Make iwn(4) flush remaining frames on the Tx aggregation queue when

Tx aggregation is stopped. Fixes a bug where outstanding frames on
the aggregation queue interfere with roaming to another AP.

net80211 will only roam once all outstanding frames destined for the
old AP have been sent, i.e. once that AP node's Tx refcount goes to 0.
Any outstanding frames sitting in the Tx aggregation queue, waiting to
be ACKed, will keep this refcount above zero.
To make roaming work reliably in combination with Tx aggregation, the
driver must ensure that ieee80211_release_node() gets called for each
frame on the queue when Tx aggregation is stopped.

Problem observed by tobhe@
Fix tested + ok tobhe@ jca@

1 files changed, 5 insertions, 1 deletions

diff --git a/sys/dev/pci/if_iwn.c b/sys/dev/pci/if_iwn.c
index 8b405460ed1..72e19d7e356 100644
--- a/sys/dev/pci/if_iwn.c
+++ b/sys/dev/pci/if_iwn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwn.c,v 1.220 2019/11/06 13:55:43 stsp Exp $	*/
+/*	$OpenBSD: if_iwn.c,v 1.221 2019/11/06 14:52:35 stsp Exp $	*/
 
 /*-
  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -5689,6 +5689,10 @@ iwn_ampdu_tx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
 	struct iwn_node *wn = (void *)ni;
 	struct iwn_node_info node;
 
+	/* Discard all frames in the current window. */
+	iwn_ampdu_txq_advance(sc, &sc->txq[qid], qid,
+	    IWN_AGG_SSN_TO_TXQ_IDX(ba->ba_winend));
+
 	if (iwn_nic_lock(sc) != 0)
 		return;
 	ops->ampdu_tx_stop(sc, tid, ba->ba_winstart);