Bug 296503 - [iwn] association to some APs is broken on recent -CURRENT
Summary: [iwn] association to some APs is broken on recent -CURRENT
Status: In Progress
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 16.0-CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-wireless (Nobody)
URL:
Keywords:
Depends on:
Blocks: 278175
  Show dependency treegraph
 
Reported: 2026-07-03 23:01 UTC by Adrian Chadd
Modified: 2026-07-03 23:16 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Adrian Chadd freebsd_committer freebsd_triage 2026-07-03 23:01:36 UTC
david wolfskill reported that iwn wasn't associating properly to some networks.

I reproduced a couple of cases at home - one is a bug in my migration to driver driven seqno assignment calls and one seems to be some interesting issues transmitting on CCK to newer hardware.

I'll track the former here; the latter will need some further diagnostics.
Comment 1 Adrian Chadd freebsd_committer freebsd_triage 2026-07-03 23:03:18 UTC
ok, so the culprit is that I didn't add ieee80211_output_seqno_assign() to iwn_tx_data_raw(), only to iwn_tx_data(). Some drivers implement the raw TX path as a wrapper around the non-raw path. iwn does not.

I'll need to go and audit the drivers again - just grep everything for calls to ieee80211_output_seqno_assign() and make sure it's happening on all of the transmit paths.
Comment 2 Adrian Chadd freebsd_committer freebsd_triage 2026-07-03 23:09:56 UTC
diff --git a/sys/dev/iwn/if_iwn.c b/sys/dev/iwn/if_iwn.c
index a949103f20d4..7fc013704253 100644
--- a/sys/dev/iwn/if_iwn.c
+++ b/sys/dev/iwn/if_iwn.c
@@ -4771,6 +4771,10 @@ iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m,
 
        ac = params->ibp_pri & 3;
 
+       /* Assign sequence number. */
+       if ((m->m_flags & M_AMPDU_MPDU) == 0)
+               ieee80211_output_seqno_assign(ni, -1, m);
+
        /* Choose a TX rate. */
        rate = params->ibp_rate0;
Comment 3 Adrian Chadd freebsd_committer freebsd_triage 2026-07-03 23:12:18 UTC
(Fwiw - I debugged this using wireshark and wifi capture using an RTL8821AU NIC in monitor mode; the authentication request frames had a sequence number that was very high and a fragment number that was also non-zero - turns out it was a 16 bit seqno/fragment field of '0xdead' :-)
Comment 4 Adrian Chadd freebsd_committer freebsd_triage 2026-07-03 23:12:39 UTC
Fixed in:

```
commit 830f690eb676ab1223bfc887a8d70691a355a656 (HEAD -> main, upstream/main, upstream/HEAD)
Author: Adrian Chadd <adrian@FreeBSD.org>
Date:   Fri Jul 3 16:06:22 2026 -0700

    iwn: assign sequence number to raw transmit frames
```
Comment 5 commit-hook freebsd_committer freebsd_triage 2026-07-03 23:13:03 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=830f690eb676ab1223bfc887a8d70691a355a656

commit 830f690eb676ab1223bfc887a8d70691a355a656
Author:     Adrian Chadd <adrian@FreeBSD.org>
AuthorDate: 2026-07-03 23:06:22 +0000
Commit:     Adrian Chadd <adrian@FreeBSD.org>
CommitDate: 2026-07-03 23:06:22 +0000

    iwn: assign sequence number to raw transmit frames

    This fixes associating to various APs.

    It worked fine to a FreeBSD AP (which is a wholly separate problem
    I'm going to need to dive into) but not to my tplink AX1800 Wifi-6
    router.

    PR: kern/296503

    Locally tested:

    * STA: Intel Centrino Advanced-N 6205 (iwn), Lenovo T420
    * AP: TP-Link AX1800 wifi-6 router

 sys/dev/iwn/if_iwn.c | 4 ++++
 1 file changed, 4 insertions(+)