Public bug reported:
While associated to an MLO AP as a multi-link station, a Wi-Fi configuration
change on the AP causes the WCN7850 data path to lose track of the ML peer:
- TX stalls ("failed to flush transmit queue, data pkts pending 30")
- TX completions reference peer_id 8193 (0x2001: ML peer id 1 with the
ML-peer bit, BIT(13), set) that the host can no longer find
- ~10 minutes later, peer delete times out, every WMI command fails with
-108 (ESHUTDOWN), and ath12k_core_restart emits a warning repeatedly
- the system then kernel-panicked (panic output was not captured in the
journal)
A second, milder occurrence on the next boot (Sep 28 01:38) produced the same
"dp_tx: failed to find the peer with peer_id 8193" errors for about 45 seconds,
then recovered without a firmware crash.
Around that time the AP showed only one of the two MLO links as active (the
other "Ready"), and throughput was about 5 Mbps. Later both links became active
by themselves and throughput returned to normal. This may be the same
underlying peer-state problem.
ENVIRONMENT
-----------
Hardware: Qualcomm WCN7850 hw2.0 [17cb:1107], PCIe (running at x1, 8 GT/s)
Driver: ath12k (ath12k_wifi7_pci)
Firmware: WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
fw_version 0x1103006c, fw_build_timestamp 2026-03-06 09:10
linux-firmware: 20260319.git217ca6e4 (Ubuntu package)
Kernel: Ubuntu 7.0.0-34-generic
Userspace: NetworkManager + wpa_supplicant (versions in system-info.txt)
AP: Ubiquiti UniFi Dream Router 7
AP firmware: 5.1.33 UniFi Network version: 10.6.106
Security: WPA3-SAE, PMF required
MLO links: 5 GHz ch149 80 MHz + 6 GHz ch37 (320 MHz, later set to 160 MHz)
Also seen: 2.4 GHz ch6 20 MHz + 5 GHz ch149 80 MHz
STEPS TO REPRODUCE
------------------
1. Associate the WCN7850 to the UDR7 SSID with MLO enabled. `iw dev wlp4s0
info` shows "MLD with links" and two links.
2. While associated, change a Wi-Fi setting on the AP.
channel width / band
3. Watch the kernel log. The TX stall starts within seconds of the AP
applying the change.
KERNEL LOG (crash boot, Sep 27; condensed, full log attached)
------------------------------------------------------------
22:21:21 ath12k_wifi7_pci 0000:04:00.0: failed to flush transmit queue, data
pkts pending 30
(repeated every 5 s until 22:21:36)
22:21:38 ath12k_wifi7_pci 0000:04:00.0: dp_tx: failed to find the peer with
peer_id 8193
(repeated ~50 times until 22:31:03)
22:31:11 ath12k_wifi7_pci 0000:04:00.0: Timeout in receiving peer delete
response
22:31:11 ath12k_wifi7_pci 0000:04:00.0: failed to submit WMI_MGMT_TX_SEND_CMDID
cmd
22:31:11 ath12k_wifi7_pci 0000:04:00.0: failed to send mgmt frame: -108
22:31:11 ath12k_wifi7_pci 0000:04:00.0: failed to tx mgmt frame, vdev_id 0 :-108
22:31:11 ath12k_wifi7_pci 0000:04:00.0: failed to submit WMI_VDEV_DELETE_CMDID
22:31:11 ath12k_wifi7_pci 0000:04:00.0: failed to delete WMI vdev 0: -108
22:31:11 ath12k_wifi7_pci 0000:04:00.0: failed to submit WMI_VDEV_CREATE_CMDID
22:31:11 ath12k_wifi7_pci 0000:04:00.0: failed to create WMI vdev 1: -108
22:31:12 Workqueue: ath12k_wq ath12k_core_restart [ath12k]
22:31:12 ath12k_core_restart+0x73/0x1e0 [ath12k]
(these two lines repeat dozens of times; first full trace in
first-warning-trace.txt)
State after recovery (later boot):
valid_links 0x3, dormant_links 0x0 (active_links unreadable: debugfs
lockdown). The AP reports one link active and the other "Ready".
OTHER OBSERVATIONS
------------------
- Several other boots the same night show the firmware loading twice within
one boot (see all-boots-ath12k.log).
- At every boot: "debugfs: 'simulate_fw_crash' already exists in
'pci-0000:04:00.0'" and the same for 'device_dp_stats'. This is probably
unrelated, but the device registers its debugfs entries twice.
- A Samsung Galaxy Z Fold 8 on the same SSID keeps both MLO links
(2.4 + 5 GHz) active without issues.
ATTACHMENTS
-----------
system-info.txt versions, PCI info, iw output
crash-boot-kernel.log full kernel log of the crash boot
crash-boot-network.log NetworkManager / wpa_supplicant log of the same boot
first-warning-trace.txt first full warning with call trace
all-boots-ath12k.log ath12k messages from every boot since the card was
installed
current-boot-ath12k.log the 01:38 recurrence
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-34-generic 7.0.0-34.34
ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
Uname: Linux 7.0.0-34-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Mon Sep 28 02:04:45 2026
InstallationDate: Installed on 2026-05-22 (129 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
MachineType: Micro-Star International Co., Ltd. MS-7C56
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-34-generic
root=UUID=8cb871a5-b770-4a49-baad-e921e12116bd ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 07/13/2024
dmi.bios.release: 5.17
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: A.I0
dmi.board.asset.tag: To be filled by O.E.M.
dmi.board.name: B550-A PRO (MS-7C56)
dmi.board.vendor: Micro-Star International Co., Ltd.
dmi.board.version: 2.0
dmi.chassis.asset.tag: To be filled by O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: Micro-Star International Co., Ltd.
dmi.chassis.version: 6.0
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrA.I0:bd07/13/2024:br5.17:svnMicro-StarInternationalCo.,Ltd.:pnMS-7C56:pvr6.0:rvnMicro-StarInternationalCo.,Ltd.:rnB550-APRO(MS-7C56):rvr2.0:cvnMicro-StarInternationalCo.,Ltd.:ct3:cvr6.0:skuTobefilledbyO.E.M.:pfaTobefilledbyO.E.M.:
dmi.product.family: To be filled by O.E.M.
dmi.product.name: MS-7C56
dmi.product.sku: To be filled by O.E.M.
dmi.product.version: 6.0
dmi.sys.vendor: Micro-Star International Co., Ltd.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute
** Attachment added: "ath12k-bug-report.tar.gz"
https://bugs.launchpad.net/bugs/2168714/+attachment/6003292/+files/ath12k-bug-report.tar.gz
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168714
Title:
ath12k: WCN7850 MLO station loses ML peer (dp_tx peer_id 8193) after
AP reconfiguration; firmware stops responding and core restart fails
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168714/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
