* [PATCH v4] wifi: ath11k: fix peer resolution on rx path when peer_id=0
@ 2026-04-24 9:50 Matthew Leach
2026-04-29 7:36 ` Baochen Qiang
0 siblings, 1 reply; 3+ messages in thread
From: Matthew Leach @ 2026-04-24 9:50 UTC (permalink / raw)
To: Jeff Johnson
Cc: Baochen Qiang, Rameshkumar Sundaram, linux-wireless, ath11k,
linux-kernel, kernel, Matthew Leach
It has been observed that on certain chipsets a peer can be assigned
peer_id=0. For reception of non-aggregated MPDUs this is fine as
ath11k_dp_rx_h_find_peer() has a fallback case where it locates the peer
based upon the source MAC address. On an aggregated link, the mpdu_start
header is only populated by hardware on the first sub-MSDU. This causes
the peer resolution to be skipped for the subsequent MSDUs and the
encryption type of these frames to be set to an incorrect value,
resulting in these MSDUs being dropped by ieee80211.
ath11k_pci 0000:03:00.0: data rx skb 000000002f4b704d len 1534 peer xx:xx:xx:xx:xx:xx 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 1 last_msdu 0
ath11k_pci 0000:03:00.0: data rx skb 0000000038acd580 len 1534 peer (null) 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d00 fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 0 last_msdu 1
Remove the null peer_id checks in ath11k_dp_rx_h_find_peer() and
ath11k_hal_rx_parse_mon_status_tlv(), allowing peers with an assigned ID
of 0 to be resolved.
Fixes: 2167fa606c0f ("ath11k: Add support for RX decapsulation offload")
Tested-on: QCA2066 hw2.1 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Signed-off-by: Matthew Leach <matthew.leach@collabora.com>
---
Changes in v4:
- Prefix subsystem with 'wifi:'.
- Added the 'Tested-by' and 'Fixes' trailers.
- Link to v3: https://patch.msgid.link/20260417-ath11k-null-peerid-workaround-v3-1-d04302284486@collabora.com
Changes in v3:
- Clarified that the mpdu_start header isn't populated by the h/w for
all sub-MSDUs in the commit message.
- Fix second null-peer check in ath11k_hal_rx_parse_mon_status_tlv().
- Link to v2: https://patch.msgid.link/20260415-ath11k-null-peerid-workaround-v2-1-2abae3bbac16@collabora.com
Changes in v2:
- Since peer_id=0 is a valid condition on some chips, remove the guard
that prevented the peer lookup.
- Link to v1: https://patch.msgid.link/20260326-ath11k-null-peerid-workaround-v1-1-0c2fd53202f8@collabora.com
To: Jeff Johnson <jjohnson@kernel.org>
Cc: linux-wireless@vger.kernel.org
Cc: ath11k@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
---
drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +--
drivers/net/wireless/ath/ath11k/hal_rx.c | 5 +----
2 files changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 49d959b2e148..ff2c78a4e5f3 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -2215,8 +2215,7 @@ ath11k_dp_rx_h_find_peer(struct ath11k_base *ab, struct sk_buff *msdu)
lockdep_assert_held(&ab->base_lock);
- if (rxcb->peer_id)
- peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
+ peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
if (peer)
return peer;
diff --git a/drivers/net/wireless/ath/ath11k/hal_rx.c b/drivers/net/wireless/ath/ath11k/hal_rx.c
index 753bd93f0212..51e0840bc0d1 100644
--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
+++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
@@ -1467,11 +1467,8 @@ ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
case HAL_RX_MPDU_START: {
struct hal_rx_mpdu_info *mpdu_info =
(struct hal_rx_mpdu_info *)tlv_data;
- u16 peer_id;
- peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
- if (peer_id)
- ppdu_info->peer_id = peer_id;
+ ppdu_info->peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
break;
}
case HAL_RXPCU_PPDU_END_INFO: {
---
base-commit: f338e77383789c0cae23ca3d48adcc5e9e137e3c
change-id: 20260326-ath11k-null-peerid-workaround-625a129781b1
Best regards,
--
Matt
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v4] wifi: ath11k: fix peer resolution on rx path when peer_id=0
2026-04-24 9:50 [PATCH v4] wifi: ath11k: fix peer resolution on rx path when peer_id=0 Matthew Leach
@ 2026-04-29 7:36 ` Baochen Qiang
2026-04-29 10:47 ` Praneesh P
0 siblings, 1 reply; 3+ messages in thread
From: Baochen Qiang @ 2026-04-29 7:36 UTC (permalink / raw)
To: Matthew Leach, Jeff Johnson
Cc: Rameshkumar Sundaram, linux-wireless, ath11k, linux-kernel,
kernel
On 4/24/2026 5:50 PM, Matthew Leach wrote:
> It has been observed that on certain chipsets a peer can be assigned
> peer_id=0. For reception of non-aggregated MPDUs this is fine as
> ath11k_dp_rx_h_find_peer() has a fallback case where it locates the peer
> based upon the source MAC address. On an aggregated link, the mpdu_start
> header is only populated by hardware on the first sub-MSDU. This causes
> the peer resolution to be skipped for the subsequent MSDUs and the
> encryption type of these frames to be set to an incorrect value,
> resulting in these MSDUs being dropped by ieee80211.
>
> ath11k_pci 0000:03:00.0: data rx skb 000000002f4b704d len 1534 peer xx:xx:xx:xx:xx:xx 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 1 last_msdu 0
> ath11k_pci 0000:03:00.0: data rx skb 0000000038acd580 len 1534 peer (null) 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d00 fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 0 last_msdu 1
>
> Remove the null peer_id checks in ath11k_dp_rx_h_find_peer() and
> ath11k_hal_rx_parse_mon_status_tlv(), allowing peers with an assigned ID
> of 0 to be resolved.
>
> Fixes: 2167fa606c0f ("ath11k: Add support for RX decapsulation offload")
> Tested-on: QCA2066 hw2.1 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9
Tested-on: is not an official tag but is ath driver specific, so generally it is put above
all official tags:
Tested-on: ...
<blank line>
Fixes: ...
s-o-b: ...
But since this is trivial I think Jeff can make the change when he merges it, so no need
to respin just for it.
> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> Signed-off-by: Matthew Leach <matthew.leach@collabora.com>
> ---
> Changes in v4:
> - Prefix subsystem with 'wifi:'.
> - Added the 'Tested-by' and 'Fixes' trailers.
> - Link to v3: https://patch.msgid.link/20260417-ath11k-null-peerid-workaround-v3-1-d04302284486@collabora.com
>
> Changes in v3:
> - Clarified that the mpdu_start header isn't populated by the h/w for
> all sub-MSDUs in the commit message.
> - Fix second null-peer check in ath11k_hal_rx_parse_mon_status_tlv().
> - Link to v2: https://patch.msgid.link/20260415-ath11k-null-peerid-workaround-v2-1-2abae3bbac16@collabora.com
>
> Changes in v2:
>
> - Since peer_id=0 is a valid condition on some chips, remove the guard
> that prevented the peer lookup.
> - Link to v1: https://patch.msgid.link/20260326-ath11k-null-peerid-workaround-v1-1-0c2fd53202f8@collabora.com
>
> To: Jeff Johnson <jjohnson@kernel.org>
> Cc: linux-wireless@vger.kernel.org
> Cc: ath11k@lists.infradead.org
> Cc: linux-kernel@vger.kernel.org
> ---
> drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +--
> drivers/net/wireless/ath/ath11k/hal_rx.c | 5 +----
> 2 files changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
> index 49d959b2e148..ff2c78a4e5f3 100644
> --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
> +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
> @@ -2215,8 +2215,7 @@ ath11k_dp_rx_h_find_peer(struct ath11k_base *ab, struct sk_buff *msdu)
>
> lockdep_assert_held(&ab->base_lock);
>
> - if (rxcb->peer_id)
> - peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
> + peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
>
> if (peer)
> return peer;
> diff --git a/drivers/net/wireless/ath/ath11k/hal_rx.c b/drivers/net/wireless/ath/ath11k/hal_rx.c
> index 753bd93f0212..51e0840bc0d1 100644
> --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
> +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
> @@ -1467,11 +1467,8 @@ ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
> case HAL_RX_MPDU_START: {
> struct hal_rx_mpdu_info *mpdu_info =
> (struct hal_rx_mpdu_info *)tlv_data;
> - u16 peer_id;
>
> - peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
> - if (peer_id)
> - ppdu_info->peer_id = peer_id;
> + ppdu_info->peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
> break;
> }
> case HAL_RXPCU_PPDU_END_INFO: {
>
> ---
> base-commit: f338e77383789c0cae23ca3d48adcc5e9e137e3c
> change-id: 20260326-ath11k-null-peerid-workaround-625a129781b1
>
> Best regards,
> --
> Matt
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v4] wifi: ath11k: fix peer resolution on rx path when peer_id=0
2026-04-29 7:36 ` Baochen Qiang
@ 2026-04-29 10:47 ` Praneesh P
0 siblings, 0 replies; 3+ messages in thread
From: Praneesh P @ 2026-04-29 10:47 UTC (permalink / raw)
To: Baochen Qiang, Matthew Leach, Jeff Johnson
Cc: Rameshkumar Sundaram, linux-wireless, ath11k, linux-kernel,
kernel
On 4/29/2026 1:06 PM, Baochen Qiang wrote:
>
> On 4/24/2026 5:50 PM, Matthew Leach wrote:
>> It has been observed that on certain chipsets a peer can be assigned
>> peer_id=0. For reception of non-aggregated MPDUs this is fine as
>> ath11k_dp_rx_h_find_peer() has a fallback case where it locates the peer
>> based upon the source MAC address. On an aggregated link, the mpdu_start
>> header is only populated by hardware on the first sub-MSDU. This causes
>> the peer resolution to be skipped for the subsequent MSDUs and the
>> encryption type of these frames to be set to an incorrect value,
>> resulting in these MSDUs being dropped by ieee80211.
>>
>> ath11k_pci 0000:03:00.0: data rx skb 000000002f4b704d len 1534 peer xx:xx:xx:xx:xx:xx 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 1 last_msdu 0
>> ath11k_pci 0000:03:00.0: data rx skb 0000000038acd580 len 1534 peer (null) 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d00 fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 0 last_msdu 1
>>
>> Remove the null peer_id checks in ath11k_dp_rx_h_find_peer() and
>> ath11k_hal_rx_parse_mon_status_tlv(), allowing peers with an assigned ID
>> of 0 to be resolved.
>>
>> Fixes: 2167fa606c0f ("ath11k: Add support for RX decapsulation offload")
>> Tested-on: QCA2066 hw2.1 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9
> Tested-on: is not an official tag but is ath driver specific, so generally it is put above
> all official tags:
>
> Tested-on: ...
> <blank line>
> Fixes: ...
> s-o-b: ...
>
> But since this is trivial I think Jeff can make the change when he merges it, so no need
> to respin just for it.
For QCN9074, IPQ8074, IPQ5018 and IPQ6018, Peer_id 0 is not a expected
value. Like ath12k, it is better to handle it through hw_params.
>> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
>> Signed-off-by: Matthew Leach <matthew.leach@collabora.com>
>> ---
>> Changes in v4:
>> - Prefix subsystem with 'wifi:'.
>> - Added the 'Tested-by' and 'Fixes' trailers.
>> - Link to v3: https://patch.msgid.link/20260417-ath11k-null-peerid-workaround-v3-1-d04302284486@collabora.com
>>
>> Changes in v3:
>> - Clarified that the mpdu_start header isn't populated by the h/w for
>> all sub-MSDUs in the commit message.
>> - Fix second null-peer check in ath11k_hal_rx_parse_mon_status_tlv().
>> - Link to v2: https://patch.msgid.link/20260415-ath11k-null-peerid-workaround-v2-1-2abae3bbac16@collabora.com
>>
>> Changes in v2:
>>
>> - Since peer_id=0 is a valid condition on some chips, remove the guard
>> that prevented the peer lookup.
>> - Link to v1: https://patch.msgid.link/20260326-ath11k-null-peerid-workaround-v1-1-0c2fd53202f8@collabora.com
>>
>> To: Jeff Johnson <jjohnson@kernel.org>
>> Cc: linux-wireless@vger.kernel.org
>> Cc: ath11k@lists.infradead.org
>> Cc: linux-kernel@vger.kernel.org
>> ---
>> drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +--
>> drivers/net/wireless/ath/ath11k/hal_rx.c | 5 +----
>> 2 files changed, 2 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
>> index 49d959b2e148..ff2c78a4e5f3 100644
>> --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
>> +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
>> @@ -2215,8 +2215,7 @@ ath11k_dp_rx_h_find_peer(struct ath11k_base *ab, struct sk_buff *msdu)
>>
>> lockdep_assert_held(&ab->base_lock);
>>
>> - if (rxcb->peer_id)
>> - peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
>> + peer = ath11k_peer_find_by_id(ab, rxcb->peer_id);
>>
>> if (peer)
>> return peer;
>> diff --git a/drivers/net/wireless/ath/ath11k/hal_rx.c b/drivers/net/wireless/ath/ath11k/hal_rx.c
>> index 753bd93f0212..51e0840bc0d1 100644
>> --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
>> +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
>> @@ -1467,11 +1467,8 @@ ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,
>> case HAL_RX_MPDU_START: {
>> struct hal_rx_mpdu_info *mpdu_info =
>> (struct hal_rx_mpdu_info *)tlv_data;
>> - u16 peer_id;
>>
>> - peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
>> - if (peer_id)
>> - ppdu_info->peer_id = peer_id;
>> + ppdu_info->peer_id = ath11k_hal_rx_mpduinfo_get_peerid(ab, mpdu_info);
>> break;
>> }
>> case HAL_RXPCU_PPDU_END_INFO: {
>>
>> ---
>> base-commit: f338e77383789c0cae23ca3d48adcc5e9e137e3c
>> change-id: 20260326-ath11k-null-peerid-workaround-625a129781b1
>>
>> Best regards,
>> --
>> Matt
>>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-29 10:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-24 9:50 [PATCH v4] wifi: ath11k: fix peer resolution on rx path when peer_id=0 Matthew Leach
2026-04-29 7:36 ` Baochen Qiang
2026-04-29 10:47 ` Praneesh P
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox