Help Needed: Kernel Panic on Acer Predator W6 When Disconnecting from 5G

Hello everyone,

I'm facing a recurring issue with my Acer Predator W6 experiencing kernel panics specifically when I disconnect from 5G. This issue persists across various builds:

  • Release 23.05.3 or Snapshot Release, Default Build or Custom Build
  • Affected Card is the MT7986 802.11ac/ax/n, 5 Ghz

Has anyone encountered a similar problem or can offer any insights on a possible fix? Your expertise would be greatly appreciated!

Thank you!

Crash Log:

2024-04-23T11:15:25+00:00 AP_MASTER hostapd: phy2-ap0: AP-STA-DISCONNECTED 04:33:c2:67:0a:de
2024-04-23T11:15:25+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de WPA: event 3 notification
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: unauthorizing port
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: deauthenticated
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DEAUTHENTICATE.indication(04:33:c2:67:0a:de, 1)
2024-04-23T11:15:26+00:00 AP_MASTER hostapd: phy2-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)
[  276.141410] Unable to handle kernel read from unreadable memory at virtual address 0000000000000024
[  276.150448] Mem abort info:
[  276.153239]   ESR = 0x0000000096000005
[  276.156972]   EC = 0x25: DABT (current EL), IL = 32 bits
[  276.162269]   SET = 0, FnV = 0
[  276.165308]   EA = 0, S1PTW = 0
[  276.168432]   FSC = 0x05: level 1 translation fault
[  276.173297] Data abort info:
[  276.176162]   ISV = 0, ISS = 0x00000005
[  276.179980]   CM = 0, WnR = 0
[  276.182937] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000045c8f000
[  276.189357] [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[  276.198041] Internal error: Oops: 0000000096000005 [#1] SMP
[  276.203595] Modules linked in: nft_fib_inet nf_flow_table_inet nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_f
ib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7915e mt76_connac_lib mt76 mac80211 cfg80211 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32
c compat crypto_safexcel sha512_arm64 sha1_ce sha1_generic seqiv md5 des_generic libdes authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug usbcore usb_common aquantia
[  276.262369] CPU: 3 PID: 1432 Comm: hostapd Not tainted 6.1.86 #0
[  276.268358] Hardware name: Acer Predator W6 (DT)
[  276.272957] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  276.279897] pc : mt76_wcid_cleanup+0x84/0x21c [mt76]
[  276.284860] lr : mt76_wcid_cleanup+0x64/0x21c [mt76]
[  276.289812] sp : ffffffc009c73710
[  276.293110] x29: ffffffc009c73710 x28: ffffff8000b01780 x27: ffffffc009c73dc8
[  276.300226] x26: ffffff80000a4880 x25: ffffffc008c72d00 x24: 0000000000000001
[  276.307342] x23: ffffffc000ab3144 x22: 0000000000000000 x21: ffffff800581ace8
[  276.314458] x20: ffffffc009c73758 x19: ffffff8004a62000 x18: 0000000000000028
[  276.321574] x17: 0000000000000000 x16: 00000000000005c8 x15: 0000000000000250
[  276.328689] x14: ffffff800581ae50 x13: ffffff800581ae50 x12: 0000000000000000
[  276.335804] x11: 0000000000000040 x10: 0000000000000000 x9 : ffffff800581ae50
[  276.342920] x8 : 0000000000000000 x7 : 0800000000000000 x6 : 0000000000000000
[  276.342920] x8 : 0000000000000000 x7 : 0800000000000000 x6 : 0000000000000000
[  276.350035] x5 : ffffffc000afda30 x4 : 0000000000000000 x3 : 0000000000000001
[  276.357151] x2 : 0000000000000000 x1 : ffffff8000b01780 x0 : 0000000000000024
[  276.364267] Call trace:
[  276.366698]  mt76_wcid_cleanup+0x84/0x21c [mt76]
[  276.371304]  __mt76_sta_remove+0x70/0xbc [mt76]
[  276.375823]  mt76_sta_state+0x8c/0x2f4 [mt76]
[  276.380168]  mt7915_eeprom_get_power_delta+0x1424/0x23d0 [mt7915e]
[  276.386335]  drv_sta_state+0x250/0x2f4 [mac80211]
[  276.391055]  ieee80211_sta_eosp+0x598/0x674 [mac80211]
[  276.396193]  sta_set_sinfo+0xc24/0xd50 [mac80211]
[  276.400898]  sta_info_destroy_addr_bss+0x50/0x70 [mac80211]
[  276.406468]  ieee80211_color_change_finish+0x1ab8/0x1da0 [mac80211]
[  276.412732]  cfg80211_check_station_change+0x11c0/0x3370 [cfg80211]
[  276.418993]  genl_family_rcv_msg_doit+0xb4/0x110
[  276.423596]  genl_rcv_msg+0x104/0x220
[  276.427243]  netlink_rcv_skb+0x58/0x120
[  276.431062]  genl_rcv+0x34/0x4c
[  276.434189]  netlink_unicast+0x1e0/0x2d0
[  276.438094]  netlink_sendmsg+0x198/0x3c0
[  276.442000]  ____sys_sendmsg+0x1c0/0x260
[  276.445910]  ___sys_sendmsg+0x78/0xc0
[  276.449559]  __sys_sendmsg+0x44/0xa0
[  276.453120]  __arm64_sys_sendmsg+0x20/0x30
[  276.457202]  invoke_syscall.constprop.0+0x4c/0xe0
[  276.461891]  do_el0_svc+0x40/0xd0
[  276.465190]  el0_svc+0x14/0x4c
[  276.468231]  el0t_64_sync_handler+0x10c/0x120
[  276.472571]  el0t_64_sync+0x14c/0x150
[  276.476222] Code: d2800002 910092c0 52800023 f9800011 (885f7c01)
[  276.482295] ---[ end trace 0000000000000000 ]---
[  276.491393] Kernel panic - not syncing: Oops: Fatal exception in interrupt
[  276.498247] SMP: stopping secondary CPUs
[  276.502155] Kernel Offset: disabled
[  276.505627] CPU features: 0x00000,00000004,0000400b
[  276.510487] Memory Limit: none
[  276.517922] Rebooting in 3 seconds..

Regular Log (from the 2.4 Ghz Interface):

2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: start SAE authentication (RX commit, status=126 (SAE_HASH_TO_ELEMENT))
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: SAE authentication (RX confirm, status=0 (SUCCESS))
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-AUTHENTICATE.indication(04:33:c2:67:0a:de, unknown)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: association OK (aid 1)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: associated (aid 1)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-ASSOCIATE.indication(04:33:c2:67:0a:de)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: binding station to interface 'phy0-ap0'
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: event 1 notification
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: start authentication
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: unauthorizing port
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: sending 1/4 msg of 4-Way Handshake
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA-OPMODE-SMPS-MODE-CHANGED 04:33:c2:67:0a:de off
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: received EAPOL-Key frame (2/4 Pairwise)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: sending 3/4 msg of 4-Way Handshake
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: received EAPOL-Key frame (4/4 Pairwise)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: AP-STA-CONNECTED 04:33:c2:67:0a:de auth_alg=sae
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: authorizing port
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de RADIUS: starting accounting session 6A9969AD0CCEFB6F
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: pairwise key handshake completed (RSN)
2024-04-23T11:45:25+00:00 AP_MASTER hostapd: phy0-ap0: EAPOL-4WAY-HS-COMPLETED 04:33:c2:67:0a:de
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: AP-STA-DISCONNECTED 04:33:c2:67:0a:de
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de WPA: event 3 notification
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.1X: unauthorizing port
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de IEEE 802.11: deauthenticated
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DEAUTHENTICATE.indication(04:33:c2:67:0a:de, 1)
2024-04-23T11:45:50+00:00 AP_MASTER hostapd: phy0-ap0: STA 04:33:c2:67:0a:de MLME: MLME-DELETEKEYS.request(04:33:c2:67:0a:de)

/etc/config/wireless:

2.4 Ghz (working)
config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/11280000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel 'auto'
        option band '2g'
        option htmode 'HE40'
        option cell_density '0'
        option country 'CH'
        option log_level '0'
config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'hotspot'
        option encryption 'sae-mixed'
        option key 'password'

5 Ghz (crashing)
config wifi-device 'radio2'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel 'auto'
        option band '5g'
        option htmode 'HE160'
        option country 'CH'
        option cell_density '1'
        option log_level '0'
        option disabled '1'
config wifi-iface 'default_radio2'
        option device 'radio2'
        option network 'lan'
        option mode 'ap'
        option ssid 'hotspot'
        option encryption 'sae-mixed'
        option key 'password'
        option disabled '1'

hostapd config:

2.4 Ghz (working)
driver=nl80211
logger_syslog=127
logger_syslog_level=0
logger_stdout=127
logger_stdout_level=0
country_code=CH
ieee80211d=1
hw_mode=g
supported_rates=60 90 120 180 240 360 480 540
basic_rates=60 120 240
beacon_int=100
channel=acs_survey
#num_global_macaddr=1
ieee80211n=1
ht_coex=0
ht_capab=[HT40+][LDPC][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1][MAX-AMSDU-7935]
ieee80211ax=1
he_su_beamformer=1
he_su_beamformee=1
he_mu_beamformer=1
he_bss_color=128
he_spr_sr_control=3
he_default_pe_duration=4
he_rts_threshold=1023
he_mu_edca_qos_info_param_count=0
he_mu_edca_qos_info_q_ack=0
he_mu_edca_qos_info_queue_request=0
he_mu_edca_qos_info_txop_request=0
he_mu_edca_ac_be_aifsn=8
he_mu_edca_ac_be_aci=0
he_mu_edca_ac_be_ecwmin=9
he_mu_edca_ac_be_ecwmax=10
he_mu_edca_ac_be_timer=255
he_mu_edca_ac_bk_aifsn=15
he_mu_edca_ac_bk_aci=1
he_mu_edca_ac_bk_ecwmin=9
he_mu_edca_ac_bk_ecwmax=10
he_mu_edca_ac_bk_timer=255
he_mu_edca_ac_vi_ecwmin=5
he_mu_edca_ac_vi_ecwmax=7
he_mu_edca_ac_vi_aifsn=5
he_mu_edca_ac_vi_aci=2
he_mu_edca_ac_vi_timer=255
he_mu_edca_ac_vo_aifsn=5
he_mu_edca_ac_vo_aci=3
he_mu_edca_ac_vo_ecwmin=5
he_mu_edca_ac_vo_ecwmax=7
he_mu_edca_ac_vo_timer=255
interface=phy0-ap0
ctrl_interface=/var/run/hostapd
ap_isolate=1
bss_load_update_period=60
chan_util_avg_period=600
disassoc_low_ack=1
skip_inactivity_poll=0
preamble=1
wmm_enabled=1
ignore_broadcast_ssid=0
uapsd_advertisement_enabled=1
utf8_ssid=1
multi_ap=0
sae_require_mfp=1
sae_pwe=2
wpa_passphrase=password
wpa_psk_file=/var/run/hostapd-phy0-ap0.psk
auth_algs=1
wpa=2
wpa_pairwise=CCMP
ssid=ssid
bridge=br-lan
wds_bridge=
snoop_iface=br-lan
wpa_disable_eapol_key_retries=0
wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
okc=1
ieee80211w=1
group_mgmt_cipher=AES-128-CMAC
dynamic_vlan=0
vlan_naming=1
vlan_no_bridge=1
vlan_file=/var/run/hostapd-phy0-ap0.vlan
qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
bssid=c0:18:50:de:39:2b
#default_macaddr

5 Ghz (Crashing)
driver=nl80211
logger_syslog=127
logger_syslog_level=0
logger_stdout=127
logger_stdout_level=0
country_code=CH
ieee80211d=1
ieee80211h=1
hw_mode=a
supported_rates=60 90 120 180 240 360 480 540
basic_rates=60 120 240
beacon_int=100
channel=acs_survey
tx_queue_data2_burst=2.0
#num_global_macaddr=1
ieee80211n=1
ht_coex=0
ht_capab=[HT40+][LDPC][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1][MAX-AMSDU-7935]
ieee80211ac=1
vht_oper_chwidth=2
vht_oper_centr_freq_seg0_idx=acs_survey
vht_capab=[RXLDPC][SHORT-GI-80][SHORT-GI-160][TX-STBC-2BY1][SU-BEAMFORMER][SU-BEAMFORMEE][MU-BEAMFORMER][MU-BEAMFORMEE][RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN][RX-STBC-1][SOUNDING-DIMENSION-4][BF-ANT>
ieee80211ax=1
he_oper_chwidth=2
he_oper_centr_freq_seg0_idx=acs_survey
he_su_beamformer=1
he_su_beamformee=1
he_mu_beamformer=1
he_bss_color=128
he_spr_sr_control=3
he_default_pe_duration=4
he_rts_threshold=1023
he_mu_edca_qos_info_param_count=0
he_mu_edca_qos_info_q_ack=0
he_mu_edca_qos_info_queue_request=0
he_mu_edca_qos_info_txop_request=0
he_mu_edca_ac_be_aifsn=8
he_mu_edca_ac_be_aci=0
he_mu_edca_ac_be_ecwmin=9
he_mu_edca_ac_be_ecwmax=10
he_mu_edca_ac_be_timer=255
he_mu_edca_ac_bk_aifsn=15
he_mu_edca_ac_bk_aci=1
he_mu_edca_ac_bk_ecwmin=9
he_mu_edca_ac_bk_ecwmax=10
he_mu_edca_ac_bk_timer=255
he_mu_edca_ac_vi_ecwmin=5
he_mu_edca_ac_vi_ecwmax=7
he_mu_edca_ac_vi_aifsn=5
he_mu_edca_ac_vi_aci=2
he_mu_edca_ac_vi_timer=255
he_mu_edca_ac_vo_aifsn=5
he_mu_edca_ac_vo_aci=3
he_mu_edca_ac_vo_ecwmin=5
he_mu_edca_ac_vo_ecwmax=7
he_mu_edca_ac_vo_timer=255
interface=phy2-ap0
ctrl_interface=/var/run/hostapd
ap_isolate=1
bss_load_update_period=60
chan_util_avg_period=600
disassoc_low_ack=1
skip_inactivity_poll=0
preamble=1
wmm_enabled=1
ignore_broadcast_ssid=0
uapsd_advertisement_enabled=1
utf8_ssid=1
multi_ap=0
sae_require_mfp=1
sae_pwe=2
wpa_passphrase=password
wpa_psk_file=/var/run/hostapd-phy2-ap0.psk
auth_algs=1
wpa=2
wpa_pairwise=CCMP
ssid=ssid
bridge=br-lan
wds_bridge=
snoop_iface=br-lan
wpa_disable_eapol_key_retries=0
wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE
okc=1
ieee80211w=1
group_mgmt_cipher=AES-128-CMAC
dynamic_vlan=0
vlan_naming=1
vlan_no_bridge=1
vlan_file=/var/run/hostapd-phy2-ap0.vlan
qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56
bssid=c0:18:50:de:39:2a
#default_macaddr

I just stumbled over your post. I am experiencing and reported the same issue in the original W6 thread. Have you found any solution yet?

This should now be fixed with

Was quite interesting since the bug only affected MT7986 without DBDC.

1 Like