[PATCH v3 0/2] wifi: ath9k_htc: keep WMI commands off the 64-byte packet boundary

v2 [1] must not be applied. Its message said no caller fills the RMW
buffer; ar9271_hw_pa_cal() does, on every AR9271 reset. With the size
corrected the flush is a 192-byte command, three full 64-byte USB
packets. The firmware ends a command only on a short packet, so this
one is never delivered: the device stops answering WMI and stays dead
until power is removed. This happens on the first interface open,
with the linux-firmware 1.4.0 blob and with an open-firmware build.

Patch 1 fixes the size and caps MAX_RMW_CMD_NUMBER at 14, so the
buffer can never produce a 192-byte command. With the cap, 120
interface opens ran clean: 60 with this patch, 20 of them on the
linux-firmware blob and 20 on a second AR9271, and 60 with a bench
build of the same wire lengths. A 16-entry, 204-byte command is
delivered while the 15-entry, 192-byte one is not. Patch 2 refuses
any command whose length is a multiple of the endpoint's packet size.

With all 15 writes applied the PA calibration reads offset 30 on 40
of 40 opens, where the truncated command gave 32 on 78 of 80. A
firmware with fixed reassembly, given the full 15-entry command, gave
30 on 19 of 20. The on-air effect is not measured yet.

The firmware rule is usb_reg_out_patch() in open-ath9k-htc-firmware,
target_firmware/magpie_fw_dev/target/hif/usb_api_main_patch.c. A fix
for it exists and goes to the firmware project separately; it does
not reach devices already in the field, so the driver has to stay
clear anyway.

[1] https://lore.kernel.org/linux-wireless/20260904180849.775404-1-nerijus.bendziunas@gmail.com/ (local)

Based on ath-next, commit 1d8e73163ef9.

Nerijus Bendžiūnas (2):
  wifi: ath9k_htc: fix the byte count of a full RMW buffer flush
  wifi: ath9k_htc: refuse a command that fills whole USB packets

 drivers/net/wireless/ath/ath9k/hif_usb.c      | 7 +++++++
 drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +-
 drivers/net/wireless/ath/ath9k/wmi.h          | 3 ++-
 3 files changed, 10 insertions(+), 2 deletions(-)

-- 
2.55.0