From owner-freebsd-net@FreeBSD.ORG Fri Oct 8 17:38:48 2010 Return-Path: Delivered-To: net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 68D4B1065675; Fri, 8 Oct 2010 17:38:48 +0000 (UTC) (envelope-from bschmidt@techwires.net) Received: from mail-fx0-f54.google.com (mail-fx0-f54.google.com [209.85.161.54]) by mx1.freebsd.org (Postfix) with ESMTP id BDD028FC17; Fri, 8 Oct 2010 17:38:47 +0000 (UTC) Received: by fxm4 with SMTP id 4so561372fxm.13 for ; Fri, 08 Oct 2010 10:38:46 -0700 (PDT) Received: by 10.223.105.82 with SMTP id s18mr3574593fao.77.1286559523398; Fri, 08 Oct 2010 10:38:43 -0700 (PDT) Received: from julie.lab.techwires.net ([178.2.205.177]) by mx.google.com with ESMTPS id c20sm1747106fak.9.2010.10.08.10.38.40 (version=SSLv3 cipher=RC4-MD5); Fri, 08 Oct 2010 10:38:42 -0700 (PDT) From: Bernhard Schmidt To: Paul B Mahol Date: Fri, 8 Oct 2010 19:36:13 +0200 User-Agent: KMail/1.13.5 (FreeBSD/8.1-RELEASE; KDE/4.5.1; amd64; ; ) References: <4763016D.7060100@janh.de> <20101008160422.GC81218@FreeBSD.org> In-Reply-To: MIME-Version: 1.0 Content-Type: Multipart/Mixed; boundary="Boundary-00=_Oa1rMALqoTlYxaa" Message-Id: <201010081936.14269.bschmidt@techwires.net> Cc: Alexey Dokuchaev , net@freebsd.org Subject: Re: Monitor mode not working for iwi(4) on 7.X X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Oct 2010 17:38:48 -0000 --Boundary-00=_Oa1rMALqoTlYxaa Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit On Friday 08 October 2010 18:59:44 Paul B Mahol wrote: > On 10/8/10, Alexey Dokuchaev wrote: > > On Fri, Oct 08, 2010 at 03:20:08PM +0000, Paul B Mahol wrote: > >> On 10/8/10, Alexey Dokuchaev wrote: > >> > On Thu, Oct 07, 2010 at 08:43:37PM +0200, Bernhard Schmidt wrote: > >> >> Try the attached patch, this is basically the code from stable/6 > >> >> ported to head and stable/7. I did only some basic tests but monitor > >> >> mode seems to work and it is still possible to use the card in STA > >> >> mode. > >> > > >> > Unfortunately, I am getting instant panic when trying any of > >> > aircrack-ng suite utilities ("ifconfig iwi0 scan/list scan" works > >> > though): > >> > > >> > Fatal trap 12: page fault while in kernel mode > >> > processor eflags = interrupt enabled, resume, IOPL = 0 > >> > current process = 35 (iwi0 taskq) > >> > > >> > Any suggestions? > >> > >> 7.X is buggy regarding taskqueue, I think (maybe it is net80211 bug > >> and not iwi fault). > > > > That's a sad thing to hear about stable branch. > > > >> Does it panic with tcpdump too? > > > > Bernhard's tests indicate it's not. However, me doing "ifconfig iwi0 > > mediaopt monitor" here resulted in immediate panic (did not catch the > > core this time, but I'm positive it's the same as with aircrack-ng). > > Looks like SMP issue. > Let me look if it is something obvious. After having another cup of coffee it's pretty obvious what's wrong.. and I really wonder how that could have worked during my tests yesterday. Just to be sure I did the same tests again today and it still worked. The only difference between what I did and your scenario is, that I didn't use ifconfig iwi0 mediaopt monitor but ifconfig iwi0 monitor instead.. anyways.. ic != sc Attached patched should behave better now. alix# kldload if_iwi iwi0: mem 0xe0040000-0xe0040fff irq 10 at device 12.0 on pci0 iwi0: Ethernet address: 00:16:6f:64:37:68 iwi0: [ITHREAD] kalix# kldload wlan_scan_sta alix# ifconfig iwi0 -mediaopt monitor alix# ifconfig iwi0 channel 1 up alix# aireplay-ng -9 iwi0 00:34:10 Trying broadcast probe requests... 00:34:12 No Answer... 00:34:12 Found 1 AP 00:34:12 Trying directed probe requests... 00:34:12 00:15:6D:84:06:6B - channel: 1 - 'aplab' wi_write(): Input/output error wi_write(): Input/output error ^C/ 6: 0% alix# tcpdump -nei iwi0 -y IEEE802_11_RADIO tcpdump: data link type IEEE802_11_RADIO tcpdump: WARNING: iwi0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on iwi0, link-type IEEE802_11_RADIO (802.11 plus BSD radio information header), capture size 96 bytes 00:37:56.039527 1.0 Mb/s 2412 MHz 11g antenna 0 37dB signal BSSID:00:15:6d:84:06 :6b DA:ff:ff:ff:ff:ff:ff SA:00:15:6d:84:06:6b Beacon (aplab) [1.0* 2.0* 5.5* 11. 0* 6.0 9.0 12.0 18.0 Mbit] ESS CH: 1, PRIVACY -- Bernhard --Boundary-00=_Oa1rMALqoTlYxaa Content-Type: text/x-patch; charset="ISO-8859-1"; name="iwi_monitor-stable7.diff" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="iwi_monitor-stable7.diff" Index: sys/dev/iwi/if_iwivar.h =================================================================== --- sys/dev/iwi/if_iwivar.h (revision 213522) +++ sys/dev/iwi/if_iwivar.h (working copy) @@ -193,6 +193,7 @@ struct iwi_softc { struct task sc_scanaborttask; /* cancel active scan */ struct task sc_restarttask; /* restart adapter processing */ struct task sc_opstask; /* scan / auth processing */ + struct task sc_monitortask; unsigned int sc_softled : 1, /* enable LED gpio status */ sc_ledstate: 1, /* LED on/off state */ Index: sys/dev/iwi/if_iwi.c =================================================================== --- sys/dev/iwi/if_iwi.c (revision 213522) +++ sys/dev/iwi/if_iwi.c (working copy) @@ -163,6 +163,7 @@ static void iwi_release_fw_dma(struct iwi_softc *s static int iwi_config(struct iwi_softc *); static int iwi_get_firmware(struct iwi_softc *); static void iwi_put_firmware(struct iwi_softc *); +static void iwi_monitor_scan(void *, int); static int iwi_scanchan(struct iwi_softc *, unsigned long, int); static void iwi_scan_start(struct ieee80211com *); static void iwi_scan_end(struct ieee80211com *); @@ -291,6 +292,7 @@ iwi_attach(device_t dev) TASK_INIT(&sc->sc_restarttask, 0, iwi_restart, sc); TASK_INIT(&sc->sc_opstask, 0, iwi_ops, sc); TASK_INIT(&sc->sc_scanaborttask, 0, iwi_scanabort, sc); + TASK_INIT(&sc->sc_monitortask, 0, iwi_monitor_scan, sc); callout_init_mtx(&sc->sc_wdtimer, &sc->sc_mtx, 0); if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) { @@ -978,7 +980,8 @@ iwi_newstate(struct ieee80211com *ic, enum ieee802 */ if (ic->ic_state == IEEE80211_S_SCAN) iwi_assoc(ic); - } + } else if (ic->ic_opmode == IEEE80211_M_MONITOR) + taskqueue_enqueue(sc->sc_tq, &sc->sc_monitortask); break; case IEEE80211_S_INIT: /* @@ -1411,6 +1414,18 @@ iwi_notification_intr(struct iwi_softc *sc, struct IWI_STATE_END(sc, IWI_FW_SCANNING); + /* + * Monitor mode works by doing a passive scan to set + * the channel and enable rx. Because we don't want + * to abort a scan lest the firmware crash we scan + * for a short period of time and automatically restart + * the scan when notified the sweep has completed. + */ + if (ic->ic_opmode == IEEE80211_M_MONITOR) { + taskqueue_enqueue(sc->sc_tq, &sc->sc_monitortask); + break; + } + if (scan->status == IWI_SCAN_COMPLETED) ieee80211_scan_next(ic); @@ -2595,6 +2610,11 @@ iwi_config(struct iwi_softc *sc) config.answer_pbreq = (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0; config.disable_unicast_decryption = 1; config.disable_multicast_decryption = 1; + if (ic->ic_opmode == IEEE80211_M_MONITOR) { + config.allow_invalid_frames = 1; + config.allow_beacon_and_probe_resp = 1; + config.allow_mgt = 1; + } DPRINTF(("Configuring adapter\n")); error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config); if (error != 0) @@ -2717,6 +2737,18 @@ scan_band(const struct ieee80211_channel *c) return IEEE80211_IS_CHAN_5GHZ(c) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ; } +static void +iwi_monitor_scan(void *arg, int npending) +{ + struct ieee80211com *ic = arg; + struct iwi_softc *sc = ic->ic_ifp->if_softc; + IWI_LOCK_DECL; + + IWI_LOCK(sc); + (void) iwi_scanchan(sc, 2000, 0); + IWI_UNLOCK(sc); +} + /* * Start a scan on the current channel or all channels. */ --Boundary-00=_Oa1rMALqoTlYxaa--