[ath11k] Roaming latency with Compex WLE300HX (QCN9074) — firmware/driver issue/Latency

[Aliliche Larbi]

Hello,

I am experiencing persistent roaming latency with a Compex WLE300HX
(QCN9074-based) Wi-Fi 6 PCIe card using the ath11k driver.

I have a roaming test platform with multiple APs and controllable
attenuators.

The roaming test is performed between two 11a access points:
- AP1 on channel 36
- AP2 on channel 149

Using Wireshark monitors, I measured the time between:
1) the last data packet on channel 36, and
2) the first data packet on channel 149.

I tested four devices:

1. ACKSYS Railbox (WLE300HX), firmware QCN9074:
   https://git.codelinaro.org/clo/ath-firmware/ath11k-firmware.git

2. 8devices Mango kit, CPU IPQ6018 + WLE300HX (QCN9074 firmware)

3. ACKSYS Airwave, CPU IPQ6018 + QCA firmware:
   https://github.com/andreybondar59/firmware_qca-wireless

4. Moxa AWK-1161C, CPU IPQ6010, firmware unknown

Roaming time (last data packet on ch36 → first data packet on ch149):
- Moxa: ~104 ms
- Railbox: ~180 ms
- AirWave: ~104 ms
- Mango: ~140 ms

Wireshark measurement (last data packet ch36 → authentication response ch149):
- Moxa: ~44 ms
- Railbox: ~101 ms
- AirWave: ~51 ms
- Mango: ~100 ms

I traced the Railbox using ftrace and extracted several WMI commands and
their response times, from the last data packet on channel 36 until
authentication success on channel 149:

subif_start_xmit -> wmi_install_key_cmdid: 19.9 ms
wmi_install_key_cmdid -> wmi_install_key_cmdid_response: 1.2 ms
wmi_install_key_cmdid_response -> wmi_perr_delete_cmdid: 0.26 ms
wmi_perr_delete_cmdid -> wmi_perr_delete_cmdid_response: 5 ms
wmi_perr_delete_cmdid_response -> ath11k_mac_vdev_stop(): 0.5 ms
ath11k_mac_vdev_stop() -> wmi_vdev_stop_cmdid: 19.3 ms
wmi_vdev_stop_cmdid -> wmi_vdev_stop_cmdid_response: 0.27 ms
wmi_vdev_stop_cmdid_response -> ath11k_wmi_vdev_start(): 0.03 ms
ath11k_wmi_vdev_start() -> wmi_vdev_start_cmdid: 6.3 ms
wmi_vdev_start_cmdid -> wmi_vdev_start_cmdid_response: 38.7 ms
wmi_vdev_start_cmdid_response -> ieee80211_mgd_auth: 18.7 ms
ieee80211_mgd_auth -> wmi_send_auth_req_cmdid: 5 ms
wmi_send_auth_req_cmdid -> wmi_send_auth_req_cmdid_completed: 2.7 ms
wmi_send_auth_req_cmdid_completed -> wmi_rx_auth_response: 1.39 ms
wmi_rx_auth_response -> ieee80211_mark_sta_authenticated(): 3.57 ms

Total: ~123 ms between the last packet on ch36 and authentication
success on ch149

Note: These timings are specific to the Railbox (QCN9074).
The Airwave (IPQ6018 + QCA firmware) behaves differently; for instance,
the vdev start command responds in ~10 ms on the Airwave firmware.

Given this, it seems the QCN9074 firmware responds significantly slower.

What are the differences between the WLE300HX QCN9074 firmware and the
QCA firmware used on the Airwave device? Is there anything that can be
tuned or configured to reduce roaming latency?


Thank you,
Larbi
------------------------------------------------------wireshark
measures in ms--------------------------------------------------
Event                         | MOXA         | RailboxV2 + WLE3000HX
  |AirWave (New FW)     | Mango + WLE3000HX
--------------------------+-------------------+--------------------------------------+-----------------------------+-------------------
LAST DATA PACKET    | T0                | T0
                | T0                       | T0

Disassociate                  | T0+{16}       | XX
                      | Deauth XX          | XX
Auth request                  | T0+{42}       | T0+{94;97}
                  | T0+{48}               | T0+{96}
Auth response               | T0+{44}       | T0+{98;101}
               | T0+{51}               | T0+{99}
Assoc request                | T0+{46}      | T0+{113;116}
              | T0+{57}               | T0+{104}
Assoc response             | T0+{51}      | T0+{115;118}
            | T0+{58}               | T0+{106}
EAPOL 1/4                    | T0+{61}       | T0+{123;126}
               | T0+{67}               | T0+{113}
EAPOL 2/4                    | T0+{64}      | T0+{142;144}
               | T0+{73}               | T0+{124}
EAPOL 3/4                    | T0+{67}      | T0+{145;147}
               | T0+{76}               | T0+{125}
EAPOL 4/4                    | T0+{68}      | T0+{148;151}
               | T0+{78}               | T0+{129}

LAST DATA PACKET    | T0+{104}    | T0+{177;197}
     | T0+{104}             | T0+{140}