From af21319fcda4c43aa89186e0d6001432c5d6000e Mon Sep 17 00:00:00 2001 From: Michal Kazior Date: Thu, 29 Jan 2015 14:29:52 +0200 Subject: [PATCH] ath10k: fix beacon deadlock This should fix a very rare occurrence of the following deadlock: [] ath10k_wmi_tx_beacons_nowait+0x1e/0x50 [ath10k_core] [] ath10k_wmi_op_ep_tx_credits+0x16/0x40 [ath10k_core] [] ath10k_htc_send+0x285/0x3d0 [ath10k_core] [] ath10k_wmi_cmd_send_nowait+0x81/0x110 [ath10k_core] [] ath10k_wmi_tx_beacon_nowait.part.33+0x51/0x90 [ath10k_core] [] ath10k_wmi_tx_beacons_iter+0x30/0x40 [ath10k_core] [] __iterate_active_interfaces+0xa6/0x100 [] ? ath10k_wmi_tx_beacon_nowait.part.33+0x90/0x90 [ath10k_core] [] ieee80211_iterate_active_interfaces_atomic+0xe/0x10 [] ath10k_wmi_tx_beacons_nowait+0x36/0x50 [ath10k_core] [] ath10k_wmi_op_ep_tx_credits+0x16/0x40 [ath10k_core] [] ath10k_htc_rx+0x280/0x410 [ath10k_core] [] ? ath10k_ce_completed_recv_next+0x60/0x80 [ath10k_pci] [] ath10k_pci_ce_recv_data+0x11b/0x1d0 [ath10k_pci] [] ath10k_ce_per_engine_service+0x64/0xc0 [ath10k_pci] [] ath10k_ce_per_engine_service_any+0x22/0x50 [ath10k_pci] [] ath10k_pci_tasklet+0x30/0x90 [ath10k_pci] [] tasklet_action+0xc5/0x100 To prevent this make sure to release ar->data_lock while calling to ath10k_wmi_beacon_send_ref_nowait(). Signed-off-by: Michal Kazior Signed-off-by: Kalle Valo --- drivers/net/wireless/ath/ath10k/core.h | 8 +++- drivers/net/wireless/ath/ath10k/mac.c | 6 ++- drivers/net/wireless/ath/ath10k/wmi.c | 68 +++++++++++++++++++++++----------- 3 files changed, 58 insertions(+), 24 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h index a47b41d..c8ba6bd 100644 --- a/drivers/net/wireless/ath/ath10k/core.h +++ b/drivers/net/wireless/ath/ath10k/core.h @@ -262,6 +262,12 @@ struct ath10k_sta { #define ATH10K_VDEV_SETUP_TIMEOUT_HZ (5*HZ) +enum ath10k_beacon_state { + ATH10K_BEACON_SCHEDULED = 0, + ATH10K_BEACON_SENDING, + ATH10K_BEACON_SENT, +}; + struct ath10k_vif { struct list_head list; @@ -272,7 +278,7 @@ struct ath10k_vif { u32 dtim_period; struct sk_buff *beacon; /* protected by data_lock */ - bool beacon_sent; + enum ath10k_beacon_state beacon_state; void *beacon_buf; dma_addr_t beacon_paddr; diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index d3fe1a3..d0d882d 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -531,10 +531,14 @@ void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif) dma_unmap_single(ar->dev, ATH10K_SKB_CB(arvif->beacon)->paddr, arvif->beacon->len, DMA_TO_DEVICE); + if (WARN_ON(arvif->beacon_state != ATH10K_BEACON_SCHEDULED && + arvif->beacon_state != ATH10K_BEACON_SENT)) + return; + dev_kfree_skb_any(arvif->beacon); arvif->beacon = NULL; - arvif->beacon_sent = false; + arvif->beacon_state = ATH10K_BEACON_SCHEDULED; } static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif) diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c index 01c0230..d6c5b42 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.c +++ b/drivers/net/wireless/ath/ath10k/wmi.c @@ -956,30 +956,45 @@ err_pull: static void ath10k_wmi_tx_beacon_nowait(struct ath10k_vif *arvif) { - struct sk_buff *bcn; + struct ath10k *ar = arvif->ar; struct ath10k_skb_cb *cb; + struct sk_buff *bcn; int ret; - lockdep_assert_held(&arvif->ar->data_lock); + spin_lock_bh(&ar->data_lock); - if (arvif->beacon == NULL) - return; + bcn = arvif->beacon; - if (arvif->beacon_sent) - return; + if (!bcn) + goto unlock; - bcn = arvif->beacon; cb = ATH10K_SKB_CB(bcn); - ret = ath10k_wmi_beacon_send_ref_nowait(arvif->ar, arvif->vdev_id, - bcn->data, bcn->len, cb->paddr, - cb->bcn.dtim_zero, - cb->bcn.deliver_cab); - if (ret) - return; - /* We need to retain the arvif->beacon reference for DMA unmapping and - * freeing the skbuff later. */ - arvif->beacon_sent = true; + switch (arvif->beacon_state) { + case ATH10K_BEACON_SENDING: + case ATH10K_BEACON_SENT: + break; + case ATH10K_BEACON_SCHEDULED: + arvif->beacon_state = ATH10K_BEACON_SENDING; + spin_unlock_bh(&ar->data_lock); + + ret = ath10k_wmi_beacon_send_ref_nowait(arvif->ar, + arvif->vdev_id, + bcn->data, bcn->len, + cb->paddr, + cb->bcn.dtim_zero, + cb->bcn.deliver_cab); + + spin_lock_bh(&ar->data_lock); + + if (ret == 0) + arvif->beacon_state = ATH10K_BEACON_SENT; + else + arvif->beacon_state = ATH10K_BEACON_SCHEDULED; + } + +unlock: + spin_unlock_bh(&ar->data_lock); } static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac, @@ -992,12 +1007,10 @@ static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac, static void ath10k_wmi_tx_beacons_nowait(struct ath10k *ar) { - spin_lock_bh(&ar->data_lock); ieee80211_iterate_active_interfaces_atomic(ar->hw, IEEE80211_IFACE_ITER_NORMAL, ath10k_wmi_tx_beacons_iter, NULL); - spin_unlock_bh(&ar->data_lock); } static void ath10k_wmi_op_ep_tx_credits(struct ath10k *ar) @@ -2459,9 +2472,19 @@ void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb) spin_lock_bh(&ar->data_lock); if (arvif->beacon) { - if (!arvif->beacon_sent) - ath10k_warn(ar, "SWBA overrun on vdev %d\n", + switch (arvif->beacon_state) { + case ATH10K_BEACON_SENT: + break; + case ATH10K_BEACON_SCHEDULED: + ath10k_warn(ar, "SWBA overrun on vdev %d, skipped old beacon\n", + arvif->vdev_id); + break; + case ATH10K_BEACON_SENDING: + ath10k_warn(ar, "SWBA overrun on vdev %d, skipped new beacon\n", arvif->vdev_id); + dev_kfree_skb(bcn); + goto skip; + } ath10k_mac_vif_beacon_free(arvif); } @@ -2489,15 +2512,16 @@ void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb) } arvif->beacon = bcn; - arvif->beacon_sent = false; + arvif->beacon_state = ATH10K_BEACON_SCHEDULED; trace_ath10k_tx_hdr(ar, bcn->data, bcn->len); trace_ath10k_tx_payload(ar, bcn->data, bcn->len); - ath10k_wmi_tx_beacon_nowait(arvif); skip: spin_unlock_bh(&ar->data_lock); } + + ath10k_wmi_tx_beacons_nowait(ar); } void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar, struct sk_buff *skb) -- 2.7.4