AP mode firmware crash on QCA9880-BR4A

[Michal Kazior]

On 12 July 2015 at 22:05, Martin Blumenstingl
<martin.blumenstingl at googlemail.com> wrote:
> Hello,
>
> I have two devices with chips that are supported by ath10k.
> One uses a QCA9880-BR4A, the other has a QCA9558-AT4A.
>
> The device with QCA9558-AT4A is working fine.
> However, the other one is experiencing firmware crashes.
> You can find the dmesg output below and here: [0].
>
> Those crashes are firmware related. Here is what I have tested on QCA9880-BR4A:
> - firmware-2.bin_10.1.467.bin is NOT crashing
> - firmware-3.bin_10.2.2.39.bin is crashing
> - firmware-4.bin_10.2.4.bin is also crashing
> - firmware-5.bin_10.2.4.70-2 is crashing as well
>
> As a side-note: Both devices are running OpenWrt.
> I am pretty sure that my caldata is correct on both devices.
> Also I am not the only one affected by this bug, see [1]

Thanks for testing and reporting it back to upstream ;-) I rarely look
at OpenWRT buglist.


>
> Please let me know if more information is required.

It is always good to see either debugs or traces to know what happened
before a crash. Your build doesn't seem to contain either at the
moment though.


>
>
> Regards,
> Martin
>
> [0] https://paste.kde.org/pzcauwdpb
> [1] https://dev.openwrt.org/ticket/19167
>
>
> [   11.544000] Loading modules backported from Linux version
> master-2015-06-22-0-g4732c92
> [   11.552000] Backport generated by backports.git backports-20150626-0-gc1a4168

I see you're using a pretty recent openwrt snapshot.

By looking at SVN changesets I can see that otp bypass patch has been
removed[1] in favour of caldata approach[2]. With this OTP is not even
executed. If I assume the caldata extracted from flash partition isn't
complete then it could lead to firmware crash.

[1]: https://dev.openwrt.org/changeset/46245
[2]: https://dev.openwrt.org/changeset/46244

Can you please try do the following:

 cd /lib/firmware/ath10k/QCA988X/hw2.0/
 mv caldata.bin board.bin
 rmmod ath10k_pci
 echo 1 > /sys/module/ath10k_core/parameters/skip_otp
 modprobe ath10k_pci
 wifi

(not tested; could include typos/errors but should be enough for you
to get the idea)


[...]
> [   28.952000] ath10k_pci 0000:02:00.0: firmware crashed! (uuid
> adba4793-5d11-4002-b3ac-9be37592db2e)
> [   28.960000] ath10k_pci 0000:02:00.0: qca988x hw2.0 (0x4100016c,
> 0x043202ff) fw 10.2.4.70-2 api 5 htt 2.1 wmi 5 cal file max_sta 128
> [   28.972000] ath10k_pci 0000:02:00.0: debug 1 debugfs 1 tracing 0
> dfs 1 testmode 1
> [   28.992000] ath10k_pci 0000:02:00.0: failed to read diag value at
> 0x1c100804: -16
> [   28.996000] ath10k_pci 0000:02:00.0: failed to get memcpy hi
> address for firmware address 4: -16
> [   29.004000] ath10k_pci 0000:02:00.0: failed to read firmware dump area: -16
> [   29.100000] ieee80211 phy0: Hardware restart was requested
> [   29.304000] ath10k_pci 0000:02:00.0: failed to read diag value at
> 0x1c100800: -16
> [   29.308000] ath10k_pci 0000:02:00.0: failed to poke copy engine: -16
> [   29.428000] ath10k_pci 0000:02:00.0: failed to read diag value at
> 0x1c100800: -16
> [   29.432000] ath10k_pci 0000:02:00.0: failed to poke copy engine: -16
> [   29.556000] ath10k_pci 0000:02:00.0: failed to read diag value at
> 0x1c100800: -16
> [   29.560000] ath10k_pci 0000:02:00.0: failed to poke copy engine: -16

This looks hairy. Device crashes so hard it's impossible to read out
the crash dump..


Michał