[BPI-R4 Pro 8X + BPI-R4-NIC-BE14] Full hardware/RFSPI audit of dead 5 GHz (-95 dBm / 70 dB attenuation) on cards with zeroed 0x1300 eFuse

Banana Pi Router design BPI-R4/BPI-R4 Pro(MT7988)
1

Hello @sinovoip, @frank-w and community,

We have completed a deep low-level hardware, RFSPI (MT7976CN 0x79768b00), Baseband (WF_PHY / WF_MAC), and GPIO/ANTSEL audit of the BPI-R4-NIC-BE14 module on Banana Pi BPI-R4 Pro 8X (OpenWrt SNAPSHOT r36304, kernel 6.18.44).

All data, full register dumps, and analysis are published in our repository: :point_right: GitHub - lacrus66/bpi-r4-pro-be14-5ghz-audit: Banana Pi BPI-R4 Pro 8X + BPI-R4-NIC-BE14 (MediaTek MT7995AV 0x7990, MT7976CN, MT7977IAN, OpenWrt mt76/mt7996e): Deep register, EEPROM (0x0198 rdmDoRunTmAlgoInFw fix), WF_PHY, PCA9555 & 5 GHz -95 dBm hardware audit · GitHub

Key Findings for BPI-R4 Pro 8X + BE14 Owners:

  1. Why mt7988a-bananapi-bpi-r4-wifi-be14.dtso (561e3cf6) doesn’t work out-of-the-box on BPI-R4 Pro 8X:
    • It is missing from DEVICE_DTS_OVERLAY in bananapi_bpi-r4-pro-common (filogic.mk).
    • Its zeroed MAC bytes 0x0004..0x000f rely on /etc/hotplug.d/ieee80211/11_fix_wifi_mac, which lacks bananapi,bpi-r4-pro-8x, resulting in a degenerate 82:00:00:00:00:00 MAC on phy0.1-ap0 (5 GHz).
    • Byte 0x01af = 0x02 in 561e3cf6 corrupts the 3rd 5 GHz chain descriptor (0x0f000724 = 0x00000005 instead of 0x12662801) on MT7976CN rev 0x8b00 (0x01af must be 0x00).
  2. Why sys_recovery (echo "1,8" > sys_recovery) hangs the dual-PCIE bridge on BPI-R4 Pro 8X:
    • Reloading WM works, but the first command to WA (Message 001a0034 (seq 11) timeout) hangs because the 12V rail on CN7/CN9 has no GPIO reset. However, running wifi down && rmmod mt7996e before reboot (with PCA9555 gpio603=0 [3.30V]) cleanly exits the MCU and allows 100% reliable warm reboots without losing PCIe link.
  3. Root Cause of Dead 5 GHz on cards with zeroed 0x1300..0x1317 factory eFuse:
    • Even with a 100% verified EEPROM buffer in FLASH_MODE = 2, accurate thermal calibration (28.0 °C), and a full 503 ms NormalTRx runtime calibration (0x0198 = 0x00), all three 5 GHz chains (ANT0, ANT1, ANT2) on MT7976CN suffer from a ~70 dB RF attenuation (receiving a +22 dBm signal at 50 cm at -95 dBm), while 2.4 GHz (on the same MT7976CN die) and 6 GHz (MT7977IAN) work perfectly.
    • This strongly indicates a factory hardware defect on this batch of BE14 modules (missing/faulty 5 GHz PA/LNA power rail on the NIC PCB, which also explains why the factory ATE station failed to write the 5 GHz target power table at 0x1300..0x1317).

@sinovoip: Can you check the schematic of BPI-R4-NIC-BE14 for the 5 GHz VDD_PA / iFEM power supply rail on MT7976CN or confirm if there is an external RF switch GPIO strapping change on recent BE14 revisions?

2

This overlay was designed for BPI-R4 not the R4PRO. This is why it is not added to r4-pro-common and also have not its compatible.