From Andre.Albsmeier@siemens.com  Fri Dec 25 18:16:15 2009
Return-Path: <Andre.Albsmeier@siemens.com>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 73BA21065695
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 25 Dec 2009 18:16:15 +0000 (UTC)
	(envelope-from Andre.Albsmeier@siemens.com)
Received: from goliath.siemens.de (goliath.siemens.de [192.35.17.28])
	by mx1.freebsd.org (Postfix) with ESMTP id 0BE1C8FC22
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 25 Dec 2009 18:16:14 +0000 (UTC)
Received: from mail2.siemens.de (localhost [127.0.0.1])
	by goliath.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id nBPI4LQa020048
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 25 Dec 2009 19:04:21 +0100
Received: from curry.mchp.siemens.de (curry.mchp.siemens.de [139.25.40.130])
	by mail2.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id nBPI4LVI022245
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 25 Dec 2009 19:04:21 +0100
Received: (from localhost)
	by curry.mchp.siemens.de (8.14.3/8.14.3) id nBPI4LCU064379
	for FreeBSD-gnats-submit@freebsd.org; Fri, 25 Dec 2009 19:04:21 +0100 (CET)
Message-Id: <200912251804.nBPI4LvG079706@curry.mchp.siemens.de>
Date: Fri, 25 Dec 2009 19:04:21 +0100 (CET)
From: Andre Albsmeier <Andre.Albsmeier@siemens.com>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: iwi: Possibly wrong interpretation of beacon->number in if_iwi.c
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         142018
>Category:       kern
>Synopsis:       [iwi] [patch] Possibly wrong interpretation of beacon->number in if_iwi.c
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-net
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Dec 25 18:20:02 UTC 2009
>Closed-Date:    
>Last-Modified:  Fri Jan 15 07:30:01 UTC 2010
>Originator:     Andre Albsmeier
>Release:        FreeBSD 7.2-STABLE i386
>Organization:
>Environment:

System: FreeBSD 7.2-STABLE #9: Wed Dec 23 20:32:46 CET 2009

using iwi driver

>Description:

In WLAN environments where beacon misses may happen occasionally
iwi(4) might reassociate even if the set threshold (bmiss) is not
reached. sysctl debug.iwi=5 enables logging of beacon misses
which are ridiculous high even after an uptime of only a
few minutes:

Beacon state (1, 19006982)
Beacon miss: 19006982 >= 10
Beacon state (1, 19007496)
Beacon miss: 19007496 >= 10
Beacon state (1, 19269126)
Beacon miss: 19269126 >= 10

Adding code to if_iwi.c which prints out the hex values
leads us to this picture:

iwi0: Beacon miss: 19006982 1220606
iwi0: Beacon miss: 19006982 1220606
iwi0: Beacon miss: 19007239 1220707
iwi0: Beacon miss: 19007496 1220808
iwi0: Beacon miss: 19269126 1260606
iwi0: Beacon miss: 19269383 1260707
iwi0: Beacon miss: 19269640 1260808
iwi0: Beacon miss: 19269126 1260606
iwi0: Beacon miss: 19269383 1260707
iwi0: Beacon miss: 19269640 1260808
                            ^^^^^^^ hex values

It seems to be wrong to use all 32bits of beacon->number in if_iwi.c.
However, if_iwi.c in 7.2 is the same as in RELENG_6 where the problem
didn't show up under same conditions. It might depend on the contents
of other memory locations, stack, ...

>How-To-Repeat:

Use iwi in a WLAN environments where beacon misses happen.
Use sysctl debug.iwi=5 to see debugging output. If numbers
are reasonably low, you might not have been hit bit the
problem for reasons mentioned above.

See also:

http://lists.freebsd.org/pipermail/freebsd-mobile/2009-December/011833.html

>Fix:

I am currently using this patch to mask out only the lower
8 bits of beacon->number in if_iwi.c:

--- if_iwi.c.ORI        2009-12-07 16:17:46.000000000 +0100
+++ if_iwi.c    2009-12-07 16:20:10.000000000 +0100
@@ -1508,9 +1508,9 @@
                         * 802.11 layer.
                         * XXX try to roam, drop assoc only on much higher count
                         */
-                       if (le32toh(beacon->number) >= ic->ic_bmissthreshold) {
+                       if ((le32toh(beacon->number) & 0xFF) >= ic->ic_bmissthreshold) {
                                DPRINTF(("Beacon miss: %u >= %u\n",
-                                   le32toh(beacon->number),
+                                   le32toh(beacon->number) & 0xFF,
                                    ic->ic_bmissthreshold));
                                ieee80211_beacon_miss(ic);
                        }

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Fri Dec 25 23:52:51 UTC 2009 
Responsible-Changed-Why:  

Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=142018 

From: Bernhard Schmidt <bschmidt@techwires.net>
To: bug-followup@freebsd.org, Andre.Albsmeier@siemens.com
Cc:  
Subject: Re: kern/142018: [iwi] [patch] Possibly wrong interpretation of beacon-&gt;number in if_iwi.c
Date: Thu, 14 Jan 2010 16:10:28 +0100

 Hi,
 
 It might be simple endianess related issue, does this patch make any 
 difference?
 
 Index: if_iwi.c
 ===================================================================
 --- sys/dev/iwi/if_iwi.c	(revision 202285)
 +++ sys/dev/iwi/if_iwi.c	(working copy)
 @@ -1499,9 +1499,9 @@ iwi_notification_intr(struct iwi_softc *sc, struct
  		beacon = (struct iwi_notif_beacon_state *)(notif + 1);
  
  		DPRINTFN(5, ("Beacon state (%u, %u)\n",
 -		    beacon->state, le32toh(beacon->number)));
 +		    le32toh(beacon->state), le32toh(beacon->number)));
  
 -		if (beacon->state == IWI_BEACON_MISS) {
 +		if (le32toh(beacon->state) == IWI_BEACON_MISS) {
  			/*
  			 * The firmware notifies us of every beacon miss
  			 * so we need to track the count against the
 
 -- 
 Bernhard

From: Andre Albsmeier <Andre.Albsmeier@siemens.com>
To: Bernhard Schmidt <bschmidt@techwires.net>
Cc: bug-followup@freebsd.org, Andre.Albsmeier@siemens.com
Subject: Re: kern/142018: [iwi] [patch] Possibly wrong interpretation of
 beacon-&gt;number in if_iwi.c
Date: Fri, 15 Jan 2010 08:07:40 +0100

 On Thu, 14-Jan-2010 at 16:10:28 +0100, Bernhard Schmidt wrote:
 > Hi,
 > 
 > It might be simple endianess related issue, does this patch make any 
 > difference?
 
 No, it doesn't (which is what I expected on an i386 machine).
 And beacon->state is not the problem, it's beacon->number ;-)
 
 If have associated the interface to a network with a weak
 signal and results are the same:
 
 Jan 15 08:00:08 <kern.crit> box kernel: Beacon state (1, 0x1260606)
 Jan 15 08:00:09 <kern.crit> box kernel: Beacon state (1, 0x1260707)
 Jan 15 08:00:09 <kern.crit> box kernel: Beacon state (1, 0x1260808)
 Jan 15 08:00:09 <kern.crit> box kernel: Beacon state (1, 0x1260606)
 Jan 15 08:00:10 <kern.crit> box kernel: Beacon state (1, 0x1260707)
 Jan 15 08:00:10 <kern.crit> box kernel: Beacon state (1, 0x1260808)
 Jan 15 08:00:10 <kern.crit> box kernel: Beacon state (1, 0x1260909)
 Jan 15 08:00:10 <kern.crit> box kernel: Beacon state (1, 0x1260a0a)
 Jan 15 08:00:10 <kern.crit> box kernel: Beacon state (1, 0x1260b0b)
 Jan 15 08:00:12 <kern.crit> box kernel: Beacon state (1, 0x1260606)
 Jan 15 08:00:12 <kern.crit> box kernel: Beacon state (1, 0x1260707)
 Jan 15 08:00:12 <kern.crit> box kernel: Beacon state (1, 0x1260808)
 Jan 15 08:00:12 <kern.crit> box kernel: Beacon state (1, 0x1260909)
 Jan 15 08:00:13 <kern.crit> box kernel: Beacon state (1, 0x1260a0a)
 Jan 15 08:00:13 <kern.crit> box kernel: Beacon state (1, 0x1260b0b)
 Jan 15 08:00:15 <kern.crit> box kernel: Beacon state (1, 0x210606)
 Jan 15 08:00:15 <kern.crit> box kernel: Beacon state (1, 0x210707)
 Jan 15 08:00:15 <kern.crit> box kernel: Beacon state (1, 0x210808)
 Jan 15 08:00:15 <kern.crit> box kernel: Beacon state (1, 0x210909)
 Jan 15 08:00:15 <kern.crit> box kernel: Beacon state (1, 0x210a0a)
 Jan 15 08:00:15 <kern.crit> box kernel: Beacon state (1, 0x210b0b)
 Jan 15 08:00:18 <kern.crit> box kernel: Beacon state (1, 0x606)
 Jan 15 08:00:18 <kern.crit> box kernel: Beacon state (1, 0x707)
 Jan 15 08:00:18 <kern.crit> box kernel: Beacon state (1, 0x808)
 Jan 15 08:00:18 <kern.crit> box kernel: Beacon state (1, 0x909)
 Jan 15 08:00:18 <kern.crit> box kernel: Beacon state (1, 0xa0a)
 Jan 15 08:00:18 <kern.crit> box kernel: Beacon state (1, 0xb0b)
 Jan 15 08:00:21 <kern.crit> box kernel: Beacon state (1, 0x606)
 Jan 15 08:00:21 <kern.crit> box kernel: Beacon state (1, 0x707)
 Jan 15 08:00:21 <kern.crit> box kernel: Beacon state (1, 0x808)
 Jan 15 08:00:21 <kern.crit> box kernel: Beacon state (1, 0x909)
 Jan 15 08:00:21 <kern.crit> box kernel: Beacon state (1, 0xa0a)
 Jan 15 08:00:21 <kern.crit> box kernel: Beacon state (1, 0xb0b)
 Jan 15 08:00:24 <kern.crit> box kernel: Beacon state (1, 0x606)
 Jan 15 08:00:25 <kern.crit> box kernel: Beacon state (1, 0x707)
 Jan 15 08:00:25 <kern.crit> box kernel: Beacon state (1, 0x808)
 Jan 15 08:00:25 <kern.crit> box kernel: Beacon state (1, 0x909)
 Jan 15 08:00:25 <kern.crit> box kernel: Beacon state (1, 0xa0a)
 Jan 15 08:00:25 <kern.crit> box kernel: Beacon state (1, 0xb0b)
 Jan 15 08:00:27 <kern.crit> box kernel: Beacon state (1, 0x606)
 Jan 15 08:00:27 <kern.crit> box kernel: Beacon state (1, 0x707)
 Jan 15 08:00:28 <kern.crit> box kernel: Beacon state (1, 0x808)
 Jan 15 08:00:29 <kern.crit> box kernel: Beacon state (1, 0x1220606)
 Jan 15 08:00:29 <kern.crit> box kernel: Beacon state (1, 0x1220707)
 Jan 15 08:00:30 <kern.crit> box kernel: Beacon state (1, 0x1220808)
 Jan 15 08:00:30 <kern.crit> box kernel: Beacon state (1, 0x1220909)
 Jan 15 08:00:30 <kern.crit> box kernel: Beacon state (1, 0x1220a0a)
 Jan 15 08:00:30 <kern.crit> box kernel: Beacon state (1, 0x1220b0b)
 
 	-Andre
 
 > 
 > Index: if_iwi.c
 > ===================================================================
 > --- sys/dev/iwi/if_iwi.c	(revision 202285)
 > +++ sys/dev/iwi/if_iwi.c	(working copy)
 > @@ -1499,9 +1499,9 @@ iwi_notification_intr(struct iwi_softc *sc, struct
 >  		beacon = (struct iwi_notif_beacon_state *)(notif + 1);
 >  
 >  		DPRINTFN(5, ("Beacon state (%u, %u)\n",
 > -		    beacon->state, le32toh(beacon->number)));
 > +		    le32toh(beacon->state), le32toh(beacon->number)));
 >  
 > -		if (beacon->state == IWI_BEACON_MISS) {
 > +		if (le32toh(beacon->state) == IWI_BEACON_MISS) {
 >  			/*
 >  			 * The firmware notifies us of every beacon miss
 >  			 * so we need to track the count against the
 > 
 > -- 
 > Bernhard
>Unformatted:
