From 2a372d279baf466c903ba53b11c07ed4cc558bbb Mon Sep 17 00:00:00 2001
From: Manoj Ekbote <mekbote@codeaurora.org>
Date: Thu, 29 Jun 2017 14:54:57 -0700
Subject: [PATCH] qcacmn: Flush the REO cmd list during detach

When suspend is done, and if there are any outstanding
REO commands to HW, there could be a leak from allocated
buffers. FLush the buffer list during detach.

Change-Id: I62a7b612c401a36f5098163e017c3b42d7d3750d
---
 dp/wifi3.0/dp_internal.h |  1 +
 dp/wifi3.0/dp_main.c     |  5 +++--
 dp/wifi3.0/dp_reo.c      | 27 +++++++++++++++++++++++++++
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/dp/wifi3.0/dp_internal.h b/dp/wifi3.0/dp_internal.h
index b7bccc554918..4cac8a417e29 100644
--- a/dp/wifi3.0/dp_internal.h
+++ b/dp/wifi3.0/dp_internal.h
@@ -276,6 +276,7 @@ extern QDF_STATUS dp_reo_send_cmd(struct dp_soc *soc,
 	enum hal_reo_cmd_type type, struct hal_reo_cmd_params *params,
 	void (*callback_fn), void *data);
 
+extern void dp_reo_cmdlist_destroy(struct dp_soc *soc);
 extern void dp_reo_status_ring_handler(struct dp_soc *soc);
 void dp_aggregate_vdev_stats(struct dp_vdev *vdev);
 uint16_t dp_tx_me_send_convert_ucast(struct cdp_vdev *vdev_handle,
diff --git a/dp/wifi3.0/dp_main.c b/dp/wifi3.0/dp_main.c
index 4d921ca219e1..a4888cafa01d 100644
--- a/dp/wifi3.0/dp_main.c
+++ b/dp/wifi3.0/dp_main.c
@@ -1675,12 +1675,13 @@ static void dp_soc_detach_wifi3(void *txrx_soc)
 	dp_srng_cleanup(soc, &soc->reo_cmd_ring, REO_CMD, 0);
 	dp_srng_cleanup(soc, &soc->reo_status_ring, REO_STATUS, 0);
 
-	qdf_spinlock_destroy(&soc->rx.reo_cmd_lock);
-
 	qdf_spinlock_destroy(&soc->peer_ref_mutex);
 	htt_soc_detach(soc->htt_handle);
 
+	dp_reo_cmdlist_destroy(soc);
+	qdf_spinlock_destroy(&soc->rx.reo_cmd_lock);
 	dp_reo_desc_freelist_destroy(soc);
+
 	wlan_cfg_soc_detach(soc->wlan_cfg_ctx);
 
 	dp_soc_wds_detach(soc);
diff --git a/dp/wifi3.0/dp_reo.c b/dp/wifi3.0/dp_reo.c
index 14571e2cbad2..969bc03183c8 100644
--- a/dp/wifi3.0/dp_reo.c
+++ b/dp/wifi3.0/dp_reo.c
@@ -168,3 +168,30 @@ next:
 
 	hal_srng_access_end(soc->hal_soc, soc->reo_status_ring.hal_srng);
 }
+
+/**
+ * dp_reo_cmdlist_destroy - Free REO commands in the queue
+ * @soc: DP SoC hanle
+ *
+ */
+void dp_reo_cmdlist_destroy(struct dp_soc *soc)
+{
+	struct dp_reo_cmd_info *reo_cmd = NULL;
+	union hal_reo_status reo_status;
+
+	reo_status.queue_status.header.status =
+			HAL_REO_CMD_FAILED;
+
+	qdf_spin_lock_bh(&soc->rx.reo_cmd_lock);
+	TAILQ_FOREACH(reo_cmd, &soc->rx.reo_cmd_list,
+		      reo_cmd_list_elem) {
+		TAILQ_REMOVE(&soc->rx.reo_cmd_list, reo_cmd,
+		       reo_cmd_list_elem);
+		if (reo_cmd) {
+			reo_cmd->handler(soc, reo_cmd->data,
+					&reo_status);
+			qdf_mem_free(reo_cmd);
+		}
+	}
+	qdf_spin_unlock_bh(&soc->rx.reo_cmd_lock);
+}