[PATCH ath-next] wifi: ath12k: fix rx_mpdu_start layout for QCC2072

From: Wei Zhang

Date: Mon Jun 29 2026 - 02:20:13 EST


QCC2072's rx_mpdu_start TLV has a different field layout from QCN9274.
Reusing struct rx_mpdu_start_qcn9274 in hal_rx_desc_qcc2072 causes the
RX datapath to read the wrong offsets for info2, info4, pn[] and
phy_ppdu_id, producing corrupted sequence number, PN, ppdu_id and
mpdu-info flags (encrypted, fragment, addr2/addr4 valid).

Add a dedicated struct rx_mpdu_start_qcc2072 that matches the actual
hardware descriptor layout, and use it in hal_rx_desc_qcc2072.

Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0.c2-00188-QCACOLSWPL_V1_TO_SILICONZ-1

Fixes: 28badc78142e ("wifi: ath12k: add HAL descriptor and ops for QCC2072")
Signed-off-by: Wei Zhang <wei.zhang@xxxxxxxxxxxxxxxx>
---
.../wireless/ath/ath12k/wifi7/hal_rx_desc.h | 34 ++++++++++++++++++-
1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hal_rx_desc.h b/drivers/net/wireless/ath/ath12k/wifi7/hal_rx_desc.h
index 0d19a9cbb68c..6d69851e529d 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hal_rx_desc.h
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hal_rx_desc.h
@@ -140,6 +140,38 @@ struct rx_mpdu_start_qcn9274 {
__le32 res1;
} __packed;

+struct rx_mpdu_start_qcc2072 {
+ __le32 info0;
+ __le32 info2;
+ __le32 reo_queue_desc_lo;
+ __le32 info1;
+ __le32 pn[4];
+ __le32 info4;
+ __le32 peer_meta_data;
+ __le16 ast_index;
+ __le16 sw_peer_id;
+ __le16 info3;
+ __le16 phy_ppdu_id;
+ __le32 info5;
+ __le32 info6;
+ __le16 frame_ctrl;
+ __le16 duration;
+ u8 addr1[ETH_ALEN];
+ u8 addr2[ETH_ALEN];
+ u8 addr3[ETH_ALEN];
+ __le16 seq_ctrl;
+ u8 addr4[ETH_ALEN];
+ __le16 qos_ctrl;
+ __le32 ht_ctrl;
+ __le32 info7;
+ __le32 res0;
+ __le32 res1;
+ __le32 res2;
+ __le32 info8;
+ __le32 res3;
+ __le32 res4;
+} __packed;
+
#define QCN9274_MPDU_START_SELECT_MPDU_START_TAG BIT(0)
#define QCN9274_MPDU_START_SELECT_INFO0_REO_QUEUE_DESC_LO BIT(1)
#define QCN9274_MPDU_START_SELECT_INFO1_PN_31_0 BIT(2)
@@ -1492,7 +1524,7 @@ struct hal_rx_desc_qcc2072 {
struct rx_msdu_end_qcn9274 msdu_end;
u8 rx_padding0[RX_BE_PADDING0_BYTES];
__le32 mpdu_start_tag;
- struct rx_mpdu_start_qcn9274 mpdu_start;
+ struct rx_mpdu_start_qcc2072 mpdu_start;
struct rx_pkt_hdr_tlv_qcc2072 pkt_hdr_tlv;
u8 msdu_payload[];
};

base-commit: 1547a99cd8d8c1ab3e04dbd92b72b3b5f7cb85a9
--
2.34.1