Bridger not loaded - Asus TUF AX6000

I followed the openwrt wiki for Asus TUF AX6000 (with some AI help) in order to use WED (wifi) and bridger for the dumb access point.
To check whether it works I ran iperf3 and crosschecked with
cat /sys/kernel/debug/ppe0/bind
but the result was always nothing.

In dmesg it shows
[ 11.852720] bridger[1438]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
indicating that something is not loaded correctly (acc. to AI).

Here some additional info:

opkg list-installed | grep bpf
kmod-sched-bpf - 6.6.86-r1
libbpf1 - 1.5.0-r1

cat /sys/module/mt7915e/parameters/wed_enable
Y

brctl show
bridge name	bridge id		STP enabled	interfaces
br-lan		7fff.a0ad9f48412c	no		phy1-ap0
							lan4
							lan2
							lan5
							lan3
							lan1
							phy0-ap0

lsmod | grep mt79
cfg80211              299008  4 mt7915e,mt76_connac_lib,mt76,mac80211
mac80211              577536  3 mt7915e,mt76_connac_lib,mt76
mt76                   73728  2 mt7915e,mt76_connac_lib
mt76_connac_lib        45056  1 mt7915e
mt7915e               135168  0 

lsmod | grep ppe and lsmod | grep bridger show nothing

cat /etc/openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='24.10.1'
DISTRIB_REVISION='r28597-0425664679'
DISTRIB_TARGET='mediatek/filogic'
DISTRIB_ARCH='aarch64_cortex-a53'
DISTRIB_DESCRIPTION='OpenWrt 24.10.1 r28597-0425664679'
DISTRIB_TAINTS=''

Btw, the night before (20-Jun-2025, CET) I couldn't create an image, because something went wrong with the imagebuilder, indicating several corrupt packages, but this morning I could create an image including bridger without issues.

Key Questions

  1. Is is worth to turn on WED and use bridger for a dumb access point ?
  2. If yes, what should I do to make it run ?
  3. Off-topic or linked to it ?: Why is my wifi 5 GHz so slow (up 560 MBit/s, down only 180 MBits/s, my other AP Netgear WAX206 with the identical config is much faster with 80 MHz), see config (dawn does not influence the speed btw):
config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option band '5g'
	option channel '104'
	option htmode 'HE160'
	option country 'CH'
	option cell_density '0'
	option he_su_beamformee '1'
	option he_bss_color '8'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'VPN'
	option mode 'ap'
	option ssid 'Wifi5'
	option encryption 'sae'
	option key 'redacted'
	option ocv '0'
	option ieee80211r '1'
	option mobility_domain '1111'
	option ft_over_ds '1'
	option ieee80211k '1'
	option time_zone 'CET-1CEST,M3.5.0,M10.5.0/3'
	option bss_transition '1'

Thanks and Cheers, blinton

If your client is apple too many 11R )ptions make its location service nuts.

1 yes
2 install bridger package on a standrd image
3 because you have 2 160MHz options, one is half dfs, half neighbours, other is all dfs. Try 80MHz instead, as per your own writing.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Hi brada4,

Thanks a lot for your help in advance !
Here we go
1)

ubus call system board
{
        "kernel": "6.6.86",
        "hostname": "AP-Rinzler",
        "system": "ARMv8 Processor rev 4",
        "model": "ASUS TUF-AX6000",
        "board_name": "asus,tuf-ax6000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
        }


cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'REDACTED'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        option ipv6 '0'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'
        option igmp_snooping '1'
        option igmpversion '3'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '10.215.139.95'
        option netmask '255.255.255.0'
        option gateway '10.215.139.100'
        list dns '10.215.139.100'
        option delegate '0'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan5:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan5:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '4'
        list ports 'lan4'
        list ports 'lan5:t'

config device
        option type '8021q'
        option ifname 'br-lan'
        option vid '1'
        option name 'br-lan.1'
        option ipv6 '0'
        option igmpversion '3'

config device
        option type '8021q'
        option ifname 'br-lan'
        option vid '3'
        option name 'br-lan.3'
        option ipv6 '0'
        option igmpversion '3'

config device
        option type '8021q'
        option ifname 'br-lan'
        option vid '4'
        option name 'br-lan.4'
        option ipv6 '0'
        option igmpversion '3'

config interface 'VPN'
        option proto 'static'
        option device 'br-lan.3'
        option ipaddr '10.215.140.95'
        option netmask '255.255.255.0'
        option gateway '10.215.140.100'
        list dns '10.215.140.100'
        option delegate '0'

config interface 'BAR'
        option proto 'static'
        option device 'br-lan.4'
        option ipaddr '10.215.141.95'
        option netmask '255.255.255.0'
        option gateway '10.215.141.100'
        list dns '10.215.141.100'
        option delegate '0'


 cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '6'
        option htmode 'HE20'
        option txpower '20'
        option country 'CH'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'VPN'
        option mode 'ap'
        option ssid 'Hera'
        option encryption 'psk2+ccmp'
        option key 'REDACTED'
        option ieee80211w '1'
        option ocv '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '116'
        option htmode 'HE160'
        option country 'CH'
        option cell_density '0'
        option he_su_beamformee '1'
        option he_bss_color '8'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'VPN'
        option mode 'ap'
        option ssid 'Hera5'
        option encryption 'sae'
        option key 'REDACTED'
        option ocv '0'
        option ieee80211r '1'
        option mobility_domain '1111'
        option ft_over_ds '1'
        option ieee80211k '1'
        option time_zone 'CET-1CEST,M3.5.0,M10.5.0/3'
        option bss_transition '1'


# dnsmasq is DISABLED in System / Startup
cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'


# Firewall is DISABLED in Sytem / Startup ... that's why I deleted quite some stuff
cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

These are my imagebuilder parameters for dumb access points I use, except the line with ethtool-full bridger, only for Asus TUF AX6000 (I know you didn't ask for, maybe it helps):

make clean
make image PROFILE="asus_tuf-ax6000" \
PACKAGES="-ppp -ppp-mod-pppoe -ip6tables -odhcp6c -kmod-ipv6 -kmod-ip6tables -odhcpd-ipv6only \
-wpad-basic-mbedtls wpad-mbedtls \
irqbalance luci-ssl nano mdio-tools luci-app-wifischedule \
dawn luci-app-dawn \
ethtool-full bridger" \
DISABLED_SERVICES="dnsmasq firewall"
  1. Can't do today, wife is watching TV ... will check late late later :slight_smile:

  2. In CH only channels 100-128 seem allowed, lower channels 36-48 don't work in openwrt (iwinfo says 6 GHz and NOHT, if I try channel 42 with HE160). See here:

phy1-ap0  ESSID: "Hera5"
          Access Point: REDACTED
          Mode: Master  Channel: 42 (6.160 GHz)  HT Mode: NOHT
          Center Channel 1: unknown 2: unknown
          Tx-Power: 23 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: -92 dBm
          Bit Rate: unknown
          Encryption: WPA3 SAE (CCMP)
          Type: nl80211  HW Mode(s): 802.11ac/ax/n
          Hardware: embedded [MediaTek MT7986]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy1

Many thanks !

Cheers, blinton

It is only ch 36 amd ch100, both take DFS to start transmitting.

tc -s filter ?

shows nothing

root@AP-Rinzler:~# tc -s filter
root@AP-Rinzler:~#

Try to identify and repeat the command causing logged error.

sh -x /etc/init.d/bridger restart
sh -x /etc/init.d/bridger restart
+ START=19
+ USE_PROCD=1
+ PROG=/usr/sbin/bridger

Not related to the issue at hand, but you're going to end up locked out when you run a sysupgrade at some point in the future. The firewall service will become re-enabled when you sysupgrade, and input is set to REJECT for your defaults in there. That will lock you out entirely.

Change the input rule to ACCEPT. And you can leave the firewall service enabled.

2 Likes

indeed, thanks a lot psherman !

Is it possible that WED and bridger are correctly running if I also get this:

dmesg | grep -i "wed"
[    9.913090] mt798x-wmac 18000000.wifi: attaching wed device 0 version 2
[    9.972192] platform 15010000.wed: MTK WED WO Firmware Version: DEV_000000, Build Time: 20221012175005
[    9.981521] platform 15010000.wed: MTK WED WO Chip ID 00 Region 3

service bridger status
running

dmesg | grep -i "offload" -> I get nothing as output, also with iperf3 -c (is this ok?)

Thanks and Cheers, blinton

I tested locally now with 160 MHz (116 center channel) and 80 MHz (60 center channel) with iperf3 to a local PC (two 2.5 GbE switches in between, one Mikrotik, one Ubiquiti) from my Macbook Air 15 M4 ("brewed" iperf3).

Results (iper3 -c "ip-address" -P 16):

  • 160 MHz (-R, download): 1.67 GBit/s
  • 160 MHz (upload): 1.48 Gbit/s
  • 80 MHz (-R, download): 969 Mbit/s
  • 80 MHz (upload): 900 MBit/s

To be noted, at 160 MHz, a 2400 MBit/s link is established to the airbook
at 80 MHz, a 1200 MBit/s link is established.

Now the maybe irritating iperf3 tests to eg speedtest.iway.ch:

  • 160 MHz (-R, download): 550 MBit/s
  • 160 MHz (upload): 230 MBit/s
  • 80 MHz (-R, download): 550 Mbit/s
  • 80 MHz (upload): 480 MBit/s
    (80 MHz, with speedtest.net - if I choose the right server, I get up to 800 MBit/s download and > 700 MBit/s upload)

"Analysis"
-> AI tells, that with 160 MHz there are more "hickups" with iperf3 over internet due to higher latencies compared to local network, which may explain the dramatic degradation of internet speed.
-> However, when I check interference (e.g. wifi analysis or wifi explorer), at 160 MHz there is almost no congestion, there is a 80 MHz band with -92 dBm overlapping with my 160 MHz from a neighbour. Not sure about radar signal, if this is shown in openwrt.

Fyi, I have 1 GBit/s symmetric internet, FTTH, I limited with SQM to 900'000 kbit/s download and 850'000 kbit/s upload for wan and lan (lan values are "flipped"), so a quick test on the PC (two switches to wan router, just fyi)

  • with SQM I get iperf3 download 851 MBit/s / upload 760 MBit/s
  • without SQM iper3 (above not tested with this settings!): download 945 MBit/s, upload 860 MBit/s

Do I really have an issue with WED / bridger or are these results expected ?
Maybe other users have similar observations, and it may help to understand (?).

Thanks a lot in advance !

Cheers, blinton