1 --- a/drivers/net/wireless/ath/ath9k/xmit.c
2 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
3 @@ -61,6 +61,8 @@ static int ath_tx_num_badfrms(struct ath
4 struct ath_tx_status *ts, int txok);
5 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
6 int nbad, int txok, bool update_rc);
7 +static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
12 @@ -144,18 +146,23 @@ static void ath_tx_flush_tid(struct ath_
13 struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
15 struct list_head bf_head;
16 - INIT_LIST_HEAD(&bf_head);
17 + struct ath_tx_status ts;
19 - WARN_ON(!tid->paused);
20 + INIT_LIST_HEAD(&bf_head);
22 + memset(&ts, 0, sizeof(ts));
23 spin_lock_bh(&txq->axq_lock);
24 - tid->paused = false;
26 while (!list_empty(&tid->buf_q)) {
27 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
28 - BUG_ON(bf_isretried(bf));
29 list_move_tail(&bf->list, &bf_head);
30 - ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
32 + if (bf_isretried(bf)) {
33 + ath_tx_update_baw(sc, tid, bf->bf_seqno);
34 + ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
36 + ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
40 spin_unlock_bh(&txq->axq_lock);
41 @@ -430,7 +437,7 @@ static void ath_tx_complete_aggr(struct
42 list_move_tail(&bf->list, &bf_head);
46 + if (!txpending || (tid->state & AGGR_CLEANUP)) {
48 * complete the acked-ones/xretried ones; update
50 @@ -451,6 +458,7 @@ static void ath_tx_complete_aggr(struct
53 /* retry the un-acked ones */
55 if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)) {
56 if (bf->bf_next == NULL && bf_last->bf_stale) {
58 @@ -509,15 +517,12 @@ static void ath_tx_complete_aggr(struct
61 if (tid->state & AGGR_CLEANUP) {
62 + ath_tx_flush_tid(sc, tid);
64 if (tid->baw_head == tid->baw_tail) {
65 tid->state &= ~AGGR_ADDBA_COMPLETE;
66 tid->state &= ~AGGR_CLEANUP;
68 - /* send buffered frames as singles */
69 - ath_tx_flush_tid(sc, tid);
76 @@ -808,12 +813,6 @@ void ath_tx_aggr_stop(struct ath_softc *
77 struct ath_node *an = (struct ath_node *)sta->drv_priv;
78 struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
79 struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
80 - struct ath_tx_status ts;
82 - struct list_head bf_head;
84 - memset(&ts, 0, sizeof(ts));
85 - INIT_LIST_HEAD(&bf_head);
87 if (txtid->state & AGGR_CLEANUP)
89 @@ -823,31 +822,22 @@ void ath_tx_aggr_stop(struct ath_softc *
93 - /* drop all software retried frames and mark this TID */
94 spin_lock_bh(&txq->axq_lock);
96 - while (!list_empty(&txtid->buf_q)) {
97 - bf = list_first_entry(&txtid->buf_q, struct ath_buf, list);
98 - if (!bf_isretried(bf)) {
100 - * NB: it's based on the assumption that
101 - * software retried frame will always stay
102 - * at the head of software queue.
106 - list_move_tail(&bf->list, &bf_head);
107 - ath_tx_update_baw(sc, txtid, bf->bf_seqno);
108 - ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
110 - spin_unlock_bh(&txq->axq_lock);
112 - if (txtid->baw_head != txtid->baw_tail) {
114 + * If frames are still being transmitted for this TID, they will be
115 + * cleaned up during tx completion. To prevent race conditions, this
116 + * TID can only be reused after all in-progress subframes have been
119 + if (txtid->baw_head != txtid->baw_tail)
120 txtid->state |= AGGR_CLEANUP;
123 txtid->state &= ~AGGR_ADDBA_COMPLETE;
124 - ath_tx_flush_tid(sc, txtid);
126 + spin_unlock_bh(&txq->axq_lock);
128 + ath_tx_flush_tid(sc, txtid);
131 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)