[PATCH 3/5] wifi: ath12k: fix MLO dp_peer ID desync with firmware

[Jose Ignacio Tornos Martinez <jtornosm@redhat.com>]

TX completions fail with:
  "dp_tx: failed to find the peer with peer_id <N>"

where <N> is an ML peer_id (host-assigned ml_peer_id OR'd with
ATH12K_PEER_ML_ID_VALID, BIT(13) = 0x2000). This happens because
the firmware uses an internal monotonic counter for ML peer IDs that
does not necessarily match the host-assigned ml_peer_id. The desync
has been observed in normal MLO operation and is particularly
reproducible after firmware crash recovery, where the
create-delete-create cycle guarantees the firmware increments its
internal counter.

Currently, ath12k_dp_peer_create() stores the host-assigned
ml_peer_id (with ATH12K_PEER_ML_ID_VALID OR'd in) as dp_peer->peer_id
and immediately populates the dp_peers[] RCU lookup table at that
index. When the firmware later uses a different peer_id in its data
path descriptors, ath12k_dp_peer_find_by_peerid() looks up the wrong
index and returns NULL, causing the "failed to find peer" error on
every TX completion.

Fix this by initializing dp_peer->peer_id to ATH12K_DP_PEER_ID_INVALID
for MLO peers at creation time, deferring the dp_peers[] RCU table
population. When ath12k_dp_peer_find_by_peerid() encounters a lookup
miss for an ML peer_id (one with ATH12K_PEER_ML_ID_VALID set), it
walks dp_peers_list for an MLO peer whose peer_id is still INVALID,
syncs peer_id from the firmware's actual value, and populates the
dp_peers[] table. This lazy sync approach ensures the host always uses
the firmware's real ML peer_id regardless of any internal firmware
counter behavior.

Guard the dp_peers[] RCU table clear in ath12k_dp_peer_delete() and
ath12k_mac_dp_peer_cleanup() against ATH12K_DP_PEER_ID_INVALID to
avoid clearing uninitialized slots. Replace per-peer clear_bit() with
bitmap_zero() in ath12k_mac_dp_peer_cleanup() to avoid out-of-bounds
access when peer_id has not been synced yet.

Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
---
 drivers/net/wireless/ath/ath12k/dp_peer.c | 45 ++++++++++++++++-------
 drivers/net/wireless/ath/ath12k/mac.c     |  7 +++-
 2 files changed, 36 insertions(+), 16 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/dp_peer.c b/drivers/net/wireless/ath/ath12k/dp_peer.c
index 2660b4c7449b..0a7ef81425f5 100644
--- a/drivers/net/wireless/ath/ath12k/dp_peer.c
+++ b/drivers/net/wireless/ath/ath12k/dp_peer.c
@@ -413,8 +413,10 @@ u16 ath12k_dp_peer_get_peerid_index(struct ath12k_dp *dp, u16 peer_id)
 struct ath12k_dp_peer *ath12k_dp_peer_find_by_peerid(struct ath12k_pdev_dp *dp_pdev,
 						     u16 peer_id)
 {
-	u16 index;
+	struct ath12k_dp_hw *dp_hw = dp_pdev->dp_hw;
+	struct ath12k_dp_peer *dp_peer, *tmp;
 	struct ath12k_dp *dp = dp_pdev->dp;
+	u16 index;
 
 	RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
 			 "ath12k dp peer find by peerid index called without rcu lock");
@@ -423,8 +425,23 @@ struct ath12k_dp_peer *ath12k_dp_peer_find_by_peerid(struct ath12k_pdev_dp *dp_p
 		return NULL;
 
 	index = ath12k_dp_peer_get_peerid_index(dp, peer_id);
+	dp_peer = rcu_dereference(dp_hw->dp_peers[index]);
+
+	if (!dp_peer && (peer_id & ATH12K_PEER_ML_ID_VALID)) {
+		spin_lock_bh(&dp_hw->peer_lock);
+		list_for_each_entry(tmp, &dp_hw->dp_peers_list, list) {
+			if (tmp->is_mlo &&
+			    tmp->peer_id == ATH12K_DP_PEER_ID_INVALID) {
+				tmp->peer_id = peer_id;
+				rcu_assign_pointer(dp_hw->dp_peers[index], tmp);
+				dp_peer = tmp;
+				break;
+			}
+		}
+		spin_unlock_bh(&dp_hw->peer_lock);
+	}
 
-	return rcu_dereference(dp_pdev->dp_hw->dp_peers[index]);
+	return dp_peer;
 }
 EXPORT_SYMBOL(ath12k_dp_peer_find_by_peerid);
 
@@ -472,11 +489,11 @@ int ath12k_dp_peer_create(struct ath12k_dp_hw *dp_hw, u8 *addr,
 	dp_peer->is_mlo = params->is_mlo;
 
 	/*
-	 * For MLO client, the host assigns the ML peer ID, so set peer_id in dp_peer
-	 * For non-MLO client, host gets link peer ID from firmware and will be
-	 * assigned at the time of link peer creation
+	 * peer_id starts as INVALID for both MLO and non-MLO clients.
+	 * For MLO: synced from firmware's first data path descriptor.
+	 * For non-MLO: assigned at the time of link peer creation.
 	 */
-	dp_peer->peer_id = params->is_mlo ? params->peer_id : ATH12K_DP_PEER_ID_INVALID;
+	dp_peer->peer_id = ATH12K_DP_PEER_ID_INVALID;
 	dp_peer->ucast_ra_only = params->ucast_ra_only;
 
 	dp_peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
@@ -488,15 +505,12 @@ int ath12k_dp_peer_create(struct ath12k_dp_hw *dp_hw, u8 *addr,
 	list_add(&dp_peer->list, &dp_hw->dp_peers_list);
 
 	/*
-	 * For MLO client, the peer_id for ath12k_dp_peer is allocated by host
-	 * and that peer_id is known at this point, and hence this ath12k_dp_peer
-	 * can be added to the RCU table using the peer_id.
+	 * For MLO client, the dp_peers[] RCU table entry will be populated
+	 * when the firmware's actual peer_id is learned from the first data
+	 * path descriptor (in ath12k_dp_peer_find_by_peerid).
 	 * For non-MLO client, this addition to RCU table shall be done at the
 	 * time of assignment of ath12k_dp_link_peer to ath12k_dp_peer.
 	 */
-	if (dp_peer->is_mlo)
-		rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id], dp_peer);
-
 	spin_unlock_bh(&dp_hw->peer_lock);
 
 	return 0;
@@ -515,8 +529,11 @@ void ath12k_dp_peer_delete(struct ath12k_dp_hw *dp_hw, u8 *addr,
 		return;
 	}
 
-	if (dp_peer->is_mlo)
-		rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id], NULL);
+	if (dp_peer->is_mlo) {
+		if (dp_peer->peer_id != ATH12K_DP_PEER_ID_INVALID)
+			rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id],
+					   NULL);
+	}
 
 	list_del(&dp_peer->list);
 
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 3fa62deb8186..aa03491fb59a 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -1287,13 +1287,16 @@ void ath12k_mac_dp_peer_cleanup(struct ath12k_hw *ah)
 	spin_lock_bh(&dp_hw->peer_lock);
 	list_for_each_entry_safe(dp_peer, tmp, &dp_hw->dp_peers_list, list) {
 		if (dp_peer->is_mlo) {
-			rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id], NULL);
-			clear_bit(dp_peer->peer_id, ah->free_ml_peer_id_map);
+			if (dp_peer->peer_id != ATH12K_DP_PEER_ID_INVALID)
+				rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id],
+						   NULL);
 		}
 
 		list_move(&dp_peer->list, &peers);
 	}
 
+	bitmap_zero(ah->free_ml_peer_id_map, ATH12K_MAX_MLO_PEERS);
+
 	spin_unlock_bh(&dp_hw->peer_lock);
 
 	synchronize_rcu();
-- 
2.54.0