Commit Graph

1293 Commits

Author SHA1 Message Date
Conrad Meyer
c1475a191e net80211: Move rate printing in amrr_node_stats() to a separate method
This makes amrr_node_stats() cleaner and allows the rate printing to be
reusable.

Submitted by:	Neel Chauhan <neel at neelc.org>
Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D22318
2020-01-17 22:04:11 +00:00
Gleb Smirnoff
2b60ecf197 Don't use if_maddr_rlock() in 802.11, use epoch(9) directly instead. 2019-10-10 23:55:33 +00:00
Bjoern A. Zeeb
cd02c6b10d Enhance the comment ieee80211_add_channel() to avoid a
misunderstanding that the function does not work additive
when repeatedly called for diffferent bands.

Reviewed by:	avos (a few months ago)
MFC after:	2 weeks
2019-06-10 14:31:18 +00:00
John Baldwin
fb3bc59600 Restructure mbuf send tags to provide stronger guarantees.
- Perform ifp mismatch checks (to determine if a send tag is allocated
  for a different ifp than the one the packet is being output on), in
  ip_output() and ip6_output().  This avoids sending packets with send
  tags to ifnet drivers that don't support send tags.

  Since we are now checking for ifp mismatches before invoking
  if_output, we can now try to allocate a new tag before invoking
  if_output sending the original packet on the new tag if allocation
  succeeds.

  To avoid code duplication for the fragment and unfragmented cases,
  add ip_output_send() and ip6_output_send() as wrappers around
  if_output and nd6_output_ifp, respectively.  All of the logic for
  setting send tags and dealing with send tag-related errors is done
  in these wrapper functions.

  For pseudo interfaces that wrap other network interfaces (vlan and
  lagg), wrapper send tags are now allocated so that ip*_output see
  the wrapper ifp as the ifp in the send tag.  The if_transmit
  routines rewrite the send tags after performing an ifp mismatch
  check.  If an ifp mismatch is detected, the transmit routines fail
  with EAGAIN.

- To provide clearer life cycle management of send tags, especially
  in the presence of vlan and lagg wrapper tags, add a reference count
  to send tags managed via m_snd_tag_ref() and m_snd_tag_rele().
  Provide a helper function (m_snd_tag_init()) for use by drivers
  supporting send tags.  m_snd_tag_init() takes care of the if_ref
  on the ifp meaning that code alloating send tags via if_snd_tag_alloc
  no longer has to manage that manually.  Similarly, m_snd_tag_rele
  drops the refcount on the ifp after invoking if_snd_tag_free when
  the last reference to a send tag is dropped.

  This also closes use after free races if there are pending packets in
  driver tx rings after the socket is closed (e.g. from tcpdrop).

  In order for m_free to work reliably, add a new CSUM_SND_TAG flag in
  csum_flags to indicate 'snd_tag' is set (rather than 'rcvif').
  Drivers now also check this flag instead of checking snd_tag against
  NULL.  This avoids false positive matches when a forwarded packet
  has a non-NULL rcvif that was treated as a send tag.

- cxgbe was relying on snd_tag_free being called when the inp was
  detached so that it could kick the firmware to flush any pending
  work on the flow.  This is because the driver doesn't require ACK
  messages from the firmware for every request, but instead does a
  kind of manual interrupt coalescing by only setting a flag to
  request a completion on a subset of requests.  If all of the
  in-flight requests don't have the flag when the tag is detached from
  the inp, the flow might never return the credits.  The current
  snd_tag_free command issues a flush command to force the credits to
  return.  However, the credit return is what also frees the mbufs,
  and since those mbufs now hold references on the tag, this meant
  that snd_tag_free would never be called.

  To fix, explicitly drop the mbuf's reference on the snd tag when the
  mbuf is queued in the firmware work queue.  This means that once the
  inp's reference on the tag goes away and all in-flight mbufs have
  been queued to the firmware, tag's refcount will drop to zero and
  snd_tag_free will kick in and send the flush request.  Note that we
  need to avoid doing this in the middle of ethofld_tx(), so the
  driver grabs a temporary reference on the tag around that loop to
  defer the free to the end of the function in case it sends the last
  mbuf to the queue after the inp has dropped its reference on the
  tag.

- mlx5 preallocates send tags and was using the ifp pointer even when
  the send tag wasn't in use.  Explicitly use the ifp from other data
  structures instead.

- Sprinkle some assertions in various places to assert that received
  packets don't have a send tag, and that other places that overwrite
  rcvif (e.g. 802.11 transmit) don't clobber a send tag pointer.

Reviewed by:	gallatin, hselasky, rgrimes, ae
Sponsored by:	Netflix
Differential Revision:	https://reviews.freebsd.org/D20117
2019-05-24 22:30:40 +00:00
Andriy Voskoboinyk
f35b8451ba net80211: correct check for SMPS node flags updates
Update node flags when driver supports SMPS, not when it is disabled or
in dynamic mode ((iv_htcaps & HTCAP_SMPS) != 0).

Checked with RTL8188EE (1T1R), STA mode - 'smps' word should disappear
from 'ifconfig wlan0' output.

MFC after:	2 weeks
2019-03-18 02:40:22 +00:00
Andriy Voskoboinyk
f3f08e16a3 net80211(4): hide casts for 'i_seq' field offset calculation inside
ieee80211_getqos() and reuse it in various places.

Checked with RTL8188EE, HOSTAP mode + RTL8188CUS, STA mode.

MFC after:	2 weeks
2019-02-10 23:58:56 +00:00
Andriy Voskoboinyk
545619f3f2 net80211(4): validate supplied roam:rate values from ifconfig(8)
MFC after:	4 days
2019-02-06 13:01:21 +00:00
Andriy Voskoboinyk
1c4cb65153 net80211(4): do not setup Tx parameters for unsupported modes.
That should shorten 'ifconfig <wlan> list txparam' output since
unsupported modes will not be shown.

Checked with RTL8188EE, STA mode.

MFC after:	2 weeks
2019-02-03 04:31:50 +00:00
Andriy Voskoboinyk
2ce6d2b58c net80211(4): fix rate check when 'roaming' ifconfig(8) option is set to 'auto'
Do not try to clear 'basic rate' bit from roamRate; it cannot be here and,
actually, this operation clears 'MCS rate' bit instead, breaking comparison
for 11n / 11ac modes.

Tested with RTL8188CUS, HOSTAP mode + RTL8821AU, STA mode.

MFC after:	3 days
2019-02-03 02:32:13 +00:00
Andriy Voskoboinyk
511e2766f1 net80211(4): do not setup roaming parameters for unsupported modes.
ifconfig(8) prints per-mode parameters if they are non-zero; since
we have 13 possible modes with 3...5 typically supported this change
should greatly reduce amount of information for 'ifconfig <wlan> list roam'
command.

While here ensure that sta_roam_check() will not use roaming parameters
for unsupported modes (it should not).

This change effectively reverts r188776.

MFC after:	2 weeks
2019-02-03 01:32:02 +00:00
Andriy Voskoboinyk
378478f9fc Drop unused M_80211_COM malloc(9) type.
It is not used since r287197.

MFC after:	3 days
2019-02-02 16:23:45 +00:00
Andriy Voskoboinyk
4ab4d681f3 Do not acquire IEEE80211_LOCK twice in cac_timeout(); reuse
locked function instead.

It is externally visible since r257065.

MFC after:	5 days
2019-02-02 16:21:23 +00:00
Andriy Voskoboinyk
b84b36380e Remove 2GHz channel list copies from wireless drivers.
Wrap ieee80211_add_channel_list_2ghz into another function
which supplies default (1-14) channel list to it and drop
its copies from drivers.

Checked with RTL8188EE, country US / JP / KR / UA.

MFC after:	2 weeks
2019-01-26 17:00:55 +00:00
Andriy Voskoboinyk
9df9e9361c net80211: reuse TICKS_2_MSEC / MSEC_2_TICKS macros from sys/time.h
Replace in-place implementation with system-wide one; since it
guarantees non-zero result drop all less-than-one checks from
drivers and net80211.

MFC after:	2 weeks
2019-01-25 01:05:18 +00:00
Andriy Voskoboinyk
7e2bcba46e net80211: turn channel mode check into assertion.
There is may be only 11b channel (since chanflags[] table
maps MODE_AUTO to the corresponding 11b channel flags).

Checked with RTL8812AU, STA mode.

MFC after:	5 days
2019-01-23 13:17:03 +00:00
Andriy Voskoboinyk
d514ab894a net80211: fix channel list construction for non-auto operating mode.
Change the way how channel list mode <-> desired mode match is done:
- Match channel list mode for next non-auto desired modes:
 * 11b: 11g, 11ng, 11acg;
 * 11a: 11na, 11ac
- Add pre-defined channels only when one of the next conditions met:
 * the desired channel mode is 'auto' or
 * the desired channel and selected channel list modes are exactly
the same or
 * the previous rule (11g / 11n / 11ac promotion) applies.

Before r275875 construction work properly for all except
11ng / 11na / 11acg / 11ac modes - these were broken at all
(i.e., the scan list was empty); after r275875 all checks were removed,
so scan table was populated by all device-compatible channels
(desired mode was ignored).

For example, if I will set 'ifconfig wlan0 mode 11ng' for RTL8821AU:
- pre-r275875: nothing, scan will not work;
- after r275875: both 11ng and 11na bands were scanned; also, since 11b
channel list was used, 14th channel was scanned too.
- after this change: only 11ng - 1-13 channels - are used for scanning.

Tested with:
 * RTL8188EE, STA mode.
 * RTL8821AU, STA mode.

MFC after:	5 days
2019-01-23 12:43:46 +00:00
Andriy Voskoboinyk
dab61567ab net80211: resolve ioctl <-> detach race for ieee80211com structure
Since r287197 ieee80211com is a part of drivers softc; as a result,
after detach all pointers to it (iv_ic, ni_ic) are invalid. Most
possible users (tasks, interrupt handlers) are blocked / removed
when device is stopped; however, ioctl handlers were not tracked
and may crash if ieee80211com structure is accessed.

Since ieee80211com pointer access from ieee80211vap structure is not
protected by lock (constant after interface creation) and used in
many other places just use reference counting for ioctl handlers;
on detach set 'detached' flag and wait until reference counter goes to 0.

For HEAD ieee80211vap size was changed (__FreeBSD_version bumped);
however, in stable branches I'm going to split / reuse the last
iv_spare field for KBI stability.

Tested with:
 - rsu(4), SIOCSIFCAP (-rxcsum) ioctl;
 - rtwn_pci(4), SIOCG80211 / IEEE80211_IOC_HTPROTMODE ioctl.

MFC after:	1 week
2019-01-20 13:39:18 +00:00
Oleksandr Tymoshenko
f280f93df7 [ifconfig] Print more WPS attributes in verbose "list scan" output
- Move WPS related defines to dedicated file
- Add handlers for more WPS attributes

PR:		217317
Submitted by:	J.R. Oldroyd <fbsd@opal.com>
MFC after:	3 weeks
2019-01-20 00:45:44 +00:00
Andriy Voskoboinyk
79e0962d4c net80211: drop m_pullup call from ieee80211_crypto_decap.
For most wireless drivers Rx mbuf is allocated as one
contiguous chunk; only few are using chains for allocations -
but even then at least MCLBYTES (minus Rx descriptor size) is
available in the first mbuf.

In addition to the above, m_pullup was never called here - otherwise,
reallocation will break post-crypto_decap logic (ieee80211_decap,
ieee80211_deliver_data...), so just remove it; length check is left
in case if some truncated frame appears here.

PR:		234241
MFC after:	1 week
2019-01-19 16:04:26 +00:00
Andriy Voskoboinyk
e42e878b35 net80211: provide rate validation for injected frames.
There may be various side effects (device timeout, firmware and / or
kernel panic) when an invalid (or inapplicable - e.g., an MCS rate
for 11g-only device) is set; check rates before sending the frame to
the driver.

How-to-reproduce:
Set an MCS (real or bogus - with 0x80 bit set) rate in ibp_rate0 field
for any device that uses ieee80211_isratevalid() for rate checks -
rum(4), run(4), ural(4), bwi(4) or ral(4); if kernel is compiled
with INVARIANTS the check will result in "rate %d is basic/mcs?" panic.

Tested with WUSB54GC (rum(4)), AP mode.

MFC after:	1 week
2019-01-13 06:01:36 +00:00
Andriy Voskoboinyk
4367c2d177 net80211: fix possible panic for some drivers after r342211
Check if rate control structures were allocated before trying to
access them in various places; this was possible before on
allocation failure (unlikely), but was revealed after r342211
where allocation was deferred.

In case if driver uses wlan_amrr(4) and it is loaded it
is possible to reproduce the panic via

sysctl net.wlan.<number>.rate_stats

(for wlan0 the number will be 0).

Tested with: RTL8188EE, AP mode + RTL8188CUS, STA mode.

MFC after:	3 days
2019-01-12 14:57:12 +00:00
Andriy Voskoboinyk
7071b803da net80211: fix panic when device is removed during initialization
if_dead() is called during device detach - check if interface is
still exists before trying to refresh vap MAC address
(IF_LLADDR will trigger page fault otherwise).

MFC after:	5 days
2019-01-09 12:50:24 +00:00
Andriy Voskoboinyk
18569211a1 net80211: fix duplicate sequence number bump for non-AMPDU QoS frames.
This should be a part of r312972.

MFC after:	4 days
2018-12-30 03:03:53 +00:00
Andriy Voskoboinyk
627bd78e3e net80211: fix out-of-bounds read in ieee80211_amrr(9).
ieee80211_alloc_node() does not initialize rateset tables; that's not
expected by rate control modules and will result in array access at
index -1 - where ni_essid[] array is located (zeroed at allocation, so
there are no user-visible consequences).

Just delay rate control initialization to the moment, when rateset
tables are initiaziled; nothing will use rates here anyway.

MFC after:	4 days
2018-12-19 03:08:10 +00:00
Devin Teske
ab9ed8a1bd Fix misspellings of transmitter/transmitted
Reviewed by:	emaste, bcr
Sponsored by:	Smule, Inc.
Differential Revision:	https://reviews.freebsd.org/D16025
2018-08-10 20:37:32 +00:00
Kyle Evans
8e0cc51b87 ieee8021_node: fix whitespace issues
Submitted by:	Augustin Cavalier <waddlesplash@gmail.com>
Obtained from:	Haiku (dffc3e235360cd7b71261239ee8507b7d62a1471)
MFC after:	1 week
2018-08-10 13:34:23 +00:00
Kyle Evans
58a7c4bfcf net80211: Drain ageq before cleaning it up.
The comment above ieee80211_ageq_cleanup specifically notes that the queue
is assumed to be empty, and in order to make it so, ieee80211_ageq_drain
must be used.

Submitted by:	Augustin Cavalier <waddlesplash@gmail.com>
Obtained from:	Haiku (dffc3e235360cd7b71261239ee8507b7d62a1471)
MFC after:	1 week
2018-08-10 13:32:02 +00:00
Kyle Evans
a84a458c6f net80211: Fix ifdetach w/o ifattach, small whitespace cleanup
As the comment says, ifdetach might be called during the course of driver
detach if initialization failed. This shouldn't be a total failure, though,
we just have nothing to do there.

This has been modified slightly from Augustin's original commit to move the
bail-out slightly earlier since the ic wouldn't have been added to the
ic list in the first place, and a comment has been added describing when
this might be an issue.

Submitted by:	Augustin Cavalier <waddlesplash@gmail.com>
Obtained from:	Haiku (e6f6c1b4633532a8ad37c803dc7c65601e5b24ba)
2018-07-10 23:30:19 +00:00
Brooks Davis
541d96aaaf Use an accessor function to access ifr_data.
This fixes 32-bit compat (no ioctl command defintions are required
as struct ifreq is the same size).  This is believed to be sufficent to
fully support ifconfig on 32-bit systems.

Reviewed by:	kib
Obtained from:	CheriBSD
MFC after:	1 week
Relnotes:	yes
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D14900
2018-03-30 18:50:13 +00:00
Andriy Voskoboinyk
d1b671061b net80211: wrap protection frame allocation into ieee80211_alloc_prot()
Move copy-pasted code for RTS/CTS frame allocation into net80211.
While here, add stat / debug message for allocation failures
(copied from run(4)) + return error here in bwn(4).

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D14628
2018-03-09 11:33:56 +00:00
Andriy Voskoboinyk
bcabc90835 net80211: sanitize input for ieee80211_output()
- Add some basic checks for i_fc* bits (ToDS, FromDS, MoreFrag, Protected);
those are used / checked across various places in Tx path.
- Mark injected 802.11 frame as encapsulated (just as it should be).
- Classify 802.11 frame in a proper way (extract ether_type from LLC header
for Data frames, use AC_BE queue for others (NoData / Management / Control).
- Subtract header length from tx_bytes statistics (so it will correspond
to the comment).

Was checked with RTL8188EU (AP) + Intel 6205 (STA).

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D13161
2017-12-30 00:40:34 +00:00
Andriy Voskoboinyk
f6b986459f net80211: handle VHT nodes in ieee80211_node_setuptxparms()
Select proper mode when node can do VHT.

Currently there are no drivers with VHT support in the tree,
so this should be noop.

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D9806
2017-12-30 00:24:53 +00:00
Eitan Adler
caa7e52f3f kernel: Fix several typos and minor errors
- duplicate words
- typos
- references to old versions of FreeBSD

Reviewed by:	imp, benno
2017-12-27 03:23:21 +00:00
Adrian Chadd
0c6960361b [net80211] add a method for checking if a VAP WME AC has a NOACK policy or not.
A subsequent set of commits will introduce this instead of a whole lot of
gymnastics to check the WME category.
2017-12-09 23:16:02 +00:00
Pedro F. Giffuni
fe267a5590 sys: general adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

No functional change intended.
2017-11-27 15:23:17 +00:00
Adrian Chadd
79caf56e97 [net80211] don't try to follow a NULL rxs pointer down the sink.
It's smelly, and we already checked earlier whether we needed to.
2017-10-13 06:49:07 +00:00
Adrian Chadd
48f95a360e [net80211] begin handling multiple hardware decap'ed A-MSDU in the RX path.
The duplicate detection code currently expects A-MSDU frames to be encaped -
they're decap'ed /after/ duplicate detection.

However for ath10k (and iwm hardware later on) the firmware supports
doing A-MSDU decap in hardware - which shows up as multiple frames with
the same sequence number and IV.

This is the first part of decap handling - if we see a stretch of A-MSDU
frames from the driver with the MORE bit set, then don't treat them
as duplicates.

This isn't 100% complete as crypto sequence number handling and "A-MSDU in
A-MPDU" needs handling, but it's a start.

This should be a glorified no-op for everyone.  Please tell me if it isn't.
2017-10-12 21:56:58 +00:00
Andriy Voskoboinyk
191ccdf545 net80211: fix a typo (premable -> preamble). 2017-08-27 22:13:03 +00:00
Pedro F. Giffuni
d2ffc7af30 sys/net8021: Add missing braces in setcurchan().
Obtained from:	DragonFlyBSD (git c69e37d6)
MFC after:	3 days
2017-08-01 03:13:43 +00:00
Andriy Voskoboinyk
810490a0e2 net80211: do not allow to unload rate control module if it is still in use.
Keep 'nrefs' counter up-to-date, so 'kldunload wlan_amrr' with 1+ active
wlan(4) interface will not lead to kernel panic.

MFC after:	5 days
2017-07-23 22:38:00 +00:00
Andriy Voskoboinyk
2db223f902 net80211: initialize i_seq for A-MPDU frames.
Fragment number field (part of i_seq) is used for AAD calculation;
as a result, without this patch every driver without h/w crypto support
need to clear it before ieee80211_crypto_encap().

Also fixes rtwn(4) A-MPDU Tx with dev.rtwn.%d.hwcrypto tunable
set to 0 (h/w crypto is disabled).

Tested with:
 * Intel 6205, STA mode.
 * RTL8188EU, STA mode.

Differential Revision:	https://reviews.freebsd.org/D10753
2017-06-01 20:46:43 +00:00
Adrian Chadd
85c4e67075 [net80211] prepare for A-MSDU/A-MPDU offload crypto / sequence number checking.
When doing AMSDU offload, the driver (for now!) presents 802.11 frames with
the same sequence number and crypto sequence number / IV values up to the stack.
But, this will trip afoul over the sequence number detection.

So drivers now have a way to signify that a frame is part of an offloaded
AMSDU group, so we can just ensure that we pass those frames up to the
stack.

The logic will be a bit messy - the TL;DR will be that if it's part of
the previously seen sequence number then it belongs in the same burst.
But if we get a repeat of the same sequence number (eg we sent an ACK
but the receiver didn't hear it) then we shouldn't be passing those frames
up.  So, we can't just say "all subframes go up", we need to track
whether we've seen the end of a burst of frames for the given sequence
number or not, so we know whether to actually pass them up or not.

The first part of doing all of this is to ensure the ieee80211_rx_stats
struct is available in the RX sequence number check path and the
RX ampdu reorder path.  So, start by passing the pointer into these
functions to avoid doing another lookup.

The actual support will come in a subsequent commit once I know the
functionality actually works!
2017-05-20 00:43:52 +00:00
Adrian Chadd
f56f89c7a4 [net80211] initial VHT radiotap implementation defines from upstream radiotap. 2017-05-17 19:34:36 +00:00
Adrian Chadd
d03baf3578 [net80211] add methods to fetch the global and per-VAP WME parameters.
For now there isn't any per-VAP WME state.  The eventual aim is to migrate
the driver direct use of WME parameters over to use these methods as
appropriate (global for most devices, per-VAP for firmware NICs that support
it) in preparation for actual per-VAP WME (and other thing) state change
support.
2017-04-22 02:12:07 +00:00
Adrian Chadd
82bd08ee81 [net80211] refactor out "add slot" and "purge slot" for A-MPDU.
This is in preparation for A-MSDU decap in A-MPDU support.

* refactor out the code to purge a single reorder slot into ampdu_rx_purge_slot().
* refactor out the code to add a frame to the given reorder slot
  to ampdu_rx_add_slot().

This should be a big no-op as far as current code is concerned.

Tested:

* QCA9880v2, STA mode (11ac)
* iwn(4), STA mode (11n)

Reviewed by:	avos
Differential Revision:	https://reviews.freebsd.org/D10328
2017-04-11 07:05:55 +00:00
Adrian Chadd
2d6ab41dcd [net80211] refactor out the A-MPDU dispatch routine.
The "dispatch a frame from the A-MPDU reorder buffer" code is essentially
duplicated in a couple of places.  This refactors it out into a single
place in preparation for A-MSDU in A-MPDU offload support, where multiple
A-MSDUs are decap'ed in hardware to 802.3/802.11 frames, but with the
same sequence number.

Reviewed by:	avos
Differential Revision:	https://reviews.freebsd.org/D10240
2017-04-06 01:35:42 +00:00
Adrian Chadd
b06dfd5843 [net80211] refactor the A-MPDU RX window code
The RX window update code is effectively the same in both locations.

Reviewed by:	avos
Differential Revision:	https://reviews.freebsd.org/D10208
2017-04-02 20:59:12 +00:00
Andriy Voskoboinyk
e2db307ebc net80211: fix possible panic when wlan(4) interface is destroyed.
If this is the last running vap wait until device will be powered off
(fixes panic when 'ifconfig wlan0 destroy' is executed for running iwn(4)
interface).

Tested with:
 - Intel 6205, STA mode.
 - RTL8188EU, STA / IBSS modes.
 - RTL8821AU, STA / HOSTAP modes.
2017-03-24 22:29:51 +00:00
Andriy Voskoboinyk
dc33c66d2b net80211: reschedule tasks properly after r315594. 2017-03-19 23:05:03 +00:00
Andriy Voskoboinyk
e79ef94927 net80211: do not cancel callout when FF queue is empty.
This should reduce overhead for aggregates (since every second frame
clears the queue and reschedules the task there is no need to cancel
the callout here; let it just run once at the end - even if queue is
empty).

Reported by:	adrian
2017-03-19 22:18:44 +00:00