1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Off-channel operation helpers 4 * 5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 6 * Copyright 2004, Instant802 Networks, Inc. 7 * Copyright 2005, Devicescape Software, Inc. 8 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 10 * Copyright 2009 Johannes Berg <johannes@sipsolutions.net> 11 * Copyright (C) 2019, 2022-2023 Intel Corporation 12 */ 13 #include <linux/export.h> 14 #include <net/mac80211.h> 15 #include "ieee80211_i.h" 16 #include "driver-ops.h" 17 18 /* 19 * Tell our hardware to disable PS. 20 * Optionally inform AP that we will go to sleep so that it will buffer 21 * the frames while we are doing off-channel work. This is optional 22 * because we *may* be doing work on-operating channel, and want our 23 * hardware unconditionally awake, but still let the AP send us normal frames. 24 */ 25 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata) 26 { 27 struct ieee80211_local *local = sdata->local; 28 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 29 bool offchannel_ps_enabled = false; 30 31 /* FIXME: what to do when local->pspolling is true? */ 32 33 del_timer_sync(&local->dynamic_ps_timer); 34 del_timer_sync(&ifmgd->bcn_mon_timer); 35 del_timer_sync(&ifmgd->conn_mon_timer); 36 37 wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work); 38 39 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 40 offchannel_ps_enabled = true; 41 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 42 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 43 } 44 45 if (!offchannel_ps_enabled || 46 !ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 47 /* 48 * If power save was enabled, no need to send a nullfunc 49 * frame because AP knows that we are sleeping. But if the 50 * hardware is creating the nullfunc frame for power save 51 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not 52 * enabled) and power save was enabled, the firmware just 53 * sent a null frame with power save disabled. So we need 54 * to send a new nullfunc frame to inform the AP that we 55 * are again sleeping. 56 */ 57 ieee80211_send_nullfunc(local, sdata, true); 58 } 59 60 /* inform AP that we are awake again */ 61 static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata) 62 { 63 struct ieee80211_local *local = sdata->local; 64 65 if (!local->ps_sdata) 66 ieee80211_send_nullfunc(local, sdata, false); 67 else if (local->hw.conf.dynamic_ps_timeout > 0) { 68 /* 69 * the dynamic_ps_timer had been running before leaving the 70 * operating channel, restart the timer now and send a nullfunc 71 * frame to inform the AP that we are awake so that AP sends 72 * the buffered packets (if any). 73 */ 74 ieee80211_send_nullfunc(local, sdata, false); 75 mod_timer(&local->dynamic_ps_timer, jiffies + 76 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 77 } 78 79 ieee80211_sta_reset_beacon_monitor(sdata); 80 ieee80211_sta_reset_conn_monitor(sdata); 81 } 82 83 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local) 84 { 85 struct ieee80211_sub_if_data *sdata; 86 87 lockdep_assert_wiphy(local->hw.wiphy); 88 89 if (WARN_ON(local->use_chanctx)) 90 return; 91 92 /* 93 * notify the AP about us leaving the channel and stop all 94 * STA interfaces. 95 */ 96 97 /* 98 * Stop queues and transmit all frames queued by the driver 99 * before sending nullfunc to enable powersave at the AP. 100 */ 101 ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP, 102 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL, 103 false); 104 ieee80211_flush_queues(local, NULL, false); 105 106 list_for_each_entry(sdata, &local->interfaces, list) { 107 if (!ieee80211_sdata_running(sdata)) 108 continue; 109 110 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE || 111 sdata->vif.type == NL80211_IFTYPE_NAN) 112 continue; 113 114 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 115 set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state); 116 117 /* Check to see if we should disable beaconing. */ 118 if (sdata->vif.bss_conf.enable_beacon) { 119 set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, 120 &sdata->state); 121 sdata->vif.bss_conf.enable_beacon = false; 122 ieee80211_link_info_change_notify( 123 sdata, &sdata->deflink, 124 BSS_CHANGED_BEACON_ENABLED); 125 } 126 127 if (sdata->vif.type == NL80211_IFTYPE_STATION && 128 sdata->u.mgd.associated) 129 ieee80211_offchannel_ps_enable(sdata); 130 } 131 } 132 133 void ieee80211_offchannel_return(struct ieee80211_local *local) 134 { 135 struct ieee80211_sub_if_data *sdata; 136 137 lockdep_assert_wiphy(local->hw.wiphy); 138 139 if (WARN_ON(local->use_chanctx)) 140 return; 141 142 list_for_each_entry(sdata, &local->interfaces, list) { 143 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) 144 continue; 145 146 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 147 clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state); 148 149 if (!ieee80211_sdata_running(sdata)) 150 continue; 151 152 /* Tell AP we're back */ 153 if (sdata->vif.type == NL80211_IFTYPE_STATION && 154 sdata->u.mgd.associated) 155 ieee80211_offchannel_ps_disable(sdata); 156 157 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, 158 &sdata->state)) { 159 sdata->vif.bss_conf.enable_beacon = true; 160 ieee80211_link_info_change_notify( 161 sdata, &sdata->deflink, 162 BSS_CHANGED_BEACON_ENABLED); 163 } 164 } 165 166 ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP, 167 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL, 168 false); 169 } 170 171 static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc) 172 { 173 /* was never transmitted */ 174 if (roc->frame) { 175 cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie, 176 roc->frame->data, roc->frame->len, 177 false, GFP_KERNEL); 178 ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame); 179 } 180 181 if (!roc->mgmt_tx_cookie) 182 cfg80211_remain_on_channel_expired(&roc->sdata->wdev, 183 roc->cookie, roc->chan, 184 GFP_KERNEL); 185 else 186 cfg80211_tx_mgmt_expired(&roc->sdata->wdev, 187 roc->mgmt_tx_cookie, 188 roc->chan, GFP_KERNEL); 189 190 list_del(&roc->list); 191 kfree(roc); 192 } 193 194 static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local, 195 unsigned long now) 196 { 197 struct ieee80211_roc_work *roc, *tmp; 198 long remaining_dur_min = LONG_MAX; 199 200 lockdep_assert_wiphy(local->hw.wiphy); 201 202 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 203 long remaining; 204 205 if (!roc->started) 206 break; 207 208 remaining = roc->start_time + 209 msecs_to_jiffies(roc->duration) - 210 now; 211 212 /* In case of HW ROC, it is possible that the HW finished the 213 * ROC session before the actual requested time. In such a case 214 * end the ROC session (disregarding the remaining time). 215 */ 216 if (roc->abort || roc->hw_begun || remaining <= 0) 217 ieee80211_roc_notify_destroy(roc); 218 else 219 remaining_dur_min = min(remaining_dur_min, remaining); 220 } 221 222 return remaining_dur_min; 223 } 224 225 static bool ieee80211_recalc_sw_work(struct ieee80211_local *local, 226 unsigned long now) 227 { 228 long dur = ieee80211_end_finished_rocs(local, now); 229 230 if (dur == LONG_MAX) 231 return false; 232 233 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, dur); 234 return true; 235 } 236 237 static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc, 238 unsigned long start_time) 239 { 240 if (WARN_ON(roc->notified)) 241 return; 242 243 roc->start_time = start_time; 244 roc->started = true; 245 246 if (roc->mgmt_tx_cookie) { 247 if (!WARN_ON(!roc->frame)) { 248 ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7, 249 roc->chan->band); 250 roc->frame = NULL; 251 } 252 } else { 253 cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie, 254 roc->chan, roc->req_duration, 255 GFP_KERNEL); 256 } 257 258 roc->notified = true; 259 } 260 261 static void ieee80211_hw_roc_start(struct wiphy *wiphy, struct wiphy_work *work) 262 { 263 struct ieee80211_local *local = 264 container_of(work, struct ieee80211_local, hw_roc_start); 265 struct ieee80211_roc_work *roc; 266 267 lockdep_assert_wiphy(local->hw.wiphy); 268 269 list_for_each_entry(roc, &local->roc_list, list) { 270 if (!roc->started) 271 break; 272 273 roc->hw_begun = true; 274 ieee80211_handle_roc_started(roc, local->hw_roc_start_time); 275 } 276 } 277 278 void ieee80211_ready_on_channel(struct ieee80211_hw *hw) 279 { 280 struct ieee80211_local *local = hw_to_local(hw); 281 282 local->hw_roc_start_time = jiffies; 283 284 trace_api_ready_on_channel(local); 285 286 wiphy_work_queue(hw->wiphy, &local->hw_roc_start); 287 } 288 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel); 289 290 static void _ieee80211_start_next_roc(struct ieee80211_local *local) 291 { 292 struct ieee80211_roc_work *roc, *tmp; 293 enum ieee80211_roc_type type; 294 u32 min_dur, max_dur; 295 296 lockdep_assert_wiphy(local->hw.wiphy); 297 298 if (WARN_ON(list_empty(&local->roc_list))) 299 return; 300 301 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work, 302 list); 303 304 if (WARN_ON(roc->started)) 305 return; 306 307 min_dur = roc->duration; 308 max_dur = roc->duration; 309 type = roc->type; 310 311 list_for_each_entry(tmp, &local->roc_list, list) { 312 if (tmp == roc) 313 continue; 314 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 315 break; 316 max_dur = max(tmp->duration, max_dur); 317 min_dur = min(tmp->duration, min_dur); 318 type = max(tmp->type, type); 319 } 320 321 if (local->ops->remain_on_channel) { 322 int ret = drv_remain_on_channel(local, roc->sdata, roc->chan, 323 max_dur, type); 324 325 if (ret) { 326 wiphy_warn(local->hw.wiphy, 327 "failed to start next HW ROC (%d)\n", ret); 328 /* 329 * queue the work struct again to avoid recursion 330 * when multiple failures occur 331 */ 332 list_for_each_entry(tmp, &local->roc_list, list) { 333 if (tmp->sdata != roc->sdata || 334 tmp->chan != roc->chan) 335 break; 336 tmp->started = true; 337 tmp->abort = true; 338 } 339 wiphy_work_queue(local->hw.wiphy, &local->hw_roc_done); 340 return; 341 } 342 343 /* we'll notify about the start once the HW calls back */ 344 list_for_each_entry(tmp, &local->roc_list, list) { 345 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 346 break; 347 tmp->started = true; 348 } 349 } else { 350 /* If actually operating on the desired channel (with at least 351 * 20 MHz channel width) don't stop all the operations but still 352 * treat it as though the ROC operation started properly, so 353 * other ROC operations won't interfere with this one. 354 */ 355 roc->on_channel = roc->chan == local->_oper_chandef.chan && 356 local->_oper_chandef.width != NL80211_CHAN_WIDTH_5 && 357 local->_oper_chandef.width != NL80211_CHAN_WIDTH_10; 358 359 /* start this ROC */ 360 ieee80211_recalc_idle(local); 361 362 if (!roc->on_channel) { 363 ieee80211_offchannel_stop_vifs(local); 364 365 local->tmp_channel = roc->chan; 366 ieee80211_hw_config(local, 0); 367 } 368 369 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 370 msecs_to_jiffies(min_dur)); 371 372 /* tell userspace or send frame(s) */ 373 list_for_each_entry(tmp, &local->roc_list, list) { 374 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 375 break; 376 377 tmp->on_channel = roc->on_channel; 378 ieee80211_handle_roc_started(tmp, jiffies); 379 } 380 } 381 } 382 383 void ieee80211_start_next_roc(struct ieee80211_local *local) 384 { 385 struct ieee80211_roc_work *roc; 386 387 lockdep_assert_wiphy(local->hw.wiphy); 388 389 if (list_empty(&local->roc_list)) { 390 ieee80211_run_deferred_scan(local); 391 return; 392 } 393 394 /* defer roc if driver is not started (i.e. during reconfig) */ 395 if (local->in_reconfig) 396 return; 397 398 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work, 399 list); 400 401 if (WARN_ON_ONCE(roc->started)) 402 return; 403 404 if (local->ops->remain_on_channel) { 405 _ieee80211_start_next_roc(local); 406 } else { 407 /* delay it a bit */ 408 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 409 round_jiffies_relative(HZ / 2)); 410 } 411 } 412 413 static void __ieee80211_roc_work(struct ieee80211_local *local) 414 { 415 struct ieee80211_roc_work *roc; 416 bool on_channel; 417 418 lockdep_assert_wiphy(local->hw.wiphy); 419 420 if (WARN_ON(local->ops->remain_on_channel)) 421 return; 422 423 roc = list_first_entry_or_null(&local->roc_list, 424 struct ieee80211_roc_work, list); 425 if (!roc) 426 return; 427 428 if (!roc->started) { 429 WARN_ON(local->use_chanctx); 430 _ieee80211_start_next_roc(local); 431 } else { 432 on_channel = roc->on_channel; 433 if (ieee80211_recalc_sw_work(local, jiffies)) 434 return; 435 436 /* careful - roc pointer became invalid during recalc */ 437 438 if (!on_channel) { 439 ieee80211_flush_queues(local, NULL, false); 440 441 local->tmp_channel = NULL; 442 ieee80211_hw_config(local, 0); 443 444 ieee80211_offchannel_return(local); 445 } 446 447 ieee80211_recalc_idle(local); 448 ieee80211_start_next_roc(local); 449 } 450 } 451 452 static void ieee80211_roc_work(struct wiphy *wiphy, struct wiphy_work *work) 453 { 454 struct ieee80211_local *local = 455 container_of(work, struct ieee80211_local, roc_work.work); 456 457 lockdep_assert_wiphy(local->hw.wiphy); 458 459 __ieee80211_roc_work(local); 460 } 461 462 static void ieee80211_hw_roc_done(struct wiphy *wiphy, struct wiphy_work *work) 463 { 464 struct ieee80211_local *local = 465 container_of(work, struct ieee80211_local, hw_roc_done); 466 467 lockdep_assert_wiphy(local->hw.wiphy); 468 469 ieee80211_end_finished_rocs(local, jiffies); 470 471 /* if there's another roc, start it now */ 472 ieee80211_start_next_roc(local); 473 } 474 475 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw) 476 { 477 struct ieee80211_local *local = hw_to_local(hw); 478 479 trace_api_remain_on_channel_expired(local); 480 481 wiphy_work_queue(hw->wiphy, &local->hw_roc_done); 482 } 483 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired); 484 485 static bool 486 ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local, 487 struct ieee80211_roc_work *new_roc, 488 struct ieee80211_roc_work *cur_roc) 489 { 490 unsigned long now = jiffies; 491 unsigned long remaining; 492 493 if (WARN_ON(!cur_roc->started)) 494 return false; 495 496 /* if it was scheduled in the hardware, but not started yet, 497 * we can only combine if the older one had a longer duration 498 */ 499 if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration) 500 return false; 501 502 remaining = cur_roc->start_time + 503 msecs_to_jiffies(cur_roc->duration) - 504 now; 505 506 /* if it doesn't fit entirely, schedule a new one */ 507 if (new_roc->duration > jiffies_to_msecs(remaining)) 508 return false; 509 510 /* add just after the current one so we combine their finish later */ 511 list_add(&new_roc->list, &cur_roc->list); 512 513 /* if the existing one has already begun then let this one also 514 * begin, otherwise they'll both be marked properly by the work 515 * struct that runs once the driver notifies us of the beginning 516 */ 517 if (cur_roc->hw_begun) { 518 new_roc->hw_begun = true; 519 ieee80211_handle_roc_started(new_roc, now); 520 } 521 522 return true; 523 } 524 525 static int ieee80211_start_roc_work(struct ieee80211_local *local, 526 struct ieee80211_sub_if_data *sdata, 527 struct ieee80211_channel *channel, 528 unsigned int duration, u64 *cookie, 529 struct sk_buff *txskb, 530 enum ieee80211_roc_type type) 531 { 532 struct ieee80211_roc_work *roc, *tmp; 533 bool queued = false, combine_started = true; 534 int ret; 535 536 lockdep_assert_wiphy(local->hw.wiphy); 537 538 if (channel->freq_offset) 539 /* this may work, but is untested */ 540 return -EOPNOTSUPP; 541 542 if (local->use_chanctx && !local->ops->remain_on_channel) 543 return -EOPNOTSUPP; 544 545 roc = kzalloc(sizeof(*roc), GFP_KERNEL); 546 if (!roc) 547 return -ENOMEM; 548 549 /* 550 * If the duration is zero, then the driver 551 * wouldn't actually do anything. Set it to 552 * 10 for now. 553 * 554 * TODO: cancel the off-channel operation 555 * when we get the SKB's TX status and 556 * the wait time was zero before. 557 */ 558 if (!duration) 559 duration = 10; 560 561 roc->chan = channel; 562 roc->duration = duration; 563 roc->req_duration = duration; 564 roc->frame = txskb; 565 roc->type = type; 566 roc->sdata = sdata; 567 568 /* 569 * cookie is either the roc cookie (for normal roc) 570 * or the SKB (for mgmt TX) 571 */ 572 if (!txskb) { 573 roc->cookie = ieee80211_mgmt_tx_cookie(local); 574 *cookie = roc->cookie; 575 } else { 576 roc->mgmt_tx_cookie = *cookie; 577 } 578 579 /* if there's no need to queue, handle it immediately */ 580 if (list_empty(&local->roc_list) && 581 !local->scanning && !ieee80211_is_radar_required(local)) { 582 /* if not HW assist, just queue & schedule work */ 583 if (!local->ops->remain_on_channel) { 584 list_add_tail(&roc->list, &local->roc_list); 585 wiphy_delayed_work_queue(local->hw.wiphy, 586 &local->roc_work, 0); 587 } else { 588 /* otherwise actually kick it off here 589 * (for error handling) 590 */ 591 ret = drv_remain_on_channel(local, sdata, channel, 592 duration, type); 593 if (ret) { 594 kfree(roc); 595 return ret; 596 } 597 roc->started = true; 598 list_add_tail(&roc->list, &local->roc_list); 599 } 600 601 return 0; 602 } 603 604 /* otherwise handle queueing */ 605 606 list_for_each_entry(tmp, &local->roc_list, list) { 607 if (tmp->chan != channel || tmp->sdata != sdata) 608 continue; 609 610 /* 611 * Extend this ROC if possible: If it hasn't started, add 612 * just after the new one to combine. 613 */ 614 if (!tmp->started) { 615 list_add(&roc->list, &tmp->list); 616 queued = true; 617 break; 618 } 619 620 if (!combine_started) 621 continue; 622 623 if (!local->ops->remain_on_channel) { 624 /* If there's no hardware remain-on-channel, and 625 * doing so won't push us over the maximum r-o-c 626 * we allow, then we can just add the new one to 627 * the list and mark it as having started now. 628 * If it would push over the limit, don't try to 629 * combine with other started ones (that haven't 630 * been running as long) but potentially sort it 631 * with others that had the same fate. 632 */ 633 unsigned long now = jiffies; 634 u32 elapsed = jiffies_to_msecs(now - tmp->start_time); 635 struct wiphy *wiphy = local->hw.wiphy; 636 u32 max_roc = wiphy->max_remain_on_channel_duration; 637 638 if (elapsed + roc->duration > max_roc) { 639 combine_started = false; 640 continue; 641 } 642 643 list_add(&roc->list, &tmp->list); 644 queued = true; 645 roc->on_channel = tmp->on_channel; 646 ieee80211_handle_roc_started(roc, now); 647 ieee80211_recalc_sw_work(local, now); 648 break; 649 } 650 651 queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp); 652 if (queued) 653 break; 654 /* if it wasn't queued, perhaps it can be combined with 655 * another that also couldn't get combined previously, 656 * but no need to check for already started ones, since 657 * that can't work. 658 */ 659 combine_started = false; 660 } 661 662 if (!queued) 663 list_add_tail(&roc->list, &local->roc_list); 664 665 return 0; 666 } 667 668 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev, 669 struct ieee80211_channel *chan, 670 unsigned int duration, u64 *cookie) 671 { 672 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 673 struct ieee80211_local *local = sdata->local; 674 675 lockdep_assert_wiphy(local->hw.wiphy); 676 677 return ieee80211_start_roc_work(local, sdata, chan, 678 duration, cookie, NULL, 679 IEEE80211_ROC_TYPE_NORMAL); 680 } 681 682 static int ieee80211_cancel_roc(struct ieee80211_local *local, 683 u64 cookie, bool mgmt_tx) 684 { 685 struct ieee80211_roc_work *roc, *tmp, *found = NULL; 686 int ret; 687 688 lockdep_assert_wiphy(local->hw.wiphy); 689 690 if (!cookie) 691 return -ENOENT; 692 693 wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start); 694 695 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 696 if (!mgmt_tx && roc->cookie != cookie) 697 continue; 698 else if (mgmt_tx && roc->mgmt_tx_cookie != cookie) 699 continue; 700 701 found = roc; 702 break; 703 } 704 705 if (!found) { 706 return -ENOENT; 707 } 708 709 if (!found->started) { 710 ieee80211_roc_notify_destroy(found); 711 goto out_unlock; 712 } 713 714 if (local->ops->remain_on_channel) { 715 ret = drv_cancel_remain_on_channel(local, roc->sdata); 716 if (WARN_ON_ONCE(ret)) { 717 return ret; 718 } 719 720 /* TODO: 721 * if multiple items were combined here then we really shouldn't 722 * cancel them all - we should wait for as much time as needed 723 * for the longest remaining one, and only then cancel ... 724 */ 725 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 726 if (!roc->started) 727 break; 728 if (roc == found) 729 found = NULL; 730 ieee80211_roc_notify_destroy(roc); 731 } 732 733 /* that really must not happen - it was started */ 734 WARN_ON(found); 735 736 ieee80211_start_next_roc(local); 737 } else { 738 /* go through work struct to return to the operating channel */ 739 found->abort = true; 740 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 0); 741 } 742 743 out_unlock: 744 745 return 0; 746 } 747 748 int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy, 749 struct wireless_dev *wdev, u64 cookie) 750 { 751 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 752 struct ieee80211_local *local = sdata->local; 753 754 return ieee80211_cancel_roc(local, cookie, false); 755 } 756 757 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, 758 struct cfg80211_mgmt_tx_params *params, u64 *cookie) 759 { 760 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 761 struct ieee80211_local *local = sdata->local; 762 struct sk_buff *skb; 763 struct sta_info *sta = NULL; 764 const struct ieee80211_mgmt *mgmt = (void *)params->buf; 765 bool need_offchan = false; 766 bool mlo_sta = false; 767 int link_id = -1; 768 u32 flags; 769 int ret; 770 u8 *data; 771 772 lockdep_assert_wiphy(local->hw.wiphy); 773 774 if (params->dont_wait_for_ack) 775 flags = IEEE80211_TX_CTL_NO_ACK; 776 else 777 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX | 778 IEEE80211_TX_CTL_REQ_TX_STATUS; 779 780 if (params->no_cck) 781 flags |= IEEE80211_TX_CTL_NO_CCK_RATE; 782 783 switch (sdata->vif.type) { 784 case NL80211_IFTYPE_ADHOC: 785 if (!sdata->vif.cfg.ibss_joined) 786 need_offchan = true; 787 #ifdef CONFIG_MAC80211_MESH 788 fallthrough; 789 case NL80211_IFTYPE_MESH_POINT: 790 if (ieee80211_vif_is_mesh(&sdata->vif) && 791 !sdata->u.mesh.mesh_id_len) 792 need_offchan = true; 793 #endif 794 fallthrough; 795 case NL80211_IFTYPE_AP: 796 case NL80211_IFTYPE_AP_VLAN: 797 case NL80211_IFTYPE_P2P_GO: 798 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 799 !ieee80211_vif_is_mesh(&sdata->vif) && 800 !sdata->bss->active) 801 need_offchan = true; 802 803 rcu_read_lock(); 804 sta = sta_info_get_bss(sdata, mgmt->da); 805 mlo_sta = sta && sta->sta.mlo; 806 807 if (!ieee80211_is_action(mgmt->frame_control) || 808 mgmt->u.action.category == WLAN_CATEGORY_PUBLIC || 809 mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED || 810 mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) { 811 rcu_read_unlock(); 812 break; 813 } 814 815 if (!sta) { 816 rcu_read_unlock(); 817 return -ENOLINK; 818 } 819 if (params->link_id >= 0 && 820 !(sta->sta.valid_links & BIT(params->link_id))) { 821 rcu_read_unlock(); 822 return -ENOLINK; 823 } 824 link_id = params->link_id; 825 rcu_read_unlock(); 826 break; 827 case NL80211_IFTYPE_STATION: 828 case NL80211_IFTYPE_P2P_CLIENT: 829 if (!sdata->u.mgd.associated || 830 (params->offchan && params->wait && 831 local->ops->remain_on_channel && 832 memcmp(sdata->vif.cfg.ap_addr, mgmt->bssid, ETH_ALEN))) 833 need_offchan = true; 834 break; 835 case NL80211_IFTYPE_P2P_DEVICE: 836 need_offchan = true; 837 break; 838 case NL80211_IFTYPE_NAN: 839 default: 840 return -EOPNOTSUPP; 841 } 842 843 /* configurations requiring offchan cannot work if no channel has been 844 * specified 845 */ 846 if (need_offchan && !params->chan) 847 return -EINVAL; 848 849 /* Check if the operating channel is the requested channel */ 850 if (!params->chan && mlo_sta) { 851 need_offchan = false; 852 } else if (!need_offchan) { 853 struct ieee80211_chanctx_conf *chanctx_conf = NULL; 854 int i; 855 856 rcu_read_lock(); 857 /* Check all the links first */ 858 for (i = 0; i < ARRAY_SIZE(sdata->vif.link_conf); i++) { 859 struct ieee80211_bss_conf *conf; 860 861 conf = rcu_dereference(sdata->vif.link_conf[i]); 862 if (!conf) 863 continue; 864 865 chanctx_conf = rcu_dereference(conf->chanctx_conf); 866 if (!chanctx_conf) 867 continue; 868 869 if (mlo_sta && params->chan == chanctx_conf->def.chan && 870 ether_addr_equal(sdata->vif.addr, mgmt->sa)) { 871 link_id = i; 872 break; 873 } 874 875 if (ether_addr_equal(conf->addr, mgmt->sa)) 876 break; 877 878 chanctx_conf = NULL; 879 } 880 881 if (chanctx_conf) { 882 need_offchan = params->chan && 883 (params->chan != 884 chanctx_conf->def.chan); 885 } else { 886 need_offchan = true; 887 } 888 rcu_read_unlock(); 889 } 890 891 if (need_offchan && !params->offchan) { 892 ret = -EBUSY; 893 goto out_unlock; 894 } 895 896 skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len); 897 if (!skb) { 898 ret = -ENOMEM; 899 goto out_unlock; 900 } 901 skb_reserve(skb, local->hw.extra_tx_headroom); 902 903 data = skb_put_data(skb, params->buf, params->len); 904 905 /* Update CSA counters */ 906 if (sdata->vif.bss_conf.csa_active && 907 (sdata->vif.type == NL80211_IFTYPE_AP || 908 sdata->vif.type == NL80211_IFTYPE_MESH_POINT || 909 sdata->vif.type == NL80211_IFTYPE_ADHOC) && 910 params->n_csa_offsets) { 911 int i; 912 struct beacon_data *beacon = NULL; 913 914 rcu_read_lock(); 915 916 if (sdata->vif.type == NL80211_IFTYPE_AP) 917 beacon = rcu_dereference(sdata->deflink.u.ap.beacon); 918 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 919 beacon = rcu_dereference(sdata->u.ibss.presp); 920 else if (ieee80211_vif_is_mesh(&sdata->vif)) 921 beacon = rcu_dereference(sdata->u.mesh.beacon); 922 923 if (beacon) 924 for (i = 0; i < params->n_csa_offsets; i++) 925 data[params->csa_offsets[i]] = 926 beacon->cntdwn_current_counter; 927 928 rcu_read_unlock(); 929 } 930 931 IEEE80211_SKB_CB(skb)->flags = flags; 932 933 skb->dev = sdata->dev; 934 935 if (!params->dont_wait_for_ack) { 936 /* make a copy to preserve the frame contents 937 * in case of encryption. 938 */ 939 ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL); 940 if (ret) { 941 kfree_skb(skb); 942 goto out_unlock; 943 } 944 } else { 945 /* Assign a dummy non-zero cookie, it's not sent to 946 * userspace in this case but we rely on its value 947 * internally in the need_offchan case to distinguish 948 * mgmt-tx from remain-on-channel. 949 */ 950 *cookie = 0xffffffff; 951 } 952 953 if (!need_offchan) { 954 ieee80211_tx_skb_tid(sdata, skb, 7, link_id); 955 ret = 0; 956 goto out_unlock; 957 } 958 959 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN | 960 IEEE80211_TX_INTFL_OFFCHAN_TX_OK; 961 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 962 IEEE80211_SKB_CB(skb)->hw_queue = 963 local->hw.offchannel_tx_hw_queue; 964 965 /* This will handle all kinds of coalescing and immediate TX */ 966 ret = ieee80211_start_roc_work(local, sdata, params->chan, 967 params->wait, cookie, skb, 968 IEEE80211_ROC_TYPE_MGMT_TX); 969 if (ret) 970 ieee80211_free_txskb(&local->hw, skb); 971 out_unlock: 972 return ret; 973 } 974 975 int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy, 976 struct wireless_dev *wdev, u64 cookie) 977 { 978 struct ieee80211_local *local = wiphy_priv(wiphy); 979 980 return ieee80211_cancel_roc(local, cookie, true); 981 } 982 983 void ieee80211_roc_setup(struct ieee80211_local *local) 984 { 985 wiphy_work_init(&local->hw_roc_start, ieee80211_hw_roc_start); 986 wiphy_work_init(&local->hw_roc_done, ieee80211_hw_roc_done); 987 wiphy_delayed_work_init(&local->roc_work, ieee80211_roc_work); 988 INIT_LIST_HEAD(&local->roc_list); 989 } 990 991 void ieee80211_roc_purge(struct ieee80211_local *local, 992 struct ieee80211_sub_if_data *sdata) 993 { 994 struct ieee80211_roc_work *roc, *tmp; 995 bool work_to_do = false; 996 997 lockdep_assert_wiphy(local->hw.wiphy); 998 999 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 1000 if (sdata && roc->sdata != sdata) 1001 continue; 1002 1003 if (roc->started) { 1004 if (local->ops->remain_on_channel) { 1005 /* can race, so ignore return value */ 1006 drv_cancel_remain_on_channel(local, roc->sdata); 1007 ieee80211_roc_notify_destroy(roc); 1008 } else { 1009 roc->abort = true; 1010 work_to_do = true; 1011 } 1012 } else { 1013 ieee80211_roc_notify_destroy(roc); 1014 } 1015 } 1016 if (work_to_do) 1017 __ieee80211_roc_work(local); 1018 } 1019