From: Christopher Griffin The firmware reports its PPE thresholds as WMI defines them: in ppet16_ppet8_ru3_ru0[nss], each RU has six bits, PPET16 in bits 2:0 and PPET8 in bits 5:3, each a 3-bit constellation index. The PPE Thresholds field of the HE Capabilities element carries the same two subfields in the same order, bit 0 first, and ath11k_peer_assoc_h_he() already converts a peer's field to the WMI layout that way. ath11k_gen_ppe_thresh(), which builds our own field from the firmware's, swaps the two halves and then writes the six bits from the top down. That puts PPET16 first again, but with its three bits reversed, and the same for PPET8: a threshold of 1 (QPSK) is advertised as 4 (256-QAM), 4 as 1, 3 (64-QAM) as 6 (reserved) and 6 as 3. Only 0, 2, 5 and 7 (none) come out right, so the bug does not show with firmware that asks for 16 us padding at every constellation (PPET16 0, PPET8 7). Copy the six bits in order. IPQ8074 (WLAN.HK.2.9.0.1-02146) and QCN9074 (WLAN.HK.2.5.r4-00683) firmware report PPET16 0 and PPET8 7 everywhere (iw phy: PPE Threshold 0x7b 0x1c 0xc7 0x71 ...), which reads the same either way, so their HE capabilities do not change. Compile-tested. Fixes: 9f056ed8ee01 ("ath11k: add HE support") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Christopher Griffin --- drivers/net/wireless/ath/ath11k/mac.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 1a237adaa37d1..8b4e992b609a6 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -5825,8 +5825,7 @@ static void ath11k_gen_ppe_thresh(struct ath11k_ppe_threshold *fw_ppet, continue; val = (fw_ppet->ppet16_ppet8_ru3_ru0[nss] >> (ru * 6)) & 0x3f; - val = ((val >> 3) & 0x7) | ((val & 0x7) << 3); - for (i = 5; i >= 0; i--) { + for (i = 0; i < 6; i++) { he_ppet[bit / 8] |= ((val >> i) & 0x1) << ((bit % 8)); bit++; -- 2.43.0 From: Christopher Griffin The firmware reports its PPE thresholds as WMI defines them: in ppet16_ppet8_ru3_ru0[nss], each RU has six bits, PPET16 in bits 2:0 and PPET8 in bits 5:3, each a 3-bit constellation index. The PPE Thresholds field of the HE Capabilities element carries the same two subfields in the same order, bit 0 first, and ath12k_peer_assoc_h_he() already converts a peer's field to the WMI layout that way. ath12k_gen_ppe_thresh(), which builds our own field from the firmware's, swaps the two halves and then writes the six bits from the top down. That puts PPET16 first again, but with its three bits reversed, and the same for PPET8: a threshold of 1 (QPSK) is advertised as 4 (256-QAM), 4 as 1, 3 (64-QAM) as 6 (reserved) and 6 as 3. Only 0, 2, 5 and 7 (none) come out right, so the bug does not show with firmware that asks for 16 us padding at every constellation (PPET16 0, PPET8 7). Copy the six bits in order. Compile-tested; ath11k has the same function and gets the same fix. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Christopher Griffin --- drivers/net/wireless/ath/ath12k/mac.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c index 9fd3841f71b71..ebf28a8089ca8 100644 --- a/drivers/net/wireless/ath/ath12k/mac.c +++ b/drivers/net/wireless/ath/ath12k/mac.c @@ -8647,8 +8647,7 @@ static void ath12k_gen_ppe_thresh(struct ath12k_wmi_ppe_threshold_arg *fw_ppet, continue; val = (fw_ppet->ppet16_ppet8_ru3_ru0[nss] >> (ru * 6)) & 0x3f; - val = ((val >> 3) & 0x7) | ((val & 0x7) << 3); - for (i = 5; i >= 0; i--) { + for (i = 0; i < 6; i++) { he_ppet[bit / 8] |= ((val >> i) & 0x1) << ((bit % 8)); bit++; -- 2.43.0