Linux 802.11 subsystem and brcmsmac WLAN driver
- 1. Broadcom Wifi Driver Midhun Lohidakshan
- 2. Today’s Topics ● Brief about 802.11 standard. ● MAC layer frames ● MLME ● SoftMAC and HardMAC ● Broadcom bcm43xx chipsets ● Tx path and Rx path of brcmsmac driver ● Mac80211 debugfs ● Live demonstration
- 3. 802.11 Wireless Standard ● Created in 1997 ● Targeted to standardise PHY and MAC layers which are two lowest OSI layers. ● Initially for the PHY layer, 2 frequency bands were chosen : Infra Red ( IR ) band and Microwave Band ( 2.4 GHz ) ● 802.11a standard brought 5GHz frequency.
- 5. The 802.11 MAC Header Frame Control
- 6. MAC layer frames MAC layer uses 3 types of frames ● Management ● Data ● Control
- 7. Management Frames 1. Association Request - Association Response 2. Reassociation Request - Reassociation Response 3. Probe Request - Probe Response 4. Beacon 5. ATIM 6. Disassociation 7. Authentication - Deauthentication 8. Action
- 8. Control Frames 1. Power Save ( PS - Poll ) 2. RTS 3. CTS 4. Acknowledgement 5. Contention Free 6. CF-End + CF-Ack
- 9. Data Frames 1. Data 2. Data + CF-ACK 3. Data + CF-Poll 4. Data + CF-ACK + CF-Poll 5. Null Data 6. CF-Ack 7. CF-Poll 8. Data + CF-Ack + CF-Poll
- 10. MAC subLayer Management Entity ( MLME ) ● MLME is the management entity where the Physical layer ( PHY ) MAC state machine resides. ● Based on the location of the core that processes MLME, 2 types MAC layer implementations are available - SoftMAC and FullMAC ( HardMAC ) ● Soft MAC ○ MLME is running in the Linux Kernel Module ( LKM ) ○ Mac80211 is a driver API for SoftMAC WNIC ● Full MAC ( Hard MAC ) ○ MLME is managed in hardware. ○ We will not use mac80211 to write FullMAC wireless driver.
- 11. SoftMAC vs HardMAC HardMAC/FullMAC devices SoftMAC devices Proprietary Implementations Lower Hardware Cost Less CPU load Possibility to upgrade to newer standards by updating the driver only. Better power consumption and performance. Hence used in smartphones Possibility to correct faults in the MAC implementation. No monitor mode Different drivers for different WNIC can all share the same MAC implementation
- 12. Broadcom bcm43xxx chipset ● Bcm43xxx series have both HardMAC and SoftMAC cards. ● Some chips are integrated both WLAN and Bluetooth functionalities. ○ Eg - bcm4339, bcm4330 ● Main MCU of the chipset is ARM Cortex-M3/ ARM Cortex-R4
- 13. bcm43xxx Chip Components ● ARM Cortex ( M3 or R4 ) ● ROM ● RAM ● D11 Core ● 802.11 PHY ● 2.4 or 5 GHz radio
- 14. D11 Core ● Does all time critical operations Firmware ● Firmwares used by these chips are split into two parts. ● Read-only part is written into the ROM. ● Read-Write part is uploaded by the device driver to the chip’s RAM. ● RAM portion of the firmware can be updated when new features arrives.
- 15. Host Driver Interface ● USB ● SDIO ● PCIe Chip Model MAC Type MCU Bus Interface Driver Host Device bcm4339 FullMAC ARM Cortex R4 SDIO bcmdhd Nexus 5 bcm4330 FullMAC ARM Cortex M3 SDIO bcmdhd Samsung Galaxy Y bcm43430 FullMAC ARM Cortex M3 SDIO brcmfmac Raspberry PI 3B bcm4352 FullMAC ARM Cortex M3 PCIe wl Dell XPS laptop bcm43236 SoftMAC ARM Cortex R4 USB wl SFR mini decoder TV Interface details of bcm43xxx chipsets
- 16. Types of bcm43xxx device drivers No Device Driver OS MAC type Driver Source 1 b43 Linux SoftMAC OpenSource 2 brcmsmac Linux SoftMAC OpenSource 3 brcmfmac Linux FullMAC OpenSource 4 brcmdhd Android FullMAC OpenSource 5 broadcom-sta aka 'wl' Linux SoftMAC & FullMAC Proprietary
- 17. WiFi Stack on Linux
- 18. Data Path and Control Path in Wireless Subsystem
- 20. Tx Path : Kernel -> mac80211 -> brcmsmac
- 22. Mac80211 Debugfs ● Debugfs is a technique that enables exporting debugging information to the userspace. ● It creates entries under the sysfs filesystem. ● For mac80211 , debugfs implemented at net/mac80211/debugfs.c ● After mounting debugfs, various mac80211 statistics and information entries can be visualised. ● Mounting debugfs is performed via below command ○ mount -t debugfs none_debugs /sys/kernel/debug ● If wireless phy of our system is phy0, then mac80211 debugfs can be seen at below location. ○ /sys/kernel/debug/ieee80211/phy0
- 24. 1. Output of below commands on Linux system a. sudo lshw -C network b. Iw list ( using netlink sockets ) i. Show supported modes ii. Show supported bands c. Iw dev ( using netlink sockets ) d. Iwconfig ( using ioctl ) e. watch -n1 "cat /proc/net/wireless" ( Quality of signals ) f. watch -n1 "cat /proc/net/dev" ( device statistics ) g. sudo watch -n1 "cat /sys/kernel/debug/ieee80211/phy0/iwlwifi/iwlmvm/nic_temp" (debugfs) 2. Linux Kernel Code for mac80211, brcmfmac and brcmsmac
- 25. Questions ?