ath11k: unable to connect to 6ghz networks after cycling interface (IWD restart)

[James Prestwood]

Hi,

Recently I've noticed an issue scanning 6GHz-only SSIDs. I am running:

Card: Qualcomm Atheros QCNFA765 (rev 01)
Driver: ath11k
Kernel: 6.8
Firmware: fw_version 0x1106196e fw_build_timestamp 2024-01-12 11:30 
fw_build_id WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37
Running IWD

I can't reproduce this 100% of the time, but it happens quite frequently 
when I perform the following steps:

- Device is connected to a 5GHz SSID
- Switch the IWD profile to a 6GHz-only SSID
- Restart IWD

In some cases this works, but frequently IWD starts up and scans the 
entire spectrum (2.4/5/6ghz) and sees no 6GHz SSIDs. IWD continues to 
scan indefinitely and in some cases never sees a 6GHz SSID until its 
restarted. Restarting IWD does remove and create a wireless interface in 
the process. AFAICT the regulatory domain is set correctly and very 
early on when IWD scans and the kernel detects a US-FCC SSID.

This leaves the device unconnected until our external watchdog kicks in 
and restarts IWD which generally gets things working again. I've 
captured the netlink comms below and nothing looks wrong or incorrect 
about how IWD scans, the regdom, or enabled/disabled frequencies in the 
wiphy dump:

The regulatory domain is set:

 > Result: Get Reg (0x1f) len 508     Jul 22 13:32:08
     Wiphy: 0 (0x00000000)
     Regulatory Alpha2: US
     DFS Region: 1 (0x01)
     ...
             Rule 7: len 56
             Flags: len 4
                 No Outdoor
                 Auto BW
             Frequency Start: 5925 MHz
             Frequency End: 7125 MHz
             Frequency Range Max BW: 160 MHz
             Max Antenna Gain: 0 (0x00000000)
             Max EIRP: 2400 (0x00000960)
             DFS CAC Time: 0 (0x00000000)

During the wiphy dump when IWD starts up I see the frequency of my SSID 
and it is not disabled/no-IR:

 > Result: New Wiphy (0x03) len 72 [multi]            Jul 22 13:32:08
     Wiphy: 0 (0x00000000)
     Wiphy Name: phy0
     Generation: 1 (0x00000001)
     Wiphy Bands: len 40
         Band 3: len 36
             Frequencies: len 32
                 Frequency 40: len 28
*                    Frequency: 6755 (0x00001a63)*
                     Unknown: 20 len 4
                         00 00 00 00       ....
                     Indoor only: true
                     Max TX Power: 2400 (0x00000960)

IWD will then issues a trigger scan, and requests to scan on frequency 
6755 (among many others):

< Request: Trigger Scan (0x21) len 848 [ack]             Jul 22 13:32:08
     Wireless Device: 9 (0x0000000000000009)
     Information Elements: len 12
         Extended Capabilities: len 10
             Capability: bit  2: Extended channel switching
             Capability: bit 19: BSS transition
             Capability: bit 22: Multiple BSSID
             Capability: bit 32: QoS Map
             Capability: bit 62: Opmode Notification
             04 00 48 00 01 00 00 40 00 21 ..H.... at .!
     Scan Frequencies: len 816
         <removed for readability>
*        69: 6755 (0x00001a63)*
         <removed for readability>

The kernel responds and includes 6755 in the response:

 > Event: Trigger Scan (0x21) len 844             Jul 22 13:32:08
     Wiphy: 0 (0x00000000)
     Interface Index: 15 (0x0000000f)
     Wireless Device: 9 (0x0000000000000009)
     Scan SSIDs: len 0
     Scan Frequencies: len 792
        <removed for readability>
*        69: 6755 (0x00001a63)*
        <removed for readability>

IWD receives a new scan result event, which also includes 6755:

 > Event: New Scan Results (0x22) len 844             Jul 22 13:32:14
     Wiphy: 0 (0x00000000)
     Interface Index: 15 (0x0000000f)
     Wireless Device: 9 (0x0000000000000009)
     Scan SSIDs: len 0
     Scan Frequencies: len 792
        <removed for readability>
*        69: 6755 (0x00001a63)*
        <removed for readability>

But in the scan results there are no 6GHz BSS's found. Plenty of 2.4 and 
5GHz though so the kernel is scanning. IWD also pulls a survey after the 
scan, which includes 6755:

 > Result: New Survey Results (0x33) len 52 [multi]             Jul 22 
13:32:14
     Interface Index: 15 (0x0000000f)
     Survey Info: len 40
*        Frequency: 6755 (0x00001a63)*
         Noise dBm: -96
         Survey Time: 30 (0x000000000000001e)
         Busy Time: 0 (0x0000000000000000)

I'm open to upgrading the kernel to debug, or trying patches. But I'm 
curious if there are any reports of this, or patches that have gone in 
since 6.8 to address scanning behavior similar to this. We have other 
devices connected to this SSID during this process so the APs are 
clearly sending beacons to maintain other connections. It feels to me 
that the kernel is not actually scanning 6GHz despite the netlink 
messaging saying it is.

Thanks,

James