[PATCH 00/13] Ranging support enhancements

[PATCH 00/13] Ranging support enhancements

[Peddolla Harshavardhan Reddy]

This patch series introduces Fine Timing Measurement (FTM)
enhancements and Proximity Detection (PD) capabilities. The
implementation follows the Wi-Fi Alliance "PR Implementation
Consideration Draft 1.9 Rev 1" specification and extends the
existing peer measurement framework with advanced ranging
features.

Kavita Kavita (1):
  mac80211_hwsim: Add support for extended FTM ranging

Peddolla Harshavardhan Reddy (12):
  wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR
    request
  wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR
  wifi: nl80211/cfg80211: add continuous ranging and PD request support
  wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging
  wifi: nl80211/cfg80211: add peer measurement abort command
  wifi: nl80211/cfg80211: add role-based PD peer limits
  wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM
  wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM
  wifi: nl80211/cfg80211: add FTM range report negotiation support
  wifi: nl80211/cfg80211: add result reporting control for PD requests
  wifi: nl80211/cfg80211: add MAC randomization support for PD requests
  wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging

 drivers/net/wireless/virtual/mac80211_hwsim.c | 141 +++++++++++++
 include/net/cfg80211.h                        | 163 ++++++++++++++-
 include/uapi/linux/nl80211.h                  | 177 +++++++++++++++-
 net/wireless/nl80211.c                        |  87 ++++++++
 net/wireless/nl80211.h                        |   1 +
 net/wireless/pmsr.c                           | 194 ++++++++++++++++--
 6 files changed, 738 insertions(+), 25 deletions(-)

-- 
2.34.1

[PATCH 01/13] wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR request

[Peddolla Harshavardhan Reddy]

The commit 853800c746d3 ("wifi: nl80211/cfg80211: support operating as
RSTA in PMSR FTM request") adds a check which mandates LMR to be requested
when the request is to enable RSTA, such check is incorrect in cases
where we want the device to just to act as RSTA and not wakeup the
host with measurement reports. This commit fixes this issue by removing
the mentioned check and also updating the corresponding documentation.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       | 5 +++--
 include/uapi/linux/nl80211.h | 4 ++--
 net/wireless/pmsr.c          | 7 -------
 3 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 7911ed58abbb..83dbe9aeab4d 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4309,8 +4309,9 @@ struct cfg80211_pmsr_result {
  *		 EDCA based ranging will be used.
  * @lmr_feedback: negotiate for I2R LMR feedback. Only valid if either
  *		 @trigger_based or @non_trigger_based is set.
- * @rsta: Operate as the RSTA in the measurement. Only valid if @lmr_feedback
- *	and either @trigger_based or @non_trigger_based is set.
+ * @rsta: Operate as the RSTA in the measurement. Only valid if either
+ *	@trigger_based or @non_trigger_based is set. set @lmr_feedback
+ *	to receive measurement results in response.
  * @bss_color: the bss color of the responder. Optional. Set to zero to
  *	indicate the driver should set the BSS color. Only valid if
  *	@non_trigger_based or @trigger_based is set.
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 706a98686068..d4738bcc9914 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7897,9 +7897,9 @@ enum nl80211_peer_measurement_ftm_capa {
  *	channel specified in %NL80211_PMSR_PEER_ATTR_CHAN until it receives the
  *	FTM request from the peer or the timeout specified by
  *	%NL80211_ATTR_TIMEOUT has expired.
- *	Only valid if %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK is set (so the
+ *	set %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK so the
  *	RSTA will have the measurement results to report back in the FTM
- *	response).
+ *	response.
  *
  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 60e1e31c2185..4db6c40dd782 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -195,13 +195,6 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 		return -EOPNOTSUPP;
 	}
 
-	if (out->ftm.rsta && !out->ftm.lmr_feedback) {
-		NL_SET_ERR_MSG_ATTR(info->extack,
-				    tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],
-				    "FTM: RSTA set without LMR feedback");
-		return -EINVAL;
-	}
-
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH 01/13] wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR request

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> The commit 853800c746d3 ("wifi: nl80211/cfg80211: support operating as
> RSTA in PMSR FTM request") adds a check which mandates LMR to be requested
> when the request is to enable RSTA, such check is incorrect in cases

this is a run-on sentence. s/, such/. Such/

> where we want the device to just to act as RSTA and not wakeup the
> host with measurement reports. This commit fixes this issue by removing

use imperative tense: Fix this issue...

> the mentioned check and also updating the corresponding documentation.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>

[PATCH 02/13] wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR

[Peddolla Harshavardhan Reddy]

Add support for Proximity Detection (PD) capabilities in Peer Measurement
Service (PMSR) as defined in the Wi-Fi Alliance specification
"PR Implementation Consideration Draft 1.9 Rev 1". This includes the PD
support flag, concurrent ISTA/RSTA support for simultaneous initiator
and responder roles.

Additionally, extend FTM capabilities with antenna configuration, ranging
intervals for EDCA/NTB-based ranging, and EDCA based responder support
flags with corresponding netlink attributes and capability reporting.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       | 28 ++++++++++++++++++++++++++--
 include/uapi/linux/nl80211.h | 29 +++++++++++++++++++++++++++++
 net/wireless/nl80211.c       | 32 ++++++++++++++++++++++++++++++++
 net/wireless/pmsr.c          |  3 ++-
 4 files changed, 89 insertions(+), 3 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 83dbe9aeab4d..fedff0a8b982 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5633,6 +5633,13 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
  * @max_peers: maximum number of peers in a single measurement
  * @report_ap_tsf: can report assoc AP's TSF for radio resource measurement
  * @randomize_mac_addr: can randomize MAC address for measurement
+ * @pd_support: supports peer-to-peer ranging as mentioned in the specification
+ *	"PR Implementation Consideration Draft 1.9 rev 1" where PD stands for
+ *	proximity detection
+ * @pd_concurrent_ista_rsta_support: As the peer measurement request can be a
+ *	multi-peer request this will indicate if the device can act
+ *	simultaneously as initiator and a responder. Only valid if @pd_support
+ *	is set.
  * @ftm: FTM measurement data
  * @ftm.supported: FTM measurement is supported
  * @ftm.asap: ASAP-mode is supported
@@ -5659,12 +5666,24 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
  *	(0 means unknown)
  * @ftm.max_total_ltf_rx: maximum total number of LTFs that can be received
  *	(0 means unknown)
+ * @ftm.max_no_of_tx_antennas: maximum number of transmit antennas supported for
+ *	ranging
+ * @ftm.max_no_of_rx_antennas: maximum number of receive antennas supported for
+ *	ranging
+ * @ftm.min_allowed_ranging_interval_edca: Minimum EDCA ranging
+ *	interval supported by the device in milli seconds. (0 means unknown)
+ * @ftm.min_allowed_ranging_interval_ntb: Minimum NTB ranging
+ *	interval supported by the device in milli seconds. (0 means unknown)
  * @ftm.support_rsta: supports operating as RSTA in PMSR FTM request
+ * @ftm.support_edca_responder: supports operating as FTM responder in PMSR FTM
+ *	request for EDCA-based ranging
  */
 struct cfg80211_pmsr_capabilities {
 	unsigned int max_peers;
 	u8 report_ap_tsf:1,
-	   randomize_mac_addr:1;
+	   randomize_mac_addr:1,
+	   pd_support:1,
+	   pd_concurrent_ista_rsta_support:1;
 
 	struct {
 		u32 preambles;
@@ -5685,7 +5704,12 @@ struct cfg80211_pmsr_capabilities {
 		u8 max_rx_sts;
 		u8 max_total_ltf_tx;
 		u8 max_total_ltf_rx;
-		u8 support_rsta:1;
+		u8 max_no_of_tx_antennas;
+		u8 max_no_of_rx_antennas;
+		u32 min_allowed_ranging_interval_edca;
+		u32 min_allowed_ranging_interval_ntb;
+		u8 support_rsta:1,
+		   support_edca_responder:1;
 	} ftm;
 };
 
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index d4738bcc9914..6a858e46bf3e 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7745,6 +7745,15 @@ enum nl80211_peer_measurement_peer_attrs {
  *	meaningless, just a list of peers to measure with, with the
  *	sub-attributes taken from
  *	&enum nl80211_peer_measurement_peer_attrs.
+ * @NL80211_PMSR_ATTR_PD_SUPPORT: flag attribute in capability indicating
+ *	that the device supports peer-to-peer ranging as mentioned in the
+ *	specification "PR Implementation Consideration Draft 1.9 rev 1" where
+ *	PD stands for proximity detection
+ * @NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT: flag attribute in
+ *	capability indicating that as the peer measurement request can be a
+ *	multi-peer request, the device can act simultaneously as initiator and
+ *	a responder, where the multiple requests are being processed
+ *	simultaneously
  *
  * @NUM_NL80211_PMSR_ATTR: internal
  * @NL80211_PMSR_ATTR_MAX: highest attribute number
@@ -7757,6 +7766,8 @@ enum nl80211_peer_measurement_attrs {
 	NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR,
 	NL80211_PMSR_ATTR_TYPE_CAPA,
 	NL80211_PMSR_ATTR_PEERS,
+	NL80211_PMSR_ATTR_PD_SUPPORT,
+	NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT,
 
 	/* keep last */
 	NUM_NL80211_PMSR_ATTR,
@@ -7815,6 +7826,19 @@ enum nl80211_peer_measurement_attrs {
  *	This limits the allowed combinations of LTF repetitions and STS.
  * @NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT: flag attribute indicating the
  *	device supports operating as the RSTA in PMSR FTM request
+ * @NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER: flag attribute indicating
+ *	the device supports operating as the Responder in PMSR FTM request for
+ *	EDCA-based ranging.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS: u8 attribute indicating
+ *	the maximum number of transmit antennas supported for ranging
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS: u8 attribute indicating
+ *	the maximum number of receive antennas supported for ranging
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA: u32 attribute indicating
+ *	the minimum EDCA ranging interval supported by the device
+ *	in milli seconds. (0 means unknown)
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB: u32 attribute indicating
+ *	the minimum NTB ranging interval supported by the device
+ *	in milli seconds. (0 means unknown)
  *
  * @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal
  * @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number
@@ -7840,6 +7864,11 @@ enum nl80211_peer_measurement_ftm_capa {
 	NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_TX,
 	NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_RX,
 	NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT,
+	NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER,
+	NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS,
+	NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS,
+	NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA,
+	NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_CAPA_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 9aa83a6943a2..accbc80b4a90 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -394,6 +394,10 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 	[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 	[NL80211_PMSR_ATTR_PEERS] =
 		NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
+	[NL80211_PMSR_ATTR_PD_SUPPORT] = { .type = NLA_REJECT },
+	[NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT] = {
+		.type = NLA_REJECT
+	},
 };
 
 static const struct nla_policy
@@ -2340,6 +2344,25 @@ nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
 	if (cap->ftm.support_rsta &&
 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT))
 		return -ENOBUFS;
+	if (cap->ftm.support_edca_responder &&
+	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER))
+		return -ENOBUFS;
+	if (cap->ftm.max_no_of_tx_antennas > 0 &&
+	    nla_put_u8(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS,
+		       cap->ftm.max_no_of_tx_antennas))
+		return -ENOBUFS;
+	if (cap->ftm.max_no_of_rx_antennas > 0 &&
+	    nla_put_u8(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS,
+		       cap->ftm.max_no_of_rx_antennas))
+		return -ENOBUFS;
+	if (cap->ftm.min_allowed_ranging_interval_edca > 0 &&
+	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA,
+			cap->ftm.min_allowed_ranging_interval_edca))
+		return -ENOBUFS;
+	if (cap->ftm.min_allowed_ranging_interval_ntb > 0 &&
+	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
+			cap->ftm.min_allowed_ranging_interval_ntb))
+		return -ENOBUFS;
 
 	nla_nest_end(msg, ftm);
 	return 0;
@@ -2374,6 +2397,15 @@ static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
 	    nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
 		return -ENOBUFS;
 
+	if (cap->pd_support) {
+		if (nla_put_flag(msg, NL80211_PMSR_ATTR_PD_SUPPORT))
+			return -ENOBUFS;
+
+		if (cap->pd_concurrent_ista_rsta_support &&
+		    nla_put_flag(msg,
+				 NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT))
+			return -ENOBUFS;
+	}
 	caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
 	if (!caps)
 		return -ENOBUFS;
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 4db6c40dd782..8cc8d6be0e98 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -188,7 +188,8 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 	}
 
 	out->ftm.rsta = !!tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA];
-	if (out->ftm.rsta && !capa->ftm.support_rsta) {
+	if (out->ftm.rsta && !capa->ftm.support_rsta &&
+	    !capa->ftm.support_edca_responder) {
 		NL_SET_ERR_MSG_ATTR(info->extack,
 				    tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],
 				    "FTM: RSTA not supported by device");
-- 
2.34.1

[PATCH 03/13] wifi: nl80211/cfg80211: add continuous ranging and PD request support

[Peddolla Harshavardhan Reddy]

Add support for NTB continuous ranging with new FTM attributes. These
enable continuos non-trigger based ranging with configurable timing and
measurement parameters. Also add PD request flag to peer attrs for
proximity detection support with device capability checks.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       | 23 +++++++++++++++++--
 include/uapi/linux/nl80211.h | 26 +++++++++++++++++++++
 net/wireless/nl80211.c       | 10 ++++++++
 net/wireless/pmsr.c          | 44 +++++++++++++++++++++++++++++++++---
 4 files changed, 98 insertions(+), 5 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index fedff0a8b982..af357d21f67c 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4315,7 +4315,19 @@ struct cfg80211_pmsr_result {
  * @bss_color: the bss color of the responder. Optional. Set to zero to
  *	indicate the driver should set the BSS color. Only valid if
  *	@non_trigger_based or @trigger_based is set.
- *
+ * @min_time_between_measurements: minimum time between two consecutive range
+ *	measurements in units of 100 micro seconds, applicable for
+ *	non trigger based ranging. Only valid if @non_trigger_based is set.
+ * @max_time_between_measurements: maximum time between two consecutive range
+ *	measurements in units of 10 milli seconds, to avoid FTM negotiation
+ *	applicable for non trigger based ranging. Only valid
+ *	if @non_trigger_based is set.
+ * @availability_window: duration of the availability window (AW) in units of
+ *	1 millisecond (0-255 ms). Only valid if @non_trigger_based is set.
+ * @nominal_time: Nominal duration between adjacent availability windows
+ *	in units of milli seconds. Only valid if @non_trigger_based is set.
+ * @measurements_per_aw: number of measurement attempts per availability window
+ *	with a maximum value of 4. Only valid if @non_trigger_based is set.
  * See also nl80211 for the respective attribute documentation.
  */
 struct cfg80211_pmsr_ftm_request_peer {
@@ -4334,6 +4346,11 @@ struct cfg80211_pmsr_ftm_request_peer {
 	u8 ftms_per_burst;
 	u8 ftmr_retries;
 	u8 bss_color;
+	u32 min_time_between_measurements;
+	u32 max_time_between_measurements;
+	u8 availability_window;
+	u32 nominal_time;
+	u8 measurements_per_aw;
 };
 
 /**
@@ -4341,12 +4358,14 @@ struct cfg80211_pmsr_ftm_request_peer {
  * @addr: MAC address
  * @chandef: channel to use
  * @report_ap_tsf: report the associated AP's TSF
+ * @pd_request: indicates a peer-to-peer PD request
  * @ftm: FTM data, see &struct cfg80211_pmsr_ftm_request_peer
  */
 struct cfg80211_pmsr_request_peer {
 	u8 addr[ETH_ALEN];
 	struct cfg80211_chan_def chandef;
-	u8 report_ap_tsf:1;
+	u8 report_ap_tsf:1,
+	   pd_request:1;
 	struct cfg80211_pmsr_ftm_request_peer ftm;
 };
 
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 6a858e46bf3e..e594ccc59021 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7708,6 +7708,8 @@ enum nl80211_peer_measurement_resp {
  * @NL80211_PMSR_PEER_ATTR_RESP: This is a nested attribute indexed by
  *	measurement type, with attributes from the
  *	&enum nl80211_peer_measurement_resp inside.
+ * @NL80211_PMSR_PEER_ATTR_PD_REQUEST: flag attribute indicating this is a
+ *	peer-to-peer PD request
  *
  * @NUM_NL80211_PMSR_PEER_ATTRS: internal
  * @NL80211_PMSR_PEER_ATTR_MAX: highest attribute number
@@ -7719,6 +7721,7 @@ enum nl80211_peer_measurement_peer_attrs {
 	NL80211_PMSR_PEER_ATTR_CHAN,
 	NL80211_PMSR_PEER_ATTR_REQ,
 	NL80211_PMSR_PEER_ATTR_RESP,
+	NL80211_PMSR_PEER_ATTR_PD_REQUEST,
 
 	/* keep last */
 	NUM_NL80211_PMSR_PEER_ATTRS,
@@ -7929,6 +7932,24 @@ enum nl80211_peer_measurement_ftm_capa {
  *	set %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK so the
  *	RSTA will have the measurement results to report back in the FTM
  *	response.
+ * @NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS: minimum time
+ *	between two consecutive range measurements in units of 100 microseconds,
+ *	applicable for non-trigger based ranging (u32). Only valid if
+ *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS: maximum time
+ *	between two consecutive range measurements in units of 10 milliseconds,
+ *	to avoid FTM negotiation, applicable for non-trigger based ranging (u32)
+ *	. Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME: the nominal time field shall be set
+ *	to the nominal duration between adjacent Availability Windows in units
+ *	of milli seconds (u32). Only valid if
+ *	%NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION: The AW duration field shall be set
+ *	to the duration of the AW in units of 1ms (0-255 ms) (u8).
+ *	Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW: meas per AW field shall indicate the.
+ *	number of measurements attempts per AW with a maximum value of 4 (u8).
+ *	Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
  *
  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -7950,6 +7971,11 @@ enum nl80211_peer_measurement_ftm_req {
 	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK,
 	NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR,
 	NL80211_PMSR_FTM_REQ_ATTR_RSTA,
+	NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS,
+	NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS,
+	NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
+	NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
+	NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index accbc80b4a90..e0c910d22bd4 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -362,6 +362,15 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 	[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 	[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
 	[NL80211_PMSR_FTM_REQ_ATTR_RSTA] = { .type = NLA_FLAG },
+	[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS] = {
+		.type = NLA_U32
+	},
+	[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS] = {
+		.type = NLA_U32
+	},
+	[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW] = { .type = NLA_U8 },
 };
 
 static const struct nla_policy
@@ -384,6 +393,7 @@ nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 	[NL80211_PMSR_PEER_ATTR_REQ] =
 		NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 	[NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
+	[NL80211_PMSR_PEER_ATTR_PD_REQUEST] = { .type = NLA_FLAG },
 };
 
 static const struct nla_policy
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 8cc8d6be0e98..bee9c6fd2859 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -91,11 +91,10 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST]);
 
 	if (capa->ftm.max_ftms_per_burst &&
-	    (out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst ||
-	     out->ftm.ftms_per_burst == 0)) {
+	    (out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst)) {
 		NL_SET_ERR_MSG_ATTR(info->extack,
 				    tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],
-				    "FTM: FTMs per burst must be set lower than the device limit but non-zero");
+				    "FTM: FTMs per burst must be set lower than the device limit");
 		return -EINVAL;
 	}
 
@@ -196,6 +195,36 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 		return -EOPNOTSUPP;
 	}
 
+	if (out->ftm.non_trigger_based) {
+		if (tb[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS])
+			out->ftm.min_time_between_measurements =
+			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS]);
+
+		if (tb[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS])
+			out->ftm.max_time_between_measurements =
+			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS]);
+
+		if (tb[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION])
+			out->ftm.availability_window =
+			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION]);
+
+		if (tb[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME])
+			out->ftm.nominal_time =
+			nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME]);
+
+		if (tb[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW])
+			out->ftm.measurements_per_aw =
+			nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW]);
+	}
+
+	if (!out->ftm.rsta && out->ftm.ftms_per_burst == 0 &&
+	    out->ftm.measurements_per_aw == 0) {
+		NL_SET_ERR_MSG_ATTR(info->extack,
+				    tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],
+				    "FTM: Both Ftm's per burst and measurements per avail window cannot be zero");
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
@@ -223,6 +252,15 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev,
 
 	memcpy(out->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]), ETH_ALEN);
 
+	if (tb[NL80211_PMSR_PEER_ATTR_PD_REQUEST])
+		out->pd_request = true;
+
+	if (out->pd_request && !rdev->wiphy.pmsr_capa->pd_support) {
+		NL_SET_ERR_MSG_ATTR(info->extack,
+				    tb[NL80211_PMSR_PEER_ATTR_PD_REQUEST],
+				    "PD request not supported by device");
+		return -EINVAL;
+	}
 	/* reuse info->attrs */
 	memset(info->attrs, 0, sizeof(*info->attrs) * (NL80211_ATTR_MAX + 1));
 	err = nla_parse_nested_deprecated(info->attrs, NL80211_ATTR_MAX,
-- 
2.34.1

Re: [PATCH 03/13] wifi: nl80211/cfg80211: add continuous ranging and PD request support

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> Add support for NTB continuous ranging with new FTM attributes. These
> enable continuos non-trigger based ranging with configurable timing and

WARNING:TYPO_SPELLING: 'continuos' may be misspelled - perhaps 'continuous'?

> measurement parameters. Also add PD request flag to peer attrs for
> proximity detection support with device capability checks.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>

[PATCH 04/13] wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging

[Peddolla Harshavardhan Reddy]

Extend the peer measurement FTM response structure to include
negotiated parameters for proximity ranging sessions. This adds
support for reporting LTF repetition counts, time constraints
between measurements, spatial stream configuration, and
availability window parameters.

These parameters allow userspace to understand the negotiated
session configuration for proximity detection and continuous
ranging operations.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       | 59 +++++++++++++++++++++++++++++++++++-
 include/uapi/linux/nl80211.h | 41 ++++++++++++++++++++++++-
 net/wireless/pmsr.c          | 16 ++++++++++
 3 files changed, 114 insertions(+), 2 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index af357d21f67c..a82d1606345a 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4206,6 +4206,27 @@ struct cfg80211_ftm_responder_stats {
  *	(must have either this or @rtt_avg)
  * @dist_variance: variance of distances measured (see also @rtt_variance)
  * @dist_spread: spread of distances measured (see also @rtt_spread)
+ * @tx_ltf_repetition_count: negotiated value of number of tx ltf repetitions
+ *	in NDP frames
+ * @rx_ltf_repetition_count: negotiated value of number of rx ltf repetitions
+ *	in NDP frames
+ * @max_time_between_measurements: the negotiated maximum interval (in units of
+ *	10 ms) by which the ISTA must complete the next measurement cycle.
+ * @min_time_between_measurements: the negotiated minimum interval (in units of
+ *	100 µs) between two consecutive range measurements initiated by the
+ *	ISTA.
+ * @num_tx_spatial_streams: number of Tx space-time streams used in the NDP
+ *	frame during the measurement sounding phase.
+ * @num_rx_spatial_streams: number of Rx space-time streams used in the NDP
+ *	frame during the measurement sounding phase.
+ * @nominal_time: negotiated nominal duration between adjacent availability
+ *	windows in units of milli seconds (u32).
+ * @availability_window: negotiated availability window time used in this
+ *	session (8 bits size, units of 1ms)
+ * @measurements_per_aw: negotiated number of measurement attempts per
+ *	availability window.
+ * @band_width: band width used for measurement.
+ * @preamble: preamble used for measurement.
  * @num_ftmr_attempts_valid: @num_ftmr_attempts is valid
  * @num_ftmr_successes_valid: @num_ftmr_successes is valid
  * @rssi_avg_valid: @rssi_avg is valid
@@ -4218,6 +4239,19 @@ struct cfg80211_ftm_responder_stats {
  * @dist_avg_valid: @dist_avg is valid
  * @dist_variance_valid: @dist_variance is valid
  * @dist_spread_valid: @dist_spread is valid
+ * @tx_ltf_repetition_count_valid: @tx_ltf_repetition_count is valid
+ * @rx_ltf_repetition_count_valid: @rx_ltf_repetition_count is valid
+ * @max_time_between_measurements_valid: @max_time_between_measurements is valid
+ * @min_time_between_measurements_valid: @min_time_between_measurements is valid
+ * @num_tx_spatial_streams_valid: @num_tx_spatial_streams is valid
+ * @num_rx_spatial_streams_valid: @num_rx_spatial_streams is valid
+ * @nominal_time_valid: @nominal_time is valid
+ * @availability_window_valid: @availability_window is valid
+ * @measurements_per_aw_valid: @measurements_per_aw is valid
+ * @band_width_valid: @band_width is valid.
+ * @preamble_valid: @preamble is valid.
+ * @is_delayed_lmr: indicates if the reported LMR is of the current burst or the
+ *	previous burst, flag.
  */
 struct cfg80211_pmsr_ftm_result {
 	const u8 *lci;
@@ -4241,6 +4275,17 @@ struct cfg80211_pmsr_ftm_result {
 	s64 dist_avg;
 	s64 dist_variance;
 	s64 dist_spread;
+	u8 tx_ltf_repetition_count;
+	u8 rx_ltf_repetition_count;
+	u32 max_time_between_measurements;
+	u32 min_time_between_measurements;
+	u8 num_tx_spatial_streams;
+	u8 num_rx_spatial_streams;
+	u32 nominal_time;
+	u8 availability_window;
+	u8 measurements_per_aw;
+	enum nl80211_chan_width band_width;
+	enum nl80211_preamble preamble;
 
 	u16 num_ftmr_attempts_valid:1,
 	    num_ftmr_successes_valid:1,
@@ -4253,7 +4298,19 @@ struct cfg80211_pmsr_ftm_result {
 	    rtt_spread_valid:1,
 	    dist_avg_valid:1,
 	    dist_variance_valid:1,
-	    dist_spread_valid:1;
+	    dist_spread_valid:1,
+	    tx_ltf_repetition_count_valid:1,
+	    rx_ltf_repetition_count_valid:1,
+	    max_time_between_measurements_valid:1,
+	    min_time_between_measurements_valid:1;
+	u16 num_tx_spatial_streams_valid:1,
+	    num_rx_spatial_streams_valid:1,
+	    nominal_time_valid:1,
+	    availability_window_valid:1,
+	    measurements_per_aw_valid:1,
+	    band_width_valid:1,
+	    preamble_valid:1,
+	    is_delayed_lmr:1;
 };
 
 /**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index e594ccc59021..a3c82b231d82 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -8062,7 +8062,34 @@ enum nl80211_peer_measurement_ftm_failure_reasons {
  * @NL80211_PMSR_FTM_RESP_ATTR_PAD: ignore, for u64/s64 padding only
  * @NL80211_PMSR_FTM_RESP_ATTR_BURST_PERIOD: actual burst period used by
  *	the responder (similar to request, u16)
- *
+ * @NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT: negotiated value of
+ *	number of tx ltf repetitions in NDP frames (u8, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT: negotiated value of
+ *	number of rx ltf repetitions in NDP frames (u8, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS: negotiated value
+ *	where latest time by which the ISTA needs to complete the next round of
+ *	measurements, in units of 10 ms (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS: negotiated
+ *	minimum time between two consecutive range measurements initiated by an
+ *	ISTA, in units of 100 µs (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS: number of Tx space-time
+ *	streams used in NDP frames during the measurement sounding phase
+ *	(u8, optional).
+ * @NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS: number of Rx space-time
+ *	streams used in the NDP frames during the measurement sounding phase
+ *	(u8, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME: negotiated nominal time used in
+ *	this session in milli seconds. (u32)
+ * @NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW: negotiated availability
+ *	window time used in this session, in units of 1ms (u8, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW: negotiated measurements
+ *	per availability window (u8, optional, max value 4)
+ * @NL80211_PMSR_FTM_RESP_ATTR_BANDWIDTH: u32 attribute indicating channel
+ *	width used for measurement, see &enum nl80211_chan_width.
+ * @NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE: u32 attribute indicating the preamble
+ *	type used for the measurement, see &enum nl80211_preamble
+ * @NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR: flag, indicates if the
+ *	current result is delayed LMR data.
  * @NUM_NL80211_PMSR_FTM_RESP_ATTR: internal
  * @NL80211_PMSR_FTM_RESP_ATTR_MAX: highest attribute number
  */
@@ -8091,6 +8118,18 @@ enum nl80211_peer_measurement_ftm_resp {
 	NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC,
 	NL80211_PMSR_FTM_RESP_ATTR_PAD,
 	NL80211_PMSR_FTM_RESP_ATTR_BURST_PERIOD,
+	NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT,
+	NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT,
+	NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS,
+	NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS,
+	NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS,
+	NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS,
+	NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME,
+	NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW,
+	NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW,
+	NL80211_PMSR_FTM_RESP_ATTR_BANDWIDTH,
+	NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE,
+	NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_RESP_ATTR,
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index bee9c6fd2859..141ac19f86c8 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -518,6 +518,22 @@ static int nl80211_pmsr_send_ftm_res(struct sk_buff *msg,
 	PUTOPT_U64(DIST_AVG, dist_avg);
 	PUTOPT_U64(DIST_VARIANCE, dist_variance);
 	PUTOPT_U64(DIST_SPREAD, dist_spread);
+	PUTOPT(u8, TX_LTF_REPETITION_COUNT, tx_ltf_repetition_count);
+	PUTOPT(u8, RX_LTF_REPETITION_COUNT, rx_ltf_repetition_count);
+	PUTOPT(u32, MAX_TIME_BETWEEN_MEASUREMENTS,
+	       max_time_between_measurements);
+	PUTOPT(u32, MIN_TIME_BETWEEN_MEASUREMENTS,
+	       min_time_between_measurements);
+	PUTOPT(u8, NUM_TX_SPATIAL_STREAMS, num_tx_spatial_streams);
+	PUTOPT(u8, NUM_RX_SPATIAL_STREAMS, num_rx_spatial_streams);
+	PUTOPT(u32, NOMINAL_TIME, nominal_time);
+	PUTOPT(u8, AVAILABILITY_WINDOW, availability_window);
+	PUTOPT(u8, MEASUREMENTS_PER_AW, measurements_per_aw);
+	PUTOPT(u32, BANDWIDTH, band_width);
+	PUTOPT(u32, PREAMBLE, preamble);
+	if (res->ftm.is_delayed_lmr &&
+	    nla_put_flag(msg, NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR))
+		goto error;
 	if (res->ftm.lci && res->ftm.lci_len &&
 	    nla_put(msg, NL80211_PMSR_FTM_RESP_ATTR_LCI,
 		    res->ftm.lci_len, res->ftm.lci))
-- 
2.34.1

[PATCH 05/13] wifi: nl80211/cfg80211: add peer measurement abort command

[Peddolla Harshavardhan Reddy]

Add support for aborting ongoing peer measurement sessions
through a new NL80211_CMD_PEER_MEASUREMENT_ABORT command.
This allows userspace to cancel continuous ranging or other
long-running measurement sessions before completion.

The abort operation is identified by the measurement cookie.
When a matching request is found, it is marked for cleanup
and the existing free work is scheduled to handle the
abortion and notify the driver.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/uapi/linux/nl80211.h |  5 +++++
 net/wireless/nl80211.c       |  6 ++++++
 net/wireless/nl80211.h       |  1 +
 net/wireless/pmsr.c          | 34 ++++++++++++++++++++++++++++++++++
 4 files changed, 46 insertions(+)

diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index a3c82b231d82..b2410d4f572c 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1361,6 +1361,9 @@
  *	user space that the NAN new cluster has been joined. The cluster ID is
  *	indicated by %NL80211_ATTR_MAC.
  *
+ * @NL80211_CMD_PEER_MEASUREMENT_ABORT: Abort an ongoing peer measurement,
+ *     identified by %NL80211_ATTR_COOKIE.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -1624,6 +1627,8 @@ enum nl80211_commands {
 	NL80211_CMD_NAN_NEXT_DW_NOTIFICATION,
 	NL80211_CMD_NAN_CLUSTER_JOINED,
 
+	NL80211_CMD_PEER_MEASUREMENT_ABORT,
+
 	/* add new commands above here */
 
 	/* used to define NL80211_CMD_MAX below */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e0c910d22bd4..1ad7eb103189 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -19117,6 +19117,12 @@ static const struct genl_small_ops nl80211_small_ops[] = {
 		.flags = GENL_UNS_ADMIN_PERM,
 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
 	},
+	{
+		.cmd = NL80211_CMD_PEER_MEASUREMENT_ABORT,
+		.doit = nl80211_pmsr_abort,
+		.flags = GENL_UNS_ADMIN_PERM,
+		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
+	},
 };
 
 static struct genl_family nl80211_fam __ro_after_init = {
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 5e25782af1e0..9791da9f5fbd 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -123,6 +123,7 @@ void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce);
 
 /* peer measurement */
 int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info);
+int nl80211_pmsr_abort(struct sk_buff *skb, struct genl_info *info);
 
 void nl80211_mlo_reconf_add_done(struct net_device *dev,
 				 struct cfg80211_mlo_reconf_done_data *data);
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 141ac19f86c8..8b7665f2f824 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -718,6 +718,40 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
 	WARN_ON(!list_empty(&wdev->pmsr_list));
 }
 
+int nl80211_pmsr_abort(struct sk_buff *skb, struct genl_info *info)
+{
+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
+	struct wireless_dev *wdev = info->user_ptr[1];
+	struct cfg80211_pmsr_request *req;
+	u64 cookie;
+
+	if (!rdev->wiphy.pmsr_capa)
+		return -EOPNOTSUPP;
+
+	if (!info->attrs[NL80211_ATTR_COOKIE])
+		return -EINVAL;
+
+	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
+
+	spin_lock_bh(&wdev->pmsr_lock);
+	list_for_each_entry(req, &wdev->pmsr_list, list) {
+		if (req->cookie == cookie) {
+			/* Verify the request belongs to this netlink port */
+			if (req->nl_portid != info->snd_portid) {
+				spin_unlock_bh(&wdev->pmsr_lock);
+				return -EACCES;
+			}
+			req->nl_portid = 0; /* Mark for abortion */
+			schedule_work(&wdev->pmsr_free_wk);
+			spin_unlock_bh(&wdev->pmsr_lock);
+			return 0;
+		}
+	}
+	spin_unlock_bh(&wdev->pmsr_lock);
+
+	return -ENOENT; /* Request not found */
+}
+
 void cfg80211_release_pmsr(struct wireless_dev *wdev, u32 portid)
 {
 	struct cfg80211_pmsr_request *req;
-- 
2.34.1

Re: [PATCH 05/13] wifi: nl80211/cfg80211: add peer measurement abort command

[Johannes Berg]

On Fri, 2026-01-30 at 21:30 +0530, Peddolla Harshavardhan Reddy wrote:
> Add support for aborting ongoing peer measurement sessions
> through a new NL80211_CMD_PEER_MEASUREMENT_ABORT command.
> This allows userspace to cancel continuous ranging or other
> long-running measurement sessions before completion.
> 
> The abort operation is identified by the measurement cookie.
> When a matching request is found, it is marked for cleanup
> and the existing free work is scheduled to handle the
> abortion and notify the driver.

Originally, the idea was that we don't need this, since it's easy to
just close the socket. Are there any resource constraints in socket
handling in userspace that make this necessary? I'm not necessarily
totally opposed to this, but you also haven't explained why it's
necessary at all.

johannes

Re: [PATCH 05/13] wifi: nl80211/cfg80211: add peer measurement abort command

[Peddolla Harshavardhan Reddy]

On 30-Jan-26 9:45 PM, Johannes Berg wrote:
> On Fri, 2026-01-30 at 21:30 +0530, Peddolla Harshavardhan Reddy wrote:
>> Add support for aborting ongoing peer measurement sessions
>> through a new NL80211_CMD_PEER_MEASUREMENT_ABORT command.
>> This allows userspace to cancel continuous ranging or other
>> long-running measurement sessions before completion.
>>
>> The abort operation is identified by the measurement cookie.
>> When a matching request is found, it is marked for cleanup
>> and the existing free work is scheduled to handle the
>> abortion and notify the driver.
> Originally, the idea was that we don't need this, since it's easy to
> just close the socket. Are there any resource constraints in socket
> handling in userspace that make this necessary? I'm not necessarily
> totally opposed to this, but you also haven't explained why it's
> necessary at all.
>
> johannes

We’ll be dropping this. As you pointed out, PMSR abort can be handled by closing the socket. Thanks.

[PATCH 06/13] wifi: nl80211/cfg80211: add role-based PD peer limits

[Peddolla Harshavardhan Reddy]

Currently, proximity detection capabilities only advertise a
single maximum peer count that applies regardless of whether
the request is of PD type. However, some devices may support
different numbers of simultaneous peers depending on whether
the request is of PD type or not.

Introduce separate capability fields to allow drivers to
specify distinct peer limits for each request type. When a
device operates as a PD initiator, it can now advertise how
many responder peers it can measure simultaneously.
Similarly, when operating as a PD responder, it can indicate
how many initiator peers it can serve concurrently.

In scenarios where a device supports concurrent operation
as both PD initiator and PD responder, the enforcement logic
considers the sum of both role-specific limits to determine
the total number of peers allowed in a single measurement
request.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       | 12 ++++++++++++
 include/uapi/linux/nl80211.h | 16 ++++++++++++++++
 net/wireless/nl80211.c       | 13 +++++++++++++
 net/wireless/pmsr.c          | 32 ++++++++++++++++++++++++++++----
 4 files changed, 69 insertions(+), 4 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index a82d1606345a..ae63a3ead165 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5716,6 +5716,16 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
  *	multi-peer request this will indicate if the device can act
  *	simultaneously as initiator and a responder. Only valid if @pd_support
  *	is set.
+ * @pd_max_peer_ista_role: Maximum number of peers allowed for a device
+ *	operating in the ISTA role under proximity detection. Only valid if
+ *	@pd_support is set. Sum of both @pd_max_peer_ista_role and
+ *	@pd_max_peer_rsta_role is considered to enforce the max peers supported
+ *	in case the request is of peer-to-peer PD type.
+ * @pd_max_peer_rsta_role: Maximum number of peers allowed for a device
+ *	operating in the RSTA role under proximity detection. Only valid if
+ *	@pd_support is set. Sum of both @pd_max_peer_ista_role and
+ *	@pd_max_peer_rsta_role is considered to enforce the max peers supported
+ *	in case the request is of peer-to-peer PD type
  * @ftm: FTM measurement data
  * @ftm.supported: FTM measurement is supported
  * @ftm.asap: ASAP-mode is supported
@@ -5760,6 +5770,8 @@ struct cfg80211_pmsr_capabilities {
 	   randomize_mac_addr:1,
 	   pd_support:1,
 	   pd_concurrent_ista_rsta_support:1;
+	u32 pd_max_peer_ista_role;
+	u32 pd_max_peer_rsta_role;
 
 	struct {
 		u32 preambles;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b2410d4f572c..b6c28c75e141 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7762,6 +7762,20 @@ enum nl80211_peer_measurement_peer_attrs {
  *	multi-peer request, the device can act simultaneously as initiator and
  *	a responder, where the multiple requests are being processed
  *	simultaneously
+ * @NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE: u32 attribute indicating the
+ *	maximum number of peers allowed for a device operating in the ISTA
+ *	(Initiator STA) role under proximity detection. Only valid if
+ *	NL80211_PMSR_ATTR_PD_SUPPORT is set. Sum of both
+ *	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
+ *	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
+ *	max peers supported in case the request is of peer-to-peer PD type
+ * @NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE: u32 attribute indicating the
+ *	maximum number of peers allowed for a device operating in the RSTA
+ *	(Responder STA) role under proximity detection. Only valid if
+ *	NL80211_PMSR_ATTR_PD_SUPPORT is set. Sum of both
+ *	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
+ *	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
+ *	max peers supported in case the request is of peer-to-peer PD type
  *
  * @NUM_NL80211_PMSR_ATTR: internal
  * @NL80211_PMSR_ATTR_MAX: highest attribute number
@@ -7776,6 +7790,8 @@ enum nl80211_peer_measurement_attrs {
 	NL80211_PMSR_ATTR_PEERS,
 	NL80211_PMSR_ATTR_PD_SUPPORT,
 	NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT,
+	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE,
+	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
 
 	/* keep last */
 	NUM_NL80211_PMSR_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1ad7eb103189..bfe88f7068da 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -408,6 +408,8 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 	[NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT] = {
 		.type = NLA_REJECT
 	},
+	[NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE] = { .type = NLA_REJECT },
+	[NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE] = { .type = NLA_REJECT },
 };
 
 static const struct nla_policy
@@ -2017,6 +2019,7 @@ nl80211_send_iftype_data(struct sk_buff *msg,
 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
 			    ppe_thresh_size, eht_cap->eht_ppe_thres))
 			return -ENOBUFS;
+
 	}
 
 	if (sband->band == NL80211_BAND_6GHZ &&
@@ -2415,6 +2418,16 @@ static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
 		    nla_put_flag(msg,
 				 NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT))
 			return -ENOBUFS;
+
+		if (cap->pd_max_peer_ista_role > 0 &&
+		    nla_put_u32(msg, NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE,
+				cap->pd_max_peer_ista_role))
+			return -ENOBUFS;
+
+		if (cap->pd_max_peer_rsta_role > 0 &&
+		    nla_put_u32(msg, NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
+				cap->pd_max_peer_rsta_role))
+			return -ENOBUFS;
 	}
 	caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
 	if (!caps)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 8b7665f2f824..e1b4cc7244cd 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -318,11 +318,14 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 	struct nlattr *reqattr = info->attrs[NL80211_ATTR_PEER_MEASUREMENTS];
 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 	struct wireless_dev *wdev = info->user_ptr[1];
+	const struct cfg80211_pmsr_capabilities *capa;
 	struct cfg80211_pmsr_request *req;
 	struct nlattr *peers, *peer;
-	int count, rem, err, idx;
+	int count, rem, err, idx, pd_count, max_pd_peers;
 
-	if (!rdev->wiphy.pmsr_capa)
+	capa = rdev->wiphy.pmsr_capa;
+
+	if (!capa)
 		return -EOPNOTSUPP;
 
 	if (!reqattr)
@@ -337,7 +340,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 	nla_for_each_nested(peer, peers, rem) {
 		count++;
 
-		if (count > rdev->wiphy.pmsr_capa->max_peers) {
+		if (count > capa->max_peers) {
 			NL_SET_ERR_MSG_ATTR(info->extack, peer,
 					    "Too many peers used");
 			return -EINVAL;
@@ -353,7 +356,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 		req->timeout = nla_get_u32(info->attrs[NL80211_ATTR_TIMEOUT]);
 
 	if (info->attrs[NL80211_ATTR_MAC]) {
-		if (!rdev->wiphy.pmsr_capa->randomize_mac_addr) {
+		if (!capa->randomize_mac_addr) {
 			NL_SET_ERR_MSG_ATTR(info->extack,
 					    info->attrs[NL80211_ATTR_MAC],
 					    "device cannot randomize MAC address");
@@ -378,6 +381,27 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 			goto out_err;
 		idx++;
 	}
+
+	/* Count PD requests and validate against PD peer limits */
+	if (capa->pd_support) {
+		pd_count = 0;
+
+		max_pd_peers = capa->pd_max_peer_ista_role +
+			       capa->pd_max_peer_rsta_role;
+
+		for (idx = 0; idx < req->n_peers; idx++) {
+			if (req->peers[idx].pd_request) {
+				pd_count++;
+
+				if (pd_count > max_pd_peers) {
+					NL_SET_ERR_MSG(info->extack,
+						       "Too many PD peers used");
+					err = -EINVAL;
+					goto out_err;
+				}
+			}
+		}
+	}
 	req->cookie = cfg80211_assign_cookie(rdev);
 	req->nl_portid = info->snd_portid;
 
-- 
2.34.1

Re: [PATCH 06/13] wifi: nl80211/cfg80211: add role-based PD peer limits

[Vasanthakumar Thiagarajan]

On 1/30/2026 9:30 PM, Peddolla Harshavardhan Reddy wrote:
> Currently, proximity detection capabilities only advertise a
> single maximum peer count that applies regardless of whether
> the request is of PD type. However, some devices may support
> different numbers of simultaneous peers depending on whether
> the request is of PD type or not.
> 
> Introduce separate capability fields to allow drivers to
> specify distinct peer limits for each request type. When a
> device operates as a PD initiator, it can now advertise how
> many responder peers it can measure simultaneously.
> Similarly, when operating as a PD responder, it can indicate
> how many initiator peers it can serve concurrently.
> 
> In scenarios where a device supports concurrent operation
> as both PD initiator and PD responder, the enforcement logic
> considers the sum of both role-specific limits to determine
> the total number of peers allowed in a single measurement
> request.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
> ---
>   include/net/cfg80211.h       | 12 ++++++++++++
>   include/uapi/linux/nl80211.h | 16 ++++++++++++++++
>   net/wireless/nl80211.c       | 13 +++++++++++++
>   net/wireless/pmsr.c          | 32 ++++++++++++++++++++++++++++----
>   4 files changed, 69 insertions(+), 4 deletions(-)
> 
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index a82d1606345a..ae63a3ead165 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -5716,6 +5716,16 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
>    *	multi-peer request this will indicate if the device can act
>    *	simultaneously as initiator and a responder. Only valid if @pd_support
>    *	is set.
> + * @pd_max_peer_ista_role: Maximum number of peers allowed for a device
> + *	operating in the ISTA role under proximity detection. Only valid if
> + *	@pd_support is set. Sum of both @pd_max_peer_ista_role and
> + *	@pd_max_peer_rsta_role is considered to enforce the max peers supported
> + *	in case the request is of peer-to-peer PD type.
> + * @pd_max_peer_rsta_role: Maximum number of peers allowed for a device
> + *	operating in the RSTA role under proximity detection. Only valid if
> + *	@pd_support is set. Sum of both @pd_max_peer_ista_role and
> + *	@pd_max_peer_rsta_role is considered to enforce the max peers supported
> + *	in case the request is of peer-to-peer PD type
>    * @ftm: FTM measurement data
>    * @ftm.supported: FTM measurement is supported
>    * @ftm.asap: ASAP-mode is supported
> @@ -5760,6 +5770,8 @@ struct cfg80211_pmsr_capabilities {
>   	   randomize_mac_addr:1,
>   	   pd_support:1,
>   	   pd_concurrent_ista_rsta_support:1;
> +	u32 pd_max_peer_ista_role;
> +	u32 pd_max_peer_rsta_role;
>   
>   	struct {
>   		u32 preambles;
> diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
> index b2410d4f572c..b6c28c75e141 100644
> --- a/include/uapi/linux/nl80211.h
> +++ b/include/uapi/linux/nl80211.h
> @@ -7762,6 +7762,20 @@ enum nl80211_peer_measurement_peer_attrs {
>    *	multi-peer request, the device can act simultaneously as initiator and
>    *	a responder, where the multiple requests are being processed
>    *	simultaneously
> + * @NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE: u32 attribute indicating the
> + *	maximum number of peers allowed for a device operating in the ISTA
> + *	(Initiator STA) role under proximity detection. Only valid if
> + *	NL80211_PMSR_ATTR_PD_SUPPORT is set. Sum of both
> + *	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
> + *	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
> + *	max peers supported in case the request is of peer-to-peer PD type
> + * @NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE: u32 attribute indicating the
> + *	maximum number of peers allowed for a device operating in the RSTA
> + *	(Responder STA) role under proximity detection. Only valid if
> + *	NL80211_PMSR_ATTR_PD_SUPPORT is set. Sum of both
> + *	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
> + *	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the

need to add % kernel-doc markup for enums.

Vasanth

[PATCH 07/13] wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM

[Peddolla Harshavardhan Reddy]

Add support for configurable distance-based measurement reporting
thresholds in FTM peer measurement requests. This enables proximity
detection applications to receive measurement results only when
devices move into (ingress) or out of (egress) specified distance
ranges in millimeters.

The implementation adds NL80211_PMSR_FTM_REQ_ATTR_INGRESS and
NL80211_PMSR_FTM_REQ_ATTR_EGRESS attributes with corresponding
u64 fields in cfg80211_pmsr_ftm_request_peer. When configured,
measurement results are reported on burst index basis only when
peer crosses these distance boundaries.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       | 9 +++++++++
 include/uapi/linux/nl80211.h | 7 +++++++
 net/wireless/nl80211.c       | 2 ++
 net/wireless/pmsr.c          | 8 ++++++++
 4 files changed, 26 insertions(+)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index ae63a3ead165..73ef64d86a63 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4385,6 +4385,13 @@ struct cfg80211_pmsr_result {
  *	in units of milli seconds. Only valid if @non_trigger_based is set.
  * @measurements_per_aw: number of measurement attempts per availability window
  *	with a maximum value of 4. Only valid if @non_trigger_based is set.
+ * @ingress_distancemm: the measurement result of the peer needs
+ *	to be indicated in case the device moves into this range.(units mm, u64)
+ *	measurement results need be sent on a burst index basis in this case.
+ * @egress_distancemm: the measurement result of the peer needs
+ *	to be indicated in case the device moves out of this range.
+ *	(units mm, u64). measurement results need be sent on a burst index basis
+ *	in this case.
  * See also nl80211 for the respective attribute documentation.
  */
 struct cfg80211_pmsr_ftm_request_peer {
@@ -4408,6 +4415,8 @@ struct cfg80211_pmsr_ftm_request_peer {
 	u8 availability_window;
 	u32 nominal_time;
 	u8 measurements_per_aw;
+	u64 ingress_distancemm;
+	u64 egress_distancemm;
 };
 
 /**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b6c28c75e141..4d91c73a4ed2 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7971,6 +7971,11 @@ enum nl80211_peer_measurement_ftm_capa {
  * @NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW: meas per AW field shall indicate the.
  *	number of measurements attempts per AW with a maximum value of 4 (u8).
  *	Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_INGRESS: the measurement result of the peer needs
+ *	to be indicated in case the device moves into this range.(units mm, u64)
+ * @NL80211_PMSR_FTM_REQ_ATTR_EGRESS: the measurement result of the peer needs
+ *	to be indicated in case the device moves out of this range.
+ *	(units mm, u64)
  *
  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -7997,6 +8002,8 @@ enum nl80211_peer_measurement_ftm_req {
 	NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
 	NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
 	NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
+	NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
+	NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index bfe88f7068da..b1865668feb4 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -371,6 +371,8 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 	[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
 	[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION] = { .type = NLA_U8 },
 	[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },
+	[NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },
 };
 
 static const struct nla_policy
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index e1b4cc7244cd..c9915b1f57cb 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -225,6 +225,14 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 		return -EINVAL;
 	}
 
+	if (tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS])
+		out->ftm.ingress_distancemm =
+			nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS]);
+
+	if (tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS])
+		out->ftm.egress_distancemm =
+			nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS]);
+
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH 07/13] wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> Add support for configurable distance-based measurement reporting
> thresholds in FTM peer measurement requests. This enables proximity
> detection applications to receive measurement results only when
> devices move into (ingress) or out of (egress) specified distance
> ranges in millimeters.
> 
> The implementation adds NL80211_PMSR_FTM_REQ_ATTR_INGRESS and

use imperative tense

> NL80211_PMSR_FTM_REQ_ATTR_EGRESS attributes with corresponding
> u64 fields in cfg80211_pmsr_ftm_request_peer. When configured,
> measurement results are reported on burst index basis only when
> peer crosses these distance boundaries.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>

[PATCH 08/13] wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM

[Peddolla Harshavardhan Reddy]

Add separate bandwidth capability reporting for proximity detection
(PD) requests with EDCA and NTB-based ranging. This allows devices
to advertise different supported bandwidths for PD operations
versus regular FTM measurements, enabling more flexible capability
negotiation for proximity ranging scenarios.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       |  8 ++++++++
 include/uapi/linux/nl80211.h | 14 ++++++++++++++
 net/wireless/nl80211.c       |  6 ++++++
 net/wireless/pmsr.c          | 10 +++++++++-
 4 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 73ef64d86a63..5224a68867cc 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5772,6 +5772,12 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
  * @ftm.support_rsta: supports operating as RSTA in PMSR FTM request
  * @ftm.support_edca_responder: supports operating as FTM responder in PMSR FTM
  *	request for EDCA-based ranging
+ * @ftm.pd_edca_bandwidths: bitmap of bandwidths supported
+ *	(&enum nl80211_chan_width) in case of PD request with EDCA based
+ *	initiator or responder role. ignored if @pd_support is not set.
+ * @ftm.pd_ntb_bandwidths: bitmap of bandwidths supported
+ *	(&enum nl80211_chan_width) in case of PD request with NTB based
+ *	initiator or responder role. ignored if @pd_support is not set.
  */
 struct cfg80211_pmsr_capabilities {
 	unsigned int max_peers;
@@ -5807,6 +5813,8 @@ struct cfg80211_pmsr_capabilities {
 		u32 min_allowed_ranging_interval_ntb;
 		u8 support_rsta:1,
 		   support_edca_responder:1;
+		u32 pd_edca_bandwidths;
+		u32 pd_ntb_bandwidths;
 	} ftm;
 };
 
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 4d91c73a4ed2..181595ec960e 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7863,6 +7863,18 @@ enum nl80211_peer_measurement_attrs {
  * @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB: u32 attribute indicating
  *	the minimum NTB ranging interval supported by the device
  *	in milli seconds. (0 means unknown)
+ * @NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS: bitmap of values from
+ *	&enum nl80211_chan_width indicating the supported channel
+ *	bandwidths for FTM in case of PD based EDCA initiator or responder role.
+ *	Note that a higher channel bandwidth may be configured to allow for
+ *	other measurements types with different bandwidth requirement in the
+ *	same measurement.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS: bitmap of values from
+ *	&enum nl80211_chan_width indicating the supported channel
+ *	bandwidths for FTM in case of PD based NTB initiator or responder role.
+ *	Note that a higher channel bandwidth may be configured to allow for
+ *	other measurements types with different bandwidth requirement in the
+ *	same measurement.
  *
  * @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal
  * @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number
@@ -7893,6 +7905,8 @@ enum nl80211_peer_measurement_ftm_capa {
 	NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS,
 	NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA,
 	NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
+	NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS,
+	NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_CAPA_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b1865668feb4..571d96a5ddf4 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2378,6 +2378,12 @@ nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
 	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
 			cap->ftm.min_allowed_ranging_interval_ntb))
 		return -ENOBUFS;
+	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS,
+			cap->ftm.pd_edca_bandwidths))
+		return -ENOBUFS;
+	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
+			cap->ftm.pd_ntb_bandwidths))
+		return -ENOBUFS;
 
 	nla_nest_end(msg, ftm);
 	return 0;
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index c9915b1f57cb..0ed0f401db11 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -17,11 +17,19 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 	u32 preamble = NL80211_PREAMBLE_DMG; /* only optional in DMG */
 
 	/* validate existing data */
-	if (!(rdev->wiphy.pmsr_capa->ftm.bandwidths & BIT(out->chandef.width))) {
+	if (!out->pd_request &&
+	    !(rdev->wiphy.pmsr_capa->ftm.bandwidths & BIT(out->chandef.width))) {
 		NL_SET_ERR_MSG(info->extack, "FTM: unsupported bandwidth");
 		return -EINVAL;
 	}
 
+	if (out->pd_request &&
+	    (!(rdev->wiphy.pmsr_capa->ftm.pd_edca_bandwidths & BIT(out->chandef.width)) &&
+	    !(rdev->wiphy.pmsr_capa->ftm.pd_ntb_bandwidths & BIT(out->chandef.width)))) {
+		NL_SET_ERR_MSG(info->extack, "FTM: unsupported bandwidth for pd request");
+		return -EINVAL;
+	}
+
 	/* no validation needed - was already done via nested policy */
 	nla_parse_nested_deprecated(tb, NL80211_PMSR_FTM_REQ_ATTR_MAX, ftmreq,
 				    NULL, NULL);
-- 
2.34.1

Re: [PATCH 08/13] wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> Add separate bandwidth capability reporting for proximity detection
> (PD) requests with EDCA and NTB-based ranging. This allows devices
> to advertise different supported bandwidths for PD operations
> versus regular FTM measurements, enabling more flexible capability
> negotiation for proximity ranging scenarios.

Normally in kernel commit text you describe the problem first, and then
describe how to solve the problem.

[PATCH 09/13] wifi: nl80211/cfg80211: add FTM range report negotiation support

[Peddolla Harshavardhan Reddy]

Add support for FTM range report negotiation in EDCA-based
ranging operations. This allows devices to negotiate whether
range measurement reports should be exchanged after the FTM
session.

The implementation adds a new capability flag and request
attribute for range report negotiation. Devices advertise
range report support and userspace can request it for EDCA
ranging sessions only.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       |  8 +++++++-
 include/uapi/linux/nl80211.h |  6 ++++++
 net/wireless/nl80211.c       |  4 ++++
 net/wireless/pmsr.c          | 19 +++++++++++++++++++
 4 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 5224a68867cc..890d4b007033 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4392,6 +4392,8 @@ struct cfg80211_pmsr_result {
  *	to be indicated in case the device moves out of this range.
  *	(units mm, u64). measurement results need be sent on a burst index basis
  *	in this case.
+ * @range_report: negotiate for FTM range report. Only valid for
+ *		 EDCA based ranging.
  * See also nl80211 for the respective attribute documentation.
  */
 struct cfg80211_pmsr_ftm_request_peer {
@@ -4417,6 +4419,7 @@ struct cfg80211_pmsr_ftm_request_peer {
 	u8 measurements_per_aw;
 	u64 ingress_distancemm;
 	u64 egress_distancemm;
+	u8 range_report:1;
 };
 
 /**
@@ -5772,6 +5775,8 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
  * @ftm.support_rsta: supports operating as RSTA in PMSR FTM request
  * @ftm.support_edca_responder: supports operating as FTM responder in PMSR FTM
  *	request for EDCA-based ranging
+ * @ftm.support_range_report: capable of negotiating for FTM range report. Only
+ *	valid for EDCA based ranging.
  * @ftm.pd_edca_bandwidths: bitmap of bandwidths supported
  *	(&enum nl80211_chan_width) in case of PD request with EDCA based
  *	initiator or responder role. ignored if @pd_support is not set.
@@ -5812,7 +5817,8 @@ struct cfg80211_pmsr_capabilities {
 		u32 min_allowed_ranging_interval_edca;
 		u32 min_allowed_ranging_interval_ntb;
 		u8 support_rsta:1,
-		   support_edca_responder:1;
+		   support_edca_responder:1,
+		   support_range_report:1;
 		u32 pd_edca_bandwidths;
 		u32 pd_ntb_bandwidths;
 	} ftm;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 181595ec960e..af80248d24a1 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7875,6 +7875,8 @@ enum nl80211_peer_measurement_attrs {
  *	Note that a higher channel bandwidth may be configured to allow for
  *	other measurements types with different bandwidth requirement in the
  *	same measurement.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT: flag indicating if range report
+ *	negotiation and reporting is supported in case of EDCA based ranging.
  *
  * @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal
  * @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number
@@ -7907,6 +7909,7 @@ enum nl80211_peer_measurement_ftm_capa {
 	NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
 	NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS,
 	NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
+	NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_CAPA_ATTR,
@@ -7990,6 +7993,8 @@ enum nl80211_peer_measurement_ftm_capa {
  * @NL80211_PMSR_FTM_REQ_ATTR_EGRESS: the measurement result of the peer needs
  *	to be indicated in case the device moves out of this range.
  *	(units mm, u64)
+ * @NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT: Negotiate Range report in case of
+ *	EDCA based ranging.
  *
  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -8018,6 +8023,7 @@ enum nl80211_peer_measurement_ftm_req {
 	NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
 	NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
 	NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
+	NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 571d96a5ddf4..bbb80032d615 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -373,6 +373,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 	[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW] = { .type = NLA_U8 },
 	[NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },
 	[NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },
+	[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT] = { .type = NLA_FLAG },
 };
 
 static const struct nla_policy
@@ -2384,6 +2385,9 @@ nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
 	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
 			cap->ftm.pd_ntb_bandwidths))
 		return -ENOBUFS;
+	if (cap->ftm.support_range_report &&
+	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT))
+		return -ENOBUFS;
 
 	nla_nest_end(msg, ftm);
 	return 0;
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 0ed0f401db11..f89fcd9bb505 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -241,6 +241,25 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 		out->ftm.egress_distancemm =
 			nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS]);
 
+	if (tb[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT])
+		out->ftm.range_report =
+		nla_get_flag(tb[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT]);
+
+	if (!capa->ftm.support_range_report && out->ftm.range_report) {
+		NL_SET_ERR_MSG_ATTR(info->extack,
+				    tb[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT],
+				    "FTM: Range report negotiation not supported");
+		return -EINVAL;
+	}
+
+	if ((out->ftm.non_trigger_based || out->ftm.trigger_based) &&
+	    out->ftm.range_report) {
+		NL_SET_ERR_MSG_ATTR(info->extack,
+				    tb[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT],
+				    "FTM: Range report request is not valid for TB/NTB ranging");
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH 09/13] wifi: nl80211/cfg80211: add FTM range report negotiation support

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> Add support for FTM range report negotiation in EDCA-based
> ranging operations. This allows devices to negotiate whether
> range measurement reports should be exchanged after the FTM
> session.

describe the problem first

> 
> The implementation adds a new capability flag and request

use imperative tense

> attribute for range report negotiation. Devices advertise
> range report support and userspace can request it for EDCA
> ranging sessions only.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>

[PATCH 10/13] wifi: nl80211/cfg80211: add result reporting control for PD requests

[Peddolla Harshavardhan Reddy]

Add optional result reporting control for proximity detection
(PD) requests, allowing userspace to disable ranging result
reports when measurement data is not needed. This reduces
unnecessary data transfer and processing overhead for
applications that only require proximity detection without
detailed ranging measurements.

The implementation validates that result reporting control is
only used with PD requests and ensures proper configuration
when operating as responder (RSTA role). For RSTA operations
requesting results, either LMR feedback or range report must
be enabled to provide a mechanism for result delivery. This
prevents invalid configurations where results are requested
but no delivery method is available.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       |  8 +++++++-
 include/uapi/linux/nl80211.h |  9 +++++++++
 net/wireless/nl80211.c       |  1 +
 net/wireless/pmsr.c          | 19 +++++++++++++++++++
 4 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 890d4b007033..00ef211f20f1 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4394,6 +4394,11 @@ struct cfg80211_pmsr_result {
  *	in this case.
  * @range_report: negotiate for FTM range report. Only valid for
  *		 EDCA based ranging.
+ * @pd_require_range_results: flag to enable receiving results
+ *	for PD requests. if this flag is disabled then ranging result will not
+ *	be reported regardless of ranging role or the type or ranging. Only
+ *	valid if @pd_request is set. in case @rsta is set, either @range_report
+ *	or @lmr_feedback should be set inorder for the request to be valid.
  * See also nl80211 for the respective attribute documentation.
  */
 struct cfg80211_pmsr_ftm_request_peer {
@@ -4419,7 +4424,8 @@ struct cfg80211_pmsr_ftm_request_peer {
 	u8 measurements_per_aw;
 	u64 ingress_distancemm;
 	u64 egress_distancemm;
-	u8 range_report:1;
+	u8 range_report:1,
+	   pd_require_range_results:1;
 };
 
 /**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index af80248d24a1..85223b16eb84 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7995,6 +7995,14 @@ enum nl80211_peer_measurement_ftm_capa {
  *	(units mm, u64)
  * @NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT: Negotiate Range report in case of
  *	EDCA based ranging.
+ * @NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT: flag to enable receiving results
+ *	for PD requests. if this flag is disabled then ranging result will not
+ *	reported regardless of ranging role or the type or ranging. Only valid
+ *	if %NL80211_PMSR_PEER_ATTR_PD_REQUEST is set. in case
+ *	%NL80211_PMSR_FTM_REQ_ATTR_RSTA is set, either
+ *	%NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT or
+ *	%NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK should be set inorder for
+ *	request to be valid.
  *
  * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
  * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -8024,6 +8032,7 @@ enum nl80211_peer_measurement_ftm_req {
 	NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
 	NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
 	NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT,
+	NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT,
 
 	/* keep last */
 	NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index bbb80032d615..6d53eb3eb78c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -374,6 +374,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 	[NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },
 	[NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },
 	[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT] = { .type = NLA_FLAG },
+	[NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT] = { .type = NLA_FLAG },
 };
 
 static const struct nla_policy
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index f89fcd9bb505..a55eb73e6938 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -260,6 +260,25 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
 		return -EINVAL;
 	}
 
+	if (tb[NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT])
+		out->ftm.pd_require_range_results =
+		nla_get_flag(tb[NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT]);
+
+	if (!out->pd_request && out->ftm.pd_require_range_results) {
+		NL_SET_ERR_MSG_ATTR(info->extack,
+				    tb[NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT],
+				    "FTM: require range result flag only valid for PD requests");
+		return -EINVAL;
+	}
+
+	if (out->ftm.pd_require_range_results && out->ftm.rsta &&
+	    (!out->ftm.range_report && !out->ftm.lmr_feedback)) {
+		NL_SET_ERR_MSG_ATTR(info->extack,
+				    tb[NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT],
+				    "FTM: range results requested for responder without LMR or range report");
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH 10/13] wifi: nl80211/cfg80211: add result reporting control for PD requests

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> Add optional result reporting control for proximity detection
> (PD) requests, allowing userspace to disable ranging result
> reports when measurement data is not needed. This reduces
> unnecessary data transfer and processing overhead for
> applications that only require proximity detection without
> detailed ranging measurements.

describe the problem first

> 
> The implementation validates that result reporting control is

use imperative tense

> only used with PD requests and ensures proper configuration
> when operating as responder (RSTA role). For RSTA operations
> requesting results, either LMR feedback or range report must
> be enabled to provide a mechanism for result delivery. This
> prevents invalid configurations where results are requested
> but no delivery method is available.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>

[PATCH 11/13] wifi: nl80211/cfg80211: add MAC randomization support for PD requests

[Peddolla Harshavardhan Reddy]

Add support for MAC address randomization in proximity detection
(PD) requests. When enabled, the same randomized MAC address
used for discovery and authentication phases will be used for
the ranging measurements, maintaining privacy throughout the
entire PD session workflow.

The implementation adds a capability flag for devices to
advertise PD MAC randomization support and validates that
randomization is only requested when the device supports it.
This ensures consistent MAC address usage across all phases of
proximity detection while preventing invalid configurations
where randomization is requested but not supported by hardware.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       |  7 ++++++-
 include/uapi/linux/nl80211.h |  5 +++++
 net/wireless/nl80211.c       |  6 ++++++
 net/wireless/pmsr.c          | 10 ++++++++++
 4 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 00ef211f20f1..dd45dda7e619 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5734,6 +5734,10 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
  *	multi-peer request this will indicate if the device can act
  *	simultaneously as initiator and a responder. Only valid if @pd_support
  *	is set.
+ * @pd_randomize_mac_addr: flag attribute in capability indicating that MAC
+ *	address randomization is supported for PD request. if capable a mac
+ *	address used for discovery, authentication will be used for ranging too.
+ *	only valid if @pd_support is set
  * @pd_max_peer_ista_role: Maximum number of peers allowed for a device
  *	operating in the ISTA role under proximity detection. Only valid if
  *	@pd_support is set. Sum of both @pd_max_peer_ista_role and
@@ -5795,7 +5799,8 @@ struct cfg80211_pmsr_capabilities {
 	u8 report_ap_tsf:1,
 	   randomize_mac_addr:1,
 	   pd_support:1,
-	   pd_concurrent_ista_rsta_support:1;
+	   pd_concurrent_ista_rsta_support:1,
+	   pd_randomize_mac_addr:1;
 	u32 pd_max_peer_ista_role;
 	u32 pd_max_peer_rsta_role;
 
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 85223b16eb84..c102a54ff335 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7776,6 +7776,10 @@ enum nl80211_peer_measurement_peer_attrs {
  *	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
  *	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
  *	max peers supported in case the request is of peer-to-peer PD type
+ * @NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR: flag attribute in capability
+ *	indicating that MAC address randomization is supported for PD request.
+ *	if capable a mac address used for discovery, authentication will be
+ *	used for ranging too. only valid if %NL80211_PMSR_ATTR_PD_SUPPORT is set
  *
  * @NUM_NL80211_PMSR_ATTR: internal
  * @NL80211_PMSR_ATTR_MAX: highest attribute number
@@ -7792,6 +7796,7 @@ enum nl80211_peer_measurement_attrs {
 	NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT,
 	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE,
 	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
+	NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR,
 
 	/* keep last */
 	NUM_NL80211_PMSR_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 6d53eb3eb78c..2909520bb949 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -414,6 +414,7 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 	},
 	[NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE] = { .type = NLA_REJECT },
 	[NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE] = { .type = NLA_REJECT },
+	[NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 };
 
 static const struct nla_policy
@@ -2441,6 +2442,11 @@ static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
 		    nla_put_u32(msg, NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
 				cap->pd_max_peer_rsta_role))
 			return -ENOBUFS;
+
+		if (cap->pd_randomize_mac_addr &&
+		    nla_put_flag(msg,
+				 NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR))
+			return -ENOBUFS;
 	}
 	caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
 	if (!caps)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index a55eb73e6938..fcd7af0c61ba 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -376,6 +376,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 	struct cfg80211_pmsr_request *req;
 	struct nlattr *peers, *peer;
 	int count, rem, err, idx, pd_count, max_pd_peers;
+	u8 use_random_mac = 0;
 
 	capa = rdev->wiphy.pmsr_capa;
 
@@ -422,6 +423,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 					       req->mac_addr_mask);
 		if (err)
 			goto out_err;
+		use_random_mac = 1;
 	} else {
 		memcpy(req->mac_addr, wdev_address(wdev), ETH_ALEN);
 		eth_broadcast_addr(req->mac_addr_mask);
@@ -453,6 +455,14 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 					err = -EINVAL;
 					goto out_err;
 				}
+
+				if (use_random_mac &&
+				    !capa->pd_randomize_mac_addr) {
+					NL_SET_ERR_MSG(info->extack,
+						       "PD mac randomization not supported");
+					err = -EINVAL;
+					goto out_err;
+				}
 			}
 		}
 	}
-- 
2.34.1

Re: [PATCH 11/13] wifi: nl80211/cfg80211: add MAC randomization support for PD requests

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> Add support for MAC address randomization in proximity detection
> (PD) requests. When enabled, the same randomized MAC address
> used for discovery and authentication phases will be used for
> the ranging measurements, maintaining privacy throughout the
> entire PD session workflow.

describe the problem first

> 
> The implementation adds a capability flag for devices to

use imperative tense

> advertise PD MAC randomization support and validates that
> randomization is only requested when the device supports it.
> This ensures consistent MAC address usage across all phases of
> proximity detection while preventing invalid configurations
> where randomization is requested but not supported by hardware.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>

Re: [PATCH 11/13] wifi: nl80211/cfg80211: add MAC randomization support for PD requests

[Vasanthakumar Thiagarajan]

On 1/30/2026 9:30 PM, Peddolla Harshavardhan Reddy wrote:
> Add support for MAC address randomization in proximity detection
> (PD) requests. When enabled, the same randomized MAC address
> used for discovery and authentication phases will be used for
> the ranging measurements, maintaining privacy throughout the
> entire PD session workflow.
> 
> The implementation adds a capability flag for devices to
> advertise PD MAC randomization support and validates that
> randomization is only requested when the device supports it.
> This ensures consistent MAC address usage across all phases of
> proximity detection while preventing invalid configurations
> where randomization is requested but not supported by hardware.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
> ---
>   include/net/cfg80211.h       |  7 ++++++-
>   include/uapi/linux/nl80211.h |  5 +++++
>   net/wireless/nl80211.c       |  6 ++++++
>   net/wireless/pmsr.c          | 10 ++++++++++
>   4 files changed, 27 insertions(+), 1 deletion(-)
> 
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index 00ef211f20f1..dd45dda7e619 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -5734,6 +5734,10 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
>    *	multi-peer request this will indicate if the device can act
>    *	simultaneously as initiator and a responder. Only valid if @pd_support
>    *	is set.
> + * @pd_randomize_mac_addr: flag attribute in capability indicating that MAC
> + *	address randomization is supported for PD request. if capable a mac
> + *	address used for discovery, authentication will be used for ranging too.
> + *	only valid if @pd_support is set
>    * @pd_max_peer_ista_role: Maximum number of peers allowed for a device
>    *	operating in the ISTA role under proximity detection. Only valid if
>    *	@pd_support is set. Sum of both @pd_max_peer_ista_role and
> @@ -5795,7 +5799,8 @@ struct cfg80211_pmsr_capabilities {
>   	u8 report_ap_tsf:1,
>   	   randomize_mac_addr:1,
>   	   pd_support:1,
> -	   pd_concurrent_ista_rsta_support:1;
> +	   pd_concurrent_ista_rsta_support:1,
> +	   pd_randomize_mac_addr:1;
>   	u32 pd_max_peer_ista_role;
>   	u32 pd_max_peer_rsta_role;
>   
> diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
> index 85223b16eb84..c102a54ff335 100644
> --- a/include/uapi/linux/nl80211.h
> +++ b/include/uapi/linux/nl80211.h
> @@ -7776,6 +7776,10 @@ enum nl80211_peer_measurement_peer_attrs {
>    *	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
>    *	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
>    *	max peers supported in case the request is of peer-to-peer PD type
> + * @NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR: flag attribute in capability
> + *	indicating that MAC address randomization is supported for PD request.
> + *	if capable a mac address used for discovery, authentication will be
> + *	used for ranging too. only valid if %NL80211_PMSR_ATTR_PD_SUPPORT is set
>    *
>    * @NUM_NL80211_PMSR_ATTR: internal
>    * @NL80211_PMSR_ATTR_MAX: highest attribute number
> @@ -7792,6 +7796,7 @@ enum nl80211_peer_measurement_attrs {
>   	NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT,
>   	NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE,
>   	NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
> +	NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR,
>   
>   	/* keep last */
>   	NUM_NL80211_PMSR_ATTR,
> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> index 6d53eb3eb78c..2909520bb949 100644
> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -414,6 +414,7 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
>   	},
>   	[NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE] = { .type = NLA_REJECT },
>   	[NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE] = { .type = NLA_REJECT },
> +	[NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
>   };
>   
>   static const struct nla_policy
> @@ -2441,6 +2442,11 @@ static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
>   		    nla_put_u32(msg, NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
>   				cap->pd_max_peer_rsta_role))
>   			return -ENOBUFS;
> +
> +		if (cap->pd_randomize_mac_addr &&
> +		    nla_put_flag(msg,
> +				 NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR))
> +			return -ENOBUFS;
>   	}
>   	caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
>   	if (!caps)
> diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
> index a55eb73e6938..fcd7af0c61ba 100644
> --- a/net/wireless/pmsr.c
> +++ b/net/wireless/pmsr.c
> @@ -376,6 +376,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
>   	struct cfg80211_pmsr_request *req;
>   	struct nlattr *peers, *peer;
>   	int count, rem, err, idx, pd_count, max_pd_peers;
> +	u8 use_random_mac = 0;

bool instead?

[PATCH 12/13] wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging

[Peddolla Harshavardhan Reddy]

Add NL80211_ATTR_LTF_KEYSEED attribute to support secure FTM
measurements. This allows drivers to generate secure LTF keys
for PHY-layer security in ranging operations.

The keyseed is used with trigger-based and non-trigger-based
FTM requests to enable secure peer measurement sessions.

Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
 include/net/cfg80211.h       |  2 ++
 include/uapi/linux/nl80211.h | 15 ++++++++++++---
 net/wireless/nl80211.c       |  7 +++++++
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index dd45dda7e619..ea6b9c994455 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -800,6 +800,8 @@ struct key_params {
 	u16 vlan_id;
 	u32 cipher;
 	enum nl80211_key_mode mode;
+	const u8 *ltf_keyseed;
+	int ltf_keyseed_len;
 };
 
 /**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index c102a54ff335..4db71f400571 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -395,9 +395,10 @@
  *	%NL80211_ATTR_MLO_LINK_ID.
  * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
  *	%NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER,
- *	and %NL80211_ATTR_KEY_SEQ attributes. %NL80211_ATTR_MAC represents
- *	peer's MLD address for MLO pairwise key. The link to add MLO
- *	group key is identified by %NL80211_ATTR_MLO_LINK_ID.
+ *	%NL80211_ATTR_KEY_SEQ and %NL80211_ATTR_LTF_KEYSEED attributes.
+ *	%NL80211_ATTR_MAC represents peer's MLD address for MLO pairwise key.
+ *	The link to add MLO group key is identified by
+ *	%NL80211_ATTR_MLO_LINK_ID.
  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
  *	or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC represents peer's MLD address
  *	for MLO pairwise key. The link to delete group key is identified by
@@ -5536,6 +5537,13 @@ enum nl80211_key_default_types {
  * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode.
  *	Defaults to @NL80211_KEY_RX_TX.
  * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key
+ * @NL80211_ATTR_LTF_KEYSEED: LTF key seed is used by the driver to generate
+ *	secure LTF keys used in case of peer measurement request with FTM
+ *	request type as either %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED
+ *	or %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED, secure LTF key seeds will
+ *	help enable PHY security in peer measurement session. The corresponding
+ *	keys need to be configured before hand to ensure peer measurement
+ *	session is secure.
  *
  * @__NL80211_KEY_AFTER_LAST: internal
  * @NL80211_KEY_MAX: highest key attribute
@@ -5552,6 +5560,7 @@ enum nl80211_key_attributes {
 	NL80211_KEY_DEFAULT_TYPES,
 	NL80211_KEY_MODE,
 	NL80211_KEY_DEFAULT_BEACON,
+	NL80211_ATTR_LTF_KEYSEED,
 
 	/* keep last */
 	__NL80211_KEY_AFTER_LAST,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2909520bb949..3aaa5734be57 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -968,6 +968,8 @@ static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 	[NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 	[NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
+	[NL80211_ATTR_LTF_KEYSEED] = { .type = NLA_BINARY,
+				       .len = WLAN_MAX_KEY_LEN },
 };
 
 /* policy for the key default flags */
@@ -1491,6 +1493,11 @@ static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 	if (tb[NL80211_KEY_MODE])
 		k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
 
+	if (tb[NL80211_ATTR_LTF_KEYSEED]) {
+		k->p.ltf_keyseed = nla_data(tb[NL80211_ATTR_LTF_KEYSEED]);
+		k->p.ltf_keyseed_len = nla_len(tb[NL80211_ATTR_LTF_KEYSEED]);
+	}
+
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH 12/13] wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index dd45dda7e619..ea6b9c994455 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -800,6 +800,8 @@ struct key_params {
>  	u16 vlan_id;
>  	u32 cipher;
>  	enum nl80211_key_mode mode;
> +	const u8 *ltf_keyseed;
> +	int ltf_keyseed_len;

Warning: include/net/cfg80211.h:804 struct member 'ltf_keyseed' not described in 'key_params'
Warning: include/net/cfg80211.h:804 struct member 'ltf_keyseed_len' not described in 'key_params'

Re: [PATCH 12/13] wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging

[Vasanthakumar Thiagarajan]

On 1/30/2026 9:30 PM, Peddolla Harshavardhan Reddy wrote:
> Add NL80211_ATTR_LTF_KEYSEED attribute to support secure FTM
> measurements. This allows drivers to generate secure LTF keys
> for PHY-layer security in ranging operations.
> 
> The keyseed is used with trigger-based and non-trigger-based
> FTM requests to enable secure peer measurement sessions.
> 
> Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
> ---
>   include/net/cfg80211.h       |  2 ++
>   include/uapi/linux/nl80211.h | 15 ++++++++++++---
>   net/wireless/nl80211.c       |  7 +++++++
>   3 files changed, 21 insertions(+), 3 deletions(-)
> 
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index dd45dda7e619..ea6b9c994455 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -800,6 +800,8 @@ struct key_params {
>   	u16 vlan_id;
>   	u32 cipher;
>   	enum nl80211_key_mode mode;
> +	const u8 *ltf_keyseed;
> +	int ltf_keyseed_len;

Missing kernel-doc for newly added members.

Vasanth

[PATCH 13/13] mac80211_hwsim: Add support for extended FTM ranging

[Peddolla Harshavardhan Reddy]

From: Kavita Kavita <kavita.kavita@oss.qualcomm.com>

Introduce support for continuous ranging and advanced timing parameters
in the FTM (Fine Timing Measurement) request, response, and capability
paths. This enables more flexible ranging scenarios with improved
control over measurement timing and session management.

Signed-off-by: Kavita Kavita <kavita.kavita@oss.qualcomm.com>
---
 drivers/net/wireless/virtual/mac80211_hwsim.c | 141 ++++++++++++++++++
 1 file changed, 141 insertions(+)

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 4d9f5f87e814..430058bb0326 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -843,6 +843,18 @@ hwsim_ftm_result_policy[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1] = {
 	[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD] = { .type = NLA_U64 },
 	[NL80211_PMSR_FTM_RESP_ATTR_LCI] = { .type = NLA_STRING },
 	[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_STRING },
+	[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_RESP_ATTR_BANDWIDTH] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR] = { .type = NLA_FLAG },
 };
 
 static const struct nla_policy
@@ -888,6 +900,14 @@ hwsim_ftm_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
 	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST] = NLA_POLICY_MAX(NLA_U8, 31),
 	[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 	[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
+	[NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER] = { .type = NLA_FLAG },
+	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS] = { .type = NLA_U8 },
+	[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS] = { .type = NLA_U32 },
+	[NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT] = { .type = NLA_FLAG },
 };
 
 static const struct nla_policy
@@ -3488,6 +3508,49 @@ static int mac80211_hwsim_send_pmsr_ftm_request_peer(struct sk_buff *msg,
 	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, request->bss_color))
 		return -ENOBUFS;
 
+	if (request->min_time_between_measurements &&
+	    nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS,
+			request->min_time_between_measurements))
+		return -ENOBUFS;
+
+	if (request->max_time_between_measurements &&
+	    nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS,
+			request->max_time_between_measurements))
+		return -ENOBUFS;
+
+	if (request->availability_window &&
+	    nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
+		       request->availability_window))
+		return -ENOBUFS;
+
+	if (request->nominal_time &&
+	    nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
+			request->nominal_time))
+		return -ENOBUFS;
+
+	if (request->measurements_per_aw &&
+	    nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
+		       request->measurements_per_aw))
+		return -ENOBUFS;
+
+	if (request->ingress_distancemm &&
+	    nla_put_u64_64bit(msg, NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
+			      request->ingress_distancemm, NL80211_ATTR_PAD))
+		return -ENOBUFS;
+
+	if (request->egress_distancemm &&
+	    nla_put_u64_64bit(msg, NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
+			      request->egress_distancemm, NL80211_ATTR_PAD))
+		return -ENOBUFS;
+
+	if (request->range_report &&
+	    nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT))
+		return -ENOBUFS;
+
+	if (request->pd_require_range_results &&
+	    nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_PD_REPORT_RESULT))
+		return -ENOBUFS;
+
 	nla_nest_end(msg, ftm);
 
 	return 0;
@@ -3857,6 +3920,57 @@ static int mac80211_hwsim_parse_ftm_result(struct nlattr *ftm,
 		result->civicloc_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
 	}
 
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT])
+		result->tx_ltf_repetition_count =
+			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT])
+		result->rx_ltf_repetition_count =
+			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS])
+		result->max_time_between_measurements =
+			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS])
+		result->min_time_between_measurements =
+			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS])
+		result->num_tx_spatial_streams =
+			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS])
+		result->num_rx_spatial_streams =
+			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME])
+		result->nominal_time =
+			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW])
+		result->availability_window =
+			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW])
+		result->measurements_per_aw =
+			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW]);
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_BANDWIDTH]) {
+		result->band_width_valid = 1;
+		result->band_width =
+			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_BANDWIDTH]);
+	}
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE]) {
+		result->preamble_valid = 1;
+		result->preamble =
+			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE]);
+	}
+
+	if (tb[NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR])
+		result->is_delayed_lmr = 1;
+
 	return 0;
 }
 
@@ -6312,6 +6426,33 @@ static int parse_ftm_capa(const struct nlattr *ftm_capa, struct cfg80211_pmsr_ca
 	out->ftm.request_civicloc = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC];
 	out->ftm.trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED];
 	out->ftm.non_trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED];
+	out->ftm.support_edca_responder = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER];
+
+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS])
+		out->ftm.max_no_of_tx_antennas =
+			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS]);
+
+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS])
+		out->ftm.max_no_of_rx_antennas =
+			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS]);
+
+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA])
+		out->ftm.min_allowed_ranging_interval_edca =
+			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA]);
+
+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB])
+		out->ftm.min_allowed_ranging_interval_ntb =
+			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB]);
+
+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS])
+		out->ftm.pd_edca_bandwidths =
+			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS]);
+
+	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS])
+		out->ftm.pd_ntb_bandwidths =
+			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS]);
+
+	out->ftm.support_range_report = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT];
 
 	return 0;
 }
-- 
2.34.1

Re: [PATCH 00/13] Ranging support enhancements

[Jeff Johnson]

On 1/30/2026 8:00 AM, Peddolla Harshavardhan Reddy wrote:
> This patch series introduces Fine Timing Measurement (FTM)
> enhancements and Proximity Detection (PD) capabilities. The
> implementation follows the Wi-Fi Alliance "PR Implementation
> Consideration Draft 1.9 Rev 1" specification and extends the
> existing peer measurement framework with advanced ranging
> features.
> 
> Kavita Kavita (1):
>   mac80211_hwsim: Add support for extended FTM ranging
> 
> Peddolla Harshavardhan Reddy (12):
>   wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR
>     request
>   wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR
>   wifi: nl80211/cfg80211: add continuous ranging and PD request support
>   wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging
>   wifi: nl80211/cfg80211: add peer measurement abort command
>   wifi: nl80211/cfg80211: add role-based PD peer limits
>   wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM
>   wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM
>   wifi: nl80211/cfg80211: add FTM range report negotiation support
>   wifi: nl80211/cfg80211: add result reporting control for PD requests
>   wifi: nl80211/cfg80211: add MAC randomization support for PD requests
>   wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging
> 
>  drivers/net/wireless/virtual/mac80211_hwsim.c | 141 +++++++++++++
>  include/net/cfg80211.h                        | 163 ++++++++++++++-
>  include/uapi/linux/nl80211.h                  | 177 +++++++++++++++-
>  net/wireless/nl80211.c                        |  87 ++++++++
>  net/wireless/nl80211.h                        |   1 +
>  net/wireless/pmsr.c                           | 194 ++++++++++++++++--
>  6 files changed, 738 insertions(+), 25 deletions(-)
> 

This was not submitted through the Qualcomm internal review process, and it
has plenty of issues that should be addressed.

Please follow the process communicated privately to have this series go
through the internal processes so that your v2 will be better polished.

/jeff

Re: [PATCH 00/13] Ranging support enhancements

[Vasanthakumar Thiagarajan]

On 1/30/2026 9:30 PM, Peddolla Harshavardhan Reddy wrote:
> This patch series introduces Fine Timing Measurement (FTM)
> enhancements and Proximity Detection (PD) capabilities. The
> implementation follows the Wi-Fi Alliance "PR Implementation
> Consideration Draft 1.9 Rev 1" specification and extends the
> existing peer measurement framework with advanced ranging
> features.
> 
> Kavita Kavita (1):
>    mac80211_hwsim: Add support for extended FTM ranging
> 
> Peddolla Harshavardhan Reddy (12):
>    wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR
>      request
>    wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR
>    wifi: nl80211/cfg80211: add continuous ranging and PD request support
>    wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging
>    wifi: nl80211/cfg80211: add peer measurement abort command
>    wifi: nl80211/cfg80211: add role-based PD peer limits
>    wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM
>    wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM
>    wifi: nl80211/cfg80211: add FTM range report negotiation support
>    wifi: nl80211/cfg80211: add result reporting control for PD requests
>    wifi: nl80211/cfg80211: add MAC randomization support for PD requests
>    wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging
> 
>   drivers/net/wireless/virtual/mac80211_hwsim.c | 141 +++++++++++++
>   include/net/cfg80211.h                        | 163 ++++++++++++++-
>   include/uapi/linux/nl80211.h                  | 177 +++++++++++++++-
>   net/wireless/nl80211.c                        |  87 ++++++++
>   net/wireless/nl80211.h                        |   1 +
>   net/wireless/pmsr.c                           | 194 ++++++++++++++++--
>   6 files changed, 738 insertions(+), 25 deletions(-)
> 

Pls add branch tag in all the patches in the series.

Vasanth

Re: [PATCH 00/13] Ranging support enhancements

[Lachlan Hodges]

Hi,

> Peddolla Harshavardhan Reddy (12):
>   wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR
>     request
>   wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR
>   wifi: nl80211/cfg80211: add continuous ranging and PD request support
>   wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging
>   wifi: nl80211/cfg80211: add peer measurement abort command
>   wifi: nl80211/cfg80211: add role-based PD peer limits
>   wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM
>   wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM
>   wifi: nl80211/cfg80211: add FTM range report negotiation support
>   wifi: nl80211/cfg80211: add result reporting control for PD requests
>   wifi: nl80211/cfg80211: add MAC randomization support for PD requests
>   wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging

Could you not just have "wifi: cfg80211: ..." for each commit? I think
having both nl80211 and cfg80211 just adds unnecessary noise when
ultimately this is all within cfg80211.

lachlan 

Re: [PATCH 00/13] Ranging support enhancements

[Peddolla Harshavardhan Reddy]

On 03-Feb-26 5:10 PM, Lachlan Hodges wrote:
> Hi,
>
>> Peddolla Harshavardhan Reddy (12):
>>   wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR
>>     request
>>   wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR
>>   wifi: nl80211/cfg80211: add continuous ranging and PD request support
>>   wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging
>>   wifi: nl80211/cfg80211: add peer measurement abort command
>>   wifi: nl80211/cfg80211: add role-based PD peer limits
>>   wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM
>>   wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM
>>   wifi: nl80211/cfg80211: add FTM range report negotiation support
>>   wifi: nl80211/cfg80211: add result reporting control for PD requests
>>   wifi: nl80211/cfg80211: add MAC randomization support for PD requests
>>   wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging
> Could you not just have "wifi: cfg80211: ..." for each commit? I think
> having both nl80211 and cfg80211 just adds unnecessary noise when
> ultimately this is all within cfg80211.
>
> lachlan 

Sure, will use "wifi: cfg80211: ..." format, Thanks.