Re: [9front] Free Carrots #6: Tools For Fighting WiFi Inequality

[kemal <kemalinanc8@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2862 bytes --]

2023-07-24 5:35 GMT+03:00, ori@eigenstate.org <ori@eigenstate.org>:
> Quoth kemal <kemalinanc8@gmail.com>:
>>
>> my mail didn't end up in /n/lists/9front, so the mail server may have
>> ate my mail. i'm going to reply to my original message and upload
>> my patch to okturing instead of attaching it, hoping that it will get
>> sent
>> http://okturing.com/src/16441/body
>
> this breaks wireless on my t460s (Intel Wireless 8260, 8086:24f3).
>
> Before, it would often give me firmware crashes, but with this it
> does it on every bind:
>
> 	 #l1: fatal firmware error
> 	 lastcmd: 108 (0x6c)
> 	 error:  id 2b12, trm_hw_status 000002f0 00000000,
> 	         branchlink2 0002395c, interruptlink 0003867a 00000000,
> 	         errordata 80087cca 7acdf1f6 00000000
> 	 #l1: flushq: broken
>
> happy to help debug, but not sure where to start.
>
>

first of all, thank you for testing!

as for what happens here, it errors on the command i changed. firmware
makes the situation worse by sending us an unknown error id (0x2b12),
but i at least know that it's not because we're sending a bad command but
because firmware breaks for a cryptic reason. just for reference,
i'll leave the error id table from openbsd here:

static struct {
	const char *name;
	uint8_t num;
} advanced_lookup[] = {
	{ "NMI_INTERRUPT_WDG", 0x34 },
	{ "SYSASSERT", 0x35 },
	{ "UCODE_VERSION_MISMATCH", 0x37 },
	{ "BAD_COMMAND", 0x38 },
	{ "BAD_COMMAND", 0x39 },
	{ "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C },
	{ "FATAL_ERROR", 0x3D },
	{ "NMI_TRM_HW_ERR", 0x46 },
	{ "NMI_INTERRUPT_TRM", 0x4C },
	{ "NMI_INTERRUPT_BREAK_POINT", 0x54 },
	{ "NMI_INTERRUPT_WDG_RXF_FULL", 0x5C },
	{ "NMI_INTERRUPT_WDG_NO_RBD_RXF_FULL", 0x64 },
	{ "NMI_INTERRUPT_HOST", 0x66 },
	{ "NMI_INTERRUPT_LMAC_FATAL", 0x70 },
	{ "NMI_INTERRUPT_UMAC_FATAL", 0x71 },
	{ "NMI_INTERRUPT_OTHER_LMAC_FATAL", 0x73 },
	{ "NMI_INTERRUPT_ACTION_PT", 0x7C },
	{ "NMI_INTERRUPT_UNKNOWN", 0x84 },
	{ "NMI_INTERRUPT_INST_ACTION_PT", 0x86 },
	{ "ADVANCED_SYSASSERT", 0 },
};
(unknown errors are ADVANCED_SYSASSERT)

sadly, the rest of the error is useless as no one except intel knows the
firmwares internals. i want to know why it fails, so i added some debug
prints to deduce something.
diff with debug prints attached.

for reference, this is what openbsd does:

int
iwm_send_phy_db_cmd(struct iwm_softc *sc, uint16_t type, uint16_t length,
    void *data)
{
	struct iwm_phy_db_cmd phy_db_cmd;
	struct iwm_host_cmd cmd = {
		.id = IWM_PHY_DB_CMD,
		.flags = IWM_CMD_ASYNC,
	};

	phy_db_cmd.type = le16toh(type);
	phy_db_cmd.length = le16toh(length);

	cmd.data[0] = &phy_db_cmd;
	cmd.len[0] = sizeof(struct iwm_phy_db_cmd);
	cmd.data[1] = data;
	cmd.len[1] = length;

	return iwm_send_cmd(sc, &cmd);
}

and this is the structure:

struct iwm_phy_db_cmd {
	uint16_t type;
	uint16_t length;
	uint8_t data[];
} __packed;

(data is unused)

[-- Attachment #2: etheriwl.diff --]
[-- Type: text/plain, Size: 4579 bytes --]

diff f6ac182f86bf0bcc777a76db50f94227ef6f7962 uncommitted
--- a/sys/src/9/port/etheriwl.c
+++ b/sys/src/9/port/etheriwl.c
@@ -330,25 +330,14 @@
 };
 
 /*
- * uCode TLV api
- */
-enum {
-	/* api[0] */
-	UcodeApiSta	= 1<<30,
-};
-
-/*
  * uCode capabilities
  */
 enum {
-	/* capa[0] */
-	UcodeCapLar	= 1<<1,
+	UcodeApiSta	= 30,
 
-	/* capa[1] */
-	UcodeCapQuota	= 1<<12,
-	
-	/* capa[2] */
-	UcodeCapLar2	= 1<<9,
+	UcodeCapaLar	= 1,
+	UcodeCapaQuota	= 44,
+	UcodeCapaLar2	= 73,
 };
 
 enum {
@@ -658,8 +647,6 @@
 	Type6005	= 11,	/* also Centrino Advanced-N 6030, 6235 */
 	Type2030	= 12,
 	Type2000	= 16,
-
-	Type7260	= 20,
 };
 
 static struct ratetab {
@@ -721,6 +708,8 @@
 
 #define csr32r(c, r)	(*((c)->nic+((r)/4)))
 #define csr32w(c, r, v)	(*((c)->nic+((r)/4)) = (v))
+/* macro to help with ctlr->fw->(api|capa) */
+#define isset(a, i)	((a)[(i)/32] & 1U<<(i)%32)
 
 static uint
 get16(uchar *p){
@@ -1114,7 +1103,8 @@
 	}
 
 	/* Enable the oscillator to count wake up time for L1 exit. (weird W/A) */
-	if(ctlr->type == Type7260){
+	switch(ctlr->pdev->did){
+	case 0x08b1: case 0x08b2: case 0x08b3: case 0x08b4: /* Wireless 7260/3160 */
 		if((err = niclock(ctlr)) != nil)
 			return err;
 
@@ -2014,7 +2004,7 @@
 	*p++ = mcc[0];
 	*p++ = 0;
 	*p++ = 0;	// reserved
-	if(ctlr->fw->capa[2] & UcodeCapLar2){
+	if(isset(ctlr->fw->capa, UcodeCapaLar2)){
 		p += 4;
 		p += 5*4;
 	}
@@ -2407,7 +2397,7 @@
 		p += 2;			/* sleep_tx_count */
 		p++;			/* sleep state flags */
 
-		*p++ = ctlr->fw->api[0] & UcodeApiSta ? type : 0;		/* station_type */
+		*p++ = isset(ctlr->fw->api, UcodeApiSta) ? type : 0;		/* station_type */
 
 		p += 2;			/* assoc id */
 
@@ -2416,7 +2406,7 @@
 		put32(p, 1<<0);
 		p += 4;			/* tfd_queue_mask */
 
-		if(ctlr->fw->api[0] & UcodeApiSta){
+		if(isset(ctlr->fw->api, UcodeApiSta)){
 			p += 2;		/* rx_ba_window */
 			p++;		/* sp_length */
 			p++;		/* uapsd_acs */
@@ -2750,7 +2740,7 @@
 	uchar c[4*(3*4)], *p;
 	int i;
 
-	if((ctlr->fw->capa[1] & UcodeCapQuota) == 0)
+	if(!isset(ctlr->fw->capa, UcodeCapaQuota))
 		return nil;
 
 	i = 0;
@@ -2883,6 +2873,41 @@
 }
 
 static char*
+sendcalibdata(Ctlr *ctlr)
+{
+	Block *b;
+	uchar c[4];
+	char *err;
+	int i;
+
+	for(i = 0; i < sizeof(ctlr->calib.cmd); i++){
+		if((b = ctlr->calib.cmd[i]) == nil){
+			print("iwl: calib %d empty", i);
+			continue;
+		}
+		if(b == ctlr->calib.cfg)
+			put16(c, 1);
+		else if(b == ctlr->calib.nch)
+			put16(c, 2);
+		else if(ctlr->calib.cmd+i < ctlr->calib.papd+nelem(ctlr->calib.papd))
+			put16(c, 4);
+		else if(ctlr->calib.cmd+i < ctlr->calib.txp+nelem(ctlr->calib.txp))
+			put16(c, 5);
+		put16(c+2, BLEN(b));
+		print("iwl: calib %d to be sent: type %uhd len %uhd", i, get16(c), get16(c+2));
+		
+		b = copyblock(b, BLEN(b));
+		if((err = qcmd(ctlr, 4, 108, c, sizeof(c), b)) != nil){
+			freeb(b);
+			return err;
+		}
+		if((err = flushq(ctlr, 4)) != nil)
+			return err;
+	}
+	return nil;
+}
+
+static char*
 postboot7000(Ctlr *ctlr)
 {
 	char *err;
@@ -2914,21 +2939,9 @@
 			ctlr->calib.done = 1;
 		}
 	} else {
-		Block *b;
-		int i;
+		if((err = sendcalibdata(ctlr)) != nil)
+			return err;
 
-		for(i = 0; i < nelem(ctlr->calib.cmd); i++){
-			if((b = ctlr->calib.cmd[i]) == nil)
-				continue;
-			b = copyblock(b, BLEN(b));
-			if((qcmd(ctlr, 4, 108, nil, 0, b)) != nil){
-				freeb(b);
-				return err;
-			}
-			if((err = flushq(ctlr, 4)) != nil)
-				return err;
-		}
-
 		if((err = sendphyconfig(ctlr,
 			ctlr->fw->physku,
 			ctlr->fw->main.defcalib.flowmask,
@@ -2947,7 +2960,7 @@
 			print("can't update device power: %s\n", err);
 			return err;
 		}
-		if(ctlr->fw->capa[0] & UcodeCapLar)
+		if(!isset(ctlr->fw->capa, UcodeCapaLar))
 			if((err = sendmccupdate(ctlr, "ZZ")) != nil)
 				return err;
 		if((err = disablebeaconfilter(ctlr)) != nil){
@@ -4421,7 +4434,7 @@
 	int family;
 	
 	pdev = nil;
-	while(pdev = pcimatch(pdev, Vintel, 0)) {
+	while(pdev = pcimatch(pdev, 0x8086, 0)) {
 		Ctlr *ctlr;
 		void *mem;
 		
@@ -4467,6 +4480,7 @@
 			fwname = "iwm-7260-17";
 			break;
 		case 0x08b3:	/* Wireless AC 3160 */
+		case 0x08b4:	/* Wireless AC 3160 */
 			family = 7000;
 			fwname = "iwm-3160-17";
 			break;
@@ -4474,6 +4488,15 @@
 		case 0x095b:	/* Wireless AC 7265 */
 			family = 7000;
 			fwname = "iwm-7265-17";
+			break;
+		case 0x3165:	/* Wireless AC 3165 */
+		case 0x3166:	/* Wireless AC 3165 */
+			family = 7000;
+			fwname = "iwm-7265D-29";
+			break;
+		case 0x24fb:	/* Wireless AC 3168 */
+			family = 7000;
+			fwname = "iwm-3168-29";
 			break;
 		case 0x24f3:	/* Wireless AC 8260 */
 			family = 8000;