Kernel panic when mt7915e fails to start WA firmware (MT7986 / BPi-R3) #1052
Description
Hardware
- BananaPi BPi-R3 (MT7986)
- Built-in mt7915e WiFi
Software
- OpenWrt 25.12.0-rc4 and OpenWrt 24.10.5
During boot, when mt7915e fails to start the WA firmware, the kernel panics due to a NULL pointer write? Here's the full boot log:
Boot Logs
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 1006 0033 [0200]
F3: 4001 00E0 [0200]
F3: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 0221 [010F]
Jump to BL
NOTICE: BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7986-emmc-ddr4)
NOTICE: BL2: Built : 22:36:22, Jan 29 2026
NOTICE: WDT: Cold boot
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (1998MHz)
NOTICE: EMI: Using DDR4 settings
NOTICE: EMI: Detected DRAM size: 2048MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: Located partition 'fip' at 0x680000, size 0x400000
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7986-emmc-ddr4)
NOTICE: BL31: Built : 22:36:22, Jan 29 2026
U-Boot 2025.10-OpenWrt-r32534-12374d88b9 (Jan 29 2026 - 22:36:22 +0000)
CPU: MediaTek MT7986
Model: BananaPi BPi-R3
DRAM: 2 GiB
Core: 55 devices, 25 uclasses, devicetree: embed
jedec_spi_nor spi_nor@0: unrecognized JEDEC id bytes: ff, ef, aa
MMC: mmc@11230000: 0
Loading Environment from MMC... Reading from MMC(0)... OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Loading Environment from MMC... Reading from MMC(0)... OK
Net: MediaTek MT7531
eth0: ethernet@15100000
( ( ( OpenWrt ) ) ) [eMMC] U-Boot 2025.10-OpenWrt-r32534-12374d88b9 (Jan 29 2026 - 22:36:22 +0000)
1. Run default boot command.
2. Boot system via TFTP.
3. Boot production system from eMMC.
4. Boot recovery system from eMMC.
5. Load production system via TFTP then write to eMMC.
6. Load recovery system via TFTP then write to eMMC.
7. Load BL31+U-Boot FIP via TFTP then write to eMMC.
8. Load BL2 preloader via TFTP then write to eMMC.
9. Reboot.
a. Reset all settings to factory defaults.
0. Exit
Press UP/DOWN to move, ENTER to select, ESC to quit
spi-nand: spi_nand spi_nand@1: CASN page check failed
spi-nand: spi_nand spi_nand@1: Fallback to read ID
spi-nand: spi_nand spi_nand@1: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
jedec_spi_nor spi_nor@0: unrecognized JEDEC id bytes: 00, ef, aa
'spi-nand0' is now active device
* spi-nand0
- device: spi_nand@1
- parent: spi@1100a000
- driver: spi_nand
- type: NAND flash
- block size: 0x20000 bytes
- page size: 0x800 bytes
- OOB size: 64 bytes
- OOB available: 24 bytes
- 0x000000000000-0x000008000000 : "spi-nand0"
- 0x000000000000-0x000000200000 : "bl2"
- 0x000000200000-0x000008000000 : "ubi"
MMC read: dev # 0, block # 131072, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 131072, count 23808 ... 23808 blocks read: OK
## Loading kernel (any) from FIT Image at 46000000 ...
Using 'config-mt7986a-bananapi-bpi-r3' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-6.12.66
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x46001000
Data Size: 5873068 Bytes = 5.6 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x44000000
Entry Point: 0x44000000
Hash algo: crc32
Hash value: efdda381
Hash algo: sha1
Hash value: 824bbe634c70123556aa3f104643d6e3ec1994ec
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt (any) from FIT Image at 46000000 ...
Using 'config-mt7986a-bananapi-bpi-r3' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt bananapi_bpi-r3 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x4659b000
Data Size: 32016 Bytes = 31.3 KiB
Architecture: AArch64
Load Address: 0x43f00000
Hash algo: crc32
Hash value: 331fdfaf
Hash algo: sha1
Hash value: 4930ba36e594a76bcf6ba90ba8c92ae5dc68ed66
Verifying Hash Integrity ... crc32+ sha1+ OK
Loading fdt from 0x4659b000 to 0x43f00000
Loading Device Tree to 00000000be7e3000, end 00000000be7edfff ... OK
Working FDT set to be7e3000
## Loading fdt (any) from FIT Image at 46000000 ...
Using 'mt7986a-bananapi-bpi-r3-emmc' configuration
Trying 'fdt-mt7986a-bananapi-bpi-r3-emmc' fdt subimage
Description: ARM64 OpenWrt bananapi_bpi-r3 device tree overlay mt7986a-bananapi-bpi-r3-emmc
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x465a3000
Data Size: 1029 Bytes = 1 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 59209fd3
Hash algo: sha1
Hash value: b76ad9bb9619b7898e920f0227be0a3a6154b007
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt (any) from FIT Image at 46000000 ...
Using 'mt7986a-bananapi-bpi-r3-nand' configuration
Trying 'fdt-mt7986a-bananapi-bpi-r3-nand' fdt subimage
Description: ARM64 OpenWrt bananapi_bpi-r3 device tree overlay mt7986a-bananapi-bpi-r3-nand
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x465a4000
Data Size: 1132 Bytes = 1.1 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: aeedea4c
Hash algo: sha1
Hash value: c47f4473cf3eb99a284f63a0b508857ded829f97
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0xbe7e3000
Working FDT set to be7e3000
## Loading loadables (any) from FIT Image at 46000000 ...
Trying 'rootfs-1' loadables subimage
Description: ARM64 OpenWrt bananapi_bpi-r3 rootfs
Type: Filesystem Image
Compression: uncompressed
Data Start: 0x465a8000
Data Size: 6258688 Bytes = 6 MiB
Hash algo: crc32
Hash value: 18ea8ad9
Hash algo: sha1
Hash value: 6b4fa1a0ca9a982b55f7e8c61b82301728d868d3
Verifying Hash Integrity ... crc32+ sha1+ OK
Uncompressing Kernel Image to 44000000
Loading Device Tree to 00000000be7d8000, end 00000000be7e21e7 ... OK
Working FDT set to be7d8000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS
set /chosen/rootdisk to bootrom media: rootdisk-emmc (phandle 0x00000059)
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 6.12.66 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r32534-12374d88b9) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Thu Jan 29 22:36:22 2026
[ 0.000000] Machine model: Bananapi BPI-R3
[ 0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[ 0.000000] OF: reserved mem: 0x0000000043000000..0x000000004303ffff (256 KiB) nomap non-reusable secmon@43000000
[ 0.000000] OF: reserved mem: 0x000000004fc00000..0x000000004fcfffff (1024 KiB) nomap non-reusable wmcpu-reserved@4fc00000
[ 0.000000] OF: reserved mem: 0x000000004fd00000..0x000000004fd3ffff (256 KiB) nomap non-reusable wo-emi@4fd00000
[ 0.000000] OF: reserved mem: 0x000000004fd40000..0x000000004fd7ffff (256 KiB) nomap non-reusable wo-emi@4fd40000
[ 0.000000] OF: reserved mem: 0x000000004fd80000..0x000000004ffbffff (2304 KiB) nomap non-reusable wo-data@4fd80000
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000040000000-0x00000000bfffffff]
[ 0.000000] DMA32 empty
[ 0.000000] Normal empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000040000000-0x0000000042ffffff]
[ 0.000000] node 0: [mem 0x0000000043000000-0x000000004303ffff]
[ 0.000000] node 0: [mem 0x0000000043040000-0x000000004fbfffff]
[ 0.000000] node 0: [mem 0x000000004fc00000-0x000000004ffbffff]
[ 0.000000] node 0: [mem 0x000000004ffc0000-0x00000000bfffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x00000000bfffffff]
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.1 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.5
[ 0.000000] percpu: Embedded 20 pages/cpu s42584 r8192 d31144 u81920
[ 0.000000] pcpu-alloc: s42584 r8192 d31144 u81920 alloc=20*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] CPU features: detected: GIC system register CPU interface
[ 0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[ 0.000000] alternatives: applying boot alternatives
[ 0.000000] Kernel command line: root=/dev/fit0 rootwait
[ 0.000000] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 524288
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 2MB
[ 0.000000] software IO TLB: area num 4.
[ 0.000000] software IO TLB: mapped [mem 0x00000000bf67d000-0x00000000bf87d000] (2MB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[ 0.000000] GICv3: 640 SPIs implemented
[ 0.000000] GICv3: 0 Extended SPIs implemented
[ 0.000000] Root IRQ handler: 0xffffffc080010080
[ 0.000000] GICv3: GICv3 features: 16 PPIs
[ 0.000000] GICv3: GICD_CTRL.DS=0, SCR_EL3.FIQ=0
[ 0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[ 0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[ 0.000072] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[ 0.000079] pid_max: default: 32768 minimum: 301
[ 0.002053] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.002064] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.003654] cacheinfo: Unable to detect cache hierarchy for CPU 0
[ 0.004276] rcu: Hierarchical SRCU implementation.
[ 0.004279] rcu: Max phase no-delay instances is 1000.
[ 0.004399] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[ 0.004614] smp: Bringing up secondary CPUs ...
[ 0.004868] Detected VIPT I-cache on CPU1
[ 0.004908] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[ 0.004935] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[ 0.005252] Detected VIPT I-cache on CPU2
[ 0.005277] GICv3: CPU2: found redistributor 2 region 0:0x000000000c0c0000
[ 0.005289] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[ 0.005555] Detected VIPT I-cache on CPU3
[ 0.005575] GICv3: CPU3: found redistributor 3 region 0:0x000000000c0e0000
[ 0.005584] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[ 0.005621] smp: Brought up 1 node, 4 CPUs
[ 0.005624] SMP: Total of 4 processors activated.
[ 0.005626] CPU: All CPU(s) started at EL2
[ 0.005629] CPU features: detected: 32-bit EL0 Support
[ 0.005631] CPU features: detected: CRC32 instructions
[ 0.005654] alternatives: applying system-wide alternatives
[ 0.005775] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.005904] Memory: 2033692K/2097152K available (9536K kernel code, 992K rwdata, 1832K rodata, 448K init, 316K bss, 60028K reserved, 0K cma-reserved)
[ 0.008673] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.008688] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.008769] 29440 pages in range for non-PLT usage
[ 0.008771] 520960 pages in range for PLT usage
[ 0.009750] pinctrl core: initialized pinctrl subsystem
[ 0.011529] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.011786] DMA: preallocated 256 KiB GFP_KERNEL pool for atomic allocations
[ 0.011811] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.011835] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.012159] thermal_sys: Registered thermal governor 'fair_share'
[ 0.012161] thermal_sys: Registered thermal governor 'bang_bang'
[ 0.012163] thermal_sys: Registered thermal governor 'step_wise'
[ 0.012165] thermal_sys: Registered thermal governor 'user_space'
[ 0.012215] ASID allocator initialised with 65536 entries
[ 0.013064] pstore: Using crash dump compression: deflate
[ 0.013068] pstore: Registered ramoops as persistent store backend
[ 0.013070] ramoops: using 0x10000@0x42ff0000, ecc: 0
[ 0.014418] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
[ 0.018330] /soc/pcie@11280000: Fixed dependency cycle(s) with /soc/pcie@11280000/interrupt-controller
[ 0.027601] cryptd: max_cpu_qlen set to 1000
[ 0.028781] SCSI subsystem initialized
[ 0.028874] libata version 3.00 loaded.
[ 0.030064] clocksource: Switched to clocksource arch_sys_counter
[ 0.031613] NET: Registered PF_INET protocol family
[ 0.031734] IP idents hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.033266] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear)
[ 0.033284] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.033293] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear)
[ 0.033361] TCP bind hash table entries: 16384 (order: 7, 524288 bytes, linear)
[ 0.033697] TCP: Hash tables configured (established 16384 bind 16384)
[ 0.033966] MPTCP token hash table entries: 2048 (order: 4, 49152 bytes, linear)
[ 0.034069] UDP hash table entries: 1024 (order: 3, 32768 bytes, linear)
[ 0.034095] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes, linear)
[ 0.034268] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.034290] PCI: CLS 0 bytes, default 64
[ 0.035264] workingset: timestamp_bits=46 max_order=19 bucket_order=0
[ 0.038691] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.038695] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.074386] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 0.076419] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[ 0.076438] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[ 0.076447] mtk-pcie-gen3 11280000.pcie: MEM 0x0020000000..0x002fffffff -> 0x0020000000
[ 0.076567] /soc/pcie@11280000: Failed to get clk index: 0 ret: -517
[ 0.076574] mtk-pcie-gen3 11280000.pcie: failed to get clocks
[ 0.079696] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.082448] printk: legacy console [ttyS0] disabled
[ 0.102765] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 116, base_baud = 2500000) is a ST16650V2
[ 0.102803] printk: legacy console [ttyS0] enabled
[ 0.966594] 11003000.serial: ttyS1 at MMIO 0x11003000 (irq = 117, base_baud = 1625000) is a ST16650V2
[ 0.996536] 11004000.serial: ttyS2 at MMIO 0x11004000 (irq = 118, base_baud = 1625000) is a ST16650V2
[ 1.006403] mtk_rng 1020f000.rng: registered RNG driver
[ 1.014396] loop: module loaded
[ 1.019140] spi-nand spi0.0: Winbond SPI NAND was found.
[ 1.024481] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[ 1.032768] 2 fixed-partitions partitions found on MTD device spi0.0
[ 1.039298] Creating 2 MTD partitions on "spi0.0":
[ 1.044143] 0x000000200000-0x000008000000 : "ubi"
[ 1.163926] ubi0: default fastmap pool size: 50
[ 1.168459] ubi0: default fastmap WL pool size: 25
[ 1.173242] ubi0: attaching mtd0
[ 4.925921] ubi0: scanning is finished
[ 4.970981] ubi0: attached mtd0 (name "ubi", size 126 MiB)
[ 4.976465] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 4.983328] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 4.990099] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 4.997040] ubi0: good PEBs: 1008, bad PEBs: 0, corrupted PEBs: 0
[ 5.003117] ubi0: user volume: 7, internal volumes: 1, max. volumes count: 128
[ 5.010319] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 0
[ 5.018647] ubi0: available PEBs: 0, total reserved PEBs: 1008, PEBs reserved for bad PEB handling: 20
[ 5.027937] ubi0: background thread "ubi_bgt0d" started, PID 312
[ 5.030262] block ubiblock0_2: created from ubi0:2(fit)
[ 5.039292] 0x000000000000-0x000000200000 : "bl2"
[ 5.161335] mtk_soc_eth 15100000.ethernet: generated random MAC address 20:08:02:00:00:00
[ 5.172745] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081a80000, irq 123
[ 5.182536] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc081a80000, irq 123
[ 5.192240] i2c_dev: i2c /dev entries driver
[ 5.198383] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[ 5.207009] NET: Registered PF_INET6 protocol family
[ 5.212714] Segment Routing with IPv6
[ 5.216389] In-situ OAM (IOAM) with IPv6
[ 5.220344] NET: Registered PF_PACKET protocol family
[ 5.225392] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 5.238435] 8021q: 802.1Q VLAN Support v1.8
[ 5.256449] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[ 5.263795] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[ 5.270050] mtk-pcie-gen3 11280000.pcie: MEM 0x0020000000..0x002fffffff -> 0x0020000000
[ 5.278528] debugfs: File 'type' in directory 'phy-soc:t-phy@11c00000.0' already present!
[ 5.286697] debugfs: File 'efuse' in directory 'phy-soc:t-phy@11c00000.0' already present!
[ 5.294942] debugfs: File 'intr' in directory 'phy-soc:t-phy@11c00000.0' already present!
[ 5.303099] debugfs: File 'tx-imp' in directory 'phy-soc:t-phy@11c00000.0' already present!
[ 5.311430] debugfs: File 'rx-imp' in directory 'phy-soc:t-phy@11c00000.0' already present!
[ 5.630093] mtk-pcie-gen3 11280000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x1)
[ 5.638912] mtk-pcie-gen3 11280000.pcie: probe with driver mtk-pcie-gen3 failed with error -110
[ 5.713754] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[ 5.722805] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[ 5.732257] mt7530-mdio mdio-bus:1f wan (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=128)
[ 5.753281] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=129)
[ 5.774082] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=130)
[ 5.794864] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=131)
[ 5.815646] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=132)
[ 5.826803] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[ 5.833533] DSA: tree 0 setup
[ 5.837048] clk: Disabling unused clocks
[ 5.841216] PM: genpd: Disabling unused power domains
[ 5.862934] Waiting for root device /dev/fit0...
[ 5.929578] mtk-msdc 11230000.mmc: Final PAD_DS_TUNE: 0x15414
[ 5.936512] mmc0: new HS400 MMC card at address 0001
[ 5.942287] mmcblk0: mmc0:0001 008GB0 7.28 GiB
[ 5.948371] Alternate GPT is invalid, using primary GPT.
[ 5.953705] mmcblk0: p1 p2 p3 p4 p5 p128
[ 5.958670] mmcblk0boot0: mmc0:0001 008GB0 4.00 MiB
[ 5.964331] mmcblk0boot1: mmc0:0001 008GB0 4.00 MiB
[ 5.969445] mmcblk0rpmb: mmc0:0001 008GB0 4.00 MiB, chardev (249:0)
[ 5.976680] FIT: Detected U-Boot 2025.10-OpenWrt-r32534-12374d88b9
[ 5.982865] FIT: Selected configuration: "config-mt7986a-bananapi-bpi-r3" (OpenWrt bananapi_bpi-r3)
[ 5.991900] FIT: kernel sub-image 0x00001000..0x0059adab "kernel-1" (ARM64 OpenWrt Linux-6.12.66)
[ 6.001713] FIT: flat_dt sub-image 0x0059b000..0x005a2d0f "fdt-1" (ARM64 OpenWrt bananapi_bpi-r3 device tree blob)
[ 6.012915] FIT: flat_dt sub-image 0x005a3000..0x005a3404 "fdt-mt7986a-bananapi-bpi-r3-emmc" (ARM64 OpenWrt bananapi_bpi-r3 device tree overlay mt7986a-bananapi-bpi-r3-emmc)
[ 6.029230] FIT: flat_dt sub-image 0x005a4000..0x005a446b "fdt-mt7986a-bananapi-bpi-r3-nand" (ARM64 OpenWrt bananapi_bpi-r3 device tree overlay mt7986a-bananapi-bpi-r3-nand)
[ 6.045544] FIT: flat_dt sub-image 0x005a5000..0x005a54bd "fdt-mt7986a-bananapi-bpi-r3-nor" (ARM64 OpenWrt bananapi_bpi-r3 device tree overlay mt7986a-bananapi-bpi-r3-nor)
[ 6.061688] FIT: flat_dt sub-image 0x005a6000..0x005a636a "fdt-mt7986a-bananapi-bpi-r3-sd" (ARM64 OpenWrt bananapi_bpi-r3 device tree overlay mt7986a-bananapi-bpi-r3-sd)
[ 6.077663] FIT: flat_dt sub-image 0x005a7000..0x005a75b1 "fdt-mt7986a-bananapi-bpi-r3-respeaker-2mics" (ARM64 OpenWrt bananapi_bpi-r3 device tree overlay mt7986a-bananapi-bpi-r3-respeaker-2mics)
[ 6.095884] FIT: filesystem sub-image 0x005a8000..0x00b9ffff "rootfs-1" (ARM64 OpenWrt bananapi_bpi-r3 rootfs)
[ 6.106795] block mmcblk0p5: mapped 1 uImage.FIT filesystem sub-image as /dev/fit0
[ 6.114588] block mmcblk0p5: mapped remaining space as /dev/fitrw
[ 6.132659] VFS: Mounted root (squashfs filesystem) readonly on device 259:1.
[ 6.139939] Freeing unused kernel memory: 448K
[ 6.144426] Run /sbin/init as init process
[ 6.148505] with arguments:
[ 6.151461] /sbin/init
[ 6.154152] with environment:
[ 6.157277] HOME=/
[ 6.159622] TERM=linux
[ 6.260275] init: Console is alive
[ 6.263768] init: - watchdog -
[ 6.475471] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 6.491205] usbcore: registered new interface driver usbfs
[ 6.496719] usbcore: registered new interface driver hub
[ 6.502111] usbcore: registered new device driver usb
[ 6.507730] gpio_button_hotplug: loading out-of-tree module taints kernel.
[ 6.518714] xhci-mtk 11200000.usb: supply vbus not found, using dummy regulator
[ 6.526165] xhci-mtk 11200000.usb: supply vusb33 not found, using dummy regulator
[ 6.534575] xhci-mtk 11200000.usb: xHCI Host Controller
[ 6.539801] xhci-mtk 11200000.usb: new USB bus registered, assigned bus number 1
[ 6.550175] xhci-mtk 11200000.usb: hcc params 0x01403f99 hci version 0x110 quirks 0x0000000000200010
[ 6.559322] xhci-mtk 11200000.usb: irq 134, io mem 0x11200000
[ 6.565155] xhci-mtk 11200000.usb: xHCI Host Controller
[ 6.570373] xhci-mtk 11200000.usb: new USB bus registered, assigned bus number 2
[ 6.577752] xhci-mtk 11200000.usb: Host supports USB 3.2 Enhanced SuperSpeed
[ 6.585098] hub 1-0:1.0: USB hub found
[ 6.588850] hub 1-0:1.0: 2 ports detected
[ 6.593104] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[ 6.601535] hub 2-0:1.0: USB hub found
[ 6.605286] hub 2-0:1.0: 1 port detected
[ 6.612689] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 6.629860] init: - preinit -
[ 6.813432] mtk_soc_eth 15100000.ethernet sfp1: renamed from eth1
[ 6.827607] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[ 6.836087] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[ 7.000090] usb 1-1: new high-speed USB device number 2 using xhci-mtk
[ 7.150804] hub 1-1:1.0: USB hub found
[ 7.154633] hub 1-1:1.0: 4 ports detected
[ 8.540071] random: crng init done
[ 10.651052] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 14.870097] F2FS-fs (fitrw): Found nat_bits in checkpoint
[ 14.881597] F2FS-fs (fitrw): Mounted with checkpoint version = 6a3dad3d
[ 14.889333] mount_root: overlay filesystem has not been fully initialized yet
[ 14.896704] mount_root: switching to f2fs overlay
[ 14.901951] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[ 14.912883] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 14.952574] procd: - early -
[ 14.955504] procd: - watchdog -
[ 15.492613] procd: - watchdog -
[ 15.499451] procd: - ubus -
[ 15.652638] procd: - init -
Please press Enter to activate this console.
[ 15.844684] kmodloader: loading kernel modules from /etc/modules.d/*
[ 15.865431] i2c-gpio i2c-gpio-0: using lines 528 (SDA) and 529 (SCL)
[ 15.872191] i2c-gpio i2c-gpio-1: using lines 530 (SDA) and 531 (SCL)
[ 15.882057] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[ 15.896593] Loading modules backported from Linux version v6.18.7-0-g5dfbc5357
[ 15.903862] Backport generated by backports.git c8a37ce
[ 15.913936] sfp sfp-1: Host maximum power 3.0W
[ 15.919024] sfp sfp-2: Host maximum power 3.0W
[ 16.003986] urngd: v1.0.2 started.
[ 16.330708] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823160739a
[ 16.330708]
[ 16.433120] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823160804
[ 16.502482] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823160840
[ 21.600086] mt798x-wmac 18000000.wifi: Retry message 00000002 (seq 13)
[ 26.630066] mt798x-wmac 18000000.wifi: Message 00000002 (seq 13) timeout
[ 26.636759] mt798x-wmac 18000000.wifi: Failed to start WA firmware
[ 26.636776] Unable to handle kernel write to read-only memory at virtual address 0000000000000008
[ 26.651773] Mem abort info:
[ 26.654551] ESR = 0x0000000096000045
[ 26.658283] EC = 0x25: DABT (current EL), IL = 32 bits
[ 26.663579] SET = 0, FnV = 0
[ 26.666620] EA = 0, S1PTW = 0
[ 26.669744] FSC = 0x05: level 1 translation fault
[ 26.674607] Data abort info:
[ 26.677472] ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000
[ 26.682940] CM = 0, WnR = 1, TnD = 0, TagAccess = 0
[ 26.687972] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 26.693270] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000045bf6000
[ 26.699690] [0000000000000008] pgd=08000000452ca003, p4d=08000000452ca003, pud=08000000452ca003, pmd=0000000000000000
[ 26.710282] Internal error: Oops: 0000000096000045 [#1] SMP
[ 26.715836] Modules linked in: mt7915e(O+) mt76_connac_lib(O) mt76(O) mac80211(O) cfg80211(O) slhc sfp nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mdio_i2c libcrc32c compat(O) crypto_safexcel pwm_fan i2c_gpio i2c_algo_bit sha512_arm64 sha1_ce sha1_generic seqiv md5 geniv des_generic libdes authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug(O) usbcore usb_common
[ 26.755004] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G O 6.12.66 #0
[ 26.763507] Tainted: [O]=OOT_MODULE
[ 26.766979] Hardware name: Bananapi BPI-R3 (DT)
[ 26.771492] Workqueue: mt76 0xffffffc078fa6604 [mt7915e@000000005d2ae42d+0x1b000]
[ 26.778957] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 26.785898] pc : 0xffffffc078f78a18 [mt76@00000000936acc78+0xe000]
[ 26.792059] lr : 0xffffffc078f79018 [mt76@00000000936acc78+0xe000]
[ 26.798220] sp : ffffffc08125bc20
[ 26.801518] x29: ffffffc08125bc20 x28: 61c8864680b583eb x27: ffffff8005f12040
[ 26.808636] x26: ffffff8005f12070 x25: ffffffc08125bc80 x24: ffffff8005f12040
[ 26.815754] x23: ffffff8005f12058 x22: ffffff8005f149d0 x21: ffffffffffff6478
[ 26.822871] x20: ffffff8005f12068 x19: ffffff8005f12040 x18: ffffffffffff5768
[ 26.829988] x17: ffffffffffff6400 x16: ffffffc080d10000 x15: 0000000000000001
[ 26.837106] x14: 0000000000000000 x13: 0000000000000020 x12: 0101010101010101
[ 26.844223] x11: 7f7f7f7f7f7f7f7f x10: fefefefefefefeff x9 : 7f7f7f7f7f7f7f7f
[ 26.851339] x8 : 8080808080808080 x7 : 0000000080808080 x6 : ffffff8000e7e740
[ 26.858456] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[ 26.865572] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
[ 26.872689] Call trace:
[ 26.875121] 0xffffffc078f78a18 [mt76@00000000936acc78+0xe000]
[ 26.880936] 0xffffffc078f79018 [mt76@00000000936acc78+0xe000]
[ 26.886749] 0xffffffc078fa71e4 [mt7915e@000000005d2ae42d+0x1b000]
[ 26.892910] 0xffffffc08005a134
[ 26.896036] 0xffffffc08005ae58
[ 26.899163] 0xffffffc080061d9c
[ 26.902288] 0xffffffc080014860
[ 26.905416] Code: f9401b00 eb00035f 54000120 a9430702 (f9000459)
[ 26.911489] ---[ end trace 0000000000000000 ]---
[ 26.919063] pstore: backend (ramoops) writing error (-28)
[ 26.924445] Kernel panic - not syncing: Oops: Fatal exception in interrupt
[ 26.931297] SMP: stopping secondary CPUs
[ 26.935207] Kernel Offset: disabled
[ 26.938679] CPU features: 0x00,00000000,00000000,4200400b
[ 26.944059] Memory Limit: none
[ 26.949962] Rebooting in 1 seconds.