Hi guys, on 25.12.5 Comfast is going under reboot loop, if Wirelles 2.4 is enabled, from my tests this is due to wireless.radio0.txpower>=15 if value is set to 10 Wireless will work and Router will not enter on a loop. To bring back Device on loop go to MediaTek U BOOT Recovery Mode and Upload sysupgrade.bin file
opened 01:28AM - 07 Aug 26 UTC
target/mediatek
bug
Official Image
SNAPSHOT
Supported Device
### Describe the bug
I came across [this forum post](https://forum.openwrt.org/… t/setting-up-comfast-wr632ax/) which made me realize that my issue was not isolated, and as such am opening this ticket.
I have purchased a number of Comfast WR632AX devices for my family and in-laws through AliExpress over the last 1.5 years or so. I have 2 devices where enabling the 2.4GHz radio causes a Kernel crash (timing ranging as early as "Enable" is pressed in Luci, or up to 24 hours later).
I have experienced this using both stock uboot as well as uboot-mod (having tested that, I have reverted to standard uboot).
When the system goes down, it is due to a Kernel crash. Below I am pasting 2 examples from /sys/fs/pstore/. The point of failure sometimes is different, but they are consistently related to 2.4GHz radio. If 2.4GHz is disabled (keeping 5GHz enabled), the device stays up indefinitely. This to me indicates a bug in the wifi drivers are triggering a kernel crash at random points:
```
<1>[ 232.438884] Unable to handle kernel paging request at virtual address fffffd8000004908
<1>[ 232.446836] Mem abort info:
<1>[ 232.449619] ESR = 0x0000000096000004
<1>[ 232.453385] EC = 0x25: DABT (current EL), IL = 32 bits
<1>[ 232.458695] SET = 0, FnV = 0
<1>[ 232.461753] EA = 0, S1PTW = 0
<1>[ 232.464891] FSC = 0x04: level 0 translation fault
<1>[ 232.469763] Data abort info:
<1>[ 232.472654] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
<1>[ 232.478127] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
<1>[ 232.483188] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
<1>[ 232.488498] [fffffd8000004908] address between user and kernel address ranges
<0>[ 232.495636] Internal error: Oops: 0000000096000004 [#1] SMP
<7>[ 232.501284] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_inet wireguard pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft
_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table
nf_conntrack_netlink nf_conntrack mt7915e(O) mt76_connac_lib(O) mt76(O) mac80211(O) libchacha20poly1305 cfg80211(O) slhc pwm_gpio nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_lo
g_syslog nf_defrag_ipv6 nf_defrag_ipv4 libpoly1305 libcurve25519 libchacha compat(O) crypto_safexcel pwm_fan ip6_udp_tunnel udp_tunnel sha1 seqiv md5 libmd5 geniv des_generic
libdes authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug(O) usbcore usb_common
<7>[ 232.572696] CPU: 0 UID: 101 PID: 1724 Comm: hostapd Tainted: G O #0 NONE
<7>[ 232.581643] Tainted: [O]=OOT_MODULE
<7>[ 232.585118] Hardware name: COMFAST CF-WR632AX
<7>[ 232.591978] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
<7>[ 232.598927] pc : kvfree_call_rcu+0x5c/0x400
<7>[ 232.603104] lr : kvfree_call_rcu+0x20/0x400
<7>[ 232.607276] sp : ffffffc08179b890
<7>[ 232.610579] x29: ffffffc08179b890 x28: 000000000000000f x27: 000000000000030b
<7>[ 232.617706] x26: 000000000000000e x25: 000000000000010a x24: ffffff80003fd680
<7>[ 232.624832] x23: ffffff80003fdd08 x22: 000000000000000e x21: ffffff80003fdd00
<7>[ 232.631959] x20: ffffffc08179baa0 x19: ffffffc08179bde8 x18: ffffffc08179bde8
<7>[ 232.639087] x17: ffffff8003bc4540 x16: ffffff8003bc4cc0 x15: 0000000000000000
<7>[ 232.646213] x14: ffffff80037d3600 x13: 0000000000000000 x12: ffffff8003b91840
<7>[ 232.653340] x11: 0000000000000000 x10: ffffff80038c0780 x9 : ffffff80038ace40
<7>[ 232.660467] x8 : ffffff80038a00c0 x7 : ffffff8003825c00 x6 : 0000000000000000
<7>[ 232.667593] x5 : 000000000000030b x4 : 0000000000000000 x3 : ffffff8001185f50
<7>[ 232.674719] x2 : fffffd80000048ff x1 : 00000000000000f5 x0 : fffffd8000004900
<7>[ 232.681846] Call trace:
<7>[ 232.684281] kvfree_call_rcu+0x5c/0x400 (P)
<7>[ 232.688456] mas_wr_node_store+0x2ec/0x380
<7>[ 232.692547] mas_wr_store_entry+0x27c/0x3c0
<7>[ 232.696723] mas_store_prealloc+0x178/0x398
<7>[ 232.700899] vma_complete+0x26c/0x2c8
<7>[ 232.704556] __split_vma+0x228/0x2a4
<7>[ 232.708125] vms_gather_munmap_vmas+0xd8/0x2c4
<7>[ 232.712561] do_vmi_align_munmap+0xb4/0x154
<7>[ 232.716737] do_vmi_munmap+0x84/0xe8
<7>[ 232.720305] __vm_munmap+0x98/0x11c
<7>[ 232.723788] __arm64_sys_munmap+0x1c/0x28
<7>[ 232.727787] invoke_syscall.constprop.0+0x48/0xb0
<7>[ 232.732484] do_el0_svc+0x3c/0xb0
<7>[ 232.735792] el0_svc+0x18/0x60
<7>[ 232.738841] el0t_64_sync_handler+0x98/0xdc
<7>[ 232.743014] el0t_64_sync+0x158/0x15c
<0>[ 232.746672] Code: 3940cc01 7103d43f 54000081 f9400400 (f9400401)
<4>[ 232.752751] ---[ end trace 0000000000000000 ]---
```
And here is another that just happend after about 5 minutes of 2.4GHz being enabled:
```
<1>[ 18.901190] Unable to handle kernel paging request at virtual address fffffd80024d2d20
<1>[ 18.909111] Mem abort info:
<1>[ 18.911919] ESR = 0x0000000096000004
<1>[ 18.915657] EC = 0x25: DABT (current EL), IL = 32 bits
<1>[ 18.920959] SET = 0, FnV = 0
<1>[ 18.924024] EA = 0, S1PTW = 0
<1>[ 18.927157] FSC = 0x04: level 0 translation fault
<1>[ 18.932030] Data abort info:
<1>[ 18.934899] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
<1>[ 18.940370] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
<1>[ 18.945416] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
<1>[ 18.950716] [fffffd80024d2d20] address between user and kernel address ranges
<0>[ 18.957853] Internal error: Oops: 0000000096000004 [#1] SMP
<7>[ 18.963501] Modules linked in: pppoe ppp_async nft_flow_offload nft_fib_inet nf_flow_table_inet nf_flow_table wireguard pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4
nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat
nf_conntrack_netlink nf_conntrack mt7915e(O) mt76_connac_lib(O) mt76(O) mac80211(O) libchacha20poly1305 cfg80211(O) slhc rtc_pcf8563 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf
_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libpoly1305 libcurve25519 libchacha compat(O) crypto_safexcel ip6_udp_tunnel udp_tunnel sha1 seqiv md5 libmd5 geniv des_generic libde
s authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug(O) usbcore usb_common air_en8811h
<7>[ 19.035522] CPU: 1 UID: 0 PID: 920 Comm: napi/phy0-0 Tainted: G O 6.18.41 #0 NONE
<7>[ 19.044556] Tainted: [O]=OOT_MODULE
<7>[ 19.048032] Hardware name: COMFAST CF-WR632AX (DT)
<7>[ 19.052810] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
<7>[ 19.059759] pc : napi_threaded_poll+0x20/0x7c
<7>[ 19.064110] lr : napi_threaded_poll+0x38/0x7c
<7>[ 19.068456] sp : ffffffc081443e40
<7>[ 19.071758] x29: ffffffc081443e40 x28: 0000000000000000 x27: 0000000000000000
<7>[ 19.078885] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff80024d2d10
<7>[ 19.086011] x23: ffffffc08075ddc8 x22: ffffff8000b60e40 x21: 0000000000000001
<7>[ 19.093138] x20: ffffff8000b60e40 x19: fffffd80024d2d10 x18: 0000000000000000
<7>[ 19.100264] x17: ffffffbf9f1e8000 x16: ffffffc080ec0000 x15: 0672000000000000
<7>[ 19.107392] x14: 00000000000002f2 x13: 00000000000002f2 x12: 000000000005d97b
<7>[ 19.114519] x11: 00000000000000c0 x10: 00000000000008f0 x9 : ffffffc081443d80
<7>[ 19.121646] x8 : ffffff8000b61790 x7 : 0000000000000001 x6 : 0000000000000000
<7>[ 19.128773] x5 : 0000000168501bad x4 : 0000000000000002 x3 : ffffffbf9f1e8000
<7>[ 19.135899] x2 : 0000000000000000 x1 : 0000000000208040 x0 : 0000000000000000
<7>[ 19.143026] Call trace:
<7>[ 19.145461] napi_threaded_poll+0x20/0x7c (P)
<7>[ 19.149811] kthread+0xe4/0x1ac
<7>[ 19.152948] ret_from_fork+0x10/0x20
<0>[ 19.156520] Code: d5384114 f90013f5 52800035 14000004 (f9400a61)
<4>[ 19.162600] ---[ end trace 0000000000000000 ]---
<3>[ 19.171307] pstore: backend (ramoops) writing error (-28)
<0>[ 19.176698] Kernel panic - not syncing: Oops: Fatal exception
<2>[ 19.182432] SMP: stopping secondary CPUs
<0>[ 19.186348] Kernel Offset: disabled
<0>[ 19.189824] CPU features: 0x000000,00000000,00000001,0400400b
<0>[ 19.195557] Memory Limit: none
```
I have reproduced this both with firmware-selector builds, as well as local compiled builds (containing a fix for nmbm in newer devices).
Device vintage doesn't appear to be the root cause of this issue as 1 of the 2 devices is the "old FIB version" while the 2nd is the newer FIB version as explained in [this PR](https://github.com/openwrt/openwrt/pull/24552).
### OpenWrt version
r35650-5ecd3173d6
### OpenWrt release
SNAPSHOT
### OpenWrt target/subtarget
mediatek/filogic
### Device
COMFAST CF-WR632AX
### Image kind
Official downloaded image
### Steps to reproduce
If the device is impacted (in my case it is not 100% of devices), setup 2.4GHz Wifi and enable. Time to crash has been observed as anytime between immediately upon enabling up to 24 hours later.
### Actual behaviour
Device experiences Kernel crash, and in some cases could result in bootloop requiring recovery to be used.
### Expected behaviour
Enablin 2.4Ghz does not cause Kernel crash.
### Additional info
/etc/config/wireless:
```
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc/18000000.wifi'
option band '2g'
option channel '11'
option htmode 'HE20'
option country 'US'
option cell_density '0'
option disabled '1'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'BROKEN-DO-NOT-ENABLE'
option encryption 'psk2+ccmp'
option dtim_period '1'
option max_inactivity '15'
option disassoc_low_ack '0'
option key 'XXXXXXXX'
option ieee80211r '1'
option mobility_domain '1111'
option reassociation_deadline '20000'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option pmk_r1_push '1'
option ieee80211k '1'
option time_advertisement '2'
option time_zone 'EST5EDT,M3.2.0,M11.1.0'
option wnm_sleep_mode '1'
option bss_transition '1'
option nasid 'lowercase MAC without colons'
option disabled '1'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc/18000000.wifi+1'
option band '5g'
option channel '36'
option htmode 'HE80'
option country 'US'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'Works'
option encryption 'psk2+ccmp'
option dtim_period '1'
option max_inactivity '15'
option disassoc_low_ack '0'
option key 'XXXXXXXXX'
option ieee80211r '1'
option mobility_domain '1111'
option reassociation_deadline '20000'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option pmk_r1_push '1'
option ieee80211k '1'
option time_advertisement '2'
option time_zone 'EST5EDT,M3.2.0,M11.1.0'
option wnm_sleep_mode '1'
option bss_transition '1'
option nasid 'lowercase MAC without colons'
```
### Diffconfig
```text
```
### Terms
- [x] I am reporting an issue for OpenWrt, not an unsupported fork.
try a snapshot.
searching the forum for WR632AX would have gotten you some additional (and interesting/related) threads, but I guess you weren't able to locate the search function
