[Bug 294428] Kernel panic on high throughput download on intel 7265 using iwlwifi driver with ampdu

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294428

            Bug ID: 294428
           Summary: Kernel panic on high throughput download on intel 7265
                    using iwlwifi driver with ampdu
           Product: Base System
           Version: 14.4-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: wireless
          Assignee: wireless@FreeBSD.org
          Reporter: sahan.h.fernando@gmail.com

Created attachment 269648
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=269648&action=edit
Intel 7265 iwlwifi ampdu kernel panic trace

Hello,

I have a laptop with an intel 7265 wifi chipset, I have noticed a reproducible
kernel panic in the iwlwifi driver. It occurs when trying to download a large
file (~130MB) over wifi with amdpu enabled, the download starts up, runs for
about a second, then the kernel panic occurs and the machine automatically
reboots.

### System Details

```
$ ifconfig wlan0 list caps
drivercaps=581c001<STA,SHSLOT,SHPREAMBLE,MONITOR,WPA1,WPA2,WME>
cryptocaps=b<WEP,TKIP,AES_CCM>
htcaps=511ef<LDPC,CHWIDTH40,SHORTGI20,SHORTGI40,TXSTBC,DSSSCCK40>
vhtcaps=38071b0<RXLDPC,SHORTGI80,RXSTBC1,RXSTBC2,BFEECAP>
$ ifconfig wlan0 list sta
ADDR               AID CHAN RATE RSSI IDLE  TXSEQ  RXSEQ CAPS FLAG        
e4:f4:c6:00:a9:71    4   36  54M 50.5    0  15561  30816 EP   AQHVTRS+trU  RSN
BSSLOAD HTCAP VHTCAP VHTOPMODE VHTPWRENV WPS WME (rssi 51.0:47.0:0.0:0.0 nf
-96:-96:0:0)
$ ifconfig wlan0
wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=0
        ether 60:57:18:d5:55:6b
        inet 192.168.0.154 netmask 0xffffff00 broadcast 192.168.0.255
        groups: wlan
        ssid REDACTED channel 36 (5180 MHz 11a vht/80+) bssid e4:f4:c6:00:a9:71
        regdomain FCC country US authmode WPA2/802.11i privacy ON
        deftxkey UNDEF AES-CCM 2:128-bit AES-CCM ucast:128-bit txpower 17
        bmiss 7 mcastrate 6 mgmtrate 6 scanvalid 60 -ampdu ampdulimit 64k
        ampdudensity 4 -amsdutx amsdurx shortgi -ldpctx ldpcrx -uapsd vht
        vht40 vht80 -vht160 -vht80p80 wme roaming MANUAL
        parent interface: iwlwifi0
        media: IEEE 802.11 Wireless Ethernet autoselect mode 11ac
        status: associated
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
$ cat /etc/rc.conf
...
wlans_iwlwifi0="wlan0"
ifconfig_wlan0="WPA DHCP shortgi"
devmatch_blacklist="if_iwm iwm7265Dfw"
...
$ cat /boot/loader.conf
...
if_iwm_load="NO"
if_iwlwifi_load="YES"
compat.linuxkpi.iwlwifi_11n_disable=0
compat.linuxkpi.iwlwifi_disable_11ac=0
compat.linuxkpi.iwlwifi_bt_coex_active=0
compat.linuxkpi.iwlwifi_power_scheme=3
...
$  dmesg | grep -i iwl
iwlwifi0: <iwlwifi> mem 0xf7100000-0xf7101fff irq 19 at device 0.0 on pci2
iwlwifi0: Detected crf-id 0x0, cnv-id 0x0 wfpm id 0x0
iwlwifi0: PCI dev 095a/5410, rev=0x210, rfid=0xd55555d5
iwlwifi0: Detected Intel(R) Dual Band Wireless AC 7265
iwlwifi0: successfully loaded firmware image 'iwlwifi-7265D-29.ucode'
iwlwifi0: Found debug destination: EXTERNAL_DRAM
iwlwifi0: Found debug configuration: 0
iwlwifi0: loaded firmware version 29.9ef079ed.0 7265D-29.ucode op_mode iwlmvm
iwlwifi0: Applying debug destination EXTERNAL_DRAM
iwlwifi0: Allocated 0x00400000 bytes for firmware monitor.
iwlwifi0: base HW address: 60:57:18:d5:55:6b, OTP minor version: 0x0
iwlwifi0: iwlmvm doesn't allow to disable BT Coex, check bt_coex_active module
parameter
iwlwifi0: Applying debug destination EXTERNAL_DRAM
iwlwifi0: Applying debug destination EXTERNAL_DRAM
iwlwifi0: FW already configured (0) - re-configuring
```

### Reproduction

Simply booting into the system, and running the following commands:

```
$ ifconfig wlan0 ampdu # as superuser
$ wget
"http://repository.spotify.com/pool/non-free/s/spotify-client/spotify-client_1.2.84.476.ga1ff6607_amd64.deb"
```

I have attached the some details of the crash, specifically the output of the
following command, I can run further commands on the crashdump details if
needed:

```
echo 'bt
bt full
info threads
thread apply all bt' | kgdb /boot/kernel/kernel vmcore.last
```

-- 
You are receiving this mail because:
You are the assignee for the bug.