linux-kernel - QCA6174 connection issues when loading board firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20220203094137.110313-1-y.oudjana@protonmail.com>
Date:   Thu, 03 Feb 2022 09:42:24 +0000
From:   Yassine Oudjana <y.oudjana@...tonmail.com>
To:     ath10k@...ts.infradead.org
Cc:     Yassine Oudjana <y.oudjana@...tonmail.com>,
        linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: QCA6174 connection issues when loading board firmware

(Scroll down for tl;dr)

Hi,

I'm trying to fix a poor WiFi range issue with QCA6174 on the Xiaomi Mi
Note 2, an Android phone that I'm running the mainline kernel on.

Running `nmcli d wifi list --rescan yes` only shows the router that I'm
sitting next to with weak signal. I'm able to connect to it and use it
but with fluctuating speed. There are many other networks in the area
but none of them are found.

I found that this is caused by the lack of board firmware for this device.
Using the firmware from linux-firmware, this is what I get in dmesg
from ath10k:

[  132.079112] ath10k_pci 0000:01:00.0: qca6174 hw3.2 target 0x05030000 chip_id 0x00342aff sub 0000:0000
[  132.079161] ath10k_pci 0000:01:00.0: kconfig debug 1 debugfs 1 tracing 1 dfs 0 testmode 0
[  132.079538] ath10k_pci 0000:01:00.0: firmware ver WLAN.RM.4.4.1-00157-QCARMSWPZ-1 api 6 features wowlan,ignore-otp,mfp crc32 90eebefb
[  132.151817] ath10k_pci 0000:01:00.0: failed to fetch board data for bus=pci,vendor=168c,device=003e,subsystem-vendor=0000,subsystem-device=0000 from ath10k/QCA6174/hw3.0/board-2.bin
[  132.152968] ath10k_pci 0000:01:00.0: board_file api 1 bmi_id N/A crc32 ed5f849a
[  132.248837] ath10k_pci 0000:01:00.0: htt-ver 3.60 wmi-op 4 htt-op 3 cal otp max-sta 32 raw 0 hwcrypto 1
[  132.333615] ath: EEPROM regdomain: 0x6c
[  132.333654] ath: EEPROM indicates we should expect a direct regpair map
[  132.333676] ath: Country alpha2 being used: 00
[  132.333693] ath: Regpair used: 0x6c
[  132.377571] ath10k_pci 0000:01:00.0 wlp1s0: renamed from wlan0

After seeing this line:

[  132.151817] ath10k_pci 0000:01:00.0: failed to fetch board data for bus=pci,vendor=168c,device=003e,subsystem-vendor=0000,subsystem-device=0000 from ath10k/QCA6174/hw3.0/board-2.bin

I tried to add the board firmware, which I extracted from the device's
vendor partition. I got a bd30_a4.bin file which is originally loaded by the
QCA_CLD driver of the stock downstream kernel used in Android. I used
ath10k-bdencoder to pack it into a board-2.bin file using this json, which
has the names property taken from the error in dmesg:

[
  {
          "data": "bdf/bd30_a4.bin",
          "names": ["bus=pci,vendor=168c,device=003e,subsystem-vendor=0000,subsystem-device=0000"]
  }
]

(I placed bd30_a4.bin and this json in a "bdf" directory in the same path
as ath10k-bdencoder)

Using the new board-2.bin which I placed in /lib/firmware/ath10k/QCA6174/hw3.0,
ath10k_pci no longer complains about missing board firmware:

[  136.169440] ath10k_pci 0000:01:00.0: qca6174 hw3.2 target 0x05030000 chip_id 0x00342aff sub 0000:0000
[  136.169579] ath10k_pci 0000:01:00.0: kconfig debug 1 debugfs 1 tracing 1 dfs 0 testmode 0
[  136.170347] ath10k_pci 0000:01:00.0: firmware ver WLAN.RM.4.4.1-00157-QCARMSWPZ-1 api 6 features wowlan,ignore-otp,mfp crc32 90eebefb
[  136.236498] ath10k_pci 0000:01:00.0: board_file api 2 bmi_id N/A crc32 9eaa9261
[  136.338639] ath10k_pci 0000:01:00.0: htt-ver 3.60 wmi-op 4 htt-op 3 cal otp max-sta 32 raw 0 hwcrypto 1
[  136.421749] ath: EEPROM regdomain sanitized
[  136.421771] ath: EEPROM regdomain: 0x64
[  136.421782] ath: EEPROM indicates we should expect a direct regpair map
[  136.421794] ath: Country alpha2 being used: 00
[  136.421802] ath: Regpair used: 0x64
[  136.465447] ath10k_pci 0000:01:00.0 wlp1s0: renamed from wlan0

And now, running `nmcli d wifi list --rescan yes` shows several networks
with good signal strength similar to what I get in Android. However,
as soon as I try to connect to any network, it fails to connect saying
the network is not found, and when listing networks again, I get an empty
list. the networks appear again after a few seconds, but trying to connect
causes the same issue making it impossible to connect to any network.

No messages from ath10k appear in dmesg when this happens. I also tried
enabling ath0k's trace events, but nothing appears in the trace log when
this happens either. I'm not sure how and where to start debugging, so it
would be much appreciated if someone gives me some leads.

I also tried packing the vendor firmware (otp30.bin, qwlan30.bin) using
ath10k-fwencoder and using it alongside the board firmware I packed,
but that didn't change anything.

Also, shouldn't subsystem-vendor and subsystem-device be something other
than 0000:0000?

tl;dr:
 - poor range on QCA6174 without board firmware, loading board firmware
   fixes signal strength but makes chip fail to connect to any network.
 - subsystem-vendor and subsystem-device are zeroes.
 
Thanks,
Yassine