[PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Denis Kalashnikov]

Some of the Mikrotik R11e-2HPnD cards have EEPROM where is
flashed that a card has 3 chains, but actually all this cards
have only 2. This leads ath9k to write into the logs:
'ath: phy0: Unable to reset channel, reset status -5' and
stations don't see that AP.

Mikrotik R11e-2HPnD is based on AR9582 chip.

Signed-off-by: Denis Kalashnikov <denis281089@gmail.com>
---

Changelog:

Changes since v2:
  Use macros AR_SREV_9580_10 to select only AR9582 chips (they all
  have only 2 chains) instead of more general macros AR_SREV_9580
  that selects not only AR9582 but also AR9580 chips with 3 chains.

Changes since v1:
  No changes, only resending through 'git send-email' instead of Gmail.

 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index b4885a700296..86a9f49ae0d0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3373,6 +3373,15 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
 		cptr -= (COMP_HDR_LEN + osize + COMP_CKSUM_LEN);
 	}
 
+	/**
+	 * Fix firmware bug of some Mikrotik R11e-2HPnD cards (based on AR9582)
+	 * that claim that they have 3 chains, but actually have only 2.
+	 */
+	if (AR_SREV_9580_10(ah)) {
+		eep = (struct ar9300_eeprom *)mptr;
+		eep->baseEepHeader.txrxMask &= 0x33;
+	}
+
 	kfree(word);
 	return cptr;
 
-- 
2.23.0

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Felix Fietkau]

On 2020-01-10 14:21, Denis Kalashnikov wrote:
> Some of the Mikrotik R11e-2HPnD cards have EEPROM where is
> flashed that a card has 3 chains, but actually all this cards
> have only 2. This leads ath9k to write into the logs:
> 'ath: phy0: Unable to reset channel, reset status -5' and
> stations don't see that AP.
> 
> Mikrotik R11e-2HPnD is based on AR9582 chip.
> 
> Signed-off-by: Denis Kalashnikov <denis281089@gmail.com>
> ---
> 
> Changelog:
> 
> Changes since v2:
>   Use macros AR_SREV_9580_10 to select only AR9582 chips (they all
>   have only 2 chains) instead of more general macros AR_SREV_9580
>   that selects not only AR9582 but also AR9580 chips with 3 chains.
I don't think you can detect AR9582 based on SREV. Where did you get
this information from?

- Felix

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Denis Kalashnikov]

I read value from the SREV register of AR9582 -- got 0x001c04ff. I
looked through the code of ath9k and found out that in this case the
revision is 4. So, since AR_SREV_REVISION_9580_10 is defined as 4, I
logically concluded that AR_SREV_9580_10 would do the job. But you
suspicions turned to be right. I tested AR9580 now and it has the same
value as AR9582 in the SREV register -- 0x001c04ff. PCI Subsystem ID
is zero on those Mikrotik cards, so it is not useful. Felix, guys, may
be somebody have any thoughts how we can distinguish AR9582? Or that a
chip has only 2 chains? May be values from other registers?

сб, 11 янв. 2020 г. в 13:37, Felix Fietkau <nbd@nbd.name>:
>
> On 2020-01-10 14:21, Denis Kalashnikov wrote:
> > Some of the Mikrotik R11e-2HPnD cards have EEPROM where is
> > flashed that a card has 3 chains, but actually all this cards
> > have only 2. This leads ath9k to write into the logs:
> > 'ath: phy0: Unable to reset channel, reset status -5' and
> > stations don't see that AP.
> >
> > Mikrotik R11e-2HPnD is based on AR9582 chip.
> >
> > Signed-off-by: Denis Kalashnikov <denis281089@gmail.com>
> > ---
> >
> > Changelog:
> >
> > Changes since v2:
> >   Use macros AR_SREV_9580_10 to select only AR9582 chips (they all
> >   have only 2 chains) instead of more general macros AR_SREV_9580
> >   that selects not only AR9582 but also AR9580 chips with 3 chains.
> I don't think you can detect AR9582 based on SREV. Where did you get
> this information from?
>
> - Felix

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Felix Fietkau]

On 2020-01-13 15:13, Denis Kalashnikov wrote:
> I read value from the SREV register of AR9582 -- got 0x001c04ff. I
> looked through the code of ath9k and found out that in this case the
> revision is 4. So, since AR_SREV_REVISION_9580_10 is defined as 4, I
> logically concluded that AR_SREV_9580_10 would do the job. But you
> suspicions turned to be right. I tested AR9580 now and it has the same
> value as AR9582 in the SREV register -- 0x001c04ff. PCI Subsystem ID
> is zero on those Mikrotik cards, so it is not useful. Felix, guys, may
> be somebody have any thoughts how we can distinguish AR9582? Or that a
> chip has only 2 chains? May be values from other registers?
I'm not aware of any register that would have this information. Maybe
you could send those cards back to Mikrotik because they have faulty
EEPROM data?

- Felix

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Tom Psyborg]

On 13/01/2020, Denis Kalashnikov <denis281089@gmail.com> wrote:
> I read value from the SREV register of AR9582 -- got 0x001c04ff. I
> looked through the code of ath9k and found out that in this case the
> revision is 4. So, since AR_SREV_REVISION_9580_10 is defined as 4, I
> logically concluded that AR_SREV_9580_10 would do the job. But you
> suspicions turned to be right. I tested AR9580 now and it has the same
> value as AR9582 in the SREV register -- 0x001c04ff. PCI Subsystem ID
> is zero on those Mikrotik cards, so it is not useful. Felix, guys, may
> be somebody have any thoughts how we can distinguish AR9582? Or that a
> chip has only 2 chains? May be values from other registers?
>

read MAC OUI any apply only to mikrotik ones?

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Denis Kalashnikov]

Using MAC address for distinguishing these cards is a good idea for
local/ad-hoc solution. Thanks guys for participating in the question
and help. We decided to send these cards back to Mikrotik.

вт, 14 янв. 2020 г. в 05:52, Tom Psyborg <pozega.tomislav@gmail.com>:
>
> On 13/01/2020, Denis Kalashnikov <denis281089@gmail.com> wrote:
> > I read value from the SREV register of AR9582 -- got 0x001c04ff. I
> > looked through the code of ath9k and found out that in this case the
> > revision is 4. So, since AR_SREV_REVISION_9580_10 is defined as 4, I
> > logically concluded that AR_SREV_9580_10 would do the job. But you
> > suspicions turned to be right. I tested AR9580 now and it has the same
> > value as AR9582 in the SREV register -- 0x001c04ff. PCI Subsystem ID
> > is zero on those Mikrotik cards, so it is not useful. Felix, guys, may
> > be somebody have any thoughts how we can distinguish AR9582? Or that a
> > chip has only 2 chains? May be values from other registers?
> >
>
> read MAC OUI any apply only to mikrotik ones?

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Sebastian Gottschall]

>> read MAC OUI any apply only to mikrotik ones?

checking subvendor and subdevice id is usefull. mikrotik has special 
values here

the R11e-2HPnD card has

subvendor 0x19b6

subdevice 0xd016

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Tom Psyborg]

On 15/01/2020, Sebastian Gottschall <s.gottschall@newmedia-net.de> wrote:
>
>>> read MAC OUI any apply only to mikrotik ones?
>
> checking subvendor and subdevice id is usefull. mikrotik has special
> values here
>
> the R11e-2HPnD card has
>
> subvendor 0x19b6
>
> subdevice 0xd016
>
>

that i already suggested but it appears his units have zeroed sub fields

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Sebastian Gottschall]

>> checking subvendor and subdevice id is usefull. mikrotik has special
>> values here
>>
>> the R11e-2HPnD card has
>>
>> subvendor 0x19b6
>>
>> subdevice 0xd016
>>
>>
> that i already suggested but it appears his units have zeroed sub fields
if it has zero subfields it has no original eeprom but a modified one. 
all mikrotik cards with no exception have the subvendor and subdevice id 
set.
the subvendor and subdevice is is stored in the eeprom. or the eeprom 
could be also broke, but in this case the values should be 0xffff
i have several original mikrotik cards of this type and this is where i 
got these values from. are you sure that your card is no immitation?
can he send me a picture of this card?

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Tom Psyborg]

On 16/01/2020, Sebastian Gottschall <s.gottschall@newmedia-net.de> wrote:
>>> checking subvendor and subdevice id is usefull. mikrotik has special
>>> values here
>>>
>>> the R11e-2HPnD card has
>>>
>>> subvendor 0x19b6
>>>
>>> subdevice 0xd016
>>>
>>>
>> that i already suggested but it appears his units have zeroed sub fields
> if it has zero subfields it has no original eeprom but a modified one.
> all mikrotik cards with no exception have the subvendor and subdevice id
> set.
> the subvendor and subdevice is is stored in the eeprom. or the eeprom
> could be also broke, but in this case the values should be 0xffff
> i have several original mikrotik cards of this type and this is where i
> got these values from. are you sure that your card is no immitation?
> can he send me a picture of this card?
>

oh really? probably some fools then tampered with his cards and tried
to screw him. your units work without this patch, and tx/rx chain
reads out 0x3 ?

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Sebastian Gottschall]

Am 16.01.2020 um 08:46 schrieb Tom Psyborg:
> On 16/01/2020, Sebastian Gottschall <s.gottschall@newmedia-net.de> wrote:
>>>> checking subvendor and subdevice id is usefull. mikrotik has special
>>>> values here
>>>>
>>>> the R11e-2HPnD card has
>>>>
>>>> subvendor 0x19b6
>>>>
>>>> subdevice 0xd016
>>>>
>>>>
>>> that i already suggested but it appears his units have zeroed sub fields
>> if it has zero subfields it has no original eeprom but a modified one.
>> all mikrotik cards with no exception have the subvendor and subdevice id
>> set.
>> the subvendor and subdevice is is stored in the eeprom. or the eeprom
>> could be also broke, but in this case the values should be 0xffff
>> i have several original mikrotik cards of this type and this is where i
>> got these values from. are you sure that your card is no immitation?
>> can he send me a picture of this card?
>>
> oh really? probably some fools then tampered with his cards and tried
> to screw him. your units work without this patch, and tx/rx chain
> reads out 0x3 ?
yes. i have about 20 - 25 of them in use and the chaininfo is correct 
and also the subdevice and subvendor id
is correct but i'm highly interesting finding out more about this case 
here. so do we have just have
a fake mikrotik card here of a known chinese marketplace or is it a real 
one. and more interesting

if you install this card on a mikrotik board, what does routeros show

Sebastian

>   
>

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Denis Kalashnikov]

These cards have a very strange eeprom (we compared their eeprom with
eeprom of the same Mikrotik cards but without these problems). Now we
are discussing with our supplier how this is possible.

чт, 16 янв. 2020 г. в 11:50, Sebastian Gottschall
<s.gottschall@newmedia-net.de>:
>
>
> Am 16.01.2020 um 08:46 schrieb Tom Psyborg:
> > On 16/01/2020, Sebastian Gottschall <s.gottschall@newmedia-net.de> wrote:
> >>>> checking subvendor and subdevice id is usefull. mikrotik has special
> >>>> values here
> >>>>
> >>>> the R11e-2HPnD card has
> >>>>
> >>>> subvendor 0x19b6
> >>>>
> >>>> subdevice 0xd016
> >>>>
> >>>>
> >>> that i already suggested but it appears his units have zeroed sub fields
> >> if it has zero subfields it has no original eeprom but a modified one.
> >> all mikrotik cards with no exception have the subvendor and subdevice id
> >> set.
> >> the subvendor and subdevice is is stored in the eeprom. or the eeprom
> >> could be also broke, but in this case the values should be 0xffff
> >> i have several original mikrotik cards of this type and this is where i
> >> got these values from. are you sure that your card is no immitation?
> >> can he send me a picture of this card?
> >>
> > oh really? probably some fools then tampered with his cards and tried
> > to screw him. your units work without this patch, and tx/rx chain
> > reads out 0x3 ?
> yes. i have about 20 - 25 of them in use and the chaininfo is correct
> and also the subdevice and subvendor id
> is correct but i'm highly interesting finding out more about this case
> here. so do we have just have
> a fake mikrotik card here of a known chinese marketplace or is it a real
> one. and more interesting
>
> if you install this card on a mikrotik board, what does routeros show
>
> Sebastian
>
> >
> >

Re: [PATCH v3] ath9k: fix firmware bug in some Mikrotik R11e-2HPnD cards

[Sebastian Gottschall]

habe you checked them with routeros? i mean, routeros should show the 
same wrong values if i'm correct
and in that case you should contact also the official vendor mikrotik 
about it. it might be a production fault

Am 16.01.2020 um 11:44 schrieb Denis Kalashnikov:
> These cards have a very strange eeprom (we compared their eeprom with
> eeprom of the same Mikrotik cards but without these problems). Now we
> are discussing with our supplier how this is possible.
>
> чт, 16 янв. 2020 г. в 11:50, Sebastian Gottschall
> <s.gottschall@newmedia-net.de>:
>>
>> Am 16.01.2020 um 08:46 schrieb Tom Psyborg:
>>> On 16/01/2020, Sebastian Gottschall <s.gottschall@newmedia-net.de> wrote:
>>>>>> checking subvendor and subdevice id is usefull. mikrotik has special
>>>>>> values here
>>>>>>
>>>>>> the R11e-2HPnD card has
>>>>>>
>>>>>> subvendor 0x19b6
>>>>>>
>>>>>> subdevice 0xd016
>>>>>>
>>>>>>
>>>>> that i already suggested but it appears his units have zeroed sub fields
>>>> if it has zero subfields it has no original eeprom but a modified one.
>>>> all mikrotik cards with no exception have the subvendor and subdevice id
>>>> set.
>>>> the subvendor and subdevice is is stored in the eeprom. or the eeprom
>>>> could be also broke, but in this case the values should be 0xffff
>>>> i have several original mikrotik cards of this type and this is where i
>>>> got these values from. are you sure that your card is no immitation?
>>>> can he send me a picture of this card?
>>>>
>>> oh really? probably some fools then tampered with his cards and tried
>>> to screw him. your units work without this patch, and tx/rx chain
>>> reads out 0x3 ?
>> yes. i have about 20 - 25 of them in use and the chaininfo is correct
>> and also the subdevice and subvendor id
>> is correct but i'm highly interesting finding out more about this case
>> here. so do we have just have
>> a fake mikrotik card here of a known chinese marketplace or is it a real
>> one. and more interesting
>>
>> if you install this card on a mikrotik board, what does routeros show
>>
>> Sebastian
>>
>>>