2407456_en-US

はい

IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Hello,

I struggle starting an IW610G module on openwrt 25 (6.12 kernel). Enumeration goes well now, firmware download seems too but I face a crash.

USB enumeration and firmware download succeed every time. The module boots its main firmware, prints `WLAN FW is active`, loads a VDLL block (48000 bytes) — and then, **consistently ~3.9–4.1 seconds later**, the firmware crashes and triggers its own dump (`FW trigger fw dump`). This timing is remarkably deterministic across dozens of boots (cold boot and warm EHCI-rebind cycles alike), which makes us suspect a fixed internal timer/watchdog rather than random signal noise.

Full firmware dump (`file_fwdump`, 1,230,600 bytes) and driver info dump (`file_drv_info`, 259,772 bytes) from this exact boot are attached.

Full relevant dmesg excerpt from the latest clean boot:

[ 34.484411] usb 1-1: New USB device found, idVendor=0471, idProduct=0214, bcdDevice=40.00
[ 34.500356] usb 1-1: Product: NXP Wireless Device
[ 34.525526] VID/PID = 471/214, Boot2 version = 4000
[ 34.573668] Request firmware: nxp/usbusb_iw610.bin.se
[ 37.189918] fw_dnld: 808824 bytes downloaded
[ 37.381917] usb 1-1: USB disconnect, device number 2
[ 37.883662] usb 1-1: new high-speed USB device number 3 using ehci-platform
[ 38.115044] usb 1-1: New USB device found, idVendor=0471, idProduct=0215, bcdDevice=32.01
[ 38.131013] usb 1-1: Product: Bluetooth and Wireless LAN Composite Device
[ 38.288804] USB probe: idVendor=471 idProduct=215 bInterfaceNumber=0
[ 38.295470] VID/PID = 471/215, Boot2 version = 3201
[ 38.300509] woal_usb_probe: invalid endpoint assignment
[ 38.306315] USB probe: idVendor=471 idProduct=215 bInterfaceNumber=0
[ 38.312906] VID/PID = 471/215, Boot2 version = 3201
[ 38.318003] woal_usb_probe: invalid endpoint assignment
[ 38.473628] USB probe: idVendor=471 idProduct=215 bInterfaceNumber=0
[ 38.480227] VID/PID = 471/215, Boot2 version = 3201
[ 38.485411] Attach moal handle ops, card interface type: 0x40d
[ 38.628304] WLAN FW is active
[ 38.631408] on_time is 38628138922
[ 38.655388] VDLL: Request firmware: nxp/usbusb_iw610.bin.se
[ 38.671234] VDLL image: len=48000
[ 38.675868] fw_cap_info=0x487cbf03, dev_cap_mask=0xffffffff
[ 38.681912] uuid: 30548cc5aad797baaa0885c430d55486
[ 38.686932] max_p2p_conn = 8, max_sta_conn = 8
[ 42.576334] FW trigger fw dump <-- ~3.95s after "WLAN FW is active"
[ 42.579535] =====FW trigger dump====
[ 42.589155] Create directory /var/dump_42 successfully
[ 42.601497] Firmware Dump directory name is /var/dump_42
[ 42.607105] DRV dump data in /var/dump_42/file_drv_info
[ 43.786094] IOCTL failed: d64defa8 id=0xd0000, sub_id=0xd0004 action=1, status_code=0x80000007 [CMD_CANCEL] (MLAN_OID_11D_DOMAIN_INFO_EXT)
[ 43.796200] IOCTL failed: 12d298a2 id=0x30000, sub_id=0x30003 action=2, status_code=0x80000007 [CMD_CANCEL] (MLAN_OID_ANT_CFG)
[ 43.807348] 11D: Error setting domain info in FW
[ 43.844117] get fw info failed! status=-1, error_code=0x0
[ 43.954897] Firmware Init Failed
[ 43.963379] Card is removed: -2
[ 44.027311] woal_usb_probe: woal_add_card failed

Given the ~4s-after-"WLAN FW is active" determinism and the two cancelled commands (`ANT_CFG`, `11D_DOMAIN_INFO_EXT`), does this crash signature match any known issue in the `MM6X18540` line, or is there something specific we should check in our firmware dump? Happy to share `file_fwdump`/`file_drv_info` directly if that's useful — how would you like us to send them?

Thanks in advance for any pointers.

- **Host SoC**: Qualcomm Atheros QCA9533 (AR9531/QCA9533 family), custom board, OpenWrt, Linux kernel 6.12.71 (ath79 target).
- **Module**: NXP IW610 (Wi-Fi 6 + BLE 5.4 + 802.15.4 combo), connected over USB2.0 (Wi-Fi + BT) for this test; SPI (802.15.4) link is present on the board but **currently disabled** (see below).
- **Driver**: `nxp-imx/mwifiex`, commit `09f41e1423e4806a127507d5fa284cd02c46772f` — "Driver commit for hotfix release MM6X18540.p41" (2025-12-23), branch `hotfix/lf-6.12.49_2.2.0_hotfix`. Compiled `MLAN_RELEASE_VERSION "540.p41"`.
- **Firmware**: `usbusb_iw610.bin.se` (Wi-Fi+BT only, no SPI block), pulled from `nxp-imx/imx-firmware` commit `216a015fea` — "Firmware commit for hotfix release MM6X18540.p41 2025-12-23", internal tag `IW610-18.99.5.p86`. This is the firmware NXP's own release notes pair with the p41 driver.
- Module params (`wifi_mod_para.conf`): `USBIW610 = { dual_nb=0 fw_name=nxp/usbusb_iw610.bin.se }` — explicitly disables the second narrowband (802.15.4/SPI) firmware block so we're testing pure USB Wi-Fi+BT in isolation.

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

In debug mode it seems the DOMIAN INFO is the last command not answered from FW :

[ 1221.243476] QUEUE_CMD: 802_11_SNMP_MIB [0x16] is queued
[ 1221.251155] 11D:Country=US band=0 sub-band=1 dfs_region=1
[ 1221.256730] 11D: first chan=1 no_of_chan=11, max_tx_pwr=23
[ 1221.262395] mlan%d:
[ 1221.262402] QUEUE_CMD: 802_11D_DOMAIN_INFO [0x5b] is queued
[ 1221.270406] wlan_set_regiontable: 2.4G 0x10
[ 1221.274723] wlan_set_regiontable: 5G 0x10
[ 1221.283423] mlan%d:
[ 1221.283454] DNLD_CMD (1221.280171): 802_11_SNMP_MIB [0x16], act 0x1, len 16, seqno 0x18 timeout 5000
[ 1221.295486] mlan_write_data_async_complete: CMD
[ 1221.300210] mlan_recv: CMD (1221.296961)
[ 1221.313352] mlan%d:
[ 1221.313384] CMD_RESP (1221.310098): 802_11_SNMP_MIB [0x8016], result 0, len 16, seqno 0x18
[ 1221.324316] mlan%d:
[ 1221.324327] DNLD_CMD (1221.321067): 802_11D_DOMAIN_INFO [0x5b], act 0x1, len 32, seqno 0x19 timeout 5000
[ 1221.336726] mlan_write_data_async_complete: CMD
[ 1221.498408] mlan%d:
[ 1221.498441] QUEUE_CMD: 802_11_RF_ANTENNA [0x20] is queued
[ 1221.540732] mlan_recv: EVENT 0x73 (1221.537479)
[ 1221.545540] FW trigger fw dump
[ 1221.548946] =====FW trigger dump====

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

It seems the Big Endian version missed some conversion
I can't the the Nxp case anymore so I post patches here

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Hi, @Nicolas07

Currently I can only recommend you to have a try with our latest release to see whether still have this issue.

FW:

imx-firmware/FwImage_IW610_USB at lf-6.18.20_2.0.0 · nxp-imx/imx-firmware · GitHub

Driver:

GitHub - nxp-imx/mwifiex: WiFi extensions · GitHub

And at the same time, I will check internally whether this is a known issue and also have a try with our I.MX 8MMini board with our IW610-EVK(configure to USB-USB mode) to see whether have issue on our board.

Best regards,

Christine.

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Hello @Christine_Li

I am using commit b8c868b7cb9feef21cfca1f6797c7ecddd2a154f almost last one with associated firmware.

I add some patches for big endian, some algebric computation are done on swap value rather swaping at the end; Some constant need swap too, and a signed char for rssi is bad converted too but now the FW and drivers starts. No more crash, I am following on BT integration but I need to patch in btusb to dissociate wifi and bt to avoid BT driver catch all interfaces.

I have now some BT dmesg errors :
[ 730.281450] Bluetooth: hci0: Opcode 0x2037 failed: -89
[ 889.879426] Bluetooth: hci0: Opcode 0x2037 failed: -89
[ 1316.825236] Bluetooth: hci0: Opcode 0x2037 failed: -89
[ 1624.159890] Bluetooth: hci0: Opcode 0x2036 failed: -16
[ 1666.734681] Bluetooth: hci0: unexpected cc 0x0c14 length: 1 < 249

Trying to figure out why

Best Regards

Nicolas

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Mea culpa,

I used an Android device to check BLE advertising and with no profile it is filtered, with nrF Connect I cansee the device and connect to it.

Thanks for your help @Christine_Li next step will be zigbee radio over spi, another story

Best Regards

Nicolas

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Hi, @Nicolas07

From your output error logs, I recommend you below:

[ 730.281450] Bluetooth: hci0: Opcode 0x2037 failed: -89

[ 889.879426] Bluetooth: hci0: Opcode 0x2037 failed: -89

[ 1316.825236] Bluetooth: hci0: Opcode 0x2037 failed: -89

==>HCI_LE_Set_Extended_Advertising_Data(OGF: 0x08, OCF:0x0037) . I suspect it is related to Big Endian. Please check byte-order handling in btusb RX path; make sure 0x2036 succeeds first.

[ 1624.159890] Bluetooth: hci0: Opcode 0x2036 failed: -16

==>Send HCI_LE_Set_Extended_Advertising（OGF：0x08, OCF: 0x0036）first to disable, then modify the parameters.

[ 1666.734681] Bluetooth: hci0: unexpected cc 0x0c14 length: 1 < 249

==>IW610 only supports BLE, not support BR EDR. So when send HCI_Read_Local_Name 0x0c14 （OGF： 0x03 and OCF :0x0014） command, the FW only returns a 1-byte error status. You can have a try by skipping this command in the BlueZ setup flow.

Best regards,

Christine.

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Hello @Christine_Li

Sorry I am struggling answering on the thread. I corrected some endianness problems in BlueZ, now commands runs smooth but I can't discover the device (but the device is available to discover other peripherals)

Usbmon seems to not have any problem, what can I check to understand the problem ? (I have the usbmon traces if needed, just keeping the message as simplest as possible to check if it is posted ... :s )

# LE Set Extended Advertising Parameters (0x2036), 25-byte command
83a97380 S Co:1:003:0 s 20 00 0000 0000 001c 28 =
36201901 1300a000 00a00000 07000000 00000000 00007f01 00010000
^^^^ opcode 0x2036 ^^ handle=1
^^ plen=25(0x19) ^^^^ properties=0x0013 (Connectable|Scannable)
^^^^^^ min_interval=0x0000a0 (100ms, 24-bit LE)
^^^^^^ max_interval=0x0000a0 (100ms)
^^ channel_map=0x07 (37,38,39)
^^ own_addr_type=0x00 (Public)
# -> Command Complete
8396db00 C Ii:1:003:6 0:1 7 = 0e050136 20000c
^^ event=0x0e ^^ plen=5 ^^ ncmd=1 ^^^^ opcode=0x2036 ^^ status=0x00 (Success) ^^ TX power=0x0c (12dBm)

# LE Set Extended Advertising Data (0x2037), 7-byte command
83a97380 S Co:1:003:0 s 20 00 0000 0000 000a 10 =
37200701 03010302 0106
^^^^ opcode 0x2037 ^^ handle=1 ^^ operation=0x03 (Complete) ^^ frag_pref=0x01
^^ data_len=0x03 ^^ AD: len=2,type=0x01(Flags),val=0x06
# -> Command Complete: Status 0x00 (Success)

# LE Set Extended Advertising Enable (0x2039): Status 0x00 (Success)

Best Regards

Nicolas

Re: IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Hi, @Nicolas07

Thanks for your feedback and glad to hear that both WLAN and BT now works as expected.

Would you mind close this ticket for now and create a new ticket if still meet any other issue in the future?

Best regards,

Christine.