openwrt / openwrt/mt76

MT7925E: kernel oops on MLO

Open
#1,014 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
888
Forks
436
No merged PRs in 30d

Description

I'm using OpenWrt SNAPSHOT, r31701-099633be82 on Radxa ROCK 5 ITX+ with two MT7925E.

I'm trying to build Wi-Fi 7 MLO AP. But it seems firmware (version 20231227093232) in kmod-mt7925-firmware package doesn't support MLO. I can see MLD: Not supported by the driver message from hostapd.

Then, I replaced firmware (/lib/firmware/mediatek/mt7925/*.bin) with recent one from https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/mediatek/mt7925.
Firmware versions 20250526152947a and later seem to include something for MLO, but this leads to a kernel oops.

[   15.560620] ------------[ cut here ]------------
[   15.561032] WARNING: CPU: 5 PID: 1201 at target-aarch64_generic_musl/linux-rockchip_armv8/mt76-2025.11.06~eb567bc7/mt7925/mcu.c:1345 mt7925_mcu_set_mlo_roc+0x280/0x2bc [mt7925_common]
[   15.562459] Modules linked in: rtw89_8852be(O) rtw89_8852b(O) rtw89_8852b_common(O) pppoe ppp_async nft_fib_inet nf_flow_table_inet mt7925e(O) mt7925_common(O) rtw89_pci(O) rtw89_core(O) pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt792x_lib(O) mt76_connac_lib(O) mt76(O) mac80211(O) cfg80211(O) slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 crc_ccitt compat(O) pwm_fan sha512_generic sha512_arm64 seqiv sha3_generic jitterentropy_rng drbg hmac geniv rng cmac r8169 ahci libahci libata gpio_button_hotplug(O)
[   15.568414] CPU: 5 UID: 101 PID: 1201 Comm: hostapd Tainted: G           O       6.12.57 #0
[   15.569144] Tainted: [O]=OOT_MODULE
[   15.569449] Hardware name: Radxa ROCK 5 ITX (DT)
[   15.569851] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   15.570458] pc : mt7925_mcu_set_mlo_roc+0x280/0x2bc [mt7925_common]
[   15.571006] lr : mt7925_mcu_set_mlo_roc+0x78/0x2bc [mt7925_common]
[   15.571546] sp : ffff8000854e3270
[   15.571835] x29: ffff8000854e3270 x28: ffff00010642d880 x27: ffff000108c7e140
[   15.572459] x26: ffff8000854e3440 x25: ffff000102b27a80 x24: 0000000000000001
[   15.573083] x23: 0000000000000005 x22: ffff000108c7db98 x21: ffff000108c7e040
[   15.573706] x20: ffff8000854e32d8 x19: 0000000000000003 x18: 00000000ffffffff
[   15.574330] x17: 000000040044ffff x16: 000000b2b5503510 x15: 0000000000000000
[   15.574954] x14: ffff000100869d80 x13: ffff000106fa0f80 x12: 000000003464d91d
[   15.575577] x11: 00000000000000c0 x10: 0000000000000940 x9 : ffff8000854e30d0
[   15.576201] x8 : 0000000000000003 x7 : 0000000000000003 x6 : ffff000108c7e040
[   15.576824] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[   15.577445] x2 : 0000000000000001 x1 : ffff8000854e32f0 x0 : 0000000000000001
[   15.578069] Call trace:
[   15.578284]  mt7925_mcu_set_mlo_roc+0x280/0x2bc [mt7925_common]
[   15.578802]  mt7925_roc_abort_sync+0x9ac/0x27c0 [mt7925_common]
[   15.579320]  mt7925_mac_sta_event+0xa84/0x11bc [mt7925_common]
[   15.579829]  drv_change_vif_links+0xc4/0x1a8 [mac80211]
[   15.580301]  ieee80211_link_stop+0x630/0x7c0 [mac80211]
[   15.580769]  ieee80211_vif_set_links+0x20/0x50 [mac80211]
[   15.581252]  ieee80211_obss_color_collision_notify+0x16c4/0x1be8 [mac80211]
[   15.581870]  __cfg80211_send_event_skb+0x2550/0x25a0 [cfg80211]
[   15.582395]  genl_family_rcv_msg_doit+0xb0/0x120
[   15.582805]  genl_rcv_msg+0x1b8/0x250
[   15.583128]  netlink_rcv_skb+0x60/0x130
[   15.583466]  genl_rcv+0x38/0x50
[   15.583744]  netlink_unicast+0x20c/0x304
[   15.584089]  netlink_sendmsg+0x174/0x37c
[   15.584434]  ____sys_sendmsg+0x1cc/0x27c
[   15.584782]  ___sys_sendmsg+0x80/0xc8
[   15.585104]  __sys_sendmsg+0x48/0xb0
[   15.585420]  __arm64_sys_sendmsg+0x24/0x30
[   15.585781]  invoke_syscall.constprop.0+0x50/0xe0
[   15.586195]  do_el0_svc+0x40/0xe0
[   15.586488]  el0_svc+0x30/0x134
[   15.586766]  el0t_64_sync_handler+0x120/0x12c
[   15.587147]  el0t_64_sync+0x178/0x17c
[   15.587468] ---[ end trace 0000000000000000 ]---

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'a40000000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option band '6g'
	option channel '1'
	option htmode 'EHT160'
	option country 'JP'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'a40400000.pcie/pci0001:10/0001:10:00.0/0001:11:00.0'
	option band '6g'
	option channel '33'
	option htmode 'EHT160'
	option country 'JP'
	option cell_density '0'

config wifi-iface 'default_mlo'
	list device 'radio0'
	list device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt-MLO'
	option encryption 'sae'
	option key 'OpenWrt-MLO'
	option ocv '0'
	option mlo '1'

root@OpenWrt:~# ls /run/
config.md5            hostapd-ap-mld0.psk   run
dnsmasq               hostapd-ap-mld0.vlan  ubus
dropbear.main.pid     hostapd-phy0.conf     udhcpc-br-lan.pid
fw4.lock              hostapd-phy1.conf     wdev-phy0.json
fw4.state             lock                  wdev-phy1.json
hostapd               rpcd                  wpa_supplicant

root@OpenWrt:~# cat /run/hostapd-phy0.conf 
driver=nl80211
logger_syslog=127
logger_syslog_level=2
logger_stdout=127
logger_stdout_level=2
country_code=JP
ieee80211h=1
ieee80211d=1
spectrum_mgmt_required=0
beacon_int=100
noscan=0
rssi_reject_assoc_rssi=0
rssi_ignore_probe_request=0
acs_exclude_dfs=0
min_tx_power=0
hw_mode=a
channel=1
op_class=134
he_bss_color=128
he_spr_sr_control=3
ieee80211ax=1
he_oper_chwidth=2
he_oper_centr_freq_seg0_idx=15
he_su_beamformer=0
he_su_beamformee=0
he_mu_beamformer=0
he_twt_required=0
he_default_pe_duration=4
he_rts_threshold=1023
he_mu_edca_qos_info_param_count=0
he_mu_edca_qos_info_q_ack=0
he_mu_edca_qos_info_queue_request=0
he_mu_edca_qos_info_txop_request=0
he_mu_edca_ac_be_aifsn=8
he_mu_edca_ac_be_aci=0
he_mu_edca_ac_be_ecwmin=9
he_mu_edca_ac_be_ecwmax=10
he_mu_edca_ac_be_timer=255
he_mu_edca_ac_bk_aifsn=15
he_mu_edca_ac_bk_aci=1
he_mu_edca_ac_bk_ecwmin=9
he_mu_edca_ac_bk_ecwmax=10
he_mu_edca_ac_bk_timer=255
he_mu_edca_ac_vi_ecwmin=5
he_mu_edca_ac_vi_ecwmax=7
he_mu_edca_ac_vi_aifsn=5
he_mu_edca_ac_vi_aci=2
he_mu_edca_ac_vi_timer=255
he_mu_edca_ac_vo_aifsn=5
he_mu_edca_ac_vo_aci=3
he_mu_edca_ac_vo_ecwmin=5
he_mu_edca_ac_vo_ecwmax=7
he_mu_edca_ac_vo_timer=255
ieee80211be=1
eht_oper_chwidth=2
eht_oper_centr_freq_seg0_idx=15
he_6ghz_reg_pwr_type=0
stationary_ap=1
mbssid=0

#num_global_macaddr=1

# Setup interface: ap-mld0
interface=ap-mld0
bssid=c0:bf:be:05:fa:b0
ssid2="OpenWrt-MLO"
ctrl_interface=/var/run/hostapd
ap_isolate=0
bss_load_update_period=60
chan_util_avg_period=600
disassoc_low_ack=1
skip_inactivity_poll=0
ignore_broadcast_ssid=0
uapsd_advertisement_enabled=1
utf8_ssid=1
bridge=br-lan
snoop_iface=br-lan
ocv=0
preamble=1
qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
dtim_period=2
wmm_enabled=1
sae_require_mfp=1
sae_pwe=2
wpa_passphrase=OpenWrt-MLO
wpa_psk_file=/var/run/hostapd-ap-mld0.psk
dynamic_vlan=0
wpa_disable_eapol_key_retries=0
wpa=2
wpa_pairwise=CCMP
rrm_neighbor_report=1
rrm_beacon_report=1
rnr=1
vlan_file=/var/run/hostapd-ap-mld0.vlan
ieee80211w=2
group_mgmt_cipher=AES-128-CMAC
okc=1
wpa_key_mgmt=SAE
rsn_override_key_mgmt=SAE
rsn_override_pairwise=GCMP-256 CCMP
rsn_override_mfp=2
rsn_override_key_mgmt_2=SAE
rsn_override_pairwise_2=GCMP-256 CCMP
rsn_override_mfp_2=2
mld_ap=1
mld_link_id=-1
#default_macaddr

root@OpenWrt:~# cat /run/hostapd-phy1.conf 
driver=nl80211
logger_syslog=127
logger_syslog_level=2
logger_stdout=127
logger_stdout_level=2
country_code=JP
ieee80211h=1
ieee80211d=1
spectrum_mgmt_required=0
beacon_int=100
noscan=0
rssi_reject_assoc_rssi=0
rssi_ignore_probe_request=0
acs_exclude_dfs=0
min_tx_power=0
hw_mode=a
channel=33
op_class=134
he_bss_color=128
he_spr_sr_control=3
ieee80211ax=1
he_oper_chwidth=2
he_oper_centr_freq_seg0_idx=47
he_su_beamformer=0
he_su_beamformee=0
he_mu_beamformer=0
he_twt_required=0
he_default_pe_duration=4
he_rts_threshold=1023
he_mu_edca_qos_info_param_count=0
he_mu_edca_qos_info_q_ack=0
he_mu_edca_qos_info_queue_request=0
he_mu_edca_qos_info_txop_request=0
he_mu_edca_ac_be_aifsn=8
he_mu_edca_ac_be_aci=0
he_mu_edca_ac_be_ecwmin=9
he_mu_edca_ac_be_ecwmax=10
he_mu_edca_ac_be_timer=255
he_mu_edca_ac_bk_aifsn=15
he_mu_edca_ac_bk_aci=1
he_mu_edca_ac_bk_ecwmin=9
he_mu_edca_ac_bk_ecwmax=10
he_mu_edca_ac_bk_timer=255
he_mu_edca_ac_vi_ecwmin=5
he_mu_edca_ac_vi_ecwmax=7
he_mu_edca_ac_vi_aifsn=5
he_mu_edca_ac_vi_aci=2
he_mu_edca_ac_vi_timer=255
he_mu_edca_ac_vo_aifsn=5
he_mu_edca_ac_vo_aci=3
he_mu_edca_ac_vo_ecwmin=5
he_mu_edca_ac_vo_ecwmax=7
he_mu_edca_ac_vo_timer=255
ieee80211be=1
eht_oper_chwidth=2
eht_oper_centr_freq_seg0_idx=47
he_6ghz_reg_pwr_type=0
stationary_ap=1
mbssid=0

#num_global_macaddr=1

# Setup interface: ap-mld0
interface=ap-mld0
bssid=28:d0:43:64:27:ee
ssid2="OpenWrt-MLO"
ctrl_interface=/var/run/hostapd
ap_isolate=0
bss_load_update_period=60
chan_util_avg_period=600
disassoc_low_ack=1
skip_inactivity_poll=0
ignore_broadcast_ssid=0
uapsd_advertisement_enabled=1
utf8_ssid=1
bridge=br-lan
snoop_iface=br-lan
ocv=0
preamble=1
qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
dtim_period=2
wmm_enabled=1
sae_require_mfp=1
sae_pwe=2
wpa_passphrase=OpenWrt-MLO
wpa_psk_file=/var/run/hostapd-ap-mld0.psk
dynamic_vlan=0
wpa_disable_eapol_key_retries=0
wpa=2
wpa_pairwise=CCMP
rrm_neighbor_report=1
rrm_beacon_report=1
rnr=1
vlan_file=/var/run/hostapd-ap-mld0.vlan
ieee80211w=2
group_mgmt_cipher=AES-128-CMAC
okc=1
wpa_key_mgmt=SAE
rsn_override_key_mgmt=SAE
rsn_override_pairwise=GCMP-256 CCMP
rsn_override_mfp=2
rsn_override_key_mgmt_2=SAE
rsn_override_pairwise_2=GCMP-256 CCMP
rsn_override_mfp_2=2
mld_ap=1
mld_link_id=-1
#default_macaddr

root@OpenWrt:~# iw dev
phy#0
	Interface ap-mld0
		ifindex 5
		wdev 0x1
		addr c0:bf:be:05:fa:b0
		ssid OpenWrt-MLO
		type AP
		multicast TXQ:
			qsz-byt	qsz-pkt	flows	drops	marks	overlmt	hashcoltx-bytes	tx-packets
			0	0	0	0	0	0	0	00
		MLD with links:
		 - link ID  0 link addr c2:bf:be:05:fa:b0
		   channel 1 (5955 MHz), width: 160 MHz, center1: 6025 MHz
		   txpower 3.00 dBm

root@OpenWrt:~# logread | grep err.*hostapd
Fri Nov  7 12:54:02 2025 daemon.err hostapd: MLD: Failed to add link 1 in MLD ap-mld0
Fri Nov  7 12:54:02 2025 daemon.err hostapd: hostapd_free_hapd_data: Interface ap-mld0 wasn't started

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in mt7925/mcu.c at mt7925_mcu_set_mlo_roc, using the call trace through mt7925_roc_abort_sync and drv_change_vif_links. Reproduce the failure with the shown OpenWrt MLO configuration and newer MT7925 firmware. Done means MLO setup no longer triggers the warning or kernel oops and the second link can be added.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.