MT76 MT7615DN MT7602EN MT7612EN - Device Crash / reboot when a mobile device roam from 2 to 5 GHz WLAN with same SSID

[momothefox]

Hardware Configuration: SoC: MT7621AT WLAN: MT7615DN Flash: NAND EEPROM stored on flash

		bdinfo: partition@100000 {
			label = "bdinfo";
			reg = <0x100000 0x40000>;
			read-only;
		};

&pcie0 {
	wifi@0,0 {
		compatible = "mediatek,mt76";
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&bdinfo 0x0>;
	};
};

Software Configuration: Previously running custom builds of OpenWRT (versions 22.03.0 and 23.05.2) Currently running a compiled snapshot from 9-2-2024

Observations:

Reboot Issue: Devices experienced multiple reboots on versions 22.03.0 and 23.05.2. Reboots have decreased with the current compiled snapshot compared to previous versions.

Roaming Trigger: Roaming between 2.4GHz and 5GHz WLANs occurs just before crashes, with a device transitioning between the two frequencies. Both WLAN interfaces have the same SSID, leading to potential conflicts during roaming.

Log Analysis: Logs indicate crashes occurring shortly after a device roams between WLANs. Logs from the previous crashes are no longer present in the current snapshot from 9-2-2024.

Configuration: WiFi Configuration:

config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option htmode 'HT20'
	option band '2g'
	option channel '1'
	option country 'US'
	option cell_density '3'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option encryption 'none'
	option ssid 'WiFi'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0+1'
	option band '5g'
	option htmode 'HT40'
	option channel '48'
	option country 'US'
	option cell_density '3'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option encryption 'none'
	option ssid 'WiFi'

Hypothesis: Roaming between WLANs may be triggering the reboots. The issue might be related to conflicts arising from devices switching between 2.4GHz and 5GHz frequencies, both sharing the same SSID.

hostapd: phy1-ap0: STA 00:c3:0a:6f:48:ad IEEE 802.11: authenticated
hostapd: phy1-ap0: STA 00:c3:0a:6f:48:ad IEEE 802.11: associated (aid 2)
hostapd: phy1-ap0: AP-STA-CONNECTED 00:c3:0a:6f:48:ad auth_alg=open
hostapd: phy0-ap0: Prune association for 00:c3:0a:6f:48:ad
hostapd: phy0-ap0: AP-STA-DISCONNECTED 00:c3:0a:6f:48:ad
hostapd: phy0-ap0: STA 00:c3:0a:6f:48:ad IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
hostapd: phy0-ap0: STA 00:c3:0a:6f:48:ad IEEE 802.11: authenticated
hostapd: phy0-ap0: STA 00:c3:0a:6f:48:ad IEEE 802.11: associated (aid 1)
hostapd: phy0-ap0: AP-STA-CONNECTED 00:c3:0a:6f:48:ad auth_alg=open
hostapd: phy1-ap0: Prune association for 00:c3:0a:6f:48:ad
hostapd: phy1-ap0: AP-STA-DISCONNECTED 00:c3:0a:6f:48:ad
kernel: [ 5692.522777] CPU 1 Unable to handle kernel paging request at virtual address 00000004, epc == 8290b364, ra == 8290ae14
kernel: [ 5692.533437] Oops[#1]:
kernel: [ 5692.535708] CPU: 1 PID: 1289 Comm: hostapd Not tainted 5.15.137 #0
kernel: [ 5692.541863] $ 0   : 00000000 00000001 00000000 00000001
kernel: [ 5692.547087] $ 4   : 824322f8 00000000 00000008 00000000
kernel: [ 5692.552305] $ 8   : 824324a0 8039eafc 00000000 8100df40
kernel: [ 5692.557522] $12   : 00000002 00000000 00000402 85694a38
kernel: [ 5692.562740] $16   : 845fd400 85694000 1783bf82 84512500
kernel: [ 5692.567959] $20   : 82633c38 00000581 00000028 81425464
kernel: [ 5692.573177] $24   : 00000040 00000000
kernel: [ 5692.578394] $28   : 82632000 82633ac8 856944b5 8290ae14
kernel: [ 5692.583615] Hi    : 000007d0
kernel: [ 5692.586484] Lo    : 00000bb8
kernel: [ 5692.589346] epc   : 8290b364 0x8290b364 [mac80211@47326171+0x8ca80]
kernel: [ 5692.595602] ra    : 8290ae14 0x8290ae14 [mac80211@47326171+0x8ca80]
kernel: [ 5692.601847] Status: 1100fc03	KERNEL EXL IE
kernel: [ 5692.606022] Cause : 40800008 (ExcCode 02)
kernel: [ 5692.610009] BadVA : 00000004
kernel: [ 5692.612871] PrId  : 0001992f (MIPS 1004Kc)
kernel: [ 5692.616944] Modules linked in: pppoe ppp_async nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet iptable_nat xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_CT pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7615e mt7615_common mt76_connac_lib mt76 mac80211 iptable_mangle iptable_filter ipt_REJECT ip_tables cfg80211 xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG x_tables slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c hwmon crc_ccitt compat tun nls_iso8859_6 nls_cp864 sha512_generic seqiv jitterentropy_rng drbg hmac cmac leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug usbcore nls_base usb_common crc32c_generic
kernel: [ 5692.700705] Process hostapd (pid: 1289, threadinfo=9eb2e9be, task=ec1cdc83, tls=77eb0dfc)
kernel: [ 5692.708891] Stack : 82633b2c 00000000 00000003 00000004 00000002 00000003 85694000 00000001

from analyzing large log file that collected from several openwrt devices. every time there were roaming occured. and it might be with certain mobile devices. but this i am not sure about.