5 Ghz HW defective on Fritzbox 4040 / IPQ4018?

Hi, I bought a Fritzbox 4040 which was known to restart when using the original AVM firmware occasually so I flashed OpenWRT on it and it seemed to be stable. However as I tried to enable 5 Ghz WIFI, it did not come up so I compared it with the other Fritzbox 4040 on OpenWRT which works fine. I flashed the recent openwrt-18.06.4-ipq40xx-avm_fritzbox-4040-squashfs-eva.bin release.

There are some significant differences in the kernel output:

Working Fritzbox 4040

[   16.769257] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/firmware-6.bin failed with error -2
[   16.769304] ath10k_ahb a800000.wifi: Falling back to user helper
[   17.057787] firmware ath10k!QCA4019!hw1.0!firmware-6.bin: firmware_loading_store: map pages failed
[   17.058106] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   17.065744] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[   17.080219] ath10k_ahb a800000.wifi: firmware ver 10.4-3.5.3-00057 api 5 features no-p2p,mfp,peer-flow-ctrl,btcoex-param,allows-mesh-bcast,no-ps crc32 6a15d64d
[   17.126012] ath10k_ahb a800000.wifi: board_file api 2 bmi_id 0:17 crc32 83549421
[   18.512437] ath10k_ahb a800000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 512 raw 0 hwcrypto 1

non working Fritzbox 4040

[   14.019512] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/firmware-6.bin failed with error -2
[   14.019565] ath10k_ahb a800000.wifi: Falling back to user helper
[   14.261120] firmware ath10k!QCA4019!hw1.0!firmware-6.bin: firmware_loading_store: map pages failed
[   14.261431] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   14.269110] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[   14.282085] ath10k_ahb a800000.wifi: firmware ver 10.4-3.5.3-00057 api 5 features no-p2p,mfp,peer-flow-ctrl,btcoex-param,allows-mesh-bcast,no-ps crc32 6a15d64d
[   17.323232] ath10k_ahb a800000.wifi: unable to Start LZ Stream to the device
[   17.323276] ath10k_ahb a800000.wifi: could not write otp for board id check: -110
[   17.329359] ath10k_ahb a800000.wifi: failed to get board id from otp: -110
[   17.336768] ath10k_ahb a800000.wifi: could not probe fw (-110)

Is there anything I could try to fix that or is that defective hardware?

Try 19.07 snapshot.
https://downloads.openwrt.org/releases/19.07-SNAPSHOT/targets/ipq40xx/generic/

Well, sure I could try 19.07. But why does the same release work on one device and not on the other?

They are both FritzBox 4040 although I admit they seem to be different revisions as the underlying device sticker differs. What I found out so far is that this errors seems to be related to calibration data.

If the problem persists, then it could be a hardware problem.

Unfortunately I have the same error on the current snapshot release.
As there were also issues when using the original AVM firmware, that most likely is a hardware issue.
But can it be solved by manually providing calibration data or reflashing this calibration data?

[  131.376249] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/fwcfg-ahb-a800000.wifi.txt failed with error -2
[  131.376296] ath10k_ahb a800000.wifi: Falling back to user helper
[  131.733006] firmware ath10k!fwcfg-ahb-a800000.wifi.txt: firmware_loading_store: map pages failed
[  131.733331] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/pre-cal-ahb-a800000.wifi.bin failed with error -2
[  131.741054] ath10k_ahb a800000.wifi: Falling back to user helper
[  131.942592] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/ct-firmware-5.bin failed with error -2
[  131.942647] ath10k_ahb a800000.wifi: Falling back to user helper
[  132.020022] firmware ath10k!QCA4019!hw1.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
[  132.020383] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/ct-firmware-2.bin failed with error -2
[  132.028316] ath10k_ahb a800000.wifi: Falling back to user helper
[  132.088959] firmware ath10k!QCA4019!hw1.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
[  132.089369] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/firmware-6.bin failed with error -2
[  132.097248] ath10k_ahb a800000.wifi: Falling back to user helper
[  132.165183] firmware ath10k!QCA4019!hw1.0!firmware-6.bin: firmware_loading_store: map pages failed
[  132.165494] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[  132.173083] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[  132.186740] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-012-4a059b9a api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 42967f85
[  135.234144] ath10k_ahb a800000.wifi: unable to Start LZ Stream to the device
[  135.234191] ath10k_ahb a800000.wifi: could not write otp for board id check: -110
[  135.240272] ath10k_ahb a800000.wifi: failed to get board id from otp: -110
[  135.247698] ath10k_ahb a800000.wifi: could not probe fw (-110)

It is unlikely that a hardware issue can be solved this way.

  • make a backup of whole flash on a failing unit
  • make a backup of whole flash on a working unit
  • flash full backup from working unit to a failing unit

see if it still crashes with the same message

it may indicate calibration/board missing or corrupted files, there is so much of this stuff in ath10k that it's hard to tell without proper debugging,
for example i'm running into similar issue on archer c7 v1, which isn't supported (works fine with tp-link fw), but i've got info from guys who run this card (QCA9880-AR1A) in minipc they managed to make it work with ath10k:

[    7.473226] ath10k_pci 0000:01:00.0: pci probe 168c:003c 168c:3223
[    7.473641] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[    7.479448] ath10k_pci 0000:01:00.0: boot pci_mem 0xb2000000
[    7.479609] ath10k_pci 0000:01:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[    7.488098] ath10k_pci 0000:01:00.0: boot qca99x0 chip reset
[    7.488103] ath10k_pci 0000:01:00.0: boot cold reset
[    7.488117] ath10k_pci 0000:01:00.0: pull out of reset 
[    7.493416] ath10k_pci 0000:01:00.0: boot cold reset complete
[    7.493421] ath10k_pci 0000:01:00.0: boot waiting target to initialise
[    8.132639] ath10k_pci 0000:01:00.0: boot target initialised
[    8.132645] ath10k_pci 0000:01:00.0: boot qca99x0 chip reset complete (cold)
[    8.135616] ath10k_pci 0000:01:00.0: boot hif power up
[    8.135631] ath10k_pci 0000:01:00.0: boot qca99x0 chip reset
[    8.135636] ath10k_pci 0000:01:00.0: boot cold reset
[    8.135646] ath10k_pci 0000:01:00.0: pull out of reset 
[    8.140946] ath10k_pci 0000:01:00.0: boot cold reset complete
[    8.140951] ath10k_pci 0000:01:00.0: boot waiting target to initialise
[    8.140962] ath10k_pci 0000:01:00.0: boot target initialised
[    8.140967] ath10k_pci 0000:01:00.0: boot qca99x0 chip reset complete (cold)
[    8.140988] ath10k_pci 0000:01:00.0: boot init ce src ring id 0 entries 16 base_addr a76f5000
[    8.141009] ath10k_pci 0000:01:00.0: boot ce dest ring id 1 entries 128 base_addr a759d000
[    8.141026] ath10k_pci 0000:01:00.0: boot ce dest ring id 2 entries 64 base_addr a7595000
[    8.141044] ath10k_pci 0000:01:00.0: boot init ce src ring id 3 entries 32 base_addr a7519000
[    8.141299] ath10k_pci 0000:01:00.0: boot init ce src ring id 4 entries 8192 base_addr a7760000
[    8.141317] ath10k_pci 0000:01:00.0: boot ce dest ring id 5 entries 128 base_addr a753b000
[    8.141335] ath10k_pci 0000:01:00.0: boot init ce src ring id 7 entries 2 base_addr a75a9000
[    8.141350] ath10k_pci 0000:01:00.0: boot ce dest ring id 7 entries 2 base_addr a759b000
[    8.152452] ath10k_pci 0000:01:00.0: bmi get target info
[    8.164823] ath10k_pci 0000:01:00.0: Hardware name qca988x hw1.0 version 0x4000002c
[    8.165111] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:01:00.0.bin failed with error -2
[    8.175975] ath10k_pci 0000:01:00.0: Falling back to user helper
[    8.321617] firmware ath10k!pre-cal-pci-0000:01:00.0.bin: firmware_loading_store: map pages failed
[    8.330862] ath10k_pci 0000:01:00.0: boot fw request 'ath10k/pre-cal-pci-0000:01:00.0.bin': -11
[    8.330947] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/cal-pci-0000:01:00.0.bin failed with error -2
[    8.341467] ath10k_pci 0000:01:00.0: Falling back to user helper
[    8.461554] firmware ath10k!cal-pci-0000:01:00.0.bin: firmware_loading_store: map pages failed
[    8.470473] ath10k_pci 0000:01:00.0: boot fw request 'ath10k/cal-pci-0000:01:00.0.bin': -11
[    8.470481] ath10k_pci 0000:01:00.0: trying fw api 6
[    8.470892] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA988X/hw1.0/firmware-6.bin failed with error -2
[    8.481771] ath10k_pci 0000:01:00.0: Falling back to user helper
[    8.601793] firmware ath10k!QCA988X!hw1.0!firmware-6.bin: firmware_loading_store: map pages failed
[    8.611035] ath10k_pci 0000:01:00.0: boot fw request 'ath10k/QCA988X/hw1.0/firmware-6.bin': -11
[    8.611042] ath10k_pci 0000:01:00.0: trying fw api 5
[    8.826911] ath10k_pci 0000:01:00.0: boot fw request 'ath10k/QCA988X/hw1.0/firmware-5.bin': 0
[    8.826922] ath10k_pci 0000:01:00.0: found fw version 10.2.4-1.0-00037
[    8.826929] ath10k_pci 0000:01:00.0: found fw timestamp 1515682342
[    8.826935] ath10k_pci 0000:01:00.0: found otp image ie (7221 B)
[    8.826941] ath10k_pci 0000:01:00.0: found fw image ie (240781 B)
[    8.826946] ath10k_pci 0000:01:00.0: found firmware features ie (3 B)
[    8.826952] ath10k_pci 0000:01:00.0: Enabling feature bit: 3
[    8.826957] ath10k_pci 0000:01:00.0: Enabling feature bit: 10
[    8.826962] ath10k_pci 0000:01:00.0: Enabling feature bit: 12
[    8.826967] ath10k_pci 0000:01:00.0: Enabling feature bit: 16
[    8.826971] ath10k_pci 0000:01:00.0: features
[    8.826980] ath10k_pci 0000:01:00.0: 00000000: 00 01 14 08                                      ....
[    8.826985] ath10k_pci 0000:01:00.0: found fw ie wmi op version 5
[    8.826991] ath10k_pci 0000:01:00.0: found fw ie htt op version 2
[    8.826996] ath10k_pci 0000:01:00.0: using fw api 5
[    8.827011] ath10k_pci 0000:01:00.0: qca988x hw1.0 target 0x4000002c chip_id 0x043200ff sub 168c:3223
[    8.836389] ath10k_pci 0000:01:00.0: kconfig debug 1 debugfs 1 tracing 1 dfs 1 testmode 1
[    8.848298] ath10k_pci 0000:01:00.0: firmware ver 10.2.4-1.0-00037 api 5 features no-p2p,raw-mode,mfp,allows-mesh-bcast crc32 a4a52adb
[    8.860574] ath10k_pci 0000:01:00.0: boot did not find a pre calibration file, try DT next: -11
[    8.860580] ath10k_pci 0000:01:00.0: unable to load pre cal data from DT: -2
[    8.860585] ath10k_pci 0000:01:00.0: could not load pre cal data: -2
[    8.860592] ath10k_pci 0000:01:00.0: boot upload otp to 0x1234 len 7221 for board id
[    8.860600] ath10k_pci 0000:01:00.0: bmi fast download address 0x1234 buffer 0xc0393038 length 7221
[    8.860606] ath10k_pci 0000:01:00.0: bmi lz stream start address 0x1234
[    8.860667] ath10k_pci 0000:01:00.0: bmi lz data buffer 0xc0393038 length 7220
[    8.885428] ath10k_pci 0000:01:00.0: bmi lz data buffer 0x87c99dd0 length 4
[    8.885539] ath10k_pci 0000:01:00.0: bmi lz stream start address 0x0
[    8.885569] ath10k_pci 0000:01:00.0: bmi execute address 0x1234 param 0x10
[    8.885672] ath10k_pci 0000:01:00.0: bmi execute result 0x10
[    8.885679] ath10k_pci 0000:01:00.0: boot get otp board id result 0x00000010 board_id 0 chip_id 0
[    8.885684] ath10k_pci 0000:01:00.0: board id does not exist in otp, ignore it
[    8.885690] ath10k_pci 0000:01:00.0: SMBIOS bdf variant name not set.
[    8.885695] ath10k_pci 0000:01:00.0: DT bdf variant name not set.
[    8.885707] ath10k_pci 0000:01:00.0: boot using board name 'bus=pci,vendor=168c,device=003c,subsystem-vendor=168c,subsystem-device=3223'
[    8.885716] ath10k_pci 0000:01:00.0: boot using board name 'bus=pci,vendor=168c,device=003c,subsystem-vendor=168c,subsystem-device=3223'
[    8.885793] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA988X/hw1.0/board-2.bin failed with error -2
[    8.896408] ath10k_pci 0000:01:00.0: Falling back to user helper
[    8.950187] firmware ath10k!QCA988X!hw1.0!board-2.bin: firmware_loading_store: map pages failed
[    8.959167] ath10k_pci 0000:01:00.0: boot fw request 'ath10k/QCA988X/hw1.0/board-2.bin': -11
[    8.959917] ath10k_pci 0000:01:00.0: boot fw request 'ath10k/QCA988X/hw1.0/board.bin': 0
[    8.959925] ath10k_pci 0000:01:00.0: using board api 1
[    8.959960] ath10k_pci 0000:01:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[    8.967409] ath10k_pci 0000:01:00.0: bmi start
[    8.967416] ath10k_pci 0000:01:00.0: bmi write address 0x400800 length 4
[    8.975128] ath10k_pci 0000:01:00.0: bmi read address 0x400810 length 4
[    8.975204] ath10k_pci 0000:01:00.0: bmi write address 0x400810 length 4
[    8.975218] ath10k_pci 0000:01:00.0: bmi write address 0x400844 length 4
[    8.975267] ath10k_pci 0000:01:00.0: bmi write address 0x400904 length 4
[    8.975294] ath10k_pci 0000:01:00.0: bmi write address 0x4008bc length 4
[    8.975320] ath10k_pci 0000:01:00.0: boot did not find a pre calibration file, try DT next: -11
[    8.975326] ath10k_pci 0000:01:00.0: unable to load pre cal data from DT: -2
[    8.975331] ath10k_pci 0000:01:00.0: failed to load pre cal data: -2
[    8.975337] ath10k_pci 0000:01:00.0: pre cal download procedure failed, try cal file: -2
[    8.975343] ath10k_pci 0000:01:00.0: boot did not find a calibration file, try DT next: -11
[    8.975348] ath10k_pci 0000:01:00.0: boot did not find DT entry, try target EEPROM next: -2
[    8.975355] ath10k_pci 0000:01:00.0: boot did not find target EEPROM entry, try OTP next: -122
[    8.975361] ath10k_pci 0000:01:00.0: bmi read address 0x4008ac length 4
[    8.975425] ath10k_pci 0000:01:00.0: boot push board extended data addr 0x0
[    8.975431] ath10k_pci 0000:01:00.0: bmi read address 0x400854 length 4
[    8.975495] ath10k_pci 0000:01:00.0: bmi write address 0x401cb0 length 2116
[    8.982848] ath10k_pci 0000:01:00.0: bmi write address 0x400858 length 4
[    8.983149] ath10k_pci 0000:01:00.0: boot upload otp to 0x1234 len 7221
[    8.983158] ath10k_pci 0000:01:00.0: bmi fast download address 0x1234 buffer 0xc0393038 length 7221
[    8.983163] ath10k_pci 0000:01:00.0: bmi lz stream start address 0x1234
[    8.983176] ath10k_pci 0000:01:00.0: bmi lz data buffer 0xc0393038 length 7220
[    9.018967] ath10k_pci 0000:01:00.0: bmi lz data buffer 0x87c99d90 length 4
[    9.019088] ath10k_pci 0000:01:00.0: bmi lz stream start address 0x0
[    9.019118] ath10k_pci 0000:01:00.0: bmi execute address 0x1234 param 0x0
[    9.019221] ath10k_pci 0000:01:00.0: bmi execute result 0x0
[    9.019227] ath10k_pci 0000:01:00.0: boot otp execute result 0
[    9.019233] ath10k_pci 0000:01:00.0: boot using calibration mode otp
[    9.019241] ath10k_pci 0000:01:00.0: boot uploading firmware image c0394c78 len 240781
[    9.019249] ath10k_pci 0000:01:00.0: bmi fast download address 0x1234 buffer 0xc0394c78 length 240781
[    9.019254] ath10k_pci 0000:01:00.0: bmi lz stream start address 0x1234
[    9.019268] ath10k_pci 0000:01:00.0: bmi lz data buffer 0xc0394c78 length 240780
[    9.948498] ath10k_pci 0000:01:00.0: bmi lz data buffer 0x87c99dc8 length 4
[    9.949520] ath10k_pci 0000:01:00.0: bmi lz stream start address 0x0
[    9.949551] ath10k_pci 0000:01:00.0: bmi write address 0x400814 length 4
[    9.949565] ath10k_pci 0000:01:00.0: pci hif map service
[    9.949575] ath10k_pci 0000:01:00.0: boot htc service 'Control' ul pipe 0 dl pipe 1 eid 0 ready
[    9.949581] ath10k_pci 0000:01:00.0: boot htc service 'Control' eid 0 TX flow control disabled
[    9.949586] ath10k_pci 0000:01:00.0: bmi done
[   12.955020] ath10k_pci 0000:01:00.0: bmi cmd took 301 jiffies hz 100 ret -145
[   12.955032] ath10k_pci 0000:01:00.0: unable to write to the device: -145
[   12.961826] ath10k_pci 0000:01:00.0: could not init core (-145)
[   12.967908] ath10k_pci 0000:01:00.0: boot hif power down
[   12.967914] ath10k_pci 0000:01:00.0: could not probe fw (-145)

Hmm. I just flashed the AVM FritzOS again on the device. It rebooted and rebooted and I had to do some other stuff and at some point it seemed to stop rebooting and I could login. Everything was fine including 5 Ghz WIFI. Unfortunately I don't get any console logs or whatever on FritzOS. So if the calibration data is corrupted, how is it able to start up? Edit: After rebooting it failed again each time.

I'll flash OpenWRT and compare everything in /lib/firmware/ath10k vs the working FritzBox 4040. According to /etc/hotplug.d/firmware/11-ath10k-caldata this is copied straight out of memory to these files. Let's see.

Update: I compared everything in /lib/firmware/ath10k between the working and non-working FritzBox 4040. Everything in QCA4019 of course identical because it is part of the image. pre-cal-ahb-a000000.wifi.bin (of the working 2,4 Ghz Wifi) pre-cal-ahb-a800000.wifi.bin (of the non-working 5 Ghz Wifi) of course differ.

Comparing both a800000.wifi.bin doesn't show any obvious corruption, some values differ, most of the file matches. I also tried copying the a800000.wifi.bin of the working FritzBox to the non-working one but that didn't help.

So sometimes it works, sometimes it doesn't. Sounds really like a hardware issue to me. The calibration data looks okay and I don't want to overwrite the other device-specific mtd because that may wreck the whole device.