summaryrefslogtreecommitdiff
path: root/sys/dev/ic/bwfm.c
AgeCommit message (Collapse)Author
2019-04-25Follow up on jmatthew's suggestion:Kevin Lo
in x_media_change(), return the errno from ieee80211_media_change() and do the error check from x_init(). ok stsp@, jmatthew@, phessler@
2019-04-01Correctly extract the RSSI information from the structure. It'sPatrick Wildt
a 16-bit value, so we have to use letoh16() instead of letoh32(). Also properly cast it to signed, so that it can be sign-extended properly. ok stsp@
2019-02-19Make ifconfig(8) display whether bwfm(4) firmware is using 802.11ac.Stefan Sperling
ok patrick@ mpi@
2019-02-07Consistently use m_freem(9). This fixes possible leaks in a fewPatrick Wildt
error cases.
2019-02-07There's a task ring for executing commands in a sleep-safe context.Patrick Wildt
This task is used to deliver mbufs (for events, not data), but it's possible that the queue overruns. In that case it does leak mbufs. For now, assert the size to see if we hit the issue.
2019-01-30Make bwfm(4) query firmware for RSSI levels and current transmit rate whenStefan Sperling
ifconfig asks for such information. ok patrick@
2018-07-25On authentication we don't need to create the node before callingPatrick Wildt
the network stack since the stack will create the node for us if we pass the ibss stack. On assocation request the node already has to exist, so we error out if we don't have a record of the node. Fixes hostap on 5 GHz channels, since now the node's channel is recorded correctly.
2018-07-17TX packets, which can be either Ethernet or control packets, must bePatrick Wildt
sent in order. Otherwise it is possible that the key is set before we send out the EAPOL packet, or that packets are sent out before the key is set. Thus modify the SDIO backend to put both types into the same internal TX queue, which will be sent asynchronously. Discussed with bluhm@
2018-07-16Add support for the BCM43455 SDIO chip to bwfm(4).Patrick Wildt
2018-07-16Re-set the pointer to the bwfm event after the strict alignmentPatrick Wildt
check.
2018-07-06Move mbuf alignment for strict aligned architectures from the BCDCPatrick Wildt
specific receive path into the generic receive path, since PCIe supplied packets can be misaligned as well.
2018-07-04Move allocation behind sanity check to address possible memory leak asPatrick Wildt
seen by Coverity CID 1470240. Cast the ieee80211_frame struct pointer to uint8_t to address concerns raised by Coverity CID 1470239 and CID 1470237. ok stsp@
2018-05-23Only react to deauthentication/disassociation and link changes if we arePatrick Wildt
not in INIT state. Otherwise we can have bogus state changes on ifconfig down. Also don't try to end a scan if we were not scanning.
2018-05-23Select correct channel in Host AP mode. One part of that is creatingPatrick Wildt
the channel specification (channel, freq, bandwidth, control channel) which is parsed and understood by the bwfm(4) firmware. Another part is that we shouldn't start a scan if the channel is selected by the user, otherwise we override the chosen channel. The remaining part is bringing the device down properly. If it's not disabled properly, we cannot bring it up again. ok stsp@
2018-05-23Implement a separate initialization stage so that we can still usePatrick Wildt
and initialize bwfm(4) later in the case that the firmware was not available on bootup and was only later installed. ok stsp@
2018-05-17Recent Broadcom chipsets have a dedicated PMU core and it can't bePatrick Wildt
accessed using the Chipcommon core anymore.
2018-05-16Implement a BCDC control packet mechanism based on the command requestPatrick Wildt
ids. So far we were only able to have one command in flight at a time and race conditions could easily lead to unexpected behaviour, especia- lly combined with a slow bus and timeouts. With this rework we send or enqueue a control packet command and wait for replies to happen. Thus we can have multiple control packets in flight and a reply with the correct id will wake us up.
2018-04-28Some drivers handle settting a new wifi link state manually, so make surePeter Hessler
they flush old nodes and set the interface link state to down, like the framework does. OK stsp@ pirofti@
2018-04-26net80211: stub SIOCS80211SCAN, make ifconfig scan instant.Paul Irofti
The following removes the functionality of the SIOCS80211SCAN ioctl. After long discussions with stps@, mpi@, and deraadt@ we decided that this was the correct way of fixing ifconfig scan from blocking the network stack. The kernel will continue scanning in the background and filling the nodes array, but ifconfig scan commands will now basically do just a SIOCG80211ALLNODES and pretty print the array. So the output stays the same but is instant. In fact, when the interface is freshly brought up, if you type fast enough, you can see the array being filled by running multiple ifconfig scans in sequence. The SIOCS80211SCAN ioctl stays for now as wi(4), pgt(4) and malo(4) still need it around. But not for long... Another change that this introduces is the fact that ifconfig scan no longer plays with UP and DOWN. If the interface is down it complains and exits. This is needed in order to maintain the nodes list. Works on iwm(4), iwn(4), urtwn(4), run(4) and athn(4). Tested by mpi@, landry@, florian@, thanks! OK mpi@.
2018-02-11Copy the scan results into a new buffer to re-align the data so that wePatrick Wildt
don't fault on strict alignment architectures.
2018-02-11Since the BCDC header has a variable data offset, so the ethernet packetPatrick Wildt
alignment can be variable, it's better to move taking care of alignment into the BCDC receive code.
2018-02-08Move bwfm(4) from ifq begin/commit/rollback semantics to the newerPatrick Wildt
ifq dequeue semantics. This basically means we need to check for available space before dequeuing a packet. As soon as we dequeue a packet we commit to it. On the PCIe backend this check can not be done easily since the flowring depends on the packet contents and we cannot take a peek. When there is no flowring we cache the mbuf and send it out as soon as the flowring opened up. Then the ifq can be restarted and traffic can flow. Typically we usually run out of packet ids, which can be checked without consulting the packet. The flowring probably never becomes full as the bwfm(4) firmware takes the packets off the ring without actually sending them out. Discussed with dlg@
2018-02-07Move parsing the BCDC header on RX into a protocol specific RXPatrick Wildt
function so it can be shared with the SDIO attachment driver.
2018-02-07Add helper to find out if the chip supports Save/Restore. Will be usedPatrick Wildt
in the SDIO bus glue.
2018-02-06Add support for chips which use SYSMEM memory. Code is a simplifiedPatrick Wildt
version of the SOCRAM one.
2018-02-06Support setting the Cortex-M3 cores to active mode.Patrick Wildt
2018-02-05Move event packet handling into a serialized process context to removePatrick Wildt
a state transitioning race condition. Event packets, like completing authentication and the following association completion, are usually received shortly after another. The code that handles those events is scheduled using a task, so it can easily happen that the state change caused by the authentication packet was not done before the following association event arrived. By moving the event packet handling into the same context as the state task we serialize the processing and remove the race condition. Fixes connecting to the 5GHz WiFi AP used at a2k18. ok stsp@
2018-01-31Some wifi drivers don't call ieee80211_newstate() during some stateStefan Sperling
transitions, which means those state transition won't be shown in dmesg in interface debug mode. Make drivers print these transitions themselves. ok patrick@
2018-01-24Put the default case, which prints information about an event we do not yetPatrick Wildt
handle, into a debug printf. Also do not print a pointer to kernel buffers so that we don't leak kernel addresses. Spotted by and ok stsp@
2018-01-24We don't do booleans in the kernel, so replace a few occurrences of 'true'Patrick Wildt
with nicer integer equivalents. Spotted by and ok stsp@
2018-01-11Extract the control channel number from the chanspec information andPatrick Wildt
apply the channel to the node, like iwm(4) does, when supplying the scan response to the net80211 stack. Our stack uses this information for node selection so it's elementary for it to be correct. Tested by jcs@
2018-01-08Initial support for HOSTAP mode. With this bwfm(4) can spawn an accessPatrick Wildt
point including WPA2 support. We now have a different event mask per mode, so that events that are only useful for STA mode don't interfere with HOSTAP mode. Power savings is disabled when we act as AP. The connection events generate 802.11 frames for handling auth/assoc and deauth/deassoc so that our stack takes note of the connecting nodes.
2018-01-08Delete flowrings when we take the interface down or change itsPatrick Wildt
settings.
2018-01-05Drop incoming network packets as long as we are not in RUN state. ThisPatrick Wildt
happens when we successfully associate and the AP tries to initiate the WPA2 handshake but we haven't received the asynchronous ASSOC event yet. Dropping the packet will make the AP retry, and at that point we should have successfully associated. While there, don't feed the event packets to our network stack. It's been helpful for debugging but now it's time to let go.
2018-01-05When we receive an AUTH or ASSOC event even though we have alreadyPatrick Wildt
reached the RUN state, this probably means that we have roamed to a different AP. In that case throw us back into SCAN mode and let the stack look for a new AP to connect to. In the future it might be worthwhile to use the ROAM event information to read the new AP information to adjust our stack, but that is further down the road.
2018-01-04Receiving an AUTH event means that we successfully authenticated, thusPatrick Wildt
we have to move to the "trying to" ASSOC state. When association has finished we will receive an ASSOC event, so that we can move into the RUN state. After that point we will receive ethernet packets and the WPA2 handshake can occur. The SET_SSID event will now only be used to bring us back into SCAN when it notes an error, as it often completes after we have already done the WPA2 handshake and can not be used to switch between the different states.
2018-01-03Since the PCI attachment code already uses mbufs for RX packets, we canPatrick Wildt
push the mbuf allocation down into the USB attachment code and now pass an mbuf to the bwfm(4) receive function.
2017-12-26Fix channel initialization by not using the same loop variable in nestedPatrick Wildt
for-loops. Oops.
2017-12-18Read RAM size for chips with SOCRAM like the BCM4334 on one of myPatrick Wildt
Intel machines.
2017-12-18Pass the BSSID to the join command so that we connect to the AP thatPatrick Wildt
we chose instead of any AP the firmware chooses based on the SSID.
2017-12-18Pass scan type directly to the scan command instead of using the globalPatrick Wildt
variable.
2017-12-18Support setting the Cortex-A7 cores to active/passive mode andPatrick Wildt
fix up the code for the Cortex-R4 which works the same.
2017-12-17Pass Cortex-R4 reset vector to activation function.Patrick Wildt
2017-12-16Read RAM base address and size so we know where to put the firmware.Patrick Wildt
2017-12-16Implement setting the chip into active mode, as needed for setting upPatrick Wildt
the PCIe-based BCM43602's firmware in the PCI attachment driver.
2017-12-16Support setting the Cortex-R4, as found on a BCM43602, to passive mode.Patrick Wildt
2017-10-21Even though letting the firmware handle the handshake is nice fromPatrick Wildt
a user perspective, it's rather horrible from a security perspective. Especially since there has not only been the KRACK attack, but also exploited wireless firmware. Thus this commit changes the way that bwfm(4) is integrated into our network stack. Instead of making it an Ethernet controller with some WiFi capability, deeply integrate it into the net80211 stack. This way we can do the WPA handshake in software and we don't have to reimplement or copy too much code from the net80211 stack. Some code taken from NetBSD where Jared McNeill committed bwfm(4) with net80211 integration as well. Discussed with and "looks good" stsp@
2017-10-19Disable promisc mode and accepting all multicast packets. These shouldPatrick Wildt
be properly enabled by the correct ioctls.
2017-10-18Pass the SIOCG80211ALLCHANS and SIOCG80211STATS ioctls to our net80211Patrick Wildt
which can handle those ioctls quite well for us.
2017-10-18Add a scan timeout so we can recover if the firmware decides not toPatrick Wildt
send us any answers to our request.