add missed calls to bpf_peers_present

Fix the following bpf(4) race condition which can result in a panic:

(1) bpf peer attaches to interface netif0
(2) Packet is received by netif0
(3) ifp->if_bpf pointer is checked and handed off t

Fix the following bpf(4) race condition which can result in a panic:

(1) bpf peer attaches to interface netif0
(2) Packet is received by netif0
(3) ifp->if_bpf pointer is checked and handed off to bpf
(4) bpf peer detaches from netif0 resulting in ifp->if_bpf being
initialized to NULL.
(5) ifp->if_bpf is dereferenced by bpf machinery
(6) Kaboom

This race condition likely explains the various different kernel panics
reported around sending SIGINT to tcpdump or dhclient processes. But really
this race can result in kernel panics anywhere you have frequent bpf attach
and detach operations with high packet per second load.

Summary of changes:

- Remove the bpf interface's "driverp" member
- When we attach bpf interfaces, we now set the ifp->if_bpf member to the
bpf interface structure. Once this is done, ifp->if_bpf should never be
NULL. [1]
- Introduce bpf_peers_present function, an inline operation which will do
a lockless read bpf peer list associated with the interface. It should
be noted that the bpf code will pickup the bpf_interface lock before adding
or removing bpf peers. This should serialize the access to the bpf descriptor
list, removing the race.
- Expose the bpf_if structure in bpf.h so that the bpf_peers_present function
can use it. This also removes the struct bpf_if; hack that was there.
- Adjust all consumers of the raw if_bpf structure to use bpf_peers_present

Now what happens is:

(1) Packet is received by netif0
(2) Check to see if bpf descriptor list is empty
(3) Pickup the bpf interface lock
(4) Hand packet off to process

From the attach/detach side:

(1) Pickup the bpf interface lock
(2) Add/remove from bpf descriptor list

Now that we are storing the bpf interface structure with the ifnet, there is
is no need to walk the bpf interface list to locate the correct bpf interface.
We now simply look up the interface, and initialize the pointer. This has a
nice side effect of changing a bpf interface attach operation from O(N) (where
N is the number of bpf interfaces), to O(1).

[1] From now on, we can no longer check ifp->if_bpf to tell us whether or
not we have any bpf peers that might be interested in receiving packets.

In collaboration with: sam@
MFC after: 1 month

show more ...

Since DELAY() was moved, most <machine/clock.h> #includes have been
unnecessary.

MFp4: reworked iwi-driver

Changelog towards if_iwi.c 1.26 (some changes have been committed separately
in the mean time):

- add led support
- add firmware loading on demand
- auto-restart firmware

MFp4: reworked iwi-driver

Changelog towards if_iwi.c 1.26 (some changes have been committed separately
in the mean time):

- add led support
- add firmware loading on demand
- auto-restart firmware when it crashes
- serialize operations sent to the firmware to reduce firmware crashes
- add power save operation support
- remove incorrect specification of tx power control capability
- add radio on/off switch support

- improve net80211 state machine operation
- recognize and handle beacon miss
- handle authentication and association failures better
- add shared key authentication
- fix ibss mode (many changes)
- fix wme (many changes)
- correct radiotap support (many changes)
- correct bus dma setup of s/g
- correct various locking issues
- fix monitor mode
- fix scanning (many changes)
- recover from wedged scan requests
- respect active channel list
- eliminate cases where interface was marked down on error
- don't treat parity errors as fatal
- reclaim mgt frames immediately from tx queue
- correct interrupt handling, ack early (from NetBSD)
- fix short/long preamble handling

Committed with RELENG_6 compat #if's, should compile in RELENG_6. Requires
net/iwi-firmware-kmod to function.

Much work done by: sam
Tested by: many (freebsd-net), ume, luigi
MFC after: 4 weeks

show more ...

o don't use '-' characters in firmware names
o call firmware_put() early to release the firmware module
o on firmware panics or watchdog timeouts, schedule a task to reinitialize
the interface (we

o don't use '-' characters in firmware names
o call firmware_put() early to release the firmware module
o on firmware panics or watchdog timeouts, schedule a task to reinitialize
the interface (we may sleep in iwi_init())
o discard oversized rx frames

show more ...

add dependency with firmware module.
pointed out by Martin Wilke.

Fix build.

o acknowledge interrupts early in the interrupt handler
o stop processing interrupts after a firmware fatal error or a radio kill
o clarify the possible values for the 'antenna' sysctl.
o by default,

o acknowledge interrupts early in the interrupt handler
o stop processing interrupts after a firmware fatal error or a radio kill
o clarify the possible values for the 'antenna' sysctl.
o by default, let the firmware do antenna diversity.
the firmware will periodically switch to another antenna to evaluate the
signal quality.

show more ...

make use of the firmware(9) subsystem.
use intel's firmware version 3.0 layout.

fix the locking.

correct check for whether wpa is enabled

MFC after: 3 days

o Re-enable scatter/gather
o Change MEM_READ_1/MEM_READ_4 into macros (move them to if_iwireg.h)
o Add support for association LED
o Silently discard f/w notifications that are unknown (fixes spuriou

o Re-enable scatter/gather
o Change MEM_READ_1/MEM_READ_4 into macros (move them to if_iwireg.h)
o Add support for association LED
o Silently discard f/w notifications that are unknown (fixes spurious
"unknown notification 15" in logs with latest firmware)
o Fix scanning of 5GHz channels

show more ...

Don't use /etc/firmware. /etc is for configuration files only.
Use /boot to store firmware files instead.

Requested by: Daniel O'Connor, Scott Long

Fix compile on 64-bit platforms.

Load firmware images directly from the filesystem (looks into /etc/firmware
directory by default) without requiring the user to load them by hand using
e.g iwicontrol. Get rid of the old ioctl crud.

Load firmware images directly from the filesystem (looks into /etc/firmware
directory by default) without requiring the user to load them by hand using
e.g iwicontrol. Get rid of the old ioctl crud.
Updated iwi-firmware port coming soon.

Obtained from: OpenBSD

show more ...

Fix endianness issues. iwi now works on big endian architectures too.

Obtained from: NetBSD (scw@)
MFC after: 2 weeks

Be more robust when handling Rx interrupts. If we can't allocate and DMA map
a new mbuf, just discard the received frame and reuse the old mbuf.
This should fix kernel panics on high network traffic

Be more robust when handling Rx interrupts. If we can't allocate and DMA map
a new mbuf, just discard the received frame and reuse the old mbuf.
This should fix kernel panics on high network traffic.

Obtained from: NetBSD (joerg@)
MFC after: 2 weeks

show more ...

Fixes my previous commit (rev 1.20)

MFC after: 1 day

o Use firmware extended scan command; this one doesn't crash when scanning
the 5GHz band.
o Enable 802.11a channels scanning for 2915ABG adapters.
o Fix a typo (negociated->negotiated).

With hints

o Use firmware extended scan command; this one doesn't crash when scanning
the 5GHz band.
o Enable 802.11a channels scanning for 2915ABG adapters.
o Fix a typo (negociated->negotiated).

With hints from NetBSD.

MFC after: 2 days

show more ...

Use phk's kernel unit number allocator to associate unique ids to neighbors
in an IBSS. Store ids directly into ieee80211_node's instead of managing
our own private association table. Idea and code

Use phk's kernel unit number allocator to associate unique ids to neighbors
in an IBSS. Store ids directly into ieee80211_node's instead of managing
our own private association table. Idea and code by Sam Leffler.

Submitted by: sam
MFC after: 5 days

show more ...

It's safe to wait for command completion in iwi_config().

MFC after: 5 days

Make sure that we call if_free(ifp) after bus_teardown_intr. Since we
could get an interrupt after we free the ifp, and the interrupt
handler depended on the ifp being still alive, this could, in th

Make sure that we call if_free(ifp) after bus_teardown_intr. Since we
could get an interrupt after we free the ifp, and the interrupt
handler depended on the ifp being still alive, this could, in theory,
cause a crash. Eliminate this possibility by moving the if_free to
after the bus_teardown_intr() call.

show more ...

o Add initial bits for IBSS support.
o Allow association with APs that do not broadcast SSID (with hints from
Nick Hudson and Hajimu Umemoto).
o IFQ_DRV_PREPEND mbuf when h/w ring is full so it can

o Add initial bits for IBSS support.
o Allow association with APs that do not broadcast SSID (with hints from
Nick Hudson and Hajimu Umemoto).
o IFQ_DRV_PREPEND mbuf when h/w ring is full so it can be sent later.
o Increment if_oerrors when appropriate.
o Did some cleanup while I'm here.

MFC after: 1 day

show more ...

Enhanced WME (802.11e) support.

Add some necessary bits for upcoming 802.11e support:
o management of multiple tx rings (up to 4)
o setting of WME IE in association requests

Some features are still missing though, like the possibi

Add some necessary bits for upcoming 802.11e support:
o management of multiple tx rings (up to 4)
o setting of WME IE in association requests

Some features are still missing though, like the possibility to override
the default cwmin/cwmax/asfn values of each tx queues.

show more ...