Created attachment 264965 [details] 14.2 dmesg Starting from FreeBSD 14.3, the iwlwifi driver for Intel(R) Wi-Fi 6 AX101 fails when running DHCP. The interface initially scans successfully, but once dhclient starts, the driver encounters repeated errors. Dmesg extract: iwlwifi0: WRT: Collecting data: ini trigger 4 fired (delay=0ms). iwlwifi0: Failed to send flush command (-5) iwlwifi0: flush request fail wlan0: link state changed to DOWN bad state = 0 iwlwifi0: Failed to trigger RX queues sync (-5) iwlwifi0: Failed to send rate scale config (-5) iwlwifi0: Couldn't send the SESSION_PROTECTION_CMD: -5 iwlwifi0: Failed to synchronize multicast groups update iwlwifi0: Failed to send flush command (-5) iwlwifi0: Failed to send MAC_CONFIG_CMD (action:2): -5 iwlwifi0: failed to update MAC 0xfffffe00f8114ed2M iwlwifi0: Failed to send LINK_CONFIG_CMD (action:2): -5 iwlwifi0: Failed to send LINK_CONFIG_CMD (action:3): -5 iwlwifi0: Failed to send LINK_CONFIG_CMD (action:1): -5 iwlwifi0: PHY ctxt cmd error. ret=-5 iwlwifi0: Scan failed! ret -5 iwlwifi0: ERROR: lkpi_ic_scan_start: hw_scan returned -5 The final line repeats indefinitely. Full dmesg output for 14.2 and 14.3, as well as pciconf -lv, are attached for reference. Notes: - The card can scan networks successfully before running DHCP. - The issue does not occur on FreeBSD 14.2 using the same firmware. - The firmware appears to load successfully in both versions.
Created attachment 264966 [details] 14.2 dmesg
Created attachment 264967 [details] 14.3 dmesg
Created attachment 264968 [details] pciconf -lv
Both dmesg are from 14.3. But this is a data/TLC crash. In 14.2 there was no 11n and 11ac so this code path likely never happened if my memory is correct.
Created attachment 264981 [details] 14.2 dmesg I must've uploaded the wrong one for 14.2, this should be the correct one
I think you are right about 11n and 11ac, when setting: compat.linuxkpi.iwlwifi_11n_disable=1 compat.linuxkpi.iwlwifi_disable_11ac=1 the interface is able to connect.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=adb4901ac9ae6c2ceb4194d139ed3176f6ed5e55 commit adb4901ac9ae6c2ceb4194d139ed3176f6ed5e55 Author: Bjoern A. Zeeb <bz@FreeBSD.org> AuthorDate: 2025-11-28 23:10:45 +0000 Commit: Bjoern A. Zeeb <bz@FreeBSD.org> CommitDate: 2025-12-02 18:46:44 +0000 LinuxKPI: 802.11: when synching HT and VHT cap, mask rx_mcs When we sync the sta data, mask the rx_mcs with what the hardware is able to do so that we do not leave, e.g., a 2nd stream enabled on a 1x1 chipset. iwlwifi(4) has a further check for the smps_mode to limit to NSS=1 but I believe that is historic and not actually in use anymore. This fixes firmware crashes on TLC updates with nss=1 but the nss=2 array index also being populated (with HT/VHT80/160 mcs information): data being populated: iwlwifi0: 0x20101A0D | ADVANCED_SYSASSERT iwlwifi0: 0x00000006 | umac data1 iwlwifi0: 0x00000001 | umac data2 iwlwifi0: 0x000003FF | umac data3 iwlwifi0: 0x____050F | last host cmd Reported by: Claudio Zumbo (claudiozumbo gmail.com), Erik Power Tested by: Claudio Zumbo, Erik Power (eppower umich.edu) PR: 290622 MFC after: 3 days Sponsored by: The FreeBSD Foundation sys/compat/linuxkpi/common/src/linux_80211.c | 99 ++++++++++++++++++++-------- 1 file changed, 71 insertions(+), 28 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=07555b10469d0cb613cfeedfd1239d5c4b6e507f commit 07555b10469d0cb613cfeedfd1239d5c4b6e507f Author: Bjoern A. Zeeb <bz@FreeBSD.org> AuthorDate: 2025-11-28 23:10:45 +0000 Commit: Bjoern A. Zeeb <bz@FreeBSD.org> CommitDate: 2025-12-08 15:43:52 +0000 LinuxKPI: 802.11: when synching HT and VHT cap, mask rx_mcs When we sync the sta data, mask the rx_mcs with what the hardware is able to do so that we do not leave, e.g., a 2nd stream enabled on a 1x1 chipset. iwlwifi(4) has a further check for the smps_mode to limit to NSS=1 but I believe that is historic and not actually in use anymore. This fixes firmware crashes on TLC updates with nss=1 but the nss=2 array index also being populated (with HT/VHT80/160 mcs information): data being populated: iwlwifi0: 0x20101A0D | ADVANCED_SYSASSERT iwlwifi0: 0x00000006 | umac data1 iwlwifi0: 0x00000001 | umac data2 iwlwifi0: 0x000003FF | umac data3 iwlwifi0: 0x____050F | last host cmd Reported by: Claudio Zumbo (claudiozumbo gmail.com), Erik Power Tested by: Claudio Zumbo, Erik Power (eppower umich.edu) PR: 290622 Sponsored by: The FreeBSD Foundation (cherry picked from commit adb4901ac9ae6c2ceb4194d139ed3176f6ed5e55) sys/compat/linuxkpi/common/src/linux_80211.c | 99 ++++++++++++++++++++-------- 1 file changed, 71 insertions(+), 28 deletions(-)