2407456_en-US

[#1]

IW610 (USB) firmware crashes ~4s after "WLAN FW is active"

Hello, 

I struggle starting an IW610G module on openwrt 25 (6.12 kernel). Enumeration goes well now, firmware download seems too but I face a crash.

USB enumeration and firmware download succeed every time. The module boots its main firmware, prints `WLAN FW is active`, loads a VDLL block (48000 bytes) — and then, **consistently ~3.9–4.1 seconds later**, the firmware crashes and triggers its own dump (`FW trigger fw dump`). This timing is remarkably deterministic across dozens of boots (cold boot and warm EHCI-rebind cycles alike), which makes us suspect a fixed internal timer/watchdog rather than random signal noise.

Full firmware dump (`file_fwdump`, 1,230,600 bytes) and driver info dump (`file_drv_info`, 259,772 bytes) from this exact boot are attached.

Full relevant dmesg excerpt from the latest clean boot:

[ 34.484411] usb 1-1: New USB device found, idVendor=0471, idProduct=0214, bcdDevice=40.00
[ 34.500356] usb 1-1: Product: NXP Wireless Device
[ 34.525526] VID/PID = 471/214, Boot2 version = 4000
[ 34.573668] Request firmware: nxp/usbusb_iw610.bin.se
[ 37.189918] fw_dnld: 808824 bytes downloaded
[ 37.381917] usb 1-1: USB disconnect, device number 2
[ 37.883662] usb 1-1: new high-speed USB device number 3 using ehci-platform
[ 38.115044] usb 1-1: New USB device found, idVendor=0471, idProduct=0215, bcdDevice=32.01
[ 38.131013] usb 1-1: Product: Bluetooth and Wireless LAN Composite Device
[ 38.288804] USB probe: idVendor=471 idProduct=215 bInterfaceNumber=0
[ 38.295470] VID/PID = 471/215, Boot2 version = 3201
[ 38.300509] woal_usb_probe: invalid endpoint assignment
[ 38.306315] USB probe: idVendor=471 idProduct=215 bInterfaceNumber=0
[ 38.312906] VID/PID = 471/215, Boot2 version = 3201
[ 38.318003] woal_usb_probe: invalid endpoint assignment
[ 38.473628] USB probe: idVendor=471 idProduct=215 bInterfaceNumber=0
[ 38.480227] VID/PID = 471/215, Boot2 version = 3201
[ 38.485411] Attach moal handle ops, card interface type: 0x40d
[ 38.628304] WLAN FW is active
[ 38.631408] on_time is 38628138922
[ 38.655388] VDLL: Request firmware: nxp/usbusb_iw610.bin.se
[ 38.671234] VDLL image: len=48000
[ 38.675868] fw_cap_info=0x487cbf03, dev_cap_mask=0xffffffff
[ 38.681912] uuid: 30548cc5aad797baaa0885c430d55486
[ 38.686932] max_p2p_conn = 8, max_sta_conn = 8
[ 42.576334] FW trigger fw dump <-- ~3.95s after "WLAN FW is active"
[ 42.579535] =====FW trigger dump====
[ 42.589155] Create directory /var/dump_42 successfully
[ 42.601497] Firmware Dump directory name is /var/dump_42
[ 42.607105] DRV dump data in /var/dump_42/file_drv_info
[ 43.786094] IOCTL failed: d64defa8 id=0xd0000, sub_id=0xd0004 action=1, status_code=0x80000007 [CMD_CANCEL] (MLAN_OID_11D_DOMAIN_INFO_EXT)
[ 43.796200] IOCTL failed: 12d298a2 id=0x30000, sub_id=0x30003 action=2, status_code=0x80000007 [CMD_CANCEL] (MLAN_OID_ANT_CFG)
[ 43.807348] 11D: Error setting domain info in FW
[ 43.844117] get fw info failed! status=-1, error_code=0x0
[ 43.954897] Firmware Init Failed
[ 43.963379] Card is removed: -2
[ 44.027311] woal_usb_probe: woal_add_card failed

Given the ~4s-after-"WLAN FW is active" determinism and the two cancelled commands (`ANT_CFG`, `11D_DOMAIN_INFO_EXT`), does this crash signature match any known issue in the `MM6X18540` line, or is there something specific we should check in our firmware dump? Happy to share `file_fwdump`/`file_drv_info` directly if that's useful — how would you like us to send them?

Thanks in advance for any pointers.

- **Host SoC**: Qualcomm Atheros QCA9533 (AR9531/QCA9533 family), custom board, OpenWrt, Linux kernel 6.12.71 (ath79 target).
- **Module**: NXP IW610 (Wi-Fi 6 + BLE 5.4 + 802.15.4 combo), connected over USB2.0 (Wi-Fi + BT) for this test; SPI (802.15.4) link is present on the board but **currently disabled** (see below).
- **Driver**: `nxp-imx/mwifiex`, commit `09f41e1423e4806a127507d5fa284cd02c46772f` — "Driver commit for hotfix release MM6X18540.p41" (2025-12-23), branch `hotfix/lf-6.12.49_2.2.0_hotfix`. Compiled `MLAN_RELEASE_VERSION "540.p41"`.
- **Firmware**: `usbusb_iw610.bin.se` (Wi-Fi+BT only, no SPI block), pulled from `nxp-imx/imx-firmware` commit `216a015fea` — "Firmware commit for hotfix release MM6X18540.p41 2025-12-23", internal tag `IW610-18.99.5.p86`. This is the firmware NXP's own release notes pair with the p41 driver.
- Module params (`wifi_mod_para.conf`): `USBIW610 = { dual_nb=0 fw_name=nxp/usbusb_iw610.bin.se }` — explicitly disables the second narrowband (802.15.4/SPI) firmware block so we're testing pure USB Wi-Fi+BT in isolation.