Re: [PATCH ath-current] wifi: ath12k: Fix low MLO RX throughput on WCN7850

[Baochen Qiang <baochen.qiang@oss.qualcomm.com>]

On 6/10/2026 1:33 PM, Yingying Tang wrote:
> Commit [1] introduced a regression causing severely degraded MLO RX
> throughput on WCN7850.
> 
> On WCN7850, there is only a single ar instance, but MLO uses two
> link IDs. ath12k_dp_peer->hw_links[] is indexed using ar->hw_link_id,
> which causes both MLO link IDs to be stored at the same index.
> 
> As a result, an incorrect link ID is assigned to MSDUs in
> ath12k_dp_rx_deliver_msdu(), leading to severe MLO RX throughput loss.
> 
> Different chipsets identify the per-MSDU link differently:
> 
>   - On QCN9274 / IPQ5332, the host owns multiple ar instances and the
>     per-MSDU hw_link_id from the RX descriptor maps cleanly through
>     dp_peer->hw_links[hw_link_id] to the IEEE link_id.
> 
>   - On single-ar chipsets like WCN7850 / QCC2072, there is only one ar
>     instance for both MLO links, so dp_peer->hw_links[] has just one
>     valid slot and cannot be used to distinguish the two links. To
>     resolve the link, walk dp_peer->link_peers[] and match by
>     rxcb->peer_id, which on the link_peer side identifies the link
>     peer for the MSDU.
> 
> Add a new hw_op set_rx_link_id() so each chipset resolves the link
> on the RX fast path using whatever signal it actually has, and let
> the op itself decide whether to populate rx_status::link_valid and
> rx_status::link_id:
> 
>   QCN9274 / IPQ5332 : always derive link_id from
>                       dp_peer->hw_links[rxcb->hw_link_id] and set
>                       link_valid.
>   WCN7850 / QCC2072 : walk the link_peers[] of dp_peer to find the
>                       link_peer whose peer_id matches rxcb->peer_id,
>                       and set link_valid only when a match is found.
>                       Otherwise leave link_valid clear so that
>                       mac80211 can fall back to its own link
>                       resolution path (via addr2 / deflink).
> 
> For WCN7850 / QCC2072, walking dp_peer->link_peers[] is bounded by
> the number of links actually populated, so introduce a link_peers_map
> bitmap (unsigned long) in struct ath12k_dp_peer that tracks populated
> slots and use for_each_set_bit() to iterate. Non-MLO clients hit one
> slot, current MLO clients hit two; the full ATH12K_NUM_MAX_LINKS
> array is never scanned. The bitmap is maintained with WRITE_ONCE() on
> the write side (under dp_hw->peer_lock) paired with READ_ONCE() on
> both the lockless RX read side and the write-side RMW for KCSAN
> correctness.
> 
> Also guard the dp_peer dereference in ath12k_mac_peer_cleanup_all()
> with a NULL check, since peer->dp_peer can be NULL for self-peers or
> peers not yet fully assigned, the pre-existing rcu_assign_pointer()
> call there had the same latent issue.
> 
> This restores the correct link ID on WCN7850 without changing the
> QCN9274 / IPQ5332 data path, which keeps its O(1) hw_links[]
> indexing.
> 
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
> 
> Fixes: 11157e0910fd ("wifi: ath12k: Use ath12k_dp_peer in per packet Tx & Rx paths") # [1]
> Signed-off-by: Yingying Tang <yingying.tang@oss.qualcomm.com>

Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>