iwlwifi: mvm: flush queue before deleting ROC

Before deleting a time event (remain-on-channel instance), flush
the queue so that frames cannot get stuck on it. We already flush
the AUX STA queues, but a separate station is used for the P2P
Device queue.

Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

2 files changed, 24 insertions, 2 deletions

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 6a9a25beab3f..55ab5349dd40 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1061,6 +1061,7 @@ struct iwl_mvm {
  * @IWL_MVM_STATUS_ROC_AUX_RUNNING: AUX remain-on-channel is running
  * @IWL_MVM_STATUS_D3_RECONFIG: D3 reconfiguration is being done
  * @IWL_MVM_STATUS_FIRMWARE_RUNNING: firmware is running
+ * @IWL_MVM_STATUS_NEED_FLUSH_P2P: need to flush P2P bcast STA
  */
 enum iwl_mvm_status {
         IWL_MVM_STATUS_HW_RFKILL,
@@ -1072,6 +1073,7 @@ enum iwl_mvm_status {
         IWL_MVM_STATUS_ROC_AUX_RUNNING,
         IWL_MVM_STATUS_D3_RECONFIG,
         IWL_MVM_STATUS_FIRMWARE_RUNNING,
+        IWL_MVM_STATUS_NEED_FLUSH_P2P,
 };
 
 /* Keep track of completed init configuration */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 4d0314912e94..e25cda9fbf6c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -132,6 +132,24 @@ void iwl_mvm_roc_done_wk(struct work_struct *wk)
          * executed, and a new time event means a new command.
          */
         iwl_mvm_flush_sta(mvm, &mvm->aux_sta, true, CMD_ASYNC);
+
+        /* Do the same for the P2P device queue (STA) */
+        if (test_and_clear_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status)) {
+                struct iwl_mvm_vif *mvmvif;
+
+                /*
+                 * NB: access to this pointer would be racy, but the flush bit
+                 * can only be set when we had a P2P-Device VIF, and we have a
+                 * flush of this work in iwl_mvm_prepare_mac_removal() so it's
+                 * not really racy.
+                 */
+
+                if (!WARN_ON(!mvm->p2p_device_vif)) {
+                        mvmvif = iwl_mvm_vif_from_mac80211(mvm->p2p_device_vif);
+                        iwl_mvm_flush_sta(mvm, &mvmvif->bcast_sta, true,
+                                          CMD_ASYNC);
+                }
+        }
 }
 
 static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
@@ -855,10 +873,12 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
 
         mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
 
-        if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE)
+        if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                 iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
-        else
+                set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
+        } else {
                 iwl_mvm_remove_aux_roc_te(mvm, mvmvif, te_data);
+        }
 
         iwl_mvm_roc_finished(mvm);
 }