Date: Fri, 8 Oct 2010 19:44:50 +0200 From: Bernhard Schmidt <bschmidt@techwires.net> To: Paul B Mahol <onemda@gmail.com> Cc: Alexey Dokuchaev <danfe@freebsd.org>, net@freebsd.org Subject: Re: Monitor mode not working for iwi(4) on 7.X Message-ID: <201010081944.50287.bschmidt@techwires.net> In-Reply-To: <201010081936.14269.bschmidt@techwires.net> References: <4763016D.7060100@janh.de> <AANLkTikopXOR8aT1=T=Tz5D=Fb_OJh7wk-W2SsvhnMtO@mail.gmail.com> <201010081936.14269.bschmidt@techwires.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Friday 08 October 2010 19:36:13 Bernhard Schmidt wrote:
> On Friday 08 October 2010 18:59:44 Paul B Mahol wrote:
> > On 10/8/10, Alexey Dokuchaev <danfe@freebsd.org> wrote:
> > > On Fri, Oct 08, 2010 at 03:20:08PM +0000, Paul B Mahol wrote:
> > >> On 10/8/10, Alexey Dokuchaev <danfe@freebsd.org> wrote:
> > >> > On Thu, Oct 07, 2010 at 08:43:37PM +0200, Bernhard Schmidt wrote:
> > >> >> Try the attached patch, this is basically the code from stable/6
> > >> >> ported to head and stable/7. I did only some basic tests but
> > >> >> monitor mode seems to work and it is still possible to use the
> > >> >> card in STA mode.
> > >> >
> > >> > Unfortunately, I am getting instant panic when trying any of
> > >> > aircrack-ng suite utilities ("ifconfig iwi0 scan/list scan" works
> > >> > though):
> > >> >
> > >> > Fatal trap 12: page fault while in kernel mode
> > >> > processor eflags = interrupt enabled, resume, IOPL = 0
> > >> > current process = 35 (iwi0 taskq)
> > >> >
> > >> > Any suggestions?
> > >>
> > >> 7.X is buggy regarding taskqueue, I think (maybe it is net80211 bug
> > >> and not iwi fault).
> > >
> > > That's a sad thing to hear about stable branch.
> > >
> > >> Does it panic with tcpdump too?
> > >
> > > Bernhard's tests indicate it's not. However, me doing "ifconfig iwi0
> > > mediaopt monitor" here resulted in immediate panic (did not catch the
> > > core this time, but I'm positive it's the same as with aircrack-ng).
> >
> > Looks like SMP issue.
> > Let me look if it is something obvious.
>
> After having another cup of coffee it's pretty obvious what's wrong.. and I
> really wonder how that could have worked during my tests yesterday. Just to
> be sure I did the same tests again today and it still worked. The only
> difference between what I did and your scenario is, that I didn't use
> ifconfig iwi0 mediaopt monitor
> but
> ifconfig iwi0 monitor
> instead.. anyways..
>
> ic != sc
>
> Attached patched should behave better now.
Sorry.. correct one this time.
> alix# kldload if_iwi
> iwi0: <Intel(R) PRO/Wireless 2200BG> mem 0xe0040000-0xe0040fff irq 10 at
> device
> 12.0 on pci0
> iwi0: Ethernet address: 00:16:6f:64:37:68
> iwi0: [ITHREAD]
> kalix# kldload wlan_scan_sta
> alix# ifconfig iwi0 -mediaopt monitor
> alix# ifconfig iwi0 channel 1 up
> alix# aireplay-ng -9 iwi0
> 00:34:10 Trying broadcast probe requests...
> 00:34:12 No Answer...
> 00:34:12 Found 1 AP
>
> 00:34:12 Trying directed probe requests...
> 00:34:12 00:15:6D:84:06:6B - channel: 1 - 'aplab'
> wi_write(): Input/output error
> wi_write(): Input/output error
> ^C/ 6: 0%
> alix# tcpdump -nei iwi0 -y IEEE802_11_RADIO
> tcpdump: data link type IEEE802_11_RADIO
> tcpdump: WARNING: iwi0: no IPv4 address assigned
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on iwi0, link-type IEEE802_11_RADIO (802.11 plus BSD radio
> information
> header), capture size 96 bytes
> 00:37:56.039527 1.0 Mb/s 2412 MHz 11g antenna 0 37dB signal
> BSSID:00:15:6d:84:06
>
> :6b DA:ff:ff:ff:ff:ff:ff SA:00:15:6d:84:06:6b Beacon (aplab) [1.0* 2.0*
> :5.5*
>
> 11.
> 0* 6.0 9.0 12.0 18.0 Mbit] ESS CH: 1, PRIVACY
--
Bernhard
[-- Attachment #2 --]
Index: sys/dev/iwi/if_iwivar.h
===================================================================
--- sys/dev/iwi/if_iwivar.h (revision 213584)
+++ sys/dev/iwi/if_iwivar.h (working copy)
@@ -193,6 +193,7 @@ struct iwi_softc {
struct task sc_scanaborttask; /* cancel active scan */
struct task sc_restarttask; /* restart adapter processing */
struct task sc_opstask; /* scan / auth processing */
+ struct task sc_monitortask;
unsigned int sc_softled : 1, /* enable LED gpio status */
sc_ledstate: 1, /* LED on/off state */
Index: sys/dev/iwi/if_iwi.c
===================================================================
--- sys/dev/iwi/if_iwi.c (revision 213584)
+++ sys/dev/iwi/if_iwi.c (working copy)
@@ -163,6 +163,7 @@ static void iwi_release_fw_dma(struct iwi_softc *s
static int iwi_config(struct iwi_softc *);
static int iwi_get_firmware(struct iwi_softc *);
static void iwi_put_firmware(struct iwi_softc *);
+static void iwi_monitor_scan(void *, int);
static int iwi_scanchan(struct iwi_softc *, unsigned long, int);
static void iwi_scan_start(struct ieee80211com *);
static void iwi_scan_end(struct ieee80211com *);
@@ -291,6 +292,7 @@ iwi_attach(device_t dev)
TASK_INIT(&sc->sc_restarttask, 0, iwi_restart, sc);
TASK_INIT(&sc->sc_opstask, 0, iwi_ops, sc);
TASK_INIT(&sc->sc_scanaborttask, 0, iwi_scanabort, sc);
+ TASK_INIT(&sc->sc_monitortask, 0, iwi_monitor_scan, sc);
callout_init_mtx(&sc->sc_wdtimer, &sc->sc_mtx, 0);
if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
@@ -978,7 +980,8 @@ iwi_newstate(struct ieee80211com *ic, enum ieee802
*/
if (ic->ic_state == IEEE80211_S_SCAN)
iwi_assoc(ic);
- }
+ } else if (ic->ic_opmode == IEEE80211_M_MONITOR)
+ taskqueue_enqueue(sc->sc_tq, &sc->sc_monitortask);
break;
case IEEE80211_S_INIT:
/*
@@ -1411,6 +1414,18 @@ iwi_notification_intr(struct iwi_softc *sc, struct
IWI_STATE_END(sc, IWI_FW_SCANNING);
+ /*
+ * Monitor mode works by doing a passive scan to set
+ * the channel and enable rx. Because we don't want
+ * to abort a scan lest the firmware crash we scan
+ * for a short period of time and automatically restart
+ * the scan when notified the sweep has completed.
+ */
+ if (ic->ic_opmode == IEEE80211_M_MONITOR) {
+ taskqueue_enqueue(sc->sc_tq, &sc->sc_monitortask);
+ break;
+ }
+
if (scan->status == IWI_SCAN_COMPLETED)
ieee80211_scan_next(ic);
@@ -2595,6 +2610,11 @@ iwi_config(struct iwi_softc *sc)
config.answer_pbreq = (ic->ic_opmode == IEEE80211_M_IBSS) ? 1 : 0;
config.disable_unicast_decryption = 1;
config.disable_multicast_decryption = 1;
+ if (ic->ic_opmode == IEEE80211_M_MONITOR) {
+ config.allow_invalid_frames = 1;
+ config.allow_beacon_and_probe_resp = 1;
+ config.allow_mgt = 1;
+ }
DPRINTF(("Configuring adapter\n"));
error = iwi_cmd(sc, IWI_CMD_SET_CONFIG, &config, sizeof config);
if (error != 0)
@@ -2717,6 +2737,17 @@ scan_band(const struct ieee80211_channel *c)
return IEEE80211_IS_CHAN_5GHZ(c) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ;
}
+static void
+iwi_monitor_scan(void *arg, int npending)
+{
+ struct iwi_softc *sc = arg;
+ IWI_LOCK_DECL;
+
+ IWI_LOCK(sc);
+ (void) iwi_scanchan(sc, 2000, 0);
+ IWI_UNLOCK(sc);
+}
+
/*
* Start a scan on the current channel or all channels.
*/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201010081944.50287.bschmidt>