erikarn / athp Goto Github PK

Hello folks,

As requested by Geramy I'm opening a new issue.

I'm with a dell xps 9380 with the some problem here (under FreeBSD 12.0 release):

uname -a:
FreeBSD Radagast 12.0-RELEASE FreeBSD 12.0-RELEASE GENERIC amd64

pciconf -lv:
none10@pci0:2:0:0: class=0x028000 card=0x143a1a56 chip=0x003e168c rev=0x32 hdr=0x00
vendor = 'Qualcomm Atheros'
device = 'QCA6174 802.11ac Wireless Network Adapter'
class = network

athp0: mem 0xdc000000-0xdc1fffff at device 0.0 on pci2
athp_pci_attach: msicount=8, msixcount=0
athp0: athp_pci_attach: 8 MSI interrupts
athp0: ath10k_pci_alloc_pipes: WARNING: configuring 4k dmamap size for pipe 5; figure out what to do instead
athp0: ath10k_pci_alloc_pipes: WARNING: configuring 4k dmamap size for pipe 6; figure out what to do instead
athp0: athp_pci_attach: chipid: 0x00340aff
athp0: ath10k_fetch_fw_file: firmware_get: athp_cal-pci-athp0.bin
athp_cal-pci-athp0.bin: could not load firmware image, error 2
athp0: ath10k_fetch_fw_file: firmware_get: athp_QCA6174_hw3.0_board.bin
athp0: ath10k_fetch_fw_file: firmware_get: athp_QCA6174_hw3.0_firmware-5.bin
athp_QCA6174_hw3.0_firmware-5.bin: could not load firmware image, error 2
athp0: could not fetch firmware file 'athp_QCA6174_hw3.0/firmware-5.bin': -1
athp0: ath10k_fetch_fw_file: firmware_get: athp_QCA6174_hw3.0_firmware-4.bin
athp0: ath10k_core_init_firmware_features: hardware crypto
athp0: ath10k_download_cal_dt: TODO: device tree check
athp0: ath10k_wmi_event_service_ready_work: TODO: EEPROM code: 0x0000006c

Fatal trap 12: page fault while in kernel mode
cpuid = 7; apic id = 07
fault virtual address = 0x0
fault code = supervisor write data, page not present
instruction pointer = 0x20:0xffffffff84f9d189
stack pointer = 0x28:0xfffffe00995695c0
frame pointer = 0x28:0xfffffe0099569620
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 0 (athp0 ath10k_at_wq)
trap number = 12

I'm using the ARVIF_LOCK brach;

root@Radagast:/home/lbalbi/Src/athp/athp # git branch

NEW_ATHP_ARVIF_LOCK

And tried all firmwares from : https://github.com/kvalo/ath10k-firmware/tree/master/QCA6174/hw3.0

Do I'm making something wrong, or missing something?

I can test any code you wish, if this help.

I've put the core.txt at https://drive.google.com/drive/folders/12m3JDlMCeK-YYgNQeaJTK6dp2D_ytMgQ?usp=sharing.

Thank's in advanced

Best's
Balbi

I am running FreeBSD RELEASE 12.0 on my laptop, which requires a QCA6174 firmware for the network card (to get wifi).

Based on issues #11 and #20, I was able to compile on RELEASE 12.0 both kernel modules & binaries.

After rebooting, I loaded the following modules using those commands:

kldload athp_QCA6174_hw3.0_board.bin
kldload athp_QCA6174_hw3.0_firmware-4.bin
kldload if_athp

No crash after the last command... but no output either (even using dmesg).

When I launch ifconfig to get my network interfaces, I only get l0, and no another one.

If I try to create a wlan interface, using the following command: ifconfig wlan0 create wlandev athp0 wlanmode hostap, I get the following error: ifconfig: SIOCIFCREATE2: Device not configured.

Hello,
I recently acquired a Sophos XG 125w with a QCA986x/988x 802.11ac Wireless Network Adapter. Unfortunately, this adapter is not automatically supported by OPNsense/FreeBSD. After some research, I came across this great project, but so far, I haven't been able to find an installation guide. Could someone please outline the steps to install the driver so I can utilize the Qualcomm Atheros network adapter?

Why does it seem that there's no official driver available for this? Or did I just overlook it?

Thank you all in advance.

If you run the following commands:
kldload athp_QCA988X_hw2.0_board.bin
kldload athp_QCA988X_hw2.0_firmware-2.bin
kldload athp_QCA988X_hw2.0_firmware-3.bin
kldload athp_QCA988X_hw2.0_firmware-4.bin
kldload athp_QCA988X_hw2.0_firmware-5.bin
kldload if_athp

ifconfig wlan0 create wlandev athp0 wlanmode hostap

if_athp will steal the console, it never detaches.

ctrl + t
OUTPUT:
load: 1.01 cmd: ifconfig 51338 [running] 9.25r 0.01u 4.87s 29% 152196k

Hit a "deadklock".

I assume it's more likely that the firmware went kaboom after this
athp0: ath10k_htt_rx_delba: received DELBA, couldn't find node!
and we didn't move anymore?

db> trace 100166
Tracing pid 0 tid 100166 td 0xfffffe003b99be00
sched_switch() at sched_switch+0x5b2/frame 0xfffffe003c0098e0
mi_switch() at mi_switch+0x155/frame 0xfffffe003c009900
__mtx_lock_sleep() at __mtx_lock_sleep+0x1cc/frame 0xfffffe003c009990
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe003c0099e0
ath10k_wait_for_peer_common() at ath10k_wait_for_peer_common+0xe3/frame 0xfffffe003c009a40
athp_peer_free() at athp_peer_free+0xfb/frame 0xfffffe003c009a80
athp_node_free_cb() at athp_node_free_cb+0x84/frame 0xfffffe003c009ac0
athp_taskq_task() at athp_taskq_task+0x2fe/frame 0xfffffe003c009b00
taskqueue_run_locked() at taskqueue_run_locked+0xaa/frame 0xfffffe003c009b80
taskqueue_thread_loop() at taskqueue_thread_loop+0x94/frame 0xfffffe003c009bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003c009bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003c009bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
db> trace 100160
Tracing pid 12 tid 100160 td 0xfffffe003b98f700
sched_switch() at sched_switch+0x5b2/frame 0xfffffe003b1e9810
mi_switch() at mi_switch+0x155/frame 0xfffffe003b1e9830
__mtx_lock_sleep() at __mtx_lock_sleep+0x1cc/frame 0xfffffe003b1e98c0
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe003b1e9910
ath10k_get_arvif() at ath10k_get_arvif+0x2e/frame 0xfffffe003b1e9940
ath10k_htt_t2h_msg_handler() at ath10k_htt_t2h_msg_handler+0x374/frame 0xfffffe003b1e99b0
ath10k_htc_rx_completion_handler() at ath10k_htc_rx_completion_handler+0x203/frame 0xfffffe003b1e9a40
ath10k_pci_ce_recv_data() at ath10k_pci_ce_recv_data+0xff/frame 0xfffffe003b1e9ac0
ath10k_ce_per_engine_service() at ath10k_ce_per_engine_service+0x8c/frame 0xfffffe003b1e9b00
ath10k_pci_ce_tasklet() at ath10k_pci_ce_tasklet+0x55/frame 0xfffffe003b1e9b20
ithread_loop() at ithread_loop+0x279/frame 0xfffffe003b1e9bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b1e9bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b1e9bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
db> trace 100161
Tracing pid 12 tid 100161 td 0xfffffe003b98f000
sched_switch() at sched_switch+0x5b2/frame 0xfffffe003b1ee540
mi_switch() at mi_switch+0x155/frame 0xfffffe003b1ee560
__mtx_lock_sleep() at __mtx_lock_sleep+0x1cc/frame 0xfffffe003b1ee5f0
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe003b1ee640
ath10k_get_arvif() at ath10k_get_arvif+0x2e/frame 0xfffffe003b1ee670
ath10k_wmi_event_host_swba() at ath10k_wmi_event_host_swba+0x1a9/frame 0xfffffe003b1ee910
ath10k_wmi_10_2_op_rx() at ath10k_wmi_10_2_op_rx+0x2b9/frame 0xfffffe003b1ee9b0
ath10k_htc_rx_completion_handler() at ath10k_htc_rx_completion_handler+0x203/frame 0xfffffe003b1eea40
ath10k_pci_ce_recv_data() at ath10k_pci_ce_recv_data+0xff/frame 0xfffffe003b1eeac0
ath10k_ce_per_engine_service() at ath10k_ce_per_engine_service+0x8c/frame 0xfffffe003b1eeb00
ath10k_pci_ce_tasklet() at ath10k_pci_ce_tasklet+0x55/frame 0xfffffe003b1eeb20
ithread_loop() at ithread_loop+0x279/frame 0xfffffe003b1eebb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b1eebf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b1eebf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---

There's a problem with the taskqs in that node_free can run after node_alloc before the node_alloc_cb has been run from the taskq. By the time node_alloc_cb runs, the ni (ath10k_sta object). I believe it's the is_in_peer_table right after the ni based on the offsets.
All the none node_{alloc,free} changes to it seem to be properly covered by a STA check.

I added the lower half of the ni pointer to the free_cb with a 0xdead0000 << 32 prefix to be able to track them a bit better (just don't be confused as to where this address comes from; that's not the issue).

I've two more follow-up observations; I changed the is_in_peer_table to bool and the modified value changed from =1 to 0xdeadc001, which makes sense as the compiler only needs to alloc a char and not an int anymore.

I also have a patch to keep the node_alloc cb taskq on the ath10k_sta and then check on node_free if it's still on the queue, cancel it, and in that case directly go to the ni 80211 callback which will call free.
That alone however seems not to have fully solved the problem as I saw another instance after the change I believe. There might still be another race somewhere else; need to double-check locking and add asserts for that. It's become a lot harder to reproduce though and I am hitting other issues. I'll upload a pull request for this the next days if I don't hit it anymore.

athp0: athp_node_alloc: called; mac=00:80:48:3d:a3:48; ni 0xfffffe003d970000
athp0: athp_node_alloc: add peer for MAC 00:80:48:3d:a3:48 (0xfffffe003d970000)
athp0: athp_node_free: called; mac=00:80:48:3d:a3:48 (0xfffffe003d970000)
athp0: athp_node_free: delete peer for MAC 00:80:48:3d:a3:48 (0xfffffe003d970000)
athp0: athp_node_alloc: called; mac=00:24:21:28:8f:48; ni 0xfffffe003d970000
athp0: athp_node_alloc: add peer for MAC 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free: called; mac=00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_alloc_cb: added node for mac 00:80:48:3d:a3:48 (0xfffffe003d970000)
athp0: athp_node_free: delete peer for MAC 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_alloc: called; mac=00:24:21:28:8f:48; ni 0xfffffe003d970000
athp0: athp_node_alloc: add peer for MAC 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free: called; mac=00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free: delete peer for MAC 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_alloc: called; mac=00:24:21:28:8f:48; ni 0xfffffe003d970000
athp0: athp_node_alloc: add peer for MAC 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free: called; mac=00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free: delete peer for MAC 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free_cb: deleted node for mac 00:80:48:3d:a3:48 (0xdead00003d970000)
athp0: athp_node_alloc_cb: added node for mac 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free_cb: deleted node for mac 00:24:21:28:8f:48 (0xdead00003d970000)
athp0: athp_node_alloc_cb: added node for mac 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free_cb: deleted node for mac 00:24:21:28:8f:48 (0xdead00003d970000)
athp0: athp_node_alloc_cb: added node for mac 00:24:21:28:8f:48 (0xfffffe003d970000)
athp0: athp_node_free_cb: deleted node for mac 00:24:21:28:8f:48 (0xdead00003d970000)
Memory modified after free 0xfffffe003d970000(16376) val=1 @ 0xfffffe003d973300
panic: Most recently used by 80211node

cpuid = 2
time = 1490135785
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe003b149530
vpanic() at vpanic+0x182/frame 0xfffffe003b149580
panic() at panic+0x43/frame 0xfffffe003b1495e0
mtrash_ctor() at mtrash_ctor+0x81/frame 0xfffffe003b149600
item_ctor() at item_ctor+0x2bb/frame 0xfffffe003b149650
malloc() at malloc+0x99/frame 0xfffffe003b1496a0
athp_node_alloc() at athp_node_alloc+0x32/frame 0xfffffe003b1496e0
ieee80211_tmp_node() at ieee80211_tmp_node+0x1f/frame 0xfffffe003b149720
ieee80211_send_error() at ieee80211_send_error+0x59/frame 0xfffffe003b149750
hostap_input() at hostap_input+0x8fa/frame 0xfffffe003b1497e0
ieee80211_input_mimo() at ieee80211_input_mimo+0x208/frame 0xfffffe003b149890
ieee80211_input_mimo_all() at ieee80211_input_mimo_all+0x48/frame 0xfffffe003b1498d0
ath10k_process_rx() at ath10k_process_rx+0x3bc/frame 0xfffffe003b1499c0
ath10k_htt_txrx_compl_task() at ath10k_htt_txrx_compl_task+0x6f6/frame 0xfffffe003b149b00
taskqueue_run_locked() at taskqueue_run_locked+0xaa/frame 0xfffffe003b149b80
taskqueue_thread_loop() at taskqueue_thread_loop+0x94/frame 0xfffffe003b149bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b149bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b149bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 0 tid 100127 ]
Stopped at      kdb_enter+0x37: movq    $0,0x1091706(%rip)

I turned full debugging on for a short moment and saw a lot of deadcode flying by on the console.
Just recording it here to be investigated later. Smells like a buffer/dma issue (hopefully just logging at the wrong place..)

athp0: pci ps sleep refcount 1 awake 1^M
^M
htt rx netbuf pop: : de c0 ad de de c0 ad de 40 00 00 00 00 ff ff ff ff ^M
htt rx netbuf pop: : ff ff 00 80 48 3d a3 48 ff ff ff ff ff ff e0 40 ^M
htt rx netbuf pop: : 00 00 01 08 8c 12 98 24 b0 48 60 6c f2 00 00 00 00 00 00 ^M
^M
athp0: ath10k_htc_rx_completion_handler: called!; eid=2^M
...

htt rx netbuf pop: : athp0: SWBA overrun on vdev 1, skipped old beacon^M
de c0 ad de de c0 ad de de c0 ad de de c0 ad de ^M
htt rx netbuf pop: : de c0 ad de de c0 athp0: SWBA overrun on vdev 1, skipped old beacon^M
ad de de c0 ad de de c0 ad de ^M
htt rx netbuf pop: : de c0 ad de de c0 ad de de c0 ad de de c0 ad de ^M
htt rx netbuf pop: : de c0 ad de de c0 ad de de c0 ad de de c0 ad de ^M
htt rx netbuf pop: : de c0 ad de de c0 ad de de c0 ad de de c0 ad de ^M
htt rx netbuf pop: : de c0 ad de de c0 ad de de c0 ad de de c0 ad de ^M
htt rx netbuf pop: : de c0 ad de de c0 ad de de c0 ad de de c0 ad de ^M
htt rx netbuf pop: : de c0 ad de de c0 ad de de c0 ad de de c0 ad de ^M
...

I have a firmware file for the QCA6174, 0x32 chipset hardware revision, I need to add it in to the repository for now I will put the google share link here to it.

from the ath10k submission:

Most of the txpower for the ath10k firmware is stored as twicepower (0.5 dB
steps). This isn't the case for max_antenna_gain - which is still expected
by the firmware as dB.

The firmware is converting it from dB to the internal (twicepower)
representation when it calculates the limits of a channel. This can be seen
in tpc_stats when configuring "12" as max_antenna_gain. Instead of the
expected 12 (6 dB), the tpc_stats shows 24 (12 dB).

Tested on QCA9888 and IPQ4019 with firmware 10.4-3.5.3-00057.

Fixes: 02256930d9b8 ("ath10k: use proper tx power unit")
Signed-off-by: Sven Eckelmann [email protected]

Hello,

Is this card Compex WLE600VX supported by this athp driver and does it support AP mode ? I plan to use it in OPNsense as an Wi-Fi AP.
If so how do I compile this driver (I'm not very familiar with FreeBSD) ?

Thank you.

This is FreeBSD as of 2020-05-28 with some extra debugging in the driver.

athp0: athp_vap_newstate: RUN -> INIT (is_setup=1) (is_dying=0)
athp0: failed to flush transmit queue (skip 0 ar-state 1): 0
athp0: ath10k_control_beaconing: called; enable=0
athp0: athp_node_free: called; mac=00:80:48:3d:a3:48 (0xfffffe003da7d000)
athp0: athp_node_free: delete peer for MAC 00:80:48:3d:a3:48 (0xfffffe003da7d000)
Sleeping on "tx_credits_wq" with the following non-sleepable locks held:
exclusive sleep mutex athp0_com_lock (athp0_com_lock) r = 0 (0xfffffe00326cc020) locked @ athp/sys/net80211/ieee80211_scan_sw.c:429
stack backtrace:
#0 0xffffffff80c314d1 at witness_debugger+0x71
#1 0xffffffff80c3246d at witness_warn+0x40d
#2 0xffffffff80bd0b28 at _sleep+0x58
#3 0xffffffff8234df14 at ath10k_wait_wait+0x84
#4 0xffffffff8235b9a9 at ath10k_wmi_cmd_send+0xa9
#5 0xffffffff8236c6f0 at ath10k_bss_info_changed_slottime+0xa0
#6 0xffffffff823484b0 at athp_update_slot+0x30
#7 0xffffffff80d42291 at ieee80211_reset_erp+0xa1
#8 0xffffffff80d34f2c at ieee80211_reset_bss+0x2c
#9 0xffffffff80d1ab5b at hostap_newstate+0x2fb
#10 0xffffffff80d415d6 at ieee80211_newstate_cb+0x1d6
#11 0xffffffff80c23e7a at taskqueue_run_locked+0xaa
#12 0xffffffff80c24ef4 at taskqueue_thread_loop+0x94
#13 0xffffffff80b823c0 at fork_exit+0x80
#14 0xffffffff8103e43e at fork_trampoline+0xe
Sleeping thread (tid 100142, pid 0) owns a non-sleepable lock
KDB: stack backtrace of thread 100142:
sched_switch() at sched_switch+0x5b2/frame 0xfffffe003b17f7f0
mi_switch() at mi_switch+0x155/frame 0xfffffe003b17f810
sleepq_switch() at sleepq_switch+0x11a/frame 0xfffffe003b17f850
sleepq_timedwait() at sleepq_timedwait+0x4b/frame 0xfffffe003b17f890
_sleep() at _sleep+0x26c/frame 0xfffffe003b17f930
ath10k_wait_wait() at ath10k_wait_wait+0x84/frame 0xfffffe003b17f960
ath10k_wmi_cmd_send() at ath10k_wmi_cmd_send+0xa9/frame 0xfffffe003b17f9c0
ath10k_bss_info_changed_slottime() at ath10k_bss_info_changed_slottime+0xa0/frame 0xfffffe003b17f9f0
athp_update_slot() at athp_update_slot+0x30/frame 0xfffffe003b17fa10
ieee80211_reset_erp() at ieee80211_reset_erp+0xa1/frame 0xfffffe003b17fa30
ieee80211_reset_bss() at ieee80211_reset_bss+0x2c/frame 0xfffffe003b17fa60
hostap_newstate() at hostap_newstate+0x2fb/frame 0xfffffe003b17fab0
ieee80211_newstate_cb() at ieee80211_newstate_cb+0x1d6/frame 0xfffffe003b17fb00
taskqueue_run_locked() at taskqueue_run_locked+0xaa/frame 0xfffffe003b17fb80
taskqueue_thread_loop() at taskqueue_thread_loop+0x94/frame 0xfffffe003b17fbb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b17fbf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b17fbf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
panic: sleeping thread
cpuid = 1
time = 1490243822
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe003b1663f0
vpanic() at vpanic+0x182/frame 0xfffffe003b166440
panic() at panic+0x43/frame 0xfffffe003b1664a0
propagate_priority() at propagate_priority+0x219/frame 0xfffffe003b1664e0
turnstile_wait() at turnstile_wait+0x380/frame 0xfffffe003b166530
__mtx_lock_sleep() at __mtx_lock_sleep+0x1cc/frame 0xfffffe003b1665c0
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe003b166610
ieee80211_beacon_update() at ieee80211_beacon_update+0x3b/frame 0xfffffe003b166680
ath10k_wmi_event_host_swba() at ath10k_wmi_event_host_swba+0x1e2/frame 0xfffffe003b166910
ath10k_wmi_10_2_op_rx() at ath10k_wmi_10_2_op_rx+0x2b9/frame 0xfffffe003b1669b0
ath10k_htc_rx_completion_handler() at ath10k_htc_rx_completion_handler+0x203/frame 0xfffffe003b166a40
ath10k_pci_ce_recv_data() at ath10k_pci_ce_recv_data+0xff/frame 0xfffffe003b166ac0
ath10k_ce_per_engine_service() at ath10k_ce_per_engine_service+0x8c/frame 0xfffffe003b166b00
ath10k_pci_ce_tasklet() at ath10k_pci_ce_tasklet+0x55/frame 0xfffffe003b166b20
ithread_loop() at ithread_loop+0x279/frame 0xfffffe003b166bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b166bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b166bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100137 ]
Stopped at      kdb_enter+0x37: movq    $0,0x10c9ad6(%rip)

Hey,

I have following card: QCA986x/988x 802.11ac Wireless Network Adapter
I already tried several branches from your and geramy's repository.

If I load kldload if_athp. I will always end up with:

link_elf_obj: symbol __mtx_assert undefined
linker_load_file: /boot/kernel/if_athp.ko - unsupported file type

I build a GENERIC Kernel with following extra options (since I had the same issues with INVARIANTS #11):

options         INVARIANTS
options         INVARIANT_SUPPORT
options         WITNESS
options         WITNESS_SKIPSPIN
options         DEBUG_LOCKS
options         DEBUG_VFS_LOCKS
options         DIAGNOSTIC

Does anyone have an idea what I could be doing wrong here?
Thanks in advantage.

P.S. all the modules are loading fine.

This manifests as a station thinking it's still associated but the athp + hostap combo not; net80211 sends unauthed error mgmt frames back to the station but because the subtype matches QOSNULL they're dropped.

my athp_send_mgmt() routine was an initial hack to filter out scan related frames before we had proper offloaded scan support and yes, QOSNULL / NO_DATA frames won't show up in this transmit path.

after upgrading pfsense to the latest 2.5 version does not work anymore
FreeBSD 12.0-RELEASE-p4

athp0: failed to fetch generic board data: -1
athp0: failed to fetch board file: -1
athp0: could not fetch firmware files (-1)
athp0: could not probe fw, clean up allocations, memory and retry. (-1)
athp0: ath10k_fetch_fw_file: firmware_get: athp_cal-pci-athp0.bin
athp_cal-pci-athp0.bin: could not load firmware image, error 2
athp0: ath10k_fetch_fw_file: firmware_get: athp_QCA988X_hw2.0_board.bin
athp_QCA988X_hw2.0_board.bin: could not load firmware image, error 8
athp0: failed to fetch generic board data: -1
athp0: failed to fetch board file: -1
athp0: could not fetch firmware files (-1)
athp0: could not probe fw, clean up allocations, memory and retry. (-1)

---- multiple times until ->>>

Fatal double fault
rip 0xffffffff80d54382 rsp 0xfffffe002e497fb0 rbp 0xfffffe002e498050
rax 0xffffffff7fffffff rdx 0xffffffffffffffff rbx 0x7fffffff
rcx 0 rsi 0xffffffff82c22a88 rdi 0xfffffe002e498080
r8 0 r9 0x7fffffff r10 0x8000deb3
r11 0xfffffe002e49866c r12 0xfffffe002e498080 r13 0x2
r14 0 r15 0x3 rflags 0x10082
cs 0x20 ss 0x28 ds 0x3b es 0x3b fs 0x13 gs 0x1b
fsbase 0x8002348d0 gsbase 0xffffffff82cb4200 kgsbase 0
cpuid = 0; apic id = 00
panic: double fault
cpuid = 0
time = 1558182999
KDB: enter: panic

all *.bin files are indeed inside /boot/modules

i put textdump file here (textdump.tar.3) -> https://drive.google.com/open?id=1fM-Jlmf8BY21kIEGueSxFWmrISZqcDj3

still working under FreeBSD 12.0-RELEASE-p3

I'm creating this issue as advised in #freebsd-wifi on EFNet.

I have a Dell XPS 13 9370 with a Killer Wireless-AC 1435 NIC, which seems to be based on the QCA6174.

I installed a 12.0-CURRENT snapshot[1] and then built this module to see what happens. After loading the module, I get a Kernel Page Fault panic:

Reading symbols from /boot/kernel/if_athp.ko...done.
Loaded symbols for /boot/kernel/if_athp.ko
...
Reading symbols from /boot/kernel/athp_QCA6174_hw3.0_board.bin.ko...done.
Loaded symbols for /boot/kernel/athp_QCA6174_hw3.0_board.bin.ko
Reading symbols from /boot/kernel/athp_QCA6174_hw3.0_firmware-4.bin.ko...done.
Loaded symbols for /boot/kernel/athp_QCA6174_hw3.0_firmware-4.bin.ko
#0  doadump (textdump=0) at pcpu.h:230
230	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) #0  doadump (textdump=0) at pcpu.h:230
#1  0xffffffff8043dcbb in db_dump (dummy=<value optimized out>, 
    dummy2=<value optimized out>, dummy3=<value optimized out>, 
    dummy4=<value optimized out>) at /usr/src/sys/ddb/db_command.c:574
#2  0xffffffff8043da89 in db_command (cmd_table=<value optimized out>)
    at /usr/src/sys/ddb/db_command.c:481
#3  0xffffffff8043d804 in db_command_loop ()
    at /usr/src/sys/ddb/db_command.c:534
#4  0xffffffff80440a2f in db_trap (type=<value optimized out>, 
    code=<value optimized out>) at /usr/src/sys/ddb/db_main.c:252
#5  0xffffffff80bddd23 in kdb_trap (type=12, code=0, tf=<value optimized out>)
    at /usr/src/sys/kern/subr_kdb.c:693
#6  0xffffffff81077911 in trap_fatal (frame=0xfffffe008a663580, 
    eva=18446741877233962312) at /usr/src/sys/amd64/amd64/trap.c:884
#7  0xffffffff81077a32 in trap_pfault (frame=0xfffffe008a663580, 
    usermode=<value optimized out>) at pcpu.h:230
#8  0xffffffff8107703a in trap (frame=0xfffffe008a663580)
    at /usr/src/sys/amd64/amd64/trap.c:427
#9  0xffffffff8105194c in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:230
#10 0xffffffff82a92d2b in __ath10k_htt_rx_ring_fill_n ()
   from /boot/kernel/if_athp.ko
#11 0xffffffff82a8fefc in ath10k_htt_rx_ring_fill_n ()
   from /boot/kernel/if_athp.ko
#12 0xffffffff82a8fe55 in ath10k_htt_rx_ring_refill ()
   from /boot/kernel/if_athp.ko
#13 0xffffffff82a5a466 in ath10k_core_start () from /boot/kernel/if_athp.ko
#14 0xffffffff82a5ba67 in ath10k_core_probe_fw () from /boot/kernel/if_athp.ko
#15 0xffffffff82a5cec0 in ath10k_core_register_work ()
   from /boot/kernel/if_athp.ko
#16 0xffffffff80bf15ec in taskqueue_run_locked (queue=0xfffff80003707200)
    at /usr/src/sys/kern/subr_taskqueue.c:465
#17 0xffffffff80bf23b8 in taskqueue_thread_loop (arg=<value optimized out>)
    at /usr/src/sys/kern/subr_taskqueue.c:757
#18 0xffffffff80b51dc4 in fork_exit (
    callout=0xffffffff80bf2330 <taskqueue_thread_loop>, 
    arg=0xfffffe0089957078, frame=0xfffffe008a6639c0)
    at /usr/src/sys/kern/kern_fork.c:1057
#19 0xffffffff810528fe in fork_trampoline ()
    at /usr/src/sys/amd64/amd64/exception.S:978
#20 0x0000000000000000 in ?? ()
Current language:  auto; currently minimal
(kgdb) 

I put the full crash dump details in Gist[2].

1. https://download.freebsd.org/ftp/snapshots/amd64/amd64/ISO-IMAGES/12.0/FreeBSD-12.0-CURRENT-amd64-20180719-r336479-memstick.img
2. https://gist.github.com/bradleythughes/3954a110d43d805b034f9c5047b4a7f8

We need to create the ability to load board-2.bin files for QCA6174 chipsets and pull the correct board file out of the board-2.bin combination file used by linux ath10k project.
I will be working on this support.

Map the EEPROM Codes from the ath10k driver to Country Codes in the mac80211/nl8021 driver.

Please, can anyone help me?

The following feature needs to be enabled, tested and implemented:
We need 802.11ac mode tested and working, please go into the code make sure that mode exists and is uncommented then it needs to be tested and vetted.

My wifi card is:
Qualcomm Atheros QCA9377 802.11ac Wireless Network Adapter (rev 30)
Does this work in freeBSD out of the box?

If not, should I have to buy, say this usb dongle?
https://pt.aliexpress.com/item/4000512051221.html?spm=a2g0o.productlist.0.0.b3403d411Axx6Y
Thx a lot

Can you provide a more standard compilation and installation documentation?thanks.

Bug test and make sure the ath10k vif works correctly and can have as many virtual interfaces as the wireless card supports without any bugs or crashes so that it can be enabled in the release and work with ifconfig properly.

finally I can resume testing these drivers,
the problem is that every few minutes i need to reconnect because internet stop working
this is what i have on my log

athp0: athp_node_free_cb: deleted node for mac 04:d6:aa:1a:6c:90 (0)
athp0: athp_node_alloc: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_alloc: add peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_free: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_free: delete peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_alloc_cb: added node for mac 04:d6:aa:1a:6c:90 (0xfffffe002fbd8000)
athp0: ath10k_clear_peer_keys: TODO
athp0: failed to flush transmit queue (skip 0 ar-state 1): 0
athp0: athp_node_free_cb: deleted node for mac 04:d6:aa:1a:6c:90 (0)
athp0: athp_node_alloc: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_alloc: add peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_free: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_free: delete peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_alloc_cb: added node for mac 04:d6:aa:1a:6c:90 (0xfffffe002fbd8000)
athp0: ath10k_clear_peer_keys: TODO
athp0: failed to flush transmit queue (skip 0 ar-state 1): 0
athp0: athp_node_free_cb: deleted node for mac 04:d6:aa:1a:6c:90 (0)
athp0: athp_node_alloc: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_alloc: add peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_free: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_free: delete peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_alloc_cb: added node for mac 04:d6:aa:1a:6c:90 (0xfffffe002fbd8000)
athp0: ath10k_clear_peer_keys: TODO
athp0: failed to flush transmit queue (skip 0 ar-state 1): 0
athp0: athp_node_free_cb: deleted node for mac 04:d6:aa:1a:6c:90 (0)
athp0: athp_node_alloc: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_alloc: add peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_free: called; mac=04:d6:aa:1a:6c:90
athp0: athp_node_free: delete peer for MAC 04:d6:aa:1a:6c:90
athp0: athp_node_alloc_cb: added node for mac 04:d6:aa:1a:6c:90 (0xfffffe002fbd8000)
athp0: ath10k_clear_peer_keys: TODO
athp0: failed to flush transmit queue (skip 0 ar-state 1): 0

can be every 5 minutes or less, and i just need to disconnect and reconnect my phone to make it work again

Here's a fun one!

ieee80211_send_error() calls ieee80211_tmp_node() to send an error frame to a peer that doesn't yet exist.
Unfortunately it doesn't plumb the node into the node table.
It then will send the frame and expects to be reclaimed once the send is complete.

However, for devices like ath10k, we need firmware nodes when sending data to peers and we're plumbing them up every time we allocate a node. So, when we send a frame to the non-BSS node it's doing this hack, creating multiple peers, and then it tries freeing them all - but the firmware just fails to free the non-existent firmware peer node after the first temp net80211 node is freed.

So, this is an interesting one to wrestle with. Do we try to fix this in ath10k for now? Can we send these error frames using the bss peer as the ath10k firmware peer rather than needing to craft up an entirely new node? Or does this need to be fixed inside of net80211 where we keep a separate tmp_node table that we check when creating temp or new nodes so we don't end up spamming the driver with multiple overlapping node creation/deletions?

I think they are obvious problems but... I can't make it to work.

The script build_modules seems to need a 13 kernel version not a 12 (it complains about undefined symbols: MA_NOTOWNED and MA_OWNED)... Is it possible to use it with a 12 version?

With a 13 kernel, I follow the instructions (no errors): running ./build_modules, building the kernel and installing it... But I can't find any file .ko or .bin in athp/otus/freebsd/src/sys/modules/athpfw/.

What I did wrong?

cannot set ATH10K_DBG_xxx, e.g., ATH10K_DBG_WMI, in a tunable we'll panic as the fwlog_mtx is not initialised by the time we lock the first event, which means some ordering is not quite right.

panic: mtx_lock() of spin mutex (null) @ sys/modules/athp/../../dev/athp/if_athp_fwlog.c:1552

Hello,
I have a Dell G3 with a QCA9377, and I can't make it work with this driver.
As far as I understood, the QCA9377 isn't in the supported models in the core.c, so I added the definitions and the required code to identify, reset and run it (copying the needed definitions from the driver in the Linux kernel).

The diff of my changes in the project and the dmesg from the boot with debug=on is attached.

If you need more information or may send me directions to what I'm missing in the source code let me know.

uname -a
FreeBSD freebsd-g3 12.0-RELEASE-p10 FreeBSD 12.0-RELEASE-p10 GENERIC  amd64

Thanks
dmesg.txt
qca9377_defs.patch.txt

I running QCA6174 with FreeBSD RELEASE 12.0 on my laptop, after load the driver the page fault error occurred.

I try to replace the board data based on issues #20 , but the issue still exist.

Does anyone have an idea for this issue? I need some help.

Infomation:
OS : FreeBSD 12.0
Driver : git clone --branch NEW_ATHP_ARVIF_LOCK https://github.com/Geramy/athp
Laptop : Lenovo T400

Command:
kldload athp_QCA6174_hw3.0_board.bin
kldload athp_QCA6174_hw3.0_firmware-4.bin
kldload if_athp

Log:
FreeBSD 12.0-RELEASE FreeBSD 12.0-RELEASE GENERIC amd64

panic: page fault

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:
athp0: wmi unified ready event not received

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x58
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff82a26fc1
stack pointer = 0x28:0xfffffe002e63b6c0
frame pointer = 0x28:0xfffffe002e63b720
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 0 (athp0 ath10k_at_wq)
trap number = 12
panic: page fault
cpuid = 1
time = 1581651376
KDB: stack backtrace:
0 0xffffffff80be7977 at kdb_backtrace+0x67
1 0xffffffff80b9b563 at vpanic+0x1a3
2 0xffffffff80b9b3b3 at panic+0x43
3 0xffffffff8107496f at trap_fatal+0x35f
4 0xffffffff810749c9 at trap_pfault+0x49
5 0xffffffff81073fee at trap+0x29e
6 0xffffffff8104f1d5 at calltrap+0x8
7 0xffffffff82a26e81 at ath10k_ce_init_pipe+0x31
8 0xffffffff82a28a59 at ath10k_pci_init_pipes+0x49
9 0xffffffff82a223a0 at ath10k_pci_warm_reset+0xf0
10 0xffffffff82a2225f at ath10k_pci_safe_chip_reset+0x3f
11 0xffffffff82a2a624 at ath10k_pci_hif_stop+0x64
12 0xffffffff82a2f14c at ath10k_hif_stop+0x2c
13 0xffffffff82a2e30b at ath10k_core_start+0x81b
14 0xffffffff82a2f837 at ath10k_core_probe_fw+0x2f7
15 0xffffffff82a32c88 at attempt_ath10k_core_probe_fw+0x18
16 0xffffffff82a30c97 at ath10k_core_register_work+0x27
17 0xffffffff80bf9cb4 at taskqueue_run_locked+0x154
Uptime: 4m44s

https://imgur.com/L4x229k
https://imgur.com/5fiUXcb
https://imgur.com/j6vGwho

Nathan Kuo

athp/athp-master/otus/freebsd/src/sys/modules/athp/../../dev/athp/if_athp_mac.c:3339:6: error: logical not is only applied to the left hand side of this bitwise operator [-Werror,-Wlogical-not-parentheses]
if (!ni->ni_flags & IEEE80211_NODE_HT)
^ ~
Should probably be changed to:
if (!(ni->ni_flags & IEEE80211_NODE_HT))

Error in ath10k_dbg call specifically referencing the j variable which is part of the loop iteration:

athp/athp-master/otus/freebsd/src/sys/modules/athp/../../dev/athp/if_athp_mac.c:3848:17: error: format specifies type 'ssize_t' (aka 'long') but the argument has type 'int' [-Werror,-Wformat]
func, j, arg.n_channels,

This is a backtrace for the Pull Request #26 .
I happens in AP mode.
I can easily trigger it by issuing say: ifconfig wlan0 channel 8

athp0: athp_vap_wme_update: called
athp0: ath10k_conf_tx: ac=0, cwmin=15, cwmax=63, aifs=3, txop=0
athp0: ath10k_conf_tx: ac=1, cwmin=15, cwmax=1023, aifs=7, txop=0
athp0: ath10k_conf_tx: ac=2, cwmin=7, cwmax=15, aifs=1, txop=3008
athp0: ath10k_conf_tx: ac=3, cwmin=3, cwmax=7, aifs=1, txop=1504
athp0: athp_vap_newstate: SCAN -> RUN (is_setup=1) (is_dying=0)
athp0: ath10k_vif_restart: called, but not started!
athp0: ath10k_vdev_restart: XXX: notice, isn't already started
athp0: ath10k_vdev_start_restart: called; dtim=0, intval=0; restart=1
athp0: ath10k_recalc_radar_detection: TODO
athp0: athp_vif_ap_setup: TODO: probe response template setup
athp0: athp_vif_ap_setup: TODO: set hidden_ssid flag if required
athp0: ath10k_control_beaconing: called; enable=1
athp0: ath10k_control_beaconing: TODO: fix_hidden_ssid!
athp0: athp_vif_ap_setup: TODO: RTS/CTS prot, ERP slot, ERP preamble
athp0: athp_vap_wme_update: called
athp0: ath10k_conf_tx: ac=0, cwmin=7, cwmax=1023, aifs=2, txop=0
athp0: ath10k_conf_tx: ac=1, cwmin=15, cwmax=1023, aifs=7, txop=0
athp0: ath10k_conf_tx: ac=2, cwmin=7, cwmax=15, aifs=1, txop=3008
PKTLOG [614586] WAL_DBGID_CHANNEL_CHANGE ( 0x7098f, 0 )
athp0: ath10k_conf_tx: ac=3, cwmin=3, cwmax=7, aifs=1, txop=1504
panic: Duplicate free of 0xfffff8003b4e3000 from zone 0xfffffe0007ac3000(mbuf_packet) slab 0xfffff8003b4e3fd8(0)

cpuid = 0
time = 1490284479
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe003b171480
vpanic() at vpanic+0x182/frame 0xfffffe003b1714d0
panic() at panic+0x43/frame 0xfffffe003b171530
uma_dbg_free() at uma_dbg_free+0x1f2/frame 0xfffffe003b171570
uma_zfree_arg() at uma_zfree_arg+0x130/frame 0xfffffe003b1715c0
mb_free_ext() at mb_free_ext+0x114/frame 0xfffffe003b1715f0
m_free() at m_free+0xd8/frame 0xfffffe003b171620
m_freem() at m_freem+0x28/frame 0xfffffe003b171640
_athp_freebuf() at _athp_freebuf+0x175/frame 0xfffffe003b171670
ath10k_wmi_event_host_swba() at ath10k_wmi_event_host_swba+0x7a7/frame 0xfffffe003b171910
ath10k_wmi_10_2_op_rx() at ath10k_wmi_10_2_op_rx+0x2b9/frame 0xfffffe003b1719b0
ath10k_htc_rx_completion_handler() at ath10k_htc_rx_completion_handler+0x203/frame 0xfffffe003b171a40
ath10k_pci_ce_recv_data() at ath10k_pci_ce_recv_data+0xff/frame 0xfffffe003b171ac0
ath10k_ce_per_engine_service() at ath10k_ce_per_engine_service+0x8c/frame 0xfffffe003b171b00
ath10k_pci_ce_tasklet() at ath10k_pci_ce_tasklet+0x55/frame 0xfffffe003b171b20
ithread_loop() at ithread_loop+0x279/frame 0xfffffe003b171bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b171bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b171bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100136 ]
Stopped at      kdb_enter+0x37: movq    $0,0x10c9ad6(%rip)

Hi Adrian,

I noticed this while trying to figure out things on an arm64.
A PREREAD and a POSTWRITE flag at the same time make very little sense.

Submitted by: bz
Sponsored by: Rubicon Communications, LLC (d/b/a "Netgate")

diff --git a/sys/dev/athp/if_athp_desc.c b/sys/dev/athp/if_athp_desc.c
index f40afbcc2cf8..b8712dad892a 100644
--- a/sys/dev/athp/if_athp_desc.c
+++ b/sys/dev/athp/if_athp_desc.c
@@ -378,7 +378,7 @@ athp_dma_mbuf_post_xmit(struct ath10k *ar, struct athp_dma_head *dh,
 {

        ATHP_DMA_LOCK(ar);
-       bus_dmamap_sync(dh->tag, dm->map, BUS_DMASYNC_PREREAD |
+       bus_dmamap_sync(dh->tag, dm->map, BUS_DMASYNC_POSTREAD |
            BUS_DMASYNC_POSTWRITE);
        ATHP_DMA_UNLOCK(ar);
 }

Sometimes firmware loading doesn't work on first try:

athp0: failed to receive control response completion, polling.. done 0
athp0: still no control response completion received, giving up.. done 0
athp0: ctl_resp never came in (-60, done 0)
athp0: failed to connect to HTC: -60

We can repeat this 1..n times (and I have seen really large n at one point when this was happening for more than an hour).

It seems in those cases we cat three CE interrupts but no more.

I've seen pipe 0 and pipe 1 coming in in both orders but not convinced myself that it is an actual race of some sort yet.
I have no insight into the firmware and wonder if that's something we have more control over?

Also upstream with the new chipset support that entire interrupt 0 is FW and things have been cleaned up and they only have 2 no longer 3 possible setups dealing with. Do you think it might be worth porting just that logic forward (also getting us closer to upstream)?