[RFC,mt76] wifi: mt76: wed: fix kernel panic on single band MT7986
Zhi-Jun You
hujy652 at gmail.com
Mon Jun 22 07:47:18 PDT 2026
On Sun, Jun 14, 2026 at 1:31 AM Zhi-Jun You <hujy652 at gmail.com> wrote:
>
> In mt76_wed_init_rx_buf, it's hardcoded to use MT_RXQ_MAIN.
> But for single band MT7986 MT_RXQ_BAND1 is used for RX data queue which
> leads to kernel panic when attaching WED.
>
> Use the correct RX queue by checking WED version and band_idx.
>
> v2 and band 1 -> MT_RXQ_BAND1
> Others -> MT_RXQ_MAIN
>
> Kernel panic:
>
> Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
> Mem abort info:
> ESR = 0x0000000096000005
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x05: level 1 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
> CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> Internal error: Oops: 0000000096000005 [#1] SMP
> CPU: 1 UID: 0 PID: 925 Comm: kmodloader Tainted: G O 6.18.26 #0 NONE
> Tainted: [O]=OOT_MODULE
> Hardware name: Acer Connect Vero W6m (DT)
> pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : page_pool_alloc_frag_netmem+0x1c/0x1bc
> lr : page_pool_alloc_frag+0xc/0x34
> sp : ffffffc081dab660
> x29: ffffffc081dab660 x28: ffffffc081dabc60 x27: ffffff80091af040
> x26: 0000008000000000 x25: ffffff80091a8898 x24: ffffff80091a5440
> x23: 0000000000001000 x22: 0000000140000000 x21: ffffff80091a2040
> x20: ffffff8003f1d780 x19: 0000000000000000 x18: 0000000000000020
> x17: ffffffbfbf0ac000 x16: ffffffc080ee0000 x15: ffffff80049d47ca
> x14: 000000000000037b x13: 000000000000037b x12: 0000000000000001
> x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
> x8 : ffffff8003f1d7c0 x7 : 0000000000000000 x6 : ffffff8003f1d780
> x5 : 0000000000000680 x4 : 0000000000000000 x3 : 0000000000002824
> x2 : 0000000000000000 x1 : ffffffc081dab71c x0 : 0000000000000000
> Call trace:
> page_pool_alloc_frag_netmem+0x1c/0x1bc (P)
> page_pool_alloc_frag+0xc/0x34
> mt76_wed_init_rx_buf+0xf8/0x2ac [mt76]
> mtk_wed_start+0x79c/0x12ac
> mt7915_dma_start+0x274/0x63c [mt7915e]
> mt7915_dma_start+0x5b4/0x63c [mt7915e]
> mt7915_dma_init+0x49c/0x81c [mt7915e]
> mt7915_register_device+0x24c/0x530 [mt7915e]
> mt7915_mmio_probe+0x91c/0x1980 [mt7915e]
> platform_probe+0x58/0xa0
> really_probe+0xb8/0x2a8
> __driver_probe_device+0x74/0x118
> driver_probe_device+0x3c/0xe0
> __driver_attach+0x88/0x154
> bus_for_each_dev+0x60/0xb0
> driver_attach+0x20/0x28
> bus_add_driver+0xdc/0x200
> driver_register+0x64/0x118
> __platform_driver_register+0x20/0x30
> init_module+0x74/0x1000 [mt7915e]
> do_one_initcall+0x4c/0x1f8
> do_init_module+0x50/0x210
> load_module+0x15f8/0x1b10
> __do_sys_init_module+0x1a8/0x260
> __arm64_sys_init_module+0x18/0x20
> invoke_syscall.constprop.0+0x4c/0xd0
> do_el0_svc+0x3c/0xd0
> el0_svc+0x18/0x60
> el0t_64_sync_handler+0x98/0xdc
> el0t_64_sync+0x158/0x15c
> Code: aa0003f3 a9025bf5 a90363f7 d2820017 (b9400000)
>
> Signed-off-by: Zhi-Jun You <hujy652 at gmail.com>
> ---
> Hi maintainers,
>
> I am trying to fix WED on a MT7986 + MT7916 board.
> With this patch applied, WED loads without kernel panic.
> Client can connect but there's no traffic.
>
> Maybe there's somewhere else that need to be configured for single band MT7986?
>
> I can provide the rxinfo, txinfo dump from WED if requested.
> ---
> drivers/net/wireless/mediatek/mt76/wed.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/wed.c b/drivers/net/wireless/mediatek/mt76/wed.c
> index ed657d952de2..f210a0c57d81 100644
> --- a/drivers/net/wireless/mediatek/mt76/wed.c
> +++ b/drivers/net/wireless/mediatek/mt76/wed.c
> @@ -33,10 +33,15 @@ u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
> {
> struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
> struct mt76_dev *dev = mt76_wed_to_dev(wed);
> - struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
> struct mt76_txwi_cache *t = NULL;
> + struct mt76_queue *q;
> int i;
>
> + if (wed->version == 2 && dev->phy.band_idx)
> + q = &dev->q_rx[MT_RXQ_BAND1];
> + else
> + q = &dev->q_rx[MT_RXQ_MAIN];
> +
> for (i = 0; i < size; i++) {
> dma_addr_t addr;
> u32 offset;
> --
> 2.47.3
>
dump of /sys/kernel/debug/wed1
root at W6m:/sys/kernel/debug/wed1# cat rxinfo
======== WPDMA RX:
WPDMA_RX0 BASE 00000000
WPDMA_RX0 CNT 00000000
WPDMA_RX0 CIDX 00000000
WPDMA_RX0 DIDX 00000000
WPDMA_RX1 BASE 4a7c0000
WPDMA_RX1 CNT 00000600
WPDMA_RX1 CIDX 000000ea
WPDMA_RX1 DIDX 000000eb
======== WPDMA RX:
WED_WPDMA_RX_D_MIB(0) 00000000
WED_WPDMA_RING_RX_DATA(0) BASE 00000000
WED_WPDMA_RING_RX_DATA(0) CNT 00000000
WED_WPDMA_RING_RX_DATA(0) CIDX 00000fff
WED_WPDMA_RING_RX_DATA(0) DIDX 00000000
WED_WPDMA_RX_D_PROCESSED_MIB(0) 00000000
WED_WPDMA_RX_D_MIB(1) 000000eb
WED_WPDMA_RING_RX_DATA(1) BASE 4a7c0000
WED_WPDMA_RING_RX_DATA(1) CNT 00000600
WED_WPDMA_RING_RX_DATA(1) CIDX 00eb00ea
WED_WPDMA_RING_RX_DATA(1) DIDX 000000eb
WED_WPDMA_RX_D_PROCESSED_MIB(1) 000000eb
WED_WPDMA_RX_D_COHERENT_MIB 00000000
======== WED RX:
WED_RING_RX_DATA(0) BASE 00000000
WED_RING_RX_DATA(0) CNT 00000000
WED_RING_RX_DATA(0) CIDX 00000000
WED_RING_RX_DATA(0) DIDX 00000000
WED_RING_RX_DATA(1) BASE 4a7b8000
WED_RING_RX_DATA(1) CNT 00000600
WED_RING_RX_DATA(1) CIDX 0000004f
WED_RING_RX_DATA(1) DIDX 00000050
======== WED WO RRO:
WED_RRO_MIOD BASE 151f8000
WED_RRO_MIOD CNT 00000010
WED_RRO_MIOD CIDX 0000000b
WED_RRO_MIOD DIDX 0000000b
WED_RROQM_MID_MIB 000000eb
WED_RROQM_MOD_MIB 000000eb
WED_RROQM_MOD_COHERENT_MIB 00000000
WED_RRO_FDBK BASE 151f8800
WED_RRO_FDBK CNT 00000400
WED_RRO_FDBK CIDX 000000eb
WED_RRO_FDBK DIDX 00eb00eb
WED_RROQM_FDBK_IND_MIB 000000eb
WED_RROQM_FDBK_ENQ_MIB 00000000
WED_RROQM_FDBK_ANC_MIB 00000000
WED_RROQM_FDBK_ANC2H_MIB 00000000
======== WED WDMA TX:
WED_WDMA_TX_MIB 009b009b
WED_WDMA_RING_TX BASE 00000000
WED_WDMA_RING_TX CNT 00000000
WED_WDMA_RING_TX CIDX 00000001
WED_WDMA_RING_TX DIDX 00000000
======== WDMA TX:
WDMA_GLO_CFG 58404e77
WDMA_RING_TX(0) BASE 00000000
WDMA_RING_TX(0) CNT 00000000
WDMA_RING_TX(0) CIDX 00000001
WDMA_RING_TX(0) DIDX 00000000
WDMA_RING_TX(1) BASE 4a7c8000
WDMA_RING_TX(1) CNT 00000400
WDMA_RING_TX(1) CIDX 00000000
WDMA_RING_TX(1) DIDX 00000000
======== WED RX BM:
WED_RX_BM_BASE 4b400000
WED_RX_BM_RX_DMAD 000006c0
WED_RX_BM_PTR 16f93050
WED_RX_BM_TKID_MIB 000016e9
WED_RX_BM_BLEN 00000000
WED_RX_BM_STS 01100000
WED_RX_BM_INTF2 00007800
WED_RX_BM_INTF 00000000
WED_RX_BM_ERR_STS 00000000
======== WED Route QM:
WED_RTQM_R2H_MIB(0) 00000000
WED_RTQM_R2Q_MIB(0) 00000000
WED_RTQM_Q2H_MIB(0) 00000000
WED_RTQM_R2H_MIB(1) 00000050
WED_RTQM_R2Q_MIB(1) 0000009b
WED_RTQM_Q2H_MIB(1) 00000000
WED_RTQM_Q2N_MIB 0000009b
WED_RTQM_Q2B_MIB 00000000
WED_RTQM_PFDBK_MIB 00000000
root at W6m:/sys/kernel/debug/wed1# cat txinfo
======== WED TX:
WED_TX_MIB(0) 00000000
WED_RING_TX(0) BASE 00000000
WED_RING_TX(0) CNT 00000000
WED_RING_TX(0) CIDX 00000000
WED_RING_TX(0) DIDX 00000000
WED_TX_MIB(1) 0000002b
WED_RING_TX(1) BASE 49f10000
WED_RING_TX(1) CNT 00000800
WED_RING_TX(1) CIDX 0000002b
WED_RING_TX(1) DIDX 0000002b
======== WPDMA TX:
WED_WPDMA_TX_MIB(0) 00000000
WED_WPDMA_RING_TX(0) BASE 00000000
WED_WPDMA_RING_TX(0) CNT 00000000
WED_WPDMA_RING_TX(0) CIDX 00000000
WED_WPDMA_RING_TX(0) DIDX 00000000
WED_WPDMA_TX_COHERENT_MIB(0) 00000000
WED_WPDMA_TX_MIB(1) 0000002b
WED_WPDMA_RING_TX(1) BASE 49f18000
WED_WPDMA_RING_TX(1) CNT 00000800
WED_WPDMA_RING_TX(1) CIDX 002b002b
WED_WPDMA_RING_TX(1) DIDX 0000002b
WED_WPDMA_TX_COHERENT_MIB(1) 00000000
======== WPDMA TX:
WPDMA_TX0 BASE 00000000
WPDMA_TX0 CNT 00000000
WPDMA_TX0 CIDX 00000000
WPDMA_TX0 DIDX 00000000
WPDMA_TX1 BASE 49f18000
WPDMA_TX1 CNT 00000800
WPDMA_TX1 CIDX 0000002b
WPDMA_TX1 DIDX 0000002b
======== WED WDMA RX:
WED_WDMA_RX_MIB(0) 00000000
WED_WDMA_RING_RX(0) BASE 44f40000
WED_WDMA_RING_RX(0) CNT 00000010
WED_WDMA_RING_RX(0) CIDX 0000000f
WED_WDMA_RING_RX(0) DIDX 00000000
WED_WDMA_RX_THRES(0) 00040020
WED_WDMA_RX_RECYCLE_MIB(0) 00000000
WED_WDMA_RX_PROCESSED_MIB(0) 00000000
WED_WDMA_RX_MIB(1) 00000000
WED_WDMA_RING_RX(1) BASE 49f20000
WED_WDMA_RING_RX(1) CNT 00000400
WED_WDMA_RING_RX(1) CIDX 000003ff
WED_WDMA_RING_RX(1) DIDX 00000000
WED_WDMA_RX_THRES(1) 00040020
WED_WDMA_RX_RECYCLE_MIB(1) 00000000
WED_WDMA_RX_PROCESSED_MIB(1) 00000000
======== WDMA RX:
WDMA_GLO_CFG 58404e77
WDMA_RING_RX(0) BASE 44f40000
WDMA_RING_RX(0) CNT 00000010
WDMA_RING_RX(0) CIDX 0000000f
WDMA_RING_RX(0) DIDX 00000000
WDMA_RING_RX(1) BASE 49f20000
WDMA_RING_RX(1) CNT 00000400
WDMA_RING_RX(1) CIDX 000003ff
WDMA_RING_RX(1) DIDX 00000000
======== WED TX FREE:
WED_RX_MIB(0) 00000bed
WED_RING_RX(0) BASE 42784000
WED_RING_RX(0) CNT 00000200
WED_RING_RX(0) CIDX 000001ec
WED_RING_RX(0) DIDX 000001ed
WED_WPDMA_RX_COHERENT_MIB(0) 00000000
WED_RX_MIB(1) 00000000
WED_RING_RX(1) BASE 00000000
WED_RING_RX(1) CNT 00000000
WED_RING_RX(1) CIDX 00000000
WED_RING_RX(1) DIDX 00000000
WED_WPDMA_RX_COHERENT_MIB(1) 00000000
======== WED WPDMA TX FREE:
WED_WPDMA_RING_RX(0) BASE 42784000
WED_WPDMA_RING_RX(0) CNT 00000200
WED_WPDMA_RING_RX(0) CIDX 01ed01ec
WED_WPDMA_RING_RX(0) DIDX 000001ed
WED_WPDMA_RING_RX(1) BASE 00000000
WED_WPDMA_RING_RX(1) CNT 00000000
WED_WPDMA_RING_RX(1) CIDX 00000000
WED_WPDMA_RING_RX(1) DIDX 00000000
Best regards,
Zhi-Jun
More information about the Linux-mediatek
mailing list