[Bug 286219] iwlwifi(4) kernel panic lkpi_sta_auth_to_scan with Intel Wireless 7260, 8086:08b1:8086:c060

From: <bugzilla-noreply_at_freebsd.org>
Date: Sun, 20 Apr 2025 07:57:51 UTC 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=286219

            Bug ID: 286219
           Summary: iwlwifi(4) kernel panic lkpi_sta_auth_to_scan with
                    Intel Wireless 7260, 8086:08b1:8086:c060
           Product: Base System
           Version: 15.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: wireless
          Assignee: wireless@FreeBSD.org
          Reporter: grahamperrin@gmail.com

Dual Band Wireless-N 7260 [Wilkins Peak 2]


root@mowa219-gjp4-zbook-freebsd:~ # date ; uptime
Sun Apr 20 08:21:51 BST 2025
8:21AM  up  4:35, 5 users, load averages: 0.47, 0.82, 0.83
root@mowa219-gjp4-zbook-freebsd:~ # hw-probe -all -upload
Probe for hardware ... Ok
Reading logs ... Ok
WARNING: failed to detect EDID
Uploaded to DB, Thank you!

Probe URL: https://bsd-hardware.info/?probe=0290af8d17
root@mowa219-gjp4-zbook-freebsd:~ # cat /var/crash/info.15
Dump header from device: /dev/ada1p2
Architecture: amd64
Architecture Version: 2
Dump Length: 1721188352
Blocksize: 512
Compression: none
Dumptime: 2025-04-20 03:44:12 +0100
Hostname: mowa219-gjp4-zbook-freebsd
Magic: FreeBSD Kernel Dump
Version String: FreeBSD 15.0-CURRENT main-n276536-514c2930292e GENERIC-NODEBUG
Panic String: page fault
Dump Parity: 322177539
Bounds: 15
Dump Status: good
root@mowa219-gjp4-zbook-freebsd:~ #

----

…
iwlwifi0: Microcode SW error detected.  Restarting 0x2000000.
iwlwifi0: Start IWL Error Log Dump:
iwlwifi0: Transport status: 0x0000004B, valid: 6
iwlwifi0: Loaded firmware version: 17.bfb58538.0 7260-17.ucode
iwlwifi0: 0x000021A0 | ADVANCED_SYSASSERT          
iwlwifi0: 0x00A00220 | trm_hw_status0
iwlwifi0: 0x00000000 | trm_hw_status1
iwlwifi0: 0x00000B30 | branchlink2
iwlwifi0: 0x000164C0 | interruptlink1
iwlwifi0: 0x00000000 | interruptlink2
iwlwifi0: 0xDEADBEEF | data1
iwlwifi0: 0xDEADBEEF | data2
iwlwifi0: 0xDEADBEEF | data3
iwlwifi0: 0x12017AC9 | beacon time
iwlwifi0: 0x2A8EC52C | tsf low
iwlwifi0: 0x000000EB | tsf hi
iwlwifi0: 0x00000000 | time gp1
iwlwifi0: 0x01C8DCA7 | time gp2
iwlwifi0: 0x00000000 | uCode revision type
iwlwifi0: 0x00000011 | uCode version major
iwlwifi0: 0xBFB58538 | uCode version minor
iwlwifi0: 0x00000144 | hw version
iwlwifi0: 0x40489204 | board version
iwlwifi0: 0x00570118 | hcmd
iwlwifi0: 0x24022080 | isr0
iwlwifi0: 0x01000000 | isr1
iwlwifi0: 0x00000002 | isr2
iwlwifi0: 0x004154C0 | isr3
iwlwifi0: 0x00000000 | isr4
iwlwifi0: 0x01000112 | last cmd Id
iwlwifi0: 0x00000000 | wait_event
iwlwifi0: 0x000000C0 | l2p_control
iwlwifi0: 0x00018010 | l2p_duration
iwlwifi0: 0x0000003F | l2p_mhvalid
iwlwifi0: 0x00000000 | l2p_addr_match
iwlwifi0: 0x00000005 | lmpm_pmg_sel
iwlwifi0: 0x15041745 | timestamp
iwlwifi0: 0x00008090 | flow_handler
iwlwifi0: Fseq Registers:
iwlwifi0: 0x00000000 | FSEQ_ERROR_CODE
iwlwifi0: 0x00000000 | FSEQ_TOP_INIT_VERSION
iwlwifi0: 0x00000000 | FSEQ_CNVIO_INIT_VERSION
iwlwifi0: 0x00000000 | FSEQ_OTP_VERSION
iwlwifi0: 0x00000000 | FSEQ_TOP_CONTENT_VERSION
iwlwifi0: 0x00000000 | FSEQ_ALIVE_TOKEN
iwlwifi0: 0x00000000 | FSEQ_CNVI_ID
iwlwifi0: 0x00000000 | FSEQ_CNVR_ID
iwlwifi0: 0x00000000 | CNVI_AUX_MISC_CHIP
iwlwifi0: 0x00000000 | CNVR_AUX_MISC_CHIP
iwlwifi0: 0x00000000 | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
iwlwifi0: 0x00000000 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
iwlwifi0: 0x00000000 | FSEQ_PREV_CNVIO_INIT_VERSION
iwlwifi0: 0x00000000 | FSEQ_WIFI_FSEQ_VERSION
iwlwifi0: 0x00000000 | FSEQ_BT_FSEQ_VERSION
iwlwifi0: 0x00000000 | FSEQ_CLASS_TP_VERSION
iwlwifi0: Collecting data: trigger 2 fired.
iwlwifi0: FW error in SYNC CMD ADD_STA
#0 0xffffffff80dc8ffb at linux_dump_stack+0x1b
#1 0xffffffff847420cb at iwl_trans_pcie_send_hcmd+0x44b
#2 0xffffffff846d3d88 at iwl_trans_send_cmd+0x88
#3 0xffffffff8471d468 at iwl_mvm_send_cmd_status+0x28
#4 0xffffffff8471d56f at iwl_mvm_send_cmd_pdu_status+0x4f
#5 0xffffffff8470a9ce at iwl_mvm_sta_send_to_fw+0x35e
#6 0xffffffff8470d1dc at iwl_mvm_add_sta+0x14c
#7 0xffffffff846edcd7 at iwl_mvm_mac_sta_state_common+0x5b7
#8 0xffffffff80dc38c6 at lkpi_80211_mo_sta_state+0x36
#9 0xffffffff80db62ad at lkpi_sta_scan_to_auth+0x72d
#10 0xffffffff80db694b at lkpi_sta_assoc_to_auth+0x1b
#11 0xffffffff80dc1f13 at lkpi_iv_newstate+0x3c3
#12 0xffffffff80ceda5e at ieee80211_newstate_cb+0x11e
#13 0xffffffff80bb4ba2 at taskqueue_run_locked+0x182
#14 0xffffffff80bb5d72 at taskqueue_thread_loop+0xc2
#15 0xffffffff80b0504b at fork_exit+0x7b
#16 0xffffffff8102a9be at fork_trampoline+0xe
iwlwifi0: lkpi_sta_scan_to_auth:2113: mo_sta_state(NONE) failed: -5
iwlwifi0: lkpi_iv_newstate: error -1 during state transition 3 (ASSOC) -> 2
(AUTH)
iwlwifi0: lkpi_iv_newstate: error 95 during state transition 2 (AUTH) -> 2
(AUTH)
Configuring vt: keymap allscreens.
LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************


Fatal trap 12: page fault while in kernel mode
cpuid = 3; apic id = 03
fault virtual address   = 0x10
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80db5824
stack pointer           = 0x28:0xfffffe01434b6d30
frame pointer           = 0x28:0xfffffe01434b6d80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (iwlwifi0 net80211 t)
rdi: fffffe01481fd010 rsi: 0000000000000000 rdx: 0000000000000003
rcx: 0000000000000000  r8: 0000000000000001  r9: fffffe01434b7000
rax: fffff8000adf9740 rbx: 0000000000000000 rbp: fffffe01434b6d80
r10: 0000000000001388 r11: 000000007ff84851 r12: fffffe01481fd000
r13: 0000000000000000 r14: fffff8000adf9740 r15: fffffe014858c440
trap number             = 12
panic: page fault
cpuid = 3
time = 1745117052
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01434b6a80
vpanic() at vpanic+0x136/frame 0xfffffe01434b6bb0
panic() at panic+0x43/frame 0xfffffe01434b6c10
trap_pfault() at trap_pfault+0x3da/frame 0xfffffe01434b6c60
calltrap() at calltrap+0x8/frame 0xfffffe01434b6c60
--- trap 0xc, rip = 0xffffffff80db5824, rsp = 0xfffffe01434b6d30, rbp =
0xfffffe01434b6d80 ---
lkpi_sta_auth_to_scan() at lkpi_sta_auth_to_scan+0x74/frame 0xfffffe01434b6d80
lkpi_iv_newstate() at lkpi_iv_newstate+0x3c3/frame 0xfffffe01434b6df0
ieee80211_newstate_cb() at ieee80211_newstate_cb+0x11e/frame 0xfffffe01434b6e40
taskqueue_run_locked() at taskqueue_run_locked+0x182/frame 0xfffffe01434b6ec0
taskqueue_thread_loop() at taskqueue_thread_loop+0xc2/frame 0xfffffe01434b6ef0
fork_exit() at fork_exit+0x7b/frame 0xfffffe01434b6f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe01434b6f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic

…

----

grahamperrin@mowa219-gjp4-zbook-freebsd ~> bectl list -c creation | tail -n 12
1500035-016-base             -      -          986M  2025-04-08 19:31
1500036-001-base             -      -          1.06G 2025-04-10 01:00
1500036-002-base             -      -          6.75G 2025-04-11 09:22
1500036-003-base-ports       -      -          2.28G 2025-04-12 02:42
1500036-004-base             -      -          1.65G 2025-04-12 14:09
1500037-001-base             -      -          825M  2025-04-13 02:06
1500037-002-base             -      -          824M  2025-04-13 15:05
1500037-003-base             -      -          942M  2025-04-15 09:35
1500037-004-base             -      -          1.06G 2025-04-16 02:52
1500037-005-base             -      -          1.06G 2025-04-17 15:22
1500037-006-base             NR     /          330G  2025-04-18 03:11
1500037-007-base             -      -          1.19G 2025-04-19 02:56
grahamperrin@mowa219-gjp4-zbook-freebsd ~> grep 1500037-007-base
~/Documents/boot\ environments.txt
1500037-007-base                2025-04-19 02:56 main-n276558-b3d89a0cde94
GENERIC-NODEBUG da87f293d59b0e4936ba8131d42858316cf2acac
grahamperrin@mowa219-gjp4-zbook-freebsd ~>


I stepped back from 1500037-007-base to 1500037-006-base to avoid bug 286193.

Then, a one-off test of iwlwifi instead of iwm. Now back with iwm.

Additional details to follow.

-- 
You are receiving this mail because:
You are the assignee for the bug.