sc_fw_size && bra_end == 0) { 766 /* get current BRA option */ 767 bra_option = (struct upgt_fw_bra_option *)(sc->sc_fw + offset); 768 bra_option_type = le32toh(bra_option->type); 769 bra_option_len = le32toh(bra_option->len) * sizeof(*uc); 770 771 switch (bra_option_type) { 772 case UPGT_BRA_TYPE_FW: 773 DPRINTF(1, "%s: UPGT_BRA_TYPE_FW len=%d\n", 774 device_xname(sc->sc_dev), bra_option_len); 775 776 if (bra_option_len != UPGT_BRA_FWTYPE_SIZE) { 777 aprint_error_dev(sc->sc_dev, 778 "wrong UPGT_BRA_TYPE_FW len\n"); 779 return EIO; 780 } 781 if (memcmp(UPGT_BRA_FWTYPE_LM86, bra_option->data, 782 bra_option_len) == 0) { 783 sc->sc_fw_type = UPGT_FWTYPE_LM86; 784 break; 785 } 786 if (memcmp(UPGT_BRA_FWTYPE_LM87, bra_option->data, 787 bra_option_len) == 0) { 788 sc->sc_fw_type = UPGT_FWTYPE_LM87; 789 break; 790 } 791 if (memcmp(UPGT_BRA_FWTYPE_FMAC, bra_option->data, 792 bra_option_len) == 0) { 793 sc->sc_fw_type = UPGT_FWTYPE_FMAC; 794 break; 795 } 796 aprint_error_dev(sc->sc_dev, 797 "unsupported firmware type\n"); 798 return EIO; 799 case UPGT_BRA_TYPE_VERSION: 800 DPRINTF(1, "%s: UPGT_BRA_TYPE_VERSION len=%d\n", 801 device_xname(sc->sc_dev), bra_option_len); 802 break; 803 case UPGT_BRA_TYPE_DEPIF: 804 DPRINTF(1, "%s: UPGT_BRA_TYPE_DEPIF len=%d\n", 805 device_xname(sc->sc_dev), bra_option_len); 806 break; 807 case UPGT_BRA_TYPE_EXPIF: 808 DPRINTF(1, "%s: UPGT_BRA_TYPE_EXPIF len=%d\n", 809 device_xname(sc->sc_dev), bra_option_len); 810 break; 811 case UPGT_BRA_TYPE_DESCR: 812 DPRINTF(1, "%s: UPGT_BRA_TYPE_DESCR len=%d\n", 813 device_xname(sc->sc_dev), bra_option_len); 814 815 struct upgt_fw_bra_descr *descr = 816 (struct upgt_fw_bra_descr *)bra_option->data; 817 818 sc->sc_memaddr_frame_start = 819 le32toh(descr->memaddr_space_start); 820 sc->sc_memaddr_frame_end = 821 le32toh(descr->memaddr_space_end); 822 823 DPRINTF(2, "%s: memory address space start=0x%08x\n", 824 device_xname(sc->sc_dev), 825 sc->sc_memaddr_frame_start); 826 DPRINTF(2, "%s: memory address space end=0x%08x\n", 827 device_xname(sc->sc_dev), 828 sc->sc_memaddr_frame_end); 829 break; 830 case UPGT_BRA_TYPE_END: 831 DPRINTF(1, "%s: UPGT_BRA_TYPE_END len=%d\n", 832 device_xname(sc->sc_dev), bra_option_len); 833 bra_end = 1; 834 break; 835 default: 836 DPRINTF(1, "%s: unknown BRA option len=%d\n", 837 device_xname(sc->sc_dev), bra_option_len); 838 return EIO; 839 } 840 841 /* jump to next BRA option */ 842 offset += sizeof(struct upgt_fw_bra_option) + bra_option_len; 843 } 844 845 DPRINTF(1, "%s: firmware verified\n", device_xname(sc->sc_dev)); 846 847 return 0; 848} 849 850static int 851upgt_fw_load(struct upgt_softc *sc) 852{ 853 struct upgt_data *data_cmd = &sc->cmd_data; 854 struct upgt_data *data_rx = &sc->rx_data; 855 struct upgt_fw_x2_header *x2; 856 const uint8_t start_fwload_cmd[] = { 0x3c, 0x0d }; 857 int offset, bsize, n, i, len; 858 uint32_t crc; 859 860 /* send firmware start load command */ 861 len = sizeof(start_fwload_cmd); 862 memcpy(data_cmd->buf, start_fwload_cmd, len); 863 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 864 aprint_error_dev(sc->sc_dev, 865 "could not send start_firmware_load command\n"); 866 return EIO; 867 } 868 869 /* send X2 header */ 870 len = sizeof(struct upgt_fw_x2_header); 871 x2 = (struct upgt_fw_x2_header *)data_cmd->buf; 872 memcpy(x2->signature, UPGT_X2_SIGNATURE, UPGT_X2_SIGNATURE_SIZE); 873 x2->startaddr = htole32(UPGT_MEMADDR_FIRMWARE_START); 874 x2->len = htole32(sc->sc_fw_size); 875 x2->crc = upgt_crc32_le(data_cmd->buf + UPGT_X2_SIGNATURE_SIZE, 876 sizeof(struct upgt_fw_x2_header) - UPGT_X2_SIGNATURE_SIZE - 877 sizeof(uint32_t)); 878 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 879 aprint_error_dev(sc->sc_dev, 880 "could not send firmware X2 header\n"); 881 return EIO; 882 } 883 884 /* download firmware */ 885 for (offset = 0; offset < sc->sc_fw_size; offset += bsize) { 886 if (sc->sc_fw_size - offset > UPGT_FW_BLOCK_SIZE) 887 bsize = UPGT_FW_BLOCK_SIZE; 888 else 889 bsize = sc->sc_fw_size - offset; 890 891 n = upgt_fw_copy(sc->sc_fw + offset, data_cmd->buf, bsize); 892 893 DPRINTF(1, "%s: FW offset=%d, read=%d, sent=%d\n", 894 device_xname(sc->sc_dev), offset, n, bsize); 895 896 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &bsize, 0) 897 != 0) { 898 aprint_error_dev(sc->sc_dev, 899 "error while downloading firmware block\n"); 900 return EIO; 901 } 902 903 bsize = n; 904 } 905 DPRINTF(1, "%s: firmware downloaded\n", device_xname(sc->sc_dev)); 906 907 /* load firmware */ 908 crc = upgt_crc32_le(sc->sc_fw, sc->sc_fw_size); 909 *((uint32_t *)(data_cmd->buf) ) = crc; 910 *((uint8_t *)(data_cmd->buf) + 4) = 'g'; 911 *((uint8_t *)(data_cmd->buf) + 5) = '\r'; 912 len = 6; 913 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 914 aprint_error_dev(sc->sc_dev, 915 "could not send load_firmware command\n"); 916 return EIO; 917 } 918 919 for (i = 0; i < UPGT_FIRMWARE_TIMEOUT; i++) { 920 len = UPGT_FW_BLOCK_SIZE; 921 memset(data_rx->buf, 0, 2); 922 if (upgt_bulk_xmit(sc, data_rx, sc->sc_rx_pipeh, &len, 923 USBD_SHORT_XFER_OK) != 0) { 924 aprint_error_dev(sc->sc_dev, 925 "could not read firmware response\n"); 926 return EIO; 927 } 928 929 if (memcmp(data_rx->buf, "OK", 2) == 0) 930 break; /* firmware load was successful */ 931 } 932 if (i == UPGT_FIRMWARE_TIMEOUT) { 933 aprint_error_dev(sc->sc_dev, "firmware load failed\n"); 934 return EIO; 935 } 936 DPRINTF(1, "%s: firmware loaded\n", device_xname(sc->sc_dev)); 937 938 return 0; 939} 940 941/* 942 * While copying the version 2 firmware, we need to replace two characters: 943 * 944 * 0x7e -> 0x7d 0x5e 945 * 0x7d -> 0x7d 0x5d 946 */ 947static int 948upgt_fw_copy(char *src, char *dst, int size) 949{ 950 int i, j; 951 952 for (i = 0, j = 0; i < size && j < size; i++) { 953 switch (src[i]) { 954 case 0x7e: 955 dst[j] = 0x7d; 956 j++; 957 dst[j] = 0x5e; 958 j++; 959 break; 960 case 0x7d: 961 dst[j] = 0x7d; 962 j++; 963 dst[j] = 0x5d; 964 j++; 965 break; 966 default: 967 dst[j] = src[i]; 968 j++; 969 break; 970 } 971 } 972 973 return i; 974} 975 976static int 977upgt_eeprom_read(struct upgt_softc *sc) 978{ 979 struct upgt_data *data_cmd = &sc->cmd_data; 980 struct upgt_lmac_mem *mem; 981 struct upgt_lmac_eeprom *eeprom; 982 int offset, block, len; 983 984 offset = 0; 985 block = UPGT_EEPROM_BLOCK_SIZE; 986 while (offset < UPGT_EEPROM_SIZE) { 987 DPRINTF(1, "%s: request EEPROM block (offset=%d, len=%d)\n", 988 device_xname(sc->sc_dev), offset, block); 989 990 /* 991 * Transmit the URB containing the CMD data. 992 */ 993 len = sizeof(*mem) + sizeof(*eeprom) + block; 994 995 memset(data_cmd->buf, 0, len); 996 997 mem = (struct upgt_lmac_mem *)data_cmd->buf; 998 mem->addr = htole32(sc->sc_memaddr_frame_start + 999 UPGT_MEMSIZE_FRAME_HEAD); 1000 1001 eeprom = (struct upgt_lmac_eeprom *)(mem + 1); 1002 eeprom->header1.flags = 0; 1003 eeprom->header1.type = UPGT_H1_TYPE_CTRL; 1004 eeprom->header1.len = htole16(( 1005 sizeof(struct upgt_lmac_eeprom) - 1006 sizeof(struct upgt_lmac_header)) + block); 1007 1008 eeprom->header2.reqid = htole32(sc->sc_memaddr_frame_start); 1009 eeprom->header2.type = htole16(UPGT_H2_TYPE_EEPROM); 1010 eeprom->header2.flags = 0; 1011 1012 eeprom->offset = htole16(offset); 1013 eeprom->len = htole16(block); 1014 1015 mem->chksum = upgt_chksum_le((uint32_t *)eeprom, 1016 len - sizeof(*mem)); 1017 1018 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 1019 USBD_FORCE_SHORT_XFER) != 0) { 1020 aprint_error_dev(sc->sc_dev, 1021 "could not transmit EEPROM data URB\n"); 1022 return EIO; 1023 } 1024 1025 mutex_enter(&sc->sc_mtx); 1026 int res = cv_timedwait(&sc->sc_cv, &sc->sc_mtx, UPGT_USB_TIMEOUT); 1027 mutex_exit(&sc->sc_mtx); 1028 if (res) { 1029 aprint_error_dev(sc->sc_dev, 1030 "timeout while waiting for EEPROM data\n"); 1031 return EIO; 1032 } 1033 1034 offset += block; 1035 if (UPGT_EEPROM_SIZE - offset < block) 1036 block = UPGT_EEPROM_SIZE - offset; 1037 } 1038 1039 return 0; 1040} 1041 1042static int 1043upgt_eeprom_parse(struct upgt_softc *sc) 1044{ 1045 struct ieee80211com *ic = &sc->sc_ic; 1046 struct upgt_eeprom_header *eeprom_header; 1047 struct upgt_eeprom_option *eeprom_option; 1048 uint16_t option_len; 1049 uint16_t option_type; 1050 uint16_t preamble_len; 1051 int option_end = 0; 1052 1053 /* calculate eeprom options start offset */ 1054 eeprom_header = (struct upgt_eeprom_header *)sc->sc_eeprom; 1055 preamble_len = le16toh(eeprom_header->preamble_len); 1056 eeprom_option = (struct upgt_eeprom_option *)(sc->sc_eeprom + 1057 (sizeof(struct upgt_eeprom_header) + preamble_len)); 1058 1059 while (!option_end) { 1060 /* the eeprom option length is stored in words */ 1061 option_len = 1062 (le16toh(eeprom_option->len) - 1) * sizeof(uint16_t); 1063 option_type = 1064 le16toh(eeprom_option->type); 1065 1066 switch (option_type) { 1067 case UPGT_EEPROM_TYPE_NAME: 1068 DPRINTF(1, "%s: EEPROM name len=%d\n", 1069 device_xname(sc->sc_dev), option_len); 1070 break; 1071 case UPGT_EEPROM_TYPE_SERIAL: 1072 DPRINTF(1, "%s: EEPROM serial len=%d\n", 1073 device_xname(sc->sc_dev), option_len); 1074 break; 1075 case UPGT_EEPROM_TYPE_MAC: 1076 DPRINTF(1, "%s: EEPROM mac len=%d\n", 1077 device_xname(sc->sc_dev), option_len); 1078 1079 IEEE80211_ADDR_COPY(ic->ic_myaddr, eeprom_option->data); 1080 break; 1081 case UPGT_EEPROM_TYPE_HWRX: 1082 DPRINTF(1, "%s: EEPROM hwrx len=%d\n", 1083 device_xname(sc->sc_dev), option_len); 1084 1085 upgt_eeprom_parse_hwrx(sc, eeprom_option->data); 1086 break; 1087 case UPGT_EEPROM_TYPE_CHIP: 1088 DPRINTF(1, "%s: EEPROM chip len=%d\n", 1089 device_xname(sc->sc_dev), option_len); 1090 break; 1091 case UPGT_EEPROM_TYPE_FREQ3: 1092 DPRINTF(1, "%s: EEPROM freq3 len=%d\n", 1093 device_xname(sc->sc_dev), option_len); 1094 1095 upgt_eeprom_parse_freq3(sc, eeprom_option->data, 1096 option_len); 1097 break; 1098 case UPGT_EEPROM_TYPE_FREQ4: 1099 DPRINTF(1, "%s: EEPROM freq4 len=%d\n", 1100 device_xname(sc->sc_dev), option_len); 1101 1102 upgt_eeprom_parse_freq4(sc, eeprom_option->data, 1103 option_len); 1104 break; 1105 case UPGT_EEPROM_TYPE_FREQ5: 1106 DPRINTF(1, "%s: EEPROM freq5 len=%d\n", 1107 device_xname(sc->sc_dev), option_len); 1108 break; 1109 case UPGT_EEPROM_TYPE_FREQ6: 1110 DPRINTF(1, "%s: EEPROM freq6 len=%d\n", 1111 device_xname(sc->sc_dev), option_len); 1112 1113 upgt_eeprom_parse_freq6(sc, eeprom_option->data, 1114 option_len); 1115 break; 1116 case UPGT_EEPROM_TYPE_END: 1117 DPRINTF(1, "%s: EEPROM end len=%d\n", 1118 device_xname(sc->sc_dev), option_len); 1119 option_end = 1; 1120 break; 1121 case UPGT_EEPROM_TYPE_OFF: 1122 DPRINTF(1, "%s: EEPROM off without end option\n", 1123 device_xname(sc->sc_dev)); 1124 return EIO; 1125 default: 1126 DPRINTF(1, "%s: EEPROM unknown type 0x%04x len=%d\n", 1127 device_xname(sc->sc_dev), option_type, option_len); 1128 break; 1129 } 1130 1131 /* jump to next EEPROM option */ 1132 eeprom_option = (struct upgt_eeprom_option *) 1133 (eeprom_option->data + option_len); 1134 } 1135 1136 return 0; 1137} 1138 1139static void 1140upgt_eeprom_parse_hwrx(struct upgt_softc *sc, uint8_t *data) 1141{ 1142 struct upgt_eeprom_option_hwrx *option_hwrx; 1143 1144 option_hwrx = (struct upgt_eeprom_option_hwrx *)data; 1145 1146 sc->sc_eeprom_hwrx = option_hwrx->rxfilter - UPGT_EEPROM_RX_CONST; 1147 1148 DPRINTF(2, "%s: hwrx option value=0x%04x\n", 1149 device_xname(sc->sc_dev), sc->sc_eeprom_hwrx); 1150} 1151 1152static void 1153upgt_eeprom_parse_freq3(struct upgt_softc *sc, uint8_t *data, int len) 1154{ 1155 struct upgt_eeprom_freq3_header *freq3_header; 1156 struct upgt_lmac_freq3 *freq3; 1157 int i, elements, flags; 1158 unsigned channel; 1159 1160 freq3_header = (struct upgt_eeprom_freq3_header *)data; 1161 freq3 = (struct upgt_lmac_freq3 *)(freq3_header + 1); 1162 1163 flags = freq3_header->flags; 1164 elements = freq3_header->elements; 1165 1166 DPRINTF(2, "%s: flags=0x%02x\n", device_xname(sc->sc_dev), flags); 1167 DPRINTF(2, "%s: elements=%d\n", device_xname(sc->sc_dev), elements); 1168 __USE(flags); 1169 1170 for (i = 0; i < elements; i++) { 1171 channel = ieee80211_mhz2ieee(le16toh(freq3[i].freq), 0); 1172 1173 sc->sc_eeprom_freq3[channel] = freq3[i]; 1174 1175 DPRINTF(2, "%s: frequency=%d, channel=%d\n", 1176 device_xname(sc->sc_dev), 1177 le16toh(sc->sc_eeprom_freq3[channel].freq), channel); 1178 } 1179} 1180 1181static void 1182upgt_eeprom_parse_freq4(struct upgt_softc *sc, uint8_t *data, int len) 1183{ 1184 struct upgt_eeprom_freq4_header *freq4_header; 1185 struct upgt_eeprom_freq4_1 *freq4_1; 1186 struct upgt_eeprom_freq4_2 *freq4_2; 1187 int i, j, elements, settings, flags; 1188 unsigned channel; 1189 1190 freq4_header = (struct upgt_eeprom_freq4_header *)data; 1191 freq4_1 = (struct upgt_eeprom_freq4_1 *)(freq4_header + 1); 1192 1193 flags = freq4_header->flags; 1194 elements = freq4_header->elements; 1195 settings = freq4_header->settings; 1196 1197 /* we need this value later */ 1198 sc->sc_eeprom_freq6_settings = freq4_header->settings; 1199 1200 DPRINTF(2, "%s: flags=0x%02x\n", device_xname(sc->sc_dev), flags); 1201 DPRINTF(2, "%s: elements=%d\n", device_xname(sc->sc_dev), elements); 1202 DPRINTF(2, "%s: settings=%d\n", device_xname(sc->sc_dev), settings); 1203 __USE(flags); 1204 1205 for (i = 0; i < elements; i++) { 1206 channel = ieee80211_mhz2ieee(le16toh(freq4_1[i].freq), 0); 1207 1208 freq4_2 = (struct upgt_eeprom_freq4_2 *)freq4_1[i].data; 1209 1210 for (j = 0; j < settings; j++) { 1211 sc->sc_eeprom_freq4[channel][j].cmd = freq4_2[j]; 1212 sc->sc_eeprom_freq4[channel][j].pad = 0; 1213 } 1214 1215 DPRINTF(2, "%s: frequency=%d, channel=%d\n", 1216 device_xname(sc->sc_dev), 1217 le16toh(freq4_1[i].freq), channel); 1218 } 1219} 1220 1221static void 1222upgt_eeprom_parse_freq6(struct upgt_softc *sc, uint8_t *data, int len) 1223{ 1224 struct upgt_lmac_freq6 *freq6; 1225 int i, elements; 1226 unsigned channel; 1227 1228 freq6 = (struct upgt_lmac_freq6 *)data; 1229 1230 elements = len / sizeof(struct upgt_lmac_freq6); 1231 1232 DPRINTF(2, "%s: elements=%d\n", device_xname(sc->sc_dev), elements); 1233 1234 for (i = 0; i < elements; i++) { 1235 channel = ieee80211_mhz2ieee(le16toh(freq6[i].freq), 0); 1236 1237 sc->sc_eeprom_freq6[channel] = freq6[i]; 1238 1239 DPRINTF(2, "%s: frequency=%d, channel=%d\n", 1240 device_xname(sc->sc_dev), 1241 le16toh(sc->sc_eeprom_freq6[channel].freq), channel); 1242 } 1243} 1244 1245static int 1246upgt_ioctl(struct ifnet *ifp, u_long cmd, void *data) 1247{ 1248 struct upgt_softc *sc = ifp->if_softc; 1249 struct ieee80211com *ic = &sc->sc_ic; 1250 int s, error = 0; 1251 1252 s = splnet(); 1253 1254 switch (cmd) { 1255 case SIOCSIFFLAGS: 1256 if ((error = ifioctl_common(ifp, cmd, data)) != 0) 1257 break; 1258 if (ifp->if_flags & IFF_UP) { 1259 if ((ifp->if_flags & IFF_RUNNING) == 0) 1260 upgt_init(ifp); 1261 } else { 1262 if (ifp->if_flags & IFF_RUNNING) 1263 upgt_stop(sc); 1264 } 1265 break; 1266 case SIOCADDMULTI: 1267 case SIOCDELMULTI: 1268 if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) { 1269 /* setup multicast filter, etc */ 1270 error = 0; 1271 } 1272 break; 1273 default: 1274 error = ieee80211_ioctl(ic, cmd, data); 1275 break; 1276 } 1277 1278 if (error == ENETRESET) { 1279 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == 1280 (IFF_UP | IFF_RUNNING)) 1281 upgt_init(ifp); 1282 error = 0; 1283 } 1284 1285 splx(s); 1286 1287 return error; 1288} 1289 1290static int 1291upgt_init(struct ifnet *ifp) 1292{ 1293 struct upgt_softc *sc = ifp->if_softc; 1294 struct ieee80211com *ic = &sc->sc_ic; 1295 1296 DPRINTF(1, "%s: %s\n", device_xname(sc->sc_dev), __func__); 1297 1298 if (ifp->if_flags & IFF_RUNNING) 1299 upgt_stop(sc); 1300 1301 ifp->if_flags |= IFF_RUNNING; 1302 ifp->if_flags &= ~IFF_OACTIVE; 1303 1304 IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl)); 1305 1306 /* setup device rates */ 1307 upgt_setup_rates(sc); 1308 1309 if (ic->ic_opmode == IEEE80211_M_MONITOR) 1310 ieee80211_new_state(ic, IEEE80211_S_RUN, -1); 1311 else 1312 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1); 1313 1314 return 0; 1315} 1316 1317static void 1318upgt_stop(struct upgt_softc *sc) 1319{ 1320 struct ieee80211com *ic = &sc->sc_ic; 1321 struct ifnet *ifp = &sc->sc_if; 1322 1323 DPRINTF(1, "%s: %s\n", device_xname(sc->sc_dev), __func__); 1324 1325 /* device down */ 1326 ifp->if_timer = 0; 1327 ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE); 1328 1329 /* change device back to initial state */ 1330 ieee80211_new_state(ic, IEEE80211_S_INIT, -1); 1331} 1332 1333static int 1334upgt_media_change(struct ifnet *ifp) 1335{ 1336 struct upgt_softc *sc = ifp->if_softc; 1337 int error; 1338 1339 DPRINTF(1, "%s: %s\n", device_xname(sc->sc_dev), __func__); 1340 1341 if ((error = ieee80211_media_change(ifp)) != ENETRESET) 1342 return error; 1343 1344 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == 1345 (IFF_UP | IFF_RUNNING)) { 1346 /* give pending USB transfers a chance to finish */ 1347 usbd_delay_ms(sc->sc_udev, 100); 1348 upgt_init(ifp); 1349 } 1350 1351 return 0; 1352} 1353 1354static void 1355upgt_newassoc(struct ieee80211_node *ni, int isnew) 1356{ 1357 1358 ni->ni_txrate = 0; 1359} 1360 1361static int 1362upgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg) 1363{ 1364 struct upgt_softc *sc = ic->ic_ifp->if_softc; 1365 1366 /* 1367 * XXXSMP: This does not wait for the task, if it is in flight, 1368 * to complete. If this code works at all, it must rely on the 1369 * kernel lock to serialize with the USB task thread. 1370 */ 1371 usb_rem_task(sc->sc_udev, &sc->sc_task_newstate); 1372 callout_stop(&sc->scan_to); 1373 1374 /* do it in a process context */ 1375 sc->sc_state = nstate; 1376 sc->sc_arg = arg; 1377 usb_add_task(sc->sc_udev, &sc->sc_task_newstate, USB_TASKQ_DRIVER); 1378 1379 return 0; 1380} 1381 1382static void 1383upgt_newstate_task(void *arg) 1384{ 1385 struct upgt_softc *sc = arg; 1386 struct ieee80211com *ic = &sc->sc_ic; 1387 struct ieee80211_node *ni; 1388 unsigned channel; 1389 1390 mutex_enter(&sc->sc_mtx); 1391 1392 switch (sc->sc_state) { 1393 case IEEE80211_S_INIT: 1394 DPRINTF(1, "%s: newstate is IEEE80211_S_INIT\n", 1395 device_xname(sc->sc_dev)); 1396 1397 /* do not accept any frames if the device is down */ 1398 upgt_set_macfilter(sc, IEEE80211_S_INIT); 1399 upgt_set_led(sc, UPGT_LED_OFF); 1400 break; 1401 case IEEE80211_S_SCAN: 1402 DPRINTF(1, "%s: newstate is IEEE80211_S_SCAN\n", 1403 device_xname(sc->sc_dev)); 1404 1405 channel = ieee80211_chan2ieee(ic, ic->ic_curchan); 1406 upgt_set_channel(sc, channel); 1407 upgt_set_macfilter(sc, IEEE80211_S_SCAN); 1408 callout_schedule(&sc->scan_to, hz / 5); 1409 break; 1410 case IEEE80211_S_AUTH: 1411 DPRINTF(1, "%s: newstate is IEEE80211_S_AUTH\n", 1412 device_xname(sc->sc_dev)); 1413 1414 channel = ieee80211_chan2ieee(ic, ic->ic_curchan); 1415 upgt_set_channel(sc, channel); 1416 break; 1417 case IEEE80211_S_ASSOC: 1418 DPRINTF(1, "%s: newstate is IEEE80211_S_ASSOC\n", 1419 device_xname(sc->sc_dev)); 1420 1421 channel = ieee80211_chan2ieee(ic, ic->ic_curchan); 1422 upgt_set_channel(sc, channel); 1423 break; 1424 case IEEE80211_S_RUN: 1425 DPRINTF(1, "%s: newstate is IEEE80211_S_RUN\n", 1426 device_xname(sc->sc_dev)); 1427 1428 channel = ieee80211_chan2ieee(ic, ic->ic_curchan); 1429 upgt_set_channel(sc, channel); 1430 1431 ni = ic->ic_bss; 1432 1433 /* 1434 * TX rate control is done by the firmware. 1435 * Report the maximum rate which is available therefore. 1436 */ 1437 ni->ni_txrate = ni->ni_rates.rs_nrates - 1; 1438 1439 if (ic->ic_opmode != IEEE80211_M_MONITOR) 1440 upgt_set_macfilter(sc, IEEE80211_S_RUN); 1441 upgt_set_led(sc, UPGT_LED_ON); 1442 break; 1443 } 1444 1445 mutex_exit(&sc->sc_mtx); 1446 1447 sc->sc_newstate(ic, sc->sc_state, sc->sc_arg); 1448} 1449 1450static void 1451upgt_next_scan(void *arg) 1452{ 1453 struct upgt_softc *sc = arg; 1454 struct ieee80211com *ic = &sc->sc_ic; 1455 1456 DPRINTF(2, "%s: %s\n", device_xname(sc->sc_dev), __func__); 1457 1458 if (ic->ic_state == IEEE80211_S_SCAN) 1459 ieee80211_next_scan(ic); 1460} 1461 1462static void 1463upgt_start(struct ifnet *ifp) 1464{ 1465 struct upgt_softc *sc = ifp->if_softc; 1466 struct ieee80211com *ic = &sc->sc_ic; 1467 struct ether_header *eh; 1468 struct ieee80211_node *ni; 1469 struct mbuf *m; 1470 int i; 1471 1472 /* don't transmit packets if interface is busy or down */ 1473 if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING) 1474 return; 1475 1476 DPRINTF(2, "%s: %s\n", device_xname(sc->sc_dev), __func__); 1477 1478 for (i = 0; i < UPGT_TX_COUNT; i++) { 1479 struct upgt_data *data_tx = &sc->tx_data[i]; 1480 1481 if (data_tx->m != NULL) 1482 continue; 1483 1484 IF_POLL(&ic->ic_mgtq, m); 1485 if (m != NULL) { 1486 /* management frame */ 1487 IF_DEQUEUE(&ic->ic_mgtq, m); 1488 1489 ni = M_GETCTX(m, struct ieee80211_node *); 1490 M_CLEARCTX(m); 1491 1492 bpf_mtap3(ic->ic_rawbpf, m, BPF_D_OUT); 1493 1494 if ((data_tx->addr = upgt_mem_alloc(sc)) == 0) { 1495 aprint_error_dev(sc->sc_dev, 1496 "no free prism memory\n"); 1497 m_freem(m); 1498 if_statinc(ifp, if_oerrors); 1499 break; 1500 } 1501 data_tx->ni = ni; 1502 data_tx->m = m; 1503 sc->tx_queued++; 1504 } else { 1505 /* data frame */ 1506 if (ic->ic_state != IEEE80211_S_RUN) 1507 break; 1508 1509 IFQ_POLL(&ifp->if_snd, m); 1510 if (m == NULL) 1511 break; 1512 1513 IFQ_DEQUEUE(&ifp->if_snd, m); 1514 if (m->m_len < sizeof(struct ether_header) && 1515 !(m = m_pullup(m, sizeof(struct ether_header)))) 1516 continue; 1517 1518 eh = mtod(m, struct ether_header *); 1519 ni = ieee80211_find_txnode(ic, eh->ether_dhost); 1520 if (ni == NULL) { 1521 m_freem(m); 1522 continue; 1523 } 1524 1525 bpf_mtap(ifp, m, BPF_D_OUT); 1526 1527 m = ieee80211_encap(ic, m, ni); 1528 if (m == NULL) { 1529 ieee80211_free_node(ni); 1530 continue; 1531 } 1532 1533 bpf_mtap3(ic->ic_rawbpf, m, BPF_D_OUT); 1534 1535 if ((data_tx->addr = upgt_mem_alloc(sc)) == 0) { 1536 aprint_error_dev(sc->sc_dev, 1537 "no free prism memory\n"); 1538 m_freem(m); 1539 ieee80211_free_node(ni); 1540 if_statinc(ifp, if_oerrors); 1541 break; 1542 } 1543 data_tx->ni = ni; 1544 data_tx->m = m; 1545 sc->tx_queued++; 1546 } 1547 } 1548 1549 if (sc->tx_queued > 0) { 1550 DPRINTF(2, "%s: tx_queued=%d\n", 1551 device_xname(sc->sc_dev), sc->tx_queued); 1552 /* process the TX queue in process context */ 1553 ifp->if_timer = 5; 1554 ifp->if_flags |= IFF_OACTIVE; 1555 usb_rem_task(sc->sc_udev, &sc->sc_task_tx); 1556 usb_add_task(sc->sc_udev, &sc->sc_task_tx, USB_TASKQ_DRIVER); 1557 } 1558} 1559 1560static void 1561upgt_watchdog(struct ifnet *ifp) 1562{ 1563 struct upgt_softc *sc = ifp->if_softc; 1564 struct ieee80211com *ic = &sc->sc_ic; 1565 1566 if (ic->ic_state == IEEE80211_S_INIT) 1567 return; 1568 1569 aprint_error_dev(sc->sc_dev, "watchdog timeout\n"); 1570 1571 /* TODO: what shall we do on TX timeout? */ 1572 1573 ieee80211_watchdog(ic); 1574} 1575 1576static void 1577upgt_tx_task(void *arg) 1578{ 1579 struct upgt_softc *sc = arg; 1580 struct ieee80211com *ic = &sc->sc_ic; 1581 struct ieee80211_frame *wh; 1582 struct ieee80211_key *k; 1583 struct ifnet *ifp = &sc->sc_if; 1584 struct upgt_lmac_mem *mem; 1585 struct upgt_lmac_tx_desc *txdesc; 1586 struct mbuf *m; 1587 uint32_t addr; 1588 int i, len, pad, s; 1589 usbd_status error; 1590 1591 mutex_enter(&sc->sc_mtx); 1592 upgt_set_led(sc, UPGT_LED_BLINK); 1593 mutex_exit(&sc->sc_mtx); 1594 1595 s = splnet(); 1596 1597 for (i = 0; i < UPGT_TX_COUNT; i++) { 1598 struct upgt_data *data_tx = &sc->tx_data[i]; 1599 1600 if (data_tx->m == NULL) 1601 continue; 1602 1603 m = data_tx->m; 1604 addr = data_tx->addr + UPGT_MEMSIZE_FRAME_HEAD; 1605 1606 /* 1607 * Software crypto. 1608 */ 1609 wh = mtod(m, struct ieee80211_frame *); 1610 1611 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 1612 k = ieee80211_crypto_encap(ic, data_tx->ni, m); 1613 if (k == NULL) { 1614 m_freem(m); 1615 data_tx->m = NULL; 1616 ieee80211_free_node(data_tx->ni); 1617 data_tx->ni = NULL; 1618 if_statinc(ifp, if_oerrors); 1619 break; 1620 } 1621 1622 /* in case packet header moved, reset pointer */ 1623 wh = mtod(m, struct ieee80211_frame *); 1624 } 1625 1626 /* 1627 * Transmit the URB containing the TX data. 1628 */ 1629 memset(data_tx->buf, 0, sizeof(*mem) + sizeof(*txdesc)); 1630 1631 mem = (struct upgt_lmac_mem *)data_tx->buf; 1632 mem->addr = htole32(addr); 1633 1634 txdesc = (struct upgt_lmac_tx_desc *)(mem + 1); 1635 1636 /* XXX differ between data and mgmt frames? */ 1637 txdesc->header1.flags = UPGT_H1_FLAGS_TX_DATA; 1638 txdesc->header1.type = UPGT_H1_TYPE_TX_DATA; 1639 txdesc->header1.len = htole16(m->m_pkthdr.len); 1640 1641 txdesc->header2.reqid = htole32(data_tx->addr); 1642 txdesc->header2.type = htole16(UPGT_H2_TYPE_TX_ACK_YES); 1643 txdesc->header2.flags = htole16(UPGT_H2_FLAGS_TX_ACK_YES); 1644 1645 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == 1646 IEEE80211_FC0_TYPE_MGT) { 1647 /* always send mgmt frames at lowest rate (DS1) */ 1648 memset(txdesc->rates, 0x10, sizeof(txdesc->rates)); 1649 } else { 1650 memcpy(txdesc->rates, sc->sc_cur_rateset, 1651 sizeof(txdesc->rates)); 1652 } 1653 txdesc->type = htole32(UPGT_TX_DESC_TYPE_DATA); 1654 txdesc->pad3[0] = UPGT_TX_DESC_PAD3_SIZE; 1655 1656 if (sc->sc_drvbpf != NULL) { 1657 struct upgt_tx_radiotap_header *tap = &sc->sc_txtap; 1658 1659 tap->wt_flags = 0; 1660 tap->wt_rate = 0; /* TODO: where to get from? */ 1661 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq); 1662 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags); 1663 1664 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m, 1665 BPF_D_OUT); 1666 } 1667 1668 /* copy frame below our TX descriptor header */ 1669 m_copydata(m, 0, m->m_pkthdr.len, 1670 data_tx->buf + sizeof(*mem) + sizeof(*txdesc)); 1671 1672 /* calculate frame size */ 1673 len = sizeof(*mem) + sizeof(*txdesc) + m->m_pkthdr.len; 1674 1675 if (len & 3) { 1676 /* we need to align the frame to a 4 byte boundary */ 1677 pad = 4 - (len & 3); 1678 memset(data_tx->buf + len, 0, pad); 1679 len += pad; 1680 } 1681 1682 /* calculate frame checksum */ 1683 mem->chksum = upgt_chksum_le((uint32_t *)txdesc, 1684 len - sizeof(*mem)); 1685 1686 /* we do not need the mbuf anymore */ 1687 m_freem(m); 1688 data_tx->m = NULL; 1689 1690 ieee80211_free_node(data_tx->ni); 1691 data_tx->ni = NULL; 1692 1693 DPRINTF(2, "%s: TX start data sending\n", 1694 device_xname(sc->sc_dev)); 1695 1696 usbd_setup_xfer(data_tx->xfer, data_tx, data_tx->buf, len, 1697 USBD_FORCE_SHORT_XFER, UPGT_USB_TIMEOUT, NULL); 1698 error = usbd_transfer(data_tx->xfer); 1699 if (error != USBD_NORMAL_COMPLETION && 1700 error != USBD_IN_PROGRESS) { 1701 aprint_error_dev(sc->sc_dev, 1702 "could not transmit TX data URB\n"); 1703 if_statinc(ifp, if_oerrors); 1704 break; 1705 } 1706 1707 DPRINTF(2, "%s: TX sent (%d bytes)\n", 1708 device_xname(sc->sc_dev), len); 1709 } 1710 1711 splx(s); 1712 1713 /* 1714 * If we don't regulary read the device statistics, the RX queue 1715 * will stall. It's strange, but it works, so we keep reading 1716 * the statistics here. *shrug* 1717 */ 1718 mutex_enter(&sc->sc_mtx); 1719 upgt_get_stats(sc); 1720 mutex_exit(&sc->sc_mtx); 1721} 1722 1723static void 1724upgt_tx_done(struct upgt_softc *sc, uint8_t *data) 1725{ 1726 struct ifnet *ifp = &sc->sc_if; 1727 struct upgt_lmac_tx_done_desc *desc; 1728 int i, s; 1729 1730 s = splnet(); 1731 1732 desc = (struct upgt_lmac_tx_done_desc *)data; 1733 1734 for (i = 0; i < UPGT_TX_COUNT; i++) { 1735 struct upgt_data *data_tx = &sc->tx_data[i]; 1736 1737 if (data_tx->addr == le32toh(desc->header2.reqid)) { 1738 upgt_mem_free(sc, data_tx->addr); 1739 data_tx->addr = 0; 1740 1741 sc->tx_queued--; 1742 if_statinc(ifp, if_opackets); 1743 1744 DPRINTF(2, "%s: TX done: ", device_xname(sc->sc_dev)); 1745 DPRINTF(2, "memaddr=0x%08x, status=0x%04x, rssi=%d, ", 1746 le32toh(desc->header2.reqid), 1747 le16toh(desc->status), 1748 le16toh(desc->rssi)); 1749 DPRINTF(2, "seq=%d\n", le16toh(desc->seq)); 1750 break; 1751 } 1752 } 1753 1754 if (sc->tx_queued == 0) { 1755 /* TX queued was processed, continue */ 1756 ifp->if_timer = 0; 1757 ifp->if_flags &= ~IFF_OACTIVE; 1758 upgt_start(ifp); 1759 } 1760 1761 splx(s); 1762} 1763 1764static void 1765upgt_rx_cb(struct usbd_xfer *xfer, void * priv, usbd_status status) 1766{ 1767 struct upgt_data *data_rx = priv; 1768 struct upgt_softc *sc = data_rx->sc; 1769 int len; 1770 struct upgt_lmac_header *header; 1771 struct upgt_lmac_eeprom *eeprom; 1772 uint8_t h1_type; 1773 uint16_t h2_type; 1774 1775 DPRINTF(3, "%s: %s\n", device_xname(sc->sc_dev), __func__); 1776 1777 if (status != USBD_NORMAL_COMPLETION) { 1778 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED) 1779 return; 1780 if (status == USBD_STALLED) 1781 usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh); 1782 goto skip; 1783 } 1784 usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL); 1785 1786 /* 1787 * Check what type of frame came in. 1788 */ 1789 header = (struct upgt_lmac_header *)(data_rx->buf + 4); 1790 1791 h1_type = header->header1.type; 1792 h2_type = le16toh(header->header2.type); 1793 1794 if (h1_type == UPGT_H1_TYPE_CTRL && 1795 h2_type == UPGT_H2_TYPE_EEPROM) { 1796 eeprom = (struct upgt_lmac_eeprom *)(data_rx->buf + 4); 1797 uint16_t eeprom_offset = le16toh(eeprom->offset); 1798 uint16_t eeprom_len = le16toh(eeprom->len); 1799 1800 DPRINTF(2, "%s: received EEPROM block (offset=%d, len=%d)\n", 1801 device_xname(sc->sc_dev), eeprom_offset, eeprom_len); 1802 1803 mutex_enter(&sc->sc_mtx); 1804 memcpy(sc->sc_eeprom + eeprom_offset, 1805 data_rx->buf + sizeof(struct upgt_lmac_eeprom) + 4, 1806 eeprom_len); 1807 1808 /* EEPROM data has arrived in time, wakeup upgt_eeprom_read */ 1809 /* Note eeprom data arrived */ 1810 cv_broadcast(&sc->sc_cv); 1811 mutex_exit(&sc->sc_mtx); 1812 } else 1813 if (h1_type == UPGT_H1_TYPE_CTRL && 1814 h2_type == UPGT_H2_TYPE_TX_DONE) { 1815 DPRINTF(2, "%s: received 802.11 TX done\n", 1816 device_xname(sc->sc_dev)); 1817 1818 upgt_tx_done(sc, data_rx->buf + 4); 1819 } else 1820 if (h1_type == UPGT_H1_TYPE_RX_DATA || 1821 h1_type == UPGT_H1_TYPE_RX_DATA_MGMT) { 1822 DPRINTF(3, "%s: received 802.11 RX data\n", 1823 device_xname(sc->sc_dev)); 1824 1825 upgt_rx(sc, data_rx->buf + 4, le16toh(header->header1.len)); 1826 } else 1827 if (h1_type == UPGT_H1_TYPE_CTRL && 1828 h2_type == UPGT_H2_TYPE_STATS) { 1829 DPRINTF(2, "%s: received statistic data\n", 1830 device_xname(sc->sc_dev)); 1831 1832 /* TODO: what could we do with the statistic data? */ 1833 } else { 1834 /* ignore unknown frame types */ 1835 DPRINTF(1, "%s: received unknown frame type 0x%02x\n", 1836 device_xname(sc->sc_dev), header->header1.type); 1837 } 1838 1839skip: /* setup new transfer */ 1840 usbd_setup_xfer(xfer, data_rx, data_rx->buf, MCLBYTES, 1841 USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, upgt_rx_cb); 1842 (void)usbd_transfer(xfer); 1843} 1844 1845static void 1846upgt_rx(struct upgt_softc *sc, uint8_t *data, int pkglen) 1847{ 1848 struct ieee80211com *ic = &sc->sc_ic; 1849 struct ifnet *ifp = &sc->sc_if; 1850 struct upgt_lmac_rx_desc *rxdesc; 1851 struct ieee80211_frame *wh; 1852 struct ieee80211_node *ni; 1853 struct mbuf *m; 1854 int s; 1855 1856 /* access RX packet descriptor */ 1857 rxdesc = (struct upgt_lmac_rx_desc *)data; 1858 1859 /* create mbuf which is suitable for strict alignment archs */ 1860 m = m_devget(rxdesc->data, pkglen, 0, ifp); 1861 if (m == NULL) { 1862 DPRINTF(1, "%s: could not create RX mbuf\n", 1863 device_xname(sc->sc_dev)); 1864 if_statinc(ifp, if_ierrors); 1865 return; 1866 } 1867 1868 s = splnet(); 1869 1870 if (sc->sc_drvbpf != NULL) { 1871 struct upgt_rx_radiotap_header *tap = &sc->sc_rxtap; 1872 1873 tap->wr_flags = IEEE80211_RADIOTAP_F_FCS; 1874 tap->wr_rate = upgt_rx_rate(sc, rxdesc->rate); 1875 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq); 1876 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags); 1877 tap->wr_antsignal = rxdesc->rssi; 1878 1879 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN); 1880 } 1881 1882 /* trim FCS */ 1883 m_adj(m, -IEEE80211_CRC_LEN); 1884 1885 wh = mtod(m, struct ieee80211_frame *); 1886 ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh); 1887 1888 /* push the frame up to the 802.11 stack */ 1889 ieee80211_input(ic, m, ni, rxdesc->rssi, 0); 1890 1891 /* node is no longer needed */ 1892 ieee80211_free_node(ni); 1893 1894 splx(s); 1895 1896 DPRINTF(3, "%s: RX done\n", device_xname(sc->sc_dev)); 1897} 1898 1899static void 1900upgt_setup_rates(struct upgt_softc *sc) 1901{ 1902 struct ieee80211com *ic = &sc->sc_ic; 1903 1904 /* 1905 * 0x01 = OFMD6 0x10 = DS1 1906 * 0x04 = OFDM9 0x11 = DS2 1907 * 0x06 = OFDM12 0x12 = DS5 1908 * 0x07 = OFDM18 0x13 = DS11 1909 * 0x08 = OFDM24 1910 * 0x09 = OFDM36 1911 * 0x0a = OFDM48 1912 * 0x0b = OFDM54 1913 */ 1914 const uint8_t rateset_auto_11b[] = 1915 { 0x13, 0x13, 0x12, 0x11, 0x11, 0x10, 0x10, 0x10 }; 1916 const uint8_t rateset_auto_11g[] = 1917 { 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x04, 0x01 }; 1918 const uint8_t rateset_fix_11bg[] = 1919 { 0x10, 0x11, 0x12, 0x13, 0x01, 0x04, 0x06, 0x07, 1920 0x08, 0x09, 0x0a, 0x0b }; 1921 1922 if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) { 1923 /* 1924 * Automatic rate control is done by the device. 1925 * We just pass the rateset from which the device 1926 * will pickup a rate. 1927 */ 1928 if (ic->ic_curmode == IEEE80211_MODE_11B) 1929 memcpy(sc->sc_cur_rateset, rateset_auto_11b, 1930 sizeof(sc->sc_cur_rateset)); 1931 if (ic->ic_curmode == IEEE80211_MODE_11G || 1932 ic->ic_curmode == IEEE80211_MODE_AUTO) 1933 memcpy(sc->sc_cur_rateset, rateset_auto_11g, 1934 sizeof(sc->sc_cur_rateset)); 1935 } else { 1936 /* set a fixed rate */ 1937 memset(sc->sc_cur_rateset, rateset_fix_11bg[ic->ic_fixed_rate], 1938 sizeof(sc->sc_cur_rateset)); 1939 } 1940} 1941 1942static uint8_t 1943upgt_rx_rate(struct upgt_softc *sc, const int rate) 1944{ 1945 struct ieee80211com *ic = &sc->sc_ic; 1946 1947 if (ic->ic_curmode == IEEE80211_MODE_11B) { 1948 if (rate < 0 || rate > 3) 1949 /* invalid rate */ 1950 return 0; 1951 1952 switch (rate) { 1953 case 0: 1954 return 2; 1955 case 1: 1956 return 4; 1957 case 2: 1958 return 11; 1959 case 3: 1960 return 22; 1961 default: 1962 return 0; 1963 } 1964 } 1965 1966 if (ic->ic_curmode == IEEE80211_MODE_11G) { 1967 if (rate < 0 || rate > 11) 1968 /* invalid rate */ 1969 return 0; 1970 1971 switch (rate) { 1972 case 0: 1973 return 2; 1974 case 1: 1975 return 4; 1976 case 2: 1977 return 11; 1978 case 3: 1979 return 22; 1980 case 4: 1981 return 12; 1982 case 5: 1983 return 18; 1984 case 6: 1985 return 24; 1986 case 7: 1987 return 36; 1988 case 8: 1989 return 48; 1990 case 9: 1991 return 72; 1992 case 10: 1993 return 96; 1994 case 11: 1995 return 108; 1996 default: 1997 return 0; 1998 } 1999 } 2000 2001 return 0; 2002} 2003 2004static int 2005upgt_set_macfilter(struct upgt_softc *sc, uint8_t state) 2006{ 2007 struct ieee80211com *ic = &sc->sc_ic; 2008 struct ieee80211_node *ni = ic->ic_bss; 2009 struct upgt_data *data_cmd = &sc->cmd_data; 2010 struct upgt_lmac_mem *mem; 2011 struct upgt_lmac_filter *filter; 2012 int len; 2013 const uint8_t broadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 2014 2015 /* 2016 * Transmit the URB containing the CMD data. 2017 */ 2018 len = sizeof(*mem) + sizeof(*filter); 2019 2020 memset(data_cmd->buf, 0, len); 2021 2022 mem = (struct upgt_lmac_mem *)data_cmd->buf; 2023 mem->addr = htole32(sc->sc_memaddr_frame_start + 2024 UPGT_MEMSIZE_FRAME_HEAD); 2025 2026 filter = (struct upgt_lmac_filter *)(mem + 1); 2027 2028 filter->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK; 2029 filter->header1.type = UPGT_H1_TYPE_CTRL; 2030 filter->header1.len = htole16( 2031 sizeof(struct upgt_lmac_filter) - 2032 sizeof(struct upgt_lmac_header)); 2033 2034 filter->header2.reqid = htole32(sc->sc_memaddr_frame_start); 2035 filter->header2.type = htole16(UPGT_H2_TYPE_MACFILTER); 2036 filter->header2.flags = 0; 2037 2038 switch (state) { 2039 case IEEE80211_S_INIT: 2040 DPRINTF(1, "%s: set MAC filter to INIT\n", 2041 device_xname(sc->sc_dev)); 2042 2043 filter->type = htole16(UPGT_FILTER_TYPE_RESET); 2044 break; 2045 case IEEE80211_S_SCAN: 2046 DPRINTF(1, "%s: set MAC filter to SCAN (bssid %s)\n", 2047 device_xname(sc->sc_dev), ether_sprintf(broadcast)); 2048 2049 filter->type = htole16(UPGT_FILTER_TYPE_NONE); 2050 IEEE80211_ADDR_COPY(filter->dst, ic->ic_myaddr); 2051 IEEE80211_ADDR_COPY(filter->src, broadcast); 2052 filter->unknown1 = htole16(UPGT_FILTER_UNKNOWN1); 2053 filter->rxaddr = htole32(sc->sc_memaddr_rx_start); 2054 filter->unknown2 = htole16(UPGT_FILTER_UNKNOWN2); 2055 filter->rxhw = htole32(sc->sc_eeprom_hwrx); 2056 filter->unknown3 = htole16(UPGT_FILTER_UNKNOWN3); 2057 break; 2058 case IEEE80211_S_RUN: 2059 DPRINTF(1, "%s: set MAC filter to RUN (bssid %s)\n", 2060 device_xname(sc->sc_dev), ether_sprintf(ni->ni_bssid)); 2061 2062 filter->type = htole16(UPGT_FILTER_TYPE_STA); 2063 IEEE80211_ADDR_COPY(filter->dst, ic->ic_myaddr); 2064 IEEE80211_ADDR_COPY(filter->src, ni->ni_bssid); 2065 filter->unknown1 = htole16(UPGT_FILTER_UNKNOWN1); 2066 filter->rxaddr = htole32(sc->sc_memaddr_rx_start); 2067 filter->unknown2 = htole16(UPGT_FILTER_UNKNOWN2); 2068 filter->rxhw = htole32(sc->sc_eeprom_hwrx); 2069 filter->unknown3 = htole16(UPGT_FILTER_UNKNOWN3); 2070 break; 2071 default: 2072 aprint_error_dev(sc->sc_dev, 2073 "MAC filter does not know that state\n"); 2074 break; 2075 } 2076 2077 mem->chksum = upgt_chksum_le((uint32_t *)filter, sizeof(*filter)); 2078 2079 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 2080 aprint_error_dev(sc->sc_dev, 2081 "could not transmit macfilter CMD data URB\n"); 2082 return EIO; 2083 } 2084 2085 return 0; 2086} 2087 2088static int 2089upgt_set_channel(struct upgt_softc *sc, unsigned channel) 2090{ 2091 struct upgt_data *data_cmd = &sc->cmd_data; 2092 struct upgt_lmac_mem *mem; 2093 struct upgt_lmac_channel *chan; 2094 int len; 2095 2096 DPRINTF(1, "%s: %s: %d\n", device_xname(sc->sc_dev), __func__, 2097 channel); 2098 2099 /* 2100 * Transmit the URB containing the CMD data. 2101 */ 2102 len = sizeof(*mem) + sizeof(*chan); 2103 2104 memset(data_cmd->buf, 0, len); 2105 2106 mem = (struct upgt_lmac_mem *)data_cmd->buf; 2107 mem->addr = htole32(sc->sc_memaddr_frame_start + 2108 UPGT_MEMSIZE_FRAME_HEAD); 2109 2110 chan = (struct upgt_lmac_channel *)(mem + 1); 2111 2112 chan->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK; 2113 chan->header1.type = UPGT_H1_TYPE_CTRL; 2114 chan->header1.len = htole16( 2115 sizeof(struct upgt_lmac_channel) - 2116 sizeof(struct upgt_lmac_header)); 2117 2118 chan->header2.reqid = htole32(sc->sc_memaddr_frame_start); 2119 chan->header2.type = htole16(UPGT_H2_TYPE_CHANNEL); 2120 chan->header2.flags = 0; 2121 2122 chan->unknown1 = htole16(UPGT_CHANNEL_UNKNOWN1); 2123 chan->unknown2 = htole16(UPGT_CHANNEL_UNKNOWN2); 2124 chan->freq6 = sc->sc_eeprom_freq6[channel]; 2125 chan->settings = sc->sc_eeprom_freq6_settings; 2126 chan->unknown3 = UPGT_CHANNEL_UNKNOWN3; 2127 2128 memcpy(chan->freq3_1, &sc->sc_eeprom_freq3[channel].data, 2129 sizeof(chan->freq3_1)); 2130 2131 memcpy(chan->freq4, &sc->sc_eeprom_freq4[channel], 2132 sizeof(sc->sc_eeprom_freq4[channel])); 2133 2134 memcpy(chan->freq3_2, &sc->sc_eeprom_freq3[channel].data, 2135 sizeof(chan->freq3_2)); 2136 2137 mem->chksum = upgt_chksum_le((uint32_t *)chan, sizeof(*chan)); 2138 2139 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 2140 aprint_error_dev(sc->sc_dev, 2141 "could not transmit channel CMD data URB\n"); 2142 return EIO; 2143 } 2144 2145 return 0; 2146} 2147 2148static void 2149upgt_set_led(struct upgt_softc *sc, int action) 2150{ 2151 struct ieee80211com *ic = &sc->sc_ic; 2152 struct upgt_data *data_cmd = &sc->cmd_data; 2153 struct upgt_lmac_mem *mem; 2154 struct upgt_lmac_led *led; 2155 struct timeval t; 2156 int len; 2157 2158 /* 2159 * Transmit the URB containing the CMD data. 2160 */ 2161 len = sizeof(*mem) + sizeof(*led); 2162 2163 memset(data_cmd->buf, 0, len); 2164 2165 mem = (struct upgt_lmac_mem *)data_cmd->buf; 2166 mem->addr = htole32(sc->sc_memaddr_frame_start + 2167 UPGT_MEMSIZE_FRAME_HEAD); 2168 2169 led = (struct upgt_lmac_led *)(mem + 1); 2170 2171 led->header1.flags = UPGT_H1_FLAGS_TX_NO_CALLBACK; 2172 led->header1.type = UPGT_H1_TYPE_CTRL; 2173 led->header1.len = htole16( 2174 sizeof(struct upgt_lmac_led) - 2175 sizeof(struct upgt_lmac_header)); 2176 2177 led->header2.reqid = htole32(sc->sc_memaddr_frame_start); 2178 led->header2.type = htole16(UPGT_H2_TYPE_LED); 2179 led->header2.flags = 0; 2180 2181 switch (action) { 2182 case UPGT_LED_OFF: 2183 led->mode = htole16(UPGT_LED_MODE_SET); 2184 led->action_fix = 0; 2185 led->action_tmp = htole16(UPGT_LED_ACTION_OFF); 2186 led->action_tmp_dur = 0; 2187 break; 2188 case UPGT_LED_ON: 2189 led->mode = htole16(UPGT_LED_MODE_SET); 2190 led->action_fix = 0; 2191 led->action_tmp = htole16(UPGT_LED_ACTION_ON); 2192 led->action_tmp_dur = 0; 2193 break; 2194 case UPGT_LED_BLINK: 2195 if (ic->ic_state != IEEE80211_S_RUN) 2196 return; 2197 if (sc->sc_led_blink) 2198 /* previous blink was not finished */ 2199 return; 2200 led->mode = htole16(UPGT_LED_MODE_SET); 2201 led->action_fix = htole16(UPGT_LED_ACTION_OFF); 2202 led->action_tmp = htole16(UPGT_LED_ACTION_ON); 2203 led->action_tmp_dur = htole16(UPGT_LED_ACTION_TMP_DUR); 2204 /* lock blink */ 2205 sc->sc_led_blink = 1; 2206 t.tv_sec = 0; 2207 t.tv_usec = UPGT_LED_ACTION_TMP_DUR * 1000L; 2208 callout_schedule(&sc->led_to, tvtohz(&t)); 2209 break; 2210 default: 2211 return; 2212 } 2213 2214 mem->chksum = upgt_chksum_le((uint32_t *)led, sizeof(*led)); 2215 2216 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 2217 aprint_error_dev(sc->sc_dev, 2218 "could not transmit led CMD URB\n"); 2219 } 2220} 2221 2222static void 2223upgt_set_led_blink(void *arg) 2224{ 2225 struct upgt_softc *sc = arg; 2226 2227 /* blink finished, we are ready for a next one */ 2228 sc->sc_led_blink = 0; 2229 callout_stop(&sc->led_to); 2230} 2231 2232static int 2233upgt_get_stats(struct upgt_softc *sc) 2234{ 2235 struct upgt_data *data_cmd = &sc->cmd_data; 2236 struct upgt_lmac_mem *mem; 2237 struct upgt_lmac_stats *stats; 2238 int len; 2239 2240 /* 2241 * Transmit the URB containing the CMD data. 2242 */ 2243 len = sizeof(*mem) + sizeof(*stats); 2244 2245 memset(data_cmd->buf, 0, len); 2246 2247 mem = (struct upgt_lmac_mem *)data_cmd->buf; 2248 mem->addr = htole32(sc->sc_memaddr_frame_start + 2249 UPGT_MEMSIZE_FRAME_HEAD); 2250 2251 stats = (struct upgt_lmac_stats *)(mem + 1); 2252 2253 stats->header1.flags = 0; 2254 stats->header1.type = UPGT_H1_TYPE_CTRL; 2255 stats->header1.len = htole16( 2256 sizeof(struct upgt_lmac_stats) - 2257 sizeof(struct upgt_lmac_header)); 2258 2259 stats->header2.reqid = htole32(sc->sc_memaddr_frame_start); 2260 stats->header2.type = htole16(UPGT_H2_TYPE_STATS); 2261 stats->header2.flags = 0; 2262 2263 mem->chksum = upgt_chksum_le((uint32_t *)stats, sizeof(*stats)); 2264 2265 if (upgt_bulk_xmit(sc, data_cmd, sc->sc_tx_pipeh, &len, 0) != 0) { 2266 aprint_error_dev(sc->sc_dev, 2267 "could not transmit statistics CMD data URB\n"); 2268 return EIO; 2269 } 2270 2271 return 0; 2272 2273} 2274 2275static int 2276upgt_alloc_tx(struct upgt_softc *sc) 2277{ 2278 int i; 2279 2280 sc->tx_queued = 0; 2281 2282 for (i = 0; i < UPGT_TX_COUNT; i++) { 2283 struct upgt_data *data_tx = &sc->tx_data[i]; 2284 2285 data_tx->sc = sc; 2286 2287 int err = usbd_create_xfer(sc->sc_tx_pipeh, MCLBYTES, 2288 USBD_FORCE_SHORT_XFER, 0, &data_tx->xfer); 2289 if (err) { 2290 aprint_error_dev(sc->sc_dev, 2291 "could not allocate TX xfer\n"); 2292 return err; 2293 } 2294 2295 data_tx->buf = usbd_get_buffer(data_tx->xfer); 2296 } 2297 2298 return 0; 2299} 2300 2301static int 2302upgt_alloc_rx(struct upgt_softc *sc) 2303{ 2304 struct upgt_data *data_rx = &sc->rx_data; 2305 2306 data_rx->sc = sc; 2307 2308 int err = usbd_create_xfer(sc->sc_rx_pipeh, MCLBYTES, 2309 0, 0, &data_rx->xfer); 2310 if (err) { 2311 aprint_error_dev(sc->sc_dev, "could not allocate RX xfer\n"); 2312 return err; 2313 } 2314 2315 data_rx->buf = usbd_get_buffer(data_rx->xfer); 2316 2317 return 0; 2318} 2319 2320static int 2321upgt_alloc_cmd(struct upgt_softc *sc) 2322{ 2323 struct upgt_data *data_cmd = &sc->cmd_data; 2324 2325 data_cmd->sc = sc; 2326 2327 int err = usbd_create_xfer(sc->sc_tx_pipeh, MCLBYTES, 2328 USBD_FORCE_SHORT_XFER, 0, &data_cmd->xfer); 2329 if (err) { 2330 aprint_error_dev(sc->sc_dev, "could not allocate RX xfer\n"); 2331 return err; 2332 } 2333 2334 data_cmd->buf = usbd_get_buffer(data_cmd->xfer); 2335 2336 cv_init(&sc->sc_cv, "upgteeprom"); 2337 mutex_init(&sc->sc_mtx, MUTEX_DEFAULT, IPL_NONE); 2338 2339 return 0; 2340} 2341 2342static void 2343upgt_free_tx(struct upgt_softc *sc) 2344{ 2345 int i; 2346 2347 for (i = 0; i < UPGT_TX_COUNT; i++) { 2348 struct upgt_data *data_tx = &sc->tx_data[i]; 2349 2350 if (data_tx->xfer != NULL) { 2351 usbd_destroy_xfer(data_tx->xfer); 2352 data_tx->xfer = NULL; 2353 } 2354 2355 data_tx->ni = NULL; 2356 } 2357} 2358 2359static void 2360upgt_free_rx(struct upgt_softc *sc) 2361{ 2362 struct upgt_data *data_rx = &sc->rx_data; 2363 2364 if (data_rx->xfer != NULL) { 2365 usbd_destroy_xfer(data_rx->xfer); 2366 data_rx->xfer = NULL; 2367 } 2368 2369 data_rx->ni = NULL; 2370} 2371 2372static void 2373upgt_free_cmd(struct upgt_softc *sc) 2374{ 2375 struct upgt_data *data_cmd = &sc->cmd_data; 2376 2377 if (data_cmd->xfer == NULL) 2378 return; 2379 2380 mutex_destroy(&sc->sc_mtx); 2381 cv_destroy(&sc->sc_cv); 2382 2383 usbd_destroy_xfer(data_cmd->xfer); 2384 data_cmd->xfer = NULL; 2385} 2386 2387static int 2388upgt_bulk_xmit(struct upgt_softc *sc, struct upgt_data *data, 2389 struct usbd_pipe *pipeh, uint32_t *size, int flags) 2390{ 2391 usbd_status status; 2392 2393 status = usbd_bulk_transfer(data->xfer, pipeh, flags, UPGT_USB_TIMEOUT, 2394 data->buf, size); 2395 if (status != USBD_NORMAL_COMPLETION) { 2396 aprint_error_dev(sc->sc_dev, "%s: error %s\n", __func__, 2397 usbd_errstr(status)); 2398 return EIO; 2399 } 2400 2401 return 0; 2402} 2403 2404#if 0 2405static void 2406upgt_hexdump(void *buf, int len) 2407{ 2408 int i; 2409 2410 for (i = 0; i < len; i++) { 2411 if (i % 16 == 0) 2412 printf("%s%5i:", i ? "\n" : "", i); 2413 if (i % 4 == 0) 2414 printf(" "); 2415 printf("%02x", (int)*((uint8_t *)buf + i)); 2416 } 2417 printf("\n"); 2418} 2419#endif 2420 2421static uint32_t 2422upgt_crc32_le(const void *buf, size_t size) 2423{ 2424 uint32_t crc; 2425 2426 crc = ether_crc32_le(buf, size); 2427 2428 /* apply final XOR value as common for CRC-32 */ 2429 crc = htole32(crc ^ 0xffffffffU); 2430 2431 return crc; 2432} 2433 2434/* 2435 * The firmware awaits a checksum for each frame we send to it. 2436 * The algorithm used is uncommon but somehow similar to CRC32. 2437 */ 2438static uint32_t 2439upgt_chksum_le(const uint32_t *buf, size_t size) 2440{ 2441 int i; 2442 uint32_t crc = 0; 2443 2444 for (i = 0; i < size; i += sizeof(uint32_t)) { 2445 crc = htole32(crc ^ *buf++); 2446 crc = htole32((crc >> 5) ^ (crc << 3)); 2447 } 2448 2449 return crc; 2450} 2451