[PATCH ath-next v2 0/2] wifi: ath12k: accept what newer QCN9274 firmware requests at boot

[PATCH ath-next v2 0/2] wifi: ath12k: accept what newer QCN9274 firmware requests at boot

[Goran Sustek]

With QCN9274 firmware WLAN.WBE.1.6-01243 (the newest in
ath12k-firmware) the driver logs three warnings at every boot:

  ath12k_wifi7_pci 0000:06:00.0: memory type 10 not supported
  ath12k_wifi7_pci 0000:06:00.0: Invalid module id 2
  ath12k_wifi7_pci 0000:06:00.0: failed to parse tlv -22

The firmware requests the AFC memory region (QMI memory type 10) and
advertises direct buffer rings for modules 2 (CV upload) and 3 (Wi-Fi
radar), all defined in Qualcomm's interface headers but not known to
the driver.

Patch 1 answers the AFC region request with size 0, so that the
firmware sees no AFC region instead of one at bus address 0. Patch 2
makes the DMA ring capability parser skip unknown module IDs instead
of aborting the event, and stores the accepted entries contiguously.

Tested on two QCN9274 hw2.0 PCI boards (AP MLD on 5 + 6 GHz, and on
5 + 2.4 GHz) with the series on top of v7.3.1: all three warnings are
gone, the firmware reaches firmware ready, all links come up and serve
clients, and there is no firmware crash, call trace or IOMMU fault.

Changes in v2:
- Patch 1: do not allocate the AFC region, because ath12k does not
  support AFC. Answer the request with size 0 instead, and log at
  debug level. New subject. (Rameshkumar Sundaram)
- Dropped v1 patch 3 ("name direct buffer ring modules 2 and 3").
  ath12k has no user for these rings, and patch 2 alone removes the
  warnings (tested on both boards). The firmware uses such a ring only
  after the host configures it, so a host that does not implement the
  feature loses nothing by skipping the entry.
- Patch 2: commit message reworded and code comment corrected; credit
  Nazar's earlier version and Jeff's suggestion from its review.
- Rebased on ath-next a3ddbb457687.

v1: https://lore.kernel.org/r/20261030220824.915760-1-gsustek@gmail.com

Goran Sustek (2):
  wifi: ath12k: report no AFC memory region to firmware
  wifi: ath12k: skip unknown direct buffer ring module IDs

 drivers/net/wireless/ath/ath12k/qmi.c | 12 ++++++++
 drivers/net/wireless/ath/ath12k/qmi.h |  1 +
 drivers/net/wireless/ath/ath12k/wmi.c | 43 +++++++++++++++++----------
 3 files changed, 41 insertions(+), 15 deletions(-)


base-commit: a3ddbb45768717b5c9f923489387cf55c838d1ad
-- 
2.56.0

[PATCH ath-next v2 1/2] wifi: ath12k: report no AFC memory region to firmware

[Goran Sustek]

QCN9274 firmware WLAN.WBE.1.6-01243 requests a target memory segment of
type 0xa at every boot. The driver does not know this type, so it logs

  ath12k_wifi7_pci 0000:06:00.0: memory type 10 not supported

and answers the request with a NULL address but the requested size.

Type 0xa is the AFC region: QMI_WLFW_AFC_MEM_V01 = 10 in Qualcomm's
wlan_firmware_service_v01.h. The firmware asks for 8 KiB, where the
host places the response of an Automated Frequency Coordination server
for 6 GHz Standard Power operation. ath12k does not support AFC.

The firmware treats a region as provided whenever its size is non-zero;
it does not check the address. With the current answer it therefore
takes bus address 0 as its AFC region and maps it for its own use.

Name the type and answer it with size 0, so that the firmware sees no
AFC region, and log this at debug level instead of warning. No memory
is allocated. With this answer the firmware sends the memory ready
indication, reaches firmware ready and brings up all radios.

Tested as part of the series.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Goran Sustek <gsustek@gmail.com>
---
v2: do not allocate the region; answer with size 0 and log at debug
    level. New subject. (Rameshkumar Sundaram)

 drivers/net/wireless/ath/ath12k/qmi.c | 12 ++++++++++++
 drivers/net/wireless/ath/ath12k/qmi.h |  1 +
 2 files changed, 13 insertions(+)

diff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c
index 817bd820623d..55952da4343b 100644
--- a/drivers/net/wireless/ath/ath12k/qmi.c
+++ b/drivers/net/wireless/ath/ath12k/qmi.c
@@ -2755,6 +2755,18 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)
 			if (ret)
 				goto err;
 			break;
+		case AFC_REGION_TYPE:
+			/* The host does not support AFC. Firmware treats a
+			 * region with a non-zero size as provided, so report
+			 * size 0 instead of address 0 with the requested size.
+			 */
+			ath12k_dbg(ab, ATH12K_DBG_QMI,
+				   "qmi AFC memory region of %u B not provided\n",
+				   chunk->size);
+			chunk->paddr = 0;
+			chunk->v.addr = NULL;
+			chunk->size = 0;
+			break;
 		case MLO_GLOBAL_MEM_REGION_TYPE:
 			mlo_size += chunk->size;
 			if (ag->mlo_mem.mlo_mem_size &&
diff --git a/drivers/net/wireless/ath/ath12k/qmi.h b/drivers/net/wireless/ath/ath12k/qmi.h
index 1b1c88906f1e..9d9174c6ee60 100644
--- a/drivers/net/wireless/ath/ath12k/qmi.h
+++ b/drivers/net/wireless/ath/ath12k/qmi.h
@@ -177,6 +177,7 @@ enum ath12k_qmi_target_mem {
 	CALDB_MEM_REGION_TYPE = 0x4,
 	MLO_GLOBAL_MEM_REGION_TYPE = 0x8,
 	PAGEABLE_MEM_REGION_TYPE = 0x9,
+	AFC_REGION_TYPE = 0xa,
 	LPASS_SHARED_V01_REGION_TYPE = 0xb,
 };
 
-- 
2.56.0

Re: [PATCH ath-next v2 1/2] wifi: ath12k: report no AFC memory region to firmware

[Rameshkumar Sundaram]

On 11/3/2026 1:32 AM, Goran Sustek wrote:
> QCN9274 firmware WLAN.WBE.1.6-01243 requests a target memory segment of
> type 0xa at every boot. The driver does not know this type, so it logs
> 
>    ath12k_wifi7_pci 0000:06:00.0: memory type 10 not supported
> 
> and answers the request with a NULL address but the requested size.
> 
> Type 0xa is the AFC region: QMI_WLFW_AFC_MEM_V01 = 10 in Qualcomm's
> wlan_firmware_service_v01.h. The firmware asks for 8 KiB, where the
> host places the response of an Automated Frequency Coordination server
> for 6 GHz Standard Power operation. ath12k does not support AFC.
> 
> The firmware treats a region as provided whenever its size is non-zero;
> it does not check the address. With the current answer it therefore
> takes bus address 0 as its AFC region and maps it for its own use.

What do you mean by "bus address" here? Do you mean the DMA address 
provided in chunk->paddr?

Also, the paragraph below makes it sound like without this change the 
firmware doesn't send the memory ready indication and the radios don't 
come up, which isn't the case. There is no visible functional issue 
being fixed here. Please update the commit message to precisely describe 
what changes with this patch.

> 
> Name the type and answer it with size 0, so that the firmware sees no
> AFC region, and log this at debug level instead of warning. No memory
> is allocated. With this answer the firmware sends the memory ready
> indication, reaches firmware ready and brings up all radios.
> 
> Tested as part of the series.
> 
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
> Signed-off-by: Goran Sustek <gsustek@gmail.com>
> ---
> v2: do not allocate the region; answer with size 0 and log at debug
>      level. New subject. (Rameshkumar Sundaram)
> 
>   drivers/net/wireless/ath/ath12k/qmi.c | 12 ++++++++++++
>   drivers/net/wireless/ath/ath12k/qmi.h |  1 +
>   2 files changed, 13 insertions(+)
> 
> diff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c
> index 817bd820623d..55952da4343b 100644
> --- a/drivers/net/wireless/ath/ath12k/qmi.c
> +++ b/drivers/net/wireless/ath/ath12k/qmi.c
> @@ -2755,6 +2755,18 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)
>   			if (ret)
>   				goto err;
>   			break;
> +		case AFC_REGION_TYPE:
> +			/* The host does not support AFC. Firmware treats a
> +			 * region with a non-zero size as provided, so report
> +			 * size 0 instead of address 0 with the requested size.
> +			 */
> +			ath12k_dbg(ab, ATH12K_DBG_QMI,
> +				   "qmi AFC memory region of %u B not provided\n",
> +				   chunk->size);
> +			chunk->paddr = 0;
> +			chunk->v.addr = NULL;
> +			chunk->size = 0;
> +			break;

I'd rather move chunk->size = 0 to the default: case. That way, all 
unsupported memory region types are consistently reported with size 0.

>   		case MLO_GLOBAL_MEM_REGION_TYPE:
>   			mlo_size += chunk->size;
>   			if (ag->mlo_mem.mlo_mem_size &&
> diff --git a/drivers/net/wireless/ath/ath12k/qmi.h b/drivers/net/wireless/ath/ath12k/qmi.h
> index 1b1c88906f1e..9d9174c6ee60 100644
> --- a/drivers/net/wireless/ath/ath12k/qmi.h
> +++ b/drivers/net/wireless/ath/ath12k/qmi.h
> @@ -177,6 +177,7 @@ enum ath12k_qmi_target_mem {
>   	CALDB_MEM_REGION_TYPE = 0x4,
>   	MLO_GLOBAL_MEM_REGION_TYPE = 0x8,
>   	PAGEABLE_MEM_REGION_TYPE = 0x9,
> +	AFC_REGION_TYPE = 0xa,
>   	LPASS_SHARED_V01_REGION_TYPE = 0xb,
>   };
>   


-- 
Ramesh

[PATCH ath-next v2 2/2] wifi: ath12k: skip unknown direct buffer ring module IDs

[Goran Sustek]

QCN9274 firmware WLAN.WBE.1.6-01243 advertises direct buffer rings for
module IDs 2 (CV upload) and 3 (Wi-Fi radar), one entry per radio.
ath12k_wmi_dma_ring_caps() treats any ID at or above
WMI_DIRECT_BUF_MAX as fatal:

  ath12k_wifi7_pci 0000:06:00.0: Invalid module id 2
  ath12k_wifi7_pci 0000:06:00.0: failed to parse tlv -22

It frees the capabilities stored so far and aborts the parse of the
rest of the service ready ext event. Initialisation continues only
because the service ready ext2 event completes it.

An unknown ID is not an error. The firmware uses a direct buffer ring
only after the host configures it with WMI_PDEV_DMA_RING_CFG_REQ_CMDID,
and the host does that only for a feature it implements. Skip unknown
module IDs with a debug message instead.

Store the accepted entries contiguously and set num_db_cap to the
number actually stored. ath12k_wmi_alloc_dbring_caps() zero-fills the
array, so a skipped entry left in place would read as a spectral ring
with zero sizes. No code reads db_caps today, but a future spectral
user would.

This follows Nazar Mokrynskyi's earlier version, with the separate
count of stored entries that Jeff Johnson suggested in its review.

Link: https://lore.kernel.org/linux-wireless/20260505172415.566328-3-nazar@mokrynskyi.com/
Suggested-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Goran Sustek <gsustek@gmail.com>
---
v2: commit message reworded (firmware behaviour, credits); code
    comment corrected.

 drivers/net/wireless/ath/ath12k/wmi.c | 43 +++++++++++++++++----------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index f41138a7c68e..c5ff5b4d9141 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4988,8 +4988,8 @@ static int ath12k_wmi_dma_ring_caps(struct ath12k_base *ab,
 	struct ath12k_wmi_dma_ring_caps_parse *dma_caps_parse = data;
 	struct ath12k_wmi_dma_ring_caps_params *dma_caps;
 	struct ath12k_dbring_cap *dir_buff_caps;
+	u32 i, n = 0, module_id;
 	int ret;
-	u32 i;
 
 	dma_caps_parse->n_dma_ring_caps = 0;
 	dma_caps = (struct ath12k_wmi_dma_ring_caps_params *)ptr;
@@ -5015,26 +5015,39 @@ static int ath12k_wmi_dma_ring_caps(struct ath12k_base *ab,
 
 	dir_buff_caps = ab->db_caps;
 	for (i = 0; i < dma_caps_parse->n_dma_ring_caps; i++) {
-		if (le32_to_cpu(dma_caps[i].module_id) >= WMI_DIRECT_BUF_MAX) {
-			ath12k_warn(ab, "Invalid module id %d\n",
-				    le32_to_cpu(dma_caps[i].module_id));
-			ret = -EINVAL;
-			goto free_dir_buff;
+		module_id = le32_to_cpu(dma_caps[i].module_id);
+
+		/* Firmware may advertise rings for modules this driver
+		 * does not implement. It uses a ring only after the host
+		 * configures it, so skipping the entry is safe.
+		 */
+		if (module_id >= WMI_DIRECT_BUF_MAX) {
+			ath12k_dbg(ab, ATH12K_DBG_WMI,
+				   "skipping dma ring caps of unknown module id %u\n",
+				   module_id);
+			continue;
 		}
 
-		dir_buff_caps[i].id = le32_to_cpu(dma_caps[i].module_id);
-		dir_buff_caps[i].pdev_id =
+		dir_buff_caps[n].id = module_id;
+		dir_buff_caps[n].pdev_id =
 			DP_HW2SW_MACID(le32_to_cpu(dma_caps[i].pdev_id));
-		dir_buff_caps[i].min_elem = le32_to_cpu(dma_caps[i].min_elem);
-		dir_buff_caps[i].min_buf_sz = le32_to_cpu(dma_caps[i].min_buf_sz);
-		dir_buff_caps[i].min_buf_align = le32_to_cpu(dma_caps[i].min_buf_align);
+		dir_buff_caps[n].min_elem = le32_to_cpu(dma_caps[i].min_elem);
+		dir_buff_caps[n].min_buf_sz = le32_to_cpu(dma_caps[i].min_buf_sz);
+		dir_buff_caps[n].min_buf_align = le32_to_cpu(dma_caps[i].min_buf_align);
+		n++;
 	}
 
-	return 0;
+	if (!n) {
+		ath12k_wmi_free_dbring_caps(ab);
+		return 0;
+	}
 
-free_dir_buff:
-	ath12k_wmi_free_dbring_caps(ab);
-	return ret;
+	/* count only the entries stored, so no zeroed entry looks like
+	 * a spectral ring
+	 */
+	ab->num_db_cap = n;
+
+	return 0;
 }
 
 static void
-- 
2.56.0