Same as me. Waiting for Felix to figure out what's going on.
Maybe you could all post your wireless config files to see if there are any differences that could help recreate and debug the issue?
That's a very good approach. I tried, even asked AI, need to make git bisect, on which I don't have time now.
Got a kernel warning on one of my units. Same firmware on both but error only on one??!!
[ 33.716381] ------------[ cut here ]------------
[ 33.721017] WARNING: CPU: 3 PID: 1142 at mt7996_mac_reset_sta_iter+0x74c/0x840 [mt7996e]
[ 33.729150] Modules linked in: nft_fib_inet nf_flow_table_inet nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack nct7802 mt7996e(O) mt76_connac_lib(O) mt76(O) mac80211(O) iptable_mangle iptable_filter ipt_REJECT ip_tables cfg80211(O) xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG x_tables tcp_bbr regmap_i2c nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 compat(O) br_netfilter i2c_mt7621 i2c_dev sha512 libsha512 seqiv sha3_generic jitterentropy_rng drbg hmac geniv cmac leds_gpio gpio_button_hotplug(O) realtek hwmon i2c_core
[ 33.799370] CPU: 3 UID: 0 PID: 1142 Comm: napi/phy0-0 Tainted: G O 6.18.34 #0 NONE
[ 33.808508] Tainted: [O]=OOT_MODULE
[ 33.811994] Hardware name: Gemtek W1700K (OpenWrt U-Boot layout) (DT)
[ 33.818428] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 33.825389] pc : mt7996_mac_reset_sta_iter+0x74c/0x840 [mt7996e]
[ 33.831421] lr : mt7996_mac_reset_sta_iter+0x69c/0x840 [mt7996e]
[ 33.837437] sp : ffffffc08139bad0
[ 33.840744] x29: ffffffc08139bb10 x28: 0000000000000005 x27: ffffffc08139baf0
[ 33.847888] x26: ffffff8011453040 x25: 0000000040000000 x24: 000000000000000c
[ 33.855023] x23: 0000000000000006 x22: 0000000000000000 x21: ffffff8011453040
[ 33.862159] x20: ffffff8006282060 x19: 0000000041000000 x18: 00000007d8eabdb8
[ 33.869294] x17: 0000000000000000 x16: 0000000000000000 x15: 0267ff4c8b6fb254
[ 33.876430] x14: 00000000000002a4 x13: 0000000000000000 x12: ffffffc0808fa088
[ 33.883566] x11: ffffff80062860e8 x10: 0000000000000000 x9 : 0000000000000040
[ 33.890701] x8 : ffffff80062860e8 x7 : 000000000000000c x6 : 0000000000000000
[ 33.897836] x5 : ffffff8005c0a480 x4 : ffffff8005c0a4b0 x3 : 0000000000000000
[ 33.904971] x2 : ffffff8001b68e40 x1 : ffffff8011453040 x0 : 0000000000007fff
[ 33.912108] Call trace:
[ 33.914547] mt7996_mac_reset_sta_iter+0x74c/0x840 [mt7996e] (P)
[ 33.920572] mt7996_queue_rx_skb+0x9e8/0xe54 [mt7996e]
[ 33.925727] mt76_npu_rx_poll+0x288/0x3bc [mt76]
[ 33.930362] __napi_poll+0x34/0x180
[ 33.933852] napi_threaded_poll_loop+0xa4/0x148
[ 33.938384] napi_threaded_poll+0x84/0x98
[ 33.942394] kthread+0xf8/0x1c0
[ 33.945536] ret_from_fork+0x10/0x20
[ 33.949114] ---[ end trace 0000000000000000 ]---
full dmesg below:
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 6.18.34 (runner@runnervmfoai2) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 15.2.0 r0-750e1ea) 15.2.0, GNU ld (GNU Binutils) 2.46.0.20260210) #0 SMP Wed Jun 3 06:28:38 2026
[ 0.000000] Machine model: Gemtek W1700K (OpenWrt U-Boot layout)
[ 0.000000] earlycon: ns16550 at MMIO32 0x000000001fbf0000 (options '115200n8')
[ 0.000000] printk: legacy bootconsole [ns16550] enabled
[ 0.000000] OF: reserved mem: 0x0000000080000000..0x00000000801fffff (2048 KiB) nomap non-reusable atf@80000000
[ 0.000000] OF: reserved mem: 0x0000000084000000..0x00000000840fffff (1024 KiB) nomap non-reusable npu-binary@84000000
[ 0.000000] OF: reserved mem: 0x0000000087000000..0x0000000088ffffff (32768 KiB) nomap non-reusable qdma0-buf@87000000
[ 0.000000] OF: reserved mem: 0x0000000089000000..0x0000000089ffffff (16384 KiB) nomap non-reusable qdma1-buf@89000000
[ 0.000000] OF: reserved mem: 0x000000008a000000..0x000000008cbfffff (45056 KiB) nomap non-reusable npu-pkt@8a000000
[ 0.000000] OF: reserved mem: 0x000000008cc00000..0x0000000090bfffff (65536 KiB) nomap non-reusable npu-txpkt@8cc00000
[ 0.000000] OF: reserved mem: 0x0000000090c00000..0x0000000090c067ff (26 KiB) nomap non-reusable npu-txbufid@90c00000
[ 0.000000] OF: reserved mem: 0x0000000090c06800..0x0000000090e067ff (2048 KiB) nomap non-reusable npu-ba@90c06800
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000080000000-0x00000000ffffffff]
[ 0.000000] DMA32 empty
[ 0.000000] Normal empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000080000000-0x00000000801fffff]
[ 0.000000] node 0: [mem 0x0000000080200000-0x0000000083ffffff]
[ 0.000000] node 0: [mem 0x0000000084000000-0x00000000840fffff]
[ 0.000000] node 0: [mem 0x0000000084100000-0x0000000086ffffff]
[ 0.000000] node 0: [mem 0x0000000087000000-0x0000000090e05fff]
[ 0.000000] node 0: [mem 0x0000000090e07000-0x00000000ffffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x00000000ffffffff]
[ 0.000000] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.1 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.2
[ 0.000000] percpu: Embedded 20 pages/cpu s43352 r8192 d30376 u81920
[ 0.000000] pcpu-alloc: s43352 r8192 d30376 u81920 alloc=20*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] CPU features: detected: GICv3 CPU interface
[ 0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[ 0.000000] alternatives: applying boot alternatives
[ 0.000000] Kernel command line: console=ttyS0,115200 earlycon ubi.block=0,fit root=/dev/fit0 rootwait
[ 0.000000] printk: log buffer data + meta data: 131072 + 458752 = 589824 bytes
[ 0.000000] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 2MB
[ 0.000000] software IO TLB: area num 4.
[ 0.000000] software IO TLB: mapped [mem 0x00000000ff6cb000-0x00000000ff8cb000] (2MB)
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 524287
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[ 0.000000] GICv3: 256 SPIs implemented
[ 0.000000] GICv3: 0 Extended SPIs implemented
[ 0.000000] Root IRQ handler: gic_handle_irq
[ 0.000000] GICv3: GICv3 features: 16 PPIs
[ 0.000000] GICv3: GICD_CTLR.DS=0, SCR_EL3.FIQ=0
[ 0.000000] GICv3: CPU0: found redistributor 0 region 0:0x0000000009080000
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] arch_timer: cp15 timer running at 25.00MHz (phys).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x5c40939b5, max_idle_ns: 440795202646 ns
[ 0.000000] sched_clock: 56 bits at 25MHz, resolution 40ns, wraps every 4398046511100ns
[ 0.008957] Calibrating delay loop (skipped), value calculated using timer frequency.. 50.00 BogoMIPS (lpj=250000)
[ 0.020334] pid_max: default: 32768 minimum: 301
[ 0.028249] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.036383] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.051820] rcu: Hierarchical SRCU implementation.
[ 0.057116] rcu: Max phase no-delay instances is 1000.
[ 0.063054] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[ 0.072256] smp: Bringing up secondary CPUs ...
[ 0.077658] Detected VIPT I-cache on CPU1
[ 0.077760] GICv3: CPU1: found redistributor 1 region 0:0x00000000090a0000
[ 0.077795] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[ 0.078324] Detected VIPT I-cache on CPU2
[ 0.078422] GICv3: CPU2: found redistributor 2 region 0:0x00000000090c0000
[ 0.078449] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[ 0.078966] Detected VIPT I-cache on CPU3
[ 0.079062] GICv3: CPU3: found redistributor 3 region 0:0x00000000090e0000
[ 0.079089] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[ 0.079177] smp: Brought up 1 node, 4 CPUs
[ 0.140997] SMP: Total of 4 processors activated.
[ 0.146152] CPU: All CPU(s) started at EL2
[ 0.150645] CPU features: detected: 32-bit EL0 Support
[ 0.156284] CPU features: detected: CRC32 instructions
[ 0.161965] alternatives: applying system-wide alternatives
[ 0.168234] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.178007] Memory: 1872464K/2097148K available (9088K kernel code, 826K rwdata, 2508K rodata, 960K init, 288K bss, 221016K reserved, 0K cma-reserved)
[ 0.197350] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.208207] posixtimers hash table entries: 2048 (order: 3, 32768 bytes, linear)
[ 0.216389] futex hash table entries: 1024 (65536 bytes on 1 NUMA nodes, total 64 KiB, linear).
[ 0.226038] 29296 pages in range for non-PLT usage
[ 0.226044] 520816 pages in range for PLT usage
[ 0.232926] pinctrl core: initialized pinctrl subsystem
[ 0.245087] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.252043] DMA: preallocated 256 KiB GFP_KERNEL pool for atomic allocations
[ 0.259826] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.268384] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.277323] thermal_sys: Registered thermal governor 'step_wise'
[ 0.277420] ASID allocator initialised with 65536 entries
[ 0.292571] /soc/interrupt-controller@9000000: Fixed dependency cycle(s) with /soc/interrupt-controller@9000000
[ 0.306320] /soc/pcie@1fc00000: Fixed dependency cycle(s) with /soc/pcie@1fc00000/interrupt-controller
[ 0.316780] /soc/pcie@1fc40000: Fixed dependency cycle(s) with /soc/pcie@1fc40000/interrupt-controller
[ 0.342994] Advanced Linux Sound Architecture Driver Initialized.
[ 0.350800] clocksource: Switched to clocksource arch_sys_counter
[ 0.360429] NET: Registered PF_INET protocol family
[ 0.365948] IP idents hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.376489] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear)
[ 0.385910] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.394436] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear)
[ 0.403243] TCP bind hash table entries: 16384 (order: 7, 524288 bytes, linear)
[ 0.411780] TCP: Hash tables configured (established 16384 bind 16384)
[ 0.419319] MPTCP token hash table entries: 2048 (order: 4, 49152 bytes, linear)
[ 0.427678] UDP hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.435121] UDP-Lite hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.443462] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.449707] PCI: CLS 0 bytes, default 64
[ 0.455533] workingset: timestamp_bits=46 max_order=19 bucket_order=0
[ 0.468744] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.475173] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.492352] airoha-cpu-pmdomain 1fa20000.cpufreq: ATF SMC not available, using direct PLL programming
[ 0.501629] mtk-pcie-gen3 1fc00000.pcie: host bridge /soc/pcie@1fc00000 ranges:
[ 0.502550] airoha-cpu-pmdomain 1fa20000.cpufreq: CPU frequency: 1200 MHz
[ 0.510545] mtk-pcie-gen3 1fc00000.pcie: MEM 0x0020000000..0x0023ffffff -> 0x0020000000
[ 0.518960] Serial: 8250/16550 driver, 5 ports, IRQ sharing enabled
[ 0.535390] printk: legacy console [ttyS0] disabled
[ 0.540980] mtk-pcie-gen3 1fc40000.pcie: host bridge /soc/pcie@1fc40000 ranges:
[ 0.549066] mtk-pcie-gen3 1fc40000.pcie: MEM 0x0028000000..0x002bffffff -> 0x0028000000
[ 0.558379] 1fbf0000.serial: ttyS0 at MMIO 0x1fbf0000 (irq = 15, base_baud = 115200) is a 16550
[ 0.568000] printk: legacy console [ttyS0] enabled
[ 0.578054] printk: legacy bootconsole [ns16550] disabled
[ 0.590533] 1fbf0300.serial: ttyS1 at MMIO 0x1fbf0300 (irq = 16, base_baud = 460800) is a Airoha 16550
[ 0.600840] 1fbe1000.serial: ttyS2 at MMIO 0x1fbe1000 (irq = 17, base_baud = 460800) is a Airoha 16550
[ 0.611196] airoha-trng 1faa1000.rng: scu regmap found, controlling clocks manually
[ 0.618875] airoha-trng 1faa1000.rng: TRNG mode: DRBG
[ 0.624004] airoha-trng 1faa1000.rng: TRNG mode setup [0x1faa1804]: old=0x00000002, new=0x00000002 (setting DRBG mode)
[ 0.630960] mtk-pcie-gen3 1fc00000.pcie: x2 mode enabled
[ 0.634734] airoha-trng 1faa1000.rng: TRNG init [0x1faa1804]: old=0x00000002, new=0x80000002 (enabling RNG and OSC)
[ 0.640020] mtk-pcie-gen3 1fc00000.pcie: x2 mode: sister MAC mapped
[ 0.650448] airoha-trng 1faa1000.rng: SCU init [offset 0x1e4]: old=0xffffffff, new=0xffffffff (enabling BUS clock)
[ 0.667072] airoha-trng 1faa1000.rng: SCU init [offset 0x1ec]: old=0xffffffff, new=0xffffffff (enabling PER1 clock)
[ 0.677518] airoha-trng 1faa1000.rng: SCU init [offset 0x200]: old=0xffffffff, new=0xffffffff (enabling PER2 clock)
[ 0.688790] random: crng init done
[ 0.694251] spi-nand spi0.0: Winbond SPI NAND was found.
[ 0.699575] spi-nand spi0.0: 512 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[ 0.708047] 4 fixed-partitions partitions found on MTD device spi0.0
[ 0.714655] Creating 4 MTD partitions on "spi0.0":
[ 0.719456] 0x000000000000-0x000000600000 : "vendor"
[ 0.737063] 0x000000600000-0x000000700000 : "chainloader"
[ 0.745186] 0x000000700000-0x00001be00000 : "ubi"
[ 1.011159] mtk-pcie-gen3 1fc40000.pcie: PCI host bridge to bus 0002:00
[ 1.017793] pci_bus 0002:00: root bus resource [bus 00-ff]
[ 1.023303] pci_bus 0002:00: root bus resource [mem 0x28000000-0x2bffffff]
[ 1.030212] pci 0002:00:00.0: [14c3:6899] type 01 class 0x060400 PCIe Root Port
[ 1.037543] pci 0002:00:00.0: BAR 0 [mem 0x00000000-0x00007fff 64bit]
[ 1.043991] pci 0002:00:00.0: PCI bridge to [bus 00]
[ 1.048959] pci 0002:00:00.0: bridge window [io 0x0000-0x0fff]
[ 1.055058] pci 0002:00:00.0: bridge window [mem 0x00000000-0x000fffff]
[ 1.061862] pci 0002:00:00.0: bridge window [mem 0x00000000-0x000fffff 64bit pref]
[ 1.069647] pci 0002:00:00.0: PME# supported from D0 D3hot D3cold
[ 1.077084] pci 0002:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 1.085274] pci 0002:01:00.0: [14c3:7991] type 00 class 0x028000 PCIe Endpoint
[ 1.092565] pci 0002:01:00.0: BAR 0 [mem 0x00000000-0x001fffff 64bit pref]
[ 1.099447] pci 0002:01:00.0: BAR 2 [mem 0x00000000-0x00007fff 64bit]
[ 1.105990] pci 0002:01:00.0: PME# supported from D0 D3hot D3cold
[ 1.112142] pci 0002:01:00.0: 4.000 Gb/s available PCIe bandwidth, limited by 5.0 GT/s PCIe x1 link at 0002:00:00.0 (capable of 15.752 Gb/s with 8.0 GT/s PCIe x2 link)
[ 1.140823] pci 0002:01:00.0: ASPM: default states L0s L1
[ 1.146268] pci_bus 0002:01: busn_res: [bus 01-ff] end is updated to 01
[ 1.152915] pci 0002:00:00.0: bridge window [mem 0x28000000-0x281fffff 64bit pref]: assigned
[ 1.161361] pci 0002:00:00.0: bridge window [mem 0x28200000-0x282fffff]: assigned
[ 1.168845] pci 0002:00:00.0: BAR 0 [mem 0x28300000-0x28307fff 64bit]: assigned
[ 1.176168] pci 0002:01:00.0: BAR 0 [mem 0x28000000-0x281fffff 64bit pref]: assigned
[ 1.183928] pci 0002:01:00.0: BAR 2 [mem 0x28200000-0x28207fff 64bit]: assigned
[ 1.191254] pci 0002:00:00.0: PCI bridge to [bus 01]
[ 1.196216] pci 0002:00:00.0: bridge window [mem 0x28200000-0x282fffff]
[ 1.203008] pci 0002:00:00.0: bridge window [mem 0x28000000-0x281fffff 64bit pref]
[ 1.210757] pci_bus 0002:00: resource 4 [mem 0x28000000-0x2bffffff]
[ 1.217032] pci_bus 0002:01: resource 1 [mem 0x28200000-0x282fffff]
[ 1.223304] pci_bus 0002:01: resource 2 [mem 0x28000000-0x281fffff 64bit pref]
[ 1.230713] pcieport 0002:00:00.0: enabling device (0000 -> 0002)
[ 1.238354] pcieport 0002:00:00.0: PME: Signaling with IRQ 21
[ 1.244481] pcieport 0002:00:00.0: AER: enabled with IRQ 21
[ 1.640051] ubi0: attaching mtd2
[ 3.130806] mtk-pcie-gen3 1fc00000.pcie: x2: init complete
[ 3.136578] mtk-pcie-gen3 1fc00000.pcie: PCI host bridge to bus 0000:00
[ 3.143228] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 3.148716] pci_bus 0000:00: root bus resource [mem 0x20000000-0x23ffffff]
[ 3.155650] pci 0000:00:00.0: [14c3:6899] type 01 class 0x060400 PCIe Root Port
[ 3.162977] pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x00007fff 64bit]
[ 3.169421] pci 0000:00:00.0: PCI bridge to [bus 00]
[ 3.174395] pci 0000:00:00.0: bridge window [io 0x0000-0x0fff]
[ 3.180486] pci 0000:00:00.0: bridge window [mem 0x00000000-0x000fffff]
[ 3.187286] pci 0000:00:00.0: bridge window [mem 0x00000000-0x000fffff 64bit pref]
[ 3.195070] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[ 3.202577] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 3.210756] pci 0000:01:00.0: [14c3:7990] type 00 class 0x028000 PCIe Endpoint
[ 3.218051] pci 0000:01:00.0: BAR 0 [mem 0x00000000-0x001fffff 64bit pref]
[ 3.224940] pci 0000:01:00.0: BAR 2 [mem 0x00000000-0x00007fff 64bit]
[ 3.231481] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[ 3.237625] pci 0000:01:00.0: 8.000 Gb/s available PCIe bandwidth, limited by 5.0 GT/s PCIe x2 link at 0000:00:00.0 (capable of 15.752 Gb/s with 8.0 GT/s PCIe x2 link)
[ 3.270823] pci 0000:01:00.0: ASPM: default states L0s L1
[ 3.276270] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 3.282921] pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff 64bit pref]: assigned
[ 3.291370] pci 0000:00:00.0: bridge window [mem 0x20200000-0x202fffff]: assigned
[ 3.298854] pci 0000:00:00.0: BAR 0 [mem 0x20300000-0x20307fff 64bit]: assigned
[ 3.306177] pci 0000:01:00.0: BAR 0 [mem 0x20000000-0x201fffff 64bit pref]: assigned
[ 3.313937] pci 0000:01:00.0: BAR 2 [mem 0x20200000-0x20207fff 64bit]: assigned
[ 3.321262] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 3.326225] pci 0000:00:00.0: bridge window [mem 0x20200000-0x202fffff]
[ 3.333017] pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff 64bit pref]
[ 3.340766] pci_bus 0000:00: resource 4 [mem 0x20000000-0x23ffffff]
[ 3.347035] pci_bus 0000:01: resource 1 [mem 0x20200000-0x202fffff]
[ 3.353302] pci_bus 0000:01: resource 2 [mem 0x20000000-0x201fffff 64bit pref]
[ 3.360718] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[ 3.360799] ubi0: scanning is finished
[ 3.368329] pcieport 0000:00:00.0: PME: Signaling with IRQ 24
[ 3.376700] pcieport 0000:00:00.0: AER: enabled with IRQ 24
[ 3.431712] ubi0: attached mtd2 (name "ubi", size 439 MiB)
[ 3.437223] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 3.444117] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 3.450912] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 3.457871] ubi0: good PEBs: 3512, bad PEBs: 0, corrupted PEBs: 0
[ 3.463971] ubi0: user volume: 6, internal volumes: 1, max. volumes count: 128
[ 3.471193] ubi0: max/mean erase counter: 23/14, WL threshold: 4096, image sequence number: 1111385447
[ 3.480493] ubi0: available PEBs: 0, total reserved PEBs: 3512, PEBs reserved for bad PEB handling: 80
[ 3.489816] ubi0: background thread "ubi_bgt0d" started, PID 238
[ 3.490713] block ubiblock0_4: created from ubi0:4(fit)
[ 3.501239] 0x00001be00000-0x000020000000 : "reserved_bmt"
[ 3.801849] SMCCC: SOC_ID: ARCH_SOC_ID not implemented, skipping ....
[ 3.808819] NET: Registered PF_INET6 protocol family
[ 3.815058] Segment Routing with IPv6
[ 3.818755] In-situ OAM (IOAM) with IPv6
[ 3.822757] NET: Registered PF_PACKET protocol family
[ 3.827863] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 3.840943] 8021q: 802.1Q VLAN Support v1.8
[ 3.857209] FIT: Detected U-Boot 2026.01-OpenWrt-r34154-35e3ed74fe
[ 3.863448] FIT: Selected configuration: "config-1" (OpenWrt gemtek_w1700k-ubi)
[ 3.870769] FIT: kernel sub-image 0x00001000..0x0058e694 "kernel-1" (ARM64 OpenWrt Linux-6.18.34)
[ 3.880632] FIT: flat_dt sub-image 0x0058f000..0x005948f5 "fdt-1" (ARM64 OpenWrt gemtek_w1700k-ubi device tree blob)
[ 3.892051] FIT: filesystem sub-image 0x00595000..0x011e8fff "rootfs-1" (ARM64 OpenWrt gemtek_w1700k-ubi rootfs)
[ 3.903362] block ubiblock0_4: mapped 1 uImage.FIT filesystem sub-image as /dev/fit0
[ 5.181074] mt7530-mmio 1fb58000.switch: configuring for fixed/internal link mode
[ 5.188703] mt7530-mmio 1fb58000.switch lan3 (uninitialized): PHY [mt7530-0:09] driver [Airoha AN7581 PHY] (irq=50)
[ 5.199223] mt7530-mmio 1fb58000.switch: Link is Up - 10Gbps/Full - flow control rx/tx
[ 5.202222] mt7530-mmio 1fb58000.switch lan4 (uninitialized): PHY [mt7530-0:0a] driver [Airoha AN7581 PHY] (irq=51)
[ 5.218929] airoha_eth 1fb50000.ethernet eth0: entered promiscuous mode
[ 5.225664] DSA: tree 0 setup
[ 5.230274] clk: Disabling unused clocks
[ 5.234250] PM: genpd: Disabling unused power domains
[ 5.239325] ALSA device list:
[ 5.242302] No soundcards found.
[ 5.245870] check access for rdinit=/init failed: -2, ignoring
[ 5.255420] VFS: Mounted root (squashfs filesystem) readonly on device 259:0.
[ 5.262975] Freeing unused kernel memory: 960K
[ 5.267515] Run /sbin/init as init process
[ 5.271638] with arguments:
[ 5.271643] /sbin/init
[ 5.271647] with environment:
[ 5.271650] HOME=/
[ 5.271654] TERM=linux
[ 5.594151] init: Console is alive
[ 5.597697] init: - watchdog -
[ 5.989731] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 6.021468] RTL8261N 10Gbps PHY mt7530-0:05: PMA low-power suspend disabled
[ 6.050440] RTL8261N 10Gbps PHY mt7530-0:08: PMA low-power suspend disabled
[ 6.072253] gpio_button_hotplug: loading out-of-tree module taints kernel.
[ 6.083371] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 6.095505] init: - preinit -
[ 6.330926] airoha-npu 1e900000.npu: NPU fw version: 0.1111
[ 6.467355] airoha_eth 1fb50000.ethernet wan: renamed from eth1
[ 6.475856] airoha_eth 1fb50000.ethernet lan2: renamed from eth2
[ 7.330825] airoha_eth 1fb50000.ethernet lan2: PHY [mt7530-0:05] driver [RTL8261N 10Gbps PHY] (irq=POLL)
[ 7.340433] airoha_eth 1fb50000.ethernet lan2: configuring for inband/usxgmii link mode
[ 11.712921] UBIFS (ubi0:5): Mounting in unauthenticated mode
[ 11.718700] UBIFS (ubi0:5): background thread "ubifs_bgt0_5" started, PID 934
[ 11.749375] UBIFS (ubi0:5): recovery needed
[ 11.849128] UBIFS (ubi0:5): recovery completed
[ 11.853663] UBIFS (ubi0:5): UBIFS: mounted UBI device 0, volume 5, name "rootfs_data"
[ 11.861500] UBIFS (ubi0:5): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 11.871419] UBIFS (ubi0:5): FS size: 400228352 bytes (381 MiB, 3152 LEBs), max 3167 LEBs, journal size 20062208 bytes (19 MiB, 158 LEBs)
[ 11.883684] UBIFS (ubi0:5): reserved for root: 4952683 bytes (4836 KiB)
[ 11.890293] UBIFS (ubi0:5): media format: w5/r0 (latest is w5/r0), UUID 49D3302C-2E12-4EEC-B170-6DE681B6ACC8, small LPT model
[ 11.905332] mount_root: switching to ubifs overlay
[ 11.916325] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[ 12.155236] procd: - early -
[ 12.158206] procd: - watchdog -
[ 12.736919] procd: - watchdog -
[ 12.741802] procd: - ubus -
[ 12.803658] procd: - init -
[ 13.207363] kmodloader: loading kernel modules from /etc/modules.d/*
[ 13.333968] i2c_dev: i2c /dev entries driver
[ 13.340128] i2c-mt7621 1fbf8000.i2c0: clock 100 kHz
[ 13.351006] Bridge firewalling registered
[ 13.355859] Loading modules backported from Linux version v6.18.26-0-g1fe060681
[ 13.363208] Backport generated by backports.git 6ecbb44
[ 13.385277] xt_time: kernel timezone is -0000
[ 13.487776] mt7996e_hif 0002:01:00.0: enabling device (0000 -> 0002)
[ 13.494423] mt7996e 0000:01:00.0: enabling device (0000 -> 0002)
[ 13.631365] mt7996e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20260311120419a
[ 13.631365]
[ 13.982137] mt7996e 0000:01:00.0: WM Firmware Version: ____000000, Build Time: 20260311120504
[ 14.022296] mt7996e 0000:01:00.0: DSP Firmware Version: ____000000, Build Time: 20260311120415
[ 14.103601] mt7996e 0000:01:00.0: WA Firmware Version: ____000000, Build Time: 20260311120325
[ 14.543916] mt7996e 0000:01:00.0: NPU version: 0.1111
[ 14.607660] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 17.881165] airoha_eth 1fb50000.ethernet lan2: PHY [mt7530-0:05] driver [RTL8261N 10Gbps PHY] (irq=POLL)
[ 17.895952] airoha_eth 1fb50000.ethernet lan2: configuring for inband/usxgmii link mode
[ 18.053778] br-lan: port 1(lan2) entered blocking state
[ 18.059046] br-lan: port 1(lan2) entered disabled state
[ 18.064408] airoha_eth 1fb50000.ethernet lan2: entered allmulticast mode
[ 18.071443] airoha_eth 1fb50000.ethernet lan2: entered promiscuous mode
[ 18.097210] mt7530-mmio 1fb58000.switch lan3: configuring for phy/internal link mode
[ 18.106305] br-lan: port 2(lan3) entered blocking state
[ 18.111640] br-lan: port 2(lan3) entered disabled state
[ 18.116920] mt7530-mmio 1fb58000.switch lan3: entered allmulticast mode
[ 18.123628] airoha_eth 1fb50000.ethernet eth0: entered allmulticast mode
[ 18.130681] mt7530-mmio 1fb58000.switch lan3: entered promiscuous mode
[ 18.140289] mt7530-mmio 1fb58000.switch lan4: configuring for phy/internal link mode
[ 18.149278] br-lan: port 3(lan4) entered blocking state
[ 18.154639] br-lan: port 3(lan4) entered disabled state
[ 18.159921] mt7530-mmio 1fb58000.switch lan4: entered allmulticast mode
[ 18.167113] mt7530-mmio 1fb58000.switch lan4: entered promiscuous mode
[ 18.580822] airoha_eth 1fb50000.ethernet wan: PHY [mt7530-0:08] driver [RTL8261N 10Gbps PHY] (irq=POLL)
[ 18.590349] airoha_eth 1fb50000.ethernet wan: configuring for inband/usxgmii link mode
[ 18.767374] br-lan: port 4(wan) entered blocking state
[ 18.772607] br-lan: port 4(wan) entered disabled state
[ 18.777806] airoha_eth 1fb50000.ethernet wan: entered allmulticast mode
[ 18.784711] airoha_eth 1fb50000.ethernet wan: entered promiscuous mode
[ 22.891790] airoha_eth 1fb50000.ethernet wan: Link is Up - 2.5Gbps/Full - flow control rx/tx
[ 22.900300] br-lan: port 4(wan) entered blocking state
[ 22.905464] br-lan: port 4(wan) entered forwarding state
[ 32.263229] br-lan: port 5(phy0.1-ap0) entered blocking state
[ 32.268995] br-lan: port 5(phy0.1-ap0) entered disabled state
[ 32.274825] mt7996e 0000:01:00.0 phy0.1-ap0: entered allmulticast mode
[ 32.281577] mt7996e 0000:01:00.0 phy0.1-ap0: entered promiscuous mode
[ 33.563539] br-lan: port 5(phy0.1-ap0) entered blocking state
[ 33.569308] br-lan: port 5(phy0.1-ap0) entered forwarding state
[ 33.716381] ------------[ cut here ]------------
[ 33.721017] WARNING: CPU: 3 PID: 1142 at mt7996_mac_reset_sta_iter+0x74c/0x840 [mt7996e]
[ 33.729150] Modules linked in: nft_fib_inet nf_flow_table_inet nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack nct7802 mt7996e(O) mt76_connac_lib(O) mt76(O) mac80211(O) iptable_mangle iptable_filter ipt_REJECT ip_tables cfg80211(O) xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG x_tables tcp_bbr regmap_i2c nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 compat(O) br_netfilter i2c_mt7621 i2c_dev sha512 libsha512 seqiv sha3_generic jitterentropy_rng drbg hmac geniv cmac leds_gpio gpio_button_hotplug(O) realtek hwmon i2c_core
[ 33.799370] CPU: 3 UID: 0 PID: 1142 Comm: napi/phy0-0 Tainted: G O 6.18.34 #0 NONE
[ 33.808508] Tainted: [O]=OOT_MODULE
[ 33.811994] Hardware name: Gemtek W1700K (OpenWrt U-Boot layout) (DT)
[ 33.818428] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 33.825389] pc : mt7996_mac_reset_sta_iter+0x74c/0x840 [mt7996e]
[ 33.831421] lr : mt7996_mac_reset_sta_iter+0x69c/0x840 [mt7996e]
[ 33.837437] sp : ffffffc08139bad0
[ 33.840744] x29: ffffffc08139bb10 x28: 0000000000000005 x27: ffffffc08139baf0
[ 33.847888] x26: ffffff8011453040 x25: 0000000040000000 x24: 000000000000000c
[ 33.855023] x23: 0000000000000006 x22: 0000000000000000 x21: ffffff8011453040
[ 33.862159] x20: ffffff8006282060 x19: 0000000041000000 x18: 00000007d8eabdb8
[ 33.869294] x17: 0000000000000000 x16: 0000000000000000 x15: 0267ff4c8b6fb254
[ 33.876430] x14: 00000000000002a4 x13: 0000000000000000 x12: ffffffc0808fa088
[ 33.883566] x11: ffffff80062860e8 x10: 0000000000000000 x9 : 0000000000000040
[ 33.890701] x8 : ffffff80062860e8 x7 : 000000000000000c x6 : 0000000000000000
[ 33.897836] x5 : ffffff8005c0a480 x4 : ffffff8005c0a4b0 x3 : 0000000000000000
[ 33.904971] x2 : ffffff8001b68e40 x1 : ffffff8011453040 x0 : 0000000000007fff
[ 33.912108] Call trace:
[ 33.914547] mt7996_mac_reset_sta_iter+0x74c/0x840 [mt7996e] (P)
[ 33.920572] mt7996_queue_rx_skb+0x9e8/0xe54 [mt7996e]
[ 33.925727] mt76_npu_rx_poll+0x288/0x3bc [mt76]
[ 33.930362] __napi_poll+0x34/0x180
[ 33.933852] napi_threaded_poll_loop+0xa4/0x148
[ 33.938384] napi_threaded_poll+0x84/0x98
[ 33.942394] kthread+0xf8/0x1c0
[ 33.945536] ret_from_fork+0x10/0x20
[ 33.949114] ---[ end trace 0000000000000000 ]---
@glassdoor - I just finished a build from the newly merged commit and I'm not seeing it in my log. What mt76 commit are you using?
Edit: Which hardware version HW1.0. or HW1.1. ?
mt76 from march. HW 1.1. Given that it's has issue only on one unit it's probably a race condition in the loading sequence. will track it down when I have a bit more time.
Edit:
issue resolved. It was one of the patches. w1700k is very sensitive to modules loading sequence and timing.
3 Likes
This is my own development branch, based on OpenWRT-fanboy's test branch with my additional patches:
PPE/nft_flow_offload: Support WiFi P2P flow offload (and some other corner cases)
PPE/nft_flow_offload/fw4: Support flow offload with bonding (bonding itself is not offloaded but it's enough; only 802.3ad(LACP) with Layer3+4 policy is tested)
(meaningless) Wifi: Enforce EHT beamforming & (try to) enhance 6GHz EHT320 performance
kernel/crypto: Adapt all EIP93 fixes
mt76(mt7996e): Mitigate in-kernel stall issue
airoha: Add SOE driver (inline IPSec packet processor with ESP encap./decap. + NAT-T encap./decap. offload with crypto offload; ESP/NAT-T IPSec throughput (using PC1 ip xfrm to PC2 ip xfrm): ~5Gbps; only tunnel mode is supported)
net: Add Bonding LAG XFRM offload support (only 802.3ad(LACP) with Layer3+4 policy is tested/supported)
airoha: Add Boning LAG XFRM offload support with SOE (only 802.3ad(LACP) with Layer3+4 policy is tested/supported)
airoha: Enable LRO by default
The system image is available here: https://github.com/hurryman2212/w1700k-builds
7 Likes
@iCare Yes, the 10G PHY and Switch PHY temps do work, but the code in /root/usr/libexec/rpcd/luci.fan needs to be updated, and CONFIG_HWMON=y & CONFIG_REALTEK_PHY_HWMON=y need to be set in config-6.12 or config-6.18.
3 Likes
This seems to be a ubi2 build?
Yes. It's based on Fanboy's test branch.
The repo has been updated (and rebuilt) to fix many issues with IPSec H/W tunneling and now IPSec/IKEv2 strongswan works OK.
It is not gonna frequently updated and it is mostly for preliminary purpose before pushing each patch to others; Currently I'm working on more Wi-Fi stuffs and RTL8261CE temperature HWMON support.
From now on, I will only update on my fork via the separate thread for community W1700K builds.
1 Like
(re-posted from the original W1700K thread) This is my own development branch, based on OpenWRT-fanboy's test branch with my additional patches:
PPE/nft_flow_offload: Support WiFi P2P flow offload (and some other corner cases)
PPE/nft_flow_offload/fw4: Support flow offload with bonding (bonding itself is not offloaded but it's enough; only 802.3ad(LACP) with Layer3+4 policy is tested)
(meaningless) Wifi: Enforce EHT beamforming & (try to) enhance 6GHz EHT320 performance
kernel/crypto: Adapt all EIP93 fixes
mt76(mt7996e): Mitigate in-kernel stall issue
airoha: Add SOE driver (inline IPSec packet processor with ESP encap./decap. + NAT-T encap./decap. offload with crypto offload; ESP/NAT-T IPSec throughput (using PC1 ip xfrm to PC2 ip xfrm): ~5Gbps only with PPE+SOE (no CPU usage); only tunnel mode is supported) / Now verified to work with IPSec/IKEv2 StrongSwan hw_offload=packet in tunneling mode.
net: Add Bonding LAG XFRM offload support (only 802.3ad(LACP) with Layer3+4 policy is tested/supported)
airoha: Add Boning LAG XFRM offload support with SOE (only 802.3ad(LACP) with Layer3+4 policy is tested/supported)
airoha: Enable LRO by default
The system image is available here: https://github.com/hurryman2212/w1700k-builds
Not gonna frequently updated and it is mostly for preliminary purpose before pushing each patch to others; Currently I'm working on more Wi-Fi stuffs and RTL8261CE temperature HWMON support.
[EDIT]
More features are added:
Fix LUCI FanControl labels to correctly display sensor labels (10G PHY 1 and 10G PHY 2; There is currently no MT7530 DSA switch temp. sensor implementation)
kernel: add hwmon support to RTL8261CE PHY module (currently broken for correct temperature (too low))
3 Likes
I've added HWMON temperature sensor support in my RTL8261CE reverse-engineered kernel module for HW2.1, but I don't see MT7530 DSA switch temperature sensor implementation in the code.
[EDIT]
I think they are both from two sources of 10G PHY. Probably need to change the label to 10G PHY 1 and 10G PHY 2?
[EDIT #2]
HW2.1 now supports PHY temperature readings.
4 Likes
Is your build ubi2?
Yes. It tracks on Fanboy's test build.
1 Like
I just flashed release test-2026.06.05-r34799-bab46fadf9 from hurryman2212 on HW2.1
PHY1 and 2 temp readings are working, but wrong (offset). 5-6 in idle (no lan connected). Increases when connecting 1 GBIT LAN to 14-16
2 Likes
Hi,
I see. I thought the temperature itself is low due to new production node 
The equation was driven directly from the original WXK002 firmware's vendor RTL8261CE kernel module (and some glues from current RTL8261N OpenWRT-based code).
The problem is there is no additional source to replace it. So I should mark this feature as "broken" and let's see how things come...
[UPDATED]
I have modified the equation logic to upstream RTL822X's one, instead of the original vendor-specific RTL8261CE's one. Although I'm not sure this is correct, but at least it now shows more "reasonable" values.
2 Likes
When I use your build or fanboy's ubi2 build, I'm not able serve VLAN-ed AP.
The SSID is showing up. Association is done, but no DHCP response. Is this a known issue?
/etc/config/network
config device 'device_lan'
option name 'br-lan'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan'
option type 'bridge'
option vlan_filtering '1'
config interface 'lan'
option device 'br-lan.1'
option proto 'static'
option ip6assign '60'
option multipath 'off'
list ipaddr '172.25.100.32/24'
option gateway '172.25.100.1'
list dns '172.25.100.1'
config bridge-vlan 'bridge_vlan1'
option device 'br-lan'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u*'
list ports 'wan:u*'
option vlan '1'
config bridge-vlan 'bridge_vlan2'
option device 'br-lan'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'
list ports 'wan:t'
option vlan '2'
......
/etc/config/wireless:
config wifi-iface 'wlan1_xxxx'
option bss_transition '1'
option device 'radio1'
option encryption 'sae-mixed'
option ieee80211k '1'
option ieee80211r '1'
option ifname 'wlan1-xxxx'
option key 'xxxx'
option mode 'ap'
option network 'lan'
option reassociation_deadline '20000'
option ssid 'xxxx'
......
1 Like
My branch does not include any VLAN-related stuffs, so if your environment does not work even with the Fanboy's test branch it is probably some setting is not configured properly (did you set /proc/sys/net/bridge/bridge-nf-filter-vlan-tagged to 1?) or the Fanboy's branch is broken for that.
I think I have seen some comment where some user said there is performance degrading when enabling VLAN offloading. Since then, I'm using this device without tagged VLAN or VLAN offloading (separation with untagged VLAN with PVID from uplink L3 Mikrotik switch).
Later, I might be able to set experiment environment to test tagged VLAN cases.
just curious.. did you also do the appropriate configuration for the vlans to the firewall zones?
/proc/sys/net/bridge/bridge-nf-filter-vlan-tagged is currently on 0 but issue remains the same after changing to 1.
The issue only affects WiFi. My CPU interface can talk in each VLAN no problem (e.g., get dhcp or ping other hosts), with or without bridge-nf-filter-vlan-tagged.
It looks like whenever vlan_filtering turns on, frames from WiFi port aren't forwarding to other switch port, tagged or untagged. I did some tcpdump:
- From client, I can see some broadcast messages from other hosts in the network and its own dhcp request.
- From dhcp server, I never see this request.
That being said, I haven't test VLAN passthrough from one port to another. But I see people talking VLAN throughput in the post so I assume it should be working.
Re glassdoor:
On this test device, I did try to put all interfaces in lan firewall zone, but it didn't help.
On my other working APs (including w1700k using pre-ubi firmware), I only add management interface to the firewall zone. Other VLAN interfaces I left protocol unmanaged and firewall zone unspecified, and their WiFi work fine.