[PATCH ath-next 0/3] wifi: ath12k: accept what newer QCN9274 firmware requests at boot

[PATCH ath-next 0/3] wifi: ath12k: accept what newer QCN9274 firmware requests at boot

[Goran Sustek]

With QCN9274 firmware WLAN.WBE.1.6-01243 (the newest in
ath12k-firmware) the driver logs three warnings at every boot:

  ath12k_wifi7_pci 0000:06:00.0: memory type 10 not supported
  ath12k_wifi7_pci 0000:06:00.0: Invalid module id 2
  ath12k_wifi7_pci 0000:06:00.0: failed to parse tlv -22

The firmware is not at fault: it requests the AFC memory region
(QMI memory type 10) and advertises a direct buffer ring for CV
upload (module 2), both defined in Qualcomm's interface headers but
not yet known to the driver.

Patch 1 allocates the AFC region instead of answering with a NULL
address. Patch 2 makes the DMA ring capability parser skip unknown
module IDs instead of aborting the event, and fixes the zero-filled
entry a plain skip would leave. Patch 3 names modules 2 and 3.

The idea of patch 2 was posted earlier by Nazar Mokrynskyi:
https://lore.kernel.org/linux-wireless/20260505172415.566328-3-nazar@mokrynskyi.com/

Tested on a QCN9274 hw2.0 PCI board (single device, AP MLD on 5 GHz
and 2.4 GHz) with the series on top of v7.3.1: all three warnings are
gone, the device comes up with both links, and there is no firmware
crash, call trace or IOMMU fault.

Goran Sustek (3):
  wifi: ath12k: allocate the AFC memory region requested by firmware
  wifi: ath12k: skip unknown direct buffer ring module IDs
  wifi: ath12k: name direct buffer ring modules 2 and 3

 drivers/net/wireless/ath/ath12k/qmi.c |   17 +++++++++++++
 drivers/net/wireless/ath/ath12k/qmi.h |    3 ++
 drivers/net/wireless/ath/ath12k/wmi.c |   43 +++++++++++++++++++++------------
 drivers/net/wireless/ath/ath12k/wmi.h |    2 ++
 4 files changed, 50 insertions(+), 15 deletions(-)


base-commit: 7b14c8f4a9615579b09cbcdc4515b65ae6124753
--
2.47.0

[PATCH ath-next 1/3] wifi: ath12k: allocate the AFC memory region requested by firmware

[Goran Sustek]

QCN9274 firmware WLAN.WBE.1.6-01243 requests a target memory segment of
type 0xa at every boot. The driver does not know this type, so it logs

  ath12k_wifi7_pci 0000:06:00.0: memory type 10 not supported

and answers the request with a NULL address but the requested size.

Type 0xa is the AFC region: QMI_WLFW_AFC_MEM_V01 = 10 in Qualcomm's
wlan_firmware_service_v01.h. The firmware asks for 8 KiB, one 4 KiB
slot per radio, where the host places the answer of an Automated
Frequency Coordination server for 6 GHz Standard Power operation.

The firmware's handler of the memory response records the reported
address and marks the region as provided whenever the size is
non-zero; it does not check for a zero address. With the current
NULL answer the firmware therefore holds a region at bus address 0.
This driver never enables AFC and no misbehaviour has been observed,
but the firmware state is wrong.

Name the type and allocate it like the other host regions, bounded to
two 4 KiB slots. This removes the warning and gives the firmware a
valid region. An oversized request keeps today's behaviour with a
warning.

Tested as part of the series.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Goran Sustek <gsustek@gmail.com>
---
 drivers/net/wireless/ath/ath12k/qmi.c |   17 +++++++++++++++++
 drivers/net/wireless/ath/ath12k/qmi.h |    3 +++
 2 files changed, 20 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c
index 280e50a1f31d..0679e5d2d4fc 100644
--- a/drivers/net/wireless/ath/ath12k/qmi.c
+++ b/drivers/net/wireless/ath/ath12k/qmi.c
@@ -2707,6 +2707,23 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)
 			if (ret)
 				goto err;
 			break;
+		case AFC_REGION_TYPE:
+			/* Firmware requests the AFC region at every boot, even
+			 * when the 6 GHz radio does not use Standard Power. It
+			 * treats a non-zero size as a provided region, so hand
+			 * it real memory instead of a NULL address.
+			 */
+			if (chunk->size > ATH12K_QMI_AFC_MEM_SIZE) {
+				ath12k_warn(ab, "AFC memory request of %u B exceeds %u B, not allocated\n",
+					    chunk->size, ATH12K_QMI_AFC_MEM_SIZE);
+				chunk->paddr = 0;
+				chunk->v.addr = NULL;
+				break;
+			}
+			ret = ath12k_qmi_alloc_chunk(ab, chunk);
+			if (ret)
+				goto err;
+			break;
 		case MLO_GLOBAL_MEM_REGION_TYPE:
 			mlo_size += chunk->size;
 			if (ag->mlo_mem.mlo_mem_size &&
diff --git a/drivers/net/wireless/ath/ath12k/qmi.h b/drivers/net/wireless/ath/ath12k/qmi.h
index 6da10f3cb597..c438ef6c7680 100644
--- a/drivers/net/wireless/ath/ath12k/qmi.h
+++ b/drivers/net/wireless/ath/ath12k/qmi.h
@@ -26,6 +26,8 @@
 #define ATH12K_QMI_BDF_EXT_STR_LENGTH		0x20
 #define ATH12K_QMI_WLFW_MAX_DEV_MEM_NUM_V01 4
 #define ATH12K_QMI_DEVMEM_CMEM_INDEX	0
+/* AFC region: one 4 KiB slot per radio, at most two radios */
+#define ATH12K_QMI_AFC_MEM_SIZE		(2 * 0x1000)
 
 #define QMI_WLFW_REQUEST_MEM_IND_V01		0x0035
 #define QMI_WLFW_FW_MEM_READY_IND_V01		0x0037
@@ -173,6 +175,7 @@ enum ath12k_qmi_target_mem {
 	CALDB_MEM_REGION_TYPE = 0x4,
 	MLO_GLOBAL_MEM_REGION_TYPE = 0x8,
 	PAGEABLE_MEM_REGION_TYPE = 0x9,
+	AFC_REGION_TYPE = 0xa,
 	LPASS_SHARED_V01_REGION_TYPE = 0xb,
 };
 
--
2.47.0

[PATCH ath-next 2/3] wifi: ath12k: skip unknown direct buffer ring module IDs

[Goran Sustek]

Newer firmware may advertise direct buffer rings for modules the
driver does not know. QCN9274 firmware WLAN.WBE.1.6-01243 lists
module 2, and ath12k_wmi_dma_ring_caps() treats it as fatal:

  ath12k_wifi7_pci 0000:06:00.0: Invalid module id 2
  ath12k_wifi7_pci 0000:06:00.0: failed to parse tlv -22

It frees the capabilities stored so far and aborts the parse of the
rest of the service ready ext event. Initialisation continues only
because the service ready ext2 event completes it.

Skip unknown module IDs with a debug message instead; the driver only
sets up rings for the modules it implements. Store the accepted
entries contiguously and set num_db_cap to the number actually stored:
ath12k_wmi_alloc_dbring_caps() zero-fills the array, so a hole left at
the index of a skipped entry would read as a spectral ring with zero
sizes.

Tested as part of the series.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Goran Sustek <gsustek@gmail.com>
---
 drivers/net/wireless/ath/ath12k/wmi.c |   43 +++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index d5160af60e00..4d4f8e9caf07 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4938,8 +4938,8 @@ static int ath12k_wmi_dma_ring_caps(struct ath12k_base *ab,
 	struct ath12k_wmi_dma_ring_caps_parse *dma_caps_parse = data;
 	struct ath12k_wmi_dma_ring_caps_params *dma_caps;
 	struct ath12k_dbring_cap *dir_buff_caps;
+	u32 i, n = 0, module_id;
 	int ret;
-	u32 i;
 
 	dma_caps_parse->n_dma_ring_caps = 0;
 	dma_caps = (struct ath12k_wmi_dma_ring_caps_params *)ptr;
@@ -4965,26 +4965,39 @@ static int ath12k_wmi_dma_ring_caps(struct ath12k_base *ab,
 
 	dir_buff_caps = ab->db_caps;
 	for (i = 0; i < dma_caps_parse->n_dma_ring_caps; i++) {
-		if (le32_to_cpu(dma_caps[i].module_id) >= WMI_DIRECT_BUF_MAX) {
-			ath12k_warn(ab, "Invalid module id %d\n",
-				    le32_to_cpu(dma_caps[i].module_id));
-			ret = -EINVAL;
-			goto free_dir_buff;
+		module_id = le32_to_cpu(dma_caps[i].module_id);
+
+		/* Newer firmware may advertise rings for modules this driver
+		 * does not know yet. Skip them; the driver only sets up rings
+		 * for the modules it implements.
+		 */
+		if (module_id >= WMI_DIRECT_BUF_MAX) {
+			ath12k_dbg(ab, ATH12K_DBG_WMI,
+				   "skipping dma ring caps of unknown module id %u\n",
+				   module_id);
+			continue;
 		}
 
-		dir_buff_caps[i].id = le32_to_cpu(dma_caps[i].module_id);
-		dir_buff_caps[i].pdev_id =
+		dir_buff_caps[n].id = module_id;
+		dir_buff_caps[n].pdev_id =
 			DP_HW2SW_MACID(le32_to_cpu(dma_caps[i].pdev_id));
-		dir_buff_caps[i].min_elem = le32_to_cpu(dma_caps[i].min_elem);
-		dir_buff_caps[i].min_buf_sz = le32_to_cpu(dma_caps[i].min_buf_sz);
-		dir_buff_caps[i].min_buf_align = le32_to_cpu(dma_caps[i].min_buf_align);
+		dir_buff_caps[n].min_elem = le32_to_cpu(dma_caps[i].min_elem);
+		dir_buff_caps[n].min_buf_sz = le32_to_cpu(dma_caps[i].min_buf_sz);
+		dir_buff_caps[n].min_buf_align = le32_to_cpu(dma_caps[i].min_buf_align);
+		n++;
 	}
 
-	return 0;
+	if (!n) {
+		ath12k_wmi_free_dbring_caps(ab);
+		return 0;
+	}
 
-free_dir_buff:
-	ath12k_wmi_free_dbring_caps(ab);
-	return ret;
+	/* count only the entries stored, so no zeroed entry looks like
+	 * a spectral ring
+	 */
+	ab->num_db_cap = n;
+
+	return 0;
 }
 
 static void
--
2.47.0

[PATCH ath-next 3/3] wifi: ath12k: name direct buffer ring modules 2 and 3

[Goran Sustek]

Qualcomm's WMI interface definition (WMI_DMA_RING_SUPPORTED_MODULE in
fw-api wmi_unified.h) lists direct buffer ring module 2 as CV upload
and module 3 as Wi-Fi radar. QCN9274 firmware WLAN.WBE.1.6-01243
advertises module 2.

Add both to enum wmi_direct_buffer_module so their capabilities are
kept instead of skipped. No ring is set up for them; that needs the
features themselves.

Tested as part of the series.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Goran Sustek <gsustek@gmail.com>
---
 drivers/net/wireless/ath/ath12k/wmi.h |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h
index b508aa759bd8..9444a1f29813 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.h
+++ b/drivers/net/wireless/ath/ath12k/wmi.h
@@ -2378,6 +2378,8 @@ enum wmi_beacon_gen_mode {
 enum wmi_direct_buffer_module {
 	WMI_DIRECT_BUF_SPECTRAL = 0,
 	WMI_DIRECT_BUF_CFR = 1,
+	WMI_DIRECT_BUF_CV_UPLOAD = 2,
+	WMI_DIRECT_BUF_WIFI_RADAR = 3,
 
 	/* keep it last */
 	WMI_DIRECT_BUF_MAX
--
2.47.0