iwlwifi: dvm: handle FLUSH ampdu actions from mac80211

Until now we didn't handle properly the FLUSH ampdu action
coming from mac80211. This could result in SCD queue leak:
mac80211 would STOP_FLUSH an AMPDU Tx session and remove
the station. If we had still packets on the ring, we
wouldn't deallocate the SCD queue and wait for it to be
empty.
The indication of the queue being empty comes from the Tx
response flow which relies on the tid_data structure. The
problem is that this structure has been cleared when the
station has been removed.
In order to solve this issue, block in the STOP_FLUSH
ampdu_action until the SCD queue is flushed, and only then,
let mac80211 move forward to remove the station.
iwlagn_txfifo_flush had to be enhanced to allow this.

The bug fixed here caused the "txq_id mismatch: 12 0" print.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 45 insertions, 0 deletions

diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index cc1e0c1a6f48..2c9e9897a3f1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -674,6 +674,51 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
         return ret;
 }
 
+int iwlagn_tx_agg_flush(struct iwl_priv *priv, struct ieee80211_vif *vif,
+                        struct ieee80211_sta *sta, u16 tid)
+{
+        struct iwl_tid_data *tid_data;
+        enum iwl_agg_state agg_state;
+        int sta_id, txq_id;
+        sta_id = iwl_sta_id(sta);
+
+        /*
+         * First set the agg state to OFF to avoid calling
+         * ieee80211_stop_tx_ba_cb in iwlagn_check_ratid_empty.
+         */
+        spin_lock_bh(&priv->sta_lock);
+
+        tid_data = &priv->tid_data[sta_id][tid];
+        txq_id = tid_data->agg.txq_id;
+        agg_state = tid_data->agg.state;
+        IWL_DEBUG_TX_QUEUES(priv, "Flush AGG: sta %d tid %d q %d state %d\n",
+                            sta_id, tid, txq_id, tid_data->agg.state);
+
+        tid_data->agg.state = IWL_AGG_OFF;
+
+        spin_unlock_bh(&priv->sta_lock);
+
+        if (iwlagn_txfifo_flush(priv, BIT(txq_id)))
+                IWL_ERR(priv, "Couldn't flush the AGG queue\n");
+
+        if (test_bit(txq_id, priv->agg_q_alloc)) {
+                /*
+                 * If the transport didn't know that we wanted to start
+                 * agreggation, don't tell it that we want to stop them.
+                 * This can happen when we don't get the addBA response on
+                 * time, or we hadn't time to drain the AC queues.
+                 */
+                if (agg_state == IWL_AGG_ON)
+                        iwl_trans_txq_disable(priv->trans, txq_id);
+                else
+                        IWL_DEBUG_TX_QUEUES(priv, "Don't disable tx agg: %d\n",
+                                            agg_state);
+                iwlagn_dealloc_agg_txq(priv, txq_id);
+        }
+
+        return 0;
+}
+
 int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta, u16 tid, u8 buf_size)
 {