Hi Rob,
Following your guidance, I spent time reading through the sm7635-modules code (qca-wifi-host-cmn and qcacld-3.0) and cross-referencing it with the existing docs on the site. Here's what I found and what I'd like to contribute.
What I documented so far:
The fw-api/fw/htt.h file turned out to be the key source — it's ~19,000 lines and acts as the complete contractual spec between the driver and the WPSS blob. I've drafted a new docs/htt.md file that covers:
The full H2T message type enum (42 types, 0x00–0x2a)
The full T2H message type enum (63 types, 0x00–0x3f)
The mandatory initialization handshake sequence extracted from htt_attach_target() in qcacld-3.0/core/dp/htt/htt.c
Physical transport: CE pipe 1 (T2H) and CE pipe 4 (H2T)
Initialization sequence (extracted from htt_attach_target()):
H2T VERSION_REQ (0x0) → T2H VERSION_CONF (0x0)
H2T FRAG_DESC_BANK_CFG (0x6)
H2T RX_RING_CFG (0x2)
H2T IPA_CFG (0x8) [optional]
One correction I found in the existing docs:
The ath11k.md doc says HIF "currently only supports PCI." For the WCN6750 this is not accurate — the WCN6750 is integrated into the SM7635 SoC and uses the SNOC/AHB bus, not PCIe. The code is in qca-wifi-host-cmn/hif/src/snoc/. The HIF_TYPE_QCA6750 (ID 23) is defined separately in hif.h. I'd like to fix this in a PR along with adding the missing HTT layer to the stack diagram.
Next step I'd like to tackle:
The message type tables tell us what messages exist, but not the bit-field layout of each one. The highest-value next step seems to be documenting the exact wire format of the 4 mandatory initialization messages (VERSION_REQ/CONF, FRAG_DESC_BANK_CFG, RX_RING_CFG) — those are the minimum a re-implemented blob would need to handle to come alive.
I also didn't find the "low-level testing API" for the WCN6750 that you mentioned. You said it's buried in the sm7635-modules — could you point me to the specific file or directory? I looked in qcacld-3.0/components/ but it's a large tree.
Is the blobs directory at
librephone.fsf.org/blobs/FP6/ accessible? I'm getting a 404 — I'd like to cross-reference the actual blob files with the protocol documentation.
I'll send the draft docs as a PR to Codeberg once you confirm the direction is right.
--