Hm, I wouldn't actually be surprised if its not the ath11k leaking directly but the QRTR
1 Like
Hello, I have different data (I flashed etzisim's build)
Uptime 5h 57m 54s
Memory
|Total Available|| 80-120 (of 367)
|Used|| 269/367
|Cached||31.24/367
Maybe leak is still here, need more testing.
Someone thought the same by the looks of it, not sure if it has been merged though.
1 Like
This patch has already been merged ...
1 Like
Yeah, but none of the memory leak fixes for QRTR are actually in 5.10.
Wireless backports only backport the net/wireless folder.
The issue is that you cant easily backport most of the fixes as they depend on other stuff and 5.10 is really showing its age.
1 Like
To anyone who installed the QSDK (Chinese Openwrt Look Alike) firmware, with no ssh access and bricked their router. I have successfully recovered my router (AX6) without ssh access but have serial access. You should have the recovery files from the QSDK tutorial.
- When your router boots hit any button to cancel boot.
- Step PC IP to 192.168.31.100 and gateway ip 192.168.31.1
- Download TinyPXE server, select file and select interface and click online.
- On router with serial connection type
tftpboot AX6_1.1.4.ubi, save file size in hex. - Run
nand erase 0xa00000 0x23c0000andnand erase 0x2dc0000 0x4280000this will erase mtd12 and mtd13 - Write the tftpboot to mtd12, tftpboot image is located at 0x44000000, Make sure you get the file size before you type the last hex number. When you get the size of your tftpboot file type it in as the has hex number so type in the following command. Type
nand write 0x44000000 0xa00000 0x362000<= last hex is going to be different - Upload the other recovery file to tftpboot. This one has to written to mtd1 type
tftpboot ybmibib.binsave file size in hex - Erase mtd1 by runinng
nand erase 0x100000 0x100000 - Write tftpboot to mtd1, again the file is located at 0x44000000. Use the file size as the last hex number. Type
nand write 0x44000000 0x100000 0x362000remember the last hex is just a placeholder and you need to type in the tftpboot size from the upload. - Run the last three commands
setenv flag_last_success 0
setenv flag_boot_rootfs 0
saveenv
- Reboot router and it should boot to the OEM firmware.
4 Likes
It seems we might have some minor issues around NSS:
[ 9248.016973] Frequency Set to 1497600000
[ 9248.017067] Frequency Supported -
[ 9248.017071] 187200000 Hz
[ 9248.019607] 748800000 Hz
[ 9248.023173] 1497600000 Hz
[ 9248.025782]
[ 9248.031520] Current Inst Per Ms 8fc2
[ 9248.033324] ------------[ cut here ]------------
[ 9248.036204] WARNING: CPU: 2 PID: 4889 at proc_sys_call_handler+0x20c/0x220
[ 9248.040795] Modules linked in: ecm iptable_nat ath11k_ahb ath11k xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_FLOWOFFLOAD nf_nat nf_flow_table nf_conntrack mac80211 ipt_REJECT cfg80211 xt_time xt_tcpudp xt_quota xt_pkttype xt_physdev xt_owner xt_multiport xt_mark xt_mac xt_limit xt_comment xt_cgroup xt_addrtype xt_TCPMSS xt_LOG ppp_async nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables hwmon crc_ccitt compat qca_nss_pppoe pppoe pppox ppp_generic slhc nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 qca_nss_drv qca_nss_dp qca_ssdk seqiv jitterentropy_rng drbg michael_mic hmac cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom gpio_button_hotplug
[ 9248.093563] CPU: 2 PID: 4889 Comm: sysctl Not tainted 5.10.72 #0
[ 9248.115795] Hardware name: Redmi AX6 (DT)
[ 9248.121783] pstate: a0400005 (NzCv daif +PAN -UAO -TCO BTYPE=--)
[ 9248.125697] pc : proc_sys_call_handler+0x20c/0x220
[ 9248.131766] lr : proc_sys_call_handler+0x130/0x220
[ 9248.136365] sp : ffffffc020b9bcd0
[ 9248.141136] x29: ffffffc020b9bcd0 x28: ffffff8012915c00
[ 9248.144524] x27: 0000000000000000 x26: 0000000000000000
[ 9248.149907] x25: ffffffc020b9bd20 x24: ffffffc00893e100
[ 9248.155203] x23: ffffffc020b9bd78 x22: 0000000000000000
[ 9248.160498] x21: ffffff80121db000 x20: fffffffffffffff2
[ 9248.165792] x19: ffffff80031c5500 x18: 0000000000000020
[ 9248.171087] x17: 0000000000000000 x16: 0000000000000000
[ 9248.176382] x15: ffffff8013c46917 x14: ffffffffffffffff
[ 9248.181677] x13: ffffff8013c46913 x12: 0000000000000000
[ 9248.186972] x11: ffffffc020b9bc70 x10: ffffffc020b9bc70
[ 9248.192269] x9 : 00000000ffffffd8 x8 : 000000000ef00000
[ 9248.197564] x7 : 0000000000000000 x6 : 0000000000000000
[ 9248.202859] x5 : 0000000000018188 x4 : ffffff8013c46800
[ 9248.208155] x3 : ffffffc00edbe000 x2 : ffffff8013c45000
[ 9248.213449] x1 : 0000000000018187 x0 : 000000007fffffff
[ 9248.218744] Call trace:
[ 9248.224037] proc_sys_call_handler+0x20c/0x220
[ 9248.226209] proc_sys_read+0x18/0x2c
[ 9248.230725] new_sync_read+0xd4/0x150
[ 9248.234455] vfs_read+0x120/0x1a0
[ 9248.238013] ksys_read+0x5c/0xe0
[ 9248.241311] __arm64_sys_read+0x20/0x30
[ 9248.244613] el0_svc_common.constprop.0+0x88/0x190
[ 9248.248172] do_el0_svc+0x74/0x94
[ 9248.253032] el0_svc+0x14/0x20
[ 9248.256414] el0_sync_handler+0xa8/0x130
[ 9248.259367] el0_sync+0x184/0x1c0
[ 9248.263445] ---[ end trace adc18d20b28c61fe ]---
[ 9248.272610] Min SKB reuse sizes -
[ 9248.272620] core 0: 2048
[ 9248.272640] core 1: 1984
[ 9248.274900]
[ 9248.353418] ICMPv6: process `sysctl' is using deprecated sysctl (syscall) net.ipv6.neigh.br-lan.base_reachable_time - use net.ipv6.neigh.br-lan.base_reachable_time_ms instead
[ 9248.365053] == for dynamic interface types read following file ==
[ 9248.365062] /sys/kernel/debug/qca-nss-drv/stats/dynamic_if/type_names
[ 9248.367948] NSS PPE VP create: echo <interface name> <dynamic interface type> > /proc/sys/nss/ppe_vp/create
[ 9248.374041] NSS PPE VP destroy: echo <interface name> <dynamic interface type> > /proc/sys/nss/ppe_vp/destroy
[ 9248.380644] == for dynamic interface types read following file ==
[ 9248.390025] /sys/kernel/debug/qca-nss-drv/stats/dynamic_if/type_names
[ 9248.400128] NSS PPE VP create: echo <interface name> <dynamic interface type> > /proc/sys/nss/ppe_vp/create
Well, the whole SSDK/NSS is just a huge hack, it's completely unsupportable in the long run.
1 Like
FYI, less than 12 hours and the first OOM happened already.
Unfortunately, as expected
By any chance, can you rebase the 512MB patch so it applies to your latest modifications?
512MB patch
Probably not today, maybe tommorow.
I am pretty booked for today.
No problem. I tried to rebase it, but failed miserably.
It might be a good idea to take that patch and make it part of your repo, even if it is not enabled by default, but a lot easier for most of the guys to apply it from menuconfig. It sure not solves the issue, but almost makes it invisible. I had 20+ days of uptime with it on previous builds.
Yeah, I will look into including it as it makes the leak bearable.
1 Like
Second OOM happened less than 2 hours after the reboot. This is now much faster than it was before...
That is really, really bad
This is off topic here, please delete your post and ask it in the proper topic.
1 Like
It is. We really need that 512MB patch in your repo, as this is getting unbearable.
FYI, Hauke pulled the 5.15 backports a couple hours ago 
I know, just pulled the updated backports
8 Likes
I have added github actions workflow to build upon pushes so you can find prebuilt images now:
Images are just default ones, the only difference is that initramfs is ZSTD compressed.
So If anyone wants to test as I those are fresh ones with 5.15 based backports
16 Likes