Bug 1738361

Summary: Intel AX200 iwlwifi firmware fails on 5.2.5, 5.2.6, 5.2.7, 5.2.8, regression from 5.1.20: loads ver 48 instead of 46
Product: [Fedora] Fedora Reporter: Arcadiy Ivanov <arcadiy>
Component: iwlwifi-firmwareAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED UPSTREAM QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 30CC: airlied, bskeggs, christian.ohrfandl, daniel.a.jenson, extras-orphan, hdegoede, ichavero, itamar, jarodwilson, jeremy, jglisse, john.j5live, jonathan, josef, kernel-maint, linville, matthias, mchehab, mjg59, steved
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-19 17:57:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Stock firmware crash log
none
Latest iwlwifi firmware crash log
none
Kernel 5.6.2 iwlwifi AX200 crash log none

Description Arcadiy Ivanov 2019-08-07 00:14:46 UTC
I have Dell Precision Mobile 5540 with Intel AX200. Today I upgraded to 5.2.5-200.fc30 and wireless stopped working.

The failure logs are at the bottom.
Intel's site shows that AX200 firmware is iwlwifi-cc-46.3cfab8da.0.tgz, while AX201 firmware is iwlwifi-Qu-48.13675109.0.tgz.


As you can see from the logs the AX200 is trying to load firmware that *seems* to be versioned for AX201.

Updating to the latest firmware from https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/linux-firmware.git doesn't help either - firmware crashes all the same.

Comment 1 Arcadiy Ivanov 2019-08-07 00:18:12 UTC
Created attachment 1601210 [details]
Stock firmware crash log

Comment 2 Arcadiy Ivanov 2019-08-07 00:18:58 UTC
Created attachment 1601211 [details]
Latest iwlwifi firmware crash log

Comment 3 Arcadiy Ivanov 2019-08-07 00:21:14 UTC
As you can see stock firmware:
   loaded firmware version 48.13675109.0 op_mode iwlmvm
   Detected Intel(R) Wi-Fi 6 AX200 160MHz, REV=0x340
Latest firmware:
   loaded firmware version 48.954cff6d.0 op_mode iwlmvm
   Detected Intel(R) Wi-Fi 6 AX200 160MHz, REV=0x340

Comment 4 Arcadiy Ivanov 2019-08-07 00:25:15 UTC
# lspci -nn
3b:00.0 Network controller [0280]: Intel Corporation Device [8086:2723] (rev 1a)

Comment 5 Arcadiy Ivanov 2019-08-07 00:58:26 UTC
On 5.1.20 we attempt to load 46.x firmware only. Looks like 5.2.5 is mismatching firmware version/misidentifying the device.

[    7.069080] iwlwifi 0000:3b:00.0: enabling device (0000 -> 0002)
[    7.114755] iwlwifi 0000:3b:00.0: Found debug destination: EXTERNAL_DRAM
[    7.114756] iwlwifi 0000:3b:00.0: Found debug configuration: 0
[    7.114914] iwlwifi 0000:3b:00.0: loaded firmware version 46.177b3e46.0 op_mode iwlmvm
[    7.187279] iwlwifi 0000:3b:00.0: Detected Intel(R) Wi-Fi 6 AX200 160MHz, REV=0x340
[    7.201846] iwlwifi 0000:3b:00.0: Applying debug destination EXTERNAL_DRAM
[    7.202640] iwlwifi 0000:3b:00.0: Allocated 0x00400000 bytes for firmware monitor.
[    7.362824] iwlwifi 0000:3b:00.0: base HW address: xx:xx:xx:xx:xx:xx
[    7.577804] iwlwifi 0000:3b:00.0 wlp59s0: renamed from wlan0
[   11.796907] iwlwifi 0000:3b:00.0: Applying debug destination EXTERNAL_DRAM
[   11.956148] iwlwifi 0000:3b:00.0: FW already configured (0) - re-configuring
[   11.997058] iwlwifi 0000:3b:00.0: Applying debug destination EXTERNAL_DRAM
[   12.156674] iwlwifi 0000:3b:00.0: FW already configured (0) - re-configuring

Comment 6 Arcadiy Ivanov 2019-08-09 01:56:41 UTC
Same issue on 5.2.6.

Comment 7 Arcadiy Ivanov 2019-08-13 03:31:11 UTC
Same issue on 5.2.7.

Comment 8 Arcadiy Ivanov 2019-08-13 22:18:54 UTC
Same issue on 5.2.8.

Comment 9 Arcadiy Ivanov 2019-08-19 17:57:15 UTC
Appears fixed in 5.2.9

Comment 10 Arcadiy Ivanov 2019-08-19 18:02:14 UTC
Presumably the following were the fixes:

commit be088ac6e1c29655de1329a86ca017a65cf1c631
Author: Luca Coelho <luciano.coelho>
Date:   Fri Jul 19 12:21:59 2019 +0300

    iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support
    
    commit f5a47fae6aa3eb06f100e701d2342ee56b857bee upstream.
    
    We erroneously added a check for FW API version 41 before sending
    GEO_TX_POWER_LIMIT, but this was already implemented in version 38.
    Additionally, it was cherry-picked to older versions, namely 17, 26
    and 29, so check for those as well.
    
    Cc: stable.org
    Fixes: eca1e56ceedd ("iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares")
    Signed-off-by: Luca Coelho <luciano.coelho>
    Signed-off-by: Johannes Berg <johannes.berg>
    Signed-off-by: Greg Kroah-Hartman <gregkh>

commit a2985d54cc5f7b0bc9f35032521e66039e1a559c
Author: Luca Coelho <luciano.coelho>
Date:   Mon Jun 24 22:29:33 2019 +0300

    iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on version < 41
    
    commit 39bd984c203e86f3109b49c2a2e20677c4d3ab65 upstream.
    
    Firmware versions before 41 don't support the GEO_TX_POWER_LIMIT
    command, and sending it to the firmware will cause a firmware crash.
    We allow this via debugfs, so we need to return an error value in case
    it's not supported.
    
    This had already been fixed during init, when we send the command if
    the ACPI WGDS table is present.  Fix it also for the other,
    userspace-triggered case.
    
    Cc: stable.org
    Fixes: 7fe90e0e3d60 ("iwlwifi: mvm: refactor geo init")
    Signed-off-by: Luca Coelho <luciano.coelho>
    Signed-off-by: Johannes Berg <johannes.berg>
    Signed-off-by: Greg Kroah-Hartman <gregkh>

commit a985a6b398d6054f5abf048cba18c30d3cffd8a0
Author: Emmanuel Grumbach <emmanuel.grumbach>
Date:   Mon Jul 22 13:02:25 2019 +0300

    iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
    
    commit 71b256f8f7a5c09810d2c3ed6165629c2cc0a652 upstream.
    
    Accessing the hdr of an skb that was consumed already isn't
    a good idea.
    First ask if the skb is a QoS packet, then keep that data
    on stack, and then consume the skb.
    This was spotted by KASAN.
    
    Cc: stable.org
    Fixes: 08f7d8b69aaf ("iwlwifi: mvm: bring back mvm GSO code")
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach>
    Signed-off-by: Johannes Berg <johannes.berg>
    Signed-off-by: Greg Kroah-Hartman <gregkh>

commit 54ae6149f4cb0ae9c622ba2ef9cb908446ed8c45
Author: Emmanuel Grumbach <emmanuel.grumbach>
Date:   Mon Jul 22 12:47:27 2019 +0300

    iwlwifi: mvm: fix an out-of-bound access
    
    commit ba3224db78034435e9ff0247277cce7c7bb1756c upstream.
    
    The index for the elements of the ACPI object we dereference
    was static. This means that if we called the function twice
    we wouldn't start from 3 again, but rather from the latest
    index we reached in the previous call.
    This was dutifully reported by KASAN.
    
    Fix this.
    
    Cc: stable.org
    Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table")
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach>
    Signed-off-by: Johannes Berg <johannes.berg>
    Signed-off-by: Greg Kroah-Hartman <gregkh>

commit ddee2b078360038527a7feece687307ea2685940
Author: Emmanuel Grumbach <emmanuel.grumbach>
Date:   Sun Jul 21 14:02:27 2019 +0300

    iwlwifi: don't unmap as page memory that was mapped as single
    
    commit 87e7e25aee6b59fef740856f4e86d4b60496c9e1 upstream.
    
    In order to remember how to unmap a memory (as single or
    as page), we maintain a bit per Transmit Buffer (TBs) in
    the meta data (structure iwl_cmd_meta).
    We maintain a bitmap: 1 bit per TB.
    If the TB is set, we will free the memory as a page.
    This bitmap was never cleared. Fix this.
    
    Cc: stable.org
    Fixes: 3cd1980b0cdf ("iwlwifi: pcie: introduce new tfd and tb formats")
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach>
    Signed-off-by: Johannes Berg <johannes.berg>
    Signed-off-by: Greg Kroah-Hartman <gregkh>

Comment 11 daniel.a.jenson 2020-01-15 05:43:46 UTC
This seems to be an issue again on 5.4.8

Comment 12 daniel.a.jenson 2020-01-15 05:44:12 UTC
This seems to be an issue again on 5.4.8

Comment 13 christian.ohrfandl 2020-04-15 00:40:17 UTC
Created attachment 1678841 [details]
Kernel 5.6.2 iwlwifi AX200 crash log

I can confirm that the issue that the firmware of the Intel AX201 ist loaded instead of the one for the AX200 network card in kernel 5.6.2 (5.6.2-201.fc32.ppc64le). Therefore, the system fails to load the driver for the AX200 and implicitely the network card is not usable. Manually loading the module does not have any effect on solving the issue.

For details see the attachment kernel-5-6-2-iwlwifi-ax200-crash.log

It would be really great if the issue were to be solved soon or at least a workaround can be shown.

Thank you in advance!