Possible bug in iwlwifi

Hello and happy MLK day (for those of you in the States).

There may be a bug in iwlwifi. Using kernels 6.7.0 (mainline), 6.6.11 (LTS), or 6.6.9 (F39 current), this driver in use with the Intel BE200 wifi 7 module produces the following via dmesg:

[ 1548.936989] iwlwifi 0000:05:00.0: enabling device (0000 -> 0002)
[ 1548.939309] iwlwifi 0000:05:00.0: Detected crf-id 0x2001910, cnv-id 0x2001910 wfpm id 0x80000000
[ 1548.939316] iwlwifi 0000:05:00.0: PCI dev 272b/00f4, rev=0x472, rfid=0x112200
[ 1548.963940] iwlwifi 0000:05:00.0: api flags index 2 larger than supported by driver
[ 1548.963948] iwlwifi 0000:05:00.0: TLV_FW_FSEQ_VERSION: FSEQ Version: 0.97.4.2
[ 1548.964106] iwlwifi 0000:05:00.0: loaded firmware version 83.d24e06ed.0 gl-c0-fm-c0-83.ucode op_mode iwlmvm
[ 1548.981181] iwlmvm: unknown parameter 'init_dbq' ignored
[ 1548.989394] iwlwifi 0000:05:00.0: Detected Intel(R) TBD Bz device, REV=0x472
[ 1549.011274] iwlwifi 0000:05:00.0: WRT: Invalid buffer destination
[ 1549.240395] iwlwifi 0000:05:00.0: loaded PNVM version e28bb9d7
[ 1549.342177] iwlwifi 0000:05:00.0: base HW address: 90:65:84:b7:d8:d3
[ 1549.396993] iwlwifi 0000:05:00.0 wlp5s0f0: renamed from wlan0
[ 1561.339307] iwlwifi 0000:05:00.0: WRT: Invalid buffer destination
[ 1561.674331] iwlwifi 0000:05:00.0: Registered PHC clock: iwlwifi-PTP, with index: 0

The line of interest is “WRT: Invalid buffer destination.” Speculation: This is to be taken literally as meaning that the driver is going to write to an invalid memory location in the kernel. Attempting to use the driver at this point will either crash the driver like this:

[ 1691.504338] WARNING: CPU: 7 PID: 8076 at drivers/net/wireless/intel/iwlwifi/pcie/rx.c:1489 iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504352] Modules linked in: iwlmvm iwlwifi mac80211 libarc4 uinput rfcomm snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr bnep sunrpc nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) binfmt_misc vfat fat nvidia(POE) 8852bu(OE) snd_sof_pci_intel_tgl snd_sof_intel_hda_common soundwire_intel snd_sof_intel_hda_mlink soundwire_cadence snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi soundwire_generic_allocation soundwire_bus snd_hda_codec_realtek snd_soc_core intel_rapl_msr snd_hda_codec_generic intel_rapl_common snd_compress ac97_bus intel_uncore_frequency snd_hda_codec_hdmi snd_pcm_dmaengine ledtrig_audio intel_uncore_frequency_common snd_hda_intel x86_pkg_temp_thermal snd_intel_dspcfg
[ 1691.504393] CPU: 7 PID: 8076 Comm: irq/149-iwlwifi Tainted: P           OE      6.6.9-200.fc39.x86_64 #1
[ 1691.504395] RIP: 0010:iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504412]  ? iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504423]  ? iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504441]  ? iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504449]  ? iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504456]  iwl_pcie_napi_poll_msix+0x2d/0xc0 [iwlwifi]
[ 1691.504489]  iwl_pcie_irq_rx_msix_handler+0xc3/0x110 [iwlwifi]
[ 1691.504596] WARNING: CPU: 7 PID: 8076 at drivers/net/wireless/intel/iwlwifi/pcie/rx.c:1489 iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504608] Modules linked in: iwlmvm iwlwifi mac80211 libarc4 uinput rfcomm snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr bnep sunrpc nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) binfmt_misc vfat fat nvidia(POE) 8852bu(OE) snd_sof_pci_intel_tgl snd_sof_intel_hda_common soundwire_intel snd_sof_intel_hda_mlink soundwire_cadence snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi soundwire_generic_allocation soundwire_bus snd_hda_codec_realtek snd_soc_core intel_rapl_msr snd_hda_codec_generic intel_rapl_common snd_compress ac97_bus intel_uncore_frequency snd_hda_codec_hdmi snd_pcm_dmaengine ledtrig_audio intel_uncore_frequency_common snd_hda_intel x86_pkg_temp_thermal snd_intel_dspcfg
[ 1691.504647] CPU: 7 PID: 8076 Comm: irq/149-iwlwifi Tainted: P        W  OE      6.6.9-200.fc39.x86_64 #1
[ 1691.504649] RIP: 0010:iwl_pcie_rx_handle+0x743/0x9c0 [iwlwifi]
[ 1691.504663] iwlwifi 0000:05:00.0: Microcode SW error detected. Restarting 0x0.

or will crash the kernel itself (possibly due to writing all over kernel memory).

The Internet, in its wisdom, indicates that drivers are part of the upstream kernel, so I notified the iwlwifi driver maintainers. However I also posted here in case it’s OS related or just a stupidity on my part. It is also of interest because Koji marks the 6.7.0 kernel with the tag “f40” which would seem to indicate that this kernel is tagged for release in the next Fedora update, and it seems that this bug persists in that version (if it is a bug).

The wifi module in use comes soldered to my MoBo (Asrock z790 “Riptide”).

Any help or feedback (or even just suggestions to improve the upstream bug report) are welcome. Thanks!

You may get push back that you have a tainted kernel.
If that is the case reproduce the problem without nvidia drivers from rpmfusion loaded.

Fedora does not have an LTS notion. The 6.7.0 kernel in rawhide will be there first for testing and will turn up in F39 as soon as the kernel team think its stable.

Good advice, thanks!

The notion of stable here was supposed to refer to the kernel and not Fedora. They will only respond to bug reports on a “release candidate” or “stable” version. 6.6.12 is listed as “stable” on kernel.org (which I now realize is not the 6.6.11 that I tested with!) and 6.7.0 is the mainline, which I assume will be or is a release candidate. They will not, for example, care about a bug report on 6.6.9, which is what I believe Fedora is currently using.

Edit: The “longterm” (LTS) versions of the kernel are all too old to support wifi 7, so the only kernels worth testing here are, I believe, 6.6.12 and 6.7.0.

Oh right LTS, mainstream from kernel.org! That makes sense.

Maybe also raise a bug against the kernel in the fedora abug tracker as well and reference your upstream communications.

Also there are release candidate builds of the kernel available, but I’m not sure how you should install them: kernel | Package Info | koji

Thank you for explaining that. I couldn’t really figure out what “release candidate” really meant. :slight_smile:

These are the so called “RC” builds of the kernel as its developed.
Over a few weeks they go from RC0 to RC7 or RC8 as new code is merged and fixes are made in response to testing issues. After that the release is made and cycle starts again.

I also encountered an issue with the Intel BE200 on Fedora 39. I checked how the BE200 operates on ‘Fedora-KDE-Live-x86_64-Rawhide-20240126.n.1.iso’ and noticed that it uses kernel 6.8. I managed to resolve the problem on Fedora 39 by installing kernel ‘6.8.0-0.rc1.20240128gt8a696a29.217.vanilla.fc39.x86_64’. I understand this is a temporary solution, and I just need to wait for the official release of kernel 6.8 on Fedora. However, it worked for me, and I won’t reboot my computer until kernel 6.8 is released :grinning:.