ath10k: qca4019: FW crash on 5GHz when baseEepHeader.nonLinearTxFir == 1

[Sven Eckelmann]

Hi,

I've just wanted to test openwrt-21.02 (with ath10k-firmware-qca4019 + kmod-
ath10k) on an Plasma Cloud PA1200 router. While this device worked fine in the 
past, with this upgrade (to the newest firmware from linux-firmware), the 5GHz 
radio firmware seems to crash whenever I set it up via `ifconfig wlan1 up`:

    ath10k_ahb a800000.wifi: firmware crashed! (guid 9e36ee82-4d2c-4c63-b20b-609a1eaca30c)
    ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
    ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
    ath10k_ahb a800000.wifi: firmware ver 10.4-3.6-00140 api 5 features no-p2p,mfp,peer-flow-ctrl,btcoex-param,allows-mesh-bcast,no-ps crc32 ba79b746
    ath10k_ahb a800000.wifi: board_file api 2 bmi_id 0:17 crc32 5f400efc
    ath10k_ahb a800000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 512 raw 0 hwcrypto 1
    ath10k_ahb a800000.wifi: firmware register dump:
    ath10k_ahb a800000.wifi: [00]: 0x0000000B 0x000015B3 0x009C3C27 0x00975B31
    ath10k_ahb a800000.wifi: [04]: 0x009C3C27 0x00060530 0x00000018 0x004176B8
    ath10k_ahb a800000.wifi: [08]: 0x00405A50 0x00412A30 0x00000000 0x00000000
    ath10k_ahb a800000.wifi: [12]: 0x00000009 0x00000000 0x009B9742 0x009B974F
    ath10k_ahb a800000.wifi: [16]: 0x00971238 0x009B9742 0x00000000 0x00000000
    ath10k_ahb a800000.wifi: [20]: 0x409C3C27 0x004053DC 0x00000D2C 0x00405A60
    ath10k_ahb a800000.wifi: [24]: 0x809C3E13 0x0040543C 0x00000000 0xC09C3C27
    ath10k_ahb a800000.wifi: [28]: 0x809B9AC5 0x0040547C 0x00412A30 0x0040549C
    ath10k_ahb a800000.wifi: [32]: 0x809B8ECD 0x0040549C 0x00000001 0x00412A30
    ath10k_ahb a800000.wifi: [36]: 0x809B8FF3 0x004054CC 0x00412838 0x00000014
    ath10k_ahb a800000.wifi: [40]: 0x809BEF98 0x0040551C 0x0041627C 0x00000002
    ath10k_ahb a800000.wifi: [44]: 0x80986D47 0x0040553C 0x0041627C 0x00416A88
    ath10k_ahb a800000.wifi: [48]: 0x809CBB0A 0x0040559C 0x0041ACC0 0x00000000
    ath10k_ahb a800000.wifi: [52]: 0x809864EE 0x0040560C 0x0041ACC0 0x00000001
    ath10k_ahb a800000.wifi: [56]: 0x809CA8A4 0x0040564C 0x0041ACC0 0x00000001
    ath10k_ahb a800000.wifi: Copy Engine register dump:
    ath10k_ahb a800000.wifi: [00]: 0x0004a000  14  14   3   3
    ath10k_ahb a800000.wifi: [01]: 0x0004a400  16  16  22  23
    ath10k_ahb a800000.wifi: [02]: 0x0004a800   3   3   2   3
    ath10k_ahb a800000.wifi: [03]: 0x0004ac00  15  15  15  15
    ath10k_ahb a800000.wifi: [04]: 0x0004b000   4   4  44   4
    ath10k_ahb a800000.wifi: [05]: 0x0004b400   3   3   2   3
    ath10k_ahb a800000.wifi: [06]: 0x0004b800   1   1   1   1
    ath10k_ahb a800000.wifi: [07]: 0x0004bc00   1   1   1   1
    ath10k_ahb a800000.wifi: [08]: 0x0004c000   0   0 127   0
    ath10k_ahb a800000.wifi: [09]: 0x0004c400   0   0   0   0
    ath10k_ahb a800000.wifi: [10]: 0x0004c800   0   0   0   0
    ath10k_ahb a800000.wifi: [11]: 0x0004cc00   0   0   0   0
    ath10k_ahb a800000.wifi: failed to update channel list: -108
    ath10k_ahb a800000.wifi: failed to set pdev regdomain: -108
    ath10k_ahb a800000.wifi: failed to create WMI vdev 0: -108
    ieee80211 phy1: Hardware restart was requested

Interestingly, the crash disappeared when I've changed 
baseEepHeader.nonLinearTxFir (offset 0xc2 in the BDF) from 1 to 0.

The device itself was using firmware 10.4-3.6-00140 (the version currently in 
linux-firmware) - a working firmware is 10.4-3.5.3-00078. I also wanted to 
"bisected" when this problem was introduced but there are only these two 
recent firmware version available in Kalle's ath10k-firmware repository.

Does anybody know more about it?

Kind regards,
	Sven
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bus=ahb,bmi-chip-id=0,bmi-board-id=17,variant=PlasmaCloud-PA1200.bin
Type: application/octet-stream
Size: 12064 bytes
Desc: not available
URL: <http://lists.openwrt.org/pipermail/openwrt-devel/attachments/20210917/3c820898/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.openwrt.org/pipermail/openwrt-devel/attachments/20210917/3c820898/attachment-0001.sig>