Repository navigation
wifi: apple: centauri: t6050: tell the firmware the host is awake before a join - #1316
Merged
Merged
Conversation
…oader Add apple,t6050-pcie, a T6050 (M5 Ultra) PCIe host whose root ports the boot loader powered, trained and left running. Each such port is marked apple,link-trained-by-bootloader and named by its port<n>, phy<n> and intr2axi<n> register ranges and its port<n> interrupt; the host's local MSI map starts at apple,msi-vector-base. The OS adopts the trained state and never resets, retrains or changes the port's power: reset-gpios, pwren-gpios and power-domains are not allowed on it. Also name nonposted-mmio, which these hosts take. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
On the M5 Ultra (T6050, J775D) running Linux on the hardware, the boot loader brings up the internal PCIe host's ports itself: it powers the shared PHY, trains each port's link and leaves it up, with the endpoint idle. Port 2 carries the onboard RTL8127 Ethernet controller and port 3 the ASM3142 xHCI behind the rear USB-A ports. Repeating the reset and training sequence from Linux is not needed and not known to be safe on this SoC. Add apple,t6050-pcie, a host whose root ports marked apple,link-trained-by-bootloader are adopted as they are: no reset, no tunable replay, no clock or power change and no retraining. Every resource comes from the DT by the port's index (port<n>, phy<n>, intr2axi<n>, interrupt port<n>, the iommu-map entry for the endpoint's RID). Before the first PCIe register write the driver checks that the link is up and not retraining at Gen3 x1, that the boot loader numbered the root port's buses (primary 0, one secondary), that the endpoint on it is device 0 function 0 with DMA and MSI off and a well-formed capability list, and that the port's RID table holds no valid entry. A port that fails a check is left alone and the others are still adopted. Then the endpoint's RID is routed to its SID, the host's MSI map is set up from apple,msi-vector-base, and only the adopted root ports and the endpoint behind each are enumerated. The links cannot be recovered by a user reset or removal, since the boot loader owns them. No other SoC sets adopt_link. Testing: on J775D, every boot adopts port 2 (RTL8127, DHCP and SSH over it on every boot) and port 3 (ASM3142, a USB keyboard and mouse driving the desktop session). Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
A driver's work item that rescans or resets part of a bus takes the rescan/remove lock. When the device is being removed, the remover holds that lock while it cancels the work, so a worker that blocks on the lock deadlocks against its own cancellation. Add pci_trylock_rescan_remove(), which takes the rescan/remove lock only if it is free. A worker that cannot get it returns and retries later, and the remover's cancellation completes. Signed-off-by: Dj <hey@djdev.me> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
…uences An adopted T6050 port is left as the boot loader trained it, but an endpoint that has to come back on a retrained link (the N1 on port 0, after its ROM boot) needs the host to take the port down and bring it up again. Add the sequences for that, on the port's own register blocks (port<n>, phy<n> and intr2axi<n>) and the root port's config space: - Disable: wait for the link to leave L1 and go idle, assert the port's PERST# through its handshake, then stop the lane clocks and the port's application clock. - Enable: the port reset table, which also clears the RID2SID and MSI map tables, the port's tunables, then the application clock and the PERST# release handshake, until the port is ready and its link idle. - Configure: with the root complex's read-only registers opened, its tunables and the per-rate shadow tunables, then a Gen3 x1 link (target speed, link width and capability) and a directed speed change; Intr2AXI enabled. - Train: the lane's reference clocks, the endpoint's PERST# released through its pad, the LTSSM started, then the 100 ms wait after link up. The tunables are the lists the boot loader copies onto the root port node, groups of (offset, 4, mask, value); a list it did not copy is skipped. The root-port reset that runs the sequences follows; until then they are marked __maybe_unused. Co-developed-by: Dj <hey@djdev.me> Signed-off-by: Dj <hey@djdev.me> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
… port The N1 Wi-Fi/Bluetooth sits on apcie0 port 0, which the bootloader now trains like ports 2 and 3. Two things the adoption assumed do not hold for it: - It is multi-function. In its ROM personality only function 0 answers; after its firmware starts, Control, Alpha and Beta (0-2) do. Each function's RID is routed to its own DART stream from the iommu-map (slot == SID) when it is enabled, instead of the one route set at adoption; config accesses on the adopted bus reach every function of device 0; teardown clears every slot it routed. Port 0 is accepted. - Its ROM links at Gen1. Adoption takes an x1 link at Gen1 to Gen3 (the bootloader's target), not only Gen3; the endpoint picks the speed. - After the ROM boot it must come back on a retrained link. The host provides reset_root_port for an adopted port that names its PERST# pad (perst<n>): PME_Turn_Off to L2, PERST#, then the T6050 port disable, reset, enable, configure and train sequences, with the routes and the MSI map rewritten in between. Tunables the boot loader copied onto the root port node are applied; absent ones are skipped. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The adopted port 0 named its PERST# pad as a 4-byte reg of the host (perst0, one word inside the pin controller's block) and wrote it raw. With the pin controller in the device tree the two nodes claim the same MMIO word, and whichever probes second fails: when pinctrl wins, the host's port setup stops with -EBUSY and no port is adopted, so the Ethernet and USB behind ports 2 and 3 are gone with it. One owner for the pad: the pin controller. The port node carries reset-gpios, as every other Apple host's port nodes do, and the host takes the line as the bootloader left it (GPIOD_ASIS: probe never touches a trained link's reset) and drives it only in the root-port reset, as a GPIO output at the logical level the reset asks for. The raw pad write set the same things (function bits cleared, mode output, the data bit) plus the pad's input enable, which the pin controller leaves as the bootloader set it. Probe asks for the line before any port is set up, so a host whose pin controller is not up yet defers instead of adopting nothing; an adopted port without reset-gpios has no reset, as before (reset_root_port answers -EOPNOTSUPP). The perst<n> reg, its binding entry and the raw pad write go; the binding allows reset-gpios on an adopted port again. Probe names the port whose line it cannot have, as the probe of the other hosts' ports does: a line the pin controller reserves (gpio-reserved-ranges) is refused with -EINVAL, which the host's probe otherwise returned with no word of which port or property. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The PCIe-C policy test extracts driver macro definitions to compile its production-code fixture. Taking only the first physical line truncates T6050_ROUTE and joins the following directive to its trailing backslash, so the fixture fails to compile after the T6050 host support is added. Copy continuation lines along with their define. The production fixture and both negative controls now pass. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
Add the T6050 DisplayPort/USB combo PHY and four-clock display crossbar profile. Carry the current Type-C, USB2, USB3 PIPE sequencing, and teardown behavior from the published T6050 source. Source snapshot: t6050-gpu ee68abb105200e99636a5edfc647a5cfc1d89954 Integration base: 9cbdd07 Signed-off-by: Dj <hey@djdev.me> Signed-off-by: Erik Bourget <erik@ebourget.net>
The combo PHY's USB2 PHY and digital banks are in the USB controller's power domain. Let a combo PHY name it fourth, as "usb", so the PHY can hold it on a port with no USB controller bound. The fixed DisplayPort PHY keeps exactly three domains. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Erik Bourget <erik@ebourget.net>
The combo PHY's USB2 PHY and digital banks are in the USB controller's power domain. Only a bound USB controller holds that domain, so on a port with no controller (a DisplayPort-only port, as on J775D with Linux on the hardware) the first Type-C mode switch wrote an unclocked bank and took an SError. A combo PHY node may now name that domain as a fourth power domain, "usb". When it does, the PHY holds it from combo start to combo stop, after the common domain on the way up and before it on the way down. Nodes that name three domains probe and run exactly as before, and the fixed DisplayPort PHY still takes exactly three. Testing: on J775D (M5 Ultra), with the fourth domain named on each combo port, Type-C mode switches and DisplayPort on the rear ports ran without an SError on every boot since 2026-10-30. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Erik Bourget <erik@ebourget.net>
apple,port-index has an enum but no type, so dtschema cannot decode the cell and every combo PHY node fails with "b'\x00\x00\x00\x02' is not one of [1, 2]" and a core-schema type error, whatever port it names. Give it the uint32 type. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Erik Bourget <erik@ebourget.net>
Add apple,t6050-dwc3, the T6050 (J775D) DWC3 on bare metal. It uses the shared tunable table, extended with the tables Diljit Singh's T6050 USB support applies, in the same order: the T6040 tables plus CIO (the Apple region from 0xcd20, after the fixed CIO values), bulk fabric and AUSBC debug (the optional drd-bulk and drd-ausbc regions). It is host-only, like T6040. The USB2 port reset follows the root hub's start (a no-op without a PHY reset op), and a USB3 PHY failure is fatal, as on T8132. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Erik Bourget <erik@ebourget.net>
dwc3_apple_init() now resets the USB2 port through phy_reset() once the host is up. The dwc3 teardown model extracts dwc3_apple_init() and the PHY core functions it calls, so it needs phy_reset() and a reset member in its phy_ops; none of its PHYs has one, as on every SoC before T6050. neo-stability-tests also builds dwc3_apple_init() against a reduced dwc3_apple. Give it the usb2_phy member and a no-op phy_reset(). Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
The PIPE lock that starts the USB3 handoff is acknowledged only while the combo PHY's dummy PIPE PHY is enabled (pipehandler NONSELECTED_OVERRIDE bit 15), as on the earlier ATC PHYs (T8122, T8140), and the bit resets to clear with the controller's domain. Without it the lock timed out, the PHY faulted and rear port 2 had no USB at all. Enable it before the controller leaves reset. Each PIPE-switch step returns its own code, and every fault of the PHY is logged with its reason (the pipehandler registers for PIPE faults); dwc3-apple logs a fatal USB3 PHY failure. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Erik Bourget <erik@ebourget.net>
A USB3 PIPE switch can fail before the mux moves, with the PIPE still on its dummy producer. The PHY then faulted and lost USB2 with it. Leave the port on USB2 in that case, as four DisplayPort lanes do. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Erik Bourget <erik@ebourget.net>
The combo PHY refused any apple,port-index other than 1 or 2, the two ports a guest description produced. Nothing else in the driver reads the index: the firmware buffer, banks and sequences are port-agnostic. Validate it against the board's port set instead: 1 to 5, with 0 (the port that carries the boot loader's debug link) still excluded, here and in the binding. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Erik Bourget <erik@ebourget.net>
Describe the right-hand USB-C port: its SN201202x PD controller, the ATC2 combo PHY, usb-drd2 and its DARTs, and their power domains. On J716c the port's HPM is ADT /arm-io/nub-spmi-a1/hpm2 (SPMI address 0xc, port-location "right"), on its own SPMI bus, not on nub-spmi-a0 at address 8 as on J775D; on J716c that address is hpm5 (port-type 0x11), not a port's controller. Add nub-spmi-a1 to t6050-max.dtsi, polled as nub-spmi-a0 is, put the HPM on it, and enable the ATC2 chain that J775D leaves to the display handoff. Add the atcphy2 alias so that the boot loader fills the PHY's tunables from /arm-io/atc-phy2, and turn dcpext0's Type-C route off with dcpext0: a mode-switch endpoint whose mux is never registered would defer the PD controller forever. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
On J716c the PIPE handler does not acknowledge the lock request when the controller switches from the dummy producer to USB3, even with the dummy PHY behind the mux enabled. The switch then fails and the port falls back to USB2. The switch works without the ACK. Wait 6 ms for the lock ACK, and for an unlock ACK to clear, then log the PIPE handler state if it is missing and complete the switch. With this, USB3 comes up on that port. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
On T6050 the CPU wrapper of each USB4 router is clocked through the CIO reconfig request (the router CPU's clock gate CIOn_RECONFIG_V). Until it has run, any access to the wrapper faults. The request register uses the T8142 bit positions (request BIT(2 * port), four ports) and sits at offset 0x60 of a page in the die's PMGR block, 0x280620000 on die 0. Its odd bit is a done flag rather than a busy flag: it is set once the request is taken, then request and done clear by themselves about 4 ms later. The wrapper takes an SError when it is accessed before they clear. Wait for both bits to clear (a reconfiguration still under way), store the request, wait for the done flag, then wait for both bits to clear again. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The CIO (USB4/Thunderbolt) mode has its own firmware register and receiver tunables. They are optional: an absent one is skipped. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The T6050 combo PHY rejects TYPEC_MODE_USB4 and the Thunderbolt alternate mode, so a USB4 dock that the PD controller has already entered USB4 with gets no link: the PHY is never configured and DWC3 cannot start. Add the CIO mode as a step recipe in the style of the USB ones: - the mode-independent power-up; - the common tunables, then the CIO set (AUS40CMN_SHM, AUSPLL_CORE, CIO4PLL_CORE) and the CIO80 set (UC_REGS_CIO, LN0/LN1_RX_TOP_CIO, LN0/LN1_RX_EQ_CIO), with no USB or DP lane masks; - the crossbar in CIO, where orientation only selects TOP +0x78 bit 0; - the sleep-control release of both lanes; - the firmware start, UC_TNBL_DONE and the ACIOPHY reset release, without the PIPE BIST and the ATCPHY_CFG +0x8 orientation bit. The shutdown powers both transmitters and receivers down, shuts the common block down, stops the firmware and runs the usual sleep, clamp and reset sequence. USB2 runs beside the link, so the USB2 PHY is brought up as for USB. USB3 arrives through a tunnel later; in CIO the USB3 PHY set_mode leaves DWC3 on its dummy PIPE producer until a tunnel exists. The five CIO80 tunables are optional DT properties (apple,tunable-uc-regs-cio, -lane0/1-rx-top-cio, -lane0/1-rx-eq-cio); a missing one is skipped. On J716c only the RX_TOP pair is non-empty. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The T6050 host router has the T8132 MxWrap CPU wrapper and LSTX pin, four ACIO power domains instead of three, and a PCIe router AP firmware block with its own tunables. Its NHI has a single register range, one DART stream per ring, and an SRAM parity interrupt after its 24 ring interrupts. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The M5 Max (T6050) host routers are Type 7 routers with an MxWrap CPU wrapper, close to the M3 ones. They differ at start: - The wrapper is only clocked once the CIO reset (the reconfig request) has run; any access before it faults. The reset is required, as on the other generations, and runs before the wrapper is touched. - The CPU is released with a plain store of the RUN value rather than a read-modify-write, and halted again when the router stops. - Both the rc block and the wrapper take an external abort when read before the CPU runs, so the M3_CTRL start of the other generations is skipped and their state is not logged. The rc block is first touched to hand LSTX over, once RTKit is up. - The router takes the LSTX pin over only once its RTKit is up: write the LSTX control from the level the AP held, then mux the pin to the router. While the router is off, hold the pin as a GPIO at the level the router last drove. - The PCIe router AP firmware tunable is applied with the other router tunables once the firmware is ready. - The router firmware trains Gen4 links only when the cable word says the cable is Gen4. For a USB4 Gen4 cable from Enter_USB it expects 0x801 (present and Gen4), without the 20 Gb/s bit. - The NHI has a named SRAM parity interrupt after its 24 ring interrupts, which is not a ring. Match apple,t6050-usb4-acio and apple,t6050-usb4-nhi. DisplayPort tunnels stay off on T6050 for now. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
…initialises A T8110 DART that no boot loader sets up, such as a USB4 router's or its PCIe-C tunnel's, needs the device tree to describe what the boot loader otherwise does: its tunables, its bypass streams, every error reported and the context cache flushed. Add apple,full-error-reporting and apple,ctc-flush, and extend apple,bypass-sids beyond the PCIe-C tunnel DARTs. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
A T8110 DART that the boot loader leaves alone, such as the M5 Max USB4 router's, comes up with its tunables unapplied, its errors masked and no stream in bypass. Its own driver otherwise only clears the streams, enables them and flushes the TLBs. Let the device tree describe the rest, for non-tunneled T8110 DARTs: - apple,tunable: the DART's own tunables, applied at every reset before the first stream is configured. Client partition registers (0x800..0xfff) are skipped unless PARAMS1 bit 29 says they exist. - apple,bypass-sids: streams set to bypass translation at every reset, outside any domain. - apple,full-error-reporting: unmask every error and enable the error interrupt for every stream with the registers of the DART's revision (the error mask moved to 0x4060 in 2.2; status, enable and the per-stream enables moved from 0x700 to 0x4200 in 2.4), and leave the DART unlocked on error. On 2.4 the interrupt handler also reports and acknowledges the error status. - apple,ctc-flush: where PARAMS2 bit 4 says there is a context cache, flush it (0x600) after a V2 stream flush, which leaves it alone. Log the identification registers of a DART set up this way at probe. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
Describe the USB4/Thunderbolt host router behind the right-hand USB-C port (ADT /arm-io/acio2, acio-cpu2 and dart-acio2). In t6050-max.dtsi: - the ATC2_CIO, ATC2_CIO_PCIE, ATC2_CIO_USB and ATC2_CIO_AUSS power domains; - the router CPU's mailbox and the router's LSTX pin function on the AOP GPIO controller; - the router itself, with its DART and NHI as children, so that both are populated only once the router runs: nothing is touched at boot; - the DART's stream 15 in bypass, full error reporting and the context cache flush. In the board: AUSS, kept as the boot loader leaves it, the CIO reconfig request (port 2 of the die's CIO reset), the AOP GPIO controller with only the LSTX pin exposed, the PHY's CIO80 RX_TOP tunables, the link from the PD controller to the router, and, until the boot loader fills them, this board's router, NHI and DART tunables and host DROM, from its ADT. The router node is named acio@: the boot loader disables a cio@ node unless its first register is the third register of the matching /arm-io/acioN, which on T6050 is not the router's rc block. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
At the first controller reset the USB3 PIPE mux is expected unset (0), on the dummy producer (2) or already parked (0x42). When nothing has reset the controller domain since boot, as on a boot without the SPTM, the mux reads 0x22: the dummy producer on another clock. The park then refused it and dwc3 failed to probe. The park clears the clock field before it selects the dummy producer and its clock, so start from any clock while the producer is the dummy one. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The host DROM of the M5 Max USB4 router lists port 8, which the router reports as not implemented. Reading its port config fails with -ENODEV, which made the whole DROM unusable and left the host router without one, so the NHI failed to probe. Skip such entries, as is already done for entries past the last port. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
This was referenced Nov 9, 2026
integration/aurora now has the J713 display DART power gating (#1059), whose register definitions sit where this series' DART commit adds the v2.2/v2.4 error, client-partition and context-cache definitions. Keep both blocks; they define different registers. Signed-off-by: Diljit Singh <hey@djdev.me>
Keep this transport alongside the current J813/J873 implementation. Select it only for a T6050 host, with separate objects and private helper names so both implementations can be built and registered together. Boot the N1 firmware and expose its shared ACIPC transport behind the T6050 PCIe host. After the ROM boot, isolate and quiesce function 0, put it in D3hot with PME enabled, let the host's root-port reset take the link through L2, PERST# and retraining, then restore the root port's and the endpoint's state. Keep firmware and calibration as external inputs, and retain supplier lifetime for the separate Wi-Fi and Bluetooth consumers. Source snapshot: t6050-gpu ee68abb105200e99636a5edfc647a5cfc1d89954 Integration base: 9cbdd07 Signed-off-by: Dj <hey@djdev.me> Co-developed-by: Jeff Queisser <funkzy@users.noreply.github.com> Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
Add the N1 protocol-27 cfg80211 station interface, Alpha command/data rings, scanning, and WPA2-PSK/CCMP connections. The shared firmware and PCIe transport are supplied by the sibling core PR. Source snapshot: t6050-gpu ee68abb105200e99636a5edfc647a5cfc1d89954 Integration base: 9cbdd07 Signed-off-by: Dj <hey@djdev.me> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
Keep the J813/J873 transport intact. Give the T6050 driver its own module name and reject other hosts before creating a supplier link. Add the N1 protocol-27 Beta HCI/ACL transport and its Control-supplier lifetime. Carry the bounded HCI command-cache reset hook while preserving standard status and command-credit semantics. Source snapshot: t6050-gpu ee68abb105200e99636a5edfc647a5cfc1d89954 Integration base: 9cbdd07 Signed-off-by: Dj <hey@djdev.me> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
cen_hci_reset_dup_filter() never uses the driver data it looks up, and clang warns about it. Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
Boot loaders fill the standard local-bd-address property from the bluetooth0 alias. Take the factory address from it (least significant byte first), falling back to local-mac-address, and let the binding accept either. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
A connect request carries the BSSID and channel the client chose from its own scan results. The driver looked the target up in cfg80211's scan list instead and refused the connect with -ENOENT when the entry was not there. iwd runs a requested scan as channel subsets, each with the flush flag, and at the end of each subset cfg80211 expires every BSS that subset did not see, on every band. After a last subset of 2.4 GHz channels with no access point, the list holds none of the network's BSSes while iwd's own list holds all of them, so every connect right after such a scan failed until a later unflushed scan refilled cfg80211's list. - The target is the request's BSSID and channel, or its hints. The scan entry is looked up only when the request names neither. - The RSN capabilities sent to the firmware are the station's own, from the request's RSN element (the client's MFP choice), rather than the AP's from the scan entry. - A successful connect is reported against cfg80211's entry for the target. When the client's scans expired it, one is informed from the request (BSSID, channel, SSID), and the AP's beacons, which the firmware reports once associated, fill in its elements. - Scan and connect failures name the firmware's status: a refused command, a connect or disconnect event with a non-zero status, a scan whose completion event carries one, or no event at all. command() still returns -EREMOTEIO for a refusal. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The firmware owns the radio's channel list, its per-country rules and its capabilities; the driver registered a fixed 2.4/5 GHz table and never asked. Read the firmware's two reports once the interface is configured: system command 19, the channels the hardware supports, and system command 8, the system capabilities. Both are kept as read in debugfs (ieee80211/phyN/hw_channels and system_caps) and their sizes are logged. The band table is built from them next. command() gains a reply buffer, command_reply(): the payload of the reply to the command that asked is copied there, in place of the ring consumer's per-command copies. query_link_status() parses the interface status reply (20) from it; the copy of the country reply (10), which nothing requested, goes. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The driver registered a fixed table: 2.4 GHz channels 1-13 and 25 5 GHz channels, every one at 20 dBm, and no 6 GHz band. The firmware reports which channels the current country allows (system command 19), at each width and with passive and radar flags, and its own capability elements (system command 8). Before a country is set it reports 2.4 and 5 GHz only; under US rules it reports 167 entries, 6 GHz channels 1-233 among them. - The band plan (2.4 GHz 1-14, 5 GHz 36-177, 6 GHz 1-233) is registered once, and the firmware's list is applied over cfg80211's rules: a channel it leaves out is disabled, its passive and radar flags become NO_IR and RADAR, and a width no entry covers is not used. The power limit is left to the regulatory domain and the firmware. - The regulatory notifier sets the country (command 9, as before), then reads the list again and applies it, after every regulatory change. - 6 GHz is registered with the HE capabilities element the firmware reports, and 6 GHz band capabilities from its VHT element; without an HE element there is no 6 GHz band. The radio is started before the wiphy is registered, since the bands come from it. - One band encoding, firmware_band(), for scan, connect and beacons. 6 GHz beacons carry neither DS parameters nor HT operation, so they take their channel from the HE operation's 6 GHz information. - Scans include the listen-only channels (radar channels, and all of 6 GHz under US rules) with the firmware's passive and radar bits, as its channel list encodes them, instead of skipping them. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
The firmware runs SAE itself from the password. Offer SAE (AKM 00-0F-AC:8, SAE offload). The connect command carries one authentication and AKM pair: a request that offers SAE with a password sends SAE authentication (3) and AKM 8, with the password in TLV 313 as a 16-bit length and its bytes, and no PMK; one that offers PSK with a PMK sends open authentication and AKM 4 as before. Management frame protection travels in the station's RSN element only. TLV 316 is the security roaming groups bitmap, not a PMF flag: send 0 (no roaming groups), and TLV 304 (the join mode) as 5 for every join. 6 GHz admits WPA3-Personal only with management frame protection, so a 6 GHz connect without both is refused. Signed-off-by: Jeff Queisser <funkzy@users.noreply.github.com> Developed with Claude Code. Signed-off-by: Erik Bourget <erik@ebourget.net>
…ore a join Without the host power state the N1 Alpha firmware treats the host as asleep, powers the PHYs down and traps. Before the first join of a firmware boot, send command 6 with a zero body (host power state awake), command 43 (packet lifetime) and command 52 (control profile). Each is sent once per firmware boot and retried at the next join if it fails. The host_setup parameter (default on) turns this off. This is Joshua Warren's fix from the J813/J873 N1 driver (linux-aurora 1242f12e876b), which Erik Bourget ported to the T6050 driver as #828. #828 targets t6050/centauri-wifi's centauri/centauri_wifi.c; with the T6050 transport now in centauri/t6050/, the same change goes here. Signed-off-by: Diljit Singh <hey@djdev.me>
DjDeveloperr
force-pushed
the
j716c/t6050-n1
branch
from
November 9, 2026 17:02
1a59756 to
5663c0e
Compare
DjDeveloperr
changed the base branch from
j716c/t6050-n1
to
integration/aurora
November 9, 2026 17:02
DjDeveloperr
force-pushed
the
djdev/t6050-n1-host-awake
branch
from
November 9, 2026 17:02
fb53424 to
b4ef305
Compare
Contributor
Author
|
Rebased with #938 onto #1323's head and retargeted to integration/aurora; until #938 is merged the diff also shows #938's commits. The old head fb53424 is kept as 🤖 Generated with Claude Code |
Merged
Contributor
Author
|
Retested before merging on the M5 Pro (J714sAP, bare metal, SSD boot), kernel 7.3.0-m5-merge (the M5's integration kernel with this round's rebased heads; this PR's files identical to this head). CI green; merged after #1323, whose head this branch sits on.
🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#828 adds the N1 host-awake commands to
centauri/centauri_wifi.cont6050/centauri-wifi. Since #938, the T6050 transport lives incentauri/t6050/, and that copy doesn't send them. This is the same change (Joshua Warren's fix, as Erik ported it in #828) applied tocentauri/t6050/centauri_wifi.c. Stacked on #938.Before the first join of a firmware boot, the driver sends command 6 (host power state awake, zero body), command 43 (packet lifetime) and command 52 (control profile). Each is sent once per firmware boot and retried at the next join if it fails.
host_setup=0turns this off.Testing (MacBook Pro 14" M5 Pro, J714sAP, bare metal)
Kernel: PR1012's base 0dd0833 with the heads of #936–#943, #938 and #1199, plus this commit. The boot loader trains apcie0 port 0 (erikwb's T6050 PCIe bring-up from
ewb/j716c-daily, ported to our J714s aura). The N1 firmwarej714s-ftab.binis read from the M5's Linux root.host_setup=1(default): before the first join,host power state awake: rc=0 status=0,TX packet lifetime defaults: rc=0,TX control profile defaults: rc=0. Then WPA2-PSK on 5 GHz connects, gets DHCP and passes traffic.Wi-Fi connect ... failed: firmware status 130, wpa_supplicantASSOC-REJECT status_code=1). wpa_supplicant's retry 3 s later connected.host_setup=0and join (connects), stop wpa_supplicant, sethost_setup=1, then join again. The commands go out right before that join (host power state awake: rc=0 status=0, both TX defaults rc=0), and the join connects on the first attempt. A later rejoin also connects. So the earlier refusal came from joining very soon after the firmware boot, not from these commands.Build: part of the kernel above (arm64, LLVM). checkpatch
--strict: no errors.🤖 Generated with Claude Code