Date: Tue, 21 Jul 2026 11:20:05 +0000 From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 296953] iwlwifi crashed at RX BA restart Message-ID: <bug-296953-21060@https.bugs.freebsd.org/bugzilla/>
index | next in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296953 Bug ID: 296953 Summary: iwlwifi crashed at RX BA restart Product: Base System Version: 16.0-CURRENT Hardware: amd64 OS: Any Status: New Severity: Affects Many People Priority: --- Component: wireless Assignee: wireless@FreeBSD.org Reporter: slw@zxy.spb.ru Created attachment 273049 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273049&action=edit fix RX BA crash iwlwifi(4)/AX211: reproducible fw crash ADVANCED_SYSASSERT 0x2010350B in RX_BAID_ALLOCATION_CONFIG_CMD on ADDBA (hw_crypto=1) After enabling compat.linuxkpi.80211.hw_crypto=1 I am getting reproducible firmware crashes on an AX211, always with the same signature: the crash happens the moment the AP sends an ADDBA request and net80211 accepts the A-MPDU RX session. 6 crashes within ~6 hours of normal use, all identical. iwlwifi0: UMAC CURRENT PC: 0x80284cac iwlwifi0: LMAC1 CURRENT PC: 0xd0 iwlwifi0: FW error in SYNC CMD UNKNOWN #0 0xffffffff80e6d17b at linux_dump_stack+0x1b #1 0xffffffff84eef096 at iwl_trans_pcie_send_hcmd+0x406 #2 0xffffffff84ecbd9a at iwl_trans_send_cmd+0x6a #3 0xffffffff84f3414c at iwl_mvm_send_cmd_status+0x2c #4 0xffffffff84f25eb5 at iwl_mvm_sta_rx_agg+0x285 #5 0xffffffff84efb3a8 at iwl_mvm_mac_ampdu_action+0x238 #6 0xffffffff80e5c3da at lkpi_ic_ampdu_rx_start+0x13a #7 0xffffffff80d6561d at ht_recv_action_ba_addba_request+0x13d #8 0xffffffff80e64599 at lkpi_iv_sta_recv_mgmt+0x19 #9 0xffffffff80d9042b at sta_input+0xc8b #10 0xffffffff80d69a50 at ieee80211_input_mimo+0x1f0 #11 0xffffffff80e56d98 at lkpi_80211_lhw_rxq_task+0x148 #12 0xffffffff80c38d7e at taskqueue_run_locked+0x18e #13 0xffffffff80c39f42 at taskqueue_thread_loop+0xc2 #14 0xffffffff80b843db at fork_exit+0x7b #15 0xffffffff810d9b4e at fork_trampoline+0xe iwlwifi0: lkpi_ic_ampdu_rx_start: mo_ampdu_action returned -5. ni 0xfffffe0199012000 rap 0xfffffe0199012d58 iwlwifi0: WRT: Collecting data: ini trigger 4 fired (delay=0ms). iwlwifi0: Device error - SW reset Claude code do next analyze: ==== net80211 does not tear down a running RX BA session before accepting a new ADDBA request on the same TID. ht_recv_action_ba_addba_request() (sys/net80211/ieee80211_ht.c) unconditionally calls ic_ampdu_rx_start() and net80211's own software handler ampdu_rx_start() copes with the restart by just purging and re-initializing the reorder queue (see the IEEE80211_AGGR_RUNNING check around ieee80211_ht.c:697-708). LinuxKPI forwards this as a second IEEE80211_AMPDU_RX_START to the driver without an intervening RX_STOP. mac80211 guarantees drivers a stop of the running session before the next start on the same TID (net/mac80211/agg-rx.c tears the old session down first), so iwlwifi does not handle the duplicate: iwl_mvm_sta_rx_agg() sends a second RX_BAID_ALLOCATION_CONFIG_CMD/ADD for the same (sta, tid) and the firmware asserts (ADVANCED_SYSASSERT 0x2010350B). That matches the observed trigger: the peer re-sends an ADDBA request after a timeout or a lost ADDBA response (this link runs at low MCS, so that happens regularly). Note lkpi_ic_ampdu_rx_stop() already guards the mirror case ("we should not call into mac80211 ops with AMPDU_RX_STOP if we did not START", with the same IEEE80211_AGGR_RUNNING check); the START side was simply missing the equivalent handling. Patch below: emulate the mac80211 semantics in lkpi_ic_ampdu_rx_start() by sending RX_STOP for the running session first. === Result on my system (AX211, fw 89, hw_crypto=1): with this patch the box went from 6 identical firmware crashes in ~6 hours to zero crashes since (A-MPDU RX active, >12h uptime including bulk traffic). -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-296953-21060>