Banana Pi R4 Kernel Reboot on ip link set eth1 down with SFP-10G-T

Banana Pi Router design BPI-R4/BPI-R4 Pro(MT7988)
1

Hello,

I would like to ask about an issue I’m encountering with the Banana Pi R4 when using an SFP-10G-T module (10GBase-T copper).

Whenever I run the following command on debian11 via SSH:

ip link set dev eth1 down

The system immediately reboots. This seems to trigger a kernel panic or watchdog reset. I’ve tested this multiple times, and it is consistently reproducible.

[  140.149317] Kernel panic - not syncing: Fatal exception
[  140.152177] sfp sfp@1: SM: exit present:up:wait
[  140.155379] SMP: stopping secondary CPUs
[  140.155391] Kernel Offset: disabled
[  140.155394] CPU features: 0x10002,20002008
[  140.155395] Memory Limit: none
[  140.206505] Rebooting in 1 seconds..
PANIC at PC : 0x000000004300495c

F0: 102B 0000
FA: 1042 0000
FA: 1042 0000 [0200]
F9: 1041 0000
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 380E 5012
F5: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0600 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [3000]
MK: 0000 0000 [0000]
T0: 0000 014B [0101]
Jump to BL

NOTICE:  BL2: v2.9.0(release):BPI-R4 v2023-10-13-0ea67d76-1 (mt7988-sdmmc-ddr4)
NOTICE:  BL2: Built : 12:20:42, Jan 28 2024
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  CPU: MT7988
NOTICE:  EMI: Using DDR unknown settings
NOTICE:  EMI: Detected DRAM size: 4096 MB
NOTICE:  EMI: complex R/W mem test passed

Is this a known issue with the SFP interface or the driver for the MT7988 SoC?

Any recommendations on how to safely bring down the interface or apply a MAC address change without crashing the system?

Thanks in advance for your help.

2

Set the desired mac address before bringing it up?

With systemd-networkd, you can do this in the .network file, or create a .link file.

3

When talking about debian 11 i guess you use the image provided by sinovoip and its kernel (afaik 5.4),right?

I guess there is a crash when putting eth1 down,and you should see a trace on debuguart. But i would not put much effort in this old image/kernel and suggest trying my debian 12 image with kernel 6.12.

4

Yes correct it from sinovoip version

The problem is cannot move forward to any other debian because I did many things and rebuild hostapd and some other things depended on networking So my firewall product now very stable on currect debian only thing left is the ethernet down issue

If possible provide me how to resolve the issue ?

Thanks alot

5

i guess it is a kernel issue and not debian, but you have to take output (should see a trace) via uart when try to put the link down…and then try to find rootcause for this and patch it…not that easy but without this trace we have no idea what caused this reboot

1 Like
6

Work with a more up to date kernel…

Try ubuntu, it may have a more up to date hostapd

1 Like
7

It is goog idea But I have done my current debian11 from about 2 years ago until now So I cannot remember every single modification I did, Because it has to be very stable for firewall and IDS/IPS

So very it is difficult to move to other debian or ubuntu

I will leave this solution to the last option If we couldn’t resolve it so I have this only option that make it very difficult for implementation but no other way

I wished my firewall to be work on home use and small enterprise usage but some times like this issue it make the time longer to lease the product

8

I will try to provide the uart logs I really hope resolve the issue

Thanks in advance

9 
root@:~# date
Sat 17 May 13:08:39 CEST 2025
root@almaos:~# ip link set eth1 down
[121493.088173] sfp sfp@1: SM: enter present:up:link_up event dev_down
[121493.294881] mtk_soc_eth 15100000.ethernet eth1: resolve link status: system iface=1, line iface=0
[121493.303881] mtk_soc_eth 15100000.ethernet eth1: Link is Down
[121493.387061] sfp sfp@1: tx disable 0 -> 1
[121493.391126] sfp sfp@1: SM: exit present:down:down
root@:~# [121493.405601] sfp sfp@1: SM: enter present:down:down event los_high
[121493.411845] sfp sfp@1: SM: exit present:down:down
[121493.868858] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000180
[121493.877739] Mem abort info:
[121493.880607]   ESR = 0x96000005
[121493.883751]   EC = 0x25: DABT (current EL), IL = 32 bits
[121493.889143]   SET = 0, FnV = 0
[121493.892272]   EA = 0, S1PTW = 0
[121493.895493] Data abort info:
[121493.898453]   ISV = 0, ISS = 0x00000005
[121493.902367]   CM = 0, WnR = 0
[121493.905416] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000dae00000
[121493.911949] [0000000000000180] pgd=0000000000000000, pud=0000000000000000
[121493.918819] Internal error: Oops: 96000005 [#1] SMP
[121493.923771] Modules linked in: ccm mt7996e mt76_connac_lib mt76 mac80211 l2tp_ppp l2tp_netlink l2tp_core cfg80211 compat nls_iso8859_1 nls_cp437 nft_masq nft_objref nft_queue nft_chain_nat nf_nat sunrpc ip_tables autofs4
[121493.943405] CPU: 2 PID: 4244 Comm: aqr107_mib_thre Not tainted 5.4.260 #3
[121493.950264] Hardware name: Bananapi BPI-R4 (DT)
[121493.954869] pstate: 80000005 (Nzcv daif -PAN -UAO)
[121493.959740] pc : __phy_read_mmd+0x20/0xa0
[121493.963823] lr : phy_read_mmd+0x38/0x60
[121493.967732] sp : ffffffc011eb3d90
[121493.971121] x29: ffffffc011eb3d90 x28: 0000000000000000
[121493.976506] x27: ffffff80e0d39738 x26: ffffffc010beec38
[121493.981891] x25: ffffffc010642f90 x24: ffffff80f280c800
[121493.987274] x23: ffffffc010feb908 x22: ffffffc011eb3e3c
[121493.992659] x21: 000000000000e811 x20: 0000000000000003
[121493.998043] x19: ffffff80f280c800 x18: 0000000000000000
[121494.003426] x17: 0000000000000000 x16: 0000000000000000
[121494.008810] x15: 0000000000000000 x14: 0000000000000000
[121494.014195] x13: 0000000000000000 x12: 0000000000000001
[121494.019578] x11: 0000000000000000 x10: 0000000000000880
[121494.024962] x9 : ffffffc011eb3d00 x8 : ffffff80fa16af20
[121494.030346] x7 : 0000000000000800 x6 : 0000000000000000
[121494.035730] x5 : 0000000000000000 x4 : 0000000000000000
[121494.041114] x3 : ffffff80f280c800 x2 : 000000000000e811
[121494.046499] x1 : 0000000000000003 x0 : ffffff80f280c800
[121494.051884] Call trace:
[121494.054407]  __phy_read_mmd+0x20/0xa0
[121494.058143]  phy_read_mmd+0x38/0x60
[121494.061707]  aqr107_mib_read_word+0x2c/0x60
[121494.065964]  aqr107_mib_read+0x24/0x200
[121494.069873]  aqr107_mib_thread+0x20/0x50
[121494.073871]  kthread+0x128/0x130
[121494.077176]  ret_from_fork+0x10/0x18
[121494.080829] Code: a9be7bfd aa0003e3 910003fd f9418405 (f940c0a5)
[121494.086996] ---[ end trace 221494c71315648b ]---
[121494.095851] Kernel panic - not syncing: Fatal exception
[121494.101154] SMP: stopping secondary CPUs
[121494.105155] Kernel Offset: disabled
[121494.108719] CPU features: 0x10002,20002008
[121494.112889] Memory Limit: none
[121494.120184] Rebooting in 1 seconds..
PANIC at PC : 0x000000004300495c

F0: 102B 0000
FA: 1042 0000
FA: 1042 0000 [0200]
F9: 1041 0000
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 380E 5012
F5: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0600 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [3000]
MK: 0000 0000 [0000]
T0: 0000 014E [0101]
Jump to BL

NOTICE:  BL2: v2.9.0(release):BPI-R4 v2023-10-13-0ea67d76-1 (mt7988-sdmmc-ddr4)
NOTICE:  BL2: Built : 12:20:42, Jan 28 2024
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  CPU: MT7988
NOTICE:  EMI: Using DDR unknown settings
NOTICE:  EMI: Detected DRAM size: 4096 MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.9.0(release):BPI-R4 v2023-10-13-0ea67d76-1 (mt7988-sdmmc-ddr4)
NOTICE:  BL31: Built : 12:20:49, Jan 28 2024


U-Boot 2024.01-BPI-R4-r24894-4d30d371e7 (Jan 28 2024 - 12:21:09 +0800)

CPU:   MediaTek MT7988
Model: Bananapi BPI-R4
DRAM:  4 GiB
Core:  63 devices, 23 uclasses, devicetree: embed
spi-nand: spi_nand spi_nand@0: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
MMC:   mmc@11230000: 0
Loading Environment from MMC... OK
In:    serial@11000000
Out:   serial@11000000
Err:   serial@11000000
reset button found
Loading Environment from MMC... OK
Net:   eth0: ethernet@15100000
Cannot read EFI system partition
Cannot read EFI system partition
Failed to persist EFI variables
Cannot read EFI system partition
Failed to persist EFI variables
Cannot read EFI system partition
Failed to persist EFI variables
Cannot read EFI system partition
Failed to persist EFI variables
Cannot read EFI system partition
Failed to persist EFI variables

        ( ( ( OpenWrt ) ) )  [SD card]       U-Boot 2024.01-BPI-R4-r24894-4d30d371e7 (Jan 28 2024 - 12:21:09 +0800)

      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from SD card.
      4. Boot recovery system from SD card.
      5. Load production system via TFTP then write to SD card.
      6. Load recovery system via TFTP then write to SD card.
      7. Install bootloader, recovery and production to NAND.
      8. Reboot.
      9. Reset all settings to factory defaults.
      mmc 0:5
      mmc 0:6
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC to quit
MT7988> 3;317R

here is what I see from serial port

please note the end MT7988> 3;317R

10

Interesting parts are:

So access to a var which is null

And the location

First 2 i guess are in mmd core,so you have to fix in aqr107_mib_read_word.

Add some printk in __phy_read_mmd to find out,which var is not set,and/or find call of phy_read_mmd in aqr107_mib_read_word.

I guess something in aqr107_mib_read_word tries to read after phy is detached.maybe order in release the phy is wrong.

11

can you please provide me steps how to do that if possible??

because I dont have experience with these thing

12

The first is a lot more easier to do then the second. That you have done before…