[PATCH ath-next 0/3] wifi: ath11k: select the hardware mode

[PATCH ath-next 0/3] wifi: ath11k: select the hardware mode

[Julius Bairaktaris]

ath11k always takes the highest priority hardware mode the firmware
advertises. On the Zyxel NBG7815 (IPQ8074) that is DBS+SBS: three
radios, with the eight 5 GHz chains split between two radios and no
160 MHz. With Zyxel's own board data the firmware also advertises DBS,
which gives one 5 GHz radio with all eight chains and 160 MHz, the
layout Zyxel specifies for the board. There is no way to ask for it.

1/3 adds the range check on the firmware's mode IDs that ath12k has.
2/3 drops the regulatory events the firmware sends for phys outside the
selected mode; with DBS on the NBG7815 the event for phy 2 hit the
WARN_ON() in ath11k_reg_handle_chan_list() on every firmware start.
3/3 adds a hw_mode module parameter; without it nothing changes.

Tested 1/3 and 3/3 on a Xiaomi AX3600, whose firmware advertises only
DBS: no change without the parameter, and hw_mode=0, 4 and 7 warn with
the advertised modes (0x2) and keep DBS. Semih Baskan tested the series on an NBG7815
(modes 0x12): hw_mode=1 gives two radios, the 5 GHz one with eight
chains and a 160 MHz AP, without the warning from 2/3; no parameter and
hw_mode=4 give the three radios as before. Both tests ran on OpenWrt's
ath11k (Linux 6.18 with backports 7.2); on ath-next the series is
build-tested.

I used Claude (Anthropic) to help write these patches.

Julius Bairaktaris (2):
  wifi: ath11k: skip unknown hardware modes
  wifi: ath11k: add a module parameter to select the hardware mode

Semih Baskan (1):
  wifi: ath11k: ignore regulatory info of phys outside the hw mode

 drivers/net/wireless/ath/ath11k/core.c |  6 ++++++
 drivers/net/wireless/ath/ath11k/core.h |  1 +
 drivers/net/wireless/ath/ath11k/reg.c  | 14 +++++++++++++-
 drivers/net/wireless/ath/ath11k/wmi.c  | 25 ++++++++++++++++++++-----
 4 files changed, 40 insertions(+), 6 deletions(-)


base-commit: 2c50cd5d10e8723797f28c7978f1f61688e0c0d2
-- 
2.53.0

[PATCH ath-next 1/3] wifi: ath11k: skip unknown hardware modes

[Julius Bairaktaris]

ath11k_wmi_tlv_hw_mode_caps() indexes ath11k_hw_mode_pri_map[] with the
hw_mode_id the firmware reports, without a range check. A firmware or
board data file that reports a mode above WMI_HOST_HW_MODE_MAX reads
past the end of the array, and the result decides whether that mode
becomes the preferred one. Skip every mode from WMI_HOST_HW_MODE_MAX up,
as ath12k does since commit 1e9b1363e2de ("wifi: ath12k: avoid array
overflow of hw mode for preferred_hw_mode").

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 08fd6795ed9e7..b3c778eb15876 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -4776,17 +4776,19 @@ static int ath11k_wmi_tlv_hw_mode_caps(struct ath11k_base *soc,
 		return ret;
 	}
 
-	i = 0;
-	while (i < svc_rdy_ext->n_hw_mode_caps) {
+	for (i = 0; i < svc_rdy_ext->n_hw_mode_caps; i++) {
 		hw_mode_caps = &svc_rdy_ext->hw_mode_caps[i];
 		mode = hw_mode_caps->hw_mode_id;
+
+		if (mode >= WMI_HOST_HW_MODE_MAX)
+			continue;
+
 		pref = soc->wmi_ab.preferred_hw_mode;
 
 		if (ath11k_hw_mode_pri_map[mode] < ath11k_hw_mode_pri_map[pref]) {
 			svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps;
 			soc->wmi_ab.preferred_hw_mode = mode;
 		}
-		i++;
 	}
 
 	ath11k_dbg(soc, ATH11K_DBG_WMI, "preferred_hw_mode:%d\n",
-- 
2.53.0

[PATCH ath-next 2/3] wifi: ath11k: ignore regulatory info of phys outside the hw mode

[Julius Bairaktaris]

From: Semih Baskan <strst.gs@gmail.com>

The firmware sends a regulatory event for every phy it reports, also
for phys the selected hw mode does not use. On the Zyxel NBG7815
(IPQ8074) the firmware advertises DBS with phy_id_map 0x3 and DBS_SBS
with phy_id_map 0x7, and its events always carry num_phy 3. With DBS
selected num_radios is 2, so the event for phy 2 takes the fallback
path in ath11k_reg_handle_chan_list() and hits its WARN_ON(1) each time
the firmware starts:

  WARNING: CPU: 0 PID: 0 at drivers/net/wireless/ath/ath11k/reg.c:828 ath11k_reg_handle_chan_list+0x230/0x2e0 [ath11k]
  ath11k c000000.wifi: failed to process regulatory info -22

There is no radio to apply the rules of an unused phy to, so drop the
event, as the single_pdev_only case already does. A phy ID at or above
the num_phy of the event still goes to the fallback.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1

Signed-off-by: Semih Baskan <strst.gs@gmail.com>
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
 drivers/net/wireless/ath/ath11k/reg.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index 1030e119fd903..37be563d8de68 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -910,15 +910,27 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
 	if (pdev_idx >= ab->num_radios) {
 		/* Process the event for phy0 only if single_pdev_only
 		 * is true. If pdev_idx is valid but not 0, discard the
-		 * event. Otherwise, it goes to fallback. In either case
+		 * event. The firmware also sends the rules of phys that
+		 * the selected hw mode does not use, discard those too.
+		 * Otherwise, it goes to fallback. In either case
 		 * ath11k_reg_reset_info() needs to be called to avoid
 		 * memory leak issue.
 		 */
+		u8 num_phy = reg_info->num_phy;
+
 		ath11k_reg_reset_info(reg_info);
 
 		if (ab->hw_params.single_pdev_only &&
 		    pdev_idx < ab->hw_params.num_rxdma_per_pdev)
 			return 0;
+
+		if (pdev_idx < num_phy) {
+			ath11k_dbg(ab, ATH11K_DBG_REG,
+				   "ignoring regulatory info of unused phy %d\n",
+				   pdev_idx);
+			return 0;
+		}
+
 		goto fallback;
 	}
 
-- 
2.53.0

[PATCH ath-next 3/3] wifi: ath11k: add a module parameter to select the hardware mode

[Julius Bairaktaris]

ath11k always uses the highest priority hardware mode the firmware
advertises. On the Zyxel NBG7815 that is DBS+SBS, which splits the
eight 5 GHz chains between two radios, neither with a 160 MHz channel
width. The firmware also advertises DBS, which gives one 5 GHz radio
with all eight chains and 160 MHz. Add a hw_mode parameter that selects
any mode the firmware advertises; for a mode it does not advertise, warn
with the modes it does advertise and keep the default.

On the NBG7815, hw_mode=1 brings up the 8-chain 5 GHz radio. iperf3
from the router to a 2x2 HE client with 4 streams gave 1.22 and
1.20 Gbit/s at 160 MHz (two 20 s runs), against 886 Mbit/s at 80 MHz
with the unpatched driver (one run).

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1

Tested-by: Semih Baskan <strst.gs@gmail.com>
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
---
 drivers/net/wireless/ath/ath11k/core.c |  6 ++++++
 drivers/net/wireless/ath/ath11k/core.h |  1 +
 drivers/net/wireless/ath/ath11k/wmi.c  | 17 +++++++++++++++--
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
index 766ae27306f43..e1a6085a065a6 100644
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -38,6 +38,12 @@ bool ath11k_ftm_mode;
 module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
 MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
 
+/* hw mode values are mapped as per enum wmi_host_hw_mode_config_type */
+unsigned int ath11k_hw_mode = WMI_HOST_HW_MODE_MAX;
+module_param_named(hw_mode, ath11k_hw_mode, uint, 0444);
+MODULE_PARM_DESC(hw_mode,
+		 "Hardware mode (0: single, 1: DBS, 2: SBS passive, 3: SBS, 4: DBS+SBS, 5: DBS or SBS, default: preferred mode the firmware supports)");
+
 static const struct ath11k_hw_params ath11k_hw_params[] = {
 	{
 		.hw_rev = ATH11K_HW_IPQ8074,
diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
index a0d725923ef24..0d81212770019 100644
--- a/drivers/net/wireless/ath/ath11k/core.h
+++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -59,6 +59,7 @@
 #define ATH11K_SMBIOS_BDF_EXT_MAGIC "BDF_"
 
 extern unsigned int ath11k_frame_mode;
+extern unsigned int ath11k_hw_mode;
 extern bool ath11k_ftm_mode;
 
 #define ATH11K_SCAN_TIMEOUT_HZ (20 * HZ)
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index b3c778eb15876..615a8fc0b9937 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -4760,9 +4760,9 @@ static int ath11k_wmi_tlv_hw_mode_caps(struct ath11k_base *soc,
 				       u16 len, const void *ptr, void *data)
 {
 	struct wmi_tlv_svc_rdy_ext_parse *svc_rdy_ext = data;
-	struct wmi_hw_mode_capabilities *hw_mode_caps;
+	struct wmi_hw_mode_capabilities *hw_mode_caps, *requested = NULL;
 	enum wmi_host_hw_mode_config_type mode, pref;
-	u32 i;
+	u32 i, modes = 0;
 	int ret;
 
 	svc_rdy_ext->n_hw_mode_caps = 0;
@@ -4783,6 +4783,10 @@ static int ath11k_wmi_tlv_hw_mode_caps(struct ath11k_base *soc,
 		if (mode >= WMI_HOST_HW_MODE_MAX)
 			continue;
 
+		modes |= BIT(mode);
+		if (mode == ath11k_hw_mode)
+			requested = hw_mode_caps;
+
 		pref = soc->wmi_ab.preferred_hw_mode;
 
 		if (ath11k_hw_mode_pri_map[mode] < ath11k_hw_mode_pri_map[pref]) {
@@ -4791,6 +4795,15 @@ static int ath11k_wmi_tlv_hw_mode_caps(struct ath11k_base *soc,
 		}
 	}
 
+	if (requested) {
+		svc_rdy_ext->pref_hw_mode_caps = *requested;
+		soc->wmi_ab.preferred_hw_mode = ath11k_hw_mode;
+	} else if (ath11k_hw_mode != WMI_HOST_HW_MODE_MAX) {
+		ath11k_warn(soc, "hw mode %u not supported (modes 0x%x), using %d\n",
+			    ath11k_hw_mode, modes,
+			    soc->wmi_ab.preferred_hw_mode);
+	}
+
 	ath11k_dbg(soc, ATH11K_DBG_WMI, "preferred_hw_mode:%d\n",
 		   soc->wmi_ab.preferred_hw_mode);
 	if (soc->wmi_ab.preferred_hw_mode == WMI_HOST_HW_MODE_MAX)
-- 
2.53.0

Re: [PATCH ath-next 3/3] wifi: ath11k: add a module parameter to select the hardware mode

[Jeff Johnson]

On 10/27/2026 12:55 AM, Julius Bairaktaris wrote:
> ath11k always uses the highest priority hardware mode the firmware
> advertises. On the Zyxel NBG7815 that is DBS+SBS, which splits the
> eight 5 GHz chains between two radios, neither with a 160 MHz channel
> width. The firmware also advertises DBS, which gives one 5 GHz radio
> with all eight chains and 160 MHz. Add a hw_mode parameter that selects
> any mode the firmware advertises; for a mode it does not advertise, warn
> with the modes it does advertise and keep the default.
> 
> On the NBG7815, hw_mode=1 brings up the 8-chain 5 GHz radio. iperf3
> from the router to a 2x2 HE client with 4 streams gave 1.22 and
> 1.20 Gbit/s at 160 MHz (two 20 s runs), against 886 Mbit/s at 80 MHz
> with the unpatched driver (one run).
> 
> Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
> 
> Tested-by: Semih Baskan <strst.gs@gmail.com>
> Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
> ---
>  drivers/net/wireless/ath/ath11k/core.c |  6 ++++++
>  drivers/net/wireless/ath/ath11k/core.h |  1 +
>  drivers/net/wireless/ath/ath11k/wmi.c  | 17 +++++++++++++++--
>  3 files changed, 22 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
> index 766ae27306f43..e1a6085a065a6 100644
> --- a/drivers/net/wireless/ath/ath11k/core.c
> +++ b/drivers/net/wireless/ath/ath11k/core.c
> @@ -38,6 +38,12 @@ bool ath11k_ftm_mode;
>  module_param_named(ftm_mode, ath11k_ftm_mode, bool, 0444);
>  MODULE_PARM_DESC(ftm_mode, "Boots up in factory test mode");
>  
> +/* hw mode values are mapped as per enum wmi_host_hw_mode_config_type */
> +unsigned int ath11k_hw_mode = WMI_HOST_HW_MODE_MAX;
> +module_param_named(hw_mode, ath11k_hw_mode, uint, 0444);
> +MODULE_PARM_DESC(hw_mode,
> +		 "Hardware mode (0: single, 1: DBS, 2: SBS passive, 3: SBS, 4: DBS+SBS, 5: DBS or SBS, default: preferred mode the firmware supports)");
> +

Is there a different way?
Adding new module params is frowned upon.
https://msgid.link/6d553cffcb0ae84e141006ae1430f6f37909ad2b.camel@sipsolutions.net