ath10k-firmware: QCA9377 hw1.0: proposal to enable mfp-support flag
Conn O'Griofa
connogriofa at gmail.com
Fri Nov 13 07:22:29 PST 2026
Hello Jeff,
As discussed in a recent thread [1], my QCA9377 chipset device also
exhibits poor performance when PMF is negotiated either in WPA2-PSK or
WPA3-SAE modes, which can be resolved by setting the mfp-support
firmware feature flag. The reason for this is assumed to be identical to
Shunsuke Nagashima's discovery [2] re: the WCN3990 firmware sending
unprotected ADDBA Request frames.
My device came included with a Dell Inspiron 5570 which identifies as a
hw1.1 revision pci device, but it uses the standard QCA9377/hw1.0
firmware(s):
qca9377 hw1.1 target 0x05020001 chip_id 0x003821ff sub 1028:1810
WLAN.TF.2.1-00021-QCARMSWP-1 api 6 features wowlan,ignore-otp crc32
42e41877
WLAN.TF.1.0-00002-QCATFSWPZ-5 api 5 features ignore-otp crc32
c3e0d04f
As per the recommendation from Loic, I am attaching the modified
firmware files for consideration. The exact reproduction steps are as
follows using the latest [3] [4] firmware blobs for my chipset.
$ mkdir -p original modified
$ cp -a ~/work/linux-firmware/ath10k/QCA9377/hw1.0/firmware-5.bin \
original/
$ cp -a ~/work/linux-firmware/ath10k/QCA9377/hw1.0/firmware-6.bin \
original/
$ cp -a original/*.bin modified/
$ ./ath10k-fwencoder --dump-cmdline --show-timestamp \
original/firmware-6.bin
(output) ath10k-fwencoder --create \
--firmware-version=WLAN.TF.2.1-00021-QCARMSWP-1 \
--timestamp=1536825307 \
--features=wowlan,ignore-otp-result \
--firmware=athwlan.bin \
--otp=otp.bin \
--set-wmi-op-version=tlv \
--set-htt-op-version=tlv \
$ ./ath10k-fwencoder --modify \
--features=wowlan,ignore-otp-result,mfp-support \
--timestamp=1536825307 \
modified/firmware-6.bin
(output) modified/firmware-6.bin modified: 751436 B
$ ./ath10k-fwencoder --dump-cmdline --show-timestamp \
original/firmware-5.bin
(output) ath10k-fwencoder --create \
--firmware-version=WLAN.TF.1.0-00002-QCATFSWPZ-5 \
--timestamp=1501752298 \
--features=ignore-otp-result \
--firmware=athwlan.bin \
--otp=otp.bin \
--set-wmi-op-version=tlv \
--set-htt-op-version=tlv \
$ ./ath10k-fwencoder --modify \
--features=ignore-otp-result,mfp-support \
--timestamp 1501752298 \
modified/firmware-5.bin
(output) modified/firmware-5.bin modified: 783336 B
$ diff -u <(xxd original/firmware-6.bin) <(xxd modified/firmware-6.bin)
--- /dev/fd/63 2026-11-13 01:48:56.016590001 +0000
+++ /dev/fd/62 2026-11-13 01:48:56.017589995 +0000
@@ -46960,6 +46960,6 @@
000b76f0: 3641 00ad 0281 0514 b1bb 2682 2842 3c8c 6A........&.(B<.
000b7700: e008 000c 021d f000 3641 001d f000 0000 ........6A......
000b7710: 3641 001d f000 040a 00fd ffff ff00 0000 6A..............
-000b7720: 00ff ffff ff77 7777 0200 0000 0100 0000 .....www........
-000b7730: c077 7777 0500 0000 0400 0000 0400 0000 .www............
+000b7720: 00ff ffff ff77 7777 0200 0000 0200 0000 .....www........
+000b7730: c010 7777 0500 0000 0400 0000 0400 0000 ..ww............
000b7740: 0600 0000 0400 0000 0300 0000 ............
$ diff -u <(xxd original/firmware-5.bin) <(xxd modified/firmware-5.bin)
--- /dev/fd/63 2026-11-13 01:49:06.730515866 +0000
+++ /dev/fd/62 2026-11-13 01:49:06.731515859 +0000
@@ -48954,6 +48954,6 @@
000bf390: ad02 8103 14b1 9b21 8228 423c 8ce0 0800 .......!.(B<....
000bf3a0: 0c02 1df0 0036 4100 1df0 0000 0036 4100 .....6A......6A.
000bf3b0: 1df0 0004 0a00 fdff ffff 0000 0000 ffff ................
-000bf3c0: ffff 7777 0200 0000 0100 0000 8077 7777 ..ww.........www
+000bf3c0: ffff 7777 0200 0000 0200 0000 8010 7777 ..ww..........ww
000bf3d0: 0500 0000 0400 0000 0400 0000 0600 0000 ................
000bf3e0: 0400 0000 0300 0000 ........
$ find . -name "*.bin" -exec md5sum {} \;
a5337de417ecc57bfe8b9760dd971c7b ./original/firmware-6.bin
8b958cbd9ba5c126c18be54993b897df ./original/firmware-5.bin
300d7071b4623ca4fcd2a365d4a53b93 ./modified/firmware-5.bin
40f83c743e0379f1211d9ae8df29aa7d ./modified/firmware-6.bin
Validation using unmodified ath10k driver from kernel 7.3 against wired
host; WPA3-SAE (and therefore PMF) is active on client:
$ uname -a
Linux inspiron5570 7.3.4-zen2-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Wed, \
11 Nov 2026 19:02:29 +0000 x86_64 GNU/Linux
$ sudo wpa_cli status | grep -E "key_mgmt|group_cipher"
group_cipher=CCMP
key_mgmt=SAE
mgmt_group_cipher=BIP
Original firmware (api 6):
$ iperf3 -c 192.168.0.46 -R
Connecting to host 192.168.0.46, port 5201
Reverse mode, remote host 192.168.0.46 is sending
[ 4] local 192.168.0.78 port 36264 connected to 192.168.0.46 port 5201
[ ID] Interval Transfer Bitrate
[ 4] 0.00-1.00 sec 4.00 MBytes 33.5 Mbits/sec
[ 4] 1.00-2.00 sec 4.25 MBytes 35.7 Mbits/sec
[ 4] 2.00-3.00 sec 4.00 MBytes 33.6 Mbits/sec
[ 4] 3.00-4.00 sec 4.12 MBytes 34.6 Mbits/sec
[ 4] 4.00-5.00 sec 4.25 MBytes 35.6 Mbits/sec
[ 4] 5.00-6.00 sec 4.25 MBytes 35.7 Mbits/sec
[ 4] 6.00-7.00 sec 4.12 MBytes 34.6 Mbits/sec
[ 4] 7.00-8.00 sec 4.00 MBytes 33.6 Mbits/sec
[ 4] 8.00-9.00 sec 4.25 MBytes 35.7 Mbits/sec
[ 4] 9.00-10.00 sec 4.25 MBytes 35.7 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate Retr
[ 4] 0.00-10.52 sec 51.0 MBytes 40.7 Mbits/sec 0
sender
[ 4] 0.00-10.00 sec 41.5 MBytes 34.8 Mbits/sec
receiver
Modified firmware (api 6); note that a non-zero retry count also occurs
with unmodified firmware when running in WPA2-PSK with PMF disabled and
reaching a similar speed:
$ iperf3 -c 192.168.0.46 -R
Connecting to host 192.168.0.46, port 5201
Reverse mode, remote host 192.168.0.46 is sending
[ 4] local 192.168.0.78 port 33796 connected to 192.168.0.46 port 5201
[ ID] Interval Transfer Bitrate
[ 4] 0.00-1.00 sec 29.1 MBytes 244 Mbits/sec
[ 4] 1.00-2.00 sec 31.6 MBytes 265 Mbits/sec
[ 4] 2.00-3.00 sec 31.8 MBytes 266 Mbits/sec
[ 4] 3.00-4.00 sec 31.4 MBytes 263 Mbits/sec
[ 4] 4.00-5.00 sec 31.4 MBytes 263 Mbits/sec
[ 4] 5.00-6.00 sec 31.8 MBytes 266 Mbits/sec
[ 4] 6.00-7.00 sec 31.6 MBytes 265 Mbits/sec
[ 4] 7.00-8.00 sec 31.1 MBytes 261 Mbits/sec
[ 4] 8.00-9.00 sec 32.1 MBytes 269 Mbits/sec
[ 4] 9.00-10.00 sec 31.1 MBytes 261 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate Retr
[ 4] 0.00-10.01 sec 337 MBytes 282 Mbits/sec 122
sender
[ 4] 0.00-10.00 sec 313 MBytes 263 Mbits/sec
receiver
I verified these results against my ISP router (Virgin Media Hub 5x) and
a different OpenWrt router with an IPQ5018/QCN6122 chipset via ath11k.
Benchmark result taken from api 6 firmware, but api 5 firmware was also
confirmed to have the same issue and resolution on my device, even
though I don't plan to actually use the older api 5 firmware myself.
The unmodified firmwares can also both reach ~250-300Mbps, but only if
connected via WPA2-PSK with PMF disabled (achieved by setting my router
to WPA3 Transition Mode and forcing PMF disabled on the client). Windows
can reach a similar ~250-300Mbps without any issues when PMF is active.
[1] https://lore.kernel.org/linux-wireless/c45bdcae-63da-4552-9e35-59ec6a71621a@gmail.com/
[2] https://lore.kernel.org/linux-wireless/20261016-ath10k-series-v1-send-v1-1-c847697b3558@nagashi.ma/
[3] firmware-6.bin via commit 3e2e5d3c5bce21b4ef5bd89bad604e2be48c73b1
[4] firmware-5.bin via commit 56e5de3261877e5ca9df285e0751368c72b0861a
Tested-on: QCA9377 hw1.0 PCI api 6 WLAN.TF.2.1-00021-QCARMSWP-1
Tested-on: QCA9377 hw1.0 PCI api 5 WLAN.TF.1.0-00002-QCATFSWPZ-5
Regards,
Conn O'Griofa
-------------- next part --------------
A non-text attachment was scrubbed...
Name: firmware-5.bin
Type: application/octet-stream
Size: 783336 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/ath10k/attachments/20261113/469d36bc/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: firmware-6.bin
Type: application/octet-stream
Size: 751436 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/ath10k/attachments/20261113/469d36bc/attachment-0003.bin>
More information about the ath10k
mailing list