From nobody Mon Feb 19 16:11:05 2024 X-Original-To: wireless@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TdnZx6LgGz5C5Qh for ; Mon, 19 Feb 2024 16:11:05 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TdnZx4xSSz4Qgj for ; Mon, 19 Feb 2024 16:11:05 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1708359065; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3m/SFceBlIQ3YJy59NyKyV2BdqAWrPirHp2WKVqOEAQ=; b=PcuyDzGAiSkqZSyyAOn4fxhW5TZv/WoM70qHMHARM2/QaCV6bHmdPfTPRZ4Ot1cUzvxqr0 2dFOiYMbbb2BnkbH2a1AFS2uvxi6dxJY/6PAr5v/DdylROuSLrS6A6TgaVFndbXpfR3mdx LVBP/Y/aLhY7BbfZFobqwOjJmK2tBXGOSIcIgrZulE8SdExXSbmrFcv3IfGUbhmRKcCWPO 14RxBbvdHaghZe2U8PwZUP2fdp6G08cTA72fAwm7Dywjf40unI9vE/PO+1zP3q19vX59wY hGquxrYgFHCjDlE/8YCCy9N1Lar0QiWDFa7Ukyo/BmBPPUPiyNVWItCW+KYIRw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1708359065; a=rsa-sha256; cv=none; b=Lmv28p9j3EflRDtGm4N9UuPgoA7jB7Hb+yoTZj9BEoxwXsCppOnQwpzlGY7d6ybhxsuYCb YWrl+j2Lif6rO8J6qUQoXNPHPu8FCkJSfiBdDDPjZ+sAfw+CQul7KiZaxdSmuXmcitnkRU rvsXwk4xhfj4Nzmv4PqcyGGUhXKO05XtxrvJh4iVhQrmNp2J7JMZuyBveVxR/nZ02os/K5 u8SEb5FCY2aVuSE2ttS6knlSl29H6gpBBXLjW6EA6oWI/3pvC7dz3bfl2euHm4+1SN/wpY /2G1TgCVn1m1gm7fiaC1khAMKww17Rtl0nPPLITXX59/80UdRHrh2HjQMuJpXw== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4TdnZx434LzhdZ for ; Mon, 19 Feb 2024 16:11:05 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 41JGB5Rl008364 for ; Mon, 19 Feb 2024 16:11:05 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from bugzilla@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 41JGB5lO008362 for wireless@FreeBSD.org; Mon, 19 Feb 2024 16:11:05 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: bugzilla set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 275255] iwlwifi: panic after iwlwifi0: lkpi_iv_newstate: error -5 during state transition 5 (RUN) -> 0 (INIT) Date: Mon, 19 Feb 2024 16:11:05 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: wireless X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: commit-hook@FreeBSD.org X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: wireless@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-wireless List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-wireless@freebsd.org X-BeenThere: freebsd-wireless@freebsd.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D275255 --- Comment #11 from commit-hook@FreeBSD.org --- A commit in branch releng/13.3 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3D9b998db87c28356fce21784c4f8bfb873= 7615e1f commit 9b998db87c28356fce21784c4f8bfb8737615e1f Author: Bjoern A. Zeeb AuthorDate: 2024-01-10 10:14:16 +0000 Commit: Bjoern A. Zeeb CommitDate: 2024-02-19 16:07:20 +0000 net80211: deal with lost state transitions Since 5efea30f039c4 we can possibly lose a state transition which can cause trouble further down the road. The reproducer from 643d6dce6c1e can trigger these for example. Drivers for firmware based wireless cards have worked around some of this (and other) problems in the past. Add an array of tasks rather than a single one as we would simply get npending > 1 and lose order with other tasks. Try to keep state changes updated as queued in case we end up with more than one at a time. While this is not ideal either (call it a hack) it will sort the problem for now. We will queue in ieee80211_new_state_locked() and do checks there and dequeue in ieee80211_newstate_cb(). If we still overrun the (currently) 8 slots we will drop the state change rather than overwrite the last one. When dequeing we will update iv_nstate and keep it around for historic reasons for the moment. The longer term we should make the callers of ieee80211_new_state[_locked]() actually use the returned errors and act appropriately but that will touch a lot more places and drivers (possibly incl. changed behaviour for ioctls). rtwn(4) and rum(4) should probably be revisted and net80211 internals removed (for rum(4) at least the current logic still seems prone to races). PR: 271979, 271988, 275255, 263613, 274003 Sponsored by: The FreeBSD Foundation (in 2023) Reviewed by: cc Differential Revision: https://reviews.freebsd.org/D43389 (cherry picked from commit 713db49d06deee90dd358b2e4b9ca05368a5eaf6) Given this changes the internal structure of 'struct ieee80211vap', which gets allocated by the drivers, and we do not have enough spares, all wireless drivers need to be recompiled. Given we are forced to do the update, we leave fields in the middle of the struct and add more spares at the same time. __FreeBSD_version will get updated to 1303001 to be able to detect this change. Approved by: re (cperciva) (cherry picked from commit a890a3a5ddf33acb0a4000885945b89156799b07) (cherry picked from commit a7e1fc7f620d3341549c1380f550aaafbdb45622) sys/dev/rtwn/if_rtwn.c | 4 +- sys/dev/usb/wlan/if_rum.c | 4 +- sys/net80211/ieee80211.c | 4 +- sys/net80211/ieee80211_ddb.c | 15 ++++- sys/net80211/ieee80211_proto.c | 124 ++++++++++++++++++++++++++++++++++---= ---- sys/net80211/ieee80211_var.h | 18 +++--- 6 files changed, 136 insertions(+), 33 deletions(-) --=20 You are receiving this mail because: You are the assignee for the bug.=