QCA988X firmware crash when sending in monitor mode

QCA988X firmware crash when sending in monitor mode

[Ouri Lipner]

Hi all,
I’m consistently encountering issues with raw wifi packet injection.

Sending a raw packet in monitor mode keeps crashing the firmware.
This happens consistently with every firmware that supports raw mode.
Currently on kernel 4.9-rc2 but older drivers behave the same.
Is this an issues with a missing parameter (e.g. in RadioTap) or a real problem with the firmware?

Any ideas?
Thanks,

Ouri.

ath10k_pci 0000:02:00.0: firmware crashed! (uuid 9f67baa6-cd91-4a37-8e90-59455e349a30)
ath10k_pci 0000:02:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000
ath10k_pci 0000:02:00.0: kconfig debug 1 debugfs 1 tracing 1 dfs 0 testmode 0
ath10k_pci 0000:02:00.0: firmware ver 10.2.4.70.58 api 5 features no-p2p,raw-mode,mfp crc32 e1af076f
ath10k_pci 0000:02:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
ath10k_pci 0000:02:00.0: htt-ver 2.1 wmi-op 5 htt-op 2 cal otp max-sta 128 raw 1 hwcrypto 0
ath10k_pci 0000:02:00.0: firmware register dump:
ath10k_pci 0000:02:00.0: [00]: 0x4100016C 0x000015B3 0x0099D4B5 0x00955B31
ath10k_pci 0000:02:00.0: [04]: 0x0099D4B5 0x00060130 0x00000020 0x00400000
ath10k_pci 0000:02:00.0: [08]: 0x00420C28 0x00000149 0x00000000 0x0000001A
ath10k_pci 0000:02:00.0: [12]: 0x00000009 0x00000000 0x0095808C 0x009580A2
ath10k_pci 0000:02:00.0: [16]: 0x00958080 0x0094085D 0x00000000 0x00000000
ath10k_pci 0000:02:00.0: [20]: 0x4099D4B5 0x0040AC24 0x00000000 0x00413FA4
ath10k_pci 0000:02:00.0: [24]: 0x809B50A2 0x0040AC84 0x00000000 0xC099D4B5
ath10k_pci 0000:02:00.0: [28]: 0x809B30D2 0x0040AD44 0x00413F90 0x00955A00
ath10k_pci 0000:02:00.0: [32]: 0x809B3160 0x0040AD94 0x0040AE04 0x00400000
ath10k_pci 0000:02:00.0: [36]: 0x809B2862 0x0040ADC4 0x00000001 0x0040AE04
ath10k_pci 0000:02:00.0: [40]: 0x809C07D9 0x0040ADE4 0x00411FE0 0x00412004
ath10k_pci 0000:02:00.0: [44]: 0x809BFFDC 0x0040AE04 0x00000001 0x00000000
ath10k_pci 0000:02:00.0: [48]: 0x809BFDB3 0x0040AEA4 0x0041F8A8 0x00412640
ath10k_pci 0000:02:00.0: [52]: 0x809BFC39 0x0040AEC4 0x0041F8A8 0x00000001
ath10k_pci 0000:02:00.0: [56]: 0x80940F18 0x0040AF14 0x00000011 0x00403AD4



_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

Re: QCA988X firmware crash when sending in monitor mode

[Michal Kazior]

On 7 November 2016 at 15:22, Ouri Lipner <lipner@equus-tech.com> wrote:
> Hi all,
> I’m consistently encountering issues with raw wifi packet injection.
>
> Sending a raw packet in monitor mode keeps crashing the firmware.
> This happens consistently with every firmware that supports raw mode.
> Currently on kernel 4.9-rc2 but older drivers behave the same.
> Is this an issues with a missing parameter (e.g. in RadioTap) or a real problem with the firmware?

To the best of my knowledge firmware does not support frame injection
on monitor vdev. Therefore this is expected. Moreover this limitation
is mentioned on ath10k wiki:
https://wireless.wiki.kernel.org/en/users/drivers/ath10k


> Any ideas?

You could probably hack up the driver to create and use AP or STA vdev
alongside monitor vdev to use it's vdev_id for frame injection. I'm
not aware of anyone trying that out so far though.


Michał

_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

Re: QCA988X firmware crash when sending in monitor mode

[Ben Greear]

On 11/07/2016 03:03 PM, Michal Kazior wrote:
> On 7 November 2016 at 15:22, Ouri Lipner <lipner@equus-tech.com> wrote:
>> Hi all,
>> I’m consistently encountering issues with raw wifi packet injection.
>>
>> Sending a raw packet in monitor mode keeps crashing the firmware.
>> This happens consistently with every firmware that supports raw mode.
>> Currently on kernel 4.9-rc2 but older drivers behave the same.
>> Is this an issues with a missing parameter (e.g. in RadioTap) or a real problem with the firmware?
>
> To the best of my knowledge firmware does not support frame injection
> on monitor vdev. Therefore this is expected. Moreover this limitation
> is mentioned on ath10k wiki:
> https://wireless.wiki.kernel.org/en/users/drivers/ath10k
>
>
>> Any ideas?
>
> You could probably hack up the driver to create and use AP or STA vdev
> alongside monitor vdev to use it's vdev_id for frame injection. I'm
> not aware of anyone trying that out so far though.

I had this sort of half-arsed working at one point, but it was very limitted
and could only send legacy rate frames.

Ouri:  What are your goals for sending raw frames?

Thanks,
Ben


-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com


_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

Re: QCA988X firmware crash when sending in monitor mode

[Ouri Lipner]

I’m aware of what the wiki says, but was under the impression this is outdated.
Recent firmware files have a raw mode capability, and there is also code in the driver to handle it.

Adding an AP alongside the monitor vdev is an interesting idea, thanks.
I’ll have to disable beacon send etc...

On 08/11/2016, 01:03, "Michal Kazior" <michal.kazior@tieto.com> wrote:

    On 7 November 2016 at 15:22, Ouri Lipner <lipner@equus-tech.com> wrote:
    > Hi all,
    > I’m consistently encountering issues with raw wifi packet injection.
    >
    > Sending a raw packet in monitor mode keeps crashing the firmware.
    > This happens consistently with every firmware that supports raw mode.
    > Currently on kernel 4.9-rc2 but older drivers behave the same.
    > Is this an issues with a missing parameter (e.g. in RadioTap) or a real problem with the firmware?
    
    To the best of my knowledge firmware does not support frame injection
    on monitor vdev. Therefore this is expected. Moreover this limitation
    is mentioned on ath10k wiki:
    https://wireless.wiki.kernel.org/en/users/drivers/ath10k
    
    
    > Any ideas?
    
    You could probably hack up the driver to create and use AP or STA vdev
    alongside monitor vdev to use it's vdev_id for frame injection. I'm
    not aware of anyone trying that out so far though.
    
    
    Michał
    

_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k