* [PATCH RFC 2/3] net: ath11k: add firmware lockup detection and recovery
From: Matthew Leach @ 2026-03-04 12:47 UTC (permalink / raw)
To: Jeff Johnson; +Cc: linux-wireless, ath11k, linux-kernel, kernel, Matthew Leach
In-Reply-To: <20260304-ath11k-lockup-fixes-v1-0-67143c2fe2a1@collabora.com>
Detect firmware lockup when a WMI command times out and TX descriptor
exhaustion occurs within ATH11K_LOCKUP_DESC_ERR_RANGE_HZ (1 minute). In
this case, consider the firmware dead.
When a lockup is detected, queue reset work to restart the chip.
After reset completes, clear the lockup detection state.
Signed-off-by: Matthew Leach <matthew.leach@collabora.com>
---
drivers/net/wireless/ath/ath11k/core.h | 2 ++
drivers/net/wireless/ath/ath11k/mac.c | 6 ++++++
drivers/net/wireless/ath/ath11k/wmi.c | 24 +++++++++++++++++++++++-
3 files changed, 31 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
index a0d725923ef2..221dcd23b3dd 100644
--- a/drivers/net/wireless/ath/ath11k/core.h
+++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -70,6 +70,7 @@ extern bool ath11k_ftm_mode;
#define ATH11K_RESET_FAIL_TIMEOUT_HZ (20 * HZ)
#define ATH11K_RECONFIGURE_TIMEOUT_HZ (10 * HZ)
#define ATH11K_RECOVER_START_TIMEOUT_HZ (20 * HZ)
+#define ATH11K_LOCKUP_DESC_ERR_RANGE_HZ (60 * HZ)
enum ath11k_supported_bw {
ATH11K_BW_20 = 0,
@@ -1039,6 +1040,7 @@ struct ath11k_base {
struct ath11k_dbring_cap *db_caps;
u32 num_db_cap;
+ u64 last_frame_tx_error_jiffies;
/* To synchronize 11d scan vdev id */
struct mutex vdev_id_11d_lock;
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 748f779b3d1b..a0b4d60da330 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -9,6 +9,7 @@
#include <linux/etherdevice.h>
#include <linux/bitfield.h>
#include <linux/inetdevice.h>
+#include <linux/jiffies.h>
#include <net/if_inet6.h>
#include <net/ipv6.h>
@@ -6546,6 +6547,10 @@ static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
ret = ath11k_dp_tx(ar, arvif, arsta, skb);
if (unlikely(ret)) {
+ scoped_guard(spinlock_bh, &ar->ab->base_lock) {
+ ar->ab->last_frame_tx_error_jiffies = jiffies_64;
+ }
+
ath11k_warn(ar->ab, "failed to transmit frame %d\n", ret);
ieee80211_free_txskb(ar->hw, skb);
}
@@ -9281,6 +9286,7 @@ ath11k_mac_op_reconfig_complete(struct ieee80211_hw *hw,
atomic_dec(&ab->reset_count);
complete(&ab->reset_complete);
ab->is_reset = false;
+ ab->last_frame_tx_error_jiffies = 0;
atomic_set(&ab->fail_cont_count, 0);
ath11k_dbg(ab, ATH11K_DBG_BOOT, "reset success\n");
}
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 40747fba3b0c..7d9f0bcbb3b0 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -7,8 +7,11 @@
#include <linux/ctype.h>
#include <net/mac80211.h>
#include <net/cfg80211.h>
+#include <linux/cleanup.h>
#include <linux/completion.h>
#include <linux/if_ether.h>
+#include <linux/jiffies.h>
+#include <linux/spinlock.h>
#include <linux/types.h>
#include <linux/pci.h>
#include <linux/uuid.h>
@@ -325,9 +328,28 @@ int ath11k_wmi_cmd_send(struct ath11k_pdev_wmi *wmi, struct sk_buff *skb,
}), WMI_SEND_TIMEOUT_HZ);
}
- if (ret == -EAGAIN)
+ if (ret == -EAGAIN) {
+ u64 range_start;
+
ath11k_warn(wmi_ab->ab, "wmi command %d timeout\n", cmd_id);
+ guard(spinlock_bh)(&ab->base_lock);
+
+ if (ab->last_frame_tx_error_jiffies == 0)
+ return ret;
+
+ range_start =
+ (jiffies_64 > ATH11K_LOCKUP_DESC_ERR_RANGE_HZ) ?
+ jiffies_64 - ATH11K_LOCKUP_DESC_ERR_RANGE_HZ :
+ 0;
+
+ if (time_in_range64(ab->last_frame_tx_error_jiffies,
+ range_start, jiffies_64) &&
+ queue_work(ab->workqueue_aux, &ab->reset_work))
+ ath11k_err(wmi_ab->ab,
+ "Firmware lockup detected. Resetting.");
+ }
+
if (ret == -ENOBUFS)
ath11k_warn(wmi_ab->ab, "ce desc not available for wmi command %d\n",
cmd_id);
--
2.53.0
^ permalink raw reply related
* [PATCH RFC 1/3] net: ath11k: fix redundant reset from stale pending workqueue bit
From: Matthew Leach @ 2026-03-04 12:47 UTC (permalink / raw)
To: Jeff Johnson; +Cc: linux-wireless, ath11k, linux-kernel, kernel, Matthew Leach
In-Reply-To: <20260304-ath11k-lockup-fixes-v1-0-67143c2fe2a1@collabora.com>
During a firmware lockup, WMI commands time out in rapid succession,
each calling queue_work() to schedule ath11k_core_reset(). This can
cause a spurious extra reset after recovery completes:
1. First WMI timeout calls queue_work(), sets the pending bit and
schedules ath11k_core_reset(). The workqueue clears the pending bit
before invoking the work function. reset_count becomes 1 and the reset
is kicked off asynchronously. ath11k_core_reset() returns.
2. Second WMI timeout calls queue_work() and re-queues the work. When it
runs after step 1 returns, it sees reset_count > 1 and blocks in
wait_for_completion(). The pending bit is again cleared.
3. Third WMI timeout calls queue_work(), the pending bit was cleared in
step 2, so this succeeds and arms another execution.
4. The asynchronous reset finishes. ath11k_mac_op_reconfig_complete()
decrements reset_count and calls complete(). The blocked worker from
step 2 wakes, takes the early-exit path, and decrements reset_count to
0.
5. The workqueue sees the pending bit from step 3 and runs
ath11k_core_reset() again. reset_count is 0, triggering a
full redundant hardware reset.
Fix this by calling cancel_work() on reset_work in
ath11k_mac_op_reconfig_complete() before signalling completion. This
clears any stale pending bit, preventing the spurious re-execution.
Signed-off-by: Matthew Leach <matthew.leach@collabora.com>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index e4ee2ba1f669..748f779b3d1b 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -9274,6 +9274,10 @@ ath11k_mac_op_reconfig_complete(struct ieee80211_hw *hw,
* the recovery has to be done for each radio
*/
if (recovery_count == ab->num_radios) {
+ /* Cancel any pending work, preventing a second redudant
+ * reset.
+ */
+ cancel_work(&ab->reset_work);
atomic_dec(&ab->reset_count);
complete(&ab->reset_complete);
ab->is_reset = false;
--
2.53.0
^ permalink raw reply related
* [PATCH RFC 0/3] net: ath11k: Firmware lockup detection & mitigation
From: Matthew Leach @ 2026-03-04 12:47 UTC (permalink / raw)
To: Jeff Johnson; +Cc: linux-wireless, ath11k, linux-kernel, kernel, Matthew Leach
When sat idle for approx 24 hours, a user experienced a firmware lockup on a
ath11k chip, resulting in the following log output:
systemd-timesyncd[558]: Timed out waiting for reply from 23.95.49.216:123 (2.arch.pool.ntp.org).
systemd-timesyncd[558]: Timed out waiting for reply from 23.186.168.125:123 (2.arch.pool.ntp.org).
systemd-timesyncd[558]: Timed out waiting for reply from 64.79.100.197:123 (2.arch.pool.ntp.org).
systemd-timesyncd[558]: Timed out waiting for reply from 69.89.207.199:123 (2.arch.pool.ntp.org).
kernel: ath11k_pci 0000:03:00.0: failed to transmit frame -12
kernel: ath11k_pci 0000:03:00.0: failed to transmit frame -12
kernel: ath11k_pci 0000:03:00.0: failed to transmit frame -12
[...]
kernel: ath11k_pci 0000:03:00.0: failed to flush transmit queue, data pkts pending 564
kernel: ath11k_pci 0000:03:00.0: wmi command 20486 timeout
kernel: ath11k_pci 0000:03:00.0: failed to submit WMI_VDEV_STOP cmd
kernel: ath11k_pci 0000:03:00.0: failed to stop WMI vdev 0: -11
kernel: ath11k_pci 0000:03:00.0: failed to stop vdev 0: -11
kernel: ath11k_pci 0000:03:00.0: failed to do early vdev stop: -11
kernel: ath11k_pci 0000:03:00.0: Failed to remove station: xx:xx:xx:xx:xx:xx for VDEV: 0
kernel: ath11k_pci 0000:03:00.0: Found peer entry xx:xx:xx:xx:xx:xx n vdev 0 after it was supposedly removed
kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 1229 at net/mac80211/sta_info.c:1490 __sta_info_destroy_part2+0x14e/0x180 [mac80211]
This patch series:
- Fixes a bug in the core reset logic which could cause a second redundant reset
after the original reset completes.
- Implements the error correlation logic and queues a chip reset when detected.
- Adds a simulation to the simulate_fw_crash debugfs file to test the
detection logic.
Signed-off-by: Matthew Leach <matthew.leach@collabora.com>
---
Matthew Leach (3):
net: ath11k: fix redundant reset from stale pending workqueue bit
net: ath11k: add firmware lockup detection and recovery
net: ath11k: add lockup simulation via debugfs
drivers/net/wireless/ath/ath11k/core.h | 3 +++
drivers/net/wireless/ath/ath11k/debugfs.c | 7 ++++++-
drivers/net/wireless/ath/ath11k/hal.c | 7 +++++--
drivers/net/wireless/ath/ath11k/htc.c | 2 +-
drivers/net/wireless/ath/ath11k/mac.c | 10 ++++++++++
drivers/net/wireless/ath/ath11k/wmi.c | 28 +++++++++++++++++++++++++++-
6 files changed, 52 insertions(+), 5 deletions(-)
---
base-commit: 11439c4635edd669ae435eec308f4ab8a0804808
change-id: 20260304-ath11k-lockup-fixes-b808b5c7318b
Best regards,
--
Matthew Leach <matthew.leach@collabora.com>
^ permalink raw reply
* Re: [PATCH wireless-next v2 15/16] wifi: cfg80211: add LTF keyseed support for secure ranging
From: Johannes Berg @ 2026-03-04 12:03 UTC (permalink / raw)
To: Peddolla Harshavardhan Reddy; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-16-peddolla.reddy@oss.qualcomm.com>
On Wed, 2026-03-04 at 12:45 +0530, Peddolla Harshavardhan Reddy wrote:
>
> * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
> * %NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER,
> - * and %NL80211_ATTR_KEY_SEQ attributes. %NL80211_ATTR_MAC represents
> - * peer's MLD address for MLO pairwise key. The link to add MLO
> - * group key is identified by %NL80211_ATTR_MLO_LINK_ID.
> + * %NL80211_ATTR_KEY_SEQ and %NL80211_KEY_LTF_SEED attributes.
> + * %NL80211_ATTR_MAC represents peer's MLD address for MLO pairwise key.
> + * The link to add MLO group key is identified by
> + * %NL80211_ATTR_MLO_LINK_ID.
I think this is a bit misleading since it mixes up the key attributes
now. I think at this level it should refer to %NL80211_ATTR_KEY instead
of the specific nested %NL80211_KEY_LTF_SEED.
> * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
> * or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC represents peer's MLD address
> * for MLO pairwise key. The link to delete group key is identified by
> @@ -5602,6 +5603,14 @@ enum nl80211_key_default_types {
> * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode.
> * Defaults to @NL80211_KEY_RX_TX.
> * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key
> + * @NL80211_KEY_LTF_SEED: LTF key seed is used by the driver to generate
> + * secure LTF keys used in case of peer measurement request with FTM
> + * request type as either %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED
> + * or %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED, secure LTF key seeds will
> + * help enable PHY security in peer measurement session. The corresponding
> + * keys need to be configured before hand to ensure peer measurement
"beforehand"
> + * session is secure. Only valid if %NL80211_EXT_FEATURE_SECURE_LTF
> + * is set.
NL80211_EXT_FEATURE_SECURE_LTF already exists today, and is set by
iwlwifi/mvm, so I'm not convinced you can just redefine it to mean also
LTF key seed is supported?
> +++ b/net/wireless/nl80211.c
> @@ -983,6 +983,7 @@ static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
> [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
> [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
> [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
> + [NL80211_KEY_LTF_SEED] = { .type = NLA_BINARY, .len = 48 },
This probably doesn't do what you think it does, unless you really
wanted that it's *at most* 48 bytes. And please add a define in
ieee80211.h for that.
johannes
^ permalink raw reply
* Re: [PATCH wireless-next v2 14/16] wifi: cfg80211: add MAC randomization support for PD requests
From: Johannes Berg @ 2026-03-04 11:56 UTC (permalink / raw)
To: Peddolla Harshavardhan Reddy; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-15-peddolla.reddy@oss.qualcomm.com>
On Wed, 2026-03-04 at 12:45 +0530, Peddolla Harshavardhan Reddy wrote:
> Enable MAC address randomization for proximity detection requests to
> maintain privacy throughout the entire PD session workflow. When
> enabled, use the same randomized MAC address for discovery,
> authentication, and ranging measurements, ensuring consistent identity
> protection across all phases.
>
> Add a capability flag for devices to advertise PD MAC randomization
> support and validate that randomization is only requested when the
> device supports it. This ensures consistent MAC address usage across
> all phases of proximity detection while preventing invalid
> configurations where randomization is requested but not supported by
> hardware.
Doesn't this basically also require NL80211_EXT_FEATURE_ROC_ADDR_FILTER
for the setup? If so, maybe some check (core.c?) should validate that
you don't have PD MAC randomization without it?
johannes
^ permalink raw reply
* Re: [PATCH wireless-next v2 07/16] wifi: cfg80211: add continuous ranging and PD request support
From: Johannes Berg @ 2026-03-04 11:52 UTC (permalink / raw)
To: Peddolla Harshavardhan Reddy; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-8-peddolla.reddy@oss.qualcomm.com>
On Wed, 2026-03-04 at 12:45 +0530, Peddolla Harshavardhan Reddy wrote:
>
> +++ b/net/wireless/pmsr.c
> @@ -91,11 +91,10 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
> nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST]);
>
> if (capa->ftm.max_ftms_per_burst &&
> - (out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst ||
> - out->ftm.ftms_per_burst == 0)) {
> + (out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst)) {
> NL_SET_ERR_MSG_ATTR(info->extack,
> tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],
> - "FTM: FTMs per burst must be set lower than the device limit but non-zero");
> + "FTM: FTMs per burst must be set lower than the device limit");
> return -EINVAL;
> }
I really don't know anything about this protocol, but this also isn't
described in the commit message, and zero seems odd?
Maybe it should be allowed only under some additional conditions,
otherwise you're potentially changing some check that existing
drivers/devices rely on?
johannes
^ permalink raw reply
* Re: [PATCH wireless-next v2 06/16] wifi: cfg80211: add proximity detection capabilities to PMSR
From: Johannes Berg @ 2026-03-04 11:50 UTC (permalink / raw)
To: Peddolla Harshavardhan Reddy; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-7-peddolla.reddy@oss.qualcomm.com>
On Wed, 2026-03-04 at 12:45 +0530, Peddolla Harshavardhan Reddy wrote:
>
> +++ b/net/wireless/nl80211.c
> @@ -404,6 +404,10 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
> [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
> [NL80211_PMSR_ATTR_PEERS] =
> NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
> + [NL80211_PMSR_ATTR_PD_SUPPORT] = { .type = NLA_REJECT },
> + [NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT] = {
> + .type = NLA_REJECT
> + },
Probably should use something like the global policy, with
[0] = { .strict_start_type = NL80211_PMSR_ATTR_PD_SUPPORT },
instead of listing them? That way, unlisted ones become reject
automatically, I think. It's been a while ...
johannes
^ permalink raw reply
* Re: [PATCH wireless-next v2 05/16] wifi: cfg80211: add start/stop proximity detection commands
From: Johannes Berg @ 2026-03-04 11:47 UTC (permalink / raw)
To: Peddolla Harshavardhan Reddy; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-6-peddolla.reddy@oss.qualcomm.com>
On Wed, 2026-03-04 at 12:45 +0530, Peddolla Harshavardhan Reddy wrote:
>
>
> +TRACE_EVENT(rdev_start_pd,
> + TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
> + TP_ARGS(wiphy, wdev),
> + TP_STRUCT__entry(
> + WIPHY_ENTRY
> + WDEV_ENTRY
> + ),
> + TP_fast_assign(
> + WIPHY_ASSIGN;
> + WDEV_ASSIGN;
> + ),
> + TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT,
> + WIPHY_PR_ARG, WDEV_PR_ARG)
> +);
Why spell this out completely?
> +DEFINE_EVENT(wiphy_wdev_evt, rdev_stop_pd,
> + TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
> + TP_ARGS(wiphy, wdev)
> +);
Clearly you knew there was a class?
johannes
^ permalink raw reply
* Re: New warning `ath10k_pci 0000:3a:00.0: not found station for peer stats`
From: Paul Menzel @ 2026-03-04 11:40 UTC (permalink / raw)
To: Baochen Qiang, Jeff Johnson; +Cc: linux-wireless, ath10k
In-Reply-To: <80231e1b-fc6f-488f-97f7-92e792954022@oss.qualcomm.com>
Dear Baochen,
Thank you for your quick reply.
Am 04.03.26 um 02:47 schrieb Baochen Qiang:
> On 3/4/2026 4:01 AM, Paul Menzel wrote:
>> Am 11.02.26 um 06:43 schrieb Baochen Qiang:
>>> On 2/10/2026 6:31 AM, Paul Menzel wrote:
>>>> Am 09.02.26 um 03:44 schrieb Baochen Qiang:
>>>>> On 2/7/2026 1:55 PM, Paul Menzel wrote:
>>>>>> Am 19.01.26 um 17:41 schrieb Paul Menzel:
>>>>>>
>>>>>>> Since January 10th, I have started seeing the warning below in
>>>>>>> my Linux logs, that reach back to September 24th, 2025:
>>>>>>>
>>>>>>> [ 37.108902] ath10k_pci 0000:3a:00.0: not found station for peer stats
>>>>>>> [ 37.108906] ath10k_pci 0000:3a:00.0: failed to parse stats info tlv: -22
[…]
>>> I managed to reproduce this issue locally. Will submit a patch
>>> fixing it.
>>
>> Sorry for being impatient, but as Linux 7.0-rc2 was tagged, were
>> you able to come up with a patch, or should the commit be reverted
>> for now to have more time to analyze this?
>
> The patch is under internal review now, will submit once it is
> approved.
Awesome. I am looking forward to it. It’d be great, if you Cc’ed me on
the patch.
Kind regards,
Paul
^ permalink raw reply
* [GIT PULL] wireless-next-2026-03-04
From: Johannes Berg @ 2026-03-04 11:34 UTC (permalink / raw)
To: netdev; +Cc: linux-wireless
Hi,
And here's the -next side, since I'll need it all merged up to
net-next as well to get the combination together to avoid the
conflicts I mentioned.
But this time we actually also have a real new feature, notably
support for EPPKE, association frame encryption and 802.1X over
auth frames, from the upcoming 802.11bi amendment. When that'll
be supported on both sides, association request/response will be
encrypted for better privacy and hopefully faster connections
(no more 4-way handshake.) Driver support will need to follow
though.
Please pull and let us know if there's any problem.
Thanks,
johannes
The following changes since commit 0314e382cf02983eb3c33ac537ad9701e7858bc9:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-02-26 10:23:00 -0800)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git tags/wireless-next-2026-03-04
for you to fetch changes up to 44d93cf1abb6a85d65c3b4b027c82d44263de6a5:
wifi: UHR: define DPS/DBE/P-EDCA elements and fix size parsing (2026-03-04 11:50:03 +0100)
----------------------------------------------------------------
Notable features this time:
- cfg80211/mac80211
- finished assoc frame encryption/EPPKE/802.1X-over-auth
(also hwsim)
- radar detection improvements
- 6 GHz incumbent signal detection APIs
- multi-link support for FILS, probe response
templates and client probling
- ath12k:
- monitor mode support on IPQ5332
- basic hwmon temperature reporting
----------------------------------------------------------------
Aaradhana Sahu (1):
wifi: ath12k: Enable monitor mode support on IPQ5332
Alejandro Colomar (1):
wifi: ath9k: Fix typo
Avraham Stern (1):
wifi: cfg80211: support key installation on non-netdev wdevs
Baochen Qiang (1):
wifi: ath12k: fix indentation in ath12k_qmi_aux_uc_load()
Bjorn Andersson (1):
wifi: ath11k: Silence remoteproc probe deferral prints
Daniel Hodges (1):
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
Gustavo A. R. Silva (1):
wifi: iwlegacy: Avoid multiple -Wflex-array-member-not-at-end warnings
Hari Chandrakanthan (1):
wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver
Janusz Dziedzic (4):
wifi: cfg80211: fix background CAC
wifi: cfg80211: set and report chandef CAC ongoing
wifi: cfg80211: events, report background radar
wifi: mac80211_hwsim: background CAC support
Johannes Berg (2):
wifi: mac80211: give the AP more time for EPPKE as well
Merge tag 'ath-next-20260303' of https://git.kernel.org/pub/scm/linux/kernel/git/ath/ath
Jori Koolstra (1):
wifi: mac80211_hwsim: change hwsim_class to a const struct
Karthikeyan Kathirvel (1):
wifi: UHR: define DPS/DBE/P-EDCA elements and fix size parsing
Karthikeyan Periyasamy (1):
wifi: ath12k: Remove the unused argument from the Rx data path
Kavita Kavita (5):
wifi: mac80211_hwsim: Advertise support for (Re)Association frame encryption
wifi: mac80211: Advertise EPPKE support based on driver capabilities
wifi: cfg80211: add support for IEEE 802.1X Authentication Protocol
wifi: mac80211: Add support for IEEE 802.1X authentication protocol in non-AP STA mode
wifi: mac80211: Advertise IEEE 802.1X authentication support
Kexin Sun (1):
wifi: mac80211: update outdated comment
Maharaja Kennadyrajan (1):
wifi: ath12k: add basic hwmon temperature reporting
Miri Korenblit (6):
wifi: nl80211: refactor nl80211_parse_chandef
wifi: cfg80211: remove unneeded call to cfg80211_leave
wifi: nl80211/cfg80211: support stations of non-netdev interfaces
wifi: cfg80211: refactor wiphy_suspend
wifi: nl80211: don't allow DFS channels for NAN
wifi: cfg80211: make cluster id an array
Ramya Gnanasekar (1):
wifi: ath12k: Set up MLO after SSR
Rosen Penev (1):
wifi: rt2x00: use generic nvmem_cell_get
Sai Pratyusha Magam (1):
wifi: mac80211: Fix AAD/Nonce computation for management frames with MLO
Sriram R (2):
wifi: mac80211: fetch FILS discovery template by link ID
wifi: mac80211: fetch unsolicited probe response template by link ID
Suraj P Kizhakkethil (2):
wifi: mac80211: set band information only for non-MLD when probing stations using NULL frame
wifi: mac80211: Set link ID for NULL packets sent to probe stations
Zilin Guan (2):
wifi: ath11k: fix memory leaks in beacon template setup
wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
drivers/net/wireless/ath/ath11k/ahb.c | 10 +-
drivers/net/wireless/ath/ath11k/mac.c | 32 ++-
drivers/net/wireless/ath/ath12k/Makefile | 1 +
drivers/net/wireless/ath/ath12k/core.c | 23 +-
drivers/net/wireless/ath/ath12k/core.h | 3 +
drivers/net/wireless/ath/ath12k/dp_rx.c | 2 -
drivers/net/wireless/ath/ath12k/dp_rx.h | 2 -
drivers/net/wireless/ath/ath12k/mac.c | 10 +-
drivers/net/wireless/ath/ath12k/qmi.c | 2 +-
drivers/net/wireless/ath/ath12k/thermal.c | 124 +++++++++
drivers/net/wireless/ath/ath12k/thermal.h | 40 +++
drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 25 +-
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 4 +-
drivers/net/wireless/ath/ath12k/wmi.c | 57 ++---
drivers/net/wireless/ath/ath6kl/cfg80211.c | 25 +-
drivers/net/wireless/ath/ath6kl/main.c | 4 +-
drivers/net/wireless/ath/ath9k/ath9k.h | 2 +-
drivers/net/wireless/ath/wil6210/cfg80211.c | 33 ++-
drivers/net/wireless/ath/wil6210/main.c | 3 +-
drivers/net/wireless/ath/wil6210/wmi.c | 5 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 41 +--
drivers/net/wireless/intel/iwlegacy/3945.h | 4 +-
drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +-
drivers/net/wireless/intel/iwlegacy/commands.h | 9 +-
drivers/net/wireless/intel/iwlegacy/common.h | 4 +-
drivers/net/wireless/intel/iwlwifi/mld/nan.c | 5 +-
drivers/net/wireless/marvell/libertas/cfg.c | 8 +-
drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 1 +
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 36 +--
drivers/net/wireless/marvell/mwifiex/init.c | 2 +-
drivers/net/wireless/marvell/mwifiex/uap_event.c | 7 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 6 +-
drivers/net/wireless/microchip/wilc1000/cfg80211.c | 44 ++--
drivers/net/wireless/quantenna/qtnfmac/cfg80211.c | 38 +--
drivers/net/wireless/quantenna/qtnfmac/event.c | 6 +-
drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 +-
drivers/net/wireless/virtual/mac80211_hwsim.c | 141 ++++++++++-
drivers/net/wireless/virtual/mac80211_hwsim.h | 2 +
drivers/net/wireless/virtual/virt_wifi.c | 12 +-
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 33 +--
include/linux/ieee80211-uhr.h | 271 +++++++++++++++++++-
include/linux/ieee80211.h | 2 +
include/net/cfg80211.h | 63 +++--
include/net/mac80211.h | 15 +-
include/uapi/linux/nl80211.h | 34 +++
net/mac80211/cfg.c | 99 +++++---
net/mac80211/ieee80211_i.h | 2 +
net/mac80211/main.c | 10 +
net/mac80211/mlme.c | 81 +++++-
net/mac80211/rx.c | 5 +
net/mac80211/sta_info.c | 4 +-
net/mac80211/tx.c | 77 ++++--
net/mac80211/wpa.c | 55 +++-
net/wireless/chan.c | 29 ++-
net/wireless/core.c | 1 -
net/wireless/core.h | 4 +
net/wireless/ibss.c | 4 +-
net/wireless/mlme.c | 51 ++--
net/wireless/nl80211.c | 279 ++++++++++++++-------
net/wireless/nl80211.h | 5 +-
net/wireless/pmsr.c | 5 +-
net/wireless/rdev-ops.h | 62 ++---
net/wireless/sme.c | 4 +-
net/wireless/sysfs.c | 33 +--
net/wireless/trace.h | 185 +++++++++-----
net/wireless/util.c | 4 +-
net/wireless/wext-compat.c | 12 +-
68 files changed, 1628 insertions(+), 584 deletions(-)
create mode 100644 drivers/net/wireless/ath/ath12k/thermal.c
create mode 100644 drivers/net/wireless/ath/ath12k/thermal.h
^ permalink raw reply
* Re: pull-request: ath-next-20260303
From: Johannes Berg @ 2026-03-04 11:34 UTC (permalink / raw)
To: Jeff Johnson; +Cc: linux-wireless
In-Reply-To: <18112483-1280-4ede-bd59-10cac700404e@oss.qualcomm.com>
Hi,
On Tue, 2026-03-03 at 08:34 -0800, Jeff Johnson wrote:
> > git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath.git tags/ath-next-20260303
I'm almost surprised this even still works, don't you use https://?
>
> FYI the reason for the early PR is that I made the mistake of pulling some
> patches into ath-next before I realized that Kees & Linux had applied the
> treewide kmalloc_obj() feature, so now I need to merge so I can then fast
> forward to wireless-next/main to pick that up. I don't want to take any more
> ath-next changes until that is in place.
Sure, that's fine, I often send almost a PR per week, so should be happy
to accept that too :)
johannes
^ permalink raw reply
* [GIT PULL] wireless-2026-03-04
From: Johannes Berg @ 2026-03-04 11:24 UTC (permalink / raw)
To: netdev; +Cc: linux-wireless
Hi,
A couple more fixes, I'm mostly sending this for the mt76
fixes which conflict with some other upcoming work for
-next, so I can put it all together next week.
Please pull and let us know if there's any problem.
Thanks,
johannes
The following changes since commit b9c8fc2caea6ff7e45c6942de8fee53515c66b34:
Merge tag 'net-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-02-26 08:00:13 -0800)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git tags/wireless-2026-03-04
for you to fetch changes up to 4e10a730d1b511ff49723371ed6d694dd1b2c785:
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() (2026-03-03 12:13:36 +0100)
----------------------------------------------------------------
Some more fixes:
- mt76 gets three almost identical new length checks
- cw1200 & ti: locking fixes
- mac80211 has a fix for the recent EML frame handling
- rsi driver no longer oddly responds to config, which
had triggered a warning in mac80211
- ath12k has two fixes for station statistics handling
----------------------------------------------------------------
Baochen Qiang (2):
wifi: ath12k: use correct pdev id when requesting firmware stats
wifi: ath12k: fix station lookup failure when disconnecting from AP
Bart Van Assche (2):
wifi: cw1200: Fix locking in error paths
wifi: wlcore: Fix a locking bug
Johannes Berg (1):
Merge tag 'ath-current-20260302' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath
Lorenzo Bianconi (3):
wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
MeiChia Chiu (1):
wifi: mac80211: fix missing ieee80211_eml_params member initialization
Sebastian Krzyszkowiak (1):
wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
drivers/net/wireless/ath/ath12k/mac.c | 6 ++--
drivers/net/wireless/ath/ath12k/wmi.c | 36 ++++++++--------------
.../net/wireless/mediatek/mt76/mt76_connac_mac.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 1 +
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 2 +-
drivers/net/wireless/st/cw1200/pm.c | 2 ++
drivers/net/wireless/ti/wlcore/main.c | 4 +--
net/mac80211/eht.c | 1 +
9 files changed, 25 insertions(+), 29 deletions(-)
^ permalink raw reply
* Re: [PATCH wireless-next v5 2/2] wifi: mac80211_hwsim: Add UHR capabilities to the driver
From: Johannes Berg @ 2026-03-04 10:49 UTC (permalink / raw)
To: Karthikeyan Kathirvel; +Cc: linux-wireless, ath12k
In-Reply-To: <20260304085343.1093993-3-karthikeyan.kathirvel@oss.qualcomm.com>
On Wed, 2026-03-04 at 14:23 +0530, Karthikeyan Kathirvel wrote:
>
> +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
> @@ -4478,6 +4478,43 @@ static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
> },
> /* PPE threshold information is not supported */
> },
> + .uhr_cap = {
Missing from the context, but this is non-AP side.
> + .has_uhr = true,
> + .mac = {
> + .mac_cap[0] =
> + IEEE80211_UHR_MAC_CAP0_DPS_SUPP |
> + IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP |
"Reserved for a non-AP STA."
Maybe we're just better off doing this as we implement features?
I've applied patch 1 with some minor edits.
johannes
^ permalink raw reply
* [wireless-next:main] BUILD SUCCESS 5d048bbed1bb2bbef612dad0bb9c177c434e63a4
From: kernel test robot @ 2026-03-04 9:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
branch HEAD: 5d048bbed1bb2bbef612dad0bb9c177c434e63a4 wifi: mac80211: give the AP more time for EPPKE as well
elapsed time: 1345m
configs tested: 65
configs skipped: 2
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
arc allmodconfig clang-16
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig gcc-15.2.0
arm allnoconfig clang-23
arm allyesconfig clang-16
arm allyesconfig gcc-15.2.0
arm64 allmodconfig clang-19
arm64 allnoconfig gcc-15.2.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
hexagon allmodconfig clang-17
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-23
i386 allmodconfig clang-20
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allyesconfig clang-20
i386 allyesconfig gcc-14
loongarch allmodconfig clang-19
loongarch allnoconfig clang-23
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k allyesconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig gcc-11.5.0
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc allyesconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig gcc-15.2.0
riscv allmodconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
s390 allmodconfig clang-18
s390 allmodconfig clang-19
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
sh allmodconfig gcc-15.2.0
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh allyesconfig gcc-15.2.0
sparc allnoconfig gcc-15.2.0
sparc64 allmodconfig clang-23
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
um allyesconfig gcc-15.2.0
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allyesconfig clang-20
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH wireless-next v5 2/2] wifi: mac80211_hwsim: Add UHR capabilities to the driver
From: Karthikeyan Kathirvel @ 2026-03-04 8:53 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, ath12k, Karthikeyan Kathirvel
In-Reply-To: <20260304085343.1093993-1-karthikeyan.kathirvel@oss.qualcomm.com>
Add UHR capabilities for bringing up the interface in UHR mode.
This is required to validate UHR test cases.
The fields added to AP and STATION mode for each bands based on the
IEEE 802.11bn Draft P802.11bn/D1.3 "Table 9-bb3—Fields of the UHR MAC
Capabilities Information field" and "Table 9-bb6—Subfields of the UHR
PHY Capabilities Information field"
Signed-off-by: Karthikeyan Kathirvel <karthikeyan.kathirvel@oss.qualcomm.com>
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 246 ++++++++++++++++++
1 file changed, 246 insertions(+)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index e89173f91637..1d8060ad86fd 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -4478,6 +4478,43 @@ static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
},
/* PPE threshold information is not supported */
},
+ .uhr_cap = {
+ .has_uhr = true,
+ .mac = {
+ .mac_cap[0] =
+ IEEE80211_UHR_MAC_CAP0_DPS_SUPP |
+ IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP |
+ IEEE80211_UHR_MAC_CAP0_NPCA_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ENH_BSR_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ADD_MAP_TID_SUPP |
+ IEEE80211_UHR_MAC_CAP0_EOTSP_SUPP,
+ .mac_cap[1] =
+ IEEE80211_UHR_MAC_CAP1_DSO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PEDCA_SUPP |
+ IEEE80211_UHR_MAC_CAP1_UL_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_P2P_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DUO_SUPP,
+ .mac_cap[2] =
+ IEEE80211_UHR_MAC_CAP2_AOM_SUPP |
+ IEEE80211_UHR_MAC_CAP2_IFCS_LOC_SUPP |
+ IEEE80211_UHR_MAC_CAP2_UHR_TRS_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXSPG_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXOP_RET_IN_TXSPG |
+ IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW,
+ .mac_cap[3] =
+ IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH,
+ .mac_cap[4] =
+ IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP,
+ },
+ .phy = {
+ .cap =
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_LE80 |
+ IEEE80211_UHR_PHY_CAP_ELR_RX |
+ IEEE80211_UHR_PHY_CAP_ELR_TX,
+ },
+ },
},
{
.types_mask = BIT(NL80211_IFTYPE_AP) |
@@ -4586,6 +4623,48 @@ static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
},
/* PPE threshold information is not supported */
},
+ .uhr_cap = {
+ .has_uhr = true,
+ .mac = {
+ .mac_cap[0] =
+ IEEE80211_UHR_MAC_CAP0_DPS_SUPP |
+ IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP |
+ IEEE80211_UHR_MAC_CAP0_NPCA_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ENH_BSR_SUPP |
+ IEEE80211_UHR_MAC_CAP0_EOTSP_SUPP,
+ .mac_cap[1] =
+ IEEE80211_UHR_MAC_CAP1_DSO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PEDCA_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DBE_SUPP |
+ IEEE80211_UHR_MAC_CAP1_UL_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_P2P_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_AP_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DUO_SUPP,
+ .mac_cap[2] =
+ IEEE80211_UHR_MAC_CAP2_OMC_UL_MU_DIS_RX_SUPP |
+ IEEE80211_UHR_MAC_CAP2_AOM_SUPP |
+ IEEE80211_UHR_MAC_CAP2_IFCS_LOC_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXSPG_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXOP_RET_IN_TXSPG |
+ IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW,
+ .mac_cap[3] =
+ IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH |
+ IEEE80211_UHR_MAC_CAP3_PARAM_UPD_ADV_NOTIF_INTV |
+ IEEE80211_UHR_MAC_CAP3_UPD_IND_TIM_INTV_LOW,
+ .mac_cap[4] =
+ IEEE80211_UHR_MAC_CAP4_UPD_IND_TIM_INTV_HIGH |
+ IEEE80211_UHR_MAC_CAP4_BOUNDED_ESS |
+ IEEE80211_UHR_MAC_CAP4_BTM_ASSURANCE |
+ IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP,
+ },
+ .phy = {
+ .cap =
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 |
+ IEEE80211_UHR_PHY_CAP_ELR_RX |
+ IEEE80211_UHR_PHY_CAP_ELR_TX,
+ },
+ },
},
#ifdef CONFIG_MAC80211_MESH
{
@@ -4755,6 +4834,45 @@ static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
},
/* PPE threshold information is not supported */
},
+ .uhr_cap = {
+ .has_uhr = true,
+ .mac = {
+ .mac_cap[0] =
+ IEEE80211_UHR_MAC_CAP0_DPS_SUPP |
+ IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP |
+ IEEE80211_UHR_MAC_CAP0_NPCA_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ENH_BSR_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ADD_MAP_TID_SUPP |
+ IEEE80211_UHR_MAC_CAP0_EOTSP_SUPP,
+ .mac_cap[1] =
+ IEEE80211_UHR_MAC_CAP1_DSO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PEDCA_SUPP |
+ IEEE80211_UHR_MAC_CAP1_UL_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_P2P_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DUO_SUPP,
+ .mac_cap[2] =
+ IEEE80211_UHR_MAC_CAP2_AOM_SUPP |
+ IEEE80211_UHR_MAC_CAP2_IFCS_LOC_SUPP |
+ IEEE80211_UHR_MAC_CAP2_UHR_TRS_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXSPG_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXOP_RET_IN_TXSPG |
+ IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW,
+ .mac_cap[3] =
+ IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH,
+ .mac_cap[4] =
+ IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP,
+ },
+ .phy = {
+ .cap =
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_LE80 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_160 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_160 |
+ IEEE80211_UHR_PHY_CAP_ELR_RX |
+ IEEE80211_UHR_PHY_CAP_ELR_TX,
+ },
+ },
},
{
.types_mask = BIT(NL80211_IFTYPE_AP) |
@@ -4880,6 +4998,49 @@ static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
},
/* PPE threshold information is not supported */
},
+ .uhr_cap = {
+ .has_uhr = true,
+ .mac = {
+ .mac_cap[0] =
+ IEEE80211_UHR_MAC_CAP0_DPS_SUPP |
+ IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP |
+ IEEE80211_UHR_MAC_CAP0_NPCA_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ENH_BSR_SUPP |
+ IEEE80211_UHR_MAC_CAP0_EOTSP_SUPP,
+ .mac_cap[1] =
+ IEEE80211_UHR_MAC_CAP1_DSO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PEDCA_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DBE_SUPP |
+ IEEE80211_UHR_MAC_CAP1_UL_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_P2P_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_AP_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DUO_SUPP,
+ .mac_cap[2] =
+ IEEE80211_UHR_MAC_CAP2_OMC_UL_MU_DIS_RX_SUPP |
+ IEEE80211_UHR_MAC_CAP2_AOM_SUPP |
+ IEEE80211_UHR_MAC_CAP2_IFCS_LOC_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXSPG_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXOP_RET_IN_TXSPG |
+ IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW,
+ .mac_cap[3] =
+ IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH |
+ IEEE80211_UHR_MAC_CAP3_PARAM_UPD_ADV_NOTIF_INTV |
+ IEEE80211_UHR_MAC_CAP3_UPD_IND_TIM_INTV_LOW,
+ .mac_cap[4] =
+ IEEE80211_UHR_MAC_CAP4_UPD_IND_TIM_INTV_HIGH |
+ IEEE80211_UHR_MAC_CAP4_BOUNDED_ESS |
+ IEEE80211_UHR_MAC_CAP4_BTM_ASSURANCE |
+ IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP,
+ },
+ .phy = {
+ .cap =
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_160 |
+ IEEE80211_UHR_PHY_CAP_ELR_RX |
+ IEEE80211_UHR_PHY_CAP_ELR_TX,
+ },
+ },
},
#ifdef CONFIG_MAC80211_MESH
{
@@ -5073,6 +5234,47 @@ static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
},
/* PPE threshold information is not supported */
},
+ .uhr_cap = {
+ .has_uhr = true,
+ .mac = {
+ .mac_cap[0] =
+ IEEE80211_UHR_MAC_CAP0_DPS_SUPP |
+ IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP |
+ IEEE80211_UHR_MAC_CAP0_NPCA_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ENH_BSR_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ADD_MAP_TID_SUPP |
+ IEEE80211_UHR_MAC_CAP0_EOTSP_SUPP,
+ .mac_cap[1] =
+ IEEE80211_UHR_MAC_CAP1_DSO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PEDCA_SUPP |
+ IEEE80211_UHR_MAC_CAP1_UL_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_P2P_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DUO_SUPP,
+ .mac_cap[2] =
+ IEEE80211_UHR_MAC_CAP2_AOM_SUPP |
+ IEEE80211_UHR_MAC_CAP2_IFCS_LOC_SUPP |
+ IEEE80211_UHR_MAC_CAP2_UHR_TRS_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXSPG_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXOP_RET_IN_TXSPG |
+ IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW,
+ .mac_cap[3] =
+ IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH,
+ .mac_cap[4] =
+ IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP,
+ },
+ .phy = {
+ .cap =
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_LE80 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_160 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_160 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_320 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_320 |
+ IEEE80211_UHR_PHY_CAP_ELR_RX |
+ IEEE80211_UHR_PHY_CAP_ELR_TX,
+ },
+ },
},
{
.types_mask = BIT(NL80211_IFTYPE_AP) |
@@ -5219,6 +5421,50 @@ static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
},
/* PPE threshold information is not supported */
},
+ .uhr_cap = {
+ .has_uhr = true,
+ .mac = {
+ .mac_cap[0] =
+ IEEE80211_UHR_MAC_CAP0_DPS_SUPP |
+ IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP |
+ IEEE80211_UHR_MAC_CAP0_NPCA_SUPP |
+ IEEE80211_UHR_MAC_CAP0_ENH_BSR_SUPP |
+ IEEE80211_UHR_MAC_CAP0_EOTSP_SUPP,
+ .mac_cap[1] =
+ IEEE80211_UHR_MAC_CAP1_DSO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PEDCA_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DBE_SUPP |
+ IEEE80211_UHR_MAC_CAP1_UL_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_P2P_LLI_SUPP |
+ IEEE80211_UHR_MAC_CAP1_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_AP_PUO_SUPP |
+ IEEE80211_UHR_MAC_CAP1_DUO_SUPP,
+ .mac_cap[2] =
+ IEEE80211_UHR_MAC_CAP2_OMC_UL_MU_DIS_RX_SUPP |
+ IEEE80211_UHR_MAC_CAP2_AOM_SUPP |
+ IEEE80211_UHR_MAC_CAP2_IFCS_LOC_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXSPG_SUPP |
+ IEEE80211_UHR_MAC_CAP2_TXOP_RET_IN_TXSPG |
+ IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW,
+ .mac_cap[3] =
+ IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH |
+ IEEE80211_UHR_MAC_CAP3_PARAM_UPD_ADV_NOTIF_INTV |
+ IEEE80211_UHR_MAC_CAP3_UPD_IND_TIM_INTV_LOW,
+ .mac_cap[4] =
+ IEEE80211_UHR_MAC_CAP4_UPD_IND_TIM_INTV_HIGH |
+ IEEE80211_UHR_MAC_CAP4_BOUNDED_ESS |
+ IEEE80211_UHR_MAC_CAP4_BTM_ASSURANCE |
+ IEEE80211_UHR_MAC_CAP4_CO_BF_SUPP,
+ },
+ .phy = {
+ .cap =
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_160 |
+ IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_320 |
+ IEEE80211_UHR_PHY_CAP_ELR_RX |
+ IEEE80211_UHR_PHY_CAP_ELR_TX,
+ },
+ },
},
#ifdef CONFIG_MAC80211_MESH
{
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v5 00/02] wifi: ieee80211/mac80211: Add UHR (802.11bn) Capability and Operation parsing helpers
From: Karthikeyan Kathirvel @ 2026-03-04 8:53 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, ath12k, Karthikeyan Kathirvel
This series covers support for UHR capability and operation (11bn)
parsing helpers for DPS/DBE/P-EDCA, and adds mac80211 hwsim changes.
The code changes are based on the IEEE 802.11bn Draft P802.11bn/D1.3.
There may be changes in the code to adopt upcoming 11bn spec changes.
Karthikeyan Kathirvel (2):
wifi: UHR: define DPS/DBE/P-EDCA elements and fix size parsing
wifi: mac80211_hwsim: Add UHR capabilities to the driver
drivers/net/wireless/virtual/mac80211_hwsim.c | 246 ++++++++++++++++
include/linux/ieee80211-uhr.h | 271 +++++++++++++++++-
2 files changed, 511 insertions(+), 6 deletions(-)
---
v5:
- Addressed Johannes's comments
- Modified hwsim UHR MAC and PHY Caps as per spec
v4:
- Addressed Pablo's comment on mac80211_hwsim
v3:
- Addressed Johannes's comments
- Removed reserved macros and unwanted
IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP
v2:
- Rebased the changes on top of Johannes's initial UHR commits
---
base-commit: 0314e382cf02983eb3c33ac537ad9701e7858bc9
--
2.34.1
^ permalink raw reply
* [PATCH wireless-next v5 1/2] wifi: UHR: define DPS/DBE/P-EDCA elements and fix size parsing
From: Karthikeyan Kathirvel @ 2026-03-04 8:53 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, ath12k, Karthikeyan Kathirvel
In-Reply-To: <20260304085343.1093993-1-karthikeyan.kathirvel@oss.qualcomm.com>
Add UHR Operation and Capability definitions and parsing helpers:
- Define ieee80211_uhr_dps_info, ieee80211_uhr_dbe_info,
ieee80211_uhr_p_edca_info with masks.
- Update ieee80211_uhr_oper_size_ok() to account for optional
DPS/DBE/P-EDCA blocks.
- Move NPCA pointer position after DPS Operation Parameter if it is
present in ieee80211_uhr_oper_size_ok().
- Move NPCA pointer position after DPS info if it is present in
ieee80211_uhr_npca_info().
Signed-off-by: Karthikeyan Kathirvel <karthikeyan.kathirvel@oss.qualcomm.com>
---
include/linux/ieee80211-uhr.h | 271 +++++++++++++++++++++++++++++++++-
1 file changed, 265 insertions(+), 6 deletions(-)
diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h
index 132acced7d79..982960734ef8 100644
--- a/include/linux/ieee80211-uhr.h
+++ b/include/linux/ieee80211-uhr.h
@@ -29,11 +29,216 @@ struct ieee80211_uhr_operation {
#define IEEE80211_UHR_NPCA_PARAMS_MOPLEN 0x00400000
#define IEEE80211_UHR_NPCA_PARAMS_DIS_SUBCH_BMAP_PRES 0x00800000
+/**
+ * struct ieee80211_uhr_npca_info - npca operation information
+ *
+ * This structure is the "NPCA Operation Parameters field format" of "UHR
+ * Operation Element" fields as described in P802.11bn_D1.3
+ * subclause 9.4.2.353. See Figure 9-aa4.
+ *
+ * Refer to IEEE80211_UHR_NPCA*
+ * @params:
+ * NPCA Primary Channel - NPCA primary channel
+ * NPCA_Min Duration Threshold - Minimum duration of inter-BSS activity
+ * NPCA Switching Delay -
+ * Time needed by an NPCA AP to switch from the
+ * BSS primary channel to the NPCA primary channel
+ * in the unit of 4 µs.
+ * NPCA Switching Back Delay -
+ * Time to switch from the NPCA primary channel
+ * to the BSS primary channel in the unit of 4 µs.
+ * NPCA Initial QSRC -
+ * Initialize the EDCAF QSRC[AC] variables
+ * when an NPCA STA in the BSS
+ * switches to NPCA operation.
+ * NPCA MOPLEN -
+ * Indicates which conditions can be used to
+ * initiate an NPCA operation,
+ * 1 -> both PHYLEN NPCA operation and MOPLEN
+ * NPCA operation are
+ * permitted in the BSS
+ * 0 -> only PHYLEN NPCA operation is allowed in the BSS.
+ * NPCA Disabled Subchannel Bitmap Present -
+ * Indicates whether the NPCA Disabled Subchannel
+ * Bitmap field is present. A 1 in this field indicates that
+ * the NPCA Disabled Subchannel Bitmap field is present
+ * @dis_subch_bmap:
+ * A bit in the bitmap that lies within the BSS bandwidth is set
+ * to 1 to indicate that the corresponding 20 MHz subchannel is
+ * punctured and is set to 0 to indicate that the corresponding
+ * 20 MHz subchannel is not punctured. A bit in the bitmap that
+ * falls outside of the BSS bandwidth is reserved. This field is
+ * present when the value of the NPCA Disabled Subchannel Bitmap
+ * Field Present field is equal to 1, and not present, otherwise
+ */
struct ieee80211_uhr_npca_info {
__le32 params;
__le16 dis_subch_bmap[];
} __packed;
+#define IEEE80211_UHR_DPS_PADDING_DELAY 0x0000003F
+#define IEEE80211_UHR_DPS_TRANSITION_DELAY 0x00003F00
+#define IEEE80211_UHR_DPS_ICF_REQUIRED 0x00010000
+#define IEEE80211_UHR_DPS_PARAMETERIZED_FLAG 0x00020000
+#define IEEE80211_UHR_DPS_LC_MODE_BW 0x001C0000
+#define IEEE80211_UHR_DPS_LC_MODE_NSS 0x01E00000
+#define IEEE80211_UHR_DPS_LC_MODE_MCS 0x1E000000
+#define IEEE80211_UHR_DPS_MOBILE_AP_DPS_STATIC_HCM 0x20000000
+
+/**
+ * struct ieee80211_uhr_dps_info - DPS operation information
+ *
+ * This structure is the "DPS Operation Parameter field" of "UHR
+ * Operation Element" fields as described in P802.11bn_D1.3
+ * subclause 9.4.1.87. See Figure 9-207u.
+ *
+ * Refer to IEEE80211_UHR_DPS*
+ * @params:
+ * DPS Padding Delay -
+ * Indicates the minimum MAC padding
+ * duration that is required by a DPS STA
+ * in an ICF to cause the STA to transition
+ * from the lower capability mode to the
+ * higher capability mode. The DPS Padding
+ * Delay field is in units of 4 µs.
+ * DPS Transition Delay -
+ * Indicates the amount of time required by a
+ * DPS STA to transition from the higher
+ * capability mode to the lower capability
+ * mode. The DPS Transition Delay field is in
+ * units of 4 µs.
+ * ICF Required -
+ * Indicates when the DPS assisting STA needs
+ * to transmit an ICF frame to the peer DPS STA
+ * before performing the frame exchanges with
+ * the peer DPS STA in a TXOP.
+ * 1 -> indicates that the transmission of the
+ * ICF frame to the peer DPS STA prior to
+ * any frame exchange is needed.
+ * 0 -> ICF transmission before the frame
+ * exchanges with the peer DPS STA is only
+ * needed if the frame exchange is performed
+ * in the HC mode.
+ * Parameterized Flag -
+ * 0 -> indicate that only 20 MHz, 1 SS,
+ * non-HT PPDU format with the data
+ * rate of 6, 12, and 24 Mb/s as the
+ * default mode are supported by the
+ * DPS STA in the LC mode
+ * 1 -> indicate that a bandwidth up to the
+ * bandwidth indicated in the LC Mode
+ * Bandwidth field, a number of spatial
+ * streams up to the NSS indicated in
+ * the LC Mode Nss field, and an MCS up
+ * to the MCS indicated in the LC Mode
+ * MCS fields are supported by the DPS
+ * STA in the LC mode as the
+ * parameterized mode.
+ * LC Mode Bandwidth -
+ * Indicates the maximum bandwidth supported
+ * by the STA in the LC mode.
+ * LC Mode NSS -
+ * Indicates the maximum number of the spatial
+ * streams supported by the STA in the LC mode.
+ * LC Mode MCS -
+ * Indicates the highest MCS supported by the STA
+ * in the LC mode.
+ * Mobile AP DPS Static HCM -
+ * 1 -> indicate that it will remain in the DPS high
+ * capability mode until the next TBTT on that
+ * link.
+ * 0 -> otherwise.
+ */
+struct ieee80211_uhr_dps_info {
+ __le32 params;
+} __packed;
+
+#define IEEE80211_UHR_DBE_OPER_BANDWIDTH 0x07
+#define IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES 0x08
+
+/**
+ * enum ieee80211_uhr_dbe_oper_bw - DBE Operational Bandwidth
+ *
+ * Encoding for the DBE Operational Bandwidth field in the UHR Operation
+ * element (DBE Operation Parameters).
+ *
+ * @IEEE80211_UHR_DBE_OPER_BW_40: 40 MHz operational DBE bandwidth
+ * @IEEE80211_UHR_DBE_OPER_BW_80: 80 MHz operational DBE bandwidth
+ * @IEEE80211_UHR_DBE_OPER_BW_160: 160 MHz operational DBE bandwidth
+ * @IEEE80211_UHR_DBE_OPER_BW_320_1: 320-1 MHz operational DBE bandwidth
+ * @IEEE80211_UHR_DBE_OPER_BW_320_2: 320-2 MHz operational DBE bandwidth
+ */
+enum ieee80211_uhr_dbe_oper_bw {
+ IEEE80211_UHR_DBE_OPER_BW_40 = 1,
+ IEEE80211_UHR_DBE_OPER_BW_80 = 2,
+ IEEE80211_UHR_DBE_OPER_BW_160 = 3,
+ IEEE80211_UHR_DBE_OPER_BW_320_1 = 4,
+ IEEE80211_UHR_DBE_OPER_BW_320_2 = 5,
+};
+
+/**
+ * struct ieee80211_uhr_dbe_info - DBE operation information
+ *
+ * This structure is the "DBE Operation Parameters field" of
+ * "UHR Operation Element" fields as described in P802.11bn_D1.3
+ * subclause 9.4.2.353. See Figure 9-aa6.
+ *
+ * Refer to IEEE80211_UHR_DBE_OPER*
+ * @params:
+ * B0-B2 - DBE Operational Bandwidth field, see
+ * "enum ieee80211_uhr_dbe_oper_bw" for values.
+ * Value 0 is reserved.
+ * Value 1 indicates 40 MHz operational DBE bandwidth.
+ * Value 2 indicates 80 MHz operational DBE bandwidth.
+ * Value 3 indicates 160 MHz operational DBE bandwidth.
+ * Value 4 indicates 320-1 MHz operational DBE bandwidth.
+ * Value 5 indicates 320-2 MHz operational DBE bandwidth.
+ * Values 6 to 7 are reserved.
+ * B3 - DBE Disabled Subchannel Bitmap Present.
+ * @dis_subch_bmap: DBE Disabled Subchannel Bitmap field is set to indicate
+ * disabled 20 MHz subchannels within the DBE Bandwidth.
+ */
+struct ieee80211_uhr_dbe_info {
+ u8 params;
+ __le16 dis_subch_bmap[];
+} __packed;
+
+#define IEEE80211_UHR_P_EDCA_ECWMIN 0x0F
+#define IEEE80211_UHR_P_EDCA_ECWMAX 0xF0
+#define IEEE80211_UHR_P_EDCA_AIFSN 0x000F
+#define IEEE80211_UHR_P_EDCA_CW_DS 0x0030
+#define IEEE80211_UHR_P_EDCA_PSRC_THRESHOLD 0x01C0
+#define IEEE80211_UHR_P_EDCA_QSRC_THRESHOLD 0x0600
+
+/**
+ * struct ieee80211_uhr_p_edca_info - P-EDCA operation information
+ *
+ * This structure is the "P-EDCA Operation Parameters field" of
+ * "UHR Operation Element" fields as described in P802.11bn_D1.3
+ * subclause 9.4.2.353. See Figure 9-aa5.
+ *
+ * Refer to IEEE80211_UHR_P_EDCA*
+ * @p_edca_ec: P-EDCA ECWmin and ECWmax.
+ * These fields indicate the CWmin and CWmax values used by a
+ * P-EDCA STA during P-EDCA contention.
+ * @params: AIFSN, CW DS, PSRC threshold, and QSRC threshold.
+ * - The AIFSN field indicates the AIFSN value used by a P-EDCA STA
+ * during P-EDCA contention.
+ * - The CW DS field indicates the value used for randomization of the
+ * transmission slot of the DS-CTS frame. The value 3 is reserved.
+ * The value 0 indicates that randomization is not enabled.
+ * - The P-EDCA PSRC threshold field indicates the maximum number of
+ * allowed consecutive DS-CTS transmissions. The value 0 and values
+ * greater than 4 are reserved.
+ * - The P-EDCA QSRC threshold field indicates the value of the
+ * QSRC[AC_VO] counter required to start P-EDCA contention. The
+ * value 0 is reserved.
+ */
+struct ieee80211_uhr_p_edca_info {
+ u8 p_edca_ec;
+ __le16 params;
+} __packed;
+
static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,
bool beacon)
{
@@ -47,19 +252,52 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,
if (beacon)
return true;
- /* FIXME: DPS, DBE, P-EDCA (consider order, also relative to NPCA) */
+ /* DPS Operation Parameters (fixed 4 bytes) */
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA)) {
+ needed += sizeof(struct ieee80211_uhr_dps_info);
+ if (len < needed)
+ return false;
+ }
+ /* NPCA Operation Parameters (fixed 4 bytes + optional 2 bytes) */
if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)) {
const struct ieee80211_uhr_npca_info *npca =
- (const void *)oper->variable;
+ (const void *)(data + needed);
needed += sizeof(*npca);
-
if (len < needed)
return false;
- if (npca->params & cpu_to_le32(IEEE80211_UHR_NPCA_PARAMS_DIS_SUBCH_BMAP_PRES))
+ if (npca->params &
+ cpu_to_le32(IEEE80211_UHR_NPCA_PARAMS_DIS_SUBCH_BMAP_PRES)) {
needed += sizeof(npca->dis_subch_bmap[0]);
+ if (len < needed)
+ return false;
+ }
+ }
+
+ /* P-EDCA Operation Parameters (fixed 3 bytes) */
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA)) {
+ needed += sizeof(struct ieee80211_uhr_p_edca_info);
+ if (len < needed)
+ return false;
+ }
+
+ /* DBE Operation Parameters (fixed 1 byte + optional 2 bytes) */
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_ENA)) {
+ const struct ieee80211_uhr_dbe_info *dbe =
+ (const void *)(data + needed);
+
+ needed += sizeof(*dbe);
+ if (len < needed)
+ return false;
+
+ if (dbe->params &
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES) {
+ needed += sizeof(dbe->dis_subch_bmap[0]);
+ if (len < needed)
+ return false;
+ }
}
return len >= needed;
@@ -72,12 +310,15 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,
static inline const struct ieee80211_uhr_npca_info *
ieee80211_uhr_npca_info(const struct ieee80211_uhr_operation *oper)
{
+ const u8 *pos = oper->variable;
+
if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)))
return NULL;
- /* FIXME: DPS */
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA))
+ pos += sizeof(struct ieee80211_uhr_dps_info);
- return (const void *)oper->variable;
+ return (const void *)pos;
}
static inline const __le16 *
@@ -131,6 +372,24 @@ ieee80211_uhr_npca_dis_subch_bitmap(const struct ieee80211_uhr_operation *oper)
#define IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_160_PRES 0x08
#define IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_320_PRES 0x10
+/**
+ * enum ieee80211_uhr_dbe_max_supported_bw - DBE Maximum Supported Bandwidth
+ *
+ * As per spec P802.11bn_D1.3 "Table 9-bb5—Encoding of the DBE Maximum
+ * Supported Bandwidth field".
+ *
+ * @IEEE80211_UHR_DBE_MAX_BW_40: Indicates 40 MHz DBE max supported bw
+ * @IEEE80211_UHR_DBE_MAX_BW_80: Indicates 80 MHz DBE max supported bw
+ * @IEEE80211_UHR_DBE_MAX_BW_160: Indicates 160 MHz DBE max supported bw
+ * @IEEE80211_UHR_DBE_MAX_BW_320: Indicates 320 MHz DBE max supported bw
+ */
+enum ieee80211_uhr_dbe_max_supported_bw {
+ IEEE80211_UHR_DBE_MAX_BW_40 = 1,
+ IEEE80211_UHR_DBE_MAX_BW_80 = 2,
+ IEEE80211_UHR_DBE_MAX_BW_160 = 3,
+ IEEE80211_UHR_DBE_MAX_BW_320 = 4,
+};
+
struct ieee80211_uhr_cap_mac {
u8 mac_cap[5];
} __packed;
--
2.34.1
^ permalink raw reply related
* Re: [RFC wireless-next 8/8] wifi: mac80211: set AP NPCA parameters in bss_conf
From: Johannes Berg @ 2026-03-04 7:45 UTC (permalink / raw)
To: Lachlan Hodges; +Cc: linux-wireless
In-Reply-To: <h6zaryfx46dg45gmysd4joxecawzkj256pu6uy2g2dbmzwpfxr@apaq4cud4rmg>
On Wed, 2026-03-04 at 13:56 +1100, Lachlan Hodges wrote:
> > + npca = ieee80211_uhr_npca_info(params->uhr_oper);
> > + if (!npca) {
> > + chanreq.oper.npca_chan = NULL;
> > + chanreq.oper.npca_punctured = 0;
> > + } else {
> > + npca_params.min_dur_thresh =
> > + le32_get_bits(npca->params,
> > + IEEE80211_UHR_NPCA_PARAMS_MIN_DUR_THRESH);
> > + npca_params.switch_delay =
> > + le32_get_bits(npca->params,
> > + IEEE80211_UHR_NPCA_PARAMS_SWITCH_DELAY);
> > + npca_params.switch_back_delay =
> > + le32_get_bits(npca->params,
> > + IEEE80211_UHR_NPCA_PARAMS_SWITCH_BACK_DELAY);
> > + npca_params.init_qsrc =
> > + le32_get_bits(npca->params,
> > + IEEE80211_UHR_NPCA_PARAMS_INIT_QSRC);
> > + npca_params.moplen =
> > + le32_get_bits(npca->params,
> > + IEEE80211_UHR_NPCA_PARAMS_MOPLEN);
> > + npca_params.enabled = true;
> > + }
>
> Minor nit, and I can't really comment on the actual UHR code - but would
> it be nicer to have
>
> if (npca) {
> npca_params.min_dur_thresh = ...
> ...
> } else {
> chanreq.oper.npca_chan = NULL;
> chanreq.oper.npca_punctured = 0;
> }
>
> instead? I have no strong feelings of course, I was just perusing and
> felt it was a bit strange to read.
Fair point. I had a few things slightly differently during development
(and the non-NPCA had some goto/return) and just never went back to re-
structure it entirely when I removed that wart.
johannes
^ permalink raw reply
* [PATCH wireless-next v2 16/16] wifi: mac80211_hwsim: Add support for extended FTM ranging
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
From: Kavita Kavita <kavita.kavita@oss.qualcomm.com>
Introduce support for continuous ranging and advanced timing parameters
in the FTM (Fine Timing Measurement) request, response, and capability
paths. This enables more flexible ranging scenarios with improved
control over measurement timing and session management.
Signed-off-by: Kavita Kavita <kavita.kavita@oss.qualcomm.com>
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 171 ++++++++++++++++++
1 file changed, 171 insertions(+)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 475918ee8132..12257797f29d 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -844,6 +844,18 @@ hwsim_ftm_result_policy[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1] = {
[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD] = { .type = NLA_U64 },
[NL80211_PMSR_FTM_RESP_ATTR_LCI] = { .type = NLA_STRING },
[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_STRING },
+ [NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR] = { .type = NLA_FLAG },
};
static const struct nla_policy
@@ -889,6 +901,16 @@ hwsim_ftm_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST] = NLA_POLICY_MAX(NLA_U8, 31),
[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
+ [NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER] = { .type = NLA_FLAG },
+ [NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_PREAMBLES] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_PREAMBLES] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT] = { .type = NLA_FLAG },
};
static const struct nla_policy
@@ -903,6 +925,15 @@ hwsim_pmsr_capa_policy[NL80211_PMSR_ATTR_MAX + 1] = {
[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_FLAG },
[NL80211_PMSR_ATTR_TYPE_CAPA] = NLA_POLICY_NESTED(hwsim_pmsr_capa_type_policy),
[NL80211_PMSR_ATTR_PEERS] = { .type = NLA_REJECT }, // only for request.
+ [NL80211_PMSR_ATTR_PD_SUPPORT] = { .type = NLA_FLAG },
+ [NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT] = {
+ .type = NLA_FLAG
+ },
+ [NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE] = { .type = NLA_U32 },
+ [NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE] = { .type = NLA_U32 },
+ [NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR_CONNECTED] = {
+ .type = NLA_FLAG
+ },
};
static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
@@ -3561,6 +3592,49 @@ static int mac80211_hwsim_send_pmsr_ftm_request_peer(struct sk_buff *msg,
if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, request->bss_color))
return -ENOBUFS;
+ if (request->min_time_between_measurements &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS,
+ request->min_time_between_measurements))
+ return -ENOBUFS;
+
+ if (request->max_time_between_measurements &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS,
+ request->max_time_between_measurements))
+ return -ENOBUFS;
+
+ if (request->availability_window &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
+ request->availability_window))
+ return -ENOBUFS;
+
+ if (request->nominal_time &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
+ request->nominal_time))
+ return -ENOBUFS;
+
+ if (request->measurements_per_aw &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
+ request->measurements_per_aw))
+ return -ENOBUFS;
+
+ if (request->ingress_distancemm &&
+ nla_put_u64_64bit(msg, NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
+ request->ingress_distancemm, NL80211_PMSR_FTM_REQ_ATTR_PAD))
+ return -ENOBUFS;
+
+ if (request->egress_distancemm &&
+ nla_put_u64_64bit(msg, NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
+ request->egress_distancemm, NL80211_PMSR_FTM_REQ_ATTR_PAD))
+ return -ENOBUFS;
+
+ if (request->range_report &&
+ nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT))
+ return -ENOBUFS;
+
+ if (request->pd_suppress_range_results &&
+ nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS))
+ return -ENOBUFS;
+
nla_nest_end(msg, ftm);
return 0;
@@ -3930,6 +4004,57 @@ static int mac80211_hwsim_parse_ftm_result(struct nlattr *ftm,
result->civicloc_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
}
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT])
+ result->tx_ltf_repetition_count =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT])
+ result->rx_ltf_repetition_count =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS])
+ result->max_time_between_measurements =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS])
+ result->min_time_between_measurements =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS])
+ result->num_tx_spatial_streams =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS])
+ result->num_rx_spatial_streams =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME])
+ result->nominal_time =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW])
+ result->availability_window =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW])
+ result->measurements_per_aw =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW]);
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH]) {
+ result->chan_width_valid = 1;
+ result->chan_width =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH]);
+ }
+
+ if (tb[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE]) {
+ result->preamble_valid = 1;
+ result->preamble =
+ nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE]);
+ }
+
+ result->is_delayed_lmr =
+ nla_get_flag(tb[NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR]);
+
return 0;
}
@@ -6431,6 +6556,41 @@ static int parse_ftm_capa(const struct nlattr *ftm_capa, struct cfg80211_pmsr_ca
out->ftm.request_civicloc = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC];
out->ftm.trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED];
out->ftm.non_trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED];
+ out->ftm.support_edca_responder = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER];
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS])
+ out->ftm.max_no_of_tx_antennas =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS]);
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS])
+ out->ftm.max_no_of_rx_antennas =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS]);
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA])
+ out->ftm.min_allowed_ranging_interval_edca =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA]);
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB])
+ out->ftm.min_allowed_ranging_interval_ntb =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB]);
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_PREAMBLES])
+ out->ftm.pd_edca_preambles =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_PREAMBLES]);
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_PREAMBLES])
+ out->ftm.pd_ntb_preambles =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_PREAMBLES]);
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS])
+ out->ftm.pd_edca_bandwidths =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS]);
+
+ if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS])
+ out->ftm.pd_ntb_bandwidths =
+ nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS]);
+
+ out->ftm.support_range_report = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT];
return 0;
}
@@ -6453,6 +6613,17 @@ static int parse_pmsr_capa(const struct nlattr *pmsr_capa, struct cfg80211_pmsr_
out->max_peers = nla_get_u32(tb[NL80211_PMSR_ATTR_MAX_PEERS]);
out->report_ap_tsf = !!tb[NL80211_PMSR_ATTR_REPORT_AP_TSF];
out->randomize_mac_addr = !!tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR];
+ out->pd_randomize_mac_addr_conn =
+ !!tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR];
+ out->pd_support = !!tb[NL80211_PMSR_ATTR_PD_SUPPORT];
+ out->pd_concurrent_ista_rsta_support =
+ !!tb[NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT];
+ if (tb[NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE])
+ out->pd_max_peer_ista_role =
+ nla_get_u32(tb[NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE]);
+ if (tb[NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE])
+ out->pd_max_peer_rsta_role =
+ nla_get_u32(tb[NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE]);
if (!tb[NL80211_PMSR_ATTR_TYPE_CAPA]) {
NL_SET_ERR_MSG_ATTR(info->extack, tb[NL80211_PMSR_ATTR_TYPE_CAPA],
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 15/16] wifi: cfg80211: add LTF keyseed support for secure ranging
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Introduce NL80211_KEY_LTF_SEED attribute to enable secure FTM
measurements with PHY-layer security. This allows drivers to generate
secure LTF keys for ranging operations, protecting against
eavesdropping and manipulation of ranging measurements.
Support the keyseed with trigger-based and non-trigger-based FTM
requests to enable secure peer measurement sessions. The keyseed must
be configured before initiating the measurement session to ensure
end-to-end security throughout the ranging operation.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 4 ++++
include/uapi/linux/nl80211.h | 16 +++++++++++++---
net/wireless/nl80211.c | 10 ++++++++++
3 files changed, 27 insertions(+), 3 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 6f7abb118a27..ac69cb200c0f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -830,6 +830,8 @@ struct vif_params {
* @seq_len: length of @seq.
* @vlan_id: vlan_id for VLAN group key (if nonzero)
* @mode: key install mode (RX_TX, NO_TX or SET_TX)
+ * @ltf_keyseed: LTF key seed material
+ * @ltf_keyseed_len: length of LTF key seed material
*/
struct key_params {
const u8 *key;
@@ -839,6 +841,8 @@ struct key_params {
u16 vlan_id;
u32 cipher;
enum nl80211_key_mode mode;
+ const u8 *ltf_keyseed;
+ size_t ltf_keyseed_len;
};
/**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 9c647c184e7f..0ae56bd66e7e 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -395,9 +395,10 @@
* %NL80211_ATTR_MLO_LINK_ID.
* @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
* %NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER,
- * and %NL80211_ATTR_KEY_SEQ attributes. %NL80211_ATTR_MAC represents
- * peer's MLD address for MLO pairwise key. The link to add MLO
- * group key is identified by %NL80211_ATTR_MLO_LINK_ID.
+ * %NL80211_ATTR_KEY_SEQ and %NL80211_KEY_LTF_SEED attributes.
+ * %NL80211_ATTR_MAC represents peer's MLD address for MLO pairwise key.
+ * The link to add MLO group key is identified by
+ * %NL80211_ATTR_MLO_LINK_ID.
* @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
* or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC represents peer's MLD address
* for MLO pairwise key. The link to delete group key is identified by
@@ -5602,6 +5603,14 @@ enum nl80211_key_default_types {
* @NL80211_KEY_MODE: the mode from enum nl80211_key_mode.
* Defaults to @NL80211_KEY_RX_TX.
* @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key
+ * @NL80211_KEY_LTF_SEED: LTF key seed is used by the driver to generate
+ * secure LTF keys used in case of peer measurement request with FTM
+ * request type as either %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED
+ * or %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED, secure LTF key seeds will
+ * help enable PHY security in peer measurement session. The corresponding
+ * keys need to be configured before hand to ensure peer measurement
+ * session is secure. Only valid if %NL80211_EXT_FEATURE_SECURE_LTF
+ * is set.
*
* @__NL80211_KEY_AFTER_LAST: internal
* @NL80211_KEY_MAX: highest key attribute
@@ -5618,6 +5627,7 @@ enum nl80211_key_attributes {
NL80211_KEY_DEFAULT_TYPES,
NL80211_KEY_MODE,
NL80211_KEY_DEFAULT_BEACON,
+ NL80211_KEY_LTF_SEED,
/* keep last */
__NL80211_KEY_AFTER_LAST,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 281a15226edb..68bf941122ae 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -983,6 +983,7 @@ static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
[NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
[NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
+ [NL80211_KEY_LTF_SEED] = { .type = NLA_BINARY, .len = 48 },
};
/* policy for the key default flags */
@@ -1459,6 +1460,7 @@ struct key_parse {
static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
struct key_parse *k)
{
+ struct cfg80211_registered_device *rdev = info->user_ptr[0];
struct nlattr *tb[NL80211_KEY_MAX + 1];
int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
nl80211_key_policy,
@@ -1514,6 +1516,14 @@ static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
if (tb[NL80211_KEY_MODE])
k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
+ if (tb[NL80211_KEY_LTF_SEED]) {
+ if (!wiphy_ext_feature_isset(&rdev->wiphy,
+ NL80211_EXT_FEATURE_SECURE_LTF))
+ return -EOPNOTSUPP;
+ k->p.ltf_keyseed = nla_data(tb[NL80211_KEY_LTF_SEED]);
+ k->p.ltf_keyseed_len = nla_len(tb[NL80211_KEY_LTF_SEED]);
+ }
+
return 0;
}
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 14/16] wifi: cfg80211: add MAC randomization support for PD requests
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Enable MAC address randomization for proximity detection requests to
maintain privacy throughout the entire PD session workflow. When
enabled, use the same randomized MAC address for discovery,
authentication, and ranging measurements, ensuring consistent identity
protection across all phases.
Add a capability flag for devices to advertise PD MAC randomization
support and validate that randomization is only requested when the
device supports it. This ensures consistent MAC address usage across
all phases of proximity detection while preventing invalid
configurations where randomization is requested but not supported by
hardware.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 7 ++++++-
include/uapi/linux/nl80211.h | 6 ++++++
net/wireless/nl80211.c | 8 ++++++++
net/wireless/pmsr.c | 10 ++++++++++
4 files changed, 30 insertions(+), 1 deletion(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8dc2ccafb88b..6f7abb118a27 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5794,6 +5794,10 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
* multi-peer request this will indicate if the device can act
* simultaneously as initiator and a responder. Only valid if @pd_support
* is set.
+ * @pd_randomize_mac_addr_conn: flag attribute in capability indicating that MAC
+ * address randomization is supported in connected state for PD request.
+ * if capable the MAC address used for discovery, authentication will be
+ * used for ranging too. only valid if @pd_support is set
* @pd_max_peer_ista_role: Maximum number of peers allowed for a device
* operating in the ISTA role under proximity detection. Only valid if
* @pd_support is set. Sum of both @pd_max_peer_ista_role and
@@ -5861,7 +5865,8 @@ struct cfg80211_pmsr_capabilities {
u8 report_ap_tsf:1,
randomize_mac_addr:1,
pd_support:1,
- pd_concurrent_ista_rsta_support:1;
+ pd_concurrent_ista_rsta_support:1,
+ pd_randomize_mac_addr_conn:1;
u32 pd_max_peer_ista_role;
u32 pd_max_peer_rsta_role;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index cafa73280758..9c647c184e7f 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7855,6 +7855,11 @@ enum nl80211_peer_measurement_peer_attrs {
* %NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
* %NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
* max peers supported in case the request is of peer-to-peer PD type
+ * @NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR_CONNECTED: flag attribute in
+ * capability indicating that MAC address randomization is supported for
+ * PD request in connected state. if capable the MAC address used for
+ * discovery, authentication will be used for ranging too. only valid if
+ * %NL80211_PMSR_ATTR_PD_SUPPORT is set
*
* @NUM_NL80211_PMSR_ATTR: internal
* @NL80211_PMSR_ATTR_MAX: highest attribute number
@@ -7871,6 +7876,7 @@ enum nl80211_peer_measurement_attrs {
NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT,
NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE,
NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
+ NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR_CONNECTED,
/* keep last */
NUM_NL80211_PMSR_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 02e7c9f9b12f..281a15226edb 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -424,6 +424,9 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
},
[NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE] = { .type = NLA_REJECT },
[NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE] = { .type = NLA_REJECT },
+ [NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR_CONNECTED] = {
+ .type = NLA_REJECT
+ },
};
static const struct nla_policy
@@ -2481,6 +2484,11 @@ static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
nla_put_u32(msg, NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
cap->pd_max_peer_rsta_role))
return -ENOBUFS;
+
+ if (cap->pd_randomize_mac_addr_conn &&
+ nla_put_flag(msg,
+ NL80211_PMSR_ATTR_PD_RANDOMIZE_MAC_ADDR_CONNECTED))
+ return -ENOBUFS;
}
caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
if (!caps)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 2897876e45b2..b5e8af89c57e 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -383,6 +383,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
const struct cfg80211_pmsr_capabilities *capa;
struct cfg80211_pmsr_request *req;
struct nlattr *peers, *peer;
+ bool use_random_mac = false;
capa = rdev->wiphy.pmsr_capa;
@@ -429,6 +430,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
req->mac_addr_mask);
if (err)
goto out_err;
+ use_random_mac = true;
} else {
memcpy(req->mac_addr, wdev_address(wdev), ETH_ALEN);
eth_broadcast_addr(req->mac_addr_mask);
@@ -460,6 +462,14 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
err = -EINVAL;
goto out_err;
}
+
+ if (use_random_mac &&
+ !capa->pd_randomize_mac_addr_conn) {
+ NL_SET_ERR_MSG(info->extack,
+ "PD mac randomization not supported");
+ err = -EINVAL;
+ goto out_err;
+ }
}
}
}
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 13/16] wifi: cfg80211: add result reporting control for PD requests
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Proximity detection applications may not need detailed ranging
measurements for every request, yet currently receive all results
causing unnecessary data transfer, host wakeups, and processing
overhead. Currently, there is no mechanism for applications to
suppress result reporting when only proximity detection is needed.
Introduce optional result suppression control that drivers can use
to implement selective result reporting. Add a flag allowing
applications to disable ranging reports when only proximity detection
is needed, enabling drivers to reduce unnecessary data transfer and
host wakeups. This flag cannot be combined with range report or LMR
feedback requests in RSTA mode as these require result reporting.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 8 +++++++-
include/uapi/linux/nl80211.h | 7 +++++++
net/wireless/nl80211.c | 1 +
net/wireless/pmsr.c | 18 ++++++++++++++++++
4 files changed, 33 insertions(+), 1 deletion(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index e398a594082a..8dc2ccafb88b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4448,6 +4448,11 @@ struct cfg80211_pmsr_result {
* basis in this case.
* @range_report: negotiate for FTM range report. Only valid for
* EDCA based ranging.
+ * @pd_suppress_range_results: flag to suppress ranging results for PD
+ * requests. When set, ranging measurements are performed but results
+ * are not reported to userspace, regardless of ranging role or type.
+ * Only valid when @pd_request is set. Cannot be used with @range_report
+ * or @lmr_feedback as these require result reporting.
*
* See also nl80211 for the respective attribute documentation.
*/
@@ -4474,7 +4479,8 @@ struct cfg80211_pmsr_ftm_request_peer {
u32 measurements_per_aw;
u64 ingress_distancemm;
u64 egress_distancemm;
- u8 range_report:1;
+ u8 range_report:1,
+ pd_suppress_range_results:1;
};
/**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index a70dcb2aa111..cafa73280758 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -8082,6 +8082,12 @@ enum nl80211_peer_measurement_ftm_capa {
* (units mm, u64)
* @NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT: Negotiate Range report in case of
* EDCA based ranging (flag).
+ * @NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS: Flag to suppress ranging
+ * results for PD requests. When set, ranging measurements are performed
+ * but results are not reported to userspace, regardless of ranging role
+ * or type. Only valid when %NL80211_PMSR_PEER_ATTR_PD_REQUEST is set.
+ * Cannot be used with %NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT or
+ * %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK as these require result reporting.
*
* @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
* @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -8112,6 +8118,7 @@ enum nl80211_peer_measurement_ftm_req {
NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT,
+ NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS,
/* keep last */
NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ea46c5e215ba..02e7c9f9b12f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -384,6 +384,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
[NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },
[NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },
[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT] = { .type = NLA_FLAG },
+ [NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS] = { .type = NLA_FLAG },
};
static const struct nla_policy
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 2b3d7d260e35..2897876e45b2 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -268,6 +268,24 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
return -EINVAL;
}
+ out->ftm.pd_suppress_range_results =
+ nla_get_flag(tb[NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS]);
+
+ if (!out->pd_request && out->ftm.pd_suppress_range_results) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ tb[NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS],
+ "FTM: suppress range result flag only valid for PD requests");
+ return -EINVAL;
+ }
+
+ if (out->ftm.pd_suppress_range_results && out->ftm.rsta &&
+ (out->ftm.range_report || out->ftm.lmr_feedback)) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ tb[NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS],
+ "FTM: cannot report with suppressed results");
+ return -EINVAL;
+ }
+
return 0;
}
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 12/16] wifi: cfg80211: add FTM range report negotiation support
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Non-trigger based and trigger-based ranging use Location Measurement
Report for result exchange. EDCA-based ranging lacks an equivalent
mechanism to negotiate whether range measurement reports should be
exchanged after the FTM session.
Introduce FTM range report negotiation for EDCA-based ranging as
specified in "Proximity Ranging (PR) Implementation Consideration
Draft 1.9 Rev 1, section 5.2.2". Add a capability flag and request
attribute allowing devices to advertise support and applications
to request range reports for EDCA sessions.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 8 +++++++-
include/uapi/linux/nl80211.h | 6 ++++++
net/wireless/nl80211.c | 4 ++++
net/wireless/pmsr.c | 18 ++++++++++++++++++
4 files changed, 35 insertions(+), 1 deletion(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 61651ecc3c9d..e398a594082a 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4446,6 +4446,8 @@ struct cfg80211_pmsr_result {
* to be indicated in case the device moves out of this range.
* (units mm, u64). measurement results need to be sent on a burst index
* basis in this case.
+ * @range_report: negotiate for FTM range report. Only valid for
+ * EDCA based ranging.
*
* See also nl80211 for the respective attribute documentation.
*/
@@ -4472,6 +4474,7 @@ struct cfg80211_pmsr_ftm_request_peer {
u32 measurements_per_aw;
u64 ingress_distancemm;
u64 egress_distancemm;
+ u8 range_report:1;
};
/**
@@ -5832,6 +5835,8 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
* @ftm.support_rsta: supports operating as RSTA in PMSR FTM request
* @ftm.support_edca_responder: supports operating as FTM responder in PMSR FTM
* request for EDCA-based ranging
+ * @ftm.support_range_report: capable of negotiating for FTM range report. Only
+ * valid for EDCA based ranging.
* @ftm.pd_edca_preambles: bitmap of preambles supported
* (&enum nl80211_preamble) in case of PD request with EDCA based
* initiator or responder role. ignored if @pd_support is not set.
@@ -5878,7 +5883,8 @@ struct cfg80211_pmsr_capabilities {
u32 min_allowed_ranging_interval_edca;
u32 min_allowed_ranging_interval_ntb;
u8 support_rsta:1,
- support_edca_responder:1;
+ support_edca_responder:1,
+ support_range_report:1;
u32 pd_edca_preambles;
u32 pd_ntb_preambles;
u32 pd_edca_bandwidths;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index f064d6a260fb..a70dcb2aa111 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7960,6 +7960,8 @@ enum nl80211_peer_measurement_attrs {
* Note that a higher channel bandwidth may be configured to allow for
* other measurements types with different bandwidth requirement in the
* same measurement.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT: flag indicating if range report
+ * negotiation and reporting is supported in case of EDCA based ranging.
*
* @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal
* @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number
@@ -7994,6 +7996,7 @@ enum nl80211_peer_measurement_ftm_capa {
NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_PREAMBLES,
NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS,
NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
+ NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT,
/* keep last */
NUM_NL80211_PMSR_FTM_CAPA_ATTR,
@@ -8077,6 +8080,8 @@ enum nl80211_peer_measurement_ftm_capa {
* @NL80211_PMSR_FTM_REQ_ATTR_EGRESS: the measurement result of the peer needs
* to be indicated in case the device moves out of this range.
* (units mm, u64)
+ * @NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT: Negotiate Range report in case of
+ * EDCA based ranging (flag).
*
* @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
* @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -8106,6 +8111,7 @@ enum nl80211_peer_measurement_ftm_req {
NL80211_PMSR_FTM_REQ_ATTR_PAD,
NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
+ NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT,
/* keep last */
NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1deedb1c6c50..ea46c5e215ba 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -383,6 +383,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW] = NLA_POLICY_MAX(NLA_U32, 4),
[NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },
[NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },
+ [NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT] = { .type = NLA_FLAG },
};
static const struct nla_policy
@@ -2424,6 +2425,9 @@ nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
cap->ftm.pd_ntb_bandwidths))
return -ENOBUFS;
+ if (cap->ftm.support_range_report &&
+ nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_RANGE_REPORT))
+ return -ENOBUFS;
nla_nest_end(msg, ftm);
return 0;
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index c4c027fc0b63..2b3d7d260e35 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -250,6 +250,24 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
out->ftm.egress_distancemm =
nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS]);
+ out->ftm.range_report =
+ nla_get_flag(tb[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT]);
+
+ if (!capa->ftm.support_range_report && out->ftm.range_report) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ tb[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT],
+ "FTM: Range report negotiation not supported");
+ return -EOPNOTSUPP;
+ }
+
+ if ((out->ftm.non_trigger_based || out->ftm.trigger_based) &&
+ out->ftm.range_report) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ tb[NL80211_PMSR_FTM_REQ_ATTR_RANGE_REPORT],
+ "FTM: Range report request is not valid for TB/NTB ranging");
+ return -EINVAL;
+ }
+
return 0;
}
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 11/16] wifi: cfg80211: add PD-specific preamble and bandwidth capabilities
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Some devices support different preamble and bandwidth configurations
for proximity detection (PD) versus standard ranging, but capabilities
currently report only a single set for all FTM measurements.
Introduce separate preamble and bandwidth capability reporting for PD
requests with EDCA and NTB-based ranging, allowing devices to advertise
different supported preambles and bandwidths for PD operations.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 16 ++++++++++++++++
include/uapi/linux/nl80211.h | 22 ++++++++++++++++++++++
net/wireless/nl80211.c | 12 ++++++++++++
net/wireless/pmsr.c | 21 +++++++++++++++++++--
4 files changed, 69 insertions(+), 2 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1b663627a0e6..61651ecc3c9d 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5832,6 +5832,18 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
* @ftm.support_rsta: supports operating as RSTA in PMSR FTM request
* @ftm.support_edca_responder: supports operating as FTM responder in PMSR FTM
* request for EDCA-based ranging
+ * @ftm.pd_edca_preambles: bitmap of preambles supported
+ * (&enum nl80211_preamble) in case of PD request with EDCA based
+ * initiator or responder role. ignored if @pd_support is not set.
+ * @ftm.pd_ntb_preambles: bitmap of preambles supported
+ * (&enum nl80211_preamble) in case of PD request with NTB based
+ * initiator or responder role. ignored if @pd_support is not set.
+ * @ftm.pd_edca_bandwidths: bitmap of bandwidths supported
+ * (&enum nl80211_chan_width) in case of PD request with EDCA based
+ * initiator or responder role. ignored if @pd_support is not set.
+ * @ftm.pd_ntb_bandwidths: bitmap of bandwidths supported
+ * (&enum nl80211_chan_width) in case of PD request with NTB based
+ * initiator or responder role. ignored if @pd_support is not set.
*/
struct cfg80211_pmsr_capabilities {
unsigned int max_peers;
@@ -5867,6 +5879,10 @@ struct cfg80211_pmsr_capabilities {
u32 min_allowed_ranging_interval_ntb;
u8 support_rsta:1,
support_edca_responder:1;
+ u32 pd_edca_preambles;
+ u32 pd_ntb_preambles;
+ u32 pd_edca_bandwidths;
+ u32 pd_ntb_bandwidths;
} ftm;
};
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 174592017486..f064d6a260fb 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7942,6 +7942,24 @@ enum nl80211_peer_measurement_attrs {
* @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB: u32 attribute indicating
* the minimum NTB ranging interval supported by the device
* in milli seconds. (0 means unknown)
+ * @NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_PREAMBLES: u32 bitmap of values from
+ * &enum nl80211_preamble indicating the supported preambles for FTM in
+ * case of PD based EDCA initiator or responder role.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_PREAMBLES: u32 bitmap of values from
+ * &enum nl80211_preamble indicating the supported preambles for FTM in
+ * case of PD based NTB initiator or responder role.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS: u32 bitmap of values from
+ * &enum nl80211_chan_width indicating the supported channel
+ * bandwidths for FTM in case of PD based EDCA initiator or responder role.
+ * Note that a higher channel bandwidth may be configured to allow for
+ * other measurements types with different bandwidth requirement in the
+ * same measurement.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS: u32 bitmap of values from
+ * &enum nl80211_chan_width indicating the supported channel
+ * bandwidths for FTM in case of PD based NTB initiator or responder role.
+ * Note that a higher channel bandwidth may be configured to allow for
+ * other measurements types with different bandwidth requirement in the
+ * same measurement.
*
* @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal
* @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number
@@ -7972,6 +7990,10 @@ enum nl80211_peer_measurement_ftm_capa {
NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS,
NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA,
NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
+ NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_PREAMBLES,
+ NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_PREAMBLES,
+ NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS,
+ NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
/* keep last */
NUM_NL80211_PMSR_FTM_CAPA_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e6969578f4f1..1deedb1c6c50 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2412,6 +2412,18 @@ nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
cap->ftm.min_allowed_ranging_interval_ntb))
return -ENOBUFS;
+ if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_PREAMBLES,
+ cap->ftm.pd_edca_preambles))
+ return -ENOBUFS;
+ if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_PREAMBLES,
+ cap->ftm.pd_ntb_preambles))
+ return -ENOBUFS;
+ if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_EDCA_BANDWIDTHS,
+ cap->ftm.pd_edca_bandwidths))
+ return -ENOBUFS;
+ if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PD_NTB_BANDWIDTHS,
+ cap->ftm.pd_ntb_bandwidths))
+ return -ENOBUFS;
nla_nest_end(msg, ftm);
return 0;
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index f2bbbf8eb6f2..c4c027fc0b63 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -17,11 +17,19 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
u32 preamble = NL80211_PREAMBLE_DMG; /* only optional in DMG */
/* validate existing data */
- if (!(rdev->wiphy.pmsr_capa->ftm.bandwidths & BIT(out->chandef.width))) {
+ if (!out->pd_request &&
+ !(rdev->wiphy.pmsr_capa->ftm.bandwidths & BIT(out->chandef.width))) {
NL_SET_ERR_MSG(info->extack, "FTM: unsupported bandwidth");
return -EINVAL;
}
+ if (out->pd_request &&
+ !(rdev->wiphy.pmsr_capa->ftm.pd_edca_bandwidths & BIT(out->chandef.width)) &&
+ !(rdev->wiphy.pmsr_capa->ftm.pd_ntb_bandwidths & BIT(out->chandef.width))) {
+ NL_SET_ERR_MSG(info->extack, "FTM: unsupported bandwidth for pd request");
+ return -EINVAL;
+ }
+
/* no validation needed - was already done via nested policy */
nla_parse_nested_deprecated(tb, NL80211_PMSR_FTM_REQ_ATTR_MAX, ftmreq,
NULL, NULL);
@@ -44,13 +52,22 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
}
}
- if (!(capa->ftm.preambles & BIT(preamble))) {
+ if (!out->pd_request && !(capa->ftm.preambles & BIT(preamble))) {
NL_SET_ERR_MSG_ATTR(info->extack,
tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE],
"FTM: invalid preamble");
return -EINVAL;
}
+ if (out->pd_request &&
+ !(capa->ftm.pd_ntb_preambles & BIT(preamble)) &&
+ !(capa->ftm.pd_edca_preambles & BIT(preamble))) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE],
+ "FTM: invalid preamble for PD request");
+ return -EINVAL;
+ }
+
out->ftm.preamble = preamble;
out->ftm.burst_period = 0;
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 10/16] wifi: cfg80211: add ingress/egress distance thresholds for FTM
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Proximity detection applications need to receive measurement results
only when devices cross specific distance boundaries to avoid
unnecessary host wakeups and reduce power consumption. Currently,
there is no mechanism for applications to specify these distance
thresholds.
Introduce configurable distance-based reporting thresholds that
drivers can use to implement selective result reporting. Add
ingress and egress distance parameters allowing applications to
specify when results should be reported as peers cross these
boundaries, enabling drivers to reduce unnecessary data transfer
and host wakeups.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 9 +++++++++
include/uapi/linux/nl80211.h | 9 +++++++++
net/wireless/nl80211.c | 2 ++
net/wireless/pmsr.c | 8 ++++++++
4 files changed, 28 insertions(+)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8bbca2a98ac1..1b663627a0e6 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4439,6 +4439,13 @@ struct cfg80211_pmsr_result {
* in units of milli seconds. Only valid if @non_trigger_based is set.
* @measurements_per_aw: number of measurement attempts per availability window
* with a maximum value of 4. Only valid if @non_trigger_based is set.
+ * @ingress_distancemm: the measurement result of the peer needs
+ * to be indicated in case the device moves into this range.(units mm, u64)
+ * measurement results need to be sent on a burst index basis in this case.
+ * @egress_distancemm: the measurement result of the peer needs
+ * to be indicated in case the device moves out of this range.
+ * (units mm, u64). measurement results need to be sent on a burst index
+ * basis in this case.
*
* See also nl80211 for the respective attribute documentation.
*/
@@ -4463,6 +4470,8 @@ struct cfg80211_pmsr_ftm_request_peer {
u32 availability_window;
u32 nominal_time;
u32 measurements_per_aw;
+ u64 ingress_distancemm;
+ u64 egress_distancemm;
};
/**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 83d2a822c770..174592017486 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -8049,6 +8049,12 @@ enum nl80211_peer_measurement_ftm_capa {
* @NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW: meas per AW field shall indicate the
* number of measurements attempts per AW with a maximum value of 4 (u32).
* Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_PAD: ignore, for u64/s64 padding only
+ * @NL80211_PMSR_FTM_REQ_ATTR_INGRESS: the measurement result of the peer needs
+ * to be indicated in case the device moves into this range.(units mm, u64)
+ * @NL80211_PMSR_FTM_REQ_ATTR_EGRESS: the measurement result of the peer needs
+ * to be indicated in case the device moves out of this range.
+ * (units mm, u64)
*
* @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
* @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -8075,6 +8081,9 @@ enum nl80211_peer_measurement_ftm_req {
NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
+ NL80211_PMSR_FTM_REQ_ATTR_PAD,
+ NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
+ NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
/* keep last */
NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5222ac8e8471..e6969578f4f1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -381,6 +381,8 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION] = NLA_POLICY_MAX(NLA_U32, 255),
[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW] = NLA_POLICY_MAX(NLA_U32, 4),
+ [NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },
+ [NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },
};
static const struct nla_policy
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 3ca0e589d7cc..f2bbbf8eb6f2 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -225,6 +225,14 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
return -EINVAL;
}
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS])
+ out->ftm.ingress_distancemm =
+ nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS]);
+
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS])
+ out->ftm.egress_distancemm =
+ nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS]);
+
return 0;
}
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox