[PATCH ath-next 0/2] wifi: ath11k/ath12k: don't bit-reverse the firmware's PPE thresholds

[PATCH ath-next 0/2] wifi: ath11k/ath12k: don't bit-reverse the firmware's PPE thresholds

[Christopher Griffin via B4 Relay]

ath11k and ath12k build the PPE Thresholds field of their HE
capabilities from the firmware's WMI layout with each 3-bit threshold
bit-reversed (QPSK and 256-QAM swap places, 64-QAM becomes reserved),
while a peer's thresholds are converted the right way. Firmware that
reports 0 and 7 only, as IPQ8074 and QCN9074 do, hides it. One patch
per driver.

---
Christopher Griffin (2):
      wifi: ath11k: don't bit-reverse the firmware's PPE thresholds
      wifi: ath12k: don't bit-reverse the firmware's PPE thresholds

 drivers/net/wireless/ath/ath11k/mac.c | 3 +--
 drivers/net/wireless/ath/ath12k/mac.c | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)
---
base-commit: a3ddbb45768717b5c9f923489387cf55c838d1ad
change-id: 20261104-ath-ppe-thresholds-bit-order-436ac99c5745

Best regards,
--  
Christopher Griffin <christophergriffin05@gmail.com>

[PATCH ath-next 1/2] wifi: ath11k: don't bit-reverse the firmware's PPE thresholds

[Christopher Griffin via B4 Relay]

From: Christopher Griffin <christophergriffin05@gmail.com>

The firmware reports its PPE thresholds as WMI defines them: in
ppet16_ppet8_ru3_ru0[nss], each RU has six bits, PPET16 in bits 2:0 and
PPET8 in bits 5:3, each a 3-bit constellation index. The PPE Thresholds
field of the HE Capabilities element carries the same two subfields in
the same order, bit 0 first, and ath11k_peer_assoc_h_he() already
converts a peer's field to the WMI layout that way.

ath11k_gen_ppe_thresh(), which builds our own field from the firmware's,
swaps the two halves and then writes the six bits from the top down.
That puts PPET16 first again, but with its three bits reversed, and the
same for PPET8: a threshold of 1 (QPSK) is advertised as 4 (256-QAM),
4 as 1, 3 (64-QAM) as 6 (reserved) and 6 as 3. Only 0, 2, 5 and 7 (none)
come out right, so the bug does not show with firmware that asks for
16 us padding at every constellation (PPET16 0, PPET8 7).

Copy the six bits in order.

IPQ8074 (WLAN.HK.2.9.0.1-02146) and QCN9074 (WLAN.HK.2.5.r4-00683)
firmware report PPET16 0 and PPET8 7 everywhere (iw phy: PPE Threshold
0x7b 0x1c 0xc7 0x71 ...), which reads the same either way, so their HE
capabilities do not change. Compile-tested.

Fixes: 9f056ed8ee01 ("ath11k: add HE support")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Christopher Griffin <christophergriffin05@gmail.com>
---
 drivers/net/wireless/ath/ath11k/mac.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 1a237adaa37d1..8b4e992b609a6 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -5825,8 +5825,7 @@ static void ath11k_gen_ppe_thresh(struct ath11k_ppe_threshold *fw_ppet,
 				continue;
 			val = (fw_ppet->ppet16_ppet8_ru3_ru0[nss] >> (ru * 6)) &
 			       0x3f;
-			val = ((val >> 3) & 0x7) | ((val & 0x7) << 3);
-			for (i = 5; i >= 0; i--) {
+			for (i = 0; i < 6; i++) {
 				he_ppet[bit / 8] |=
 					((val >> i) & 0x1) << ((bit % 8));
 				bit++;

-- 
2.43.0

Re: [PATCH ath-next 1/2] wifi: ath11k: don't bit-reverse the firmware's PPE thresholds

[Rameshkumar Sundaram]

On 11/5/2026 10:47 AM, Christopher Griffin via B4 Relay wrote:
> From: Christopher Griffin <christophergriffin05@gmail.com>
> 
> The firmware reports its PPE thresholds as WMI defines them: in
> ppet16_ppet8_ru3_ru0[nss], each RU has six bits, PPET16 in bits 2:0 and
> PPET8 in bits 5:3, each a 3-bit constellation index. The PPE Thresholds
> field of the HE Capabilities element carries the same two subfields in
> the same order, bit 0 first, and ath11k_peer_assoc_h_he() already

yes, but ath11k_peer_assoc_h_he() logic seems to be too complicated as 
well with << 5 and >> 1 for each iteration. Looks we need to simplify 
that with just,

val |= ((he_cap->ppe_thres[bit / 8] >> (bit % 8)) & 0x1) << i;

May be in a separate patch.


> converts a peer's field to the WMI layout that way.
> 
> ath11k_gen_ppe_thresh(), which builds our own field from the firmware's,
> swaps the two halves and then writes the six bits from the top down.
> That puts PPET16 first again, but with its three bits reversed, and the
> same for PPET8: a threshold of 1 (QPSK) is advertised as 4 (256-QAM),
> 4 as 1, 3 (64-QAM) as 6 (reserved) and 6 as 3. Only 0, 2, 5 and 7 (none)
> come out right, so the bug does not show with firmware that asks for
> 16 us padding at every constellation (PPET16 0, PPET8 7).
> 
> Copy the six bits in order.
> 
> IPQ8074 (WLAN.HK.2.9.0.1-02146) and QCN9074 (WLAN.HK.2.5.r4-00683)
> firmware report PPET16 0 and PPET8 7 everywhere (iw phy: PPE Threshold
> 0x7b 0x1c 0xc7 0x71 ...), which reads the same either way, so their HE
> capabilities do not change. Compile-tested.
> 
> Fixes: 9f056ed8ee01 ("ath11k: add HE support")
> Assisted-by: Claude:claude-opus-5-5

This tag may not be needed as per latest guidelines

> Signed-off-by: Christopher Griffin <christophergriffin05@gmail.com>
> ---
>   drivers/net/wireless/ath/ath11k/mac.c | 3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
> index 1a237adaa37d1..8b4e992b609a6 100644
> --- a/drivers/net/wireless/ath/ath11k/mac.c
> +++ b/drivers/net/wireless/ath/ath11k/mac.c
> @@ -5825,8 +5825,7 @@ static void ath11k_gen_ppe_thresh(struct ath11k_ppe_threshold *fw_ppet,
>   				continue;
>   			val = (fw_ppet->ppet16_ppet8_ru3_ru0[nss] >> (ru * 6)) &
>   			       0x3f;
> -			val = ((val >> 3) & 0x7) | ((val & 0x7) << 3);
> -			for (i = 5; i >= 0; i--) {
> +			for (i = 0; i < 6; i++) {
>   				he_ppet[bit / 8] |=
>   					((val >> i) & 0x1) << ((bit % 8));
>   				bit++;
> 
-- 
Ramesh

[PATCH ath-next 2/2] wifi: ath12k: don't bit-reverse the firmware's PPE thresholds

[Christopher Griffin via B4 Relay]

From: Christopher Griffin <christophergriffin05@gmail.com>

The firmware reports its PPE thresholds as WMI defines them: in
ppet16_ppet8_ru3_ru0[nss], each RU has six bits, PPET16 in bits 2:0 and
PPET8 in bits 5:3, each a 3-bit constellation index. The PPE Thresholds
field of the HE Capabilities element carries the same two subfields in
the same order, bit 0 first, and ath12k_peer_assoc_h_he() already
converts a peer's field to the WMI layout that way.

ath12k_gen_ppe_thresh(), which builds our own field from the firmware's,
swaps the two halves and then writes the six bits from the top down.
That puts PPET16 first again, but with its three bits reversed, and the
same for PPET8: a threshold of 1 (QPSK) is advertised as 4 (256-QAM),
4 as 1, 3 (64-QAM) as 6 (reserved) and 6 as 3. Only 0, 2, 5 and 7 (none)
come out right, so the bug does not show with firmware that asks for
16 us padding at every constellation (PPET16 0, PPET8 7).

Copy the six bits in order.

Compile-tested; ath11k has the same function and gets the same fix.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Christopher Griffin <christophergriffin05@gmail.com>
---
 drivers/net/wireless/ath/ath12k/mac.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 9fd3841f71b71..ebf28a8089ca8 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -8647,8 +8647,7 @@ static void ath12k_gen_ppe_thresh(struct ath12k_wmi_ppe_threshold_arg *fw_ppet,
 				continue;
 			val = (fw_ppet->ppet16_ppet8_ru3_ru0[nss] >> (ru * 6)) &
 			       0x3f;
-			val = ((val >> 3) & 0x7) | ((val & 0x7) << 3);
-			for (i = 5; i >= 0; i--) {
+			for (i = 0; i < 6; i++) {
 				he_ppet[bit / 8] |=
 					((val >> i) & 0x1) << ((bit % 8));
 				bit++;

-- 
2.43.0

Re: [PATCH ath-next 0/2] wifi: ath11k/ath12k: don't bit-reverse the firmware's PPE thresholds

[Rameshkumar Sundaram]

On 11/5/2026 10:47 AM, Christopher Griffin via B4 Relay wrote:
> ath11k and ath12k build the PPE Thresholds field of their HE
> capabilities from the firmware's WMI layout with each 3-bit threshold
> bit-reversed (QPSK and 256-QAM swap places, 64-QAM becomes reserved),
> while a peer's thresholds are converted the right way. Firmware that
> reports 0 and 7 only, as IPQ8074 and QCN9074 do, hides it. One patch
> per driver.
> 
> ---
> Christopher Griffin (2):
>        wifi: ath11k: don't bit-reverse the firmware's PPE thresholds
>        wifi: ath12k: don't bit-reverse the firmware's PPE thresholds
> 
>   drivers/net/wireless/ath/ath11k/mac.c | 3 +--
>   drivers/net/wireless/ath/ath12k/mac.c | 3 +--
>   2 files changed, 2 insertions(+), 4 deletions(-)
> ---
> base-commit: a3ddbb45768717b5c9f923489387cf55c838d1ad
> change-id: 20261104-ath-ppe-thresholds-bit-order-436ac99c5745
Apart from Assisted-by Tag nits,

Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>