qca6174 hw2.1 fw and kernel crash on 5GHz network connection attempt

[Michal Kazior]

On 5 August 2015 at 15:25, Lapo Calamandrei <calamandrei at gmail.com> wrote:
> Hi,
>
> I have an alienware 17 r2 with a fedora 22 installed, I'm using kvalo
> ath kernel master branch from today, built with fedora rawhide
> 4.2.0-rc4 kernel config. The firmware is made following the
> instructions on the list by the windows drivers.
> I'm using skip_otp=1 on ath10k_core and irq_mode=1 on ath10k_pci
> otherwise I run into the same issues reported by Enrico Tagliavini.
> Everything works reasonably well on my 2.4GHz network, but trying to
> connect to my other 5Ghz I get a firmware crash followed by a kernel
> crash. Attached a dmesg output, feel free to ask any additional info.

There's no kernel crash here. It's just a warning splat with call
trace. This happens because - apparently - the device double-crashed
and got wedged so mac80211 complained verbosely.

The firmware crash itself seems to be related to TxBF. I'm guessing
the firmware wrongly advertises vht capabilities and crashes when
associating to TxBF capable AP.

As a temporary measure (and confirmation) you can try the diff below
(warning, whitespace damaged).


Michał



--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6732,23 +6732,10 @@ static struct ieee80211_sta_vht_cap
ath10k_create_vht_cap(struct ath10k *ar)
        vht_cap.vht_supported = 1;
        vht_cap.cap = ar->vht_cap_info;

-       if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
-                               IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)) {
-               val = ar->num_rf_chains - 1;
-               val <<= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
-               val &= IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
-
-               vht_cap.cap |= val;
-       }
-
-       if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
-                               IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
-               val = ar->num_rf_chains - 1;
-               val <<= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT;
-               val &= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK;
-
-               vht_cap.cap |= val;
-       }
+       ar->vht_cap_info &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+                             IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
+                             IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+                             IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE);

        mcs_map = 0;
        for (i = 0; i < 8; i++) {