Here I am describing general topics about : 1) Brief about 802.11 standard. 2) MAC layer frames 3) MLME 4) SoftMAC and HardMAC 5) Broadcom bcm43xx chipsets 6) Tx path and Rx path of brcmsmac driver 7) Mac80211 debugfs 8) Live demonstration

1. Broadcom Wifi Driver
Midhun Lohidakshan

2. Today’s Topics
● Brief about 802.11 standard.
● MAC layer frames
● MLME
● SoftMAC and HardMAC
● Broadcom bcm43xx chipsets
● Tx path and Rx path of brcmsmac driver
● Mac80211 debugfs
● Live demonstration

3. 802.11 Wireless Standard
● Created in 1997
● Targeted to standardise PHY and MAC layers which are two lowest OSI layers.
● Initially for the PHY layer, 2 frequency bands were chosen : Infra Red ( IR ) band and Microwave Band
( 2.4 GHz )
● 802.11a standard brought 5GHz frequency.

4. IEEE
802.11
MAC
Sublayer

5. The 802.11 MAC Header
Frame Control

6. MAC layer frames
MAC layer uses 3 types of frames
● Management
● Data
● Control

7. Management Frames
1. Association Request - Association Response
2. Reassociation Request - Reassociation Response
3. Probe Request - Probe Response
4. Beacon
5. ATIM
6. Disassociation
7. Authentication - Deauthentication
8. Action

8. Control Frames
1. Power Save ( PS - Poll )
2. RTS
3. CTS
4. Acknowledgement
5. Contention Free
6. CF-End + CF-Ack

9. Data Frames
1. Data
2. Data + CF-ACK
3. Data + CF-Poll
4. Data + CF-ACK + CF-Poll
5. Null Data
6. CF-Ack
7. CF-Poll
8. Data + CF-Ack + CF-Poll

10. MAC subLayer Management Entity ( MLME )
● MLME is the management entity where the Physical layer ( PHY ) MAC state machine resides.
● Based on the location of the core that processes MLME, 2 types MAC layer implementations are available - SoftMAC
and FullMAC ( HardMAC )
● Soft MAC
○ MLME is running in the Linux Kernel Module ( LKM )
○ Mac80211 is a driver API for SoftMAC WNIC
● Full MAC ( Hard MAC )
○ MLME is managed in hardware.
○ We will not use mac80211 to write FullMAC wireless driver.

11. SoftMAC vs HardMAC
HardMAC/FullMAC devices SoftMAC devices
Proprietary Implementations Lower Hardware Cost
Less CPU load Possibility to upgrade to newer standards
by updating the driver only.
Better power consumption and
performance. Hence used in smartphones
Possibility to correct faults in the MAC
implementation.
No monitor mode Different drivers for different WNIC can all
share the same MAC implementation

12. Broadcom bcm43xxx chipset
● Bcm43xxx series have both HardMAC and SoftMAC cards.
● Some chips are integrated both WLAN and Bluetooth functionalities.
○ Eg - bcm4339, bcm4330
● Main MCU of the chipset is ARM Cortex-M3/ ARM Cortex-R4

13. bcm43xxx Chip Components
● ARM Cortex ( M3 or R4 )
● ROM
● RAM
● D11 Core
● 802.11 PHY
● 2.4 or 5 GHz radio

14. D11 Core
● Does all time critical operations
Firmware
● Firmwares used by these chips are split into two parts.
● Read-only part is written into the ROM.
● Read-Write part is uploaded by the device driver to the chip’s RAM.
● RAM portion of the firmware can be updated when new features arrives.

15. Host Driver Interface
● USB
● SDIO
● PCIe
Chip Model MAC Type MCU Bus Interface Driver Host Device
bcm4339 FullMAC ARM Cortex R4 SDIO bcmdhd Nexus 5
bcm4330 FullMAC ARM Cortex M3 SDIO bcmdhd Samsung Galaxy Y
bcm43430 FullMAC ARM Cortex M3 SDIO brcmfmac Raspberry PI 3B
bcm4352 FullMAC ARM Cortex M3 PCIe wl Dell XPS laptop
bcm43236 SoftMAC ARM Cortex R4 USB wl SFR mini decoder TV
Interface details of bcm43xxx chipsets

16. Types of bcm43xxx device drivers
No Device Driver OS MAC type Driver Source
1 b43 Linux SoftMAC OpenSource
2 brcmsmac Linux SoftMAC OpenSource
3 brcmfmac Linux FullMAC OpenSource
4 brcmdhd Android FullMAC OpenSource
5 broadcom-sta aka 'wl' Linux SoftMAC & FullMAC Proprietary

17. WiFi Stack on Linux

18. Data Path and
Control Path in
Wireless
Subsystem

19. Tx Path in
MAC80211

20. Tx Path :
Kernel ->
mac80211 ->
brcmsmac

21. Rx Path:
Device
Driver->
mac80211

22. Mac80211 Debugfs
● Debugfs is a technique that enables exporting debugging information to the userspace.
● It creates entries under the sysfs filesystem.
● For mac80211 , debugfs implemented at net/mac80211/debugfs.c
● After mounting debugfs, various mac80211 statistics and information entries can be visualised.
● Mounting debugfs is performed via below command
○ mount -t debugfs none_debugs /sys/kernel/debug
● If wireless phy of our system is phy0, then mac80211 debugfs can be seen at below location.
○ /sys/kernel/debug/ieee80211/phy0

23. Live Demonstration

24. 1. Output of below commands on Linux system
a. sudo lshw -C network
b. Iw list ( using netlink sockets )
i. Show supported modes
ii. Show supported bands
c. Iw dev ( using netlink sockets )
d. Iwconfig ( using ioctl )
e. watch -n1 "cat /proc/net/wireless" ( Quality of signals )
f. watch -n1 "cat /proc/net/dev" ( device statistics )
g. sudo watch -n1 "cat /sys/kernel/debug/ieee80211/phy0/iwlwifi/iwlmvm/nic_temp" (debugfs)
2. Linux Kernel Code for mac80211, brcmfmac and brcmsmac

25. Questions ?