test(hw): wire Talise profile + radio_on into ADRV9009 ZC706 DMA test

Two improvements over the previous "skip on refill timeout" behaviour:

1. Push a canonical iio-oscilloscope DC245p76 Talise filter profile
   to ``adrv9009-phy.profile_config`` and write ``radio_on`` to
   ``ensm_mode`` before any buffer ops.  Same pattern
   test_adrv9009_zcu102_hw uses for its profile-reload loop, scoped
   here to "wake the radio" rather than "validate reload".  Talise
   re-init walks JESD through SYNC -> ILAS -> DATA again, so we
   re-assert link DATA after the push.

2. Pre-check the IIO device list for the Kuiper-production names
   (``axi-adrv9009-rx-hpc`` / ``-obs-hpc``) before opening any DMA
   buffer.  Our merged sdtgen DTB labels the JESD framing endpoint
   ``ad_ip_jesd204_tpl_adc`` instead, and the TPL device on its
   own does not back a refillable AXI-DMA buffer even with
   ``ensm_mode=radio_on`` — surfacing the buffered RX node under
   the Kuiper name is a merged-DTB IIO-naming change outside
   overlay-lifecycle scope.  Skipping early avoids leaving a
   stalled libiio buffer that segfaulted later tests in the suite.

Net effect on nemo: 5 passed, 1 skipped (DMA loopback) — same outcome
as before, but the skip carries a precise diagnosis of what was tried
and what's missing, and the suite no longer crashes during teardown.

Author: tfcollins

test/hw/xsa/test_adrv9009_zc706_overlay.py

@@ -12,24 +12,30 @@
    so U-Boot's ``tftp devicetree.dtb`` finds it; the kernel is
    ``uImage`` (legacy U-Boot image, wrapped from the built ``zImage``
    by :func:`~test.hw.hw_helpers._wrap_zimage_as_uimage`).
-2. **DMA path** — the ADRV9009 ZC706 reference HDL has no internal
-   DAC→ADC loopback (unlike AD9081's ``ad_ip_jesd204_tpl_*`` cores),
-   so an injected TX DDS tone may not appear in the RX capture
-   without an external SMA-to-SMA cable on the daughter card.  The
-   data-path verification therefore runs in two phases: a mandatory
-   :func:`~test.hw.hw_helpers.assert_rx_capture_valid` smoke check
-   plus an opportunistic FFT stage that asserts SNR > 10 dB on a
-   non-DC peak only when one is clearly present, and otherwise logs
-   the noise-only result and passes.
+2. **DMA path** — two adaptations vs the AD9081 variant:
+
+   * The default post-boot Talise state on ZC706 + ADRV9009 leaves
+     buffered RX inert.  The DMA test pushes a canonical
+     iio-oscilloscope ``DC245p76`` Talise profile via
+     ``adrv9009-phy.profile_config`` first; that re-inits the radio
+     to ``radio_on`` without changing the JESD lane rate.
+   * The ADRV9009 ZC706 reference HDL has no internal DAC→ADC
+     loopback (unlike AD9081's ``ad_ip_jesd204_tpl_*`` cores), so a
+     TX DDS tone may not appear in the RX capture without an
+     external SMA-to-SMA cable on the daughter card.  The FFT stage
+     asserts SNR > 10 dB on a non-DC peak only when one is clearly
+     present and otherwise logs the noise-only result and passes.
 
 LG_ENV: ``test/hw/env/nemo.yaml``.
 """
 
 from __future__ import annotations
 
+import base64
 import os
 import shutil as _shutil
 import time
+import urllib.request
 from pathlib import Path
 from typing import Any
 
@@ -79,6 +85,18 @@
 DDS_SCALE = 0.5
 RX_BUFFER_SIZE = 2**14
 
+# Smallest of the canonical Talise filter profiles iio-oscilloscope
+# ships.  All four use ``deviceClock=245.76 MHz`` (matches our cfg's
+# 245.76 MHz device clock), so pushing this profile re-initialises the
+# Talise radio to a state where buffered RX is enabled without
+# changing the JESD lane rate.  ``test_adrv9009_zcu102_hw`` uses the
+# same source URL.
+TALISE_PROFILE_URL = (
+    "https://raw.githubusercontent.com/analogdevicesinc/iio-oscilloscope/"
+    "main/filters/adrv9009/"
+    "Tx_BW100_IR122p88_Rx_BW100_OR122p88_ORx_BW100_OR122p88_DC245p76.txt"
+)
+
 EXPECTED_IIO_NAMES_ANY = (
     # Kuiper-built DTBs use ``axi-adrv9009-rx-hpc``; the sdtgen-built
     # merged DTB the overlay test boots from labels the same buffered
@@ -239,6 +257,66 @@ def _apply_and_wait(shell) -> None:
     time.sleep(8.0)
 
 
+def _load_talise_profile(shell, cache_dir: Path) -> bool:
+    """Push a Talise filter profile to ``adrv9009-phy.profile_config``.
+
+    On ZC706 + ADRV9009 the default post-boot Talise state leaves the
+    buffered RX path inert (unlike ZCU102 where the default profile
+    is RX-capable).  Pushing any profile triggers a Talise re-init
+    that brings the radio up to ``radio_on``, after which DMA
+    capture works.  Returns ``True`` if the profile was applied,
+    ``False`` if the sysfs ``profile_config`` node could not be
+    located (e.g. driver build without debugfs support).
+    """
+    profile_sysfs = shell_out(
+        shell,
+        "find /sys/kernel/debug/iio /sys/bus/iio/devices "
+        "-name profile_config 2>/dev/null | head -1",
+    ).strip()
+    if not profile_sysfs:
+        profile_sysfs = shell_out(
+            shell,
+            "find /sys -name profile_config 2>/dev/null | head -1",
+        ).strip()
+    if not profile_sysfs:
+        return False
+
+    cache_dir.mkdir(parents=True, exist_ok=True)
+    cached = cache_dir / "talise_default.txt"
+    if cached.exists() and cached.stat().st_size > 0:
+        body = cached.read_text()
+    else:
+        with urllib.request.urlopen(TALISE_PROFILE_URL, timeout=30) as resp:  # noqa: S310
+            body = resp.read().decode("utf-8")
+        cached.write_text(body)
+    if not body.lstrip().startswith("<profile "):
+        raise AssertionError(
+            "Talise profile fetch returned non-XML content"
+            f" (first 80 chars: {body[:80]!r})"
+        )
+
+    b64 = base64.b64encode(body.encode()).decode()
+    shell_out(shell, f"printf '%s' '{b64}' | base64 -d > /tmp/talise.txt")
+    size_on_target = shell_out(shell, "stat -c%s /tmp/talise.txt").strip()
+    assert size_on_target == str(len(body.encode())), (
+        f"Talise profile partial push: target has {size_on_target},"
+        f" expected {len(body.encode())}"
+    )
+    shell_out(shell, f"cat /tmp/talise.txt > {profile_sysfs}")
+    # Talise re-init re-runs the JESD bring-up sequence; give the FSM
+    # time to relock both links before any sysfs check.
+    time.sleep(3.0)
+
+    # Profile push leaves the radio in ``calibrated`` (ENSM state 6) on
+    # ZC706 builds — we need ``radio_on`` (state 7) before the buffered
+    # RX path will deliver samples through DMA.  ensm_mode is exposed
+    # at the adrv9009-phy IIO device level (sibling to profile_config).
+    phy_dir = profile_sysfs.rsplit("/", 1)[0]
+    shell_out(shell, f"echo radio_on > {phy_dir}/ensm_mode")
+    time.sleep(1.0)
+    return True
+
+
 def _filter_si570_probe_noise(dmesg_txt: str) -> str:
     """Strip the benign si570 -EIO probe lines.
 
@@ -324,16 +402,19 @@ def test_load_overlay(booted_board, tmp_path):
 
 @requires_lg
 @pytest.mark.lg_feature(["adrv9009", "zc706"])
-def test_dma_loopback(booted_board):
+def test_dma_loopback(booted_board, tmp_path):
     """Verify DMA TX→RX data path.
 
-    Two phases:
+    Setup: push a single Talise filter profile to wake the radio.
+    The default post-boot Talise state on ZC706 + ADRV9009 leaves
+    buffered RX inert; pushing any DC-245.76 MHz profile re-inits
+    the chip into ``radio_on`` without changing the JESD lane rate.
+
+    Two verification phases:
 
     * **Mandatory:** :func:`assert_rx_capture_valid` confirms that an
-      RX buffer arrives with non-zero, non-latched samples.  This is
-      the same smoke check ``test_adrv9009_zcu102_hw`` runs before any
-      Talise profile push and is sufficient evidence that the JESD +
-      DMA path is alive.
+      RX buffer arrives with non-zero, non-latched samples.  Same
+      smoke check ``test_adrv9009_zcu102_hw`` runs.
     * **Opportunistic FFT:** drive a DDS tone on TX and look for a
       coherent peak in the RX spectrum.  If one is present (SNR
       > 10 dB), it must be non-DC and non-Nyquist.  If no peak emerges
@@ -349,33 +430,52 @@ def test_dma_loopback(booted_board):
     if not overlay_is_loaded(shell, OVERLAY_NAME):
         pytest.skip("overlay not loaded — test_load_overlay must run first")
 
+    profile_loaded = _load_talise_profile(shell, tmp_path / "talise_cache")
+    if profile_loaded:
+        # Talise re-init walks JESD through SYNC → ILAS → DATA again.
+        assert_jesd_links_data(shell, context="after Talise profile push")
+    else:
+        print(
+            "Talise profile_config sysfs not found — proceeding with"
+            " default post-boot Talise state"
+        )
+
     ctx, ip = open_iio_context(shell)
 
-    # Phase 1: bare data-path smoke check (independent of pyadi-iio).
-    # On ZC706 + ADRV9009, the default Talise profile may leave the
-    # buffered RX path inert until ``ensm_mode = radio_on`` is written
-    # or a Talise profile is reloaded — neither of which is the
-    # overlay-lifecycle test's responsibility.  Treat a refill timeout
-    # as "DMA path needs further setup", log it, and skip cleanly.
-    try:
-        assert_rx_capture_valid(
-            ctx,
-            (
-                "axi-adrv9009-rx-hpc",
-                "axi-adrv9009-rx-obs-hpc",
-                "ad_ip_jesd204_tpl_adc",
-            ),
-            n_samples=2**12,
-            context="adrv9009 zc706 overlay",
+    # Pre-check before touching any DMA buffer: only the production
+    # Kuiper DTB names (``axi-adrv9009-rx-hpc`` / ``-obs-hpc``) back
+    # a refillable AXI-DMA buffer.  Our merged sdtgen DTB labels the
+    # JESD framing core ``ad_ip_jesd204_tpl_adc`` instead, which is
+    # the JESD framing test endpoint, not the buffered ADC frontend
+    # — refilling its buffer hangs even after Talise re-init +
+    # ``ensm_mode=radio_on``.  Aligning the merged-DTB IIO names
+    # with Kuiper is a separate merged-DTB IIO-naming change,
+    # outside overlay-lifecycle scope.  Skip the buffered-RX phase
+    # cleanly when the right names are absent so we don't leave a
+    # stalled libiio buffer that segfaults the rest of the suite.
+    rx_dev_names = {d.name for d in ctx.devices if d.name}
+    has_buffered_rx = bool(
+        rx_dev_names & {"axi-adrv9009-rx-hpc", "axi-adrv9009-rx-obs-hpc"}
+    )
+    if not has_buffered_rx:
+        del ctx
+        pytest.skip(
+            "merged-DTB exposes only ad_ip_jesd204_tpl_adc, not the"
+            " axi-adrv9009-rx-hpc Kuiper name backed by AXI-DMA;"
+            " buffered RX requires merged-DTB IIO-naming work"
+            " outside overlay-lifecycle scope"
         )
-    except AssertionError as exc:
-        if "timed out" in str(exc).lower():
-            pytest.skip(
-                "ADRV9009 RX DMA refill timed out — buffered path needs"
-                " radio-enable / profile load (lab-setup concern, not"
-                f" overlay lifecycle): {exc}"
-            )
-        raise
+
+    # Phase 1: bare data-path smoke check.
+    assert_rx_capture_valid(
+        ctx,
+        (
+            "axi-adrv9009-rx-hpc",
+            "axi-adrv9009-rx-obs-hpc",
+        ),
+        n_samples=2**12,
+        context="adrv9009 zc706 overlay",
+    )
 
     # Phase 2: opportunistic spectrum check via pyadi-iio.
     import adi