Adding support for Ubiquiti UniFi 6 Plus (U6+)

Definitely a race. It works fine on first boot, but not on subsequent boots.

It failed on r24125-9188c77cbee5 too after rebooting. Then I tried re-installing the same image, and the same happened again - worked on first boot and failed on the next.

Comparing the bootlogs gives us an ide why. First boot:

[   10.779823] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221208201745a
[   10.779823] 
[   10.961376] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221208201806
[   11.077164] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221208202048
[   11.168333] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
[   11.175155] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/mt7981_eeprom_mt7976_dbdc.bin failed with error -2
[   11.186359] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7981_eeprom_mt7976_dbdc.bin
[   16.639701] kmodloader: done loading kernel modules from /etc/modules.d/*
[   19.934650] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   20.001084] mtk_soc_eth 15100000.ethernet eth0: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY] (irq=POLL)
[   20.013460] mtk_soc_eth 15100000.ethernet eth0: configuring for phy/gmii link mode
[   20.022806] br-iot: port 1(eth0.15) entered blocking state
[   20.028301] br-iot: port 1(eth0.15) entered disabled state
[   20.034005] device eth0.15 entered promiscuous mode
[   20.038881] device eth0 entered promiscuous mode
[   20.058491] br-lan: port 1(eth0.10) entered blocking state
[   20.064041] br-lan: port 1(eth0.10) entered disabled state
[   20.069708] device eth0.10 entered promiscuous mode
[   22.013298] br-lan: port 2(phy1-ap0) entered blocking state
[   22.018881] br-lan: port 2(phy1-ap0) entered disabled state
[   22.024657] device phy1-ap0 entered promiscuous mode
[   22.112662] br-lan: port 2(phy1-ap0) entered blocking state
[   22.118241] br-lan: port 2(phy1-ap0) entered forwarding state
[   22.124328] br-lan: port 2(phy1-ap0) entered disabled state
[   22.564402] br-iot: port 2(phy0-ap0) entered blocking state
[   22.569994] br-iot: port 2(phy0-ap0) entered disabled state
[   22.575728] device phy0-ap0 entered promiscuous mode
[   22.611919] br-iot: port 2(phy0-ap0) entered blocking state
[   22.617505] br-iot: port 2(phy0-ap0) entered forwarding state
[   22.623484] IPv6: ADDRCONF(NETDEV_CHANGE): br-iot: link becomes ready
[   22.817844] IPv6: ADDRCONF(NETDEV_CHANGE): phy0-ap0: link becomes ready
[   23.423635] IPv6: ADDRCONF(NETDEV_CHANGE): phy1-ap0: link becomes ready

Second boot, without any changes inbetween:

[    9.969977] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221208201745a
[    9.969977] 
[   10.142366] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221208201806
[   10.256059] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221208202048
[   10.347183] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
[   10.379759] kmodloader: done loading kernel modules from /etc/modules.d/*
[   13.686188] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   13.753309] mtk_soc_eth 15100000.ethernet eth0: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY] (irq=POLL)
[   13.765566] mtk_soc_eth 15100000.ethernet eth0: configuring for phy/gmii link mode
[   13.775372] br-iot: port 1(eth0.15) entered blocking state
[   13.780926] br-iot: port 1(eth0.15) entered disabled state
[   13.786567] device eth0.15 entered promiscuous mode
[   13.791475] device eth0 entered promiscuous mode
[   13.809721] br-lan: port 1(eth0.10) entered blocking state
[   13.815215] br-lan: port 1(eth0.10) entered disabled state
[   13.820881] device eth0.10 entered promiscuous mode
[   14.651750] br-iot: port 2(phy0-ap0) entered blocking state
[   14.657328] br-iot: port 2(phy0-ap0) entered disabled state
[   14.663152] device phy0-ap0 entered promiscuous mode
[   14.711686] br-iot: port 2(phy0-ap0) entered blocking state
[   14.717271] br-iot: port 2(phy0-ap0) entered forwarding state
[   14.723390] IPv6: ADDRCONF(NETDEV_CHANGE): br-iot: link becomes ready
[   14.733528] br-iot: port 2(phy0-ap0) entered disabled state
[   14.888812] IPv6: ADDRCONF(NETDEV_CHANGE): phy0-ap0: link becomes ready
[   14.895610] br-iot: port 2(phy0-ap0) entered blocking state
[   14.901238] br-iot: port 2(phy0-ap0) entered forwarding state
[   15.924876] br-lan: port 2(phy1-ap0) entered blocking state
[   15.930521] br-lan: port 2(phy1-ap0) entered disabled state
[   15.936258] device phy1-ap0 entered promiscuous mode
[   15.985185] br-lan: port 2(phy1-ap0) entered blocking state
[   15.990795] br-lan: port 2(phy1-ap0) entered forwarding state
[   15.996742] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   16.809687] br-lan: port 2(phy1-ap0) entered disabled state
[   17.181245] IPv6: ADDRCONF(NETDEV_CHANGE): phy1-ap0: link becomes ready

So the wifi interfaces are created several seconds earlier

Intriguing indeed. I've taken a look at the kernel log for my U6+ and it looks more like your "second boot" log than the first, even though its MAC addresses are correct. I'm going to have to do a reboot test later to rule out if I've ran /sbin/wifi indirectly without knowing or remembering.

Do the wireless clients see the wrong MAC addresses, or do they see the correct ones as set by hotplug?

The clients see the wrong address. That's how I noticed.

I added some primitive timestamp logging to the hotplug script and the network init to get some idea of the timing here:

root@u6plus:~# grep -C3 uptime /etc/hotplug.d/ieee80211/11_fix_wifi_mac /etc/init.d/network 
/etc/hotplug.d/ieee80211/11_fix_wifi_mac-
/etc/hotplug.d/ieee80211/11_fix_wifi_mac-[ -n $PHYNBR ] || exit 0
/etc/hotplug.d/ieee80211/11_fix_wifi_mac-
/etc/hotplug.d/ieee80211/11_fix_wifi_mac:cat /proc/uptime >>/tmp/hotplug
/etc/hotplug.d/ieee80211/11_fix_wifi_mac-
/etc/hotplug.d/ieee80211/11_fix_wifi_mac-. /lib/functions.sh
/etc/hotplug.d/ieee80211/11_fix_wifi_mac-. /lib/functions/system.sh
--
/etc/init.d/network-    }
/etc/init.d/network-    procd_close_instance
/etc/init.d/network-
/etc/init.d/network:    cat /proc/uptime >>/tmp/network
/etc/init.d/network-}
/etc/init.d/network-
/etc/init.d/network-reload_service() {

Not sure these are the correct places to compare, but I believe the diff is large enough to explain the problem in any case:

root@u6plus:~# grep . /tmp/hotplug  /tmp/network
/tmp/hotplug:16.26 10.28
/tmp/hotplug:17.37 10.40
/tmp/network:13.07 10.07

So we're finished starting netifd more than 3 seconds before the first phy hotplug event.

Ok, think I might have the explanation why we get different results.

I have added the block-mount package and configured it to mount /dev/mmcblk0p10 on /var/log since I use my U6+ as a console server with logging. This is done by an init script. But the package comes with a hotplug script for removable media:

root@u6plus:~# cat /etc/hotplug.d/block/10-mount 
[ "$ACTION" = "add" -o "$ACTION" = "remove" ] && /sbin/block hotplug

And this script is probably causing delayed hotplug processing at boot since it will be called for every block device present.

I deleted the block script and rebooted and got these results (and valid macaddresses):

root@u6plus:~# grep . /tmp/hotplug /tmp/network 
/tmp/hotplug:12.45 11.28
/tmp/hotplug:12.84 11.30
/tmp/network:14.19 12.08

So we have a sort of "fix".

But I'll still argue that this is much too fragile. We should not use asynchronous hotplug scripts to set any values depended on by init scripts. The driver should be in charge of the phy addresses if possible. And here it's definitely possible since the address can be found in a simple mtd partition.

It seems to me then that any device that uses hotplug.d/ieee80211/11_fix_wifi_mac has this race condition, at least for Filogic devices. It doesn't appear to prevent wireless from functioning, which is probably why nobody noticed up until now.

Some possible solutions:

  1. A proper userspace fix may involve having netifd wait until procd finishes initialization, but I don't understand how those two interact. Then we can potentially fix this problem for all devices that rely on 11_fix_wifi_mac.
  2. Put another script somewhere else that guarantees correct order of operations. Up to this point I thought scripts in hotplug.d/ieee80211 would always run before any interfaces are brought up, so I don't know where else to put them.
  3. Fix in kernel so that loading MAC addresses from MTD works. Then we define the correct MAC addresses via DTS instead of a shell script.

I personally would like to use #1 to get rid of the race, but I would need advice from the developers to fix. #2 can be applied to existing builds without recompilation, but it's a kludge. #3 appears to be the most feasible, if this pull request of yours gets merged or upstreamed to mainline mt76.

Yup. So no need to do something specific for this device. This is a generic problem.

Just another reason to improve the infrastructure allowing every board specific detail to be documented in the DTS instead of scripts.

Not sure if still needed based on discussion above but here you go...

root@access_point_1130:~# grep . /sys/class/ieee80211/phy*/macaddress
/sys/class/ieee80211/phy0/macaddress:da:b3:70:75:4e:73
/sys/class/ieee80211/phy1/macaddress:da:b3:70:75:4e:74
root@access_point_1130:~# grep . /sys/class/net/phy*/address
/sys/class/net/phy0-ap0/address:da:b3:70:75:4e:73
/sys/class/net/phy1-ap0/address:da:b3:70:75:4e:74
root@access_point_1130:~# ubus call system board
{
	"kernel": "5.15.135",
	"hostname": "access_point_1130",
	"system": "ARMv8 Processor rev 4",
	"model": "Ubiquiti UniFi 6 Plus",
	"board_name": "ubnt,unifi-6-plus",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "SNAPSHOT",
		"revision": "r24154-6f31941d38",
		"target": "mediatek/filogic",
		"description": "OpenWrt SNAPSHOT r24154-6f31941d38"
	}
}

Thank you for taking the time to test this, it adds another data point for us to take into consideration. :+1:

Hello

It's so great that you're taking the time to do this. I've recently bought a 6+, and would like to have openwrt on it. However most of the above is all greek to me, so would be so kind as to tell me in plain english, how far you are in the process? And many an eta?

Thanks
Brian

OpenWrt on U6+ is running fine. My commit has already been merged into mainline OpenWrt, so you can run a snapshot build (but be sure to understand the caveats of running snapshot). I've described the steps to flash OpenWrt in the commit. Also see this post for clarifications to the procedure.

If you intend to use a U6+ as just a wireless AP, so far everything appears to work. The issue we just discussed doesn't actually affect wireless operations and seems to only appear if you run additional services on U6+ beyond access point functions.

2 Likes

Thanks

That sounds great.. I'm gonna try that :slight_smile:

I'm guessing the worst think that can happen is that I need to install the stock firmware again by ssh, right?

You can install back the stock firmware using the official UniFi TFTP recovery procedure. TFTP recovery always works even if the firmware (OpenWrt or not) is completely trashed.

2 Likes

Thanks for all your help. You're most kind.

I have one last question though, when openwrt has been installed on this device, there will be a GUI, right?

No, snapshot builds do not have LuCI installed by default. U6+ support is quite recent, so stable builds are not available yet. LuCI can be installed via SSH:

opkg update
opkg install luci

You should do this as soon as you install OpenWrt since snapshots are built daily.

I'm getting an occasional weird issue where my 5ghz network just stops passing traffic. If you reconnect, you occasionally get traffic for about 18 seconds and then suddenly you don't receive any more responses. (looking in wireshark).

Connecting to the same networks on 2.4ghz works fine... So maybe some sort of radio crash?

Nothing in the logs that I can see, but I have lots of log spam like this which may have hidden the crash.

Tue Nov 7 11:57:52 2023 daemon.notice hostapd: phy1-ap0: BEACON-REQ-TX-STATUS cc:20:e8:bb:e0:cd 84 ack=1
Tue Nov 7 11:57:54 2023 daemon.notice hostapd: phy1-ap0: BEACON-REQ-TX-STATUS 34:1c:f0:d9:82:06 85 ack=1
Tue Nov 7 11:57:54 2023 daemon.notice hostapd: phy0-ap1: BEACON-REQ-TX-STATUS 3e:78:ae:ae:8b:e9 250 ack=1

Those log entries look normal to me. Is there any pattern you can discern to help narrow down the issue? Like:

  • Does this happen with all devices or does it only affect certain devices?
  • Do affected devices have a common chipset/operating system/driver/etc.?
  • Does this happen with only certain WiFI modes?

Also, instead of looking at the system log via logread, try looking at the kernel log via dmesg. If there's a crash in the wireless driver, there should be a stack trace there. The next time you observe weird behavior, take a look in dmesg and report back anything suspicious.


Note that wireless functions are provided by the mt76 driver. You might want to start another thread specifically about MT7981 since any WiFi issue here would affect all MediaTek Filogic 820 devices, not just the U6+.

All 5Ghz devices. Tested a laptop (mediatek), Macbook 2016, and a Xiaomi 10t pro.

Tested across 2 SSIDs too.

Could connect to the 2.4ghz network without issues. Also had some ESP32's connected throughout on the 2.4ghz that didn't drop any pings on uptimekuma

In the end I just disabled the 5Ghz SSIDs without rebooting and nobody has complained today.

Here's the kernel log from today (without rebooting since the problem happened yesterday)

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.132 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24072-a181b9f0f9) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Oct 2 20:13:10 2023
[    0.000000] Machine model: Ubiquiti UniFi 6 Plus
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fff7fff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fff7fff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fff7fff]
[    0.000000] On node 0, zone DMA: 8 pages in unavailable ranges
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 17 pages/cpu s30040 r8192 d31400 u69632
[    0.000000] pcpu-alloc: s30040 r8192 d31400 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64504
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootwait root=/dev/mmcblk0p7
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 240400K/262112K available (8448K kernel code, 912K rwdata, 2288K rodata, 448K init, 303K bss, 21712K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: 	RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000133] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000143] pid_max: default: 32768 minimum: 301
[    0.000422] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000431] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.001676] rcu: Hierarchical SRCU implementation.
[    0.002017] smp: Bringing up secondary CPUs ...
[    0.002337] Detected VIPT I-cache on CPU1
[    0.002362] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.002389] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.002451] smp: Brought up 1 node, 2 CPUs
[    0.002465] SMP: Total of 2 processors activated.
[    0.002469] CPU features: detected: 32-bit EL0 Support
[    0.002474] CPU features: detected: CRC32 instructions
[    0.002500] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.002559] CPU: All CPU(s) started at EL2
[    0.002571] alternatives: patching kernel code
[    0.005577] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.005599] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.005734] pinctrl core: initialized pinctrl subsystem
[    0.006556] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.006877] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.006904] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.006927] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.007250] thermal_sys: Registered thermal governor 'fair_share'
[    0.007254] thermal_sys: Registered thermal governor 'bang_bang'
[    0.007259] thermal_sys: Registered thermal governor 'step_wise'
[    0.007263] thermal_sys: Registered thermal governor 'user_space'
[    0.007453] ASID allocator initialised with 65536 entries
[    0.007879] pstore: Registered ramoops as persistent store backend
[    0.007885] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.017834] cryptd: max_cpu_qlen set to 1000
[    0.020100] SCSI subsystem initialized
[    0.020257] libata version 3.00 loaded.
[    0.021378] clocksource: Switched to clocksource arch_sys_counter
[    0.021959] NET: Registered PF_INET protocol family
[    0.022051] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.022459] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.022480] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.022490] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.022509] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.022538] TCP: Hash tables configured (established 2048 bind 2048)
[    0.022601] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.022619] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.022752] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.022776] PCI: CLS 0 bytes, default 64
[    0.025412] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.028961] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.028976] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.063572] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.064207] pwm-mediatek 10048000.pwm: clock: top fail: -517
[    0.072877] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.075008] printk: console [ttyS0] disabled
[    0.095156] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 18, base_baud = 2500000) is a ST16650V2
[    0.726311] printk: console [ttyS0] enabled
[    0.731247] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.740443] loop: module loaded
[    0.743623] Loading iSCSI transport class v2.0-870.
[    0.750269] spi spi0.0: setup: ignoring unsupported mode bits a00
[    0.756700] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.762190] 2 fixed-partitions partitions found on MTD device spi0.0
[    0.768544] Creating 2 MTD partitions on "spi0.0":
[    0.773421] 0x000000000000-0x000000010000 : "EEPROM"
[    0.778937] 0x000000010000-0x000000090000 : "u-boot-env"
[    0.926271] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc009500000, irq 82
[    0.935848] i2c_dev: i2c /dev entries driver
[    0.941350] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    0.950446] NET: Registered PF_INET6 protocol family
[    0.956241] Segment Routing with IPv6
[    0.959921] In-situ OAM (IOAM) with IPv6
[    0.963894] NET: Registered PF_PACKET protocol family
[    0.968979] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    0.982313] 8021q: 802.1Q VLAN Support v1.8
[    0.987696] pstore: Using crash dump compression: deflate
[    1.003007] Waiting for root device /dev/mmcblk0p7...
[    1.071756] mmc0: new high speed MMC card at address 0001
[    1.078119] mmcblk0: mmc0:0001 MK2704 3.53 GiB 
[    1.083679] Alternate GPT is invalid, using primary GPT.
[    1.089007]  mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
[    1.095566] mmcblk0boot0: mmc0:0001 MK2704 2.00 MiB 
[    1.101614] mmcblk0boot1: mmc0:0001 MK2704 2.00 MiB 
[    1.106892] mmcblk0rpmb: mmc0:0001 MK2704 512 KiB, chardev (250:0)
[    1.144585] VFS: Mounted root (squashfs filesystem) readonly on device 179:7.
[    1.151910] Freeing unused kernel memory: 448K
[    1.201493] Run /sbin/init as init process
[    1.205581]   with arguments:
[    1.208544]     /sbin/init
[    1.211239]   with environment:
[    1.214376]     HOME=/
[    1.216723]     TERM=linux
[    1.361457] init: Console is alive
[    1.365009] init: - watchdog -
[    1.652561] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.674852] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.692355] init: - preinit -
[    1.984503] mtk_soc_eth 15100000.ethernet eth0: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY] (irq=POLL)
[    1.996778] mtk_soc_eth 15100000.ethernet eth0: configuring for phy/gmii link mode
[    2.019070] random: procd: uninitialized urandom read (4 bytes read)
[    4.076603] loop0: detected capacity change from 0 to 262144
[    4.131383] loop0: detected capacity change from 262144 to 252416
[    4.445256] F2FS-fs (loop0): Mounted with checkpoint version = 8f5dcd6
[    4.452844] mount_root: switching to f2fs overlay
[    4.458393] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[    4.470211] urandom-seed: Seeding with /etc/urandom.seed
[    4.508892] procd: - early -
[    4.511896] procd: - watchdog -
[    5.048246] procd: - watchdog -
[    5.052208] procd: - ubus -
[    5.090252] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.106607] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.113265] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.122414] procd: - init -
[    5.357146] kmodloader: loading kernel modules from /etc/modules.d/*
[    5.372089] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    5.388675] Loading modules backported from Linux version v6.5-0-g2dde18cd1d8f
[    5.395945] Backport generated by backports.git v5.15.92-1-56-g5fb2ccb6b9e8
[    5.552728] urngd: v1.0.2 started.
[    5.713365] random: crng init done
[    5.716766] random: 23 urandom warning(s) missed due to ratelimiting
[    5.751761] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221208201745a
[    5.751761] 
[    5.908992] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221208201806
[    5.997678] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221208202048
[    6.089168] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
[    6.121890] PPP generic driver version 2.4.2
[    6.127411] NET: Registered PF_PPPOX protocol family
[    6.136877] kmodloader: done loading kernel modules from /etc/modules.d/*
[    6.152979] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[    6.161270] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    8.824293] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[    8.852260] mtk_soc_eth 15100000.ethernet eth0: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY] (irq=POLL)
[    8.864588] mtk_soc_eth 15100000.ethernet eth0: configuring for phy/gmii link mode
[    8.876117] br-lan: port 1(eth0) entered blocking state
[    8.881348] br-lan: port 1(eth0) entered disabled state
[    8.886792] device eth0 entered promiscuous mode
[    8.901036] br-public: port 1(eth0.31) entered blocking state
[    8.906862] br-public: port 1(eth0.31) entered disabled state
[    8.912820] device eth0.31 entered promiscuous mode
[    8.943912] br-IoT: port 1(eth0.66) entered blocking state
[    8.949405] br-IoT: port 1(eth0.66) entered disabled state
[    8.957560] device eth0.66 entered promiscuous mode
[    9.755515] br-public: port 2(phy1-ap0) entered blocking state
[    9.761354] br-public: port 2(phy1-ap0) entered disabled state
[    9.767433] device phy1-ap0 entered promiscuous mode
[    9.812136] br-public: port 2(phy1-ap0) entered blocking state
[    9.817980] br-public: port 2(phy1-ap0) entered forwarding state
[    9.824362] IPv6: ADDRCONF(NETDEV_CHANGE): br-public: link becomes ready
[    9.833816] br-public: port 2(phy1-ap0) entered disabled state
[   11.061828] IPv6: ADDRCONF(NETDEV_CHANGE): phy1-ap0: link becomes ready
[   11.068541] br-public: port 2(phy1-ap0) entered blocking state
[   11.074388] br-public: port 2(phy1-ap0) entered forwarding state
[   11.133149] br-lan: port 2(phy1-ap1) entered blocking state
[   11.138728] br-lan: port 2(phy1-ap1) entered disabled state
[   11.144542] device phy1-ap1 entered promiscuous mode
[   11.155010] br-lan: port 2(phy1-ap1) entered blocking state
[   11.160590] br-lan: port 2(phy1-ap1) entered forwarding state
[   11.166604] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   11.323304] IPv6: ADDRCONF(NETDEV_CHANGE): phy1-ap1: link becomes ready
[   11.733524] br-IoT: port 2(phy0-ap0) entered blocking state
[   11.739097] br-IoT: port 2(phy0-ap0) entered disabled state
[   11.744902] device phy0-ap0 entered promiscuous mode
[   11.778899] br-IoT: port 2(phy0-ap0) entered blocking state
[   11.784496] br-IoT: port 2(phy0-ap0) entered forwarding state
[   11.791474] IPv6: ADDRCONF(NETDEV_CHANGE): br-IoT: link becomes ready
[   11.881547] br-IoT: port 2(phy0-ap0) entered disabled state
[   12.009088] IPv6: ADDRCONF(NETDEV_CHANGE): phy0-ap0: link becomes ready
[   12.015847] br-IoT: port 2(phy0-ap0) entered blocking state
[   12.021440] br-IoT: port 2(phy0-ap0) entered forwarding state
[   12.073118] br-public: port 3(phy0-ap1) entered blocking state
[   12.078957] br-public: port 3(phy0-ap1) entered disabled state
[   12.085021] device phy0-ap1 entered promiscuous mode
[   12.094041] br-public: port 3(phy0-ap1) entered blocking state
[   12.099882] br-public: port 3(phy0-ap1) entered forwarding state
[   12.183913] IPv6: ADDRCONF(NETDEV_CHANGE): phy0-ap1: link becomes ready
[   13.031644] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[   13.039939] br-lan: port 1(eth0) entered blocking state
[   13.045170] br-lan: port 1(eth0) entered forwarding state
[   13.050872] br-public: port 1(eth0.31) entered blocking state
[   13.056637] br-public: port 1(eth0.31) entered forwarding state
[   13.062749] br-IoT: port 1(eth0.66) entered blocking state
[   13.068234] br-IoT: port 1(eth0.66) entered forwarding state
[41470.410031] ieee80211 phy0: WA: free done event
[41470.410031] 1022e800
[41470.410031] len = 32
[41470.410031] DW0 : 20 00 08 30
[41470.410031] DW1 : 01 40 f4 3e
[41470.410031] DW2 : 00 80 00 83
[41470.410031] DW3 : 74 e5 0c 5f
[41470.410031] DW4 : 02 80 01 00
[41470.410031] DW5 : 38 83 00 00
[41470.410031] DW6 : 04 00 03 00
[41470.410031] DW7 : 08 80 04 00
[41470.442514] ieee80211 phy0: WA: free done event
[41470.442514] 10227780
[41470.442514] len = 32
[41470.442514] DW0 : 20 00 08 30
[41470.442514] DW1 : 01 42 04 3b
[41470.442514] DW2 : 00 80 00 83
[41470.442514] DW3 : 48 8a 02 5f
[41470.442514] DW4 : 0a 00 06 00
[41470.442514] DW5 : a2 80 03 00
[41470.442514] DW6 : 05 80 05 00
[41470.442514] DW7 : 0d 00 0a 00
[41470.557607] ieee80211 phy0: WA: free done event
[41470.557607] 1022cf00
[41470.557607] len = 32
[41470.557607] DW0 : 20 00 08 30
[41470.557607] DW1 : 01 47 a4 96
[41470.557607] DW2 : 00 80 00 83
[41470.557607] DW3 : c1 00 01 5f
[41470.557607] DW4 : 17 00 0c 00
[41470.557607] DW5 : 41 00 0d 00
[41470.557607] DW6 : 1e 00 11 00
[41470.557607] DW7 : 23 00 0e 00
[71188.996553] ieee80211 phy0: WA: free done event
[71188.996553] 1022a980
[71188.996553] len = 20
[71188.996553] DW0 : 14 00 01 30
[71188.996553] DW1 : 01 06 d4 2a
[71188.996553] DW2 : 00 80 00 89
[71188.996553] DW3 : 16 44 04 5f
[71188.996553] DW4 : 02 80 ff 3f
[71189.581557] ieee80211 phy0: WA: free done event
[71189.581557] 10227dc0
[71189.581557] len = 20
[71189.581557] DW0 : 14 00 01 30
[71189.581557] DW1 : 01 82 14 36
[71189.581557] DW2 : 00 80 87 89
[71189.581557] DW3 : f8 20 0a 41
[71189.581557] DW4 : 02 80 ff 3f
[73338.640931] ieee80211 phy0: WA: free done event
[73338.640931] 1022ee40
[73338.640931] len = 28
[73338.640931] DW0 : 1c 00 02 30
[73338.640931] DW1 : 02 df 64 2c
[73338.640931] DW2 : 00 c0 01 89
[73338.640931] DW3 : 00 00 00 41
[73338.640931] DW4 : 22 80 ff 3f
[73338.640931] DW5 : 00 00 00 41
[73338.640931] DW6 : 0f 80 ff 3f
[82346.025575] ieee80211 phy0: WA: free done event
[82346.025575] 1022cf00
[82346.025575] len = 52
[82346.025575] DW0 : 34 00 05 30
[82346.025575] DW1 : 05 2b e4 94
[82346.025575] DW2 : 00 c0 01 89
[82346.025575] DW3 : a7 70 0a 41
[82346.025575] DW4 : 0f 80 ff 3f
[82346.025575] DW5 : a7 60 0a 41
[82346.025575] DW6 : 49 80 ff 3f
[82346.025575] DW7 : 92 20 09 41
[82346.025575] DW8 : 4c 80 ff 3f
[82346.025575] DW9 : 91 10 09 41
[82346.025575] DW10 : 4d 80 ff 3f
[82346.025575] DW11 : a7 70 0a 42
[82346.025575] DW12 : 47 80 ff 3f
[82351.541501] ieee80211 phy0: WA: free done event
[82351.541501] 1022c280
[82351.541501] len = 28
[82351.541501] DW0 : 1c 00 05 30
[82351.541501] DW1 : 01 e1 34 37
[82351.541501] DW2 : 00 c0 01 90
[82351.541501] DW3 : 07 ac 01 41
[82351.541501] DW4 : 5a 00 28 00
[82351.541501] DW5 : 6b 00 2e 00
[82351.541501] DW6 : 5d 80 ff 3f
[82351.571063] ieee80211 phy0: WA: free done event
[82351.571063] 1022cf00
[82351.571063] len = 28
[82351.571063] DW0 : 1c 00 05 30
[82351.571063] DW1 : 01 e2 04 5f
[82351.571063] DW2 : 00 c0 01 90
[82351.571063] DW3 : 08 b8 01 41
[82351.571063] DW4 : 5e 80 2f 00
[82351.571063] DW5 : 6c 80 28 00
[82351.571063] DW6 : 56 80 ff 3f
[82351.600610] ieee80211 phy0: WA: free done event
[82351.600610] 1022e1c0
[82351.600610] len = 36
[82351.600610] DW0 : 24 00 03 30
[82351.600610] DW1 : 03 ee 94 08
[82351.600610] DW2 : 00 c0 01 89
[82351.600610] DW3 : 9f f0 08 4d
[82351.600610] DW4 : 4c 80 ff 3f
[82351.600610] DW5 : 9f f0 08 4d
[82351.600610] DW6 : 4d 80 ff 3f
[82351.600610] DW7 : 3d d0 02 4d
[82351.600610] DW8 : 4f 80 ff 3f
[86393.316888] ieee80211 phy0: WA: free done event
[86393.316888] 1022ee40
[86393.316888] len = 100
[86393.316888] DW0 : 64 00 0b 30
[86393.316888] DW1 : 0b b9 f4 2b
[86393.316888] DW2 : 00 c0 01 89
[86393.316888] DW3 : 53 0d 00 40
[86393.316888] DW4 : 0f 80 ff 3f
[86393.316888] DW5 : 53 0d 00 40
[86393.316888] DW6 : 47 80 ff 3f
[86393.316888] DW7 : 53 0d 00 40
[86393.316888] DW8 : 49 80 ff 3f
[86393.316888] DW9 : 53 0d 00 40
[86393.316888] DW10 : 4c 80 ff 3f
[86393.316888] DW11 : 53 0d 00 40
[86393.316888] DW12 : 4d 80 ff 3f
[86393.316888] DW13 : 50 0d 00 40
[86393.316888] DW14 : 4f 80 ff 3f
[86393.316888] DW15 : 4f 0d 00 40
[86393.373571] ieee80211 phy0: WA: DW16 : 50 80 ff 3f
[86393.373571] DW17 : 4f 0d 00 40
[86393.373571] DW18 : 51 80 ff 3f
[86393.373571] DW19 : 4f 0d 00 40
[86393.373571] DW20 : 56 80 ff 3f
[86393.373571] DW21 : 4f 0d 00 40
[86393.373571] DW22 : 58 80 ff 3f
[86393.373571] DW23 : 4d 0d 00 40
[86393.373571] DW24 : 5a 80 ff 3f
[86393.402666] ieee80211 phy0: WA: free done event
[86393.402666] 1022e1c0
[86393.402666] len = 20
[86393.402666] DW0 : 14 00 01 30
[86393.402666] DW1 : 01 bc 14 64
[86393.402666] DW2 : 00 c0 01 89
[86393.402666] DW3 : c3 00 00 40
[86393.402666] DW4 : 01 80 ff 3f
[119675.761385] ieee80211 phy0: WA: free done event
[119675.761385] 10225e80
[119675.761385] len = 24
[119675.761385] DW0 : 18 00 03 30
[119675.761385] DW1 : 01 47 24 8c
[119675.761385] DW2 : 00 00 01 8b
[119675.761385] DW3 : f1 24 00 41
[119675.761385] DW4 : 02 80 01 00
[119675.761385] DW5 : 08 80 ff 3f
[126838.046667] ieee80211 phy0: WA: free done event
[126838.046667] 1022c8c0
[126838.046667] len = 20
[126838.046667] DW0 : 14 00 01 30
[126838.046667] DW1 : 01 3d 64 4b
[126838.046667] DW2 : 00 40 87 81
[126838.046667] DW3 : 14 20 00 41
[126838.046667] DW4 : 18 80 ff 3f
[127266.467596] ieee80211 phy0: WA: free done event
[127266.467596] 10225200
[127266.467596] len = 20
[127266.467596] DW0 : 14 00 01 30
[127266.467596] DW1 : 01 d0 a4 48
[127266.467596] DW2 : 00 00 01 89
[127266.467596] DW3 : 4d d0 04 41
[127266.467596] DW4 : 03 80 ff 3f
[127276.703923] ieee80211 phy0: WA: free done event
[127276.703923] 10228a40
[127276.703923] len = 20
[127276.703923] DW0 : 14 00 01 30
[127276.703923] DW1 : 01 c5 34 99
[127276.703923] DW2 : 00 00 01 89
[127276.703923] DW3 : 46 81 07 43
[127276.703923] DW4 : 02 80 ff 3f
[127297.378555] ieee80211 phy0: WA: free done event
[127297.378555] 10225840
[127297.378555] len = 28
[127297.378555] DW0 : 1c 00 02 30
[127297.378555] DW1 : 02 d6 34 9a
[127297.378555] DW2 : 00 c0 87 89
[127297.378555] DW3 : 11 59 18 41
[127297.378555] DW4 : 0c 80 ff 3f
[127297.378555] DW5 : 2a 05 00 41
[127297.378555] DW6 : 0b 80 ff 3f
[127297.408960] ieee80211 phy0: WA: free done event
[127297.408960] 1022a340
[127297.408960] len = 20
[127297.408960] DW0 : 14 00 01 30
[127297.408960] DW1 : 01 d7 44 47
[127297.408960] DW2 : 00 c0 87 89
[127297.408960] DW3 : 33 01 00 41
[127297.408960] DW4 : 03 80 ff 3f
[127309.765044] ieee80211 phy0: WA: free done event
[127309.765044] 1022db80
[127309.765044] len = 84
[127309.765044] DW0 : 54 00 09 30
[127309.765044] DW1 : 09 92 74 8d
[127309.765044] DW2 : 00 80 01 89
[127309.765044] DW3 : 5f d0 00 5f
[127309.765044] DW4 : 2f 80 ff 3f
[127309.765044] DW5 : 5b d0 00 5f
[127309.765044] DW6 : 30 80 ff 3f
[127309.765044] DW7 : 56 d0 00 5f
[127309.765044] DW8 : 0f 80 ff 3f
[127309.765044] DW9 : 52 d0 00 5f
[127309.765044] DW10 : 31 80 ff 3f
[127309.765044] DW11 : 4a d0 00 5f
[127309.765044] DW12 : 32 80 ff 3f
[127309.765044] DW13 : 47 d0 00 5f
[127309.765044] DW14 : 33 80 ff 3f
[127309.765044] DW15 : 3d d0 03 5f
[127309.823287] ieee80211 phy0: WA: DW16 : 34 80 ff 3f
[127309.823287] DW17 : 38 80 03 5f
[127309.823287] DW18 : 35 80 ff 3f
[127309.823287] DW19 : 31 10 03 5f
[127309.823287] DW20 : 36 80 ff 3f
[127316.834105] ieee80211 phy0: WA: free done event
[127316.834105] 10226b00
[127316.834105] len = 20
[127316.834105] DW0 : 14 00 01 30
[127316.834105] DW1 : 01 bd 44 02
[127316.834105] DW2 : 00 80 87 89
[127316.834105] DW3 : d6 60 0c 41
[127316.834105] DW4 : 16 80 ff 3f
[128052.300360] ieee80211 phy0: WA: free done event
[128052.300360] 1022cf00
[128052.300360] len = 28
[128052.300360] DW0 : 1c 00 02 30
[128052.300360] DW1 : 02 64 34 9e
[128052.300360] DW2 : 00 40 02 89
[128052.300360] DW3 : b6 50 00 41
[128052.300360] DW4 : 03 80 ff 3f
[128052.300360] DW5 : b7 00 00 41
[128052.300360] DW6 : 06 80 ff 3f
[128062.341782] ieee80211 phy0: WA: free done event
[128062.341782] 1022c8c0
[128062.341782] len = 20
[128062.341782] DW0 : 14 00 01 30
[128062.341782] DW1 : 01 b8 a4 71
[128062.341782] DW2 : 00 80 01 89
[128062.341782] DW3 : 5a d0 02 41
[128062.341782] DW4 : 02 80 ff 3f
[128073.590793] ieee80211 phy0: WA: free done event
[128073.590793] 10229d00
[128073.590793] len = 20
[128073.590793] DW0 : 14 00 01 30
[128073.590793] DW1 : 01 12 94 98
[128073.590793] DW2 : 00 80 87 89
[128073.590793] DW3 : a7 40 00 41
[128073.590793] DW4 : 03 80 ff 3f
[128082.202595] ieee80211 phy0: WA: free done event
[128082.202595] 10225200
[128082.202595] len = 28
[128082.202595] DW0 : 1c 00 02 30
[128082.202595] DW1 : 02 7d d4 69
[128082.202595] DW2 : 00 80 02 89
[128082.202595] DW3 : 01 10 00 41
[128082.202595] DW4 : 01 80 ff 3f
[128082.202595] DW5 : 01 00 00 41
[128082.202595] DW6 : 02 80 ff 3f
[128092.428620] ieee80211 phy0: WA: free done event
[128092.428620] 10227140
[128092.428620] len = 32
[128092.428620] DW0 : 20 00 02 30
[128092.428620] DW1 : 02 a3 f4 55
[128092.428620] DW2 : 00 80 87 89
[128092.428620] DW3 : af 10 00 41
[128092.428620] DW4 : 06 80 ff 3f
[128092.428620] DW5 : 00 80 01 89
[128092.428620] DW6 : 01 10 00 41
[128092.428620] DW7 : 02 80 ff 3f
[128102.287162] ieee80211 phy0: WA: free done event
[128102.287162] 10224bc0
[128102.287162] len = 36
[128102.287162] DW0 : 24 00 06 30
[128102.287162] DW1 : 03 c5 44 1b
[128102.287162] DW2 : 00 80 02 89
[128102.287162] DW3 : 1e c0 01 41
[128102.287162] DW4 : e1 00 71 00
[128102.287162] DW5 : 1e c0 01 41
[128102.287162] DW6 : e3 00 72 00
[128102.287162] DW7 : 1e c0 01 41
[128102.287162] DW8 : e5 00 01 00
[128112.908724] ieee80211 phy0: WA: free done event
[128112.908724] 1022a980
[128112.908724] len = 24
[128112.908724] DW0 : 18 00 03 30
[128112.908724] DW1 : 01 0e 54 30
[128112.908724] DW2 : 00 00 01 8b
[128112.908724] DW3 : 07 ff 1f 41
[128112.908724] DW4 : 15 00 0b 00
[128112.908724] DW5 : fe 87 ff 3f
[128122.528469] ieee80211 phy0: WA: free done event
[128122.528469] 1022a340
[128122.528469] len = 20
[128122.528469] DW0 : 14 00 01 30
[128122.528469] DW1 : 01 15 f4 97
[128122.528469] DW2 : 00 80 01 89
[128122.528469] DW3 : 01 00 00 41
[128122.528469] DW4 : 06 80 ff 3f
[128132.765487] ieee80211 phy0: WA: free done event
[128132.765487] 1022a980
[128132.765487] len = 36
[128132.765487] DW0 : 24 00 05 30
[128132.765487] DW1 : 03 fc 34 37
[128132.765487] DW2 : 00 80 02 89
[128132.765487] DW3 : 02 10 00 41
[128132.765487] DW4 : 7d 00 3f 00
[128132.765487] DW5 : 02 10 00 41
[128132.765487] DW6 : 7f 00 40 00
[128132.765487] DW7 : 02 10 00 41
[128132.765487] DW8 : 81 80 ff 3f
[128142.798796] ieee80211 phy0: WA: free done event
[128142.798796] 10225200
[128142.798796] len = 20
[128142.798796] DW0 : 14 00 01 30
[128142.798796] DW1 : 01 19 54 64
[128142.798796] DW2 : 00 00 01 89
[128142.798796] DW3 : 57 32 0d 44
[128142.798796] DW4 : 02 80 ff 3f
[128152.829862] ieee80211 phy0: WA: free done event
[128152.829862] 102264c0
[128152.829862] len = 24
[128152.829862] DW0 : 18 00 03 30
[128152.829862] DW1 : 01 05 84 9d
[128152.829862] DW2 : 00 00 01 8b
[128152.829862] DW3 : 6c f9 06 41
[128152.829862] DW4 : 14 00 0e 00
[128152.829862] DW5 : bd 81 ff 3f
[128162.862624] ieee80211 phy0: WA: free done event
[128162.862624] 1022f480
[128162.862624] len = 24
[128162.862624] DW0 : 18 00 03 30
[128162.862624] DW1 : 01 e0 74 9d
[128162.862624] DW2 : 00 00 01 8b
[128162.862624] DW3 : 3d cd 0c 41
[128162.862624] DW4 : 03 00 0a 00
[128162.862624] DW5 : 32 83 ff 3f
[162369.369368] device phy1-ap0 left promiscuous mode
[162369.374283] br-public: port 2(phy1-ap0) entered disabled state
[162369.422322] device phy1-ap1 left promiscuous mode
[162369.427195] br-lan: port 2(phy1-ap1) entered disabled state
[162370.292033] mt798x-wmac 18000000.wifi phy1-ap0: renamed from phy1-ap1 (while UP)
[162370.333011] br-lan: port 2(phy1-ap0) entered blocking state
[162370.338674] br-lan: port 2(phy1-ap0) entered disabled state
[162370.344573] device phy1-ap0 entered promiscuous mode
[162370.349719] br-lan: port 2(phy1-ap0) entered blocking state
[162370.355423] br-lan: port 2(phy1-ap0) entered forwarding state
[162377.750126] device phy1-ap0 left promiscuous mode
[162377.755026] br-lan: port 2(phy1-ap0) entered disabled state
[162667.112273] ieee80211 phy0: WA: free done event
[162667.112273] 1022cf00
[162667.112273] len = 24
[162667.112273] DW0 : 18 00 03 30
[162667.112273] DW1 : 01 17 d4 2d
[162667.112273] DW2 : 00 80 01 90
[162667.112273] DW3 : 0c 54 08 41
[162667.112273] DW4 : 24 80 12 00
[162667.112273] DW5 : 16 82 ff 3f
[215486.128915] ieee80211 phy0: WA: free done event
[215486.128915] 10225840
[215486.128915] len = 20
[215486.128915] DW0 : 14 00 01 30
[215486.128915] DW1 : 01 bc 64 59
[215486.128915] DW2 : 00 40 00 81
[215486.128915] DW3 : 06 30 00 43
[215486.128915] DW4 : 02 80 ff 3f

This is a clue, my U6+ has none of these kernel log entries. Unfortunately this log entry yields no relevant web search results.

The first timestamps happen around 11 hours 31 minutes after boot, the last timestamps happen around 2 days 12 hours after boot. Can you remember if anything significant happens around the timestamps in the kernel log?

Also, let's see what version you're running. Please SSH ubus call system board on your U6+. I'd like to know if your snapshot build is newer or older than mine.

I haven't seen those either, on any of my MT798x devices. Definitely interesting, Seems to be a closed firmware thing:

bjorn@miraculix:/usr/local/src/git/mt76$ git grep 'free done event'
Binary file firmware/mt7915_wa.bin matches
Binary file firmware/mt7916_wa.bin matches
Binary file firmware/mt7981_wa.bin matches
Binary file firmware/mt7986_wa.bin matches