Monitor mode not working for iwi(4) on 7.X

[Paul B Mahol]

On 10/8/10, Alexey Dokuchaev <danfe at freebsd.org> wrote:
> On Thu, Oct 07, 2010 at 08:43:37PM +0200, Bernhard Schmidt wrote:
>> Try the attached patch, this is basically the code from stable/6
>> ported to head and stable/7. I did only some basic tests but monitor
>> mode seems to work and it is still possible to use the card in STA
>> mode.
>>
>> I'm not sure why that got lost, but there must be a reason I'm not
>> seeing right now. If someone has more knowledge about that, please
>> let me know, otherwise I intend to commit it this weekend.
>
> Unfortunately, I am getting instant panic when trying any of aircrack-ng
> suite utilities ("ifconfig iwi0 scan/list scan" works though):
>
> Fatal trap 12: page fault while in kernel mode
> fault virtual address   = 0x0
> fault code              = supervisor read, page not present
> instruction pointer     = 0x20:0xc0768d42
> stack pointer           = 0x28:0xe4112c80
> frame pointer           = 0x28:0xe4112c98
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 35 (iwi0 taskq)
>
> (kgdb) bt
> ...
> #6  0xc060cae0 in trap_fatal (frame=0xe4112c40, eva=0)
>     at /usr/src/sys/i386/i386/trap.c:941
> #7  0xc060cd90 in trap_pfault (frame=0xe4112c40, usermode=0, eva=0)
>     at /usr/src/sys/i386/i386/trap.c:863
> #8  0xc060d7f7 in trap (frame=0xe4112c40) at
> /usr/src/sys/i386/i386/trap.c:541
> #9  0xc05f4d9b in calltrap () at /usr/src/sys/i386/i386/exception.s:166
> #10 0xc0768d42 in iwi_monitor_scan (arg=0xc3dcc000, npending=4)
>     at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2744
> ...
> (kgdb) f 10
> #10 0xc0768d42 in iwi_monitor_scan (arg=0xc3dcc000, npending=4)
>     at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2744
> 2744            struct iwi_softc *sc = ic->ic_ifp->if_softc;
> (kgdb) l
> 2739
> 2740    static void
> 2741    iwi_monitor_scan(void *arg, int npending)
> 2742    {
> 2743            struct ieee80211com *ic = arg;
> 2744            struct iwi_softc *sc = ic->ic_ifp->if_softc;
> 2745            IWI_LOCK_DECL;
> 2746
> 2747            IWI_LOCK(sc);
> 2748            (void) iwi_scanchan(sc, 2000, 0);
> (kgdb) p ((struct ieee80211com *)arg)->ic_ifp
> $1 = (struct ifnet *) 0x0
>
> Any suggestions?

7.X is buggy regarding tasqueue, I think (maybe it is net80211 bug and
not iwi fault).
Does it panic with tcpdump too?
Try to reproduce it on CURRENT.