iwlwifi microcode crash when using wrong password to join a WPA3 access point

[Pauli Heikkinen]

I noticed that whenever I try to join a wireless network using WPA3 SAE and type the password wrong, I get a microcode crash from iwlwifi.

The chip is Intel 9462 (AX201). Ubuntu release 22.04 LTS, faithfully kept up to date.

System info available via:

https://bugs.launchpad.net/ubuntu/+source/linux-firmware/+bug/2058226

Crash log seems to be always similar:

Apr 3 22:13:55 waplinuc kernel: [1158486.254336] iwlwifi 0000:00:14.3: Not associated and the session protection is over already...
Apr 3 22:13:57 waplinuc kernel: [1158487.456868] iwlwifi 0000:00:14.3: Microcode SW error detected. Restarting 0x0.
Apr 3 22:13:57 waplinuc kernel: [1158487.456960] iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
Apr 3 22:13:57 waplinuc kernel: [1158487.456962] iwlwifi 0000:00:14.3: Transport status: 0x0000004A, valid: 6
Apr 3 22:13:57 waplinuc kernel: [1158487.456965] iwlwifi 0000:00:14.3: Loaded firmware version: 77.206b0184.0 QuZ-a0-jf-b0-77.ucode
Apr 3 22:13:57 waplinuc kernel: [1158487.456967] iwlwifi 0000:00:14.3: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL
Apr 3 22:13:57 waplinuc kernel: [1158487.456969] iwlwifi 0000:00:14.3: 0x008022F3 | trm_hw_status0
Apr 3 22:13:57 waplinuc kernel: [1158487.456971] iwlwifi 0000:00:14.3: 0x00000000 | trm_hw_status1
Apr 3 22:13:57 waplinuc kernel: [1158487.456973] iwlwifi 0000:00:14.3: 0x004C03F2 | branchlink2
Apr 3 22:13:57 waplinuc kernel: [1158487.456974] iwlwifi 0000:00:14.3: 0x000064CC | interruptlink1
Apr 3 22:13:57 waplinuc kernel: [1158487.456976] iwlwifi 0000:00:14.3: 0x000064CC | interruptlink2
Apr 3 22:13:57 waplinuc kernel: [1158487.456977] iwlwifi 0000:00:14.3: 0x0001191E | data1
Apr 3 22:13:57 waplinuc kernel: [1158487.456979] iwlwifi 0000:00:14.3: 0x00001000 | data2
Apr 3 22:13:57 waplinuc kernel: [1158487.456980] iwlwifi 0000:00:14.3: 0x00000000 | data3
Apr 3 22:13:57 waplinuc kernel: [1158487.456982] iwlwifi 0000:00:14.3: 0x04C0678B | beacon time
Apr 3 22:13:57 waplinuc kernel: [1158487.456983] iwlwifi 0000:00:14.3: 0x920B688C | tsf low
Apr 3 22:13:57 waplinuc kernel: [1158487.456985] iwlwifi 0000:00:14.3: 0x00000221 | tsf hi
Apr 3 22:13:57 waplinuc kernel: [1158487.456986] iwlwifi 0000:00:14.3: 0x0FFFFDFD | time gp1
Apr 3 22:13:57 waplinuc kernel: [1158487.456988] iwlwifi 0000:00:14.3: 0x00A909B7 | time gp2
Apr 3 22:13:57 waplinuc kernel: [1158487.456989] iwlwifi 0000:00:14.3: 0x00000001 | uCode revision type
Apr 3 22:13:57 waplinuc kernel: [1158487.456991] iwlwifi 0000:00:14.3: 0x0000004D | uCode version major
Apr 3 22:13:57 waplinuc kernel: [1158487.456992] iwlwifi 0000:00:14.3: 0x206B0184 | uCode version minor
Apr 3 22:13:57 waplinuc kernel: [1158487.456994] iwlwifi 0000:00:14.3: 0x00000351 | hw version
Apr 3 22:13:57 waplinuc kernel: [1158487.456995] iwlwifi 0000:00:14.3: 0x00489001 | board version
Apr 3 22:13:57 waplinuc kernel: [1158487.456997] iwlwifi 0000:00:14.3: 0x0000001C | hcmd
Apr 3 22:13:57 waplinuc kernel: [1158487.456998] iwlwifi 0000:00:14.3: 0x00023000 | isr0
Apr 3 22:13:57 waplinuc kernel: [1158487.456999] iwlwifi 0000:00:14.3: 0x0004C000 | isr1
Apr 3 22:13:57 waplinuc kernel: [1158487.457001] iwlwifi 0000:00:14.3: 0x08F80002 | isr2
Apr 3 22:13:57 waplinuc kernel: [1158487.457002] iwlwifi 0000:00:14.3: 0x00C3000C | isr3
Apr 3 22:13:57 waplinuc kernel: [1158487.457004] iwlwifi 0000:00:14.3: 0x00000000 | isr4
Apr 3 22:13:57 waplinuc kernel: [1158487.457005] iwlwifi 0000:00:14.3: 0x0101001C | last cmd Id
Apr 3 22:13:57 waplinuc kernel: [1158487.457006] iwlwifi 0000:00:14.3: 0x0001191E | wait_event
Apr 3 22:13:57 waplinuc kernel: [1158487.457008] iwlwifi 0000:00:14.3: 0x000054B6 | l2p_control
Apr 3 22:13:57 waplinuc kernel: [1158487.457009] iwlwifi 0000:00:14.3: 0x00001C02 | l2p_duration
Apr 3 22:13:57 waplinuc kernel: [1158487.457011] iwlwifi 0000:00:14.3: 0x00000003 | l2p_mhvalid
Apr 3 22:13:57 waplinuc kernel: [1158487.457012] iwlwifi 0000:00:14.3: 0x00000000 | l2p_addr_match
Apr 3 22:13:57 waplinuc kernel: [1158487.457013] iwlwifi 0000:00:14.3: 0x0000000B | lmpm_pmg_sel
Apr 3 22:13:57 waplinuc kernel: [1158487.457015] iwlwifi 0000:00:14.3: 0x00000000 | timestamp
Apr 3 22:13:57 waplinuc kernel: [1158487.457016] iwlwifi 0000:00:14.3: 0x000088D4 | flow_handler
Apr 3 22:13:57 waplinuc kernel: [1158487.457058] iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
Apr 3 22:13:57 waplinuc kernel: [1158487.457059] iwlwifi 0000:00:14.3: Transport status: 0x0000004A, valid: 7
Apr 3 22:13:57 waplinuc kernel: [1158487.457061] iwlwifi 0000:00:14.3: 0x20003336 | ADVANCED_SYSASSERT
Apr 3 22:13:57 waplinuc kernel: [1158487.457063] iwlwifi 0000:00:14.3: 0x00000000 | umac branchlink1
Apr 3 22:13:57 waplinuc kernel: [1158487.457064] iwlwifi 0000:00:14.3: 0x804539C6 | umac branchlink2
Apr 3 22:13:57 waplinuc kernel: [1158487.457066] iwlwifi 0000:00:14.3: 0xC0081614 | umac interruptlink1
Apr 3 22:13:57 waplinuc kernel: [1158487.457067] iwlwifi 0000:00:14.3: 0x00000000 | umac interruptlink2
Apr 3 22:13:57 waplinuc kernel: [1158487.457069] iwlwifi 0000:00:14.3: 0x000000FF | umac data1
Apr 3 22:13:57 waplinuc kernel: [1158487.457070] iwlwifi 0000:00:14.3: 0x000000FF | umac data2
Apr 3 22:13:57 waplinuc kernel: [1158487.457071] iwlwifi 0000:00:14.3: 0xDEADBEEF | umac data3
Apr 3 22:13:57 waplinuc kernel: [1158487.457073] iwlwifi 0000:00:14.3: 0x0000004D | umac major
Apr 3 22:13:57 waplinuc kernel: [1158487.457074] iwlwifi 0000:00:14.3: 0x206B0184 | umac minor
Apr 3 22:13:57 waplinuc kernel: [1158487.457075] iwlwifi 0000:00:14.3: 0x00A909B2 | frame pointer
Apr 3 22:13:57 waplinuc kernel: [1158487.457077] iwlwifi 0000:00:14.3: 0xC0885E6C | stack pointer
Apr 3 22:13:57 waplinuc kernel: [1158487.457078] iwlwifi 0000:00:14.3: 0x004E010D | last host cmd
Apr 3 22:13:57 waplinuc kernel: [1158487.457080] iwlwifi 0000:00:14.3: 0x00000000 | isr status reg
Apr 3 22:13:57 waplinuc kernel: [1158487.457102] iwlwifi 0000:00:14.3: IML/ROM dump:
Apr 3 22:13:57 waplinuc kernel: [1158487.457104] iwlwifi 0000:00:14.3: 0x00000003 | IML/ROM error/state
Apr 3 22:13:57 waplinuc kernel: [1158487.457133] iwlwifi 0000:00:14.3: 0x0000554E | IML/ROM data1
Apr 3 22:13:57 waplinuc kernel: [1158487.457142] iwlwifi 0000:00:14.3: 0x00000080 | IML/ROM WFPM_AUTH_KEY_0
Apr 3 22:13:57 waplinuc kernel: [1158487.457148] iwlwifi 0000:00:14.3: Fseq Registers:
Apr 3 22:13:57 waplinuc kernel: [1158487.457151] iwlwifi 0000:00:14.3: 0x60000000 | FSEQ_ERROR_CODE
Apr 3 22:13:57 waplinuc kernel: [1158487.457175] iwlwifi 0000:00:14.3: 0x80260000 | FSEQ_TOP_INIT_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457178] iwlwifi 0000:00:14.3: 0x00020006 | FSEQ_CNVIO_INIT_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457202] iwlwifi 0000:00:14.3: 0x0000A384 | FSEQ_OTP_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457205] iwlwifi 0000:00:14.3: 0x7BCF3FBE | FSEQ_TOP_CONTENT_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457229] iwlwifi 0000:00:14.3: 0x4552414E | FSEQ_ALIVE_TOKEN
Apr 3 22:13:57 waplinuc kernel: [1158487.457232] iwlwifi 0000:00:14.3: 0x20000302 | FSEQ_CNVI_ID
Apr 3 22:13:57 waplinuc kernel: [1158487.457255] iwlwifi 0000:00:14.3: 0x00000201 | FSEQ_CNVR_ID
Apr 3 22:13:57 waplinuc kernel: [1158487.457259] iwlwifi 0000:00:14.3: 0x20000302 | CNVI_AUX_MISC_CHIP
Apr 3 22:13:57 waplinuc kernel: [1158487.457284] iwlwifi 0000:00:14.3: 0x00000201 | CNVR_AUX_MISC_CHIP
Apr 3 22:13:57 waplinuc kernel: [1158487.457289] iwlwifi 0000:00:14.3: 0x0000485B | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
Apr 3 22:13:57 waplinuc kernel: [1158487.457344] iwlwifi 0000:00:14.3: 0xA5A5A5A2 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
Apr 3 22:13:57 waplinuc kernel: [1158487.457367] iwlwifi 0000:00:14.3: 0x00020006 | FSEQ_PREV_CNVIO_INIT_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457370] iwlwifi 0000:00:14.3: 0x00260000 | FSEQ_WIFI_FSEQ_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457394] iwlwifi 0000:00:14.3: 0x00260000 | FSEQ_BT_FSEQ_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457397] iwlwifi 0000:00:14.3: 0x00000104 | FSEQ_CLASS_TP_VERSION
Apr 3 22:13:57 waplinuc kernel: [1158487.457427] iwlwifi 0000:00:14.3: UMAC CURRENT PC: 0x80470170
Apr 3 22:13:57 waplinuc kernel: [1158487.457451] iwlwifi 0000:00:14.3: LMAC1 CURRENT PC: 0xd0
Apr 3 22:13:57 waplinuc kernel: [1158487.457581] iwlwifi 0000:00:14.3: WRT: Collecting data: ini trigger 5 fired (delay=0ms).
Apr 3 22:13:57 waplinuc kernel: [1158487.457633] iwlwifi 0000:00:14.3: Hardware error detected. Restarting.
Apr 3 22:13:57 waplinuc kernel: [1158487.466821] iwlwifi 0000:00:14.3: WRT: trying to collect phy prph at time point: 5, skipping

When I get the password right, there's no microcode crash.

The access point is a Teltonika RUT 241 running firmware 00.07.06.8. It's an OpenWrt derivative.

I'm not 100% sure about security implications. The driver restarts and chip seems to work OK after that, but I had one case when it started acting up afterwards. Not sure if a rogue AP could affect this somehow for DoS or otherwise.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[QkiZ (qkiz)]

It's not only when using wrong password. Even if a password is good and the network is connected hardware restart is requested. When this error appears packets are dropped and the network speed slows down. As a workaround you can add

options iwlwifi 11n_disable=1

to /etc/modprobe.d/iwlwifi.conf file. This slows network to 54MBit/s but it is stable, with no packet drops and hardware reset.

[Pauli Heikkinen (wapauhei)]

That is very interesting. I have not had this specific microcode crash when the the password is accepted. This may be somehow dependent on how exactly the router behaves.

[QkiZ (qkiz)]

I have the same error but different firmware used on iwlwifi module. It's the same network card. It crashes in a few minutes of use and reveals a slow network connection and packet drops. I can't even test network speed by speedtest.net because the test is ending with an error. Ubuntu 23.10 here.

[AceLan Kao (acelankao)]

This kind of iwlwifi microcode crashes usually results from the router(Access Point).
Have you tried to cold reboot your AP?

From other discussion I found on the net, the issue might be related to 40MHz channel, you probably could try the below setting.
   options cfg80211 cfg80211_disable_40mhz_24ghz=Y

[Pauli Heikkinen (wapauhei)]

Cold rebooted several times to no effect. But updating the RUT241 firmware from 07.06.x to 07.07 fixes this problem for me - no more microcode crash if the password is wrong.

07.07 contains an updated wifi driver which probably is what fixes this problem with that router.

That is of course little help to anyone experiencing the same crash with some other router :)

[QkiZ (qkiz)]

It is unacceptable that AP can crash the Wi-Fi driver. Any other devices in the network work fine. Only one specific laptop with AX201 has a problem.
I wanted to check if the new version of Kubuntu resolved the issue. I downloaded Kubuntu 24.04 beta and ran it from a USB stick. The problem has gone on 24.04 but this may be by the new kernel, 6.8 version.
Anyway for now I will work with a workaround that works, it is slower but stable. After 24.04 release and system upgrade, I can remove the workaround and use full bandwidth.

[AceLan Kao (acelankao)]

This is not a driver failure, it's the microcode in the iwlwifi firmware.
As the issue no longer be reproducible by the bug reporter, Pauli, I'm going to close this bug.

@QkiZ,

It's interesting that the issue could be fixed by the newer kernel, I'd treat that as another issue.
If you want to help us to find the root cause, plase file a new bug and we may need your help to see between which kernels the issue is gone.
Thanks.