RE: [PATCH rtw-next 5/6] wifi: rtw89: process TX wait skbs for USB via C2H handler

[Ping-Ke Shih <pkshih@realtek.com>]

Fedor Pchelkin <pchelkin@ispras.ru> wrote:
> TX wait skbs need to be completed when they are done.  PCIe part does this
> inside rtw89_pci_tx_status() during RPP processing.  Other HCIs use a
> mechanism based on C2H firmware messages.
> 
> Store a sequence number in a TX wait object so that it'll be possible to
> identify completed items inside C2H handler.  No need to add the
> corresponding skb to the &txcb->tx_ack_queue on USB part.
> 
> Found by Linux Verification Center (linuxtesting.org).
> 
> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>

[...]

> diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
> index 831e53aedccc..79409eb4d028 100644
> --- a/drivers/net/wireless/realtek/rtw89/mac.c
> +++ b/drivers/net/wireless/realtek/rtw89/mac.c
> @@ -5477,6 +5477,7 @@ rtw89_mac_c2h_tx_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
>  {
>         u8 sw_define = RTW89_GET_MAC_C2H_TX_RPT_SW_DEFINE(c2h->data);
>         u8 tx_status = RTW89_GET_MAC_C2H_TX_RPT_TX_STATE(c2h->data);
> +       struct rtw89_tx_wait_info *wait;
>         struct sk_buff *cur, *tmp;
>         unsigned long flags;
>         u8 *n;
> @@ -5485,6 +5486,16 @@ rtw89_mac_c2h_tx_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
>                     "C2H TX RPT: sn %d, tx_status %d\n",
>                     sw_define, tx_status);
> 
> +       rcu_read_lock();
> +       list_for_each_entry_rcu(wait, &rtwdev->tx_waits, list) {
> +               if (wait->sn == sw_define) {
> +                       wait->tx_done = tx_status == RTW89_TX_DONE;
> +                       complete_all(&wait->completion);
> +                       break;
> +               }
> +       }
> +       rcu_read_unlock();
> +

Since we can get 'wait' from RTW89_TX_SKB_CB(), can we just use
rtwdev->tx_rpt_queue?

Also, call rtw89_core_tx_wait_complete() to complete wait?

>         spin_lock_irqsave(&rtwdev->tx_rpt_queue.lock, flags);
>         skb_queue_walk_safe(&rtwdev->tx_rpt_queue, cur, tmp) {
>                 n = (u8 *)RTW89_TX_SKB_CB(cur)->hci_priv;