Re: [PATCH ath-next 1/3] wifi: ath10k: set the PMF peer flag on WCN3990

[Loic Poulain]

Hi folks,

On Fri, Oct 16, 2026 at 2:18 AM Shunsuke Nagashima via B4 Relay
<devnull+shunsuke.nagashi.ma@xxxxxxxxxx> wrote:
>
> From: Shunsuke Nagashima <shunsuke@xxxxxxxxxx>
>
> ath10k sets the PMF flag in the peer assoc command only when the
> firmware file advertises ATH10K_FW_FEATURE_MFP_SUPPORT. That check came
> with commit 90eceb3b5fb0 ("ath10k: set peer MFP flag in peer assoc
> command"), because at that time "only firmwares 10.1.561 and above have
> support for MFP". The WCN3990 firmware-5.bin files in linux-firmware do
> not set that feature bit, so the flag is never sent on WCN3990, although
> mac80211 negotiates PMF with the AP. ath11k and ath12k set the flag for
> every MFP station.

So why not updating firmware-5.bin file instead?

There is a tool available here:
https://github.com/qca/qca-swiss-army-knife.git

And you can retrieve info with:
./ath10k-fwencoder --info firmware-5.bin

And add the missing mfp-support flag:
./ath10k-fwencoder --modify --features=[BASE_FLAGS],mfp-support
~/Workspace/linux-firmware/ath10k/WCN3990/hw1.0/firmware-5.bin

Then you can submit a firmware update.

Regards,
Loic

>
> On WCN3990 (firmware WLAN.HL.2.0.c10-00459) in station mode with PMF,
> without the flag:
>
>  - The firmware sends its ADDBA Request frames unprotected. The AP does
>    not answer them, and no Block Ack agreement is set up, in both the
>    2.4 GHz and the 5 GHz band. On a 5 GHz WPA3 AP, iperf3 to a wired
>    host gave 22.6-31.6 Mbit/s up and 21.6-21.7 Mbit/s down, against
>    280.2-283.0 / 264.5-272.3 Mbit/s with WPA2 on the same AP. A
>    WPA2/WPA3 transition network gave the same low rate (23.4/22.7
>    Mbit/s), because wpa_supplicant chose SAE with PMF there.
>
>  - On 5 GHz, the protected Deauth sent at disconnect carried CCMP PN 0
>    (56 of 56 in one capture). One AP dropped it, kept the old
>    association and answered the next association with status 30, so a
>    reconnect took 24.3-24.4 s instead of about 5 s. Another AP accepted
>    the PN 0 Deauth. On 2.4 GHz the Deauth carried a live PN even
>    without the flag. I could not tell whether the band or the AP's
>    HT/VHT capability makes the difference.
>
> With the flag set (this series, in a build without ath10k debug):
>
>  - ADDBA Request frames were protected and Block Ack was used: on
>    5 GHz with this series, and on 2.4 GHz with an earlier revision of
>    it.
>  - WPA3 on the same 5 GHz AP gave 264.2-279.0 Mbit/s up and
>    236.8-246.2 Mbit/s down, and WPA2 283.4/261.7 Mbit/s. A 60-minute
>    upload with 4 TCP streams averaged 277 Mbit/s, and a 30-minute
>    download with 4 streams 230 Mbit/s.
>  - Deauth frames carried a live PN, except when the Deauth was the first
>    protected frame of the connection. With one MAC address, 100 of 100
>    connect/disconnect cycles to the same AP connected, with no
>    association rejection.
>  - With an earlier revision of this series (the same code at run
>    time): the transition network gave 276.9/249.6 Mbit/s, and in about
>    8 hours of cycles, every association that followed an acknowledged
>    Deauth with a current PN (not 0, and not older than a PN already
>    used; about 1,300) got status 0.
>
> The vendor driver for this firmware also sets the PMF peer flag for
> every PMF connection. On the same device and firmware it reached
> 259.0-269.7 Mbit/s up with WPA3.
>
> Add a hw_params flag and set it for WCN3990, so that the PMF peer flag
> is set for MFP stations there as well. This also applies to MFP clients
> when WCN3990 runs as an AP.
>
> Tested-on: WCN3