[REGRESSION] iwlwifi 8265 firmware ADVANCED_SYSASSERT in PHY_CONTEXT_CMD on roam (v7.0.3..v7.0.5)

[REGRESSION] iwlwifi 8265 firmware ADVANCED_SYSASSERT in PHY_CONTEXT_CMD on roam (v7.0.3..v7.0.5)

[Branislav Klocok]

[-- Attachment #1.1: Type: text/plain, Size: 2860 bytes --]

Hi,

I would like to report a regression in stable kernel 7.0.x affecting
iwlwifi on Intel Wireless-AC 8265. Bug filed at
https://bugzilla.kernel.org/show_bug.cgi?id=221512 (network-wireless-intel)
and openSUSE Bugzilla https://bugzilla.suse.com/show_bug.cgi?id=1264804.

#regzbot introduced: v7.0.3..v7.0.5
#regzbot link: https://bugzilla.kernel.org/show_bug.cgi?id=221512
#regzbot link: https://bugzilla.suse.com/show_bug.cgi?id=1264804

Summary: every controller-initiated roam between BSSIDs of the same
enterprise ESSID triggers a firmware microcode assertion
(`ADVANCED_SYSASSERT` / `NMI_INTERRUPT_LMAC_FATAL` / `FW error in SYNC
CMD PHY_CONTEXT_CMD`). Driver SW-resets and re-associates in about
4 s, but some triggers send the driver into a cascading restart loop
(observed 6 firmware errors in 23 s, twice in a single session).
Identical hardware, firmware blob (`8265-36.ucode` v36.c8e8e144.0),
network and userspace worked correctly on 7.0.3.

I personally booted only 7.0.3 (good) and 7.0.5 (bad); 7.0.4 was
installed but not run. The 7.0.5 stable changelog contains no
iwlwifi/mac80211/cfg80211 commits, so the regression most likely sits
in the 7.0.4 batch.

Crash backtrace fragment:

iwlwifi 0000:02:00.0: 0x000014FD | ADVANCED_SYSASSERT
iwlwifi 0000:02:00.0: 0x00000070 | NMI_INTERRUPT_LMAC_FATAL
iwlwifi 0000:02:00.0: FW error in SYNC CMD PHY_CONTEXT_CMD
CPU: 2 UID: 0 PID: 1527 Comm: wpa_supplicant
iwl_trans_pcie_send_hcmd+0x402/0x410 [iwlwifi]
iwl_trans_send_cmd+0x3e/0xa0 [iwlwifi]
? nl80211_authenticate+0x373/0x400 [cfg80211]
nl80211_authenticate+0x38d/0x400 [cfg80211]
iwlwifi 0000:02:00.0: PHY ctxt cmd error. ret=-5

Workarounds tested and rejected:
- `802-11-wireless.powersave=2` (CAM) — does not prevent the crash;
client still receives steering and firmware still asserts on
`PHY_CONTEXT_CMD`.
- `modprobe -r iwlmvm iwlwifi && modprobe iwlwifi` — temporary
recovery only; next roam reproduces the crash.

The only known mitigation is staying on 7.0.3 or avoiding networks
with controller-driven band/load steering.

I am happy to test patches against the affected hardware and network.
Full filtered kernel log (3329 lines, both cascading restart loops)
is attached to the bugzilla.kernel.org bug.

Hardware:
- Intel Wireless-AC 8265 [8086:24fd] rev 78, subsys [8086:0010]
- ThinkPad, openSUSE Tumbleweed (rolling) snapshot 20260509
- kernel-firmware-iwlwifi 20260331-1.1
- NetworkManager 1.54.3-3.4, wpa_supplicant 2.11-6.3

Thanks,
Branislav Klocok
*-- *
S pozdravom / Best regards
*Branislav Klocok *
*generálny riaditeľ / general director *


* OFZ, a.s.*
Mobil: 	*+421 908 703 366*
Tel: 	*+421 43 5804 488 *
e-mail: 	**branislav.klocok@ofz.sk* <mailto:branislav.klocok@ofz.sk> *
web: 	**www.ofz.company* <http://www.ofz.company> *


ofz logo


[-- Attachment #1.2.1: Type: text/html, Size: 6169 bytes --]

[-- Attachment #1.2.2: WdtYKUGW07EU0N07.png --]
[-- Type: image/png, Size: 4675 bytes --]

[-- Attachment #2: Kryptografický podpis S/MIME --]
[-- Type: application/pkcs7-signature, Size: 4669 bytes --]

Re: [REGRESSION] iwlwifi 8265 firmware ADVANCED_SYSASSERT in PHY_CONTEXT_CMD on roam (v7.0.3..v7.0.5)

[Johannes Berg]

On Wed, 2026-05-13 at 12:35 +0200, Branislav Klocok wrote:
>  #regzbot introduced: v7.0.3..v7.0.5

That cannot be right, there are no patches for wifi between those except
a handful in drivers you're not running.

johannes

Re: [REGRESSION] iwlwifi 8265 firmware ADVANCED_SYSASSERT in PHY_CONTEXT_CMD on roam (v7.0.3..v7.0.5)

[Branislav Klocok]

[-- Attachment #1.1: Type: text/plain, Size: 2725 bytes --]

Hi Johannes,

Thanks for the quick check. I dug a bit further; the v7.0.3..v7.0.5 
window is what I empirically see (clean -> crashing on every 
controller-driven roam), but the cause likely sits outside iwlwifi as 
you suggested.

What I can confirm from the openSUSE Tumbleweed packaging side:

- Between kernel-default-7.0.3-1.1 (installed 2026-05-08 21:45) and 
7.0.5-1.1 (2026-05-10 21:25), only the kernel package changed. 
kernel-firmware-intel was bumped to 20260505-1.1 in the same transaction 
as 7.0.3 on 2026-05-08 and stayed unchanged across the 7.0.5 install 
(8265 ucode 36.c8e8e144.0 is identical in both dmesg banners). 
NetworkManager 1.54.3-3.4 and wpa_supplicant 2.11-6.3 were last touched 
on 2026-05-04, also unchanged across this window. Userspace and firmware 
blob can be ruled out as the trigger.

- The only iwlwifi-touching SUSE patch added between the 7.0.3 and 7.0.5 
source packages is iwlwifi-declare-missing-firmware-files.patch in 
7.0.4, which is metadata-only (it just adds MODULE_FIRMWARE() entries). 
The rest of the diff is plain stable v7.0.3..v7.0.5.

- Caveat on my "7.0.3 worked" claim: it is based on a short boot into 
7.0.3 on 2026-05-11 before booting 7.0.5; I will re-test 7.0.3 over a 
longer window with forced roams to be sure.

Crash itself: ADVANCED_SYSASSERT (0x000014FD) + NMI_INTERRUPT_LMAC_FATAL 
(0x70) on PHY_CONTEXT_CMD during nl80211_authenticate. ~87 % of 
controller-driven roams trigger it (14/16 observed); cascading restart 
loops (6x in 23 s) on bad days. NM powersave=2 (CAM) does not suppress 
it. Full journal at https://bugzilla.kernel.org/show_bug.cgi?id=221512 
(attachment 310106).

A couple of questions, if you have a moment:

1. Is there an iwlmvm debug knob you'd like enabled on the next 
reproduction (iwlwifi.debug=, devcoredump, fw_dbg_collect) to capture 
more on what PHY_CONTEXT_CMD is hitting?

2. Given iwlwifi/mac80211 is unchanged, would you point at a tighter 
candidate area in v7.0.3..v7.0.5 (PCI PM, firmware loader, scheduler) 
before I attempt a bisect across the full tree?

*-- *
S pozdravom / Best regards
*Branislav Klocok *
*generálny riaditeľ / general director *


* OFZ, a.s.*
Mobil: 	*+421 908 703 366*
Tel: 	*+421 43 5804 488 *
e-mail: 	**branislav.klocok@ofz.sk* <mailto:branislav.klocok@ofz.sk> *
web: 	**www.ofz.company* <http://www.ofz.company> *


ofz logo

Dňa 13. 5. 2026 o 12:41 Johannes Berg napísal(a):
> On Wed, 2026-05-13 at 12:35 +0200, Branislav Klocok wrote:
>>   #regzbot introduced: v7.0.3..v7.0.5
> That cannot be right, there are no patches for wifi between those except
> a handful in drivers you're not running.
>
> johannes


[-- Attachment #1.2.1: Type: text/html, Size: 5836 bytes --]

[-- Attachment #1.2.2: FWbyySErjYKwOByv.png --]
[-- Type: image/png, Size: 4675 bytes --]

[-- Attachment #2: Kryptografický podpis S/MIME --]
[-- Type: application/pkcs7-signature, Size: 4669 bytes --]

Re: [REGRESSION] iwlwifi 8265 firmware ADVANCED_SYSASSERT in PHY_CONTEXT_CMD on roam (v7.0.3..v7.0.5)

[Branislav Klocok]

[-- Attachment #1.1: Type: text/plain, Size: 5235 bytes --]

Hi,

A few clarifications and additional data points after another working
day on 7.0.5 and after testing a recovery script — please take these
as a correction to the initial report:

1. The bug is INTERMITTENT on the roam path, not deterministic. My
initial phrasing ("every controller-initiated roam") was too strong.
Empirically across 16 observed roams: 14 crashed, 2 passed clean
(2026-05-13 11:19:23 and ~12:48). Crash probability ~87%, not 100%.

2. Some firmware crashes fire WITHOUT an immediately preceding
`disconnect from AP <a> for new auth to <b>` line in the kernel
journal: 2026-05-13 11:31:13, 12:04:28, 12:04:32, 12:18:18. These
may be background firmware events not surfaced via mac80211 mlme
tracing, or roam steering happening at a layer that mac80211 does
not log.

3. Manual `modprobe -r iwlmvm iwlwifi && modprobe iwlwifi` followed by
`nmcli connection up <SSID>` does recover the radio reliably in
~15 s when the cascading restart loop leaves Wi-Fi unusable. It
does NOT prevent future crashes (the next roam still asserts
firmware), but it's a working clean-up. Useful when the in-driver
SW reset loop fails to converge.

4. Open diagnostic question: whether the clean-roam cases differ in
any observable PHY parameter. The two clean events here both
landed on 2.4 GHz channel 9 (de:2c:6e:8f:59:ef and ce:2d:e0:be:4d:93)
but most crashing roams are also 2.4 GHz, so band/channel alone
isn't the discriminator. Auth state, BA/AMPDU state, or in-flight
command queue depth at the moment of binding are candidates.

These have also been posted as comments on the two Bugzilla trackers:
- https://bugzilla.kernel.org/show_bug.cgi?id=221512 (comment posted today)
- https://bugzilla.suse.com/show_bug.cgi?id=1264804 (comment posted today)

Still happy to test debug patches.

Thanks,
Branislav Klocok

*-- *
S pozdravom / Best regards
*Branislav Klocok *
*generálny riaditeľ / general director *


* OFZ, a.s.*
Mobil: 	*+421 908 703 366*
Tel: 	*+421 43 5804 488 *
e-mail: 	**branislav.klocok@ofz.sk* <mailto:branislav.klocok@ofz.sk> *
web: 	**www.ofz.company* <http://www.ofz.company> *


ofz logo

Dňa 13. 5. 2026 o 12:35 Branislav Klocok napísal(a):
> Hi,
>
> I would like to report a regression in stable kernel 7.0.x affecting
> iwlwifi on Intel Wireless-AC 8265. Bug filed at
> https://bugzilla.kernel.org/show_bug.cgi?id=221512 
> (network-wireless-intel)
> and openSUSE Bugzilla https://bugzilla.suse.com/show_bug.cgi?id=1264804.
>
> #regzbot introduced: v7.0.3..v7.0.5
> #regzbot link: https://bugzilla.kernel.org/show_bug.cgi?id=221512
> #regzbot link: https://bugzilla.suse.com/show_bug.cgi?id=1264804
>
> Summary: every controller-initiated roam between BSSIDs of the same
> enterprise ESSID triggers a firmware microcode assertion
> (`ADVANCED_SYSASSERT` / `NMI_INTERRUPT_LMAC_FATAL` / `FW error in SYNC
> CMD PHY_CONTEXT_CMD`). Driver SW-resets and re-associates in about
> 4 s, but some triggers send the driver into a cascading restart loop
> (observed 6 firmware errors in 23 s, twice in a single session).
> Identical hardware, firmware blob (`8265-36.ucode` v36.c8e8e144.0),
> network and userspace worked correctly on 7.0.3.
>
> I personally booted only 7.0.3 (good) and 7.0.5 (bad); 7.0.4 was
> installed but not run. The 7.0.5 stable changelog contains no
> iwlwifi/mac80211/cfg80211 commits, so the regression most likely sits
> in the 7.0.4 batch.
>
> Crash backtrace fragment:
>
> iwlwifi 0000:02:00.0: 0x000014FD | ADVANCED_SYSASSERT
> iwlwifi 0000:02:00.0: 0x00000070 | NMI_INTERRUPT_LMAC_FATAL
> iwlwifi 0000:02:00.0: FW error in SYNC CMD PHY_CONTEXT_CMD
> CPU: 2 UID: 0 PID: 1527 Comm: wpa_supplicant
> iwl_trans_pcie_send_hcmd+0x402/0x410 [iwlwifi]
> iwl_trans_send_cmd+0x3e/0xa0 [iwlwifi]
> ? nl80211_authenticate+0x373/0x400 [cfg80211]
> nl80211_authenticate+0x38d/0x400 [cfg80211]
> iwlwifi 0000:02:00.0: PHY ctxt cmd error. ret=-5
>
> Workarounds tested and rejected:
> - `802-11-wireless.powersave=2` (CAM) — does not prevent the crash;
> client still receives steering and firmware still asserts on
> `PHY_CONTEXT_CMD`.
> - `modprobe -r iwlmvm iwlwifi && modprobe iwlwifi` — temporary
> recovery only; next roam reproduces the crash.
>
> The only known mitigation is staying on 7.0.3 or avoiding networks
> with controller-driven band/load steering.
>
> I am happy to test patches against the affected hardware and network.
> Full filtered kernel log (3329 lines, both cascading restart loops)
> is attached to the bugzilla.kernel.org bug.
>
> Hardware:
> - Intel Wireless-AC 8265 [8086:24fd] rev 78, subsys [8086:0010]
> - ThinkPad, openSUSE Tumbleweed (rolling) snapshot 20260509
> - kernel-firmware-iwlwifi 20260331-1.1
> - NetworkManager 1.54.3-3.4, wpa_supplicant 2.11-6.3
>
> Thanks,
> Branislav Klocok
> *-- *
> S pozdravom / Best regards
> *Branislav Klocok *
> *generálny riaditeľ / general director *
>
>
> * OFZ, a.s.*
> Mobil: 	*+421 908 703 366*
> Tel: 	*+421 43 5804 488 *
> e-mail: 	**branislav.klocok@ofz.sk* <mailto:branislav.klocok@ofz.sk> *
> web: 	**www.ofz.company* <http://www.ofz.company> *
>
>
> ofz logo
>


[-- Attachment #1.2.1: Type: text/html, Size: 11935 bytes --]

[-- Attachment #1.2.2: utpDdaMgmKCI02E0.png --]
[-- Type: image/png, Size: 4675 bytes --]

[-- Attachment #1.2.3: WdtYKUGW07EU0N07.png --]
[-- Type: image/png, Size: 4675 bytes --]

[-- Attachment #2: Kryptografický podpis S/MIME --]
[-- Type: application/pkcs7-signature, Size: 4669 bytes --]