Fix iwx_ampdu_rx_stop() for multiple Rx BA sessions.

Marking a TID in the bitmask needs |=, not the = operator, duh.
As a result our ba_task only stopped one session even though multiple
sessions were supposed to be stopped. Now driver and firmware had
become out of sync in their tracking of Rx BA session state, and
firmware crashed with sysassert 0x00004472 when the driver later
attempted to start an already active Rx BA session again.

Problem reported by Anton Kasimov.
Thanks to Johannes Berg from Intel who looked up the meaning
of sysassert code 0x00004472 for me.

diff --git a/sys/dev/pci/if_iwx.c b/sys/dev/pci/if_iwx.c
index b663f90..9497ddb 100644 (file)
--- a/sys/dev/pci/if_iwx.c
+++ b/sys/dev/pci/if_iwx.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: if_iwx.c,v 1.148 2022/05/13 08:48:40 stsp Exp $       */
+/*     $OpenBSD: if_iwx.c,v 1.149 2022/05/14 05:42:39 stsp Exp $       */
 
 /*
  * Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -3653,7 +3653,7 @@ iwx_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
        if (tid >= IWX_MAX_TID_COUNT || sc->ba_rx.stop_tidmask & (1 << tid))
                return;
 
-       sc->ba_rx.stop_tidmask = (1 << tid);
+       sc->ba_rx.stop_tidmask |= (1 << tid);
        iwx_add_task(sc, systq, &sc->ba_task);
 }