Candela Technologies Logo
 
http://www.candelatech.com
sales@candelatech.com
+1 360 380 1618 [PST, GMT -8]
Network Testing and Emulation Solutions

Ath10k Candela Technologies CT 10.1 Firmware

The CT 10.1 firmware is a modified version of the official firmware from Qualcom-Atheros based on the 10.1.467 release. It should support all features available in the upstream 10.1.467 firmware as well as additional features.

Want to help fund new ath10k CT firmware features with modest contributions? See the ath10k kickstarter page.

To use this firwmare, download one of the firmware images and rename it firmware-2.bin. The command below should work on most systems:

cp firmware-2-ct-full-community.bin /lib/firmware/ath10k/QCA988X/hw2.0/firmware-2.bin

Get the board.bin file from the official firmware site. Then, reboot or reload the ath10k_pci driver to start using the new firmware. Look in the kernel logs (or dmesg) to make sure the firmware version contains '-ct', such as: 10.1.467-ct-swcrypt-diet-012

For more advanced configuration options, see the 10.4 advanced config section. The fwcfg file logic works for at least 10.1 and 10.4 CT firmware.

There are two types of CT firmware: The community version supports all features EXCEPT connecting multipe vifs to the same AP when using encryption. The community version may be used for any purpose allowed by the official firmware from Qualcom-Atheros, including commercial applications.
firmware-2-ct-full-community.bin (latest).

The non-commercial firmware from Candela Technologies does support multiple station vifs connecting to a single AP (really, it supports rx-software-crypt, which is the enabling feature). The non-commercial firmware is NOT freely available. It is restricted to non-commerical use unless you arrange a commercial-use license with Candela Technologies. Contact sales@candelatech.com for additional information on this topic.
firmware-2-ct-non-commercial.bin (latest).

Any and all bug reports involving this firmware (and the modified kernels from Candela Technologies) should be sent to support@candelatech.com. Qualcom-Atheros is not responsible for the changes made to the modified firmware and should not be bothered with bug reports relating to it. Reports of success are welcome as well!

To submit a useful bug report, please include kernel logs, especially any firmware crash logs. These crash logs are often chunks of ascii hex. Candela has tools that can usually decode these, but due to NDA issues, these tools may not be shared with the general public. Candela engineers will attempt to decode any reported crashes and provide help as possible. Note that unless you have a contract with Candela that provides otherwise, any help with bugs may be slow or even not much actual help at all. Please also report the kernel version and any other details about how the problem was triggered.

Candela offers paid support options, please contact sales@candelatech.com if you have interest.

See the bottom of this page for some common crash signatures.

CT Firmware Differences from Official QCA Firmware

The ath10k firmware from Candela is based on the 10.1.467 firmware from QCA, but has quite a few added features and fixes. Some notable differences are listed below. Most of these require the kernel modifications in the 3.17 and higher Candela Linux kernels, but the firmware images will work on un-modified kernels for the standard features.

Known CT Firmware/Kernel Bugs

To take advantage of all of the CT firmware features, please consider using one of these kernels. These kernels are rebased fairly often to keep all CT patches at the top of the git changelog. 4.0 is currently the suggested kernel.

## Full Candela Technologies patch set
git clone https://github.com/greearb/linux-ct-3.17.git
or
git clone https://github.com/greearb/linux-ct-4.0.git
or
git clone https://github.com/greearb/linux-ct-4.4.git
or
git clone https://github.com/greearb/linux-ct-4.7.git
or
git clone https://github.com/greearb/linux-ct-4.9.git (beta-ish)

The CT firmware has a separate release number appended to the end of the version string. A large number of fixes have been added to the stock 10.1.467. The highlights of those are above. A more detailed changelog is kept for release 14 and above.

BETA (-19)
Support IBSS + RSN, don't TX-STBC when nss is 1.
Fix passing wrong object to some beacon and WDS methods.
Fix un-init variable that caused block-ack to fail sometimes.
See BETA release notes for details.
firmware-2-ct-full-community.bin 988X | 9887
No CT-HTT-MGT feature, no supported upstream features compiled out (no diet). Available for commercial and non-commercial use at no charge.
firmware-2-ct-non-commercial.bin 988X | 9887
No CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.
firmware-2-ct-non-commercial-full.bin 988X | 9887
No CT-HTT-MGT feature, no upstream features compiled out (no diet). Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.

These htt-mgt firmwares require driver patches (use ath10k-ct driver or CT kernel). See release notes.
firmware-2-ct-full-nrcc-community.bin 988X | 9887
No CT-HTT-MGT feature, no supported upstream features compiled out (no diet), Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Available for commercial and non-commercial use at no charge. See fwcfg notes to use this firmware.
firmware-2-ct-full-htt-mgt-community.bin 988X | 9887
Has CT-HTT-MGT feature, no upstream features compiled out (no diet). Available for commercial and non-commercial use at no charge.
firmware-2-ct-nrcc-community.bin 988X | 9887
No CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Available for commercial and non-commercial use at no charge. See fwcfg notes to use this firmware.
firmware-2-ct-htt-mgt-nrcc-community.bin 988X | 9887
Has CT-HTT-MGT feature, but swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Available for commercial and non-commercial use at no charge. See fwcfg notes to use this firmware.
firmware-2-ct-non-commercial-htt-mgt.bin 988X | 9887
Has CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.
firmware-2-ct-non-commercial-htt-mgt-nrcc.bin 988X | 9887
Has CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies. See fwcfg notes to use this firmware.
firmware-2-ct-non-commercial-full-htt-mgt.bin 9887
Has CT-HTT-MGT feature, no upstream features compiled out (no diet). Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.
firmware-2-ct-full-htt-mgt-nrcc-community.bin 9887
Has CT-HTT-MGT feature, no upstream features compiled out (no diet). Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies. See fwcfg notes to use this firmware.
10.1.467-ct-18
Big backport of 10.2 features, including ability to build 9887 firmware.
Fix 802.1q VLANs.
Fix issue where radio went deaf to scanning due to inverted boolean statement.
Fix rate-ctrl issue where stations (at least) could get stuck in a low rate.
See Release notes for details.
firmware-2-ct-full-community-18.bin 988X | 9887
No CT-HTT-MGT feature, no supported upstream features compiled out (no diet). Available for commercial and non-commercial use at no charge.
firmware-2-ct-non-commercial-18.bin 988X | 9887
No CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.
firmware-2-ct-non-commercial-full-18.bin 988X | 9887
No CT-HTT-MGT feature, no upstream features compiled out (no diet). Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.

These htt-mgt firmwares require driver patches (use ath10k-ct driver or CT kernel). See release notes.
firmware-2-ct-full-nrcc-community-18.bin 988X | 9887
No CT-HTT-MGT feature, no supported upstream features compiled out (no diet), Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Available for commercial and non-commercial use at no charge. See fwcfg notes to use this firmware.
firmware-2-ct-full-htt-mgt-community-18.bin 988X | 9887
Has CT-HTT-MGT feature, no upstream features compiled out (no diet). Available for commercial and non-commercial use at no charge.
firmware-2-ct-nrcc-community-18.bin 988X | 9887
No CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Available for commercial and non-commercial use at no charge. See fwcfg notes to use this firmware.
firmware-2-ct-non-commercial-htt-mgt-18.bin 988X | 9887
Has CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.
firmware-2-ct-non-commercial-htt-mgt-nrcc-18.bin 988X | 9887
Has CT-HTT-MGT feature, swbmiss, beacon filtering, roaming code, descriptor-mgt compiled out. Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies. See fwcfg notes to use this firmware.
firmware-2-ct-non-commercial-full-htt-mgt-18.bin 9887
Has CT-HTT-MGT feature, no upstream features compiled out (no diet). Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies.
firmware-2-ct-full-htt-mgt-nrcc-community-18.bin 9887
Has CT-HTT-MGT feature, no upstream features compiled out (no diet). Rate-ctrl host-caching (swap) is compiled out. This may help on systems with weak CPU or minimal host RAM. Supports rx-sw-crypt (commercial use not allowed unless you have a license from Candela Technologies. See fwcfg notes to use this firmware.
10.1.467-ct-17
Fix HTT-Mgt TX on 4.5 and higher kernels. Properly configure RX mask on startup to work around problem reported by Mr. Kazior. Allow configuring and disabling firmware station kickout messages. See Release notes for details.
firmware-2-ct-full-community-17.bin
firmware-2-ct-non-commercial-17.bin
firmware-2-ct-non-commercial-full-17.bin

These htt-mgt firmwares require a driver patch. See release notes.
firmware-2-ct-full-htt-mgt-community-17.bin
firmware-2-ct-non-commercial-htt-mgt-17.bin
firmware-2-ct-non-commercial-full-htt-mgt-17.bin
10.1.467-ct-16
Auto-calculate base MAC addr, allow disabling 20,40,80Mhz bandwidths for TX, fix beacon-miss crash, backport iqcal baseband hang fix, disable congestion bin logic, allocate more stateless tids to stop rare crash, re-work rate-ctrl cache to deal better with many peers, backport AXI/CE fix from 10.2, fix scan requests for many ssids.
See Release notes for details.
firmware-2-ct-full-community-16.bin
firmware-2-ct-non-commercial-16.bin
firmware-2-ct-non-commercial-full-16.bin

These htt-mgt firmwares require a driver patch. See release notes.
firmware-2-ct-full-htt-mgt-community-16.bin
firmware-2-ct-non-commercial-htt-mgt-16.bin
firmware-2-ct-non-commercial-full-htt-mgt-16.bin
10.1.467-ct-15
Support management over HTT, fix 802.11r, lots of rate-ctrl changes, monitor-mode receives assoc-request and other frames it was previously dropping, allow configuring some CCA related values to better pass regulatory tests, off-channel fixes
See Release notes for details.
firmware-2-ct-full-community-15.bin
firmware-2-ct-non-commercial-15.bin
firmware-2-ct-non-commercial-full-15.bin

These htt-mgt firmwares require a driver patch. See release notes.
firmware-2-ct-full-htt-mgt-community-15.bin
firmware-2-ct-non-commercial-htt-mgt-15.bin
firmware-2-ct-non-commercial-full-htt-mgt-15.bin

10.1.467-ct-14
IBSS improvements, increase tx power for NSS < 3 rates, support setting mgmt tx-rate, return proper tx-status, bug-fixes in rate-ctrl, etc.
See Release notes.
firmware-2-ct-full-community-14.bin
firmware-2-ct-non-commercial-14.bin
firmware-2-ct-non-commercial-full-14.bin

10.1.467-ct-013
Add IBSS/AHDOC support.
Work-around tx-credits hang due to WMI/CE lockup in firmware (requires ath10k driver patches)
Attempt to fix a few asserts reported by users (scan code, rate-ctrl, resource-mgr, etc)
firmware-2-ct-full-community-13.bin
firmware-2-ct-non-commercial-13.bin
firmware-2-ct-non-commercial-full-13.bin

10.1.467-ct-012
Pay better attention to max-nss in rate-control logic.
Allow to request no channel reservation when starting vdev (improves connect time, especially with multiple vdevs)
Fix crash when using raw-tx mode.
firmware-2-ct-full-community-12.bin
firmware-2-ct-non-commercial-12.bin
firmware-2-ct-non-commercial-full-12.bin

10.1.467-ct-011
Stop using feature flag that is now used by upstream 10.2.x firmware. This lets CT firmware work with latest ath10k driver.
firmware-2-ct-full-community-11.bin
firmware-2-ct-non-commercial-11.bin
firmware-2-ct-non-commercial-full-11.bin

10.1.467-ct-010
Fix bug introduced in version 009 (related to moving some structures to IRAM).
Support the assert-on-purpose ath10k driver patch recently applied to upstream.
Slight optimization to use about 1k less IRAM.
firmware-2-ct-full-community-10.bin
firmware-2-ct-non-commercial-10.bin
firmware-2-ct-non-commercial-full-10.bin

10.1.467-ct-009
Improve RAM usage: Re-organized, trimmed, and otherwise made better use of RAM. Allow compiling out swbmiss, beacon filtering, roaming code. Images with 'full' in their name do NOT have the previously mentioned features compiled out. Over-all, freed up about 80k of extra RAM, which can be used for more vdevs, peers, buffers, etc.
Supports 64 vdevs (one should be reserved for monitor interface, so effectively 63 vdevs for current kernels.)
firmware-2-ct-full-community-9.bin
firmware-2-ct-non-commercial-9.bin
firmware-2-ct-non-commercial-full-9.bin

10.1.467-ct-008
Fix crash related to AP configured with IBSS_RSN, reported and tested by Emanuel Taube.
Improve memory usage by packing structs and moving some stuff to IRAM. Can now support 44 vdevs.
Remove some un-needed MEMSET operations, might help performance a very small bit (this was not hot-path items as far as I can tell.).
firmware-2-ct-community-8.bin
firmware-2-ct-non-commercial-8.bin

10.1.467-ct-007
Save some RAM by more tightly packing structures. Enables an additional vdev, so can now support 37.
firmware-2-ct-community-7.bin
firmware-2-ct-non-commercial-7.bin

10.1.467-ct-006
Disable the scan-on-operating-channel-only optimization. This was not working right. Will fix and re-enable this sometime later.
firmware-2-ct-community-6.bin
firmware-2-ct-non-commercial-6.bin

10.1.467-ct-005
Fix inverted scan rx-filter logic. Improves scan all around, and fixes completely broken scan on DFS channels.
firmware-2-ct-community-5.bin
firmware-2-ct-non-commercial-5.bin

10.1.467-ct-004
Add support for flushing all tids for all peers for all vdevs. Hopefully this will help ath10k driver flush itself faster.
Changed order of some patches, but over-all code should not be modified.
firmware-2-ct-community-4.bin
firmware-2-ct-non-commercial-4.bin

10.1.467-ct-003
Hit two more asserts in overnight testing of -002:
Attempt to work around assert related to scanning while deleting vdev.
Attempt to work around assert in rate-control logic.
firmware-2-ct-community-3.bin
firmware-2-ct-non-commercial-3.bin

10.1.467-ct-002
Attempt to work around crash related to scanning while deleting vdev.
Attempt to work around crash in rate-control logic.
firmware-2-ct-community-2.bin
firmware-2-ct-non-commercial-2.bin

10.1.467-ct-001
Implemented community v/s non-commercial-only builds.
Added numeric versioning for easier bug reporting.
firmware-2-ct-community-1.bin
firmware-2-ct-non-commercial-1.bin

CT Firmware Crash Signatures

There is at least one persistent firmware crash that I have not been able to fix (and do not have a lot of ideas on how to attempt to fix it). This section gathers details on such known crashes so that users can attempt to understand if they are seeing a known crash. Please report it anyway, but I am especially interested in crashes not listed here. Since the crash-decode tool cannot be made public, you have to make do with searching for specific hex.

Firmware CE Engine assert
There is a known bug, seen on x86, Gateworks Ventana boards and probably everywhere else. It is seen with WLE900VX as well as Doodle-Labs ACE-DB-3, and probably others. It is seen with upstream firmware-5.bin and stock kernels, so this is not something specific to CT firmware or kernels. This bug is seen in both AP and Station mode.

The bug is that the CE engine in the firmware reports a fatal error and then asserts. It is very easy to trigger this problem if you try to transmit high-speed UDP traffic while the RF network is very busy. A 99.9% constant-transmit source to act as a blocking signal will reproduce this bug within seconds.

A more general test case is typically something like: Set up AP with 8+ stations associated, use wget (or similar) to download 1MB web pages over and over to simulate streaming media, and firmware will typically crash in less than 10 hours.

At least with a recent version 14 firmware (community-build), the crash site is at address: 0x009b5a8d. Likely any crash very near that address on version 14 firmware is the same bug. If you are running a CT 3.17 or higher kernel, or at least with those patches applied, you will often also see a 0x9110aaa1 signature (this is a firmware debuglog message that prints before the assert hits). The stock driver may not print out the firmware debuglog info.

For instance, here is a hex-dump of the binary crash log captured from /debug/ieee80211/phy1/ath10k/fw_crash_dump after a firmware crash that shows this signature:

hexdump ~/tmp/crashphy1.dump.2.4ghz |more

0000000 5441 3148 4b30 462d 2d57 5544 504d 0000
0000010 ab00 0000 0001 0000 07b3 9ec8 3f6f 4e6d
0000020 2e97 3201 00b1 d4c1 02ff 0432 0000 0000
0000030 016c 4100 0041 0000 01d3 0000 0000 0000
0000040 0000 0000 0003 0000 003f 0000 003f 0000
0000050 085b 0000 01b2 3380 0003 0000 3031 312e
0000060 342e 3736 632d 2d74 6f63 2d6d 7566 6c6c
0000070 302d 3431 342d 3431 3862 0061 7906 5537
0000080 0000 0000 b8e3 1b4a 0000 0000 0e05 0003
0000090 2e33 3431 352e 5320 504d 6d20 646f 755f
00000a0 6c6e 616f 2064 5241 764d 2037 3270 3876
00000b0 0020 0000 0000 0000 0000 0000 0000 0000
00000c0 0000 0000 0000 0000 0000 0000 0000 0000
00000d0 9fa4 0040 16a0 0040 0c00 0040 d4f0 0040
00000e0 0000 0000 0000 0000 0000 0000 0000 0000
*
0000150 0000 0000 00f0 0000 016c 4100 15b3 0000
0000160 5a8d 009b 5b31 0095 5a8d 009b 0530 0006
.....
00006b0 aaa1 9110
....
Note the 5a8d 009b in line 0x160..that is the signature for this crash. Farther down in the file you may also see the aaa1 9110 signature from the dbglog entry.

Firmware CE watchdog assert
CT firmware has a WMI message watchdog feature that can be enabled when using the CT patched drivers/kernels. The driver will send no-operation (NOP) message every second to the firmware. After the firmware receives one of these messages, if it ever does NOT receive the message for 5 seconds in a row after that, it will assert and crash. This allows the host to take recovery actions instead of just having the system effectively hang forever.

The signature for this type of crash is to see 0x91103345 in the debug-log contents when firmware crashes, for instance:

[   36.914223] ath10k_pci 0000:05:00.0: firmware crashed! (uuid fdbe13ae-630d-4079-8ec3-86f69887fe98)
[   36.914251] ath10k_pci 0000:05:00.0: qca988x hw2.0 (0x4100016c, 0x043202ff) fw 10.1.467-ct-com-full-014-ff596b api 2 htt 2.1
[   36.914272] ath10k_pci 0000:05:00.0: debug 0 debugfs 1 tracing 0 dfs 0 testmode 1
[   36.919384] ath10k_pci 0000:05:00.0: firmware register dump:
[   36.919408] ath10k_pci 0000:05:00.0: [00]: 0x4100016C 0x000015B3 0x009A90B7 0x00955B31
[   36.919428] ath10k_pci 0000:05:00.0: [04]: 0x009A90B7 0x00060130 0x00000005 0x00000032
[   36.919446] ath10k_pci 0000:05:00.0: [08]: 0x0040ECB0 0x00411030 0x00400000 0x00000005
[   36.919465] ath10k_pci 0000:05:00.0: [12]: 0x00000009 0x00000000 0x00958360 0x0095836B
[   36.919482] ath10k_pci 0000:05:00.0: [16]: 0x00958080 0x0094085D 0x00000000 0x00000000
[   36.919501] ath10k_pci 0000:05:00.0: [20]: 0x409A90B7 0x0040AE44 0x00009198 0x00400000
[   36.919519] ath10k_pci 0000:05:00.0: [24]: 0x80944C31 0x0040AEA4 0x00411294 0xC09A90B7
[   36.919537] ath10k_pci 0000:05:00.0: [28]: 0x80942BE7 0x0040AED4 0x00411294 0x00000000
[   36.919555] ath10k_pci 0000:05:00.0: [32]: 0x80942EB3 0x0040AEF4 0x004090A0 0x00409110
[   36.919572] ath10k_pci 0000:05:00.0: [36]: 0x80940F18 0x0040AF14 0x00000008 0x00403A20
[   36.919590] ath10k_pci 0000:05:00.0: [40]: 0x80940EEA 0x0040AF44 0x00400000 0x00000000
[   36.919607] ath10k_pci 0000:05:00.0: [44]: 0x80940F31 0x0040AF64 0x00401C10 0x00400600
[   36.919624] ath10k_pci 0000:05:00.0: [48]: 0x40940024 0x0040AF84 0x004068E8 0x004068E8
[   36.919642] ath10k_pci 0000:05:00.0: [52]: 0x00000000 0x0040AFA4 0x009BB001 0x00040020
[   36.919658] ath10k_pci 0000:05:00.0: [56]: 0x00403BEC 0x00000000 0x00000001 0x00400600
[   36.924724] ath10k_pci 0000:05:00.0: state: 1 debug log header, dbuf: 0x412548  dropped: 0
[   36.927300] ath10k_pci 0000:05:00.0: state: 1 [0] next: 0x412560 buf: 0x4103ac sz: 1500 len: 216 count: 8 free: 0
[   36.929840] ATH10K_DBG_BUFFER:
[   36.929860] ath10k: [0000]: 00009198 17FC0432 00000000 00000704 00000005 00000000 00000000 00009198
[   36.929876] ath10k: [0008]: 17FC0432 00000000 00000000 00000000 00000000 00000000 00009198 17FC0432
[   36.929892] ath10k: [0016]: 00000001 00000000 00000000 00000000 00000000 00009198 17FC0432 00000002
[   36.929926] ath10k: [0024]: 00000000 00000000 00000000 00000000 00009199 17FC0432 00000003 00000000
[   36.929951] ath10k: [0032]: 00000000 00000000 00000000 00009199 17FC0432 00000004 00000000 00000000
[   36.929977] ath10k: [0040]: 00000000 00000000 00009199 0FFC0432 91103345 00006F07 00009198 00009199
[   36.930003] ath10k: [0048]: 17FC0001 000015B3 000015B3 0040AD34 4100016C 00000000
[   36.930016] ATH10K_END

Candela  Technologies, 2417 Main Street, Suite 201, Ferndale, WA 98248, USA
www.candelatech.com | sales@candelatech.com | +1.360.380.1618
Google+ | Facebook | LinkedIn | Blog
Last modified: Fri May 19 10:13:49 PDT 2017