Bug 242337
| Summary: | iwm - rate 0 causes iwm panic (and work around) | ||
|---|---|---|---|
| Product: | Base System | Reporter: | dirkx |
| Component: | wireless | Assignee: | freebsd-wireless (Nobody) <wireless> |
| Status: | New --- | ||
| Severity: | Affects Some People | CC: | dirkx, markj |
| Priority: | --- | ||
| Version: | 12.1-RELEASE | ||
| Hardware: | amd64 | ||
| OS: | Any | ||
|
Description
dirkx
2019-12-01 13:17:27 UTC
The standard IWM wifi card on a thinkpad X270 panics when it wants to talk to a dutch KPN-Experia ADLS/wifi router (a very common setup in the Netherlands). Panic/dmesg below. It then flaps up/down - but is unable to get a stable connection. iwm0: Start UMAC Error Log Dump: iwm0: Status: 0x83, count: 7 iwm0: 0x00000070 | ADVANCED_SYSASSERT iwm0: 0x00000000 | umac branchlink1 iwm0: 0xC008383C | umac branchlink2 iwm0: 0xC008166C | umac interruptlink1 iwm0: 0xC008166C | umac interruptlink2 iwm0: 0x00000800 | umac data1 iwm0: 0xC008166C | umac data2 iwm0: 0xDEADBEEF | umac data3 iwm0: 0x00000016 | umac major iwm0: 0x00058404 | umac minor iwm0: 0xC0886280 | frame pointer iwm0: 0xC0886280 | stack pointer iwm0: 0x0934004E | last host cmd iwm0: 0x00000000 | isr status reg iwm0: driver status: iwm0: tx ring 0: qid=0 cur=2 queued=0 iwm0: tx ring 1: qid=1 cur=0 queued=0 iwm0: tx ring 2: qid=2 cur=0 queued=0 iwm0: tx ring 3: qid=3 cur=0 queued=0 iwm0: tx ring 4: qid=4 cur=0 queued=0 iwm0: tx ring 5: qid=5 cur=0 queued=0 iwm0: tx ring 6: qid=6 cur=0 queued=0 iwm0: tx ring 7: qid=7 cur=0 queued=0 iwm0: tx ring 8: qid=8 cur=0 queued=0 iwm0: tx ring 9: qid=9 cur=53 queued=1 iwm0: tx ring 10: qid=10 cur=0 queued=0 iwm0: tx ring 11: qid=11 cur=0 queued=0 iwm0: tx ring 12: qid=12 cur=0 queued=0 iwm0: tx ring 13: qid=13 cur=0 queued=0 iwm0: tx ring 14: qid=14 cur=0 queued=0 iwm0: tx ring 15: qid=15 cur=0 queued=0 iwm0: tx ring 16: qid=16 cur=0 queued=0 iwm0: tx ring 17: qid=17 cur=0 queued=0 iwm0: tx ring 18: qid=18 cur=0 queued=0 iwm0: tx ring 19: qid=19 cur=0 queued=0 iwm0: tx ring 20: qid=20 cur=0 queued=0 iwm0: tx ring 21: qid=21 cur=0 queued=0 iwm0: tx ring 22: qid=22 cur=0 queued=0 iwm0: tx ring 23: qid=23 cur=0 queued=0 iwm0: tx ring 24: qid=24 cur=0 queued=0 iwm0: tx ring 25: qid=25 cur=0 queued=0 iwm0: tx ring 26: qid=26 cur=0 queued=0 iwm0: tx ring 27: qid=27 cur=0 queued=0 iwm0: tx ring 28: qid=28 cur=0 queued=0 iwm0: tx ring 29: qid=29 cur=0 queued=0 iwm0: tx ring 30: qid=30 cur=0 queued=0 iwm0: rx ring: cur=80 iwm0: 802.11 state 3 iwm0: iwm_intr: controller panicked, iv_state = 3; restarting iwm0: iwm_newstate: IWM_LQ_CMD failed: 35 iwm0: iwm_rate2ridx: WARNING: device rate for 0 not found! iwm0: iwm_rate2ridx: WARNING: device rate for 0 not found! iwm0: dumping device error log iwm0: Start Error Log Dump: iwm0: Status: 0x83, count: 6 iwm0: 0x00002078 | ADVANCED_SYSASSERT iwm0: 00A00220 | trm_hw_status0 iwm0: 00000000 | trm_hw_status1 iwm0: 0000E9C8 | branchlink2 iwm0: 0002843C | interruptlink1 iwm0: 00000000 | interruptlink2 iwm0: 00000000 | data1 iwm0: 00000000 | data2 iwm0: DEADBEEF | data3 iwm0: 00014E39 | beacon time iwm0: 4494D2A2 | tsf low iwm0: 00000055 | tsf hi iwm0: 00000000 | time gp1 iwm0: 00E55138 | time gp2 iwm0: 00000000 | uCode revision type iwm0: 00000016 | uCode version major iwm0: 00058404 | uCode version minor iwm0: 00000201 | hw version iwm0: 00009008 | board version iwm0: 0936004E | hcmd iwm0: 24022080 | isr0 iwm0: 01000000 | isr1 iwm0: 08205802 | isr2 iwm0: 00417CC0 | isr3 iwm0: 00000000 | isr4 iwm0: 04000118 | last cmd Id iwm0: 00000000 | wait_event iwm0: 00000288 | l2p_control iwm0: 00018030 | l2p_duration iwm0: 000000BF | l2p_mhvalid iwm0: 000000EF | l2p_addr_match iwm0: 0000000D | lmpm_pmg_sel iwm0: 03071928 | timestamp iwm0: 00008090 | flow_handler iwm0: Start UMAC Error Log Dump: iwm0: Status: 0x83, count: 7 iwm0: 0x00000070 | ADVANCED_SYSASSERT iwm0: 0x00000000 | umac branchlink1 iwm0: 0xC008383C | umac branchlink2 iwm0: 0xC008166C | umac interruptlink1 iwm0: 0xC008166C | umac interruptlink2 iwm0: 0x00000800 | umac data1 iwm0: 0xC008166C | umac data2 iwm0: 0xDEADBEEF | umac data3 iwm0: 0x00000016 | umac major iwm0: 0x00058404 | umac minor iwm0: 0xC0886280 | frame pointer iwm0: 0xC0886280 | stack pointer iwm0: 0x0936004E | last host cmd iwm0: 0x00000000 | isr status reg iwm0: driver status: iwm0: tx ring 0: qid=0 cur=2 queued=0 iwm0: tx ring 1: qid=1 cur=0 queued=0 iwm0: tx ring 2: qid=2 cur=0 queued=0 iwm0: tx ring 3: qid=3 cur=0 queued=0 iwm0: tx ring 4: qid=4 cur=0 queued=0 iwm0: tx ring 5: qid=5 cur=0 queued=0 iwm0: tx ring 6: qid=6 cur=0 queued=0 iwm0: tx ring 7: qid=7 cur=0 queued=0 iwm0: tx ring 8: qid=8 cur=0 queued=0 iwm0: tx ring 9: qid=9 cur=55 queued=1 iwm0: tx ring 10: qid=10 cur=0 queued=0 iwm0: tx ring 11: qid=11 cur=0 queued=0 iwm0: tx ring 12: qid=12 cur=0 queued=0 iwm0: tx ring 13: qid=13 cur=0 queued=0 iwm0: tx ring 14: qid=14 cur=0 queued=0 iwm0: tx ring 15: qid=15 cur=0 queued=0 iwm0: tx ring 16: qid=16 cur=0 queued=0 iwm0: tx ring 17: qid=17 cur=0 queued=0 iwm0: tx ring 18: qid=18 cur=0 queued=0 iwm0: tx ring 19: qid=19 cur=0 queued=0 iwm0: tx ring 20: qid=20 cur=0 queued=0 iwm0: tx ring 21: qid=21 cur=0 queued=0 iwm0: tx ring 22: qid=22 cur=0 queued=0 iwm0: tx ring 23: qid=23 cur=0 queued=0 iwm0: tx ring 24: qid=24 cur=0 queued=0 iwm0: tx ring 25: qid=25 cur=0 queued=0 iwm0: tx ring 26: qid=26 cur=0 queued=0 iwm0: tx ring 27: qid=27 cur=0 queued=0 iwm0: tx ring 28: qid=28 cur=0 queued=0 iwm0: tx ring 29: qid=29 cur=0 queued=0 iwm0: tx ring 30: qid=30 cur=0 queued=0 iwm0: rx ring: cur=134 iwm0: 802.11 state 3 iwm0: iwm_intr: controller panicked, iv_state = 3; restarting iwm0: iwm_newstate: IWM_LQ_CMD failed: 35 iwm0: iwm_rate2ridx: WARNING: device rate for 0 not found! iwm0: iwm_rate2ridx: WARNING: device rate for 0 not found! iwm0: dumping device error log iwm0: Start Error Log Dump: iwm0: Status: 0x83, count: 6 iwm0: 0x00002078 | ADVANCED_SYSASSERT iwm0: 00A00220 | trm_hw_status0 iwm0: 00000000 | trm_hw_status1 iwm0: 0000E9C8 | branchlink2 iwm0: 0002843C | interruptlink1 iwm0: 00000000 | interruptlink2 iwm0: 00000000 | data1 iwm0: 00000000 | data2 iwm0: DEADBEEF | data3 iwm0: 00017F0F | beacon time iwm0: 4650619F | tsf low iwm0: 00000055 | tsf hi iwm0: 00000000 | time gp1 iwm0: 0137F04B | time gp2 iwm0: 00000000 | uCode revision type iwm0: 00000016 | uCode version major iwm0: 00058404 | uCode version minor iwm0: 00000201 | hw version iwm0: 00009008 | board version iwm0: 0937004E | hcmd iwm0: 24022080 | isr0 iwm0: 01000000 | isr1 iwm0: 08201802 | isr2 iwm0: 00417CC0 | isr3 iwm0: 00000000 | isr4 iwm0: 04000118 | last cmd Id iwm0: 00000000 | wait_event iwm0: 00000288 | l2p_control iwm0: 00018030 | l2p_duration iwm0: 000000BF | l2p_mhvalid iwm0: 000000EF | l2p_addr_match iwm0: 0000000D | lmpm_pmg_sel iwm0: 03071928 | timestamp iwm0: 000090A0 | flow_handler iwm0: Start UMAC Error Log Dump: iwm0: Status: 0x83, count: 7 iwm0: 0x00000070 | ADVANCED_SYSASSERT iwm0: 0x00000000 | umac branchlink1 iwm0: 0xC008383C | umac branchlink2 iwm0: 0xC008166C | umac interruptlink1 iwm0: 0xC008166C | umac interruptlink2 iwm0: 0x00000800 | umac data1 iwm0: 0xC008166C | umac data2 iwm0: 0xDEADBEEF | umac data3 iwm0: 0x00000016 | umac major iwm0: 0x00058404 | umac minor iwm0: 0xC0886280 | frame pointer iwm0: 0xC0886280 | stack pointer iwm0: 0x0937004E | last host cmd iwm0: 0x00000000 | isr status reg iwm0: driver status: iwm0: tx ring 0: qid=0 cur=2 queued=0 iwm0: tx ring 1: qid=1 cur=0 queued=0 iwm0: tx ring 2: qid=2 cur=0 queued=0 iwm0: tx ring 3: qid=3 cur=0 queued=0 iwm0: tx ring 4: qid=4 cur=0 queued=0 iwm0: tx ring 5: qid=5 cur=0 queued=0 iwm0: tx ring 6: qid=6 cur=0 queued=0 iwm0: tx ring 7: qid=7 cur=0 queued=0 iwm0: tx ring 8: qid=8 cur=0 queued=0 iwm0: tx ring 9: qid=9 cur=56 queued=1 iwm0: tx ring 10: qid=10 cur=0 queued=0 iwm0: tx ring 11: qid=11 cur=0 queued=0 iwm0: tx ring 12: qid=12 cur=0 queued=0 iwm0: tx ring 13: qid=13 cur=0 queued=0 iwm0: tx ring 14: qid=14 cur=0 queued=0 iwm0: tx ring 15: qid=15 cur=0 queued=0 iwm0: tx ring 16: qid=16 cur=0 queued=0 iwm0: tx ring 17: qid=17 cur=0 queued=0 iwm0: tx ring 18: qid=18 cur=0 queued=0 iwm0: tx ring 19: qid=19 cur=0 queued=0 iwm0: tx ring 20: qid=20 cur=0 queued=0 iwm0: tx ring 21: qid=21 cur=0 queued=0 iwm0: tx ring 22: qid=22 cur=0 queued=0 iwm0: tx ring 23: qid=23 cur=0 queued=0 iwm0: tx ring 24: qid=24 cur=0 queued=0 iwm0: tx ring 25: qid=25 cur=0 queued=0 iwm0: tx ring 26: qid=26 cur=0 queued=0 iwm0: tx ring 27: qid=27 cur=0 queued=0 iwm0: tx ring 28: qid=28 cur=0 queued=0 iwm0: tx ring 29: qid=29 cur=0 queued=0 iwm0: tx ring 30: qid=30 cur=0 queued=0 iwm0: rx ring: cur=152 iwm0: 802.11 state 3 iwm0: iwm_intr: controller panicked, iv_state = 3; restarting iwm0: iwm_newstate: IWM_LQ_CMD failed: 35 iwm0: iwm_rate2ridx: WARNING: device rate for 0 not found! iwm0: iwm_rate2ridx: WARNING: device rate for 0 not found! iwm0: dumping device error log iwm0: Start Error Log Dump: iwm0: Status: 0x83, count: 6 iwm0: 0x00002078 | ADVANCED_SYSASSERT iwm0: 00A00220 | trm_hw_status0 iwm0: 00000000 | trm_hw_status1 iwm0: 0000E9C8 | branchlink2 iwm0: 0002843C | interruptlink1 iwm0: 00000000 | interruptlink2 iwm0: 00000000 | data1 iwm0: 00000000 | data2 iwm0: DEADBEEF | data3 iwm0: 0001764F | beacon time iwm0: 4955DA2D | tsf low iwm0: 00000055 | tsf hi iwm0: 00000000 | time gp1 iwm0: 020F98F2 | time gp2 iwm0: 00000000 | uCode revision type iwm0: 00000016 | uCode version major iwm0: 00058404 | uCode version minor iwm0: 00000201 | hw version iwm0: 00009008 | board version iwm0: 0939004E | hcmd iwm0: 24022080 | isr0 iwm0: 01000000 | isr1 iwm0: 08201802 | isr2 iwm0: 00417CC0 | isr3 iwm0: 00000000 | isr4 iwm0: 04000118 | last cmd Id iwm0: 00000000 | wait_event iwm0: 00000288 | l2p_control iwm0: 00018030 | l2p_duration iwm0: 000000BF | l2p_mhvalid iwm0: 000000EF | l2p_addr_match iwm0: 0000000D | lmpm_pmg_sel iwm0: 03071928 | timestamp iwm0: 0000C0D0 | flow_handler iwm0: Start UMAC Error Log Dump: iwm0: Status: 0x83, count: 7 iwm0: 0x00000070 | ADVANCED_SYSASSERT iwm0: 0x00000000 | umac branchlink1 iwm0: 0xC008383C | umac branchlink2 iwm0: 0xC008166C | umac interruptlink1 iwm0: 0xC008166C | umac interruptlink2 iwm0: 0x00000800 | umac data1 iwm0: 0xC008166C | umac data2 iwm0: 0xDEADBEEF | umac data3 iwm0: 0x00000016 | umac major iwm0: 0x00058404 | umac minor iwm0: 0xC0886280 | frame pointer iwm0: 0xC0886280 | stack pointer iwm0: 0x0939004E | last host cmd iwm0: 0x00000000 | isr status reg iwm0: driver status: iwm0: tx ring 0: qid=0 cur=2 queued=0 iwm0: tx ring 1: qid=1 cur=0 queued=0 iwm0: tx ring 2: qid=2 cur=0 queued=0 iwm0: tx ring 3: qid=3 cur=0 queued=0 iwm0: tx ring 4: qid=4 cur=0 queued=0 iwm0: tx ring 5: qid=5 cur=0 queued=0 iwm0: tx ring 6: qid=6 cur=0 queued=0 iwm0: tx ring 7: qid=7 cur=0 queued=0 iwm0: tx ring 8: qid=8 cur=0 queued=0 iwm0: tx ring 9: qid=9 cur=58 queued=1 iwm0: tx ring 10: qid=10 cur=0 queued=0 iwm0: tx ring 11: qid=11 cur=0 queued=0 iwm0: tx ring 12: qid=12 cur=0 queued=0 iwm0: tx ring 13: qid=13 cur=0 queued=0 iwm0: tx ring 14: qid=14 cur=0 queued=0 iwm0: tx ring 15: qid=15 cur=0 queued=0 iwm0: tx ring 16: qid=16 cur=0 queued=0 iwm0: tx ring 17: qid=17 cur=0 queued=0 iwm0: tx ring 18: qid=18 cur=0 queued=0 iwm0: tx ring 19: qid=19 cur=0 queued=0 iwm0: tx ring 20: qid=20 cur=0 queued=0 iwm0: tx ring 21: qid=21 cur=0 queued=0 iwm0: tx ring 22: qid=22 cur=0 queued=0 iwm0: tx ring 23: qid=23 cur=0 queued=0 iwm0: tx ring 24: qid=24 cur=0 queued=0 iwm0: tx ring 25: qid=25 cur=0 queued=0 iwm0: tx ring 26: qid=26 cur=0 queued=0 iwm0: tx ring 27: qid=27 cur=0 queued=0 iwm0: tx ring 28: qid=28 cur=0 queued=0 iwm0: tx ring 29: qid=29 cur=0 queued=0 iwm0: tx ring 30: qid=30 cur=0 queued=0 iwm0: rx ring: cur=197 iwm0: 802.11 state 3 iwm0: iwm_intr: controller panicked, iv_state = 3; restarting iwm0: iwm_newstate: IWM_LQ_CMD failed: 35 iwm0: detached As a workaround - in if_iwm.c -- simply picking the first rate from the table (the slowest) makes things work again although it emits below error:
iwm0: frame 0/230 b800002c UNHANDLED (this should not happen)
tun0: link state changed to UP
Function changed below.
static int
iwm_rate2ridx(struct iwm_softc *sc, uint8_t rate)
{
int i;
for (i = 0; i <= IWM_RIDX_MAX; i++) {
if (iwm_rates[i].rate == rate)
return i;
}
device_printf(sc->sc_dev,
"%s: WARNING: device rate for %u not found!!\n",
__func__, rate);
// On KPN Experia ADSL modems - one somehow gets a rate==0;
// just picking the first value from the table works.
if (rate == 0) {
device_printf(sc->sc_dev,
"%s: WARNING: using first rate fom the table.\n",
__func__);
return 0;
};
return -1;
}
It seems that it is not just the KPN/Telfort/Tele2 Experia v8 boxes that have this issue - but a lot of other Arcadyan based wifi access points as well. Hmm, note that one of the callers of iwm_rate2idx() already contains this logic (i.e., maps an unknown rate to the lowest one).
I guess the problem is with the code which programs the fw rate table. iwm_setrates() already skips over invalid rates... but the code which fills in the rest of the table is wrong.
Can you try this hack instead? I did not test it.
There is a larger issue here in that we are ending up with a rate of 0, but we can at least avoid panicking.
diff --git a/sys/dev/iwm/if_iwm.c b/sys/dev/iwm/if_iwm.c
index 06bd66cc3ef6..4bd6547cc57f 100644
--- a/sys/dev/iwm/if_iwm.c
+++ b/sys/dev/iwm/if_iwm.c
@@ -4385,8 +4385,10 @@ iwm_setrates(struct iwm_softc *sc, struct iwm_node *in, int rix)
/* Map 802.11 rate to HW rate index. */
ridx = iwm_rate2ridx(sc, rate);
- if (ridx == -1)
+ if (ridx == -1) {
+ nrates--;
continue;
+ }
#if 0
if (txant == 0)
Yes - works splendidly & with both types of ADSL modems. I do get a few iwm0: frame 2/189 b800002c UNHANDLED (this should not happen) which I've not seen in that place before. Reproducible with a currently supported version of FreeBSD? |
