linux-kernel - Re: wlwifi AX201: WARN_ON in iwl_mvm_mld_mac_ctxt_cmd_common repeated UMAC FW crashes on 6.16-rc2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAL=B37n6Bc998K5nSS15uL6fMfMom4g-Jbtqq57W=nS7eSSfHw@mail.gmail.com>
Date: Mon, 23 Jun 2025 06:00:01 +0200
From: Damian Tometzki <damian@...cv-rocks.de>
To: Hugh Dickins <hughd@...gle.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>, miriam.rachel.korenblit@...el.com, 
	linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: wlwifi AX201: WARN_ON in iwl_mvm_mld_mac_ctxt_cmd_common repeated
 UMAC FW crashes on 6.16-rc2

On Mon, Jun 23, 2025 at 2:00 AM Hugh Dickins <hughd@...gle.com> wrote:
>
> On Sun, 22 Jun 2025, Damian Tometzki wrote:
> > On Sun, Jun 22, 2025 at 6:30 PM Damian Tometzki <damian@...cv-rocks.de> wrote:
> > >
> > > Hi Miri,
> > > Hi all,
> > >
> > > with v6.16-rc2 I consistently hit a Wi-Fi firmware crash on a
> > > Lenovo ThinkPad X1 Carbon Gen 9.
> > >
> > > Hardware / FW
> > > -------------
> > >  * NIC  : Intel Wi-Fi 6 AX201 160 MHz (PCI ID a0f0:0070, rev 0x351)
> > >  * FW   : 77.864baa2e.0 QuZ-a0-hr-b0-77.ucode (auto-loaded)
> > >  * BIOS : N32ET96W (1.72)
> > >  * Platform: 20XWCTO1WW
> > >
> > > Kernel: 6.16.0-rc2 #440 PREEMPT(lazy)
> > >
> > > Symptoms
> > > --------
> > > Immediately after NetworkManager (or plain `ip link set wlp0s20f3 up`)
> > > the driver warns:
> > >
> > >     WARNING at drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c:37
> > >     iwl_mvm_mld_mac_ctxt_cmd_common+0x175/0x1d0
> > >
> > > The firmware then aborts:
> > >
> > >     FW error in SYNC CMD MAC_CONFIG_CMD
> > >     NMI_INTERRUPT_UMAC_FATAL
> > >     ADVANCED_SYSASSERT 0x20103126
> > >     Microcode SW error detected. Restarting 0x0.
> > >
> > > The cycle repeats every few seconds; the interface never becomes usable.
> > > Full dmesg attached.
> > >
> > > --
> > > VG
> > > Demian Tometzki
> >
> > Hi together,
> >
> > I identified commit 83f3ac2848b46e3e5af5d06b5f176c as the cause of the issue.
> > After reverting it, the system is working again.
> >
> > Best regards
> > Damian
>
> I have a similar Lenovo X1 Carbon Gen 9: saw no problem on rc1 or rc2,
> but vey much this problem on today's 6.16-rc3.
>
> Patch from Miri's reply (attachment without context so I'm replying
> to this not that) inlined below, works nicely for me: thank you.
> I've removed Change-Id and Organization tags.
>
> Hugh
Hi together,

for me, the fix resolved the issue too. Many thanks for the help and patch.

Attached my dmesg.

Many thanks
Damian


>
> From: Miri Korenblit <miriam.rachel.korenblit@...el.com>
> Date: Sun, 22 Jun 2025 23:42:04 +0300
> Subject: [PATCH] wifi: iwlwifi: mvm: assume '1' as the default mac_config_cmd
>  version
>
> Unfortunately, FWs of some devices don't have the version of the
> iwl_mac_config_cmd defined in the TLVs. We send 0 as the 'def argument
> to  iwl_fw_lookup_cmd_ver, so for such FWs, the return value will be 0,
> leading to a warning, and to not sending the command.
>
> Fix this by assuming that the default version is 1.
>
> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@...el.com>
> ---
>  drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
> index 3c255ae916c8..48ab6a2a98cc 100644
> --- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
> +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
> @@ -32,7 +32,7 @@ static void iwl_mvm_mld_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
>         unsigned int link_id;
>         int cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw,
>                                             WIDE_ID(MAC_CONF_GROUP,
> -                                                   MAC_CONFIG_CMD), 0);
> +                                                   MAC_CONFIG_CMD), 1);
>
>         if (WARN_ON(cmd_ver < 1 || cmd_ver > 3))
>                 return;
> --
> 2.34.1

View attachment "dmesg.txt" of type "text/plain" (96589 bytes)