RE: [PATCH rtw-next 6/6] wifi: rtw89: forcefully clear TX wait list on HCI reset

[Ping-Ke Shih <pkshih@realtek.com>]

Fedor Pchelkin <pchelkin@ispras.ru> wrote:
> TX status reporting based on firmware messages does not necessarily happen
> when an HCI reset occurs, in contrast to RPP based one where pending skbs
> are forcefully flushed, see rtw89_pci_release_txwd_skb().

Is it possible that USB implement HCI reset as the same behavior? So flow can
be common and people can be easier to understand the driver.

Any limitation of USB subsystem in TX path?

> 
> So for the former case, if completion from the firmware doesn't happen, TX
> wait objects are wastefully piled up in the list and not released.
> Forcefully clear TX wait list on HCI reset then.
> 
> It's okay since wiphy lock is held during HCI reset.  For the RPP case,
> all pending completions were done just before in ->reset callback and no
> new ones can appear.  For the C2H message case, RCU access to the list
> helps.
> 
> Found by Linux Verification Center (linuxtesting.org).
> 
> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
> ---
>  drivers/net/wireless/realtek/rtw89/core.c | 2 +-
>  drivers/net/wireless/realtek/rtw89/core.h | 6 +++---
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
> index e76f04736502..3a0388d3acbf 100644
> --- a/drivers/net/wireless/realtek/rtw89/core.c
> +++ b/drivers/net/wireless/realtek/rtw89/core.c
> @@ -1140,7 +1140,7 @@ static void rtw89_tx_wait_work(struct wiphy *wiphy, struct wiphy_work *work)
>         struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
>                                                 tx_wait_work.work);
> 
> -       rtw89_tx_wait_list_clear(rtwdev);
> +       rtw89_tx_wait_list_clear(rtwdev, false);
>  }
> 
>  void rtw89_core_tx_kick_off(struct rtw89_dev *rtwdev, u8 qsel)
> diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
> index e7948bd0bdf6..0ad871472e79 100644
> --- a/drivers/net/wireless/realtek/rtw89/core.h
> +++ b/drivers/net/wireless/realtek/rtw89/core.h
> @@ -6282,14 +6282,14 @@ static inline void rtw89_tx_wait_release(struct rtw89_tx_wait_info *wait)
>         kfree_rcu(wait, rcu_head);
>  }
> 
> -static inline void rtw89_tx_wait_list_clear(struct rtw89_dev *rtwdev)
> +static inline void rtw89_tx_wait_list_clear(struct rtw89_dev *rtwdev, bool force)
>  {
>         struct rtw89_tx_wait_info *wait, *tmp;
> 
>         lockdep_assert_wiphy(rtwdev->hw->wiphy);
> 
>         list_for_each_entry_safe(wait, tmp, &rtwdev->tx_waits, list) {
> -               if (!completion_done(&wait->completion))
> +               if (!force && !completion_done(&wait->completion))
>                         continue;
>                 list_del_rcu(&wait->list);
>                 rtw89_tx_wait_release(wait);
> @@ -6305,7 +6305,7 @@ static inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev,
>  static inline void rtw89_hci_reset(struct rtw89_dev *rtwdev)
>  {
>         rtwdev->hci.ops->reset(rtwdev);
> -       rtw89_tx_wait_list_clear(rtwdev);
> +       rtw89_tx_wait_list_clear(rtwdev, true);
>         skb_queue_purge(&rtwdev->tx_rpt_queue);
>  }
> 
> --
> 2.51.0
>