Skip to content

Commit 8df2379

Browse files
jlinktujlinktu
authored
Merge pull request #579 from DrSchottky/pico-w
Add monitor mode support for Raspberry Pi Pico W (bcm43439a0) FW 7_95_49_2271bb6
2 parents e357a19 + 98b1a47 commit 8df2379

File tree

6 files changed

+347
-2
lines changed

6 files changed

+347
-2
lines changed

‎firmwares/bcm43439a0/structs.common.h

Lines changed: 62 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,25 @@
99
#define PAD _XSTR(__LINE__)
1010
#endif
1111

12+
struct wl_rxsts {
13+
uint pkterror;
14+
uint phytype;
15+
uint16 chanspec;
16+
uint16 datarate;
17+
uint8 mcs;
18+
uint8 htflags;
19+
uint antenna;
20+
uint pktlength;
21+
uint32 mactime;
22+
uint sq;
23+
int32 signal;
24+
int32 noise;
25+
uint preamble;
26+
uint encoding;
27+
uint nfrmtype;
28+
struct wl_if *wlif;
29+
} __attribute__((packed));
30+
1231
struct sk_buff {
1332
union { /* 0x000 */
1433
uint32 u32;
@@ -953,6 +972,47 @@ struct wlc_hw_info {
953972
uint32 PAD; /* 0x168 */
954973
} __attribute__((packed));
955974

975+
struct wlc_if_stats {
976+
/* transmit stat counters */
977+
uint32 txframe; /* tx data frames */
978+
uint32 txbyte; /* tx data bytes */
979+
uint32 txerror; /* tx data errors (derived: sum of others) */
980+
uint32 txnobuf; /* tx out of buffer errors */
981+
uint32 txrunt; /* tx runt frames */
982+
uint32 txfail; /* tx failed frames */
983+
uint32 rxframe; /* rx data frames */
984+
uint32 rxbyte; /* rx data bytes */
985+
uint32 rxerror; /* rx data errors (derived: sum of others) */
986+
uint32 rxnobuf; /* rx out of buffer errors */
987+
uint32 rxrunt; /* rx runt frames */
988+
uint32 rxfragerr; /* rx fragment errors */
989+
uint32 txretry; /* tx retry frames */
990+
uint32 txretrie; /* tx multiple retry frames */
991+
uint32 txfrmsnt; /* tx sent frames */
992+
uint32 txmulti; /* tx mulitcast sent frames */
993+
uint32 txfrag; /* tx fragments sent */
994+
uint32 rxmulti; /* rx multicast frames */
995+
};
996+
997+
struct wl_if {
998+
struct wlc_if *wlcif;
999+
struct hndrte_dev *dev;
1000+
};
1001+
1002+
struct wlc_if {
1003+
struct wlc_if *next;
1004+
uint8 type;
1005+
uint8 index;
1006+
uint8 flags;
1007+
struct wl_if *wlif;
1008+
void *qi;
1009+
union {
1010+
struct scb *scb;
1011+
struct wlc_bsscfg *bsscfg;
1012+
} u;
1013+
struct wlc_if_stats _cnt;
1014+
};
1015+
9561016
struct wlc_info {
9571017
void *pub; /* 0x000 */
9581018
void *osh; /* 0x004 */
@@ -1083,7 +1143,7 @@ struct wlc_info {
10831143
uint32 PAD; /* 0x1f8 */
10841144
uint32 PAD; /* 0x1fc */
10851145
uint32 PAD; /* 0x200 */
1086-
uint32 PAD; /* 0x204 */
1146+
uint32 monitor; /* 0x204 */
10871147
uint32 PAD; /* 0x208 */
10881148
uint32 PAD; /* 0x20c */
10891149
uint32 PAD; /* 0x210 */
@@ -1320,7 +1380,7 @@ struct wlc_info {
13201380
uint32 PAD; /* 0x5ac */
13211381
uint32 PAD; /* 0x5b0 */
13221382
uint32 PAD; /* 0x5b4 */
1323-
uint32 PAD; /* 0x5b8 */
1383+
struct wlc_if *wlcif_list; /* 0x5b8 */
13241384
uint32 PAD; /* 0x5bc */
13251385
uint32 PAD; /* 0x5c0 */
13261386
uint32 PAD; /* 0x5c4 */

‎patches/bcm43439a0/7_95_49_2271bb6/nexmon/include/brcm.h

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/***************************************************************************
2+
* *
3+
* ########### ########### ########## ########## *
4+
* ############ ############ ############ ############ *
5+
* ## ## ## ## ## ## ## *
6+
* ## ## ## ## ## ## ## *
7+
* ########### #### ###### ## ## ## ## ###### *
8+
* ########### #### # ## ## ## ## # # *
9+
* ## ## ###### ## ## ## ## # # *
10+
* ## ## # ## ## ## ## # # *
11+
* ############ ##### ###### ## ## ## ##### ###### *
12+
* ########### ########### ## ## ## ########## *
13+
* *
14+
* S E C U R E M O B I L E N E T W O R K I N G *
15+
* *
16+
* This file is part of NexMon. *
17+
* *
18+
* Copyright (c) 2016 NexMon Team *
19+
* *
20+
* NexMon is free software: you can redistribute it and/or modify *
21+
* it under the terms of the GNU General Public License as published by *
22+
* the Free Software Foundation, either version 3 of the License, or *
23+
* (at your option) any later version. *
24+
* *
25+
* NexMon is distributed in the hope that it will be useful, *
26+
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
27+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
28+
* GNU General Public License for more details. *
29+
* *
30+
* You should have received a copy of the GNU General Public License *
31+
* along with NexMon. If not, see <http://www.gnu.org/licenses/>. *
32+
* *
33+
**************************************************************************/
34+
35+
#pragma once
36+
37+
#include "../include/types.h"
38+
#define WL_CHANSPEC_CHAN_MASK 0x00ff
39+
#define CHSPEC_CHANNEL(chspec) ((uint8_t)((chspec) & WL_CHANSPEC_CHAN_MASK))

‎patches/bcm43439a0/7_95_49_2271bb6/nexmon/include/d11.h

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/***************************************************************************
2+
* *
3+
* ########### ########### ########## ########## *
4+
* ############ ############ ############ ############ *
5+
* ## ## ## ## ## ## ## *
6+
* ## ## ## ## ## ## ## *
7+
* ########### #### ###### ## ## ## ## ###### *
8+
* ########### #### # ## ## ## ## # # *
9+
* ## ## ###### ## ## ## ## # # *
10+
* ## ## # ## ## ## ## # # *
11+
* ############ ##### ###### ## ## ## ##### ###### *
12+
* ########### ########### ## ## ## ########## *
13+
* *
14+
* S E C U R E M O B I L E N E T W O R K I N G *
15+
* *
16+
* This file is part of NexMon. *
17+
* *
18+
* Copyright (c) 2016 NexMon Team *
19+
* *
20+
* NexMon is free software: you can redistribute it and/or modify *
21+
* it under the terms of the GNU General Public License as published by *
22+
* the Free Software Foundation, either version 3 of the License, or *
23+
* (at your option) any later version. *
24+
* *
25+
* NexMon is distributed in the hope that it will be useful, *
26+
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
27+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
28+
* GNU General Public License for more details. *
29+
* *
30+
* You should have received a copy of the GNU General Public License *
31+
* along with NexMon. If not, see <http://www.gnu.org/licenses/>. *
32+
* *
33+
**************************************************************************/
34+
35+
#pragma once
36+
37+
struct d11rxhdr {
38+
unsigned short RxFrameSize; /* Actual byte length of the frame data received */
39+
unsigned short PAD;
40+
unsigned short PhyRxStatus_0; /* PhyRxStatus 15:0 */
41+
unsigned short PhyRxStatus_1; /* PhyRxStatus 31:16 */
42+
unsigned short PhyRxStatus_2; /* PhyRxStatus 47:32 */
43+
unsigned short PhyRxStatus_3; /* PhyRxStatus 63:48 */
44+
unsigned short PhyRxStatus_4; /* PhyRxStatus 79:64 */
45+
unsigned short PhyRxStatus_5; /* PhyRxStatus 95:80 */
46+
unsigned short RxStatus1; /* MAC Rx status */
47+
unsigned short RxStatus2; /* extended MAC Rx status */
48+
unsigned short RxTSFTime; /* RxTSFTime time of first MAC symbol + M_PHY_PLCPRX_DLY */
49+
unsigned short RxChan; /* gain code, channel radio code, and phy type -> looks like chanspec */
50+
} __attribute__((packed));
51+
52+
/* ucode RxStatus1: */
53+
#define RXS_BCNSENT 0x8000
54+
#define RXS_SECKINDX_MASK 0x07e0
55+
#define RXS_SECKINDX_SHIFT 5
56+
#define RXS_DECERR (1 << 4)
57+
#define RXS_DECATMPT (1 << 3)
58+
/* PAD bytes to make IP data 4 bytes aligned */
59+
#define RXS_PBPRES (1 << 2)
60+
#define RXS_RESPFRAMETX (1 << 1)
61+
#define RXS_FCSERR (1 << 0)
62+
63+
/* ucode RxStatus2: */
64+
#define RXS_AMSDU_MASK 1
65+
#define RXS_AGGTYPE_MASK 0x6
66+
#define RXS_AGGTYPE_SHIFT 1
67+
#define RXS_PHYRXST_VALID (1 << 8)
68+
#define RXS_RXANT_MASK 0x3
69+
#define RXS_RXANT_SHIFT 12
70+
71+
/* RxChan */
72+
#define RXS_CHAN_40 0x1000
73+
#define RXS_CHAN_5G 0x0800
74+
#define RXS_CHAN_ID_MASK 0x07f8
75+
#define RXS_CHAN_ID_SHIFT 3
76+
#define RXS_CHAN_PHYTYPE_MASK 0x0007
77+
#define RXS_CHAN_PHYTYPE_SHIFT 0
78+
79+
struct wlc_d11rxhdr {
80+
struct d11rxhdr rxhdr;
81+
unsigned int tsf_l;
82+
char rssi; /* computed instanteneous RSSI in BMAC */
83+
char rxpwr0;
84+
char rxpwr1;
85+
char do_rssi_ma; /* do per-pkt sampling for per-antenna ma in HIGH */
86+
char rxpwr[4]; /* rssi for supported antennas */
87+
} __attribute__((packed));
88+

‎patches/bcm43439a0/7_95_49_2271bb6/nexmon/include/local_wrapper.h

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/***************************************************************************
2+
* *
3+
* ########### ########### ########## ########## *
4+
* ############ ############ ############ ############ *
5+
* ## ## ## ## ## ## ## *
6+
* ## ## ## ## ## ## ## *
7+
* ########### #### ###### ## ## ## ## ###### *
8+
* ########### #### # ## ## ## ## # # *
9+
* ## ## ###### ## ## ## ## # # *
10+
* ## ## # ## ## ## ## # # *
11+
* ############ ##### ###### ## ## ## ##### ###### *
12+
* ########### ########### ## ## ## ########## *
13+
* *
14+
* S E C U R E M O B I L E N E T W O R K I N G *
15+
* *
16+
* This file is part of NexMon. *
17+
* *
18+
* Copyright (c) 2016 NexMon Team *
19+
* *
20+
* NexMon is free software: you can redistribute it and/or modify *
21+
* it under the terms of the GNU General Public License as published by *
22+
* the Free Software Foundation, either version 3 of the License, or *
23+
* (at your option) any later version. *
24+
* *
25+
* NexMon is distributed in the hope that it will be useful, *
26+
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
27+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
28+
* GNU General Public License for more details. *
29+
* *
30+
* You should have received a copy of the GNU General Public License *
31+
* along with NexMon. If not, see <http://www.gnu.org/licenses/>. *
32+
* *
33+
**************************************************************************/
34+
35+
#ifndef LOCAL_WRAPPER_H
36+
#define LOCAL_WRAPPER_H
37+
38+
#include "../src/local_wrapper.c" // wrapper definitions for functions that already exist in the firmware
39+
40+
#endif /*LOCAL_WRAPPER_H*/

‎patches/bcm43439a0/7_95_49_2271bb6/nexmon/src/monitormode.c

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
/***************************************************************************
2+
* *
3+
* ########### ########### ########## ########## *
4+
* ############ ############ ############ ############ *
5+
* ## ## ## ## ## ## ## *
6+
* ## ## ## ## ## ## ## *
7+
* ########### #### ###### ## ## ## ## ###### *
8+
* ########### #### # ## ## ## ## # # *
9+
* ## ## ###### ## ## ## ## # # *
10+
* ## ## # ## ## ## ## # # *
11+
* ############ ##### ###### ## ## ## ##### ###### *
12+
* ########### ########### ## ## ## ########## *
13+
* *
14+
* S E C U R E M O B I L E N E T W O R K I N G *
15+
* *
16+
* This file is part of NexMon. *
17+
* *
18+
* Copyright (c) 2016 NexMon Team *
19+
* *
20+
* NexMon is free software: you can redistribute it and/or modify *
21+
* it under the terms of the GNU General Public License as published by *
22+
* the Free Software Foundation, either version 3 of the License, or *
23+
* (at your option) any later version. *
24+
* *
25+
* NexMon is distributed in the hope that it will be useful, *
26+
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
27+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
28+
* GNU General Public License for more details. *
29+
* *
30+
* You should have received a copy of the GNU General Public License *
31+
* along with NexMon. If not, see <http://www.gnu.org/licenses/>. *
32+
* *
33+
**************************************************************************/
34+
35+
#pragma NEXMON targetregion "patch"
36+
37+
#include <firmware_version.h>
38+
#include <wrapper.h> // wrapper definitions for functions that already exist in the firmware
39+
#include <structs.h> // structures that are used by the code in the firmware
40+
#include <patcher.h>
41+
#include <helper.h>
42+
#include "d11.h"
43+
#include "brcm.h"
44+
45+
//#define RADIOTAP_MCS
46+
#include <ieee80211_radiotap.h>
47+
48+
#define MONITOR_DISABLED 0
49+
#define MONITOR_IEEE80211 1
50+
#define MONITOR_RADIOTAP 2
51+
#define MONITOR_LOG_ONLY 3
52+
#define MONITOR_DROP_FRM 4
53+
#define MONITOR_IPV4_UDP 5
54+
55+
void
56+
wl_monitor_radiotap(struct wl_info *wl, struct wl_rxsts *sts, struct sk_buff *p) {
57+
struct sk_buff *p_new = pkt_buf_get_skb(wl->wlc->osh, p->len + sizeof(struct nexmon_radiotap_header));
58+
struct nexmon_radiotap_header *frame = (struct nexmon_radiotap_header *) p_new->data;
59+
struct tsf tsf;
60+
wlc_bmac_read_tsf(wl->wlc_hw, &tsf.tsf_l, &tsf.tsf_h);
61+
62+
frame->header.it_version = 0;
63+
frame->header.it_pad = 0;
64+
frame->header.it_len = sizeof(struct nexmon_radiotap_header);
65+
frame->header.it_present =
66+
(1<<IEEE80211_RADIOTAP_TSFT)
67+
| (1<<IEEE80211_RADIOTAP_FLAGS)
68+
| (1<<IEEE80211_RADIOTAP_CHANNEL)
69+
| (1<<IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
70+
frame->tsf.tsf_l = tsf.tsf_l;
71+
frame->tsf.tsf_h = tsf.tsf_h;
72+
frame->flags = IEEE80211_RADIOTAP_F_FCS;
73+
frame->chan_freq = wlc_phy_channel2freq(CHSPEC_CHANNEL(sts->chanspec));
74+
frame->chan_flags = 0;
75+
frame->dbm_antsignal = sts->signal;
76+
77+
memcpy(p_new->data + sizeof(struct nexmon_radiotap_header), p->data + 6, p->len - 6);
78+
79+
p_new->len -= 6;
80+
81+
if (wl->wlc->wlcif_list->next)
82+
wl->wlc->wlcif_list->wlif->dev->chained->funcs->xmit(wl->wlc->wlcif_list->wlif->dev, wl->wlc->wlcif_list->wlif->dev->chained, p_new);
83+
else
84+
wl->dev->chained->funcs->xmit(wl->dev, wl->dev->chained, p_new);
85+
}
86+
87+
void
88+
wl_monitor_hook(struct wl_info *wl, struct wl_rxsts *sts, struct sk_buff *p) {
89+
switch(wl->wlc->monitor & 0xFF) {
90+
case MONITOR_RADIOTAP:
91+
wl_monitor_radiotap(wl, sts, p);
92+
break;
93+
94+
case MONITOR_IEEE80211:
95+
wl_monitor(wl, sts, p);
96+
break;
97+
98+
case MONITOR_LOG_ONLY:
99+
printf("frame received\n");
100+
break;
101+
102+
case MONITOR_DROP_FRM:
103+
break;
104+
105+
case MONITOR_IPV4_UDP:
106+
printf("%s: udp tunneling not implemented\n");
107+
// not implemented yet
108+
break;
109+
}
110+
}
111+
112+
__attribute__((at(0x81F6D6, "flashpatch", CHIP_VER_BCM43439a0, FW_VER_ALL)))
113+
BLPatch(flash_patch_76, wl_monitor_hook);

0 commit comments

Comments
 (0)