Re: 2 LORs and a FW crash in one (ifocnfig wlan0 down)

On Thu, 10 Apr 2025, Bjoern A. Zeeb wrote:

> One from myself for a change; two LORs and a firmware crash (PHY_CONTEXT_CMD) 
> for one.
>
> Got started by
>
> # ifconfig wlan0 down
>
> and comes out of the net80211 code triggered by the state change.
> More code to cleanup there...

I believe I fixed that with an update to https://reviews.freebsd.org/D49761

So if yu are trying that patch and see this, please update the patch
again.  You can drop the old one using git and then apply the new
version using arc again for example.

/bz


> lock order reversal: (sleepable after non-sleepable)
> 1st 0xfffffe0098bc1020 iwlwifi0_com_lo (iwlwifi0_com_lo, sleep mutex) @ 
> /usr/src/src/sys/net80211/ieee80211_scan_sw.c:436
> 2nd 0xfffffe0098bbd258 lhw-lvif (lhw-lvif, sx) @ 
> /usr/src/src/sys/compat/linuxkpi/common/src/linux_80211.c:5964 lock order 
> iwlwifi0_com_lo -> lhw-lvif attempted at: #0 0xffffffff80bbca61 at 
> witness_checkorder+0xbe1 #1 0xffffffff80b513b0 at _sx_xlock+0x60 #2 
> 0xffffffff82df65d2 at linuxkpi_ieee80211_iterate_interfaces+0x62 #3 
> 0xffffffff82d36f6e at iwl_mvm_change_chanctx+0x4e #4 0xffffffff82dfc5f6 at 
> lkpi_sta_sync_from_ni+0x326
> #5 0xffffffff82df5266 at lkpi_ic_node_alloc+0x446 #6 0xffffffff80cedb07 at 
> ieee80211_alloc_node+0x27 #7 0xffffffff80ced14a at ieee80211_reset_bss+0x5a 
> #8 0xffffffff80d02bc0 at sta_newstate+0x540 #9 0xffffffff82def3a5 at 
> lkpi_sta_run_to_init+0x2a5 #10 0xffffffff82dfca2b at lkpi_iv_newstate+0x30b
> #11 0xffffffff80cf9f3c at ieee80211_newstate_cb+0x29c #12 0xffffffff80baefe2 
> at taskqueue_run_locked+0x1c2
> #13 0xffffffff80bafea3 at taskqueue_thread_loop+0xd3 #14 0xffffffff80af8af2 
> at fork_exit+0x82 #15 0xffffffff80fdcf4e at fork_trampoline+0xe
>
> iwlwifi0: Microcode SW error detected. Restarting 0x0. iwlwifi0: Start IWL 
> Error Log Dump: iwlwifi0: Transport status: 0x0000004B, valid: 6 iwlwifi0: 
> Loaded firmware version: 89.6b44fa0b.0 ty-a0-gf-a0-89.ucode
> iwlwifi0: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL iwlwifi0: 0x000002F0 | 
> trm_hw_status0
> iwlwifi0: 0x00000000 | trm_hw_status1
> iwlwifi0: 0x004DACF8 | branchlink2
> iwlwifi0: 0x004D091A | interruptlink1
> iwlwifi0: 0x004D091A | interruptlink2
> iwlwifi0: 0x000144A8 | data1
> iwlwifi0: 0x00000010 | data2
> iwlwifi0: 0x00000000 | data3
> iwlwifi0: 0x28011B5D | beacon time
> iwlwifi0: 0x18CC3C83 | tsf low
> iwlwifi0: 0x000005F3 | tsf hi
> iwlwifi0: 0x00000000 | time gp1
> iwlwifi0: 0x046CA13A | time gp2
> iwlwifi0: 0x00000001 | uCode revision type
> iwlwifi0: 0x00000059 | uCode version major
> iwlwifi0: 0x6B44FA0B | uCode version minor
> iwlwifi0: 0x00000420 | hw version
> iwlwifi0: 0xA0C80002 | board version
> iwlwifi0: 0x806AFD65 | hcmd
> iwlwifi0: 0x00020000 | isr0
> iwlwifi0: 0x20000000 | isr1
> iwlwifi0: 0x48F00002 | isr2
> iwlwifi0: 0x00C3000C | isr3
> iwlwifi0: 0x00200000 | isr4
> iwlwifi0: 0x0102001C | last cmd Id
> iwlwifi0: 0x000144A8 | wait_event
> iwlwifi0: 0x00000080 | l2p_control
> iwlwifi0: 0x00000020 | l2p_duration
> iwlwifi0: 0x0000003F | l2p_mhvalid
> iwlwifi0: 0x00001800 | l2p_addr_match
> iwlwifi0: 0x00000009 | lmpm_pmg_sel
> iwlwifi0: 0x00000000 | timestamp
> iwlwifi0: 0x0000C8F0 | flow_handler
> iwlwifi0: Start IWL Error Log Dump:
> iwlwifi0: Transport status: 0x0000004B, valid: 7
> iwlwifi0: 0x20101A28 | ADVANCED_SYSASSERT
> iwlwifi0: 0x00000000 | umac branchlink1
> iwlwifi0: 0x804838BE | umac branchlink2
> iwlwifi0: 0x0102009E | umac interruptlink1
> iwlwifi0: 0x00000000 | umac interruptlink2
> iwlwifi0: 0x00020000 | umac data1
> iwlwifi0: 0x00000000 | umac data2
> iwlwifi0: 0xDEADBEEF | umac data3
> iwlwifi0: 0x00000059 | umac major
> iwlwifi0: 0x6B44FA0B | umac minor
> iwlwifi0: 0x046CA134 | frame pointer
> iwlwifi0: 0xC0886BE8 | stack pointer
> iwlwifi0: 0x006E0108 | last host cmd
> iwlwifi0: 0x00000000 | isr status reg
> iwlwifi0: IML/ROM dump:
> iwlwifi0: 0x00000B03 | IML/ROM error/state
> iwlwifi0: 0x000080DE | IML/ROM data1
> iwlwifi0: 0x00000090 | IML/ROM WFPM_AUTH_KEY_0
> iwlwifi0: Fseq Registers:
> iwlwifi0: 0x60000000 | FSEQ_ERROR_CODE
> iwlwifi0: 0x80440007 | FSEQ_TOP_INIT_VERSION
> iwlwifi0: 0x00080009 | FSEQ_CNVIO_INIT_VERSION
> iwlwifi0: 0x0000A652 | FSEQ_OTP_VERSION
> iwlwifi0: 0x00000002 | FSEQ_TOP_CONTENT_VERSION
> iwlwifi0: 0x4552414E | FSEQ_ALIVE_TOKEN
> iwlwifi0: 0x00400410 | FSEQ_CNVI_ID
> iwlwifi0: 0x00400410 | FSEQ_CNVR_ID
> iwlwifi0: 0x00400410 | CNVI_AUX_MISC_CHIP
> iwlwifi0: 0x00400410 | CNVR_AUX_MISC_CHIP
> iwlwifi0: 0x00009061 | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
> iwlwifi0: 0x00000061 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
> iwlwifi0: 0x00080009 | FSEQ_PREV_CNVIO_INIT_VERSION
> iwlwifi0: 0x00440007 | FSEQ_WIFI_FSEQ_VERSION
> iwlwifi0: 0x0FF7C577 | FSEQ_BT_FSEQ_VERSION
> iwlwifi0: 0x000000E6 | FSEQ_CLASS_TP_VERSION
> iwlwifi0: UMAC CURRENT PC: 0x804a578c
> iwlwifi0: LMAC1 CURRENT PC: 0xd0
> iwlwifi0: WRT: Collecting data: ini trigger 4 fired (delay=0ms).
> linuxkpi_ieee80211_restart_hw:3755: XXX LKPI80211 TODO iwlwifi0: FW error in 
> SYNC CMD PHY_CONTEXT_CMD
>
> lock order reversal: (sleepable after non-sleepable)
> 1st 0xfffffe0098bc1020 iwlwifi0_com_lo (iwlwifi0_com_lo, sleep mutex) @ 
> /usr/src/src/sys/net80211/ieee80211_scan_sw.c:436
> 2nd 0xffffffff81b98268 kernel linker (kernel linker, sx) @ 
> /usr/src/src/sys/kern/kern_linker.c:1127
> lock order iwlwifi0_com_lo -> kernel linker attempted at:
> #0 0xffffffff80bbca61 at witness_checkorder+0xbe1
> #1 0xffffffff80b52484 at _sx_slock_int+0x64
> #2 0xffffffff80b0e1be at linker_search_symbol_name_flags+0x4e
> #3 0xffffffff80badcd3 at stack_print+0x83
> #4 0xffffffff82dc6c83 at linux_dump_stack+0x23
> #5 0xffffffff82d8a7fb at iwl_trans_pcie_send_hcmd+0x44b
> #6 0xffffffff82d1ac88 at iwl_trans_send_cmd+0x88
> #7 0xffffffff82d657dd at iwl_mvm_send_cmd_pdu+0x6d
> #8 0xffffffff82d40987 at iwl_mvm_phy_ctxt_apply+0x3b7
> #9 0xffffffff82d40b9b at iwl_mvm_phy_ctxt_changed+0x12b
> #10 0xffffffff82d3702a at iwl_mvm_change_chanctx+0x10a
> #11 0xffffffff82dfc5f6 at lkpi_sta_sync_from_ni+0x326
> #12 0xffffffff82df5266 at lkpi_ic_node_alloc+0x446
> #13 0xffffffff80cedb07 at ieee80211_alloc_node+0x27
> #14 0xffffffff80ced14a at ieee80211_reset_bss+0x5a
> #15 0xffffffff80d02bc0 at sta_newstate+0x540
> #16 0xffffffff82def3a5 at lkpi_sta_run_to_init+0x2a5
> #17 0xffffffff82dfca2b at lkpi_iv_newstate+0x30b
>
> #0 0xffffffff82dc6c7b at linux_dump_stack+0x1b
> #1 0xffffffff82d8a7fb at iwl_trans_pcie_send_hcmd+0x44b
> #2 0xffffffff82d1ac88 at iwl_trans_send_cmd+0x88
> #3 0xffffffff82d657dd at iwl_mvm_send_cmd_pdu+0x6d
> #4 0xffffffff82d40987 at iwl_mvm_phy_ctxt_apply+0x3b7
> #5 0xffffffff82d40b9b at iwl_mvm_phy_ctxt_changed+0x12b
> #6 0xffffffff82d3702a at iwl_mvm_change_chanctx+0x10a
> #7 0xffffffff82dfc5f6 at lkpi_sta_sync_from_ni+0x326
> #8 0xffffffff82df5266 at lkpi_ic_node_alloc+0x446
> #9 0xffffffff80cedb07 at ieee80211_alloc_node+0x27
> #10 0xffffffff80ced14a at ieee80211_reset_bss+0x5a
> #11 0xffffffff80d02bc0 at sta_newstate+0x540
> #12 0xffffffff82def3a5 at lkpi_sta_run_to_init+0x2a5
> #13 0xffffffff82dfca2b at lkpi_iv_newstate+0x30b
> #14 0xffffffff80cf9f3c at ieee80211_newstate_cb+0x29c
> #15 0xffffffff80baefe2 at taskqueue_run_locked+0x1c2
> #16 0xffffffff80bafea3 at taskqueue_thread_loop+0xd3
> #17 0xffffffff80af8af2 at fork_exit+0x82
> iwlwifi0: PHY ctxt cmd error. ret=-5
> iwlwifi0: Failed to trigger RX queues sync (-5)
>
>
>

-- 
Bjoern A. Zeeb                                                     r15:7