From owner-freebsd-wireless@FreeBSD.ORG Fri Aug 19 04:20:53 2011 Return-Path: Delivered-To: freebsd-wireless@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BDEB8106564A for ; Fri, 19 Aug 2011 04:20:53 +0000 (UTC) (envelope-from moonlightakkiy@yahoo.ca) Received: from nm7.bullet.mail.bf1.yahoo.com (nm7.bullet.mail.bf1.yahoo.com [98.139.212.166]) by mx1.freebsd.org (Postfix) with SMTP id 6A33A8FC08 for ; Fri, 19 Aug 2011 04:20:53 +0000 (UTC) Received: from [98.139.212.147] by nm7.bullet.mail.bf1.yahoo.com with NNFMP; 19 Aug 2011 04:20:52 -0000 Received: from [98.139.212.209] by tm4.bullet.mail.bf1.yahoo.com with NNFMP; 19 Aug 2011 04:20:52 -0000 Received: from [127.0.0.1] by omp1018.mail.bf1.yahoo.com with NNFMP; 19 Aug 2011 04:20:52 -0000 X-Yahoo-Newman-Id: 896189.28068.bm@omp1018.mail.bf1.yahoo.com Received: (qmail 7048 invoked from network); 19 Aug 2011 04:20:52 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.ca; h=DKIM-Signature:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Received:MIME-Version:Received:Received:In-Reply-To:References:Date:Message-ID:Subject:From:To:Cc:Content-Type; b=zvuyOScMiB30B9cQ0HpEaZdhImGpAmMYa7jWAv72sGgYi5xi0AFC6FwQlOdIuAahg8gx0oexVdlnqEUfdEWc+XjSkpT9aWpC+UaNbPbKU/DGkFygG728sgkiUVPnlqEPxAF6DVJab22N9/R20bGXju1daK2MiWX1MU3MoeKM8R4= ; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.ca; s=s1024; t=1313727652; bh=Z8LkfYLwLS7DrAUtDO49x+t1dLX4VNbosbFodGvqLWc=; h=X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Received:MIME-Version:Received:Received:In-Reply-To:References:Date:Message-ID:Subject:From:To:Cc:Content-Type; b=V63Wox8vZX+6PpaHdiagfAm0vIMzQ2i9MvSy9V21nxaS5Gbl4yAAf5LTkueVGmXKW6WXjzZNomNPyNGONPwYWXcbDtkdu8lN8v42EvNNad9rrlA6bGSmqO3FOrCbJeLEmXmswCL4s/PHo36H89rtcVu4HN0D2um28lWVT4lQgnU= X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: ZYlvT_4VM1mcMKRb0FOSC2p42bu_FK626utc1wfRHUfP6qR YUlAkmdQNBsdziG2oy98G6zeM8qWkqWEKaK_SCtIktLdQTHYfFRMr_hIz0mK yFpQ_QdfS3DXwV40QxqtUaohlWPpnb.twZelTrKbVb83.CbseB___e6FMkOw PxI9OFGaBOnroAPjh_706q9zxySHIO._meCTH80FFANkhXcO1tizOKasxdyF elcXQQxIYKi.rvikzBzzIjEe4Zryuzcmz2UYtxDm9us.G5bchWTQ.us7a_tH OWDMV0GdLH_BnGWM_AzvPRe820naPEclqAmyJZZi2FhHWChkh5un.nQm0kGP 0FfboYXLQEfwq7rNiUUEwxXDo2_XGNbifbHGyAb3nbbJdyETvCqldgAliHeD EckmEd2exzRRfjZRNuCFOmPo- X-Yahoo-SMTP: Xr6qjFWswBAEmd20sAvB4Q3keqXvXsIH9TjJ Received: from mail-vx0-f182.google.com (moonlightakkiy@209.85.220.182 with plain) by smtp209.mail.bf1.yahoo.com with SMTP; 18 Aug 2011 21:20:52 -0700 PDT Received: by vxh11 with SMTP id 11so2979577vxh.13 for ; Thu, 18 Aug 2011 21:20:52 -0700 (PDT) MIME-Version: 1.0 Received: by 10.52.77.8 with SMTP id o8mr1649780vdw.152.1313727652372; Thu, 18 Aug 2011 21:20:52 -0700 (PDT) Received: by 10.52.187.195 with HTTP; Thu, 18 Aug 2011 21:20:52 -0700 (PDT) In-Reply-To: References: Date: Thu, 18 Aug 2011 22:20:52 -0600 Message-ID: From: PseudoCylon To: Adrian Chadd Content-Type: text/plain; charset=ISO-8859-1 Cc: freebsd-wireless@freebsd.org Subject: Re: ieee80211_process_callback() use in drivers X-BeenThere: freebsd-wireless@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussions of 802.11 stack, tools device driver development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2011 04:20:53 -0000 On Wed, Aug 17, 2011 at 8:31 PM, Adrian Chadd wrote: > On 18 August 2011 10:10, PseudoCylon wrote: > >>> Hm, I fixed the status check in the BAR TX routines. >>> Is that enough? Or are you saying that the node ref is freed somewhere >>> inside ic_raw_xmit() on a TX failure? >> >> Sorry, I found the commit after replied. >> >> But, drivers call ieee80211_free_node() in ic_raw_xmit() on failure. > > Hm, so we can't kill the free, because ieee80211_ref_node() is called early on. > So if ic->ic_raw_xmit(), just return ret, rather then "goto bad" ? > Other mgmt frame Tx functions, i.e ieee80211_send_mgmt(), refs node and expects ic_raw_xmit() to free node whether on success or on failure. So, drivers free node after calling ieee80211_process_callback() or in ic_raw_xmit() on failure. So, ref count is kept balanced. But, ieee80211_send_bar() frees node. So that, on failure in ic_raw_xmit(), drivers need first to test if it is a BAR frame. If not, free node; if so, don't free node because ieee80211_send_bar() does by its self. Otherwise node would be freed twice on one ref.