Intel Wireless AC 3168 on Eoan complaints FW error in SYNC CMD GEO_TX_POWER_LIMIT

[Lyubomir]

I have ubuntu 19.10 Eoan Ermine development version. Cannot boot since yesterday.

ProblemType: Bug
DistroRelease: Ubuntu 19.10
Package: linux-firmware 1.182
ProcVersionSignature: Ubuntu 5.3.0-13.14-generic 5.3.0
Uname: Linux 5.3.0-13-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu7
Architecture: amd64
Date: Mon Sep 30 20:57:08 2019
Dependencies:

InstallationDate: Installed on 2019-07-23 (68 days ago)
InstallationMedia: Ubuntu 18.04.1 LTS "Bionic Beaver" - Release amd64 (20180725)
PackageArchitecture: all
SourcePackage: linux-firmware
UpgradeStatus: Upgraded to eoan on 2019-09-27 (2 days ago)

--
Also found on Ubuntu-certified HP EliteDesk 800 G3 DM.

[sharvil.nanavati (sharvil.nanavati-linux-kernel-bugs)]

Created attachment 283657
Relevant dmesg output

Running Ubuntu 18.04 LTS with stock kernel (4.15.0-54-generic). Firmware failure with stock firmware from linux-firmware package (version 29.1044073957.0) and firmware supplied by Emmanuel (29.4009927039.0).

Takes about 1 day of uptime for the first firmware crash. After that, firmware restarts are fairly common (2-3 per day). Throughput drops by 3-4x after first firmware restart and never recovers. No specific repro steps; simply remain connected to a 5GHz WPA2 Personal network with occasional network activity.

[jethro.rose (jethro.rose-linux-kernel-bugs)]

I have also been seeing this sort of behaviour since about April/May with Fedora 30 and various kernel versions. Seems to be load-dependent - it will be fine for a while but do anything "strenous" network wise (like, say download distribution updates) and it seems more likely to happen. Sometimes after less than an hour. ifconfig down/up gets the network back.

I thought it was kernel related but as far as i can determine it is wireless firmware related, as rolling back to a previous fedora package (that was dated prior to May 14th on the fedora side) seems to revert the issue. But my testing has been limited as every time i update the box it seems to break again.

If anyone has some suggestions for diagnostics I'm willing to assist.

similar systemd journal output from my box also attached.

[jethro.rose (jethro.rose-linux-kernel-bugs)]

Created attachment 283893
systemd journal output, same issue, fedora 30 on asrock taichi x470

[jethro.rose (jethro.rose-linux-kernel-bugs)]

To confirm, this started happening for me in May, with kernel version 5.0.17 (as far as i can determine) onwards. So it isn't just with kernel 4.x, and as above i do not believe it to be kernel specific, rather wireless firmware specific due to firmware rollback resolving the issue.

[luca (luca-linux-kernel-bugs)]

There seems to be an issue with the new FW where it doesn't flag support for the new command version, but uses it anyway. The crash is caused by the driver sending a command in the wrong (i.e. old) format.

I'll fix this and send a patch/new FW version in a bit.

[luca (luca-linux-kernel-bugs)]

*** Bug 204213 has been marked as a duplicate of this bug. ***

[luca (luca-linux-kernel-bugs)]

*** Bug 204153 has been marked as a duplicate of this bug. ***

[noonetinone (noonetinone-linux-kernel-bugs)]

Created attachment 284709
dmesg output from iwlwifi 3168

I'm getting strange kernel output with Intel(R) Dual Band Wireless AC 3168, REV=0x220. It amounts to just garbage backtrace. For me, it only happens with the 5.3 release candidates. Everything is good with linux stable tree.

I've updated the firmware but no dice. Am I missing a kernel config option?
A bios setting perhaps? I've got a Asrock x370 taichi mother board.

Attached is some output from dmesg and lspci. The first 10 lines were pruned.
Around line 180 is the output from lspci.

[chris2553 (chris2553-linux-kernel-bugs)]

Created attachment 284873
FW crash messages extracted from kernel log.

[chris2553 (chris2553-linux-kernel-bugs)]

Is the patch/new FW mentioned in comment 4 above available yet, please? I'm still seeing this FW crash in 5.3.0-rc7+. I'm using the latest firmware in the linux-firmware git tree (iwlwifi 0000:02:00.0: loaded firmware version 46.6bf1df06.0 op_mode iwlmvm) in the hiope that this is the FW referred to in the comment. Relevant messages from kernel log is attached.

[bugzilla (bugzilla-linux-kernel-bugs)]

I'm still seeing it every boot and wake from suspend with 5.3.0-rc7 as well, on an 8260 controller.

[ 9.866194] flap.local kernel: iwlwifi 0000:6c:00.0: Microcode SW error detected. Restarting 0x2000000.
[ 9.866330] flap.local kernel: iwlwifi 0000:6c:00.0: Start IWL Error Log Dump:
[ 9.866331] flap.local kernel: iwlwifi 0000:6c:00.0: Status: 0x00000080, count: 6
[ 9.866332] flap.local kernel: iwlwifi 0000:6c:00.0: Loaded firmware version: 36.77d01142.0
[ 9.866334] flap.local kernel: iwlwifi 0000:6c:00.0: 0x00000038 | BAD_COMMAND
...
[ 9.867069] flap.local kernel: iwlwifi 0000:6c:00.0: FW error in SYNC CMD GEO_TX_POWER_LIMIT
...
[ 9.867192] flap.local kernel: WARNING: CPU: 2 PID: 685 at drivers/net/wireless/intel/iwlwifi/mvm/scan.c:1874 iwl_mvm_rx_umac_scan_complete_notif.cold+0xc>
[ 9.867237] flap.local kernel: CPU: 2 PID: 685 Comm: kworker/2:5 Not tainted 5.3.0-0.rc7.git0.1.fc31.x86_64 #1

And kernel is then tainted 512.

[ilya.lipnitskiy (ilya.lipnitskiy-linux-kernel-bugs)]

Still happens on 5.3.0 on an 8260 controller, any updates?

kernel: iwlwifi 0000:02:00.0: loaded firmware version 36.77d01142.0 op_mode iwlmvm
kernel: iwlwifi 0000:02:00.0: Detected Intel(R) Dual Band Wireless AC 8260, REV=0x208
kernel: iwlwifi 0000:02:00.0: Microcode SW error detected. Restarting 0x82000000.
kernel: iwlwifi 0000:02:00.0: Loaded firmware version: 36.77d01142.0
kernel: iwlwifi 0000:02:00.0: FW error in SYNC CMD GEO_TX_POWER_LIMIT
kernel: CPU: 2 PID: 71 Comm: kworker/2:1 Tainted: P OE 5.3.0-arch1-1-ARCH #1
kernel: Hardware name: HP HP ZBook 15 G3/80D5, BIOS N81 Ver. 01.41 07/16/2019
kernel: Workqueue: events iwl_mvm_async_handlers_wk [iwlmvm]
kernel: Call Trace:
kernel: dump_stack+0x5c/0x80
kernel: iwl_trans_pcie_send_hcmd+0x547/0x560 [iwlwifi]
kernel: ? wait_woken+0x70/0x70
kernel: iwl_trans_send_cmd+0x59/0xb0 [iwlwifi]
kernel: iwl_mvm_send_cmd+0x2e/0x80 [iwlmvm]
kernel: iwl_mvm_get_sar_geo_profile+0x102/0x180 [iwlmvm]
kernel: iwl_mvm_rx_chub_update_mcc+0x10b/0x1a0 [iwlmvm]
kernel: iwl_mvm_async_handlers_wk+0xaa/0x140 [iwlmvm]
kernel: process_one_work+0x1d1/0x3a0
kernel: worker_thread+0x4a/0x3d0
kernel: kthread+0xfb/0x130
kernel: ? process_one_work+0x3a0/0x3a0
kernel: ? kthread_park+0x80/0x80
kernel: ret_from_fork+0x35/0x40
kernel: iwlwifi 0000:02:00.0: Failed to get geographic profile info -5

[ilya.lipnitskiy (ilya.lipnitskiy-linux-kernel-bugs)]

Created attachment 285073
Crash on 5.3.0

[luca (luca-linux-kernel-bugs)]

*** Bug 204917 has been marked as a duplicate of this bug. ***

[luca (luca-linux-kernel-bugs)]

*** Bug 204943 has been marked as a duplicate of this bug. ***

[luca (luca-linux-kernel-bugs)]

I have just sent a fix for this upstream:

https://patchwork.kernel.org/patch/11158395/

It will hopefully be taken to v5.4 soon and from there to stable v5.3, v5.2 and v4.19.

[sharvil.nanavati (sharvil.nanavati-linux-kernel-bugs)]

Looking at the original log I attached to this bug report, I see that the uCode major version for my device is 0x1D (29):

[79300.452830] iwlwifi 0000:05:00.0: 0x0000001D | uCode version major

The patch enables GEO_TX_POWER_LIMIT for uCode major version 36 which wouldn't affect my device.

Maybe I misunderstood something about the nature of the issue / patch, but it seems that the original bug report I reported is different than what is being fixed here. If so, should I file another bug or should we reopen this bug?

[bugzilla (bugzilla-linux-kernel-bugs)]

Awesome, thanks Luca!

[chris2553 (chris2553-linux-kernel-bugs)]

On 24/09/2019 18:03, <email address hidden> wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=204151
>
> --- Comment #16 from <email address hidden> ---
> Looking at the original log I attached to this bug report, I see that the
> uCode
> major version for my device is 0x1D (29):
>
> [79300.452830] iwlwifi 0000:05:00.0: 0x0000001D | uCode version major
>
> The patch enables GEO_TX_POWER_LIMIT for uCode major version 36 which
> wouldn't
> affect my device.
>

Even with that patch applied, I'm still getting the crash too. Hardware and uCode version are shown in:

[ 3.447509] iwlwifi 0000:02:00.0: loaded firmware version 46.6bf1df06.0 op_mode iwlmvm
[ 3.493018] iwlwifi 0000:02:00.0: Detected Intel(R) Wireless-AC 9260 160MHz, REV=0x324

> Maybe I misunderstood something about the nature of the issue / patch, but it
> seems that the original bug report I reported is different than what is being
> fixed here. If so, should I file another bug or should we reopen this bug?
>

[luca (luca-linux-kernel-bugs)]

(In reply to sharvil.nanavati from comment #16)
> Looking at the original log I attached to this bug report, I see that the
> uCode major version for my device is 0x1D (29):
>
> [79300.452830] iwlwifi 0000:05:00.0: 0x0000001D | uCode version major
>
> The patch enables GEO_TX_POWER_LIMIT for uCode major version 36 which
> wouldn't affect my device.
>
> Maybe I misunderstood something about the nature of the issue / patch, but
> it seems that the original bug report I reported is different than what is
> being fixed here. If so, should I file another bug or should we reopen this
> bug?

The original bug you reported, the one that has this line in the logs:

[79300.452799] iwlwifi 0000:05:00.0: 0x00000034 | NMI_INTERRUPT_WDG

...has been fix with commit 0c3d7282233c ("iwlwifi: Add support for SAR South Korea limitation") upstream (it's in v5.3). This back has also been backported to v5.2.10+. The new patch I posted here today is not relevant for the "NMI_INTERRUPT_WDG" case. Please make sure you are using v5.2.10 or above.

[luca (luca-linux-kernel-bugs)]

(In reply to Chris Clayton from comment #18)
> Even with that patch applied, I'm still getting the crash too. Hardware and
> uCode version are shown in:
>
> [ 3.447509] iwlwifi 0000:02:00.0: loaded firmware version 46.6bf1df06.0
> op_mode iwlmvm
> [ 3.493018] iwlwifi 0000:02:00.0: Detected Intel(R) Wireless-AC 9260
> 160MHz, REV=0x324

With this device you are probably getting the NMI_INTERRUPT_WDG case. I can't see the kernel version you are using, but it probably doesn't have the fix. Can you please check and report?

For the record, this is the patch upstream for the NMI_INTERRUPT_WDG case:

https://patchwork.kernel.org/patch/11021735/

[sharvil.nanavati (sharvil.nanavati-linux-kernel-bugs)]

Thanks for closing the loop on this, Luca. Much appreciated.

[chris2553 (chris2553-linux-kernel-bugs)]

(In reply to Luca Coelho from comment #20)
> (In reply to Chris Clayton from comment #18)
> > Even with that patch applied, I'm still getting the crash too. Hardware and
> > uCode version are shown in:
> >
> > [ 3.447509] iwlwifi 0000:02:00.0: loaded firmware version 46.6bf1df06.0
> > op_mode iwlmvm
> > [ 3.493018] iwlwifi 0000:02:00.0: Detected Intel(R) Wireless-AC 9260
> > 160MHz, REV=0x324
>
> With this device you are probably getting the NMI_INTERRUPT_WDG case. I
> can't see the kernel version you are using, but it probably doesn't have the
> fix. Can you please check and report?
>
> For the record, this is the patch upstream for the NMI_INTERRUPT_WDG case:
>
> https://patchwork.kernel.org/patch/11021735/

I'm running 5.3.1 which already includes the patch you've pointed to.

I can generate the Microcode SW error more or less at will by downloading a large file (e.g. the Fedora 30 .iso). I've just done that and I'll attach the output from dmesg in a moment.

[chris2553 (chris2553-linux-kernel-bugs)]

Created attachment 285165
dmesg showing Microcode SW error

[luca (luca-linux-kernel-bugs)]

*** Bug 204983 has been marked as a duplicate of this bug. ***

[luca (luca-linux-kernel-bugs)]

(In reply to Chris Clayton from comment #22)
> I'm running 5.3.1 which already includes the patch you've pointed to.
>
> I can generate the Microcode SW error more or less at will by downloading a
> large file (e.g. the Fedora 30 .iso). I've just done that and I'll attach
> the output from dmesg in a moment.

The error you are getting is a different one:

[ 554.990533] iwlwifi 0000:02:00.0: 0x000022CE | ADVANCED_SYSASSERT

In this case, the signature is SYSASSERT and 0x000022CE. Can you please file a separate report for it?

[mcroce (mcroce-linux-kernel-bugs)]

*** Bug 205035 has been marked as a duplicate of this bug. ***

[Seth Forshee (sforshee)]

I'm confused ... is this bug about wifi issues or is it about being unable to boot?

[Lyubomir (mystiquewolf)]

It's about the crash due to which I cannot boot. I think it's a bug and that's why I posted here. I'm attaching a video of the boot log as per ubuntu wiki instructions. https://photos.app.goo.gl/pveSHmFy4M93t8we9

[Seth Forshee (sforshee)]

It's difficult to get the full log from the video. Can you check to see if your logs contain the crash dump, either by checking journalctl (e.g. 'journalctl -b -1' to access the previous boot, 'journalctl -b -2' to access the boot before that, etc.) or by looking for it in the /var/log/kern.log* files? Thanks!

[Seth Forshee (sforshee)]

This definitely looks like either a firmware issue or a kernel/firmware interaction issue.
Can you attach the output from 'lspci -vvnn'?

I'm subscribing the linux wireless driver team from Intel to the bug. For the record, this kernel is based on 5.13.1, and the linux-firmware package is based on upstream commit 6c6918ad8ae0dfb2cb591484eba525409980c16f.

[Lyubomir (mystiquewolf)]

How should i proceed, should i wait for some possible patch, or i should reinstall?

[Seth Forshee (sforshee)]

I don't think reinstallation is going to help. I'm hoping we can get some assistance from Intel. You might get a quicker response if you file a bug in their usual bug tracker, see the "How to report?" section of https://wireless.wiki.kernel.org/en/users/drivers/iwlwifi/debugging.

[You-Sheng Yang (vicamo)]

Hi, could you try backport-iwlwifi-dkms package fro my ppa https://launchpad.net/~vicamo/+archive/ubuntu/backport-iwlwifi-dkms . This ppa contains some packages from latest intel backport-iwlwifi tree HEAD.

[Lyubomir (mystiquewolf)]

I installed that package and rebooted - still got blinking cursor in video terminal and it looks at least to me as the same errors in the first terminal. The difference in the behavior after installing this package is that now the errors seem to display in a loop in an interval of 6-7 seconds also on second, third, etc terminals. Before that i used to login at least with text console without the errors also appearing there, before they only showed up in first terminal. Attached is a new journalctl log.

[You-Sheng Yang (vicamo)]

It seems the log you attached is for the session you were installing the package, not for the session after you installed the package. Could you re-submit again?

[Lyubomir (mystiquewolf)]

Now i am attaching a log from a session after a reboot, without any -1 or -2 options for journalctl.

[You-Sheng Yang (vicamo)]

https://wireless.wiki.kernel.org/en/users/drivers/iwlwifi#firmware
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux-firmware/tree/?h=eoan
From above information, so you should have already the latest firmware
iwlwifi-3168-29.ucode for this AC 3168 card, as well as the latest
backport-iwlwifi dkms, it seems to me that either we will need Intel's
direct support or we should try previous stable backport-iwlwifi releases
instead. Digging.

Lyubomir Parvanov <email address hidden> 於 2019年10月3日 週四 13:35 寫道：

> Now i am attaching a log from a session after a reboot, without any -1
> or -2 options for journalctl.
>
> ** Attachment added: "journal_last.txt"
>
> https://bugs.launchpad.net/ubuntu/+source/linux-firmware/+bug/1846016/+attachment/5293874/+files/journal_last.txt
>
> --
> You received this bug notification because you are a member of Canonical
> Kernel Team, which is subscribed to linux-firmware in Ubuntu.
> https://bugs.launchpad.net/bugs/1846016
>
> Title:
> iwlwifi regular scan timed out error sending statistics_cmd queue 0 is
> inactive
>
> Status in linux-firmware package in Ubuntu:
> New
>
> Bug description:
> I have ubuntu 19.10 Eoan Ermine development version. Cannot boot since
> yesterday.
>
> ProblemType: Bug
> DistroRelease: Ubuntu 19.10
> Package: linux-firmware 1.182
> ProcVersionSignature: Ubuntu 5.3.0-13.14-generic 5.3.0
> Uname: Linux 5.3.0-13-generic x86_64
> NonfreeKernelModules: nvidia_modeset nvidia
> ApportVersion: 2.20.11-0ubuntu7
> Architecture: amd64
> Date: Mon Sep 30 20:57:08 2019
> Dependencies:
>
> InstallationDate: Installed on 2019-07-23 (68 days ago)
> InstallationMedia: Ubuntu 18.04.1 LTS "Bionic Beaver" - Release amd64
> (20180725)
> PackageArchitecture: all
> SourcePackage: linux-firmware
> UpgradeStatus: Upgraded to eoan on 2019-09-27 (2 days ago)
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/linux-firmware/+bug/1846016/+subscriptions
>

[You-Sheng Yang (vicamo)]

By the way, maybe you want to disable this WiFi adapter first if that helps
to retain access to your desktop environment. You may want to append
"modprobe.blacklist=iwlwifi" to boot parameters in /etc/default/grub and
run `sudo update-grub`.

[You-Sheng Yang (vicamo)]

dmesg for 5.0.0-1024-oem-osp1 + eoan linux-firmware v1.182, works fine.

[You-Sheng Yang (vicamo)]

dmesg for mainline v5.2.17 + eoan linux-firmware v1.182, works fine.

[You-Sheng Yang (vicamo)]

dmesg for mainline v5.3-rc1 + eoan linux-firmware v1.182, same error messages, but system still boots into GUI as usual.

[You-Sheng Yang (vicamo)]

dmesg for eoan 5.3.0-13-generic + eoan linux-firmware v1.182, same error messages, but system still boots into GUI as usual.

[You-Sheng Yang (vicamo)]

dmesg for mainline v5.4-rc1 + eoan linux-firmware v1.182, same error messages, but system still boots into GUI as usual.

[You-Sheng Yang (vicamo)]

So I happened to kick a box containing a Ubuntu-certified HP EliteDesk 800 G3 DM that has the same AC 3168 wireless adapter and had some experiments on it.

For the iwlwifi error messages part, it should not affect system boot, and the internet connectivity is not affected, either. Some time between v5.2.17 to v5.3-rc1, this regression was introduced, and there is still no upstream fix currently at v5.4-rc1. The root cause should probably be:

  * 0c3d7282233c iwlwifi: Add support for SAR South Korea limitation

which introduced a new command CMD GEO_TX_POWER_LIMIT.

It seems this is a duplicate of upstream bug https://bugzilla.kernel.org/show_bug.cgi?id=204151, which has proposed a solution https://patchwork.kernel.org/patch/11158395/ but not yet accepted.

[Lyubomir (mystiquewolf)]

In one of the latest boots i've found red lines with some gdm3 error, so i gave gnome-shell a purge and reinstall and it worked. With the backport of iwlwifi i didn't have internet, but i uninstalled it and then was able to reinstall gnome-shell.

[vicamo (vicamo-linux-kernel-bugs)]

Hi, the patch proposed in comment 15 doesn't seem to fix the error found with a AC 3168 card. The latest firmware revision for AC 3168 is -29, and it's trying to remove -36 from the conditions. I had a build that removes both -29 and -36 together, which fixes this fw error on AC 3168 as expected.

[You-Sheng Yang (vicamo)]

Tried proposed patch https://patchwork.kernel.org/patch/11158395/ in comment #38, still have this issue. However, that patch only removes -36 from the condition, and the firmware rev used for AC 3168 is -29. With -29 removed from the conditions as well, there is no more errors.

[You-Sheng Yang (vicamo)]

https://lore.kernel.org/patchwork/patch/1136875/

[luca (luca-linux-kernel-bugs)]

Thanks for the patch you sent You-Sheng!

As I replied in the list, the 7265D devices do implement this command, so a better fix would be this:

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 0d2229319261..38d89ee9bd28 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -906,8 +906,10 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm
*mvm)
         * entirely.
         */
        return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 ||
- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 ||
- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17;
+ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17 ||
+ (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 &&
+ (mvm->trans->hw_rev &
+ CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D);
 }

 int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)

Can someone try it?

[luca (luca-linux-kernel-bugs)]

Okay, I think this patch is good and I have applied it internally. I'll push it you as soon as I get confirmation that the patch I posted in the previous comment works.

[vicamo (vicamo-linux-kernel-bugs)]

I can confirm the patch in comment 15 and comment 28 turns off firmware error messages on a HP EliteDesk 800 G3 DM that equips Intel AC 3168.

[luca (luca-linux-kernel-bugs)]

Thanks for confirming, You-Sheng!

[luca (luca-linux-kernel-bugs)]

Here's the patch that was sent upstream:

https://lore.kernel.org/linux-wireless/20191009094853.PfIm3J8o7DN_Femup-OXkJdtmKE7rftk1ODkm7cx-vk@z/

[luca (luca-linux-kernel-bugs)]

*** Bug 205163 has been marked as a duplicate of this bug. ***

[You-Sheng Yang (vicamo)]

Patches to be SRU-ed:
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fddbfeece9c7882cc47754c7da460fe427e3e85b "iwlwifi: fw: don't send GEO_TX_POWER_LIMIT command to FW version 36"
* https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=12e36d98d3e5acf5fc57774e0a15906d55f30cb9 "iwlwifi: exclude GEO SAR support for 3168"

[You-Sheng Yang (vicamo)]

This affects generic kernel on Disco or above, and -oem, -oem-osp1 kernsl as well.

[You-Sheng Yang (vicamo)]

https://lists.ubuntu.com/archives/kernel-team/2019-October/104807.html

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[linux (linux-linux-kernel-bugs)]

(In reply to Luca Coelho from comment #32)
> Here's the patch that was sent upstream:
> https://lore.kernel.org/linux-wireless/20191009094853.PfIm3J8o7DN_Femup-
> OXkJdtmKE7rftk1ODkm7cx-vk@z/

That patch/https://git.kernel.org/torvalds/c/12e36d98d3e5acf5fc57774e0a15906d55f30cb9 is not marked for stable afaics. I wonder if it should, as it contains this line:
```
Fixes: f5a47fae6aa3 ("iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support")
```
And that patch was recently backported to 5.3:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.3.y&id=3a0b7157d6a9833cefd40b5f0fa1cc90285bb4b5

Thus I suspect that 12e36d98d3e5 should be backported, too. I guess Bug 205163 is an indicator for that, as it talks about Linux 5.3.5.

[linux (linux-linux-kernel-bugs)]

(In reply to Thorsten Leemhuis from comment #34)
> ```
> Fixes: f5a47fae6aa3 ("iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT
> support")
> ```
> And that patch was recently backported to 5.3:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/
> ?h=linux-5.3.y&id=3a0b7157d6a9833cefd40b5f0fa1cc90285bb4b5

Scratch that, I mixed up the commits, sorry for the noise.

But I still wonder if https://git.kernel.org/torvalds/c/12e36d98d3e5acf5fc57774e0a15906d55f30cb9 should be backported, as I see warnings mentioned in Bug 205163 here as well on a system with a 3168

[liubomirwm (liubomirwm-linux-kernel-bugs)]

I also still have these issues on my Aspire A515-51G. https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1846016

[vicamo (vicamo-linux-kernel-bugs)]

Hi Lyubomir, please help ACK https://lists.ubuntu.com/archives/kernel-team/2019-October/104807.html if that works for you. It has been landed to Ubuntu linux-oem/linux-oem-osp1 tree, but not yet in the -generic trees due to the lack of sufficient ACKs.

[vicamo (vicamo-linux-kernel-bugs)]

Lyubomir, you may use my PPA https://launchpad.net/~vicamo/+archive/ubuntu/ppa-1846016 for test.

[You-Sheng Yang (vicamo)]

One may install my prebuilt kernel with following command:

  $ sudo apt install --no-install-recommends linux-headers-5.3.0-17-generic=5.3.0-17.18+lp1846016 linux-modules-extra-5.3.0-17-generic=5.3.0-17.18+lp1846016

You'll have to select the right kernel to boot in the grub menu because it's not the latest one installed in your system.

[brett hassall (brett-hassall)]

I am running the suggested kernel from your PPA.

No problems so far.

Thank you.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem - 4.15.0-1063.72

---------------
linux-oem (4.15.0-1063.72) bionic; urgency=medium

  * CVE-2019-11135
    - [Config] oem: Disable TSX by default when possible

  [ Ubuntu: 4.15.0-69.78 ]

  * KVM NULL pointer deref (LP: #1851205)
    - KVM: nVMX: handle page fault in vmread fix
  * CVE-2018-12207
    - KVM: MMU: drop vcpu param in gpte_access
    - kvm: Convert kvm_lock to a mutex
    - kvm: x86: Do not release the page inside mmu_set_spte()
    - KVM: x86: make FNAME(fetch) and __direct_map more similar
    - KVM: x86: remove now unneeded hugepage gfn adjustment
    - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON
    - KVM: x86: add tracepoints around __direct_map and FNAME(fetch)
    - kvm: x86, powerpc: do not allow clearing largepages debugfs entry
    - SAUCE: KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is
      active
    - SAUCE: x86: Add ITLB_MULTIHIT bug infrastructure
    - SAUCE: kvm: mmu: ITLB_MULTIHIT mitigation
    - SAUCE: kvm: Add helper function for creating VM worker threads
    - SAUCE: kvm: x86: mmu: Recovery of shattered NX large pages
    - SAUCE: cpu/speculation: Uninline and export CPU mitigations helpers
    - SAUCE: kvm: x86: mmu: Apply global mitigations knob to ITLB_MULTIHIT
  * CVE-2019-11135
    - KVM: x86: use Intel speculation bugs and features as derived in generic x86
      code
    - x86/msr: Add the IA32_TSX_CTRL MSR
    - x86/cpu: Add a helper function x86_read_arch_cap_msr()
    - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
    - x86/speculation/taa: Add mitigation for TSX Async Abort
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
    - x86/tsx: Add "auto" option to the tsx= cmdline parameter
    - x86/speculation/taa: Add documentation for TSX Async Abort
    - x86/tsx: Add config options to set tsx=on|off|auto
    - SAUCE: x86/speculation/taa: Call tsx_init()
    - SAUCE: x86/cpu: Include cpu header from bugs.c
    - [Config] Disable TSX by default when possible
  * CVE-2019-0154
    - SAUCE: drm/i915: Lower RM timeout to avoid DSI hard hangs
    - SAUCE: drm/i915/gen8+: Add RC6 CTX corruption WA
  * CVE-2019-0155
    - drm/i915/gtt: Add read only pages to gen8_pte_encode
    - drm/i915/gtt: Read-only pages for insert_entries on bdw+
    - drm/i915/gtt: Disable read-only support under GVT
    - drm/i915: Prevent writing into a read-only object via a GGTT mmap
    - drm/i915/cmdparser: Check reg_table_count before derefencing.
    - drm/i915/cmdparser: Do not check past the cmd length.
    - drm/i915: Silence smatch for cmdparser
    - drm/i915: Move engine->needs_cmd_parser to engine->flags
    - SAUCE: drm/i915: Rename gen7 cmdparser tables
    - SAUCE: drm/i915: Disable Secure Batches for gen6+
    - SAUCE: drm/i915: Remove Master tables from cmdparser
    - SAUCE: drm/i915: Add support for mandatory cmdparsing
    - SAUCE: drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
    - SAUCE: drm/i915: Allow parsing of unsized batches
    - SAUCE: drm/i915: Add gen9 BCS cmdparsing
    - SAUCE: drm/i915/cmdparser: Use explicit ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-osp1 - 5.0.0-1027.31

---------------
linux-oem-osp1 (5.0.0-1027.31) bionic; urgency=medium

  * CVE-2019-11135
    - [Config] Disable TSX by default when possible

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts

  [ Ubuntu: 5.0.0-35.38 ]

  * [REGRESSION] md/raid0: cannot assemble multi-zone RAID0 with default_layout
    setting (LP: #1849682)
    - SAUCE: Fix revert "md/raid0: avoid RAID0 data corruption due to layout
      confusion."
  * refcount underflow and type confusion in shiftfs (LP: #1850867) // CVE-2019-15793
    - SAUCE: shiftfs: Correct id translation for lower fs operations
    - SAUCE: shiftfs: prevent type confusion
    - SAUCE: shiftfs: Fix refcount underflow in btrfs ioctl handling
  * CVE-2018-12207
    - kvm: Convert kvm_lock to a mutex
    - kvm: x86: Do not release the page inside mmu_set_spte()
    - KVM: x86: make FNAME(fetch) and __direct_map more similar
    - KVM: x86: remove now unneeded hugepage gfn adjustment
    - KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON
    - KVM: x86: add tracepoints around __direct_map and FNAME(fetch)
    - kvm: x86, powerpc: do not allow clearing largepages debugfs entry
    - SAUCE: KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is
      active
    - SAUCE: x86: Add ITLB_MULTIHIT bug infrastructure
    - SAUCE: kvm: mmu: ITLB_MULTIHIT mitigation
    - SAUCE: kvm: Add helper function for creating VM worker threads
    - SAUCE: kvm: x86: mmu: Recovery of shattered NX large pages
    - SAUCE: cpu/speculation: Uninline and export CPU mitigations helpers
    - SAUCE: kvm: x86: mmu: Apply global mitigations knob to ITLB_MULTIHIT
  * CVE-2019-11135
    - KVM: x86: use Intel speculation bugs and features as derived in generic x86
      code
    - x86/msr: Add the IA32_TSX_CTRL MSR
    - x86/cpu: Add a helper function x86_read_arch_cap_msr()
    - x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
    - x86/speculation/taa: Add mitigation for TSX Async Abort
    - x86/speculation/taa: Add sysfs reporting for TSX Async Abort
    - kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
    - x86/tsx: Add "auto" option to the tsx= cmdline parameter
    - x86/speculation/taa: Add documentation for TSX Async Abort
    - x86/tsx: Add config options to set tsx=on|off|auto
    - SAUCE: x86/speculation/taa: Call tsx_init()
    - [Config] Disable TSX by default when possible
  * CVE-2019-0154
    - SAUCE: drm/i915: Lower RM timeout to avoid DSI hard hangs
    - SAUCE: drm/i915/gen8+: Add RC6 CTX corruption WA
  * CVE-2019-0155
    - SAUCE: drm/i915: Rename gen7 cmdparser tables
    - SAUCE: drm/i915: Disable Secure Batches for gen6+
    - SAUCE: drm/i915: Remove Master tables from cmdparser
    - SAUCE: drm/i915: Add support for mandatory cmdparsing
    - SAUCE: drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
    - SAUCE: drm/i915: Allow parsing of unsized batches
    - SAUCE: drm/i915: Add gen9 BCS cmdparsing
    - SAUCE: drm/i915/cmdparser: Use explicit goto for error paths
    - SAUCE: drm/i915/cmdparser: Add support for backward jumps
    - SAUCE: drm/i915/cmdparser: Ignore L...

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-disco' to 'verification-done-disco'. If the problem still exists, change the tag 'verification-needed-disco' to 'verification-failed-disco'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[brett hassall (brett-hassall)]

I reported a related bug on Eoan (5.3 kernel). Is there a 5.3 kernel to test yet?

[Adam Barton (abarton5)]

This fix is in the latest eoan kernel on the live repository. Just do standard update and reboot.

[You-Sheng Yang (vicamo)]

Verified bionic-proposed/4.15.0-71.80, disco-proposed/5.0.0-37.40, eoan-proposed/5.3.0-24.26 on HP EliteDesk 800 G3 DM.

[brett hassall (brett-hassall)]

verified eoan 5.3.0-24.26 against my original bug (1846264) as well

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.0.0-37.40

---------------
linux (5.0.0-37.40) disco; urgency=medium

  * disco/linux: 5.0.0-37.40 -proposed tracker (LP: #1852253)

  * System hangs at early boot (LP: #1851216)
    - x86/timer: Skip PIT initialization on modern chipsets

  * drm/i915: Add support for another CMP-H PCH (LP: #1848491)
    - drm/i915/cml: Add second PCH ID for CMP

  * Some EFI systems fail to boot in efi_init() when booted via maas
    (LP: #1851810)
    - efi: efi_get_memory_map -- increase map headroom

  * seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test (LP: #1849281)
    - SAUCE: seccomp: avoid overflow in implicit constant conversion
    - SAUCE: seccomp: rework define for SECCOMP_USER_NOTIF_FLAG_CONTINUE
    - SAUCE: seccomp: fix SECCOMP_USER_NOTIF_FLAG_CONTINUE test

  * dkms artifacts may expire from the pool (LP: #1850958)
    - [Packaging] dkms -- try launchpad librarian for pool downloads
    - [Packaging] dkms -- dkms-build quieten wget verbiage

  * update ENA driver to version 2.1.0 (LP: #1850175)
    - net: ena: fix swapped parameters when calling
      ena_com_indirect_table_fill_entry
    - net: ena: fix: Free napi resources when ena_up() fails
    - net: ena: fix incorrect test of supported hash function
    - net: ena: fix return value of ena_com_config_llq_info()
    - net: ena: improve latency by disabling adaptive interrupt moderation by
      default
    - net: ena: fix ena_com_fill_hash_function() implementation
    - net: ena: add handling of llq max tx burst size
    - net: ena: ethtool: add extra properties retrieval via get_priv_flags
    - net: ena: replace free_tx/rx_ids union with single free_ids field in
      ena_ring
    - net: ena: arrange ena_probe() function variables in reverse christmas tree
    - net: ena: add newline at the end of pr_err prints
    - net: ena: documentation: update ena.txt
    - net: ena: allow automatic fallback to polling mode
    - net: ena: add support for changing max_header_size in LLQ mode
    - net: ena: optimise calculations for CQ doorbell
    - net: ena: add good checksum counter
    - net: ena: use dev_info_once instead of static variable
    - net: ena: add MAX_QUEUES_EXT get feature admin command
    - net: ena: enable negotiating larger Rx ring size
    - net: ena: make ethtool show correct current and max queue sizes
    - net: ena: allow queue allocation backoff when low on memory
    - net: ena: add ethtool function for changing io queue sizes
    - net: ena: remove inline keyword from functions in *.c
    - net: ena: update driver version from 2.0.3 to 2.1.0
    - net: ena: Fix bug where ring allocation backoff stopped too late
    - Revert "net: ena: ethtool: add extra properties retrieval via
      get_priv_flags"
    - net: ena: don't wake up tx queue when down
    - net: ena: clean up indentation issue

  * Add Intel Comet Lake ethernet support (LP: #1848555)
    - SAUCE: e1000e: Add support for Comet Lake

  * Intel Wireless AC 3168 on Eoan complaints FW error in SYNC CMD
    GEO_TX_POWER_LIMIT (LP: #1846016)
    - iwlwifi: exclude GEO SAR support for 3168

  * tsc marked unstable after entered PC10 on Intel CoffeeLake (LP: #1840239...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.15.0-72.81

---------------
linux (4.15.0-72.81) bionic; urgency=medium

  * bionic/linux: 4.15.0-72.81 -proposed tracker (LP: #1854027)

  * [Regression] Bionic kernel 4.15.0-71.80 can not boot on ThunderX
    (LP: #1853326)
    - Revert "arm64: Use firmware to detect CPUs that are not affected by
      Spectre-v2"
    - Revert "arm64: Get rid of __smccc_workaround_1_hvc_*"

  * [Regression] Bionic kernel 4.15.0-71.80 can not boot on ThunderX2 and
    Kunpeng920 (LP: #1852723)
    - SAUCE: arm64: capabilities: Move setup_boot_cpu_capabilities() call to
      correct place

linux (4.15.0-71.80) bionic; urgency=medium

  * bionic/linux: 4.15.0-71.80 -proposed tracker (LP: #1852289)

  * Bionic update: upstream stable patchset 2019-10-29 (LP: #1850541)
    - panic: ensure preemption is disabled during panic()
    - f2fs: use EINVAL for superblock with invalid magic
    - [Config] updateconfigs for USB_RIO500
    - USB: rio500: Remove Rio 500 kernel driver
    - USB: yurex: Don't retry on unexpected errors
    - USB: yurex: fix NULL-derefs on disconnect
    - USB: usb-skeleton: fix runtime PM after driver unbind
    - USB: usb-skeleton: fix NULL-deref on disconnect
    - xhci: Fix false warning message about wrong bounce buffer write length
    - xhci: Prevent device initiated U1/U2 link pm if exit latency is too long
    - xhci: Check all endpoints for LPM timeout
    - usb: xhci: wait for CNR controller not ready bit in xhci resume
    - USB: adutux: fix use-after-free on disconnect
    - USB: adutux: fix NULL-derefs on disconnect
    - USB: adutux: fix use-after-free on release
    - USB: iowarrior: fix use-after-free on disconnect
    - USB: iowarrior: fix use-after-free on release
    - USB: iowarrior: fix use-after-free after driver unbind
    - USB: usblp: fix runtime PM after driver unbind
    - USB: chaoskey: fix use-after-free on release
    - USB: ldusb: fix NULL-derefs on driver unbind
    - serial: uartlite: fix exit path null pointer
    - USB: serial: keyspan: fix NULL-derefs on open() and write()
    - USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20
    - USB: serial: option: add Telit FN980 compositions
    - USB: serial: option: add support for Cinterion CLS8 devices
    - USB: serial: fix runtime PM after driver unbind
    - USB: usblcd: fix I/O after disconnect
    - USB: microtek: fix info-leak at probe
    - USB: dummy-hcd: fix power budget for SuperSpeed mode
    - usb: renesas_usbhs: gadget: Do not discard queues in
      usb_ep_set_{halt,wedge}()
    - usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior
    - USB: legousbtower: fix slab info leak at probe
    - USB: legousbtower: fix deadlock on disconnect
    - USB: legousbtower: fix potential NULL-deref on disconnect
    - USB: legousbtower: fix open after failed reset request
    - USB: legousbtower: fix use-after-free on release
    - staging: vt6655: Fix memory leak in vt6655_probe
    - iio: adc: ad799x: fix probe error handling
    - iio: adc: axp288: Override TS pin bias current for some models
    - iio: light: opt3001: fix mutex unlock race
    - efivar/ssdt: Don't iterate over EFI va...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem - 4.15.0-1065.75

---------------
linux-oem (4.15.0-1065.75) bionic; urgency=medium

  * bionic/linux-oem: 4.15.0-1065.74 -proposed tracker (LP: #1852266)

  * Bionic update: upstream stable patchset 2019-10-29 (LP: #1850541)
    - [Config] updateconfigs for USB_RIO500

  * Disable unreliable HPET on CFL-H system (LP: #1852216)
    - SAUCE: x86/intel: Disable HPET on Intel Coffe Lake H platforms

  [ Ubuntu: 4.15.0-71.80 ]

  * bionic/linux: 4.15.0-71.80 -proposed tracker (LP: #1852289)
  * Bionic update: upstream stable patchset 2019-10-29 (LP: #1850541)
    - panic: ensure preemption is disabled during panic()
    - f2fs: use EINVAL for superblock with invalid magic
    - [Config] updateconfigs for USB_RIO500
    - USB: rio500: Remove Rio 500 kernel driver
    - USB: yurex: Don't retry on unexpected errors
    - USB: yurex: fix NULL-derefs on disconnect
    - USB: usb-skeleton: fix runtime PM after driver unbind
    - USB: usb-skeleton: fix NULL-deref on disconnect
    - xhci: Fix false warning message about wrong bounce buffer write length
    - xhci: Prevent device initiated U1/U2 link pm if exit latency is too long
    - xhci: Check all endpoints for LPM timeout
    - usb: xhci: wait for CNR controller not ready bit in xhci resume
    - USB: adutux: fix use-after-free on disconnect
    - USB: adutux: fix NULL-derefs on disconnect
    - USB: adutux: fix use-after-free on release
    - USB: iowarrior: fix use-after-free on disconnect
    - USB: iowarrior: fix use-after-free on release
    - USB: iowarrior: fix use-after-free after driver unbind
    - USB: usblp: fix runtime PM after driver unbind
    - USB: chaoskey: fix use-after-free on release
    - USB: ldusb: fix NULL-derefs on driver unbind
    - serial: uartlite: fix exit path null pointer
    - USB: serial: keyspan: fix NULL-derefs on open() and write()
    - USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20
    - USB: serial: option: add Telit FN980 compositions
    - USB: serial: option: add support for Cinterion CLS8 devices
    - USB: serial: fix runtime PM after driver unbind
    - USB: usblcd: fix I/O after disconnect
    - USB: microtek: fix info-leak at probe
    - USB: dummy-hcd: fix power budget for SuperSpeed mode
    - usb: renesas_usbhs: gadget: Do not discard queues in
      usb_ep_set_{halt,wedge}()
    - usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior
    - USB: legousbtower: fix slab info leak at probe
    - USB: legousbtower: fix deadlock on disconnect
    - USB: legousbtower: fix potential NULL-deref on disconnect
    - USB: legousbtower: fix open after failed reset request
    - USB: legousbtower: fix use-after-free on release
    - staging: vt6655: Fix memory leak in vt6655_probe
    - iio: adc: ad799x: fix probe error handling
    - iio: adc: axp288: Override TS pin bias current for some models
    - iio: light: opt3001: fix mutex unlock race
    - efivar/ssdt: Don't iterate over EFI vars if no SSDT override was specified
    - perf llvm: Don't access out-of-scope array
    - perf inject jit: Fix JIT_CODE_MOVE filename
    - CIFS: Gracefully handle QueryInfo errors during open
    ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oem-osp1 - 5.0.0-1030.34

---------------
linux-oem-osp1 (5.0.0-1030.34) bionic; urgency=medium

  * bionic/linux-oem-osp1: 5.0.0-1030.34 -proposed tracker (LP: #1853116)

  * Add support for Realtek 8723DE wireless adapter (LP: #1780590)
    - SAUCE: rtw88: 8822c: update PHY parameter to v38
    - SAUCE: rtw88: 8822c: update pwr_seq to v13
    - SAUCE: rtw88: 8822c: Enable interrupt migration
    - SAUCE: rtw88: 8822c: add FW IQK support
    - SAUCE: rtw88: 8822c: add SW DPK support
    - SAUCE: rtw88: move IQK/DPK into phy_calibration
    - SAUCE: rtw88: add dynamic cck pd mechanism
    - SAUCE: rtw88: allows to receive AMSDU in AMPDU
    - SAUCE: rtw88: remove redundant flag check helper function
    - SAUCE: rtw88: pci: extract skbs free routine for trx rings
    - SAUCE: rtw88: pci: release tx skbs DMAed when stop
    - SAUCE: rtw88: not to enter or leave PS under IRQ
    - SAUCE: rtw88: not to control LPS by each vif
    - SAUCE: rtw88: remove unused lps state check helper
    - SAUCE: rtw88: LPS enter/leave should be protected by lock
    - SAUCE: rtw88: leave PS state for dynamic mechanism
    - SAUCE: rtw88: add deep power save support
    - SAUCE: rtw88: not to enter LPS by coex strategy
    - SAUCE: rtw88: select deep PS mode when module is inserted
    - SAUCE: rtw88: add deep PS PG mode for 8822c
    - SAUCE: rtw88: add RTS support
    - SAUCE: rtw88: add driver tx queue support
    - SAUCE: rtw88: take over rate control from mac80211
    - SAUCE: rtw88: report tx rate to mac80211 stack
    - SAUCE: rtw88: add TX-AMSDU support
    - SAUCE: rtw88: add power tracking support
    - SAUCE: rtw88: Enable 802.11ac beamformee support
    - SAUCE: rtw88: flush hardware tx queues
    - SAUCE: rtw88: config 8822c multicast address in MAC init flow
    - SAUCE: rtw88: add set_bitrate_mask support
    - SAUCE: rtw88: use struct rtw_fw_hdr to access firmware header
    - SAUCE: rtw88: fix NSS of hw_cap
    - SAUCE: rtw88: fix error handling when setup efuse info
    - SAUCE: rtw88: fix wrong rx power calculation
    - SAUCE: rtw88: update regulatory settings implementaion
    - SAUCE: rtw88: check firmware leave lps successfully
    - SAUCE: rtw88: support wowlan feature for 8822c
    - SAUCE: rtw88: wowlan: support pattern match
    - SAUCE: rtw88: wowlan: support PNO for 8822C
    - SAUCE: rtw88: add phy_info debugfs to show Tx/Rx physical status
    - SAUCE: rtw88: coex: Set 4 slot mode for A2DP
    - SAUCE: rtw88: default enable LPS + LCLK
    - SAUCE: rtw88: add module parameter to enable PCIE clock request
    - SAUCE: rtw88: add module parameter to enable PCIE ASPM L1
    - SAUCE: rtw88: fix TX secondary channel offset of 40M if current bw is 20M or
      40M
    - SAUCE: rtw88: Use secondary channel offset enumeration to make better read
    - SAUCE: rtw88: keep leave and enter IPS as the first and last in config
      callback
    - SAUCE: rtw88: fix rate mask for 1SS chip
    - SAUCE: rtw88: refine conversion of rx_evm_dbm from rx_evm
    - SAUCE: rtw88: 8723d: Add basic chip information of 8723D
    - SAUCE: rtw88: 8723de: Add 8723DE to Kconfig and Makefile
    - SAUCE: rtw88: 8723d: check se...

[luca (luca-linux-kernel-bugs)]

*** Bug 204153 has been marked as a duplicate of this bug. ***

[noodles (noodles-linux-kernel-bugs)]

FWIW this has regressed in 5.5 - tracked in Bug 206395

[You-Sheng Yang (vicamo)]

Eoan FIXRELEASED in Ubuntu-5.3.0-24.26 in bug 1851550.