[BUG] wifi: ath12k: Oops on rmmod when one device of a hw group failed firmware bring-up (QMI_FAIL)
Edward Boyd
foxhis11 at gmail.com
Thu Oct 29 01:29:55 PDT 2026
Hi,
On a board with three QCN9274 (PCI) in one ath12k hw group, removing the
driver after one of the devices failed QMI firmware bring-up crashes the
kernel (NULL pointer read) and the system reboots. Reproduced twice.
Setup
- Askey SBE1V1K: IPQ9570 + 3x QCN9274 hw2.0 on PCIe
(0001:01:00.0, 0002:01:00.0, 0003:01:00.0)
- kernel 6.18.55; ath12k / ath12k_wifi7 from backports 7.2 as packaged
by OpenWrt (package/kernel/mac80211; image based on an ImmortalWrt
snapshot, r42138-da63f7d6ac), no local changes to the driver
- firmware WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
- ath12k_pci_remove(), ath12k_core_hw_group_cleanup() and
ath12k_core_stop() are identical in ath.git ath-next as of today.
Steps to reproduce
1. Boot normally; all three radios come up.
2. Put an invalid board-2.bin in place (I used 4 KiB of zeros in
/lib/firmware/updates/ath12k/QCN9274/hw2.0/board-2.bin) and reload:
rmmod ath12k_wifi7 ath12k; modprobe ath12k_wifi7
One device fails at BDF/regdb download; the other two never get past
MHI "Wait for device to enter SBL or Mission mode". This part is
expected.
3. Restore a valid board-2.bin and run "rmmod ath12k_wifi7" again.
Actual (abridged, full excerpt at the end)
[ 203.584861] ath12k_wifi7_pci 0002:01:00.0: found invalid board magic
[ 203.600721] ath12k_wifi7_pci 0002:01:00.0: found invalid board magic
[ 203.618033] ath12k_wifi7_pci 0002:01:00.0: qmi failed to load regdb bin:
[ 203.618061] ath12k_wifi7_pci 0002:01:00.0: qmi failed to load
regdb file:-12
(nothing more from ath12k on 0001/0003 for ~120 s)
[ 324.611930] ath12k_wifi7_pci 0002:01:00.0: Mode request failed,
mode: 4, result: 1 err: 90
[ 324.611967] ath12k_wifi7_pci 0002:01:00.0: qmi failed to send wlan mode off
[ 324.619100] Unable to handle kernel read from unreadable memory
at virtual address 0000000000000000
[ 324.634974] ESR = 0x0000000096000005
[ 324.649897] FSC = 0x05: level 1 translation fault
[ 324.683072] Internal error: Oops: 0000000096000005 [#1] SMP
(system reboots)
I don't have the call trace: there is no serial console on this unit,
the log was streamed from /dev/kmsg over the network and stopped at the
"Internal error" line. kernel.panic_on_oops=0 did not keep the system
alive either.
Expected
The driver unloads cleanly and the device that never came up is skipped
during teardown.
Analysis (from reading the code, not confirmed by a backtrace)
- "qmi failed to send wlan mode off" is printed only by
ath12k_qmi_firmware_stop(), called from ath12k_core_stop() and from
the error path of ath12k_core_hw_group_start(). During rmmod it has to
be ath12k_core_stop() on 0002:01:00.0, the device that never finished
firmware bring-up. The Oops follows about 7 us later, so it is in the
rest of ath12k_core_stop() (dp rx reo cleanup / hif stop / wmi detach
/ dp deinit) or right after it.
- ath12k_pci_remove() skips ath12k_core_hw_group_cleanup() only for a
device that itself has ATH12K_FLAG_QMI_FAIL. The first healthy device
of the group to be removed calls ath12k_core_hw_group_cleanup(), which
runs ath12k_core_hw_group_stop() and then ath12k_core_stop() on every
device of the group unconditionally, including the one that never
started. For that device ath12k_core_to_group_ref_put() just returns
("core already de-attached"), but ath12k_core_stop() carries on and
tears down state that was never set up.
Suggestion
- In ath12k_core_hw_group_cleanup() (or at the top of
ath12k_core_stop()), skip devices that never completed firmware
bring-up, e.g. based on ab->hw_group_ref, ATH12K_FLAG_QMI_FAIL or
ATH12K_FLAG_QMI_FW_READY_COMPLETE.
- Only do the mac unregister/destroy part of ath12k_core_hw_group_stop()
if the group was actually registered (ATH12K_GROUP_FLAG_REGISTERED).
Side note: when one device of the group fails BDF download, the others
never proceed (they wait for host cap), so all radios of the group are
lost while the error is only logged for the failing device. That may be
by design.
I can test patches on this hardware.
Thanks
Edward.
---- full excerpt (from "rmmod/modprobe" in step 2 to the Oops) ----
[ 198.990367] ath12k_wifi7_pci 0002:01:00.0 wl0.1-ap0: left allmulticast mode
[ 198.990404] ath12k_wifi7_pci 0002:01:00.0 wl0.1-ap0: left promiscuous mode
[ 198.996288] br-lan: port 4(wl0.1-ap0) entered disabled state
[ 199.411627] br-lan: port 5(wl0.2-ap0) entered disabled state
[ 199.413182] ath12k_wifi7_pci 0002:01:00.0 wl0.2-ap0
(unregistering): left allmulticast mode
[ 199.416355] ath12k_wifi7_pci 0002:01:00.0 wl0.2-ap0
(unregistering): left promiscuous mode
[ 199.424470] br-lan: port 5(wl0.2-ap0) entered disabled state
[ 201.381848] ath12k_wifi7_pci 0002:01:00.0: BAR 0 [mem
0x20400000-0x205fffff 64bit]: assigned
[ 201.381974] ath12k_wifi7_pci 0002:01:00.0: Wi-Fi 7 Hardware name:
qcn9274 hw2.0
[ 201.389669] ath12k_wifi7_pci 0002:01:00.0: MSI vectors: 16
[ 201.402471] ath12k_wifi7_pci 0001:01:00.0: BAR 0 [mem
0x10400000-0x105fffff 64bit]: assigned
[ 201.402595] ath12k_wifi7_pci 0001:01:00.0: Wi-Fi 7 Hardware name:
qcn9274 hw2.0
[ 201.410783] ath12k_wifi7_pci 0001:01:00.0: MSI vectors: 16
[ 201.418504] ath12k_wifi7_pci 0003:01:00.0: BAR 0 [mem
0x18400000-0x185fffff 64bit]: assigned
[ 201.423210] ath12k_wifi7_pci 0003:01:00.0: Wi-Fi 7 Hardware name:
qcn9274 hw2.0
[ 201.431983] ath12k_wifi7_pci 0003:01:00.0: MSI vectors: 16
[ 201.490914] mhi mhi0: Requested to power ON
[ 201.490939] mhi mhi0: Power on setup success
[ 201.624426] mhi mhi0: Wait for device to enter SBL or Mission mode
[ 202.188190] mhi mhi2: Requested to power ON
[ 202.188228] mhi mhi2: Power on setup success
[ 202.321934] mhi mhi2: Wait for device to enter SBL or Mission mode
[ 202.885908] mhi mhi1: Requested to power ON
[ 202.885944] mhi mhi1: Power on setup success
[ 203.021013] mhi mhi1: Wait for device to enter SBL or Mission mode
[ 203.563737] ath12k_wifi7_pci 0002:01:00.0: using reserved
host-ddr-mem 0x0000000054100000 (0x0000000003102000 bytes used of
0x0000000003200000)
[ 203.569253] ath12k_wifi7_pci 0002:01:00.0: chip_id 0x0
chip_family 0xb board_id 0xff soc_id 0x401a2200
[ 203.575415] ath12k_wifi7_pci 0002:01:00.0: fw_version 0x160484db
fw_build_timestamp 2025-12-09 19:48 fw_build_id
QC_IMAGE_VERSION_STRING=WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
[ 203.584861] ath12k_wifi7_pci 0002:01:00.0: found invalid board magic
[ 203.600721] ath12k_wifi7_pci 0002:01:00.0: found invalid board magic
[ 203.618033] ath12k_wifi7_pci 0002:01:00.0: qmi failed to load regdb bin:
[ 203.618061] ath12k_wifi7_pci 0002:01:00.0: qmi failed to load
regdb file:-12
[ 324.611930] ath12k_wifi7_pci 0002:01:00.0: Mode request failed,
mode: 4, result: 1 err: 90
[ 324.611967] ath12k_wifi7_pci 0002:01:00.0: qmi failed to send wlan mode off
[ 324.619100] Unable to handle kernel read from unreadable memory
at virtual address 0000000000000000
[ 324.625962] Mem abort info:
[ 324.634974] ESR = 0x0000000096000005
[ 324.637744] EC = 0x25: DABT (current EL), IL = 32 bits
[ 324.641572] SET = 0, FnV = 0
[ 324.647031] EA = 0, S1PTW = 0
[ 324.649897] FSC = 0x05: level 1 translation fault
[ 324.652943] Data abort info:
[ 324.657795] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 324.660933] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 324.666218] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 324.671345] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000063f20000
[ 324.676722] [0000000000000000] pgd=0800000064474403,
p4d=0800000064474403, pud=0800000064474403, pmd=0000000000000000
[ 324.683072] Internal error: Oops: 0000000096000005 [#1] SMP
More information about the ath12k
mailing list