Make qwx(4) offload TKIP and CCMP crypto to hardware.

This reduces CPU load during interrupts, but more importantly works
around an apparent firmware bug where incoming encrypted broadcast
and multi

Make qwx(4) offload TKIP and CCMP crypto to hardware.

This reduces CPU load during interrupts, but more importantly works
around an apparent firmware bug where incoming encrypted broadcast
and multicast frames are dropped by firmware if the hardware crypto
engine is unused. (This problem also affects Linux ath11k upstream.)
Offloading CCMP to hardware hence fixes ARP and IPv6 multicast with WPA2.

However, there are known issues with WPA1 and WEP:

While the WPA1 pairwise handshake succeeds, the TKIP group key handshake
fails for unknown reasons, resulting in association failure.

WEP is broken because software crypto is skipped entirely when the driver
uses the "native wifi" frame mode. This results in all packets being sent
in plaintext while WEP is active. In the future, we should be able to fix
this by offloading WEP to hardware as well, or by setting the frame mode
back to "raw" if WEP is used.

If the TKIP/WEP issues affect you badly then take this as an opportunity
to upgrade the access point to WPA2/AES where possible.

Tested by kettenis, kevlo, and myself.
ok kevlo@

show more ...

remove prototypes with no matching function
ok mpi@

implement qwx(4) monitor status ring polling

On QCNFA765 the monitor status ring does not trigger any interrupts.
Unless the driver keeps polling this ring from a timer the device
will eventually lo

implement qwx(4) monitor status ring polling

On QCNFA765 the monitor status ring does not trigger any interrupts.
Unless the driver keeps polling this ring from a timer the device
will eventually lock up if this ring is enabled.

Even though we're not using this ring yet, add the tiny bits of code
required to poll it so that the next person who enables this code
won't have to waste time figuring out why the device stops working.

The monitor status ring provides details about received frames in special
TLV-format packets which the driver can parse and update statistics with.
Interesting info includes per-frame RSSI. Which we already learn from
beacons, so we don't need to enable an entire extra ring just for that.

Another reason to keep this disabled is that it triggers mbuf corruption
for reasons I haven't been able to figure out. Help welcome.

show more ...

qwx(4): qwx_dp_rx_tid_del_func: fix dp_reo_cache_flush_elem expiration logic

Tweak a few things in qwx_dp_rx_tid_del_func() to make it behave
correctly on OpenBSD:

- struct dp_reo_cache_flush_elem:

qwx(4): qwx_dp_rx_tid_del_func: fix dp_reo_cache_flush_elem expiration logic

Tweak a few things in qwx_dp_rx_tid_del_func() to make it behave
correctly on OpenBSD:

- struct dp_reo_cache_flush_elem: make ts a 64-bit count of nanoseconds

Linux uses jiffies to timestamp dp_reo_cache_flush_elem. Although
OpenBSD has a global jiffies variable, we shouldn't use it outside
of drm(4). I would rather not use our global ticks variable, either.
We can use getnsecuptime(9), a low-res 64-bit nanosecond timestamp,
as a substitute.

- qwx_dp_rx_tid_del_func: replace gettime(9) with getnsecuptime(9)

- qwx_dp_rx_tid_del_func: convert DP_REO_DESC_FREE_TIMEOUT_MS to nanoseconds

- qwx_dp_rx_tid_del_func: reverse timestamp comparison operator

This comparison is backwards. Linux uses the time_after() macro to
test whether a given entry has expired, so our ported code needs to
test whether the current uptime is greater than or equal to a given
entry's expiration time.

Joint effort with stsp@. Tested by stsp@.

ok stsp@

show more ...

cache qwx(4) firmware images in memory across suspend/resume cycles

testing + ok phessler@

add suspend/resume support to qwx(4)

testing + ok phessler@ deraadt@

prevent memory leaks from duplicate/spurious qwx(4) fw memory requests

The request_mem_indication event handler would always allocate a new
buffer to store the firmware's request, potentially leakin

prevent memory leaks from duplicate/spurious qwx(4) fw memory requests

The request_mem_indication event handler would always allocate a new
buffer to store the firmware's request, potentially leaking an already
existing copy. Ensure that this buffer is always freed, and avoid
allocating it in the first place if we're not currently expecting this
event to occur.
All this would have surfaced the previously fixed bug with the missing
wakeup much earlier. The wakeup was always missed but when the driver
retried it would find the stale buffer from the previous event and not
even enter tsleep.

show more ...

fix datapath Rx buffer management in qwx(4)

Fixes Tx/Rx stalls where the device ran out of free Rx buffers to use.

The device consumes buffers on the Rx refill ring out of order, which
the ring man

fix datapath Rx buffer management in qwx(4)

Fixes Tx/Rx stalls where the device ran out of free Rx buffers to use.

The device consumes buffers on the Rx refill ring out of order, which
the ring management code I wrote intially would not handle properly.
Instead of using an index into the ring where we would expect to see
a free slot which was in fact occupied, keep track of free buffers via
a bitmap.

show more ...

implement qwx_dp_rx_process_wbm_err()

implement qwx_dp_process_reo_status()

Struct layout of qwx_softc should not depend on NBPFILTER.

Due to a missing #include "bpfilter.h", the size of struct qwx_softc
varied in different object files. This made the kernel crash on
arm64

Struct layout of qwx_softc should not depend on NBPFILTER.

Due to a missing #include "bpfilter.h", the size of struct qwx_softc
varied in different object files. This made the kernel crash on
arm64. To make debugging core dumps and libkvm easier, kernel
object layout should not depend on kernel config. Remove #if
NBPFILTER > 0 from struct definition.

problem analysis kettenis@
OK deraadt@ stsp@

show more ...

add missing node reference counting to qwx's Tx completion path

implement qwx_dp_tx_process_htt_tx_complete()

mark full qwx(4) Tx queues, such that the OACTIVE mechanism will be used

Not quite tested yet. It is very hard to fill the queues at present
because Tx operation will freeze when we try. To be inves

mark full qwx(4) Tx queues, such that the OACTIVE mechanism will be used

Not quite tested yet. It is very hard to fill the queues at present
because Tx operation will freeze when we try. To be investigated next.

show more ...

implement basic bpf(4) support for qwx(4)

This is sufficient to capture 802.11 frames with tcpdump -y IEEE802_11_RADIO.
Meta-data such as RSSI and channel number is not yet recorded.

Try to fetch the board variant from the device tree on platforms that have
one (e.g. on arm64). Needed to extract the right information from the
qwx(4) firmware on the x13s.

ok stsp@

implement qwx_tx()

This gets the 4-way handshake working. Unfortunately, no traffic is
passing yet, apparently because of CCMP decryption errors in Rx.

Implement basics of the qwx(4) data frame Rx path.

Port enough ath11k dp_rx code in order to let our net80211 stack
see the initial WPA handshake packet sent by the AP.

set up qwx REO ring routing

handle qwx(4) association state transitions from ASSOC to RUN

We can succesfully complete the association sequence with the AP.
The next step will be getting data frames to pass.

add support for sending management frames to qwx(4)

The initial AUTH frame is now sent when an AP is found during scans.
We then receive an AUTH response from the AP. Handling this response
in the d

add support for sending management frames to qwx(4)

The initial AUTH frame is now sent when an AP is found during scans.
We then receive an AUTH response from the AP. Handling this response
in the driver will be our next step.

show more ...

Make qwx(4) avoid sub-directories in firmware paths.

implement qwx_auth() which moves the device from SCAN into AUTH state

Port code from Linux to provide access point info to firmware and to
start up the firmware's virtual interface in station mode.

implement qwx_auth() which moves the device from SCAN into AUTH state

Port code from Linux to provide access point info to firmware and to
start up the firmware's virtual interface in station mode.
Sending frames does not work yet so we cannot actually connect anywhere.

show more ...

Port over some ath11k code to handle the qwx(4) monitor status ring.

These changes are incomplete. More work will be required to get this
ring working if it turns out to be needed. Hopefully it will

Port over some ath11k code to handle the qwx(4) monitor status ring.

These changes are incomplete. More work will be required to get this
ring working if it turns out to be needed. Hopefully it will only be
required for monitor mode.

show more ...

Use multi-vector MSI interrupts in qwx(4).

With only one vector enabled we need to manually check various rings
to see why an interrupt triggered. This makes debugging difficult at
this early stage

Use multi-vector MSI interrupts in qwx(4).

With only one vector enabled we need to manually check various rings
to see why an interrupt triggered. This makes debugging difficult at
this early stage of development, so use multiple vectors if possible,
as the Linux driver was designed to do.
The intention is to keep single-vector mode working as well but for
now this mode will lack testing by myself.

Thanks to kettenis@ for adding the required MSI/PCI code on amd64.

show more ...