Yes. In our case, *802_11_DEAUTHENTICATE command downloaded to
firmware takes care of flushing the keys.

I can see below code in cfg80211's disconnect handling. It seems to
be there for long time.

Yeah, I saw it, but it's not clear to me that there's much point in it.
In any case, that's an unrelated question in a way, because there
definitely are things happening here that should be "more synchronous",
regardless of whether or not the key deletion makes sense.

I think, your cfg80211 change will help. We do ensure that
cfg80211_disconnected() is called before exiting
mwifiex_cfg80211_disconnect().
Sending HostCmd_CMD_802_11_DEAUTHENTICATE command to firmware is a
blocking call. cfg80211_disconnected() is called while handling that
command's response. 

Ah ok, I missed that - I thought it was asynchronous.

quoted

So somehow you'd have to synchronize with the firmware as well, to
process all those things before suspend, I guess?

[...]

This would not be needed. 

Right. Care to test my patch before I properly submit it?

johannes