Yes, I'm sure the problem is in qcom_q6v5_wcss, but you know, it's very complicated, I'm not sure if a working qcom_q6v5_wcss from qsdk could support the ath11k, right?
Do you have any datasheet for these chips?
Nope, just the kernel source from QSDK.
If you apply my qcom_q6v5_wcss.c file able and also enable
+CONFIG_QRTR=y
+CONFIG_QRTR_SMD=y
+CONFIG_QCOM_APCS_IPC=y
You sould get
[ 9.369752] Q6V5 use request_firmware
[ 9.377199] Q6V5 use qcom_mdt_load_no_init
[ 9.387161] qcom-q6v5-wcss-pil cd00000.q6v5_wcss: q6v5_wcss_start ++
[ 9.387192] qcom-q6v5-wcss-pil cd00000.q6v5_wcss: call clk_prepare_enable
[ 14.562514] qcom-q6v5-wcss-pil cd00000.q6v5_wcss: start timed out
[ 14.562543] remoteproc remoteproc0: can't start rproc cd00000.q6v5_wcss: -110
[ 14.567616] ath11k d000000.wifi: failed to boot the remote processor Q6
[ 14.574715] ath11k d000000.wifi: failed to power up :-110
[ 14.581216] ath11k d000000.wifi: failed to create soc core: -110
[ 14.586697] ath11k d000000.wifi: failed to init core: -110
[ 14.592864] ath11k: probe of d000000.wifi failed with error -110
Looks like scm is broken on mainline ipq8074 
i guess we are stuck (i cant think of anything other than porting the qca drivers for the FW load and Q6 init)
No these messages.
I think you could push your code.
I'm not sure how many different between my code and yours.
1 Like
Pushed my changes and ath11k FW package
I have ath11k starting, will push my changes tomorrow AM (getting late for me)
[ 8.405073] ath11k d000000.wifi: qmi target: chip_id: 0x0, chip_family: 0x0, board_id: 0xff, soc_id: 0xffffffff
[ 8.407418] ath11k d000000.wifi: qmi fw_version: 0x210c04a5 fw_build_timestamp: 2020-06-24 04:34 fw_build_id: QC_IMAGE_VERSION_STRING=WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-2
[ 8.419241] ath11k d000000.wifi: Downloading BDF: IPQ8074/board-2.bin, size: 1049108
[ 8.419400] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 8.434379] ath11k d000000.wifi: qmi downloading BDF: IPQ8074/caldata.bin, size: 131072
[ 8.449862] ath11k d000000.wifi: qmi BDF downloaded
However it does hard reset the device after loading caldata.bin extracted from a QSDK build.
4 Likes
Great job!
All changed pushed to https://github.com/BuzzBumbleBee/openwrt/commits/ax3600
Should get you to the following point without caldata, but I get a crash as soon as the caldata is loaded.....
But Q6 is booted and working as expected and can now talk to ath11k via qmi / glink
[ 9.413223] ath11k d000000.wifi: qmi target: chip_id: 0x0, chip_family: 0x0, board_id: 0xff, soc_id: 0xffffffff
[ 9.415693] ath11k d000000.wifi: qmi fw_version: 0x210c04a5 fw_build_timestamp: 2020-06-24 04:34 fw_build_id: QC_IMAGE_VERSION_STRING=WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-2
[ 9.425763] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 9.427084] ath11k d000000.wifi: Downloading BDF: IPQ8074/board-2.bin, size: 1049108
[ 9.449404] ath11k d000000.wifi: Direct firmware load for IPQ8074/caldata.bin failed with error -2
[ 9.455856] ath11k d000000.wifi: Falling back to sysfs fallback for: IPQ8074/caldata.bin
[ 9.472548] ath11k d000000.wifi: qmi failed to load CAL: IPQ8074/caldata.bin
[ 9.472825] ath11k d000000.wifi: qmi failed to load board data file:-12
BusyBox v1.31.1 () built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r0+13963-734742d883
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# [ 19.035537] nss-dp 3a001000.dp1 eth0: nss_dp_edma: Registering netdev eth0(qcom-id:1) with EDMA
[ 19.035578] nss-dp 3a001000.dp1 eth0: netif_napi_add() called with weight 100
[ 19.045058] br-lan: port 1(eth0) entered blocking state
[ 19.050676] br-lan: port 1(eth0) entered disabled state
[ 19.055787] device eth0 entered promiscuous mode
[ 19.061815] br-lan: port 1(eth0) entered blocking state
[ 19.065478] br-lan: port 1(eth0) entered forwarding state
[ 19.075924] nss-dp 3a001200.dp2 eth1: nss_dp_edma: Registering netdev eth1(qcom-id:2) with EDMA
[ 20.066631] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
1 Like
How to extract the caldata from mtd?
This is the stock script
#!/bin/sh
#
# Copyright (c) 2015 The Linux Foundation. All rights reserved.
# Copyright (C) 2011 OpenWrt.org
. /lib/ipq806x.sh
do_load_ipq4019_board_bin()
{
local board=$(ipq806x_board_name)
local mtdblock=$(find_mtd_part 0:ART)
local apdk="/tmp"
HK_BD_FILENAME=/lib/firmware/IPQ8074/bdwlan.bin
if [ -z "$mtdblock" ]; then
# read from mmc
mtdblock=$(find_mmc_part 0:ART)
fi
[ -n "$mtdblock" ] || return
# load board.bin
case "$board" in
ap-dk0*)
mkdir -p ${apdk}
dd if=${mtdblock} of=${apdk}/wifi0.caldata bs=32 count=377 skip=128
dd if=${mtdblock} of=${apdk}/wifi1.caldata bs=32 count=377 skip=640
;;
ap16* | ap148*)
mkdir -p ${apdk}
dd if=${mtdblock} of=${apdk}/wifi0.caldata bs=32 count=377 skip=128
dd if=${mtdblock} of=${apdk}/wifi1.caldata bs=32 count=377 skip=640
dd if=${mtdblock} of=${apdk}/wifi2.caldata bs=32 count=377 skip=1152
;;
ap-hk01-*)
mkdir -p ${apdk}/IPQ8074
if [ -f "$HK_BD_FILENAME" ]; then
FILESIZE=$(stat -Lc%s "$HK_BD_FILENAME")
else
FILESIZE=131072
fi
dd if=${mtdblock} of=${apdk}/IPQ8074/caldata.bin bs=1 count=$FILESIZE skip=4096
[ -L /lib/firmware/IPQ8074/caldata.bin ] || \
ln -s ${apdk}/IPQ8074/caldata.bin /lib/firmware/IPQ8074/caldata.bin
;;
ap-hk* | ap-ac* | ap-oa*)
mkdir -p ${apdk}/IPQ8074
dd if=${mtdblock} of=${apdk}/wifi1.caldata bs=1 count=2116 skip=208896
if [ -f "$HK_BD_FILENAME" ]; then
FILESIZE=$(stat -Lc%s "$HK_BD_FILENAME")
else
FILESIZE=131072
fi
dd if=${mtdblock} of=${apdk}/IPQ8074/caldata.bin bs=1 count=$FILESIZE skip=4096
[ -L /lib/firmware/IPQ8074/caldata.bin ] || \
ln -s ${apdk}/IPQ8074/caldata.bin /lib/firmware/IPQ8074/caldata.bin
;;
esac
}
Id get an MTD backup of ART 1st tho
Just wanted to say a massive thank you to @Apache14 , @gmzhuo , @efsg et al. for all of their hard work. It's looking really good, very much appreciated.
3 Likes
9.424317] ath11k d000000.wifi: qmi target: chip_id: 0x0, chip_family: 0x0, board_id: 0xff, soc_id: 0xffffffff
These chip id, socid looks strange.
And i'm still curious why we should use the address 0xd000000.
I have patched the wcss so you can try the lower region. Feel free to try move it back. I wont have chance to test that until after work.
He He He
With 0xc000000 I got
root@(none):/lib/modules/5.4.52# iw phy0 info
Wiphy phy0
max # scan SSIDs: 16
max scan IEs length: 142 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports AP-side u-APSD.
Available Antennas: TX 0xf0 RX 0xf0
Configured Antennas: TX 0xf0 RX 0xf0
Supported interface modes:
* managed
* AP
* AP/VLAN
* monitor
* mesh point
Band 2:
Capabilities: 0x19ef
RX LDPC
HT20/HT40
SM Power Save disabled
RX HT20 SGI
RX HT40 SGI
TX STBC
RX STBC 1-stream
Max AMSDU length: 7935 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: No restriction (0x00)
HT TX/RX MCS rate indexes supported: 0-31
VHT Capabilities (0x738bf9b2):
Max MPDU length: 11454
Supported Channel Width: neither 160 nor 80+80
RX LDPC
short GI (80 MHz)
TX STBC
SU Beamformer
SU Beamformee
MU Beamformer
RX antenna pattern consistency
TX antenna pattern consistency
VHT RX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: MCS 0-9
4 streams: MCS 0-9
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT RX highest supported: 0 Mbps
VHT TX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: MCS 0-9
4 streams: MCS 0-9
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT TX highest supported: 0 Mbps
Frequencies:
* 5180 MHz [36] (30.0 dBm)
* 5200 MHz [40] (30.0 dBm)
* 5220 MHz [44] (30.0 dBm)
* 5240 MHz [48] (30.0 dBm)
* 5260 MHz [52] (24.0 dBm) (radar detection)
* 5280 MHz [56] (24.0 dBm) (radar detection)
* 5300 MHz [60] (24.0 dBm) (radar detection)
* 5320 MHz [64] (24.0 dBm) (radar detection)
* 5500 MHz [100] (24.0 dBm) (radar detection)
* 5520 MHz [104] (24.0 dBm) (radar detection)
* 5540 MHz [108] (24.0 dBm) (radar detection)
* 5560 MHz [112] (24.0 dBm) (radar detection)
* 5580 MHz [116] (24.0 dBm) (radar detection)
* 5600 MHz [120] (24.0 dBm) (radar detection)
* 5620 MHz [124] (24.0 dBm) (radar detection)
* 5640 MHz [128] (24.0 dBm) (radar detection)
* 5660 MHz [132] (24.0 dBm) (radar detection)
* 5680 MHz [136] (24.0 dBm) (radar detection)
* 5700 MHz [140] (24.0 dBm) (radar detection)
* 5720 MHz [144] (24.0 dBm) (radar detection)
* 5745 MHz [149] (30.0 dBm)
* 5765 MHz [153] (30.0 dBm)
* 5785 MHz [157] (30.0 dBm)
* 5805 MHz [161] (30.0 dBm)
* 5825 MHz [165] (30.0 dBm)
* 5845 MHz [169] (disabled)
* 5865 MHz [173] (disabled)
valid interface combinations:
* #{ managed } <= 1, #{ AP, mesh point } <= 16,
total <= 16, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz }
HT Capability overrides:
* MCS: ff ff ff ff ff ff ff ff ff ff
* maximum A-MSDU length
* supported channel width
* short GI for 40 MHz
* max A-MPDU length exponent
* min MPDU start spacing
Supported extended features:
* [ RRM ]: RRM
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
* [ STA_TX_PWR ]: TX power control per station
3 Likes
Boom !
Fantastic, ill update my branch with that address at lunch 
Cant seem to scan on 2g or 5g but startup / init seems fine for me.
iw list
root@OpenWrt:/# iw list
Wiphy phy1
max # scan SSIDs: 16
max scan IEs length: 152 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports AP-side u-APSD.
Available Antennas: TX 0x3 RX 0x3
Configured Antennas: TX 0x3 RX 0x3
Supported interface modes:
* managed
* AP
* AP/VLAN
* monitor
* mesh point
Band 1:
Capabilities: 0x11e7
RX LDPC
HT20/HT40
Dynamic SM Power Save
RX HT20 SGI
RX HT40 SGI
TX STBC
RX STBC 1-stream
Max AMSDU length: 3839 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: No restriction (0x00)
HT TX/RX MCS rate indexes supported: 0-15
Frequencies:
* 2412 MHz [1] (30.0 dBm)
* 2417 MHz [2] (30.0 dBm)
* 2422 MHz [3] (30.0 dBm)
* 2427 MHz [4] (30.0 dBm)
* 2432 MHz [5] (30.0 dBm)
* 2437 MHz [6] (30.0 dBm)
* 2442 MHz [7] (30.0 dBm)
* 2447 MHz [8] (30.0 dBm)
* 2452 MHz [9] (30.0 dBm)
* 2457 MHz [10] (30.0 dBm)
* 2462 MHz [11] (30.0 dBm)
* 2467 MHz [12] (disabled)
* 2472 MHz [13] (disabled)
* 2484 MHz [14] (disabled)
valid interface combinations:
* #{ managed } <= 1, #{ AP, mesh point } <= 16,
total <= 16, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz }
HT Capability overrides:
* MCS: ff ff ff ff ff ff ff ff ff ff
* maximum A-MSDU length
* supported channel width
* short GI for 40 MHz
* max A-MPDU length exponent
* min MPDU start spacing
Supported extended features:
* [ RRM ]: RRM
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
* [ STA_TX_PWR ]: TX power control per station
Wiphy phy0
max # scan SSIDs: 16
max scan IEs length: 142 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports AP-side u-APSD.
Available Antennas: TX 0xf0 RX 0xf0
Configured Antennas: TX 0xf0 RX 0xf0
Supported interface modes:
* managed
* AP
* AP/VLAN
* monitor
* mesh point
Band 2:
Capabilities: 0x19e7
RX LDPC
HT20/HT40
Dynamic SM Power Save
RX HT20 SGI
RX HT40 SGI
TX STBC
RX STBC 1-stream
Max AMSDU length: 7935 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: No restriction (0x00)
HT TX/RX MCS rate indexes supported: 0-31
VHT Capabilities (0x738bf9b2):
Max MPDU length: 11454
Supported Channel Width: neither 160 nor 80+80
RX LDPC
short GI (80 MHz)
TX STBC
SU Beamformer
SU Beamformee
MU Beamformer
RX antenna pattern consistency
TX antenna pattern consistency
VHT RX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: MCS 0-9
4 streams: MCS 0-9
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT RX highest supported: 0 Mbps
VHT TX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: MCS 0-9
4 streams: MCS 0-9
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported +-----------------------------+
VHT TX highest supported: 0 Mbps | |
Frequencies: | Cannot open /dev/ttyUSB0! |
* 5180 MHz [36] (30.0 dBm) | |
* 5200 MHz [40] (30.0 dBm) +-----------------------------+
* 5220 MHz [44] (30.0 dBm)
* 5240 MHz [48] (30.0 dBm)
* 5260 MHz [52] (24.0 dBm) (radar detection)
* 5280 MHz [56] (24.0 dBm) (radar detection)
* 5300 MHz [60] (24.0 dBm) (radar detection)
* 5320 MHz [64] (24.0 dBm) (radar detection)
* 5500 MHz [100] (24.0 dBm) (radar detection)
* 5520 MHz [104] (24.0 dBm) (radar detection)
* 5540 MHz [108] (24.0 dBm) (radar detection)
* 5560 MHz [112] (24.0 dBm) (radar detection)
* 5580 MHz [116] (24.0 dBm) (radar detection)
* 5600 MHz [120] (24.0 dBm) (radar detection)
* 5620 MHz [124] (24.0 dBm) (radar detection)
* 5640 MHz [128] (24.0 dBm) (radar detection)
* 5660 MHz [132] (24.0 dBm) (radar detection)
* 5680 MHz [136] (24.0 dBm) (radar detection)
* 5700 MHz [140] (24.0 dBm) (radar detection)
* 5720 MHz [144] (24.0 dBm) (radar detection)
* 5745 MHz [149] (30.0 dBm)
* 5765 MHz [153] (30.0 dBm)
* 5785 MHz [157] (30.0 dBm)
* 5805 MHz [161] (30.0 dBm)
* 5825 MHz [165] (30.0 dBm)
* 5845 MHz [169] (disabled)
* 5865 MHz [173] (disabled)
valid interface combinations:
* #{ managed } <= 1, #{ AP, mesh point } <= 16,
total <= 16, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz }
HT Capability overrides:
* MCS: ff ff ff ff ff ff ff ff ff ff
* maximum A-MSDU length
* supported channel width
* short GI for 40 MHz
* max A-MPDU length exponent
* min MPDU start spacing
Supported extended features:
* [ RRM ]: RRM
* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
* [ STA_TX_PWR ]: TX power control per station
iw reg get
root@OpenWrt:/# iw reg get
global
country 00: DFS-UNSET
(2402 - 2472 @ 40), (N/A, 20), (N/A)
(2457 - 2482 @ 20), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
(2474 - 2494 @ 20), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
(5170 - 5250 @ 80), (N/A, 20), (N/A), AUTO-BW
(5250 - 5330 @ 80), (N/A, 20), (0 ms), DFS, AUTO-BW, PASSIVE-SCAN
(5490 - 5730 @ 160), (N/A, 20), (0 ms), DFS, PASSIVE-SCAN
(5735 - 5835 @ 80), (N/A, 20), (N/A), PASSIVE-SCAN
(57240 - 63720 @ 2160), (N/A, 0), (N/A)
phy#1 (self-managed)
country US: DFS-FCC
(2402 - 2472 @ 40), (6, 30), (N/A)
(5170 - 5250 @ 80), (6, 30), (N/A), AUTO-BW
(5250 - 5330 @ 80), (6, 24), (0 ms), DFS, AUTO-BW
(5490 - 5730 @ 160), (6, 24), (0 ms), DFS, AUTO-BW
(5735 - 5835 @ 80), (6, 30), (N/A), AUTO-BW
phy#0 (self-managed)
country US: DFS-FCC
(2402 - 2472 @ 40), (6, 30), (N/A)
(5170 - 5250 @ 80), (6, 30), (N/A), AUTO-BW
(5250 - 5330 @ 80), (6, 24), (0 ms), DFS, AUTO-BW
(5490 - 5730 @ 160), (6, 24), (0 ms), DFS, AUTO-BW
(5735 - 5835 @ 80), (6, 30), (N/A), AUTO-BW
root@(none):/lib/modules/5.4.52# hostapd /etc/hostapd.conf
[ 121.516593] br2: port 1(wlan0) entered blocking state
[ 121.516641] br2: port 1(wlan0) entered disabled state
[ 121.520874] device wlan0 entered promiscuous mode
wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
wlan0: interface state COUNTRY_UPDATE->HT_SCAN
[ 122.279103] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
wlan0: interface state HT_SCAN->ENABLED
wlan0: AP-ENABLED
[ 131.101551] ath11k c000000.wifi: bss channel survey timed out
[ 140.317552] ath11k c000000.wifi: bss channel survey timed out
1 Like
I have started a general IPQ807x thread here now we have a lot more of the HW working :
Should help get others with IPQ807x based HW startes 
2 Likes
Hi!
I managed to recompile the latest firmware (v67) using windows 10 linux subsystem.
I didn't lost SSH but I think the "phone home" stuff didn't work...
I don't see any changes in hosts, and I'm able to ping the sites that should be blocked.
Also the root password that I had set in v17 didn't change.
Could you help me? Can I run parts of the repack-squashfs.sh script in the router through SSH?
EDIT:
I was "following" the script line by line and cheking in the router if the changes were made, and besides roots password not changed (not a problem) I think this last step didn't work:
# as a last-ditch effort, change the *.miwifi.com hostnames to localhost
sed -i 's@\w\+.miwifi.com@localhost@g' $FSDIR/etc/config/miwifi
The current content of the file "/etc/config/miwifi" in the router is:
config miwifi 'server'
option API api.miwifi.com
option LOG log.miwifi.com
option S s.miwifi.com
option APP app.miwifi.com
option STUN stun.miwifi.com
option BROKER broker.miwifi.com