[PATCH ath-next v3] wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session

[Baochen Qiang]

On 3/19/2026 2:56 PM, Reshma Immaculate Rajkumar wrote:
> During ongoing traffic, a request to stop an AMPDU session
> for one TID could incorrectly affect other active sessions.
> This can happen because an incorrect TID reference would be
> passed when updating the BA session state, causing the wrong
> session to be stopped. As a result, the affected session would
> be reduced to a minimal BA size, leading to a noticeable
> throughput degradation.
> 
> Fix this issue by passing the correct argument from
> ath11k_dp_rx_ampdu_stop() to ath11k_peer_rx_tid_reo_update()
> during a stop AMPDU session. Instead of passing peer->tx_tid, which
> is the base address of the array, corresponding to TID 0; pass
> the value of &peer->rx_tid[params->tid], where the different TID numbers
> are accounted for.
> 
> Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
> 
> Fixes: d5c65159f2895 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Reshma Immaculate Rajkumar <reshma.rajkumar at oss.qualcomm.com>
> ---
> v2:
> * Added QTI yearless copyright
> v3:
> * Removed QUIC copyright information
> ---
>  drivers/net/wireless/ath/ath11k/dp_rx.c | 15 +++++++--------
>  1 file changed, 7 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
> index 49d959b2e148..85defe11750d 100644
> --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
> +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
> @@ -1,7 +1,7 @@
>  // SPDX-License-Identifier: BSD-3-Clause-Clear
>  /*
>   * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
> - * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
> + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
>   */
>  
>  #include <linux/ieee80211.h>
> @@ -1110,9 +1110,8 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
>  	struct ath11k_base *ab = ar->ab;
>  	struct ath11k_peer *peer;
>  	struct ath11k_sta *arsta = ath11k_sta_to_arsta(params->sta);
> +	struct dp_rx_tid *rx_tid;
>  	int vdev_id = arsta->arvif->vdev_id;
> -	dma_addr_t paddr;
> -	bool active;
>  	int ret;
>  
>  	spin_lock_bh(&ab->base_lock);
> @@ -1124,15 +1123,14 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
>  		return -ENOENT;
>  	}
>  
> -	paddr = peer->rx_tid[params->tid].paddr;
> -	active = peer->rx_tid[params->tid].active;
> +	rx_tid = &peer->rx_tid[params->tid];
>  
> -	if (!active) {
> +	if (!rx_tid->active) {
>  		spin_unlock_bh(&ab->base_lock);
>  		return 0;
>  	}
>  
> -	ret = ath11k_peer_rx_tid_reo_update(ar, peer, peer->rx_tid, 1, 0, false);
> +	ret = ath11k_peer_rx_tid_reo_update(ar, peer, rx_tid, 1, 0, false);
>  	spin_unlock_bh(&ab->base_lock);
>  	if (ret) {
>  		ath11k_warn(ab, "failed to update reo for rx tid %d: %d\n",
> @@ -1141,7 +1139,8 @@ int ath11k_dp_rx_ampdu_stop(struct ath11k *ar,
>  	}
>  
>  	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id,
> -						     params->sta->addr, paddr,
> +						     params->sta->addr,
> +						     rx_tid->paddr,
>  						     params->tid, 1, 1);
>  	if (ret)
>  		ath11k_warn(ab, "failed to send wmi to delete rx tid %d\n",
> 
> base-commit: 7bbb578fc43e7dcb8690cfc98844bd67bc311e8a

Reviewed-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>