Commit Graph

1270 Commits

Author SHA1 Message Date
Andriy Voskoboinyk
627bd78e3e net80211: fix out-of-bounds read in ieee80211_amrr(9).
ieee80211_alloc_node() does not initialize rateset tables; that's not
expected by rate control modules and will result in array access at
index -1 - where ni_essid[] array is located (zeroed at allocation, so
there are no user-visible consequences).

Just delay rate control initialization to the moment, when rateset
tables are initiaziled; nothing will use rates here anyway.

MFC after:	4 days
2018-12-19 03:08:10 +00:00
Devin Teske
ab9ed8a1bd Fix misspellings of transmitter/transmitted
Reviewed by:	emaste, bcr
Sponsored by:	Smule, Inc.
Differential Revision:	https://reviews.freebsd.org/D16025
2018-08-10 20:37:32 +00:00
Kyle Evans
8e0cc51b87 ieee8021_node: fix whitespace issues
Submitted by:	Augustin Cavalier <waddlesplash@gmail.com>
Obtained from:	Haiku (dffc3e235360cd7b71261239ee8507b7d62a1471)
MFC after:	1 week
2018-08-10 13:34:23 +00:00
Kyle Evans
58a7c4bfcf net80211: Drain ageq before cleaning it up.
The comment above ieee80211_ageq_cleanup specifically notes that the queue
is assumed to be empty, and in order to make it so, ieee80211_ageq_drain
must be used.

Submitted by:	Augustin Cavalier <waddlesplash@gmail.com>
Obtained from:	Haiku (dffc3e235360cd7b71261239ee8507b7d62a1471)
MFC after:	1 week
2018-08-10 13:32:02 +00:00
Kyle Evans
a84a458c6f net80211: Fix ifdetach w/o ifattach, small whitespace cleanup
As the comment says, ifdetach might be called during the course of driver
detach if initialization failed. This shouldn't be a total failure, though,
we just have nothing to do there.

This has been modified slightly from Augustin's original commit to move the
bail-out slightly earlier since the ic wouldn't have been added to the
ic list in the first place, and a comment has been added describing when
this might be an issue.

Submitted by:	Augustin Cavalier <waddlesplash@gmail.com>
Obtained from:	Haiku (e6f6c1b4633532a8ad37c803dc7c65601e5b24ba)
2018-07-10 23:30:19 +00:00
Brooks Davis
541d96aaaf Use an accessor function to access ifr_data.
This fixes 32-bit compat (no ioctl command defintions are required
as struct ifreq is the same size).  This is believed to be sufficent to
fully support ifconfig on 32-bit systems.

Reviewed by:	kib
Obtained from:	CheriBSD
MFC after:	1 week
Relnotes:	yes
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D14900
2018-03-30 18:50:13 +00:00
Andriy Voskoboinyk
d1b671061b net80211: wrap protection frame allocation into ieee80211_alloc_prot()
Move copy-pasted code for RTS/CTS frame allocation into net80211.
While here, add stat / debug message for allocation failures
(copied from run(4)) + return error here in bwn(4).

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D14628
2018-03-09 11:33:56 +00:00
Andriy Voskoboinyk
bcabc90835 net80211: sanitize input for ieee80211_output()
- Add some basic checks for i_fc* bits (ToDS, FromDS, MoreFrag, Protected);
those are used / checked across various places in Tx path.
- Mark injected 802.11 frame as encapsulated (just as it should be).
- Classify 802.11 frame in a proper way (extract ether_type from LLC header
for Data frames, use AC_BE queue for others (NoData / Management / Control).
- Subtract header length from tx_bytes statistics (so it will correspond
to the comment).

Was checked with RTL8188EU (AP) + Intel 6205 (STA).

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D13161
2017-12-30 00:40:34 +00:00
Andriy Voskoboinyk
f6b986459f net80211: handle VHT nodes in ieee80211_node_setuptxparms()
Select proper mode when node can do VHT.

Currently there are no drivers with VHT support in the tree,
so this should be noop.

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D9806
2017-12-30 00:24:53 +00:00
Eitan Adler
caa7e52f3f kernel: Fix several typos and minor errors
- duplicate words
- typos
- references to old versions of FreeBSD

Reviewed by:	imp, benno
2017-12-27 03:23:21 +00:00
Adrian Chadd
0c6960361b [net80211] add a method for checking if a VAP WME AC has a NOACK policy or not.
A subsequent set of commits will introduce this instead of a whole lot of
gymnastics to check the WME category.
2017-12-09 23:16:02 +00:00
Pedro F. Giffuni
fe267a5590 sys: general adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

No functional change intended.
2017-11-27 15:23:17 +00:00
Adrian Chadd
79caf56e97 [net80211] don't try to follow a NULL rxs pointer down the sink.
It's smelly, and we already checked earlier whether we needed to.
2017-10-13 06:49:07 +00:00
Adrian Chadd
48f95a360e [net80211] begin handling multiple hardware decap'ed A-MSDU in the RX path.
The duplicate detection code currently expects A-MSDU frames to be encaped -
they're decap'ed /after/ duplicate detection.

However for ath10k (and iwm hardware later on) the firmware supports
doing A-MSDU decap in hardware - which shows up as multiple frames with
the same sequence number and IV.

This is the first part of decap handling - if we see a stretch of A-MSDU
frames from the driver with the MORE bit set, then don't treat them
as duplicates.

This isn't 100% complete as crypto sequence number handling and "A-MSDU in
A-MPDU" needs handling, but it's a start.

This should be a glorified no-op for everyone.  Please tell me if it isn't.
2017-10-12 21:56:58 +00:00
Andriy Voskoboinyk
191ccdf545 net80211: fix a typo (premable -> preamble). 2017-08-27 22:13:03 +00:00
Pedro F. Giffuni
d2ffc7af30 sys/net8021: Add missing braces in setcurchan().
Obtained from:	DragonFlyBSD (git c69e37d6)
MFC after:	3 days
2017-08-01 03:13:43 +00:00
Andriy Voskoboinyk
810490a0e2 net80211: do not allow to unload rate control module if it is still in use.
Keep 'nrefs' counter up-to-date, so 'kldunload wlan_amrr' with 1+ active
wlan(4) interface will not lead to kernel panic.

MFC after:	5 days
2017-07-23 22:38:00 +00:00
Andriy Voskoboinyk
2db223f902 net80211: initialize i_seq for A-MPDU frames.
Fragment number field (part of i_seq) is used for AAD calculation;
as a result, without this patch every driver without h/w crypto support
need to clear it before ieee80211_crypto_encap().

Also fixes rtwn(4) A-MPDU Tx with dev.rtwn.%d.hwcrypto tunable
set to 0 (h/w crypto is disabled).

Tested with:
 * Intel 6205, STA mode.
 * RTL8188EU, STA mode.

Differential Revision:	https://reviews.freebsd.org/D10753
2017-06-01 20:46:43 +00:00
Adrian Chadd
85c4e67075 [net80211] prepare for A-MSDU/A-MPDU offload crypto / sequence number checking.
When doing AMSDU offload, the driver (for now!) presents 802.11 frames with
the same sequence number and crypto sequence number / IV values up to the stack.
But, this will trip afoul over the sequence number detection.

So drivers now have a way to signify that a frame is part of an offloaded
AMSDU group, so we can just ensure that we pass those frames up to the
stack.

The logic will be a bit messy - the TL;DR will be that if it's part of
the previously seen sequence number then it belongs in the same burst.
But if we get a repeat of the same sequence number (eg we sent an ACK
but the receiver didn't hear it) then we shouldn't be passing those frames
up.  So, we can't just say "all subframes go up", we need to track
whether we've seen the end of a burst of frames for the given sequence
number or not, so we know whether to actually pass them up or not.

The first part of doing all of this is to ensure the ieee80211_rx_stats
struct is available in the RX sequence number check path and the
RX ampdu reorder path.  So, start by passing the pointer into these
functions to avoid doing another lookup.

The actual support will come in a subsequent commit once I know the
functionality actually works!
2017-05-20 00:43:52 +00:00
Adrian Chadd
f56f89c7a4 [net80211] initial VHT radiotap implementation defines from upstream radiotap. 2017-05-17 19:34:36 +00:00
Adrian Chadd
d03baf3578 [net80211] add methods to fetch the global and per-VAP WME parameters.
For now there isn't any per-VAP WME state.  The eventual aim is to migrate
the driver direct use of WME parameters over to use these methods as
appropriate (global for most devices, per-VAP for firmware NICs that support
it) in preparation for actual per-VAP WME (and other thing) state change
support.
2017-04-22 02:12:07 +00:00
Adrian Chadd
82bd08ee81 [net80211] refactor out "add slot" and "purge slot" for A-MPDU.
This is in preparation for A-MSDU decap in A-MPDU support.

* refactor out the code to purge a single reorder slot into ampdu_rx_purge_slot().
* refactor out the code to add a frame to the given reorder slot
  to ampdu_rx_add_slot().

This should be a big no-op as far as current code is concerned.

Tested:

* QCA9880v2, STA mode (11ac)
* iwn(4), STA mode (11n)

Reviewed by:	avos
Differential Revision:	https://reviews.freebsd.org/D10328
2017-04-11 07:05:55 +00:00
Adrian Chadd
2d6ab41dcd [net80211] refactor out the A-MPDU dispatch routine.
The "dispatch a frame from the A-MPDU reorder buffer" code is essentially
duplicated in a couple of places.  This refactors it out into a single
place in preparation for A-MSDU in A-MPDU offload support, where multiple
A-MSDUs are decap'ed in hardware to 802.3/802.11 frames, but with the
same sequence number.

Reviewed by:	avos
Differential Revision:	https://reviews.freebsd.org/D10240
2017-04-06 01:35:42 +00:00
Adrian Chadd
b06dfd5843 [net80211] refactor the A-MPDU RX window code
The RX window update code is effectively the same in both locations.

Reviewed by:	avos
Differential Revision:	https://reviews.freebsd.org/D10208
2017-04-02 20:59:12 +00:00
Andriy Voskoboinyk
e2db307ebc net80211: fix possible panic when wlan(4) interface is destroyed.
If this is the last running vap wait until device will be powered off
(fixes panic when 'ifconfig wlan0 destroy' is executed for running iwn(4)
interface).

Tested with:
 - Intel 6205, STA mode.
 - RTL8188EU, STA / IBSS modes.
 - RTL8821AU, STA / HOSTAP modes.
2017-03-24 22:29:51 +00:00
Andriy Voskoboinyk
dc33c66d2b net80211: reschedule tasks properly after r315594. 2017-03-19 23:05:03 +00:00
Andriy Voskoboinyk
e79ef94927 net80211: do not cancel callout when FF queue is empty.
This should reduce overhead for aggregates (since every second frame
clears the queue and reschedules the task there is no need to cancel
the callout here; let it just run once at the end - even if queue is
empty).

Reported by:	adrian
2017-03-19 22:18:44 +00:00
Andriy Voskoboinyk
abb0adffde net80211: add a timer to flush fast-frames queues.
This should allow to drop 'ieee80211_ff_[age/flush]' calls from drivers
(an additional call can be made from ieee80211_tx_complete()
for non-default ieee80211_ffagemax values to prevent stalls -
but it will require an additional counter for transmitted frames).

Tested with RTL8821AU, STA mode (A-MSDU part only).

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D9984
2017-03-19 20:05:21 +00:00
Adrian Chadd
e3e94c963e [net80211] begin fleshing out per-VAP WME configurations.
As part of (eventual) p2p/tdls/multi-STA support, a lot of global configuration
parameters (WME, ERP (slot, preamble), channel width, HT protmode, etc are the
biggest offenders) should be per-VAP.

For multi-BSS VAP operation they may be linked, but for p2p/TDLS
operation that can be off-channel they can definitely be different
(think: 2GHz STA, 5GHz p2p.)

The global configuration view of these is mostly a "configure the current
non-smart-firmware NIC" view.  This should be split up into per-VAP state,
then a global non-smart-firmware-NIC management layer to handle channel
changes and such in software.

This is step one in a loooong road for this.  It should be a big non-functional
change for everyone.

* create a per-VAP WME update call.
* call it if its set, and call the global callback if it isn't

This still uses global WME state - it's just preparation for a future change
which will make the WME state per-VAP and fall through to a shared WME
configuration for hostap operation.

Note: this requires a full kernel recompile; the internal net80211 ABI has changed.

Reviewed by:	avos
Differential Revision:	https://reviews.freebsd.org/D9986
2017-03-13 16:44:06 +00:00
Andriy Voskoboinyk
dfabbaa0e0 net80211: fix ieee80211_htrateset setup, return EINVAL for an unsupported
ucast/mcast/mgmt HT rate.

- Init global ieee80211_htrateset only once; neither ic_htcaps nor
ic_txstream is changed when device is attached;
- Move global ieee80211_htrateset structure to ieee80211com;
there was a possible data race when more than 1 wireless device is
used simultaneously;
- Discard unsupported rates in ieee80211_ioctl_settxparams(); otherwise,
an unsupported value may break connectivity (actually,
'ifconfig wlan0 ucastrate 8' for RTL8188EU results in immediate
disconnect + infinite 'device timeout's after it).

Tested with:
 - Intel 6205, STA mode.
 - RTL8821AU, STA mode.

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D9871
2017-03-03 01:06:27 +00:00
Adrian Chadd
46788bb1d2 [net80211] validate VHT IEs. 2017-02-20 04:04:59 +00:00
Adrian Chadd
ac0b7d3206 [net80211] teach the probe response routine to add VHT IEs as appropriate. 2017-02-20 04:02:50 +00:00
Adrian Chadd
7f19273c7c [net80211] fix up VHT IE comparison typo
Whilst here, add a comment that I need to validate VHT IEs.
2017-02-20 04:02:29 +00:00
Adrian Chadd
2023566223 [net80211] fix NULL pointer dereference in VHT operation in hostap mode.
The vht IEs are NULL at this point, so we shouldn't upgrade a node to VHT.
I'll fix the upgrade after this!

Tested:

* ath10k, hostap mode
2017-02-20 03:45:41 +00:00
Adrian Chadd
617f8b101e [net80211] RX parameter shuffle in net80211 in preparation for 4x4 NICs and 160MHz channels.
* Migrate the rx_params stuff out from ieee80211_freebsd.h where it doesn't belong -
  this isn't freebsd specific anymore.

* Don't use a hard-coded number of chains in the ioctl header; now we can shuffle
  MAX_CHAINS around so it can be used in the right spot.

* Extend the signal/noisefloor levels in the mimo stats struct to userland to include
  the signal and noisefloor levels for each 20MHz slice of a 160MHz channel.

* Bump the number of EVM pilots in preparation for 4x4 and 160MHz channels.

Tested:

* ath(4), STA mode
* iwn(4), STA mode
* local ath10k port, STA mode

TODO:

* 11ax chips will come with 5GHz 8x8 hardware for lots of MU-MIMO - I'll re-bump it
  at that point.

Note:

* This breaks the driver and ifconfig ABI; please recompile  the kernel,
  ifconfig and wpa_supplicant/hostapd.
2017-02-20 02:08:08 +00:00
Adrian Chadd
07569d5533 [net80211] add a sysctl that forces a vap restart.
Well, vap restart really does "all restart" for now, which will be a good
way of debugging firmware restart issues.
2017-02-11 05:33:49 +00:00
Adrian Chadd
43eafd0d1e [net80211] don't bother doing fragmentation if the driver supports fragmentation offload.
Tested:

* ath10k, which does its own fragmentation in firmware.
2017-02-09 23:29:57 +00:00
Adrian Chadd
4d3dcce5bb [net80211] quiet IE handling improvements
* on the station side, only call the quiet time IE method if we have a
  quiet IE - otherwise call the NULL method once, and then don't waste
  time calling NULL

* on the beacon generation side - force a beacon regeneration each time
  quiet time is enabled/disabled.  Without this, enabling/disabling quiet
  time IE would cause the beacon contents to be corrupted since none of
  the "move contents around" logic (like for CSA and TIM handling) is implemented.

This changes the size of ieee80211_node so it requires a kernel recompile,
but no userland recompile.

Tested:

* AR9380, AP mode, enabling/disabling quiet time IE
* AR9380, STA mode, with upcoming driver changes.
2017-02-09 04:07:30 +00:00
Adrian Chadd
ce4552cd1a [net80211] don't update quiet time counter values every probe request.
The quiet time counter update is happening each time the IE is added,
which also means it happens for each quiet time IE addition to the probe
response.

Only update the countdown if we request ie (ie, beacon updates.)
2017-02-03 06:04:06 +00:00
Andriy Voskoboinyk
704cd54206 net80211: cleanup ic_flags / iv_flags
Flags
 - IEEE80211_F_ASCAN
 - IEEE80211_F_SIBSS
 - IEEE80211_F_IBSSON
are not used since r170530 (old WI compatibility ioctls removal)
and r178354 (removed from other places).

IEEE80211_F_TXPOW_FIXED was never utilized; initially added with
IEEE80211_F_TXPOW_AUTO / IEEE80211_F_TXPOW_OFF flags,
which were replaced with IEEE80211_C_TXPMGT capability check in r138568.

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D9369
2017-01-31 22:21:08 +00:00
Adrian Chadd
9764ef21c4 [net80211] address seqno allocation for group addressed frames
After some digging and looking at packet traces, it looks like the
sequence number allocation being done by net80211 doesn't meet
802.11-2012.

Specifically, group addressed frames (broadcast, multicast) have
sequence numbers allocated from a separate pool, even if they're
QoS frames.

This patch starts to try and address this, both on transmit and
receive.

* When receiving, don't throw away multicast frames for now.
  It's sub-optimal, but until we correctly track group addressed
  frames via another TID counter, this is the best we can do.

* When doing A-MPDU checks, don't include group addressed frames
  in the sequence number checks.

* When transmitting, don't allocate group frame sequence numbers
  from the TID, instead use the NONQOS TID for allocation.

This may fix iwn(4) 11n because I /think/ this was one of the
handful of places where ni_txseqs[] was being assigned /outside/
of the driver itself.

This however doesn't completely fix things - notably the way that
TID assignment versus WME assignment for driver hardware queues
will mess up multicast ordering. For example, if all multicast
QoS frames come from one sequence number space but they're
expected to obey the QoS value assigned, they'll end up in
different queues in the hardware and go out in different
orders.

I can't fix that right now and indeed fixing it will require some
pretty heavy lifting of both the WME<->TID QoS assignment, as well
as figuring out what the correct way for drivers to behave.

For example, both iwn(4) and ath(4) shouldn't put QoS multicast
traffic into the same output queue as aggregate traffic, because
the sequence numbers are all wrong. So perhaps the correct thing
to do there is ignore the WME/TID for QoS traffic and map it all
to the best effort queue or something, and ensure it doesn't
muck up the TID/blockack window tracking. However, I'm /pretty/
sure that is still going to happen.

.. maybe I should disable multicast QoS frames in general as well,
but I don't know what that'll do for whatever the current state
of 802.11s mesh support is.

Tested:

* STA mode, ath10k NIC
* AP mode, AR9344/AR9580 AP
* iperf tcp/udp tests with concurrent multicast QoS traffic.

Before this, iperfs would fail pretty quickly because the sending
AP would start sending out QoS multicast frames that would be
out of order from the rest of the TID traffic, causing the blockack
window to get way, way out of sync.

This now doesn't occur.

TODO:

* verify which QoS frames SHOULD be tagged as M_AMPDU_MPDU.
  For example, QoS NULL frames shouldn't be tagged!

Reviewed by: avos
Differential Revision: https://reviews.freebsd.org/D9357
2017-01-30 01:11:30 +00:00
Adrian Chadd
f551fe4637 [net80211] prepare configuration checks for VHT, fragment-offload and seqno-offload.
* allocate an ext bit for fragment offload.  Some NICs (like the ath10k
  hardware in native wifi or 802.3 mode) support doing packet fragmentation
  in firmware/hardware, so we don't have to do it here.

* allocate an ext bit for VHT and start using it.
2017-01-27 01:24:24 +00:00
Andriy Voskoboinyk
98ff1f7c6e net80211: fix flags setup for HT40 5GHz channels. 2017-01-22 23:45:59 +00:00
Andriy Voskoboinyk
c5bba9da5a net80211: allow to configure LDPC support
Tested with RTL8821AU, STA mode (Tx support only)

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D9268
2017-01-21 14:19:06 +00:00
Adrian Chadd
a2c31ee05e [net80211] allow for MCS16-23 to be statically configured.
Tested:

* AR9380, STA mode
2017-01-20 07:43:40 +00:00
Adrian Chadd
e0812c1468 [net80211] add some more "is this XXX" macros for CTRL and DATA.
There's already a macro for MGT.
2017-01-15 19:49:47 +00:00
Adrian Chadd
da6ee937ae [net80211] add a macro to check this configuration option. 2017-01-13 07:24:58 +00:00
Adrian Chadd
321eb9ffbe [net80211] begin laying the groundwork for drivers to do their own sequence number management.
I added IEEE80211_TX_LOCK() a few years ago because there were races between
seqno allocation, driver queuing and crypto IV allocation.  This meant that
they'd appear out of sequence and the receiver would drop them, leading to
terrible performance or flat out traffic hangs.

This flag should be set by drivers that do their own sequence number
allocation for all frames it needs to happen for, including beacon frames.

Eventually this should lead to the driver taking care of locking for
allocating seqno and other traffic-triggered events (eg addba setup.)
2017-01-13 07:08:14 +00:00
Adrian Chadd
51172f62a7 [net80211] Initial VHT node upgrade/downgrade support and initial IE parsing.
This is the bulk of the magic to start enabling VHT channel negotiation.
It is absolutely, positively not yet even a complete VHT wave-1 implementation.

* parse IEs in scan, assoc req/resp, probe req/resp;
* break apart the channel upgrade from the HT IE parsing - do it after the
  VHT IEs are parsed;
* (dirty! sigh) add channel width decision making in ieee80211_ht.c htinfo_update_chw().
  This is the main bit where negotiated channel promotion through IEs occur.
* Shoehorn in VHT node init ,teardown, rate control, etc calls like the HT
  versions;
* Do VHT channel adjustment where appropriate

Tested:

* monitor mode, ath10k port
* STA mode, ath10k port - VHT20, VHT40, VHT80 modes

TODO:

* IBSS;
* hostap;
* (ignore mesh, wds for now);
* finish 11n state engine - channel width change, opmode notifications, SMPS, etc;
* VHT basic rate negotiation and acceptance criteria when scanning, associating, etc;
* VHT control/management frame handling (group managment and operating mode being
  the two big ones);
* Verify TX/RX VHT rate negotiation is actually working correctly.

Whilst here, add some comments about seqno allocation and locking.  To achieve
the full VHT rates I need to push seqno allocation into the drivers and
finally remove the IEEE80211_TX_LOCK() I added years ago to fix issues. :/
2017-01-13 07:02:04 +00:00
Adrian Chadd
67f4aa3878 [net80211] initial, somewhat incomplete VHT channel setup code and attach path.
This sets up:

* vht capabilities in vaps;
* calls vht_announce to announce VHT capabilities if any;
* sets up vht20, vht40 and vht80 channels, assuming the regulatory code
  does the right thing with 80MHz available ranges;
* adds support to the ieee80211_add_channel_list_5ghz() code to populate
  VHT channels, as this is the API my ath10k driver is using;
* add support for the freq1/freq2 field population and lookup that
  VHT channels require.

The VHT80 code assumes that the regulatory domain already has limited VHT80
bands to, well, 80MHz wide chunks.
2017-01-13 06:53:56 +00:00