[PATCH ath-next v2 2/2] wifi: ath12k: skip unknown direct buffer ring module IDs
From: Goran Sustek
Date: Mon Nov 02 2026 - 15:57:44 EST
QCN9274 firmware WLAN.WBE.1.6-01243 advertises direct buffer rings for
module IDs 2 (CV upload) and 3 (Wi-Fi radar), one entry per radio.
ath12k_wmi_dma_ring_caps() treats any ID at or above
WMI_DIRECT_BUF_MAX as fatal:
ath12k_wifi7_pci 0000:06:00.0: Invalid module id 2
ath12k_wifi7_pci 0000:06:00.0: failed to parse tlv -22
It frees the capabilities stored so far and aborts the parse of the
rest of the service ready ext event. Initialisation continues only
because the service ready ext2 event completes it.
An unknown ID is not an error. The firmware uses a direct buffer ring
only after the host configures it with WMI_PDEV_DMA_RING_CFG_REQ_CMDID,
and the host does that only for a feature it implements. Skip unknown
module IDs with a debug message instead.
Store the accepted entries contiguously and set num_db_cap to the
number actually stored. ath12k_wmi_alloc_dbring_caps() zero-fills the
array, so a skipped entry left in place would read as a spectral ring
with zero sizes. No code reads db_caps today, but a future spectral
user would.
This follows Nazar Mokrynskyi's earlier version, with the separate
count of stored entries that Jeff Johnson suggested in its review.
Link: https://lore.kernel.org/linux-wireless/20260505172415.566328-3-nazar@xxxxxxxxxxxxxx/
Suggested-by: Jeff Johnson <jeff.johnson@xxxxxxxxxxxxxxxx>
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Goran Sustek <gsustek@xxxxxxxxx>
---
v2: commit message reworded (firmware behaviour, credits); code
comment corrected.
drivers/net/wireless/ath/ath12k/wmi.c | 43 +++++++++++++++++----------
1 file changed, 28 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index f41138a7c68e..c5ff5b4d9141 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4988,8 +4988,8 @@ static int ath12k_wmi_dma_ring_caps(struct ath12k_base *ab,
struct ath12k_wmi_dma_ring_caps_parse *dma_caps_parse = data;
struct ath12k_wmi_dma_ring_caps_params *dma_caps;
struct ath12k_dbring_cap *dir_buff_caps;
+ u32 i, n = 0, module_id;
int ret;
- u32 i;
dma_caps_parse->n_dma_ring_caps = 0;
dma_caps = (struct ath12k_wmi_dma_ring_caps_params *)ptr;
@@ -5015,26 +5015,39 @@ static int ath12k_wmi_dma_ring_caps(struct ath12k_base *ab,
dir_buff_caps = ab->db_caps;
for (i = 0; i < dma_caps_parse->n_dma_ring_caps; i++) {
- if (le32_to_cpu(dma_caps[i].module_id) >= WMI_DIRECT_BUF_MAX) {
- ath12k_warn(ab, "Invalid module id %d\n",
- le32_to_cpu(dma_caps[i].module_id));
- ret = -EINVAL;
- goto free_dir_buff;
+ module_id = le32_to_cpu(dma_caps[i].module_id);
+
+ /* Firmware may advertise rings for modules this driver
+ * does not implement. It uses a ring only after the host
+ * configures it, so skipping the entry is safe.
+ */
+ if (module_id >= WMI_DIRECT_BUF_MAX) {
+ ath12k_dbg(ab, ATH12K_DBG_WMI,
+ "skipping dma ring caps of unknown module id %u\n",
+ module_id);
+ continue;
}
- dir_buff_caps[i].id = le32_to_cpu(dma_caps[i].module_id);
- dir_buff_caps[i].pdev_id =
+ dir_buff_caps[n].id = module_id;
+ dir_buff_caps[n].pdev_id =
DP_HW2SW_MACID(le32_to_cpu(dma_caps[i].pdev_id));
- dir_buff_caps[i].min_elem = le32_to_cpu(dma_caps[i].min_elem);
- dir_buff_caps[i].min_buf_sz = le32_to_cpu(dma_caps[i].min_buf_sz);
- dir_buff_caps[i].min_buf_align = le32_to_cpu(dma_caps[i].min_buf_align);
+ dir_buff_caps[n].min_elem = le32_to_cpu(dma_caps[i].min_elem);
+ dir_buff_caps[n].min_buf_sz = le32_to_cpu(dma_caps[i].min_buf_sz);
+ dir_buff_caps[n].min_buf_align = le32_to_cpu(dma_caps[i].min_buf_align);
+ n++;
}
- return 0;
+ if (!n) {
+ ath12k_wmi_free_dbring_caps(ab);
+ return 0;
+ }
-free_dir_buff:
- ath12k_wmi_free_dbring_caps(ab);
- return ret;
+ /* count only the entries stored, so no zeroed entry looks like
+ * a spectral ring
+ */
+ ab->num_db_cap = n;
+
+ return 0;
}
static void
--
2.56.0