Bug 211866

Summary:	iwm 7260 driver crash message on Thinkpad T440s
Product:	Base System	Reporter:	Robin Randhawa <robin.randhawa>
Component:	kern	Assignee:	freebsd-wireless (Nobody) <wireless>
Status:	Open ---
Severity:	Affects Some People	CC:	adrian, bsd, emaste, sbruno
Priority:	---	Keywords:	crash, needs-qa
Version:	CURRENT
Hardware:	Any
OS:	Any
See Also:	https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=211653

Description Robin Randhawa 2016-08-15 11:34:03 UTC

$ pciconf -lv (appropriately grepped):

iwm0@pci0:3:0:0:        class=0x028000 card=0xc2608086 chip=0x08b28086 rev=0x83 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Wireless 7260'
    class      = network

$ dmesg (appropriately grepped):

wlan0: link state changed to DOWN
iwm0: iwm_update_edca: called
iwm0: dumping device error log
iwm0: Start Error Log Dump:
iwm0: Status: 0x3, count: 6
iwm0: 0x0000090A | ADVANCED_SYSASSERT          
iwm0: 080000F0 | trm_hw_status0
iwm0: 00000000 | trm_hw_status1
iwm0: 00000B2C | branchlink2
iwm0: 00016A90 | interruptlink1
iwm0: 00015A28 | interruptlink2
iwm0: DEADBEEF | data1
iwm0: DEADBEEF | data2
iwm0: DEADBEEF | data3
iwm0: 00305B7F | beacon time
iwm0: 000FA47F | tsf low
iwm0: 00000000 | tsf hi
iwm0: 00000000 | time gp1
iwm0: 000FA480 | time gp2
iwm0: 00000000 | uCode revision type
iwm0: 00000010 | uCode version major
iwm0: 0003B2EE | uCode version minor
iwm0: 00000144 | hw version
iwm0: 00009004 | board version
iwm0: 0000001C | hcmd
iwm0: 00022008 | isr0
iwm0: 00800000 | isr1
iwm0: 00000002 | isr2
iwm0: 004034C1 | isr3
iwm0: 00000000 | isr4
iwm0: 00010110 | last cmd Id
iwm0: 00000000 | wait_event
iwm0: 00000080 | l2p_control
iwm0: 00440000 | l2p_duration
iwm0: 00000000 | l2p_mhvalid
iwm0: 00000000 | l2p_addr_match
iwm0: 00000007 | lmpm_pmg_sel
iwm0: 22121936 | timestamp
iwm0: 00002028 | flow_handler
iwm0: driver status:
iwm0:   tx ring  0: qid=0  cur=1   queued=1  
iwm0:   tx ring  1: qid=1  cur=0   queued=0  
iwm0:   tx ring  2: qid=2  cur=0   queued=0  
iwm0:   tx ring  3: qid=3  cur=0   queued=0  
iwm0:   tx ring  4: qid=4  cur=0   queued=0  
iwm0:   tx ring  5: qid=5  cur=0   queued=0  
iwm0:   tx ring  6: qid=6  cur=0   queued=0  
iwm0:   tx ring  7: qid=7  cur=0   queued=0  
iwm0:   tx ring  8: qid=8  cur=0   queued=0  
iwm0:   tx ring  9: qid=9  cur=33  queued=0  
iwm0:   tx ring 10: qid=10 cur=0   queued=0  
iwm0:   tx ring 11: qid=11 cur=0   queued=0 
iwm0:   tx ring 12: qid=12 cur=0   queued=0  
iwm0:   tx ring 13: qid=13 cur=0   queued=0  
iwm0:   tx ring 14: qid=14 cur=0   queued=0  
iwm0:   tx ring 15: qid=15 cur=0   queued=0  
iwm0:   tx ring 16: qid=16 cur=0   queued=0  
iwm0:   tx ring 17: qid=17 cur=0   queued=0  
iwm0:   tx ring 18: qid=18 cur=0   queued=0  
iwm0:   tx ring 19: qid=19 cur=0   queued=0  
iwm0:   tx ring 20: qid=20 cur=0   queued=0  
iwm0:   tx ring 21: qid=21 cur=0   queued=0  
iwm0:   tx ring 22: qid=22 cur=0   queued=0  
iwm0:   tx ring 23: qid=23 cur=0   queued=0  
iwm0:   tx ring 24: qid=24 cur=0   queued=0  
iwm0:   tx ring 25: qid=25 cur=0   queued=0  
iwm0:   tx ring 26: qid=26 cur=0   queued=0  
iwm0:   tx ring 27: qid=27 cur=0   queued=0  
iwm0:   tx ring 28: qid=28 cur=0   queued=0  
iwm0:   tx ring 29: qid=29 cur=0   queued=0  
iwm0:   tx ring 30: qid=30 cur=0   queued=0  
iwm0:   rx ring: cur=33
iwm0:   802.11 state 1
iwm0: iwm_intr: controller panicked, iv_state = 1; restarting
wlan0: ieee80211_new_state_locked: pending SCAN -> AUTH transition lost
iwm0: PHY ctxt cmd error. ret=35

Comment 1 Sean Bruno freebsd_committer

2016-08-15 11:35:14 UTC

This error was seen at the BSDCam Devsummit on their wifi.  User reports that this doesn't seem to happen at home.

iwn(4) doesn't seem to be crashing and burning, but iwm(4) seems to be flapping with this type of card/firmware crash.

Comment 2 Adrian Chadd freebsd_committer

2016-08-15 19:01:18 UTC

my guess is it's another case of us using the firmware API wrong. :(

Comment 3 Robin Randhawa 2016-08-15 20:08:22 UTC

Hi Adrian.

Thanks for the info all the same. 

Sean recommended that I indicate the HEAD commit of the git repository from which I built the kernel, ideally with it's equivalent SVN counterpart reference. Unfortunately I'm not able to get the SVN reference at the moment.

However, here's the HEAD git commit that I used, just in case that helps.

Commit f5438765d263fbd834b2a3c4fe1e284e40ece85b
Author: ngie <ngie@FreeBSD.org>
Date:   Sat Aug 13 06:26:33 2016 +0000

    Redirect the output of the testcases to stderr instead of
    redirecting it to /dev/null
    
    This will aid in debugging failures
    
    MFC after:      1 week
    Sponsored by:   EMC / Isilon Storage Division

About your API misuse comment: I assume there is an intended API usage model that's being violated somehow. If so, is there more information on what that model is ? I'm no wifi stack expert but wouldn't mind digging around to see if I can help to resolve this in some way. At the very least, I'm happy to test things too. 

Cheers.

Comment 4 Ivan 2016-08-20 20:39:17 UTC

This thing haunting my 7265 controller, so I suppose it's a common stuff. Also, I get the same error on DragonFlyBSD 4.6

Comment 5 Ivan 2016-08-20 20:43:34 UTC

Aug 21 13:38:01 testbsd wpa_supplicant[262]: wlan0: CTRL-EVENT-DISCONNECTED bssid=00:1b:fc:45:34:fb reason=0
Aug 21 13:38:01 testbsd kernel: wlan0: link state changed to DOWN
Aug 21 13:38:01 testbsd kernel: iwm0: iwm_update_edca: called
Aug 21 13:38:01 testbsd wpa_supplicant[262]: ioctl[SIOCS80211, op=20, val=0, arg_len=7]: Can't assign requested address
Aug 21 13:38:01 testbsd kernel: iwm0: dumping device error log
Aug 21 13:38:01 testbsd kernel: iwm0: Start Error Log Dump:
Aug 21 13:38:01 testbsd kernel: iwm0: Status: 0x3, count: 6
Aug 21 13:38:01 testbsd kernel: iwm0: 0x0000090A | ADVANCED_SYSASSERT          
Aug 21 13:38:01 testbsd kernel: iwm0: 080000F0 | trm_hw_status0
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | trm_hw_status1
Aug 21 13:38:01 testbsd kernel: iwm0: 00000B34 | branchlink2
Aug 21 13:38:01 testbsd kernel: iwm0: 00019BE8 | interruptlink1
Aug 21 13:38:01 testbsd kernel: iwm0: 00018914 | interruptlink2
Aug 21 13:38:01 testbsd kernel: iwm0: 000000FF | data1
Aug 21 13:38:01 testbsd kernel: iwm0: 0001F14E | data2
Aug 21 13:38:01 testbsd kernel: iwm0: DEADBEEF | data3
Aug 21 13:38:01 testbsd kernel: iwm0: 0030753A | beacon time
Aug 21 13:38:01 testbsd kernel: iwm0: 000F8AC5 | tsf low
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | tsf hi
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | time gp1
Aug 21 13:38:01 testbsd kernel: iwm0: 000F8AC6 | time gp2
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | uCode revision type
Aug 21 13:38:01 testbsd kernel: iwm0: 00000010 | uCode version major
Aug 21 13:38:01 testbsd kernel: iwm0: 0003B2EE | uCode version minor
Aug 21 13:38:01 testbsd kernel: iwm0: 00000184 | hw version
Aug 21 13:38:01 testbsd kernel: iwm0: 00809004 | board version
Aug 21 13:38:01 testbsd kernel: iwm0: 0000001C | hcmd
Aug 21 13:38:01 testbsd kernel: iwm0: 00022008 | isr0
Aug 21 13:38:01 testbsd kernel: iwm0: 10800000 | isr1
Aug 21 13:38:01 testbsd kernel: iwm0: 00000002 | isr2
Aug 21 13:38:01 testbsd kernel: iwm0: 0040E0C1 | isr3
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | isr4
Aug 21 13:38:01 testbsd kernel: iwm0: 00010110 | last cmd Id
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | wait_event
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | l2p_control
Aug 21 13:38:01 testbsd kernel: iwm0: 00440000 | l2p_duration
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | l2p_mhvalid
Aug 21 13:38:01 testbsd kernel: iwm0: 00000000 | l2p_addr_match
Aug 21 13:38:01 testbsd kernel: iwm0: 00000007 | lmpm_pmg_sel
Aug 21 13:38:01 testbsd kernel: iwm0: 22121936 | timestamp
Aug 21 13:38:01 testbsd kernel: iwm0: 00002030 | flow_handler
Aug 21 13:38:01 testbsd kernel: iwm0: driver status:
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  0: qid=0  cur=1   queued=1  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  1: qid=1  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  2: qid=2  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  3: qid=3  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  4: qid=4  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  5: qid=5  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  6: qid=6  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  7: qid=7  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  8: qid=8  cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring  9: qid=9  cur=36  queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 10: qid=10 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 11: qid=11 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 12: qid=12 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 13: qid=13 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 14: qid=14 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 15: qid=15 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 16: qid=16 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 17: qid=17 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 18: qid=18 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 19: qid=19 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 20: qid=20 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 21: qid=21 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 22: qid=22 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 23: qid=23 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 24: qid=24 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 25: qid=25 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 26: qid=26 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 27: qid=27 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 28: qid=28 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 29: qid=29 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   tx ring 30: qid=30 cur=0   queued=0  
Aug 21 13:38:01 testbsd kernel: iwm0:   rx ring: cur=36
Aug 21 13:38:01 testbsd kernel: iwm0:   802.11 state 1
Aug 21 13:38:01 testbsd kernel: iwm0: iwm_intr: controller panicked, iv_state = 1; restarting
Aug 21 13:38:01 testbsd kernel: wlan0: ieee80211_new_state_locked: pending SCAN -> AUTH transition lost



FreeBSD 11-RC1

Comment 6 Graham Perrin freebsd_committer

2023-05-27 12:03:22 UTC

From comment 0:

>    device     = 'Wireless 7260'

From comment 4: 

> … 7265 …


Might the same type of crash occur with iwm(4) in FreeBSD 13.2-RELEASE with Intel(R) Dual Band Wireless AC 8265?