Bug 200851

Summary: iwlwifi: completely opaque WARN_ON(1) in drivers/net/wireless/intel/iwlwifi/mvm/tx.c
Product: Drivers Reporter: bugzilla
Component: network-wirelessAssignee: drivers_network-wireless (drivers_network-wireless)
Status: CLOSED DUPLICATE    
Severity: high    
Priority: P1    
Hardware: All   
OS: Linux   
See Also: https://bugzilla.kernel.org/show_bug.cgi?id=199967
Kernel Version: 4.14.x and later Subsystem:
Regression: No Bisected commit-id:

Description bugzilla 2018-08-18 02:37:11 UTC 
TX_STATUS_FAIL_DEST_PS

Please remove or fix the WARN_ON(1) at drivers/net/wireless/intel/iwlwifi/mvm/tx.c:1377 (4.17.6) it is filling my kernel logs 

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887045
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=886292
https://www.spinics.net/lists/linux-wireless/msg171988.html
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1733194/comments/18


[2664990.999192] WARNING: CPU: 2 PID: 405 at /build/linux-9Vm0he/linux-4.17.6/drivers/net/wireless/intel/iwlwifi/mvm/tx.c:1377 iwl_mvm_rx_tx_cmd+0x3be/0x600 [iwlmvm]
[2664990.999198] Modules linked in: aufs(O) tcp_diag inet_diag veth ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo xt_addrtype br_netfilter ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs ext4 mbcache jbd2 fscrypto ecb dm_mod cpuid ctr ccm fuse unix_diag sctp ipt_REJECT nf_reject_ipv4 bridge stp llc sit tunnel4 ip_tunnel sch_sfq cls_fw sch_htb ip6table_mangle nf_conntrack_ipv6 nf_defrag_ipv6 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip6table_filter ip6_tables xt_multiport xt_dscp xt_mark iptable_mangle iptable_filter xt_nat xt_tcpudp iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat binfmt_misc nf_conntrack squashfs loop snd_hda_codec_hdmi snd_hda_codec_realtek arc4 snd_hda_codec_generic intel_rapl x86_pkg_temp_thermal intel_powerclamp kvm_intel
[2664990.999290]  kvm irqbypass iwlmvm crct10dif_pclmul crc32_pclmul btusb btrtl mac80211 btbcm btintel snd_hda_intel bluetooth snd_hda_codec ghash_clmulni_intel snd_hda_core snd_hwdep snd_pcm_oss intel_cstate jitterentropy_rng snd_mixer_oss iwlwifi intel_uncore snd_pcm i915 drbg intel_rapl_perf snd_timer snd ansi_cprng pcspkr drm_kms_helper cfg80211 ecdh_generic iTCO_wdt usblp iTCO_vendor_support crc16 soundcore mei_me rfkill drm mei evdev sg joydev shpchp video acpi_pad button nct6775 hwmon_vid coretemp parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid btrfs xor zstd_decompress zstd_compress xxhash sd_mod uas usb_storage raid6_pq libcrc32c crc32c_generic crc32c_intel nvme igb xhci_pci aesni_intel aes_x86_64 crypto_simd cryptd glue_helper ahci i2c_algo_bit libahci e1000e xhci_hcd
[2664990.999389]  dca libata i2c_i801 nvme_core usbcore scsi_mod usb_common
[2664990.999405] CPU: 2 PID: 405 Comm: irq/136-iwlwifi Tainted: G        W  O      4.17.0-1-amd64 #1 Debian 4.17.6-2
[2664990.999409] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./H270M-ITX/ac, BIOS P2.00 03/29/2017
[2664990.999426] RIP: 0010:iwl_mvm_rx_tx_cmd+0x3be/0x600 [iwlmvm]
[2664990.999431] RSP: 0018:ffffb33741ec7d50 EFLAGS: 00010246
[2664990.999437] RAX: ffff88cbbbc8f901 RBX: ffff88ccd63ff300 RCX: 0000000000dcda00
[2664990.999441] RDX: 0000000000dcd9ff RSI: ffff88ceaed261a0 RDI: fffff4c145ef2380
[2664990.999445] RBP: 0000000000000088 R08: ffff88ccd63ff330 R09: ffffffffc10ce6e8
[2664990.999450] R10: ffffffffb6bc08d0 R11: 0000000000000080 R12: 000000000000d350
[2664990.999454] R13: ffff88ce95122000 R14: ffff88cd5da75000 R15: ffff88ce9895d508
[2664990.999459] FS:  0000000000000000(0000) GS:ffff88ceaed00000(0000) knlGS:0000000000000000
[2664990.999464] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[2664990.999469] CR2: 00007fb785366000 CR3: 0000000399e0a004 CR4: 00000000003606e0
[2664990.999473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[2664990.999477] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[2664990.999480] Call Trace:
[2664990.999492]  ? __switch_to_asm+0x40/0x70
[2664990.999509]  iwl_pcie_rx_handle+0x1f0/0x820 [iwlwifi]
[2664990.999526]  iwl_pcie_irq_handler+0x18b/0x6c0 [iwlwifi]
[2664990.999536]  ? irq_finalize_oneshot.part.43+0x100/0x100
[2664990.999544]  ? irq_thread_check_affinity+0xd0/0xd0
[2664990.999551]  irq_thread_fn+0x21/0x50
[2664990.999559]  irq_thread+0x146/0x1a0
[2664990.999568]  ? irq_forced_thread_fn+0x70/0x70
[2664990.999576]  kthread+0x113/0x130
[2664990.999585]  ? kthread_create_worker_on_cpu+0x70/0x70
[2664990.999592]  ret_from_fork+0x35/0x40
[2664990.999597] Code: f6 49 29 fb 49 39 c3 79 33 49 8b bf d8 12 00 00 48 c7 c6 d8 a0 0e c1 4c 89 44 24 08 e8 ec 80 c2 ff 4c 8b 44 24 08 e9 44 fe ff ff <0f> 0b 45 31 ed 81 4b 28 00 01 00 00 e9 1f fe ff ff 48 8b 05 3a
[2664990.999681] ---[ end trace bc533a9f11280b90 ]---
Comment 1 bugzilla 2018-08-18 02:40:22 UTC 

*** This bug has been marked as a duplicate of bug 199967 ***
Comment 2 bugzilla 2018-08-18 03:54:44 UTC 
According to https://osdn.net/users/richard_collins/pf/kernel/scm/commits/6ab10ff8738dfb098fd32132b7ebcf5cdb43ebde

> * when a station goes to sleep, the microcode notices
>   this and marks the station as asleep
> * when the station is marked asleep, the microcode
>   refuses to transmit to the station and rejects all
>   frames queued to it with the failure status code
>   TX_STATUS_FAIL_DEST_PS (a previous patch handled
>   this correctly)
> * when we need to send frames to the station _although_
>   it is asleep, we need to tell the ucode how many,
>   and this is asynchronous with sending so we cannot
>   just send the frames, we need to wait for all other
>   frames to be flushed, and then update the counter
>   before sending out the poll response frames. This
>   is handled partially in the driver and partially in
>   mac80211.

So this should only happen if the station goes to sleep, but I have power management turned off:

$ sudo iwconfig wlan0
wlan0     IEEE 802.11  Mode:Master  Tx-Power=22 dBm
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off
$