Disable active scanning on iwm(4) 9260 and 9560.

For some reason, if we send a scan command that actively scans for a
particular SSID with probe requests, the device will occasionally lock
up after associating to the AP, with no interrupts, totally dead.
The symptom of this is an interface that shows as "active" in ifconfig
but does not receive or transmit any packets.

Observed by kmos@ for some time already, and myself while testing new
Intel wifi firmware versions on iwm(4) 9560.

This problem was also observed on AX200 by me with old firmware. We had
the same workaround in place for iwx(4) for some time, until we upgraded
that driver to use newer firmware which uses a different scan command.

Workaround tested by kmos@ and myself.

diff --git a/sys/dev/pci/if_iwm.c b/sys/dev/pci/if_iwm.c
index b5fea7e..6ecf1dd 100644 (file)
--- a/sys/dev/pci/if_iwm.c
+++ b/sys/dev/pci/if_iwm.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: if_iwm.c,v 1.378 2021/11/16 12:55:50 stsp Exp $       */
+/*     $OpenBSD: if_iwm.c,v 1.379 2021/11/17 15:15:32 stsp Exp $       */
 
 /*
  * Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -7780,9 +7780,15 @@ iwm_umac_scan(struct iwm_softc *sc, int bgscan)
                        IWM_UMAC_SCAN_GEN_FLAGS2_ALLOW_CHNL_REORDER;
        }
 
-       /* Check if we're doing an active directed scan. */
-       if (ic->ic_des_esslen != 0) {
-               if (isset(sc->sc_ucode_api, IWM_UCODE_TLV_API_SCAN_EXT_CHAN_VER)) {
+       /*
+        * Check if we're doing an active directed scan.
+        * 9k devices may randomly lock up (no interrupts) after association
+        * following active scans. Use passive scan only for now on 9k.
+        */
+       if (sc->sc_device_family != IWM_DEVICE_FAMILY_9000 &&
+           ic->ic_des_esslen != 0) {
+               if (isset(sc->sc_ucode_api,
+                   IWM_UCODE_TLV_API_SCAN_EXT_CHAN_VER)) {
                        tail->direct_scan[0].id = IEEE80211_ELEMID_SSID;
                        tail->direct_scan[0].len = ic->ic_des_esslen;
                        memcpy(tail->direct_scan[0].ssid, ic->ic_des_essid,