[ath9k-devel] [PATCH 0/2] ath10k: htt fixes

[ath9k-devel] [PATCH 0/2] ath10k: htt fixes

[Michal Kazior]

This one addresses a rare memory leak when FW
hangs leaving some HTT tx transactions unfinished.

Michal Kazior (2):
  ath10k: clear pending_tx[] upon tx completion
  ath10k: cleanup htt pending tx

 drivers/net/wireless/ath/ath10k/htt_tx.c |   28 ++++++++++++++++++++++++++++
 drivers/net/wireless/ath/ath10k/txrx.c   |    1 +
 2 files changed, 29 insertions(+)

-- 
1.7.9.5

[ath9k-devel] [PATCH 1/2] ath10k: clear pending_tx[] upon tx completion

[Michal Kazior]

We validate the pending_tx[] upon tx completion so
it makes sense to clear the items.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
---
 drivers/net/wireless/ath/ath10k/txrx.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index ea99d06..cfe3b52 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -93,6 +93,7 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc)
 
 exit:
 	spin_lock_bh(&htt->tx_lock);
+	htt->pending_tx[ATH10K_SKB_CB(txdesc)->htt.msdu_id] = NULL;
 	ath10k_htt_tx_free_msdu_id(htt, ATH10K_SKB_CB(txdesc)->htt.msdu_id);
 	if (bitmap_empty(htt->used_msdu_ids, HTT_MAX_NUM_PENDING_TX))
 		wake_up(&htt->empty_tx_wq);
-- 
1.7.9.5

[ath9k-devel] [PATCH 2/2] ath10k: cleanup htt pending tx

[Michal Kazior]

This fixes memory leak. It could be seen in the
following scenario:

 * submit htt tx frame
 * receive htc tx completion
 * FW hangs
 * rmmod
 * txed frame never freed

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
---
 drivers/net/wireless/ath/ath10k/htt_tx.c |   28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 2058923..7ac3681 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -53,8 +53,36 @@ void ath10k_htt_tx_attach(struct ath10k_htt *htt)
 	init_waitqueue_head(&htt->empty_tx_wq);
 }
 
+static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
+{
+	struct sk_buff *txdesc;
+	int msdu_id;
+
+	/* No locks needed. Called after communication with the device has
+	 * been stopped. */
+
+	for (msdu_id = 0; msdu_id < HTT_MAX_NUM_PENDING_TX; msdu_id++) {
+		if (!test_bit(msdu_id, htt->used_msdu_ids))
+			continue;
+
+		txdesc = htt->pending_tx[msdu_id];
+		if (!txdesc)
+			continue;
+
+		ath10k_dbg(ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n",
+			   msdu_id);
+
+		if (ATH10K_SKB_CB(txdesc)->htt.refcount > 0)
+			ATH10K_SKB_CB(txdesc)->htt.refcount = 1;
+
+		ATH10K_SKB_CB(txdesc)->htt.discard = true;
+		ath10k_txrx_tx_unref(htt, txdesc);
+	}
+}
+
 void ath10k_htt_tx_detach(struct ath10k_htt *htt)
 {
+	ath10k_htt_tx_cleanup_pending(htt);
 	return;
 }
 
-- 
1.7.9.5

[ath9k-devel] [PATCH 0/2] ath10k: htt fixes

[Kalle Valo]

Michal Kazior <michal.kazior@tieto.com> writes:

> This one addresses a rare memory leak when FW
> hangs leaving some HTT tx transactions unfinished.
>
> Michal Kazior (2):
>   ath10k: clear pending_tx[] upon tx completion
>   ath10k: cleanup htt pending tx

Thanks, applied.

-- 
Kalle Valo