Android: qcacld-3.0 driver (not part of the Linux kernel) #531
-
|
When using hcxdumptool and airodump-ng on the qcacld3 driver, I encountered a freeze for a period of time whenever the second capture opened on the same channel as the first. Airodump-ng even stuttered during each refresh. After reviewing the logs, I discovered that the freeze occurs when switching to the same channel, specifically at status = qdf_wait_for_event_completion(
&adapter->qdf_monitor_mode_vdev_up_event,
WLAN_MONITOR_MODE_VDEV_UP_EVT);This operation would hang indefinitely until a timeout occurred. I tried modifying the code, and after the changes, airodump-ng worked fine. However, after launching hcdumptool once, it became impossible to start it again—it even prevented airodump-ng from launching. What should I do? Below are the changes I made for testing and the video after modification: static int __wlan_hdd_cfg80211_set_mon_ch(struct wiphy *wiphy,
struct cfg80211_chan_def *chandef)
{
struct hdd_context *hdd_ctx = wiphy_priv(wiphy);
struct hdd_adapter *adapter;
struct hdd_monitor_ctx *mon_ctx;
QDF_STATUS status;
mac_handle_t mac_handle;
struct qdf_mac_addr bssid;
struct channel_change_req *req;
struct ch_params ch_params = {0};
int ret;
enum channel_state chan_freq_state;
uint8_t max_fw_bw;
enum phy_ch_width ch_width;
qdf_freq_t sec_ch_2g_freq = 0;
hdd_enter();
ret = wlan_hdd_validate_context(hdd_ctx);
if (ret)
return ret;
mac_handle = hdd_ctx->mac_handle;
adapter = hdd_get_adapter(hdd_ctx, QDF_MONITOR_MODE);
if (!adapter)
return -EIO;
hdd_debug("%s: set monitor mode freq %d",
adapter->dev->name, chandef->chan->center_freq);
/* Verify channel state before accepting this request */
chan_freq_state =
wlan_reg_get_channel_state_for_pwrmode(
hdd_ctx->pdev,
chandef->chan->center_freq,
REG_CURRENT_PWR_MODE);
if (chan_freq_state == CHANNEL_STATE_DISABLE ||
chan_freq_state == CHANNEL_STATE_INVALID) {
hdd_err("Invalid chan freq received for monitor mode aborting");
return -EINVAL;
}
/* Verify the BW before accepting this request */
ch_width = hdd_map_nl_chan_width(chandef->width);
if (ch_width > CH_WIDTH_10MHZ ||
(!cds_is_sub_20_mhz_enabled() && ch_width > CH_WIDTH_160MHZ)) {
hdd_err("invalid BW received %d", ch_width);
return -EINVAL;
}
+ mon_ctx = WLAN_HDD_GET_MONITOR_CTX_PTR(adapter->deflink);
+ /* Check if target channel is same as current channel */
+ if (mon_ctx->freq == chandef->chan->center_freq &&
+ mon_ctx->bandwidth == ch_width) {
+ hdd_info("Target channel and mode is same as current channel and mode channel freq %d and mode %d",
+ mon_ctx->freq, mon_ctx->bandwidth);
+ return 0;
+ }
max_fw_bw = sme_get_vht_ch_width();
if ((ch_width == CH_WIDTH_160MHZ &&
max_fw_bw <= WNI_CFG_VHT_CHANNEL_WIDTH_80MHZ) ||
(ch_width == CH_WIDTH_80P80MHZ &&
max_fw_bw <= WNI_CFG_VHT_CHANNEL_WIDTH_160MHZ)) {
hdd_err("FW does not support this BW %d max BW supported %d",
ch_width, max_fw_bw);
return -EINVAL;
}
- mon_ctx = WLAN_HDD_GET_MONITOR_CTX_PTR(adapter->deflink);
if (WLAN_REG_IS_24GHZ_CH_FREQ(chandef->chan->center_freq) &&
chandef->width == NL80211_CHAN_WIDTH_40 &&
chandef->center_freq1) {
if (chandef->center_freq1 > chandef->chan->center_freq)
sec_ch_2g_freq = chandef->chan->center_freq + 20;
else if (chandef->center_freq1 < chandef->chan->center_freq)
sec_ch_2g_freq = chandef->chan->center_freq - 20;
}
hdd_debug("set mon ch:width=%d, freq %d sec_ch_2g_freq=%d",
chandef->width, chandef->chan->center_freq, sec_ch_2g_freq);
qdf_mem_copy(bssid.bytes, adapter->mac_addr.bytes,
QDF_MAC_ADDR_SIZE);
ch_params.ch_width = ch_width;
wlan_reg_set_channel_params_for_pwrmode(hdd_ctx->pdev,
chandef->chan->center_freq,
sec_ch_2g_freq, &ch_params,
REG_CURRENT_PWR_MODE);
if (wlan_hdd_change_hw_mode_for_given_chnl(adapter,
chandef->chan->center_freq,
POLICY_MGR_UPDATE_REASON_SET_OPER_CHAN)) {
hdd_err("Failed to change hw mode");
return -EINVAL;
}
if (adapter->monitor_mode_vdev_up_in_progress) {
hdd_err_rl("monitor mode vdev up in progress");
return -EBUSY;
}
status = qdf_event_reset(&adapter->qdf_monitor_mode_vdev_up_event);
if (QDF_IS_STATUS_ERROR(status)) {
hdd_err_rl("failed to reinit monitor mode vdev up event");
return qdf_status_to_os_return(status);
}
adapter->monitor_mode_vdev_up_in_progress = true;
qdf_mem_zero(&ch_params, sizeof(struct ch_params));
req = qdf_mem_malloc(sizeof(struct channel_change_req));
if (!req)
return -ENOMEM;
req->vdev_id = adapter->deflink->vdev_id;
req->target_chan_freq = chandef->chan->center_freq;
req->ch_width = ch_width;
ch_params.ch_width = ch_width;
hdd_select_cbmode(adapter, chandef->chan->center_freq, sec_ch_2g_freq,
&ch_params);
req->sec_ch_offset = ch_params.sec_ch_offset;
req->center_freq_seg0 = ch_params.center_freq_seg0;
req->center_freq_seg1 = ch_params.center_freq_seg1;
sme_fill_channel_change_request(mac_handle, req, mon_ctx->phy_mode);
status = sme_send_channel_change_req(mac_handle, req);
qdf_mem_free(req);
if (status) {
hdd_err_rl("Failed to set sme_RoamChannel for monitor mode status: %d",
status);
adapter->monitor_mode_vdev_up_in_progress = false;
ret = qdf_status_to_os_return(status);
return ret;
}
/* block on a completion variable until vdev up success*/
status = qdf_wait_for_event_completion(
&adapter->qdf_monitor_mode_vdev_up_event,
WLAN_MONITOR_MODE_VDEV_UP_EVT);
if (QDF_IS_STATUS_ERROR(status)) {
hdd_err_rl("monitor vdev up event time out vdev id: %d",
adapter->deflink->vdev_id);
if (adapter->qdf_monitor_mode_vdev_up_event.force_set)
/*
* SSR/PDR has caused shutdown, which has
* forcefully set the event.
*/
hdd_err_rl("monitor mode vdev up event forcefully set");
else if (status == QDF_STATUS_E_TIMEOUT)
hdd_err_rl("monitor mode vdev up timed out");
else
hdd_err_rl("Failed monitor mode vdev up(status-%d)",
status);
adapter->monitor_mode_vdev_up_in_progress = false;
return qdf_status_to_os_return(status);
}
hdd_exit();
return 0;
}8aa04b10b76be3945cf3745081eec0f4.2.mp4 |
Beta Was this translation helpful? Give feedback.
Replies: 7 comments 53 replies
-
|
You can't compare airodump-ng and and hcxdumptool.
Neither Linux drivers >= ath10k nor the qcacld-3.0 driver support full packet injection:
From hcxdumptool's README.md Requirements section:
hcxdumptool does not work because the qcacld3 driver does not support full packet injection. And there are much more limitations on this driver:
|
Beta Was this translation helpful? Give feedback.
-
|
My native language is not English, so my description may not be clear enough. My main problem is that before this change, although hcxdumptool couldn't send deauth packets, it could capture packets normally. However, after the change, if I start hcxdumptool on the same channel as the current channel of the network card, it can't capture any packets, and it will also prevent airodump-ng from starting after being closed. I want to know how I should modify the source code of qcacld3 to fix this problem. |
Beta Was this translation helpful? Give feedback.
-
|
Your code set monitor mode, but packet injection is still not possible. |
Beta Was this translation helpful? Give feedback.
-
Okay, I'll try to add frame injection. |
Beta Was this translation helpful? Give feedback.
-
|
Important notice: |
Beta Was this translation helpful? Give feedback.
-
The worst-case scenario may have occurred. I've tried to add frame injection support at the driver layer, and according to the logs, the transmission was indeed successful. However, in reality, no frames were sent. I'm not sure if there's a problem with my handling. Here are my changes. Terminal output: dmesg: |
Beta Was this translation helpful? Give feedback.
-
|
It's inot a good dea to use ifconfig on modern drivers. This tool (and some other ones depend on Wireless Extensions (WEXT). This extensions are deprecated and replaced by modern tools. Your changes looking good. Unfortunately we don't know whether the firmware accepts them or not. |
Beta Was this translation helpful? Give feedback.
-
|
I have some info here. This fixed the monitor mode switching |
Beta Was this translation helpful? Give feedback.
-
|
This fixed the "Monitor Mode not supported" issue, because Qcom removed it, and switching mode with iw will work again. |
Beta Was this translation helpful? Give feedback.
-
|
@kimocoder , great, thanks for this information. Unfortunately frame injection is still unsupported by the driver. On the bright side, this is not an issue of hcxdumptool. |
Beta Was this translation helpful? Give feedback.
-
|
This method doesn't seem to work. I tried to add it, but during today's test, I encountered a kernel panic. logs: |
Beta Was this translation helpful? Give feedback.
-
|
приветствую у меня похожая проблема? режим монитора и Injection начинает полноценно работать только после применения связки команд: rmmod rtw88_8821ce как будто бы привязываются к домашнему каналу и не видит других точек доступа |
Beta Was this translation helpful? Give feedback.
-
|
Вот как выглядит ДО: |
Beta Was this translation helpful? Give feedback.
-
|
опытном путём заметил, что команда: |
Beta Was this translation helpful? Give feedback.
-
|
@brokestar233 , the Qualcomm driver need a complete refresh. Otherwise, packet injection will never work. @dart8888 it doesn't make sense to compare airodump-ng with hcxdumptool. Never ever use commands designed for the aircrack-ng suite in combination with hcxdumptool! Some additional information: rtw88_8821ce is working: rt2800usb is working: Please note: |
Beta Was this translation helpful? Give feedback.
-
|
Got it. I'm going to refer to @dr1408's changes and add frame injection. |
Beta Was this translation helpful? Give feedback.
-
I guess working fine first time for me to use this tool |
Beta Was this translation helpful? Give feedback.
-
|
That's exactly what it should look like. It's nice that it works now for you. |
Beta Was this translation helpful? Give feedback.
-
|
Yes the tool is cool it captured 6 handshakes the issue is that hashcat 22000 mode doesnt work on nethunter but it cool you can crack on another setup |
Beta Was this translation helpful? Give feedback.
-
|
Same situation. Just as hcxdumptool needs a "working" WiFi driver, hashcat/john needs a working GPU driver. Usually, this is not the case on common smart phones. |
Beta Was this translation helpful? Give feedback.
Your code set monitor mode, but packet injection is still not possible.
Without your modification, the driver reports that it can't do full monitor mode and full packet injection and hcxdumptool respects this.
After your modification the driver reports that it can do full monitor mode and full packet injection - but that is not the case. As a result, the driver crashes straight after hcxdumptool transmit a packet.
As long as you don't add full packet injection mode to the driver, hcxdumptool will not work and the driver crashes.