add 6GHz radio support in ath11k driver

This patch adds support for 6GHz frequency listing.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

This patch adds support for 6GHz frequency listing.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

This patch adds support for 6GHz frequency listing.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

This patch adds support for 6GHz frequency listing.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

This patch adds 6GHz band support and mac80211 registration for the 6G phy radio.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

---
v5:
- do not add ht/vht caps in 6ghz band.
v3:
- update 6GHz starting frequency as defined in IEEE P802.11ax/D6.1

 drivers/net/wireless/ath/ath11k/core.h |  6 +-
 drivers/net/wireless/ath/ath11k/mac.c  | 93 +++++++++++++++++++++-----
 drivers/net/wireless/ath/ath11k/wmi.c  | 16 ++++-
 3 files changed, 94 insertions(+), 21 deletions(-)

Quoted 16 lines · Pradeep Kumar Chitrapu

This patch adds 6GHz band support and mac80211 registration for the 6G phy radio.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

---
v5:
- do not add ht/vht caps in 6ghz band.
v3:
- update 6GHz starting frequency as defined in IEEE P802.11ax/D6.1

 drivers/net/wireless/ath/ath11k/core.h |  6 +-
 drivers/net/wireless/ath/ath11k/mac.c  | 93 
+++++++++++++++++++++-----
 drivers/net/wireless/ath/ath11k/wmi.c  | 16 ++++-
 3 files changed, 94 insertions(+), 21 deletions(-)

[...]

drivers/net/wireless/ath/ath11k/mac.c static void ath11k_mac_setup_ht_vht_cap(struct ath11k *ar, · line 3500

Quoted 11 lines

drivers/net/wireless/ath/ath11k/mac.c +1 -1

@@ -3482,7 +3494,7 @@ static void ath11k_mac_setup_ht_vht_cap(struct 
 ath11k *ar,
 						    rate_cap_rx_chainmask);
 	}
 
-	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP) {
+	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP && 
 !ar->supports_6ghz) {
 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];

drivers/net/wireless/ath/ath11k/mac.c +0 -0

 		ht_cap = cap->band[NL80211_BAND_5GHZ].ht_cap_info;
 		if (ht_cap_info)

After this change, when 6G is support, it removed HT/VHT of 5G band from "iw list", when connect to an 11AX AP of 5G, it used non-HT. caused together with this commit 75e296e9b22aef6fa467523ace87ef623dac1fad(mac80211: simplify and improve HT/VHT/HE disable code)

(quoted diff) +6 -0

+       /* disable HT/VHT/HE if we don't support them */
+       if (!sband->ht_cap.ht_supported) {
+               ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+               ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+               ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
+       }

after remove this change in ath11k, it become correct to HE iw wls1 station dump:
rx bitrate: 149.7 MBit/s HE-MCS 6 HE-NSS 2 HE-GI 0 HE-DCM 0

[...]

Quoted 20 lines

drivers/net/wireless/ath/ath11k/mac.c static void ath11k_mac_setup_ht_vht_cap(struct ath11k *ar, · line 3500

Quoted 8 lines

(quoted diff) +1 -1

-	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP) {
+	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP && 

!ar->supports_6ghz) {

drivers/net/wireless/ath/ath11k/mac.c +0 -0

 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];
 		ht_cap = cap->band[NL80211_BAND_5GHZ].ht_cap_info;
 		if (ht_cap_info)

After this change, when 6G is support, it removed HT/VHT of 5G band from "iw list", when connect to an 11AX AP of 5G, it used non-HT. caused together with this commit 75e296e9b22aef6fa467523ace87ef623dac1fad(mac80211: simplify and improve HT/VHT/HE disable code)

(quoted diff) +6 -0

+       /* disable HT/VHT/HE if we don't support them */
+       if (!sband->ht_cap.ht_supported) {
+               ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+               ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+               ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
+       }

Quoted 3 lines

after remove this change in ath11k, it become correct to HE iw wls1 station dump:
rx bitrate: 149.7 MBit/s HE-MCS 6 HE-NSS 2 HE-GI 0 HE-DCM 0

Quoted 1 line

Hi Pradeep Kumar Chitrapu,
For QCA6390, it is single_pdev, the pdev support all 2G/5G/6G, Is it have 3 pdev/ath11k in your chip for 2G/5G/6G?
And the pdev/ath11k of 6G have WMI_HOST_WLAN_5G_CAP of cap->supported_bands?

Quoted 1 line

[...]

Quoted 19 lines

Quoted 19 lines

drivers/net/wireless/ath/ath11k/mac.c static void ath11k_mac_setup_ht_vht_cap(struct ath11k *ar, · line 3500

Quoted 7 lines

(quoted diff) +1 -1

-	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP) {
+	if (cap->supported_bands & WMI_HOST_WLAN_5G_CAP && 

!ar->supports_6ghz) {

drivers/net/wireless/ath/ath11k/mac.c +0 -0

 		band = &ar->mac.sbands[NL80211_BAND_5GHZ];
 		ht_cap = cap->band[NL80211_BAND_5GHZ].ht_cap_info;
 		if (ht_cap_info)

After this change, when 6G is support, it removed HT/VHT of 5G band from "iw list", when connect to an 11AX AP of 5G, it used non-HT. caused together with this commit 75e296e9b22aef6fa467523ace87ef623dac1fad(mac80211: simplify and improve HT/VHT/HE disable code)

(quoted diff) +6 -0

+       /* disable HT/VHT/HE if we don't support them */
+       if (!sband->ht_cap.ht_supported) {
+               ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+               ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+               ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
+       }

Quoted 3 lines

Quoted 3 lines

after remove this change in ath11k, it become correct to HE iw wls1 station dump:
rx bitrate: 149.7 MBit/s HE-MCS 6 HE-NSS 2 HE-GI 0 HE-DCM 0

Hi Wen,

Do you have
https://lore.kernel.org/linux-wireless/20200528213443.25687d2695bc.I3f9747c1147480f65445f13eda5c4a5ed4e86757@changeid/?

Quoted 7 lines

Quoted 2 lines

Hi Pradeep Kumar Chitrapu,
For QCA6390, it is single_pdev, the pdev support all 2G/5G/6G, Is it have 3 pdev/ath11k in your chip for 2G/5G/6G?
And the pdev/ath11k of 6G have WMI_HOST_WLAN_5G_CAP of cap->supported_bands?

Quoted 1 line

[...]

Yes, ath11k receives WMI_HOST_WLAN_5G_CAP from firmware for 6G as well.

This patch adds 6GHz band support and mac80211 registration for the 6G phy radio.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

---
v5:
- do not add ht/vht caps in 6ghz band.
v3:
- update 6GHz starting frequency as defined in IEEE P802.11ax/D6.1

 drivers/net/wireless/ath/ath11k/core.h |  6 +-
 drivers/net/wireless/ath/ath11k/mac.c  | 93 +++++++++++++++++++++-----
 drivers/net/wireless/ath/ath11k/wmi.c  | 16 ++++-
 3 files changed, 94 insertions(+), 21 deletions(-)

drivers/net/wireless/ath/ath11k/wmi.c +3 -0

index c2a972377687..291fb274134f 100644
@@ -368,6 +368,17 @@ ath11k_pull_mac_phy_cap_svc_ready_ext(struct
 ath11k_pdev_wmi *wmi_handle,
 	memcpy(&cap_band->he_ppet, &mac_phy_caps->he_ppet5g,
 	       sizeof(struct ath11k_ppe_threshold));
 
+	cap_band = &pdev_cap->band[NL80211_BAND_6GHZ];
+	cap_band->max_bw_supported = mac_phy_caps->max_bw_supported_5g;
+	cap_band->ht_cap_info = mac_phy_caps->ht_cap_info_5g;

With addition of 6Ghz channels, it is possible that wmi buffer size can exceed the maximum wmi buffer size. So iterate over the channel list, and send multiple messages till channel list is empty.
Also mark PSC channel flag for 6GHz channels accordingly.

Signed-off-by Pradeep Kumar Chitrapu <[email protected]>

---
 drivers/net/wireless/ath/ath11k/wmi.c | 170 ++++++++++++++------------
 drivers/net/wireless/ath/ath11k/wmi.h |   3 +
 2 files changed, 98 insertions(+), 75 deletions(-)

drivers/net/wireless/ath/ath11k/wmi.c +2 -1

index 239a336f55f4..ad3a7b68d308 100644
@@ -2194,91 +2194,111 @@ int ath11k_wmi_send_scan_chan_list_cmd(struct ath11k *ar,
 	struct channel_param *tchan_info;
 	struct wmi_tlv *tlv;
 	void *ptr;
-	int i, ret, len;
+	int i, ret = 0, len;
+	u16 num_send_chans, num_sends = 0, max_chan_limit = 0;
 	u32 *reg1, *reg2;
 

drivers/net/wireless/ath/ath11k/wmi.c +52 -0

@@ -2126,6 +2136,68 @@ int ath11k_wmi_send_scan_start_cmd(struct ath11k 
 *ar,
 
 	ptr += extraie_len_with_pad;
 
+	if (params->num_hint_s_ssid) {
+		len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
+		tlv = ptr;
+		tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+			      FIELD_PREP(WMI_TLV_LEN, len);
+		ptr += TLV_HDR_SIZE;
+		s_ssid = ptr;
+		for (i = 0; i < params->num_hint_s_ssid; ++i) {
+			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
+			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
+			s_ssid++;
+		}
+		ptr += len;
+	}
+
+	if (params->num_hint_bssid) {
+		len = params->num_hint_bssid * sizeof(struct hint_bssid);
+		tlv = ptr;
+		tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+			      FIELD_PREP(WMI_TLV_LEN, len);
+		ptr += TLV_HDR_SIZE;
+		hint_bssid = ptr;
+		for (i = 0; i < params->num_hint_bssid; ++i) {
+			hint_bssid->freq_flags =
+				params->hint_bssid[i].freq_flags;
+			ether_addr_copy(&params->hint_bssid[i].bssid.addr[0],
+					&hint_bssid->bssid.addr[0]);
+			hint_bssid++;
+		}
+	}
+
+	len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
+	tlv = ptr;
+	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+		      FIELD_PREP(WMI_TLV_LEN, len);
+	ptr += TLV_HDR_SIZE;
+	if (params->num_hint_s_ssid) {
+		s_ssid = ptr;
+		for (i = 0; i < params->num_hint_s_ssid; ++i) {
+			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
+			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
+			s_ssid++;
+		}
+	}
+	ptr += len;
+
+	len = params->num_hint_bssid * sizeof(struct hint_bssid);
+	tlv = ptr;
+	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+		      FIELD_PREP(WMI_TLV_LEN, len);
+	ptr += TLV_HDR_SIZE;
+	if (params->num_hint_bssid) {

On 2020-06-03 08:17, Pradeep Kumar Chitrapu wrote:
...

Quoted 57 lines

drivers/net/wireless/ath/ath11k/wmi.c +52 -0

@@ -2126,6 +2136,68 @@ int ath11k_wmi_send_scan_start_cmd(struct
 ath11k *ar,
 
 	ptr += extraie_len_with_pad;
 
+	if (params->num_hint_s_ssid) {
+		len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
+		tlv = ptr;
+		tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+			      FIELD_PREP(WMI_TLV_LEN, len);
+		ptr += TLV_HDR_SIZE;
+		s_ssid = ptr;
+		for (i = 0; i < params->num_hint_s_ssid; ++i) {
+			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
+			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
+			s_ssid++;
+		}
+		ptr += len;
+	}
+
+	if (params->num_hint_bssid) {
+		len = params->num_hint_bssid * sizeof(struct hint_bssid);
+		tlv = ptr;
+		tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+			      FIELD_PREP(WMI_TLV_LEN, len);
+		ptr += TLV_HDR_SIZE;
+		hint_bssid = ptr;
+		for (i = 0; i < params->num_hint_bssid; ++i) {
+			hint_bssid->freq_flags =
+				params->hint_bssid[i].freq_flags;
+			ether_addr_copy(&params->hint_bssid[i].bssid.addr[0],
+					&hint_bssid->bssid.addr[0]);
+			hint_bssid++;
+		}
+	}
+
+	len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
+	tlv = ptr;
+	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+		      FIELD_PREP(WMI_TLV_LEN, len);
+	ptr += TLV_HDR_SIZE;
+	if (params->num_hint_s_ssid) {
+		s_ssid = ptr;
+		for (i = 0; i < params->num_hint_s_ssid; ++i) {
+			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
+			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
+			s_ssid++;
+		}
+	}
+	ptr += len;
+
+	len = params->num_hint_bssid * sizeof(struct hint_bssid);
+	tlv = ptr;
+	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+		      FIELD_PREP(WMI_TLV_LEN, len);
+	ptr += TLV_HDR_SIZE;
+	if (params->num_hint_bssid) {

drivers/net/wireless/ath/ath11k/wmi.c int ath11k_wmi_send_scan_start_cmd(struct · line 2201

Quoted 10 lines

drivers/net/wireless/ath/ath11k/wmi.c +10 -0

+		hint_bssid = ptr;
+		for (i = 0; i < params->num_hint_bssid; ++i) {
+			hint_bssid->freq_flags =
+				params->hint_bssid[i].freq_flags;
+			ether_addr_copy(&params->hint_bssid[i].bssid.addr[0],
+					&hint_bssid->bssid.addr[0]);
+			hint_bssid++;
+		}
+	}
+

It handle num_hint_bssid/ num_hint_s_ssid twice, and lead skb overflow and lead crash
Removed one then not crash by my test.

[  333.887631] ath11k_pci 0000:05:00.0: ath11k_wmi_send_scan_start_cmd
2 skb null 0
,pK:ffff921f6fd85400,llx:ffff921f6fd85400,px:ffff921f6fd85400,p:000000008d8d8abe
[  333.887633] ath11k_pci 0000:05:00.0: ath11k_wmi_send_scan_start_cmd
2 skb
len:372,end:448,tail:448,head:ffff921f6d7a3140,data:ffff921f6d7a318c
[  333.887635] ath11k_pci 0000:05:00.0: ath11k_wmi_send_scan_start_cmd
2 shinfo nr_frags 19 null 0,pk:ffff921f6d7a3300,llx:ffff921f6d7a3300
[  333.887638] ath11k_pci 0000:05:00.0: ath11k_wmi_cmd_send_nowait 1
skb null 0
,pK:ffff921f6fd85400,llx:ffff921f6fd85400,px:ffff921f6fd85400,p:000000008d8d8abe
[  333.887640] ath11k_pci 0000:05:00.0: ath11k_wmi_cmd_send_nowait 1
skb
len:376,end:448,tail:448,head:ffff921f6d7a3140,data:ffff921f6d7a3188
[  333.887642] ath11k_pci 0000:05:00.0: ath11k_wmi_cmd_send_nowait
shinfo nr_frags 19 null 0,pk:ffff921f6d7a3300,llx:ffff921f6d7a3300
[  333.887644] ath11k_pci 0000:05:00.0: htc ep 2 consumed 1 credits
(total 1)
[  333.887649] ath11k_pci 0000:05:00.0: ath11k_ce_send 1 write_index
6, skb null 0
,pK:ffff921f6fd85400,llx:ffff921f6fd85400,px:ffff921f6fd85400,p:000000008d8d8abe
[  333.887650] ath11k_pci 0000:05:00.0: ath11k_ce_send 1 skb
len:384,end:448,tail:448,head:ffff921f6d7a3140,data:ffff921f6d7a3180
[  333.887652] ath11k_pci 0000:05:00.0: ath11k_ce_send shinfo nr_frags
19 null 0,pk:ffff921f6d7a3300,llx:ffff921f6d7a3300
[  333.887654] ath11k_pci 0000:05:00.0: wmi cmd send 0x3001 ret 0
[  333.887729] general protection fault, probably for non-canonical
address 0x2e676e69746e756f: 0000 [#1] SMP PTI
[  333.887734] CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G
W  OE     5.8.0-rc1+ #3
[  333.887735] Hardware name: LENOVO 418065C/418065C, BIOS 83ET63WW
(1.33 ) 07/29/2011
[  333.887741] RIP: 0010:skb_release_data+0x66/0x170
[  333.887744] Code: 41 0f c1 44 24 20 39 c2 0f 85 ff 00 00 00 31 db
41 80 7c 24 02 00 48 89 fd 74 39 48 63 c3 48 83 c0 03 48 c1 e0 04 49
8b 3c 04 <48> 8b 47 08 48 8d 50 ff a8 01 48 0f 45 fa 66 66 66 66 90 f0
ff 4f
[  333.887746] RSP: 0018:ffffb3204010ce48 EFLAGS: 00010206
[  333.887748] RAX: 0000000000000030 RBX: 0000000000000000 RCX:
000000000000466e
[  333.887749] RDX: 0000000000000011 RSI: 0000000000000001 RDI:
2e676e69746e756f
[  333.887751] RBP: ffff921f6fd85400 R08: ffff921f7e5dc9b8 R09:
ffff921f7e5cb000
[  333.887752] R10: 000000000000000c R11: 0000000000001142 R12:
ffff921f6d7a3300
[  333.887754] R13: 0000000000000013 R14: ffff921f68d41658 R15:
ffff921f68d42e68
[  333.887756] FS:  0000000000000000(0000) GS:ffff921f7a240000(0000)
knlGS:0000000000000000
[  333.887757] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  333.887759] CR2: 00007f73be694b58 CR3: 000000008f40a004 CR4:
00000000000606e0
[  333.887760] Call Trace:
[  333.887763]  <IRQ>
[  333.887766]  consume_skb+0x27/0xb0
[  333.887780]  ath11k_ce_send_done_cb+0x2a2/0x2c0 [ath11k]
[  333.887789]  ath11k_ce_per_engine_service+0x50/0x3b0 [ath11k]
[  333.887796]  ? ath11k_info+0x56/0x60 [ath11k]
[  333.887799]  ? __irq_put_desc_unlock+0x18/0x50
[  333.887802]  ath11k_pci_ce_tasklet+0x2f/0x50 [ath11k_pci]
[  333.887806]  tasklet_action_common.isra.21+0xee/0x110

[  333.887809]  __do_softirq+0xfd/0x2bb
[  333.887814]  asm_call_on_stack+0x12/0x20
[  333.887815]  </IRQ>
[  333.887819]  do_softirq_own_stack+0x39/0x50
[  333.887821]  irq_exit_rcu+0x9e/0xa0
[  333.887825]  common_interrupt+0xa4/0x140
[  333.887828]  asm_common_interrupt+0x1e/0x40
[  333.887832] RIP: 0010:cpuidle_enter_state+0xc6/0x420

On 2020-06-03 08:17, Pradeep Kumar Chitrapu wrote:
...

Quoted 57 lines

drivers/net/wireless/ath/ath11k/wmi.c +52 -0

@@ -2126,6 +2136,68 @@ int ath11k_wmi_send_scan_start_cmd(struct
 ath11k *ar,
 
 	ptr += extraie_len_with_pad;
 
+	if (params->num_hint_s_ssid) {
+		len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
+		tlv = ptr;
+		tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+			      FIELD_PREP(WMI_TLV_LEN, len);
+		ptr += TLV_HDR_SIZE;
+		s_ssid = ptr;
+		for (i = 0; i < params->num_hint_s_ssid; ++i) {
+			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
+			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
+			s_ssid++;
+		}
+		ptr += len;
+	}
+
+	if (params->num_hint_bssid) {
+		len = params->num_hint_bssid * sizeof(struct hint_bssid);
+		tlv = ptr;
+		tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+			      FIELD_PREP(WMI_TLV_LEN, len);
+		ptr += TLV_HDR_SIZE;
+		hint_bssid = ptr;
+		for (i = 0; i < params->num_hint_bssid; ++i) {
+			hint_bssid->freq_flags =
+				params->hint_bssid[i].freq_flags;
+			ether_addr_copy(&params->hint_bssid[i].bssid.addr[0],
+					&hint_bssid->bssid.addr[0]);
+			hint_bssid++;
+		}
+	}
+
+	len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
+	tlv = ptr;
+	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+		      FIELD_PREP(WMI_TLV_LEN, len);
+	ptr += TLV_HDR_SIZE;
+	if (params->num_hint_s_ssid) {
+		s_ssid = ptr;
+		for (i = 0; i < params->num_hint_s_ssid; ++i) {
+			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
+			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
+			s_ssid++;
+		}
+	}
+	ptr += len;
+
+	len = params->num_hint_bssid * sizeof(struct hint_bssid);
+	tlv = ptr;
+	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+		      FIELD_PREP(WMI_TLV_LEN, len);
+	ptr += TLV_HDR_SIZE;
+	if (params->num_hint_bssid) {

drivers/net/wireless/ath/ath11k/wmi.c int ath11k_wmi_send_scan_start_cmd(struct · line 2201

Quoted 10 lines

drivers/net/wireless/ath/ath11k/wmi.c +10 -0

+		hint_bssid = ptr;
+		for (i = 0; i < params->num_hint_bssid; ++i) {
+			hint_bssid->freq_flags =
+				params->hint_bssid[i].freq_flags;
+			ether_addr_copy(&params->hint_bssid[i].bssid.addr[0],
+					&hint_bssid->bssid.addr[0]);
+			hint_bssid++;
+		}
+	}
+

It handle num_hint_bssid/ num_hint_s_ssid twice, and lead skb overflow and lead crash
Removed one then not crash by my test.

[  333.887631] ath11k_pci 0000:05:00.0: ath11k_wmi_send_scan_start_cmd
2 skb null 0
,pK:ffff921f6fd85400,llx:ffff921f6fd85400,px:ffff921f6fd85400,p:000000008d8d8abe
[  333.887633] ath11k_pci 0000:05:00.0: ath11k_wmi_send_scan_start_cmd
2 skb
len:372,end:448,tail:448,head:ffff921f6d7a3140,data:ffff921f6d7a318c
[  333.887635] ath11k_pci 0000:05:00.0: ath11k_wmi_send_scan_start_cmd
2 shinfo nr_frags 19 null 0,pk:ffff921f6d7a3300,llx:ffff921f6d7a3300
[  333.887638] ath11k_pci 0000:05:00.0: ath11k_wmi_cmd_send_nowait 1
skb null 0
,pK:ffff921f6fd85400,llx:ffff921f6fd85400,px:ffff921f6fd85400,p:000000008d8d8abe
[  333.887640] ath11k_pci 0000:05:00.0: ath11k_wmi_cmd_send_nowait 1
skb
len:376,end:448,tail:448,head:ffff921f6d7a3140,data:ffff921f6d7a3188
[  333.887642] ath11k_pci 0000:05:00.0: ath11k_wmi_cmd_send_nowait
shinfo nr_frags 19 null 0,pk:ffff921f6d7a3300,llx:ffff921f6d7a3300
[  333.887644] ath11k_pci 0000:05:00.0: htc ep 2 consumed 1 credits
(total 1)
[  333.887649] ath11k_pci 0000:05:00.0: ath11k_ce_send 1 write_index
6, skb null 0
,pK:ffff921f6fd85400,llx:ffff921f6fd85400,px:ffff921f6fd85400,p:000000008d8d8abe
[  333.887650] ath11k_pci 0000:05:00.0: ath11k_ce_send 1 skb
len:384,end:448,tail:448,head:ffff921f6d7a3140,data:ffff921f6d7a3180
[  333.887652] ath11k_pci 0000:05:00.0: ath11k_ce_send shinfo nr_frags
19 null 0,pk:ffff921f6d7a3300,llx:ffff921f6d7a3300
[  333.887654] ath11k_pci 0000:05:00.0: wmi cmd send 0x3001 ret 0
[  333.887729] general protection fault, probably for non-canonical
address 0x2e676e69746e756f: 0000 [#1] SMP PTI
[  333.887734] CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G
W  OE     5.8.0-rc1+ #3
[  333.887735] Hardware name: LENOVO 418065C/418065C, BIOS 83ET63WW
(1.33 ) 07/29/2011
[  333.887741] RIP: 0010:skb_release_data+0x66/0x170
[  333.887744] Code: 41 0f c1 44 24 20 39 c2 0f 85 ff 00 00 00 31 db
41 80 7c 24 02 00 48 89 fd 74 39 48 63 c3 48 83 c0 03 48 c1 e0 04 49
8b 3c 04 <48> 8b 47 08 48 8d 50 ff a8 01 48 0f 45 fa 66 66 66 66 90 f0
ff 4f
[  333.887746] RSP: 0018:ffffb3204010ce48 EFLAGS: 00010206
[  333.887748] RAX: 0000000000000030 RBX: 0000000000000000 RCX:
000000000000466e
[  333.887749] RDX: 0000000000000011 RSI: 0000000000000001 RDI:
2e676e69746e756f
[  333.887751] RBP: ffff921f6fd85400 R08: ffff921f7e5dc9b8 R09:
ffff921f7e5cb000
[  333.887752] R10: 000000000000000c R11: 0000000000001142 R12:
ffff921f6d7a3300
[  333.887754] R13: 0000000000000013 R14: ffff921f68d41658 R15:
ffff921f68d42e68
[  333.887756] FS:  0000000000000000(0000) GS:ffff921f7a240000(0000)
knlGS:0000000000000000
[  333.887757] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  333.887759] CR2: 00007f73be694b58 CR3: 000000008f40a004 CR4:
00000000000606e0
[  333.887760] Call Trace:
[  333.887763]  <IRQ>
[  333.887766]  consume_skb+0x27/0xb0
[  333.887780]  ath11k_ce_send_done_cb+0x2a2/0x2c0 [ath11k]
[  333.887789]  ath11k_ce_per_engine_service+0x50/0x3b0 [ath11k]
[  333.887796]  ? ath11k_info+0x56/0x60 [ath11k]
[  333.887799]  ? __irq_put_desc_unlock+0x18/0x50
[  333.887802]  ath11k_pci_ce_tasklet+0x2f/0x50 [ath11k_pci]
[  333.887806]  tasklet_action_common.isra.21+0xee/0x110

[  333.887809]  __do_softirq+0xfd/0x2bb
[  333.887814]  asm_call_on_stack+0x12/0x20
[  333.887815]  </IRQ>
[  333.887819]  do_softirq_own_stack+0x39/0x50
[  333.887821]  irq_exit_rcu+0x9e/0xa0
[  333.887825]  common_interrupt+0xa4/0x140
[  333.887828]  asm_common_interrupt+0x1e/0x40
[  333.887832] RIP: 0010:cpuidle_enter_state+0xc6/0x420

This patch series adds 6GHz frequency listing in ath11k driver and mac80211 registration for the 6GHz band. Also, extends some of wmi command tlvs for supporting 6GHz.

changes in v5:
- latest 6ghz patches on mac80211 expects driver not to pass ht/vht caps for 6GHZ band at device registration. so fix that.

Quoted 4 lines · Pradeep Kumar Chitrapu

This patch series adds 6GHz frequency listing in ath11k driver and mac80211 registration for the 6GHz band. Also, extends some of wmi command tlvs for supporting 6GHz.

Quoted 3 lines

changes in v5:
- latest 6ghz patches on mac80211 expects driver not to pass ht/vht caps for 6GHZ band at device registration. so fix that.

What are the dependencies for this patch? Is everything that is in mac80211-next as of today enough?

Also what I do with Rajkumar's patch:

[PATCH] ath11k: build HE 6 GHz capability

Should I apply it before or after this patchset?

Quoted 8 lines · Kalle Valo

Quoted 6 lines · Pradeep Kumar Chitrapu

This patch series adds 6GHz frequency listing in ath11k driver and mac80211
registration for the 6GHz band. Also, extends some of wmi command tlvs for
supporting 6GHz.

Quoted 6 lines

Quoted 3 lines

changes in v5:
- latest 6ghz patches on mac80211 expects driver not to pass ht/vht caps for 6GHZ band at device registration. so fix that.

What are the dependencies for this patch? Is everything that is in mac80211-next as of today enough?

Yes Kalle. current mac80211-next is enough.

Quoted 3 lines

Also what I do with Rajkumar's patch:

Quoted 3 lines

[PATCH] ath11k: build HE 6 GHz capability

Should I apply it before or after this patchset?

Although there is no compile dependency with above patchset, there will be 6ghz functionality dependency with above. So, IMO, its better to apply after this patch set.