1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Off-channel operation helpers 4 * 5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 6 * Copyright 2004, Instant802 Networks, Inc. 7 * Copyright 2005, Devicescape Software, Inc. 8 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 10 * Copyright 2009 Johannes Berg <johannes@sipsolutions.net> 11 * Copyright (C) 2019, 2022-2026 Intel Corporation 12 */ 13 #include <linux/export.h> 14 #include <net/mac80211.h> 15 #include "ieee80211_i.h" 16 #include "driver-ops.h" 17 18 /* 19 * Tell our hardware to disable PS. 20 * Optionally inform AP that we will go to sleep so that it will buffer 21 * the frames while we are doing off-channel work. This is optional 22 * because we *may* be doing work on-operating channel, and want our 23 * hardware unconditionally awake, but still let the AP send us normal frames. 24 */ 25 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata) 26 { 27 struct ieee80211_local *local = sdata->local; 28 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 29 bool offchannel_ps_enabled = false; 30 31 /* FIXME: what to do when local->pspolling is true? */ 32 33 timer_delete_sync(&local->dynamic_ps_timer); 34 timer_delete_sync(&ifmgd->bcn_mon_timer); 35 timer_delete_sync(&ifmgd->conn_mon_timer); 36 37 wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work); 38 39 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 40 offchannel_ps_enabled = true; 41 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 42 ieee80211_hw_config(local, -1, IEEE80211_CONF_CHANGE_PS); 43 } 44 45 if (!offchannel_ps_enabled || 46 !ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 47 /* 48 * If power save was enabled, no need to send a nullfunc 49 * frame because AP knows that we are sleeping. But if the 50 * hardware is creating the nullfunc frame for power save 51 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not 52 * enabled) and power save was enabled, the firmware just 53 * sent a null frame with power save disabled. So we need 54 * to send a new nullfunc frame to inform the AP that we 55 * are again sleeping. 56 */ 57 ieee80211_send_nullfunc(local, sdata, true); 58 } 59 60 /* inform AP that we are awake again */ 61 static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata) 62 { 63 struct ieee80211_local *local = sdata->local; 64 65 if (!local->ps_sdata) 66 ieee80211_send_nullfunc(local, sdata, false); 67 else if (local->hw.conf.dynamic_ps_timeout > 0) { 68 /* 69 * the dynamic_ps_timer had been running before leaving the 70 * operating channel, restart the timer now and send a nullfunc 71 * frame to inform the AP that we are awake so that AP sends 72 * the buffered packets (if any). 73 */ 74 ieee80211_send_nullfunc(local, sdata, false); 75 mod_timer(&local->dynamic_ps_timer, jiffies + 76 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 77 } 78 79 ieee80211_sta_reset_beacon_monitor(sdata); 80 ieee80211_sta_reset_conn_monitor(sdata); 81 } 82 83 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local) 84 { 85 struct ieee80211_sub_if_data *sdata; 86 87 lockdep_assert_wiphy(local->hw.wiphy); 88 89 if (WARN_ON(!local->emulate_chanctx)) 90 return; 91 92 /* 93 * notify the AP about us leaving the channel and stop all 94 * STA interfaces. 95 */ 96 97 /* 98 * Stop queues and transmit all frames queued by the driver 99 * before sending nullfunc to enable powersave at the AP. 100 */ 101 ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP, 102 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL, 103 false); 104 ieee80211_flush_queues(local, NULL, false); 105 106 list_for_each_entry(sdata, &local->interfaces, list) { 107 if (!ieee80211_sdata_running(sdata)) 108 continue; 109 110 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE || 111 sdata->vif.type == NL80211_IFTYPE_NAN) 112 continue; 113 114 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 115 set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state); 116 117 /* Check to see if we should disable beaconing. */ 118 if (sdata->vif.bss_conf.enable_beacon) { 119 set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, 120 &sdata->state); 121 sdata->vif.bss_conf.enable_beacon = false; 122 ieee80211_link_info_change_notify( 123 sdata, &sdata->deflink, 124 BSS_CHANGED_BEACON_ENABLED); 125 } 126 127 if (sdata->vif.type == NL80211_IFTYPE_STATION && 128 sdata->u.mgd.associated) 129 ieee80211_offchannel_ps_enable(sdata); 130 } 131 } 132 133 void ieee80211_offchannel_return(struct ieee80211_local *local) 134 { 135 struct ieee80211_sub_if_data *sdata; 136 137 lockdep_assert_wiphy(local->hw.wiphy); 138 139 if (WARN_ON(!local->emulate_chanctx)) 140 return; 141 142 list_for_each_entry(sdata, &local->interfaces, list) { 143 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) 144 continue; 145 146 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 147 clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state); 148 149 if (!ieee80211_sdata_running(sdata)) 150 continue; 151 152 /* Tell AP we're back */ 153 if (sdata->vif.type == NL80211_IFTYPE_STATION && 154 sdata->u.mgd.associated) 155 ieee80211_offchannel_ps_disable(sdata); 156 157 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, 158 &sdata->state)) { 159 sdata->vif.bss_conf.enable_beacon = true; 160 ieee80211_link_info_change_notify( 161 sdata, &sdata->deflink, 162 BSS_CHANGED_BEACON_ENABLED); 163 } 164 } 165 166 ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP, 167 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL, 168 false); 169 } 170 171 static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc) 172 { 173 /* was never transmitted */ 174 if (roc->frame) { 175 cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie, 176 roc->frame->data, roc->frame->len, 177 false, GFP_KERNEL); 178 ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame); 179 } 180 181 if (!roc->mgmt_tx_cookie) 182 cfg80211_remain_on_channel_expired(&roc->sdata->wdev, 183 roc->cookie, roc->chan, 184 GFP_KERNEL); 185 else 186 cfg80211_tx_mgmt_expired(&roc->sdata->wdev, 187 roc->mgmt_tx_cookie, 188 roc->chan, GFP_KERNEL); 189 190 list_del(&roc->list); 191 kfree(roc); 192 } 193 194 static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local, 195 unsigned long now) 196 { 197 struct ieee80211_roc_work *roc, *tmp; 198 long remaining_dur_min = LONG_MAX; 199 200 lockdep_assert_wiphy(local->hw.wiphy); 201 202 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 203 long remaining; 204 205 if (!roc->started) 206 break; 207 208 remaining = roc->start_time + 209 msecs_to_jiffies(roc->duration) - 210 now; 211 212 /* In case of HW ROC, it is possible that the HW finished the 213 * ROC session before the actual requested time. In such a case 214 * end the ROC session (disregarding the remaining time). 215 */ 216 if (roc->abort || roc->hw_begun || remaining <= 0) 217 ieee80211_roc_notify_destroy(roc); 218 else 219 remaining_dur_min = min(remaining_dur_min, remaining); 220 } 221 222 return remaining_dur_min; 223 } 224 225 static bool ieee80211_recalc_sw_work(struct ieee80211_local *local, 226 unsigned long now) 227 { 228 long dur = ieee80211_end_finished_rocs(local, now); 229 230 if (dur == LONG_MAX) 231 return false; 232 233 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, dur); 234 return true; 235 } 236 237 static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc, 238 unsigned long start_time) 239 { 240 if (WARN_ON(roc->notified)) 241 return; 242 243 roc->start_time = start_time; 244 roc->started = true; 245 246 if (roc->mgmt_tx_cookie) { 247 if (!WARN_ON(!roc->frame)) { 248 ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7, 249 roc->chan->band); 250 roc->frame = NULL; 251 } 252 } else { 253 cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie, 254 roc->chan, roc->req_duration, 255 GFP_KERNEL); 256 } 257 258 roc->notified = true; 259 } 260 261 static void ieee80211_hw_roc_start(struct wiphy *wiphy, struct wiphy_work *work) 262 { 263 struct ieee80211_local *local = 264 container_of(work, struct ieee80211_local, hw_roc_start); 265 struct ieee80211_roc_work *roc; 266 267 lockdep_assert_wiphy(local->hw.wiphy); 268 269 list_for_each_entry(roc, &local->roc_list, list) { 270 if (!roc->started) 271 break; 272 273 roc->hw_begun = true; 274 ieee80211_handle_roc_started(roc, local->hw_roc_start_time); 275 } 276 } 277 278 void ieee80211_ready_on_channel(struct ieee80211_hw *hw) 279 { 280 struct ieee80211_local *local = hw_to_local(hw); 281 282 local->hw_roc_start_time = jiffies; 283 284 trace_api_ready_on_channel(local); 285 286 wiphy_work_queue(hw->wiphy, &local->hw_roc_start); 287 } 288 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel); 289 290 static void _ieee80211_start_next_roc(struct ieee80211_local *local) 291 { 292 struct ieee80211_roc_work *roc, *tmp; 293 enum ieee80211_roc_type type; 294 u32 min_dur, max_dur; 295 296 lockdep_assert_wiphy(local->hw.wiphy); 297 298 if (WARN_ON(list_empty(&local->roc_list))) 299 return; 300 301 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work, 302 list); 303 304 if (WARN_ON(roc->started)) 305 return; 306 307 min_dur = roc->duration; 308 max_dur = roc->duration; 309 type = roc->type; 310 311 list_for_each_entry(tmp, &local->roc_list, list) { 312 if (tmp == roc) 313 continue; 314 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 315 break; 316 max_dur = max(tmp->duration, max_dur); 317 min_dur = min(tmp->duration, min_dur); 318 type = max(tmp->type, type); 319 } 320 321 if (local->ops->remain_on_channel) { 322 int ret = drv_remain_on_channel(local, roc->sdata, roc->chan, 323 max_dur, type); 324 325 if (ret) { 326 wiphy_warn(local->hw.wiphy, 327 "failed to start next HW ROC (%d)\n", ret); 328 /* 329 * queue the work struct again to avoid recursion 330 * when multiple failures occur 331 */ 332 list_for_each_entry(tmp, &local->roc_list, list) { 333 if (tmp->sdata != roc->sdata || 334 tmp->chan != roc->chan) 335 break; 336 tmp->started = true; 337 tmp->abort = true; 338 } 339 wiphy_work_queue(local->hw.wiphy, &local->hw_roc_done); 340 return; 341 } 342 343 /* we'll notify about the start once the HW calls back */ 344 list_for_each_entry(tmp, &local->roc_list, list) { 345 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 346 break; 347 tmp->started = true; 348 } 349 } else { 350 /* If actually operating on the desired channel (with at least 351 * 20 MHz channel width) don't stop all the operations but still 352 * treat it as though the ROC operation started properly, so 353 * other ROC operations won't interfere with this one. 354 * 355 * Note: scan can't run, tmp_channel is what we use, so this 356 * must be the currently active channel. 357 */ 358 roc->on_channel = roc->chan == local->hw.conf.chandef.chan; 359 360 /* start this ROC */ 361 ieee80211_recalc_idle(local); 362 363 if (!roc->on_channel) { 364 ieee80211_offchannel_stop_vifs(local); 365 366 local->tmp_channel = roc->chan; 367 ieee80211_hw_conf_chan(local); 368 } 369 370 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 371 msecs_to_jiffies(min_dur)); 372 373 /* tell userspace or send frame(s) */ 374 list_for_each_entry(tmp, &local->roc_list, list) { 375 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 376 break; 377 378 tmp->on_channel = roc->on_channel; 379 ieee80211_handle_roc_started(tmp, jiffies); 380 } 381 } 382 } 383 384 void ieee80211_start_next_roc(struct ieee80211_local *local) 385 { 386 struct ieee80211_roc_work *roc; 387 388 lockdep_assert_wiphy(local->hw.wiphy); 389 390 if (list_empty(&local->roc_list)) { 391 ieee80211_run_deferred_scan(local); 392 return; 393 } 394 395 /* defer roc if driver is not started (i.e. during reconfig) */ 396 if (local->in_reconfig) 397 return; 398 399 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work, 400 list); 401 402 if (WARN_ON_ONCE(roc->started)) 403 return; 404 405 if (local->ops->remain_on_channel) { 406 _ieee80211_start_next_roc(local); 407 } else { 408 /* delay it a bit */ 409 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 410 round_jiffies_relative(HZ / 2)); 411 } 412 } 413 414 void ieee80211_reconfig_roc(struct ieee80211_local *local) 415 { 416 struct ieee80211_roc_work *roc, *tmp; 417 418 /* 419 * In the software implementation can just continue with the 420 * interruption due to reconfig, roc_work is still queued if 421 * needed. 422 */ 423 if (!local->ops->remain_on_channel) 424 return; 425 426 /* flush work so nothing from the driver is still pending */ 427 wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start); 428 wiphy_work_flush(local->hw.wiphy, &local->hw_roc_done); 429 430 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 431 if (!roc->started) 432 break; 433 434 if (!roc->hw_begun) { 435 /* it didn't start in HW yet, so we can restart it */ 436 roc->started = false; 437 continue; 438 } 439 440 /* otherwise destroy it and tell userspace */ 441 ieee80211_roc_notify_destroy(roc); 442 } 443 444 ieee80211_start_next_roc(local); 445 } 446 447 static void __ieee80211_roc_work(struct ieee80211_local *local) 448 { 449 struct ieee80211_roc_work *roc; 450 bool on_channel; 451 452 lockdep_assert_wiphy(local->hw.wiphy); 453 454 if (WARN_ON(local->ops->remain_on_channel)) 455 return; 456 457 roc = list_first_entry_or_null(&local->roc_list, 458 struct ieee80211_roc_work, list); 459 if (!roc) 460 return; 461 462 if (!roc->started) { 463 WARN_ON(!local->emulate_chanctx); 464 _ieee80211_start_next_roc(local); 465 } else { 466 on_channel = roc->on_channel; 467 if (ieee80211_recalc_sw_work(local, jiffies)) 468 return; 469 470 /* careful - roc pointer became invalid during recalc */ 471 472 if (!on_channel) { 473 ieee80211_flush_queues(local, NULL, false); 474 475 local->tmp_channel = NULL; 476 ieee80211_hw_conf_chan(local); 477 478 ieee80211_offchannel_return(local); 479 } 480 481 ieee80211_recalc_idle(local); 482 ieee80211_start_next_roc(local); 483 } 484 } 485 486 static void ieee80211_roc_work(struct wiphy *wiphy, struct wiphy_work *work) 487 { 488 struct ieee80211_local *local = 489 container_of(work, struct ieee80211_local, roc_work.work); 490 491 lockdep_assert_wiphy(local->hw.wiphy); 492 493 __ieee80211_roc_work(local); 494 } 495 496 static void ieee80211_hw_roc_done(struct wiphy *wiphy, struct wiphy_work *work) 497 { 498 struct ieee80211_local *local = 499 container_of(work, struct ieee80211_local, hw_roc_done); 500 501 lockdep_assert_wiphy(local->hw.wiphy); 502 503 ieee80211_end_finished_rocs(local, jiffies); 504 505 /* if there's another roc, start it now */ 506 ieee80211_start_next_roc(local); 507 } 508 509 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw) 510 { 511 struct ieee80211_local *local = hw_to_local(hw); 512 513 trace_api_remain_on_channel_expired(local); 514 515 wiphy_work_queue(hw->wiphy, &local->hw_roc_done); 516 } 517 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired); 518 519 static bool 520 ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local, 521 struct ieee80211_roc_work *new_roc, 522 struct ieee80211_roc_work *cur_roc) 523 { 524 unsigned long now = jiffies; 525 unsigned long remaining; 526 527 if (WARN_ON(!cur_roc->started)) 528 return false; 529 530 /* if it was scheduled in the hardware, but not started yet, 531 * we can only combine if the older one had a longer duration 532 */ 533 if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration) 534 return false; 535 536 remaining = cur_roc->start_time + 537 msecs_to_jiffies(cur_roc->duration) - 538 now; 539 540 /* if it doesn't fit entirely, schedule a new one */ 541 if (new_roc->duration > jiffies_to_msecs(remaining)) 542 return false; 543 544 /* add just after the current one so we combine their finish later */ 545 list_add(&new_roc->list, &cur_roc->list); 546 547 /* if the existing one has already begun then let this one also 548 * begin, otherwise they'll both be marked properly by the work 549 * struct that runs once the driver notifies us of the beginning 550 */ 551 if (cur_roc->hw_begun) { 552 new_roc->hw_begun = true; 553 ieee80211_handle_roc_started(new_roc, now); 554 } 555 556 return true; 557 } 558 559 static int ieee80211_start_roc_work(struct ieee80211_local *local, 560 struct ieee80211_sub_if_data *sdata, 561 struct ieee80211_channel *channel, 562 unsigned int duration, u64 *cookie, 563 struct sk_buff *txskb, 564 enum ieee80211_roc_type type) 565 { 566 struct ieee80211_roc_work *roc, *tmp; 567 bool queued = false, combine_started = true; 568 struct cfg80211_scan_request *req; 569 int ret; 570 571 lockdep_assert_wiphy(local->hw.wiphy); 572 573 if (channel->freq_offset) 574 /* this may work, but is untested */ 575 return -EOPNOTSUPP; 576 577 if (!local->emulate_chanctx && !local->ops->remain_on_channel) 578 return -EOPNOTSUPP; 579 580 roc = kzalloc_obj(*roc); 581 if (!roc) 582 return -ENOMEM; 583 584 /* 585 * If the duration is zero, then the driver 586 * wouldn't actually do anything. Set it to 587 * 10 for now. 588 * 589 * TODO: cancel the off-channel operation 590 * when we get the SKB's TX status and 591 * the wait time was zero before. 592 */ 593 if (!duration) 594 duration = 10; 595 596 roc->chan = channel; 597 roc->duration = duration; 598 roc->req_duration = duration; 599 roc->frame = txskb; 600 roc->type = type; 601 roc->sdata = sdata; 602 603 /* 604 * cookie is either the roc cookie (for normal roc) 605 * or the SKB (for mgmt TX) 606 */ 607 if (!txskb) { 608 roc->cookie = ieee80211_mgmt_tx_cookie(local); 609 *cookie = roc->cookie; 610 } else { 611 roc->mgmt_tx_cookie = *cookie; 612 } 613 614 req = wiphy_dereference(local->hw.wiphy, local->scan_req); 615 616 /* if there's no need to queue, handle it immediately */ 617 if (list_empty(&local->roc_list) && 618 !local->scanning && !ieee80211_is_radar_required(local, req)) { 619 /* if not HW assist, just queue & schedule work */ 620 if (!local->ops->remain_on_channel) { 621 list_add_tail(&roc->list, &local->roc_list); 622 wiphy_delayed_work_queue(local->hw.wiphy, 623 &local->roc_work, 0); 624 } else { 625 /* otherwise actually kick it off here 626 * (for error handling) 627 */ 628 ret = drv_remain_on_channel(local, sdata, channel, 629 duration, type); 630 if (ret) { 631 kfree(roc); 632 return ret; 633 } 634 roc->started = true; 635 list_add_tail(&roc->list, &local->roc_list); 636 } 637 638 return 0; 639 } 640 641 /* otherwise handle queueing */ 642 643 list_for_each_entry(tmp, &local->roc_list, list) { 644 if (tmp->chan != channel || tmp->sdata != sdata) 645 continue; 646 647 /* 648 * Extend this ROC if possible: If it hasn't started, add 649 * just after the new one to combine. 650 */ 651 if (!tmp->started) { 652 list_add(&roc->list, &tmp->list); 653 queued = true; 654 break; 655 } 656 657 if (!combine_started) 658 continue; 659 660 if (!local->ops->remain_on_channel) { 661 /* If there's no hardware remain-on-channel, and 662 * doing so won't push us over the maximum r-o-c 663 * we allow, then we can just add the new one to 664 * the list and mark it as having started now. 665 * If it would push over the limit, don't try to 666 * combine with other started ones (that haven't 667 * been running as long) but potentially sort it 668 * with others that had the same fate. 669 */ 670 unsigned long now = jiffies; 671 u32 elapsed = jiffies_to_msecs(now - tmp->start_time); 672 struct wiphy *wiphy = local->hw.wiphy; 673 u32 max_roc = wiphy->max_remain_on_channel_duration; 674 675 if (elapsed + roc->duration > max_roc) { 676 combine_started = false; 677 continue; 678 } 679 680 list_add(&roc->list, &tmp->list); 681 queued = true; 682 roc->on_channel = tmp->on_channel; 683 ieee80211_handle_roc_started(roc, now); 684 ieee80211_recalc_sw_work(local, now); 685 break; 686 } 687 688 queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp); 689 if (queued) 690 break; 691 /* if it wasn't queued, perhaps it can be combined with 692 * another that also couldn't get combined previously, 693 * but no need to check for already started ones, since 694 * that can't work. 695 */ 696 combine_started = false; 697 } 698 699 if (!queued) 700 list_add_tail(&roc->list, &local->roc_list); 701 702 return 0; 703 } 704 705 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev, 706 struct ieee80211_channel *chan, 707 unsigned int duration, u64 *cookie, 708 const u8 *rx_addr) 709 { 710 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 711 struct ieee80211_local *local = sdata->local; 712 713 lockdep_assert_wiphy(local->hw.wiphy); 714 715 return ieee80211_start_roc_work(local, sdata, chan, 716 duration, cookie, NULL, 717 IEEE80211_ROC_TYPE_NORMAL); 718 } 719 720 static int ieee80211_cancel_roc(struct ieee80211_local *local, 721 u64 cookie, bool mgmt_tx) 722 { 723 struct ieee80211_roc_work *roc, *tmp, *found = NULL; 724 int ret; 725 726 lockdep_assert_wiphy(local->hw.wiphy); 727 728 if (!cookie) 729 return -ENOENT; 730 731 wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start); 732 733 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 734 if (!mgmt_tx && roc->cookie != cookie) 735 continue; 736 else if (mgmt_tx && roc->mgmt_tx_cookie != cookie) 737 continue; 738 739 found = roc; 740 break; 741 } 742 743 if (!found) { 744 return -ENOENT; 745 } 746 747 if (!found->started) { 748 ieee80211_roc_notify_destroy(found); 749 goto out_unlock; 750 } 751 752 if (local->ops->remain_on_channel) { 753 ret = drv_cancel_remain_on_channel(local, roc->sdata); 754 if (WARN_ON_ONCE(ret)) { 755 return ret; 756 } 757 758 /* 759 * We could be racing against the notification from the driver: 760 * + driver is handling the notification on CPU0 761 * + user space is cancelling the remain on channel and 762 * schedules the hw_roc_done worker. 763 * 764 * Now hw_roc_done might start to run after the next roc will 765 * start and mac80211 will think that this second roc has 766 * ended prematurely. 767 * Cancel the work to make sure that all the pending workers 768 * have completed execution. 769 * Note that this assumes that by the time the driver returns 770 * from drv_cancel_remain_on_channel, it has completed all 771 * the processing of related notifications. 772 */ 773 wiphy_work_cancel(local->hw.wiphy, &local->hw_roc_done); 774 775 /* TODO: 776 * if multiple items were combined here then we really shouldn't 777 * cancel them all - we should wait for as much time as needed 778 * for the longest remaining one, and only then cancel ... 779 */ 780 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 781 if (!roc->started) 782 break; 783 if (roc == found) 784 found = NULL; 785 ieee80211_roc_notify_destroy(roc); 786 } 787 788 /* that really must not happen - it was started */ 789 WARN_ON(found); 790 791 ieee80211_start_next_roc(local); 792 } else { 793 /* go through work struct to return to the operating channel */ 794 found->abort = true; 795 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 0); 796 } 797 798 out_unlock: 799 800 return 0; 801 } 802 803 int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy, 804 struct wireless_dev *wdev, u64 cookie) 805 { 806 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 807 struct ieee80211_local *local = sdata->local; 808 809 return ieee80211_cancel_roc(local, cookie, false); 810 } 811 812 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, 813 struct cfg80211_mgmt_tx_params *params, u64 *cookie) 814 { 815 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 816 struct ieee80211_local *local = sdata->local; 817 struct sk_buff *skb; 818 struct sta_info *sta = NULL; 819 const struct ieee80211_mgmt *mgmt = (void *)params->buf; 820 bool need_offchan = false; 821 bool mlo_sta = false; 822 int link_id = -1; 823 u32 flags; 824 int ret; 825 u8 *data; 826 827 lockdep_assert_wiphy(local->hw.wiphy); 828 829 if (params->dont_wait_for_ack) 830 flags = IEEE80211_TX_CTL_NO_ACK; 831 else 832 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX | 833 IEEE80211_TX_CTL_REQ_TX_STATUS; 834 835 if (params->no_cck) 836 flags |= IEEE80211_TX_CTL_NO_CCK_RATE; 837 838 switch (sdata->vif.type) { 839 case NL80211_IFTYPE_ADHOC: 840 if (!sdata->vif.cfg.ibss_joined) 841 need_offchan = true; 842 #ifdef CONFIG_MAC80211_MESH 843 fallthrough; 844 case NL80211_IFTYPE_MESH_POINT: 845 if (ieee80211_vif_is_mesh(&sdata->vif) && 846 !sdata->u.mesh.mesh_id_len) 847 need_offchan = true; 848 #endif 849 fallthrough; 850 case NL80211_IFTYPE_AP: 851 case NL80211_IFTYPE_AP_VLAN: 852 case NL80211_IFTYPE_P2P_GO: 853 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 854 !ieee80211_vif_is_mesh(&sdata->vif) && 855 !sdata->bss->active) 856 need_offchan = true; 857 858 rcu_read_lock(); 859 sta = sta_info_get_bss(sdata, mgmt->da); 860 mlo_sta = sta && sta->sta.mlo; 861 862 if (!ieee80211_is_action(mgmt->frame_control) || 863 mgmt->u.action.category == WLAN_CATEGORY_PUBLIC || 864 mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED || 865 mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) { 866 rcu_read_unlock(); 867 break; 868 } 869 870 if (!sta) { 871 rcu_read_unlock(); 872 return -ENOLINK; 873 } 874 if (params->link_id >= 0 && 875 !(sta->sta.valid_links & BIT(params->link_id))) { 876 rcu_read_unlock(); 877 return -ENOLINK; 878 } 879 link_id = params->link_id; 880 rcu_read_unlock(); 881 break; 882 case NL80211_IFTYPE_STATION: 883 case NL80211_IFTYPE_P2P_CLIENT: 884 if (!sdata->u.mgd.associated || 885 (params->offchan && params->wait && 886 local->ops->remain_on_channel && 887 memcmp(sdata->vif.cfg.ap_addr, mgmt->bssid, ETH_ALEN))) { 888 need_offchan = true; 889 } else if (sdata->u.mgd.associated && 890 ether_addr_equal(sdata->vif.cfg.ap_addr, mgmt->da)) { 891 sta = sta_info_get_bss(sdata, mgmt->da); 892 mlo_sta = sta && sta->sta.mlo; 893 } 894 break; 895 case NL80211_IFTYPE_P2P_DEVICE: 896 case NL80211_IFTYPE_PD: 897 need_offchan = true; 898 break; 899 case NL80211_IFTYPE_NAN: 900 break; 901 case NL80211_IFTYPE_NAN_DATA: 902 if (is_multicast_ether_addr(mgmt->da)) 903 return -EOPNOTSUPP; 904 break; 905 default: 906 return -EOPNOTSUPP; 907 } 908 909 /* configurations requiring offchan cannot work if no channel has been 910 * specified 911 */ 912 if (need_offchan && !params->chan) 913 return -EINVAL; 914 915 /* Check if the operating channel is the requested channel */ 916 if (!params->chan && mlo_sta) { 917 need_offchan = false; 918 } else if (sdata->vif.type == NL80211_IFTYPE_NAN || 919 sdata->vif.type == NL80211_IFTYPE_NAN_DATA) { 920 /* Frames can be sent during NAN schedule */ 921 } else if (!need_offchan) { 922 struct ieee80211_chanctx_conf *chanctx_conf = NULL; 923 int i; 924 925 rcu_read_lock(); 926 /* Check all the links first */ 927 for (i = 0; i < ARRAY_SIZE(sdata->vif.link_conf); i++) { 928 struct ieee80211_bss_conf *conf; 929 930 conf = rcu_dereference(sdata->vif.link_conf[i]); 931 if (!conf) 932 continue; 933 934 chanctx_conf = rcu_dereference(conf->chanctx_conf); 935 if (!chanctx_conf) 936 continue; 937 938 if (mlo_sta && params->chan == chanctx_conf->def.chan && 939 ether_addr_equal(sdata->vif.addr, mgmt->sa)) { 940 link_id = i; 941 break; 942 } 943 944 if (ether_addr_equal(conf->addr, mgmt->sa)) { 945 /* If userspace requested Tx on a specific link 946 * use the same link id if the link bss is matching 947 * the requested chan. 948 */ 949 if (sdata->vif.valid_links && 950 params->link_id >= 0 && params->link_id == i && 951 params->chan == chanctx_conf->def.chan) 952 link_id = i; 953 954 break; 955 } 956 957 chanctx_conf = NULL; 958 } 959 960 if (chanctx_conf) { 961 need_offchan = params->chan && 962 (params->chan != 963 chanctx_conf->def.chan); 964 } else { 965 need_offchan = true; 966 } 967 rcu_read_unlock(); 968 } 969 970 if (need_offchan && !params->offchan) { 971 ret = -EBUSY; 972 goto out_unlock; 973 } 974 975 skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len); 976 if (!skb) { 977 ret = -ENOMEM; 978 goto out_unlock; 979 } 980 skb_reserve(skb, local->hw.extra_tx_headroom); 981 982 data = skb_put_data(skb, params->buf, params->len); 983 984 /* Update CSA counters */ 985 if (sdata->vif.bss_conf.csa_active && 986 (sdata->vif.type == NL80211_IFTYPE_AP || 987 sdata->vif.type == NL80211_IFTYPE_MESH_POINT || 988 sdata->vif.type == NL80211_IFTYPE_ADHOC) && 989 params->n_csa_offsets) { 990 int i; 991 struct beacon_data *beacon = NULL; 992 993 rcu_read_lock(); 994 995 if (sdata->vif.type == NL80211_IFTYPE_AP) 996 beacon = rcu_dereference(sdata->deflink.u.ap.beacon); 997 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 998 beacon = rcu_dereference(sdata->u.ibss.presp); 999 else if (ieee80211_vif_is_mesh(&sdata->vif)) 1000 beacon = rcu_dereference(sdata->u.mesh.beacon); 1001 1002 if (beacon) 1003 for (i = 0; i < params->n_csa_offsets; i++) 1004 data[params->csa_offsets[i]] = 1005 beacon->cntdwn_current_counter; 1006 1007 rcu_read_unlock(); 1008 } 1009 1010 IEEE80211_SKB_CB(skb)->flags = flags; 1011 IEEE80211_SKB_CB(skb)->control.flags |= IEEE80211_TX_CTRL_DONT_USE_RATE_MASK; 1012 1013 skb->dev = sdata->dev; 1014 1015 if (!params->dont_wait_for_ack) { 1016 /* make a copy to preserve the frame contents 1017 * in case of encryption. 1018 */ 1019 ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL); 1020 if (ret) { 1021 kfree_skb(skb); 1022 goto out_unlock; 1023 } 1024 } else { 1025 /* Assign a dummy non-zero cookie, it's not sent to 1026 * userspace in this case but we rely on its value 1027 * internally in the need_offchan case to distinguish 1028 * mgmt-tx from remain-on-channel. 1029 */ 1030 *cookie = 0xffffffff; 1031 } 1032 1033 if (!need_offchan) { 1034 ieee80211_tx_skb_tid(sdata, skb, 7, link_id); 1035 ret = 0; 1036 goto out_unlock; 1037 } 1038 1039 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN | 1040 IEEE80211_TX_INTFL_OFFCHAN_TX_OK; 1041 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 1042 IEEE80211_SKB_CB(skb)->hw_queue = 1043 local->hw.offchannel_tx_hw_queue; 1044 1045 /* This will handle all kinds of coalescing and immediate TX */ 1046 ret = ieee80211_start_roc_work(local, sdata, params->chan, 1047 params->wait, cookie, skb, 1048 IEEE80211_ROC_TYPE_MGMT_TX); 1049 if (ret) 1050 ieee80211_free_txskb(&local->hw, skb); 1051 out_unlock: 1052 return ret; 1053 } 1054 1055 int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy, 1056 struct wireless_dev *wdev, u64 cookie) 1057 { 1058 struct ieee80211_local *local = wiphy_priv(wiphy); 1059 1060 return ieee80211_cancel_roc(local, cookie, true); 1061 } 1062 1063 void ieee80211_roc_setup(struct ieee80211_local *local) 1064 { 1065 wiphy_work_init(&local->hw_roc_start, ieee80211_hw_roc_start); 1066 wiphy_work_init(&local->hw_roc_done, ieee80211_hw_roc_done); 1067 wiphy_delayed_work_init(&local->roc_work, ieee80211_roc_work); 1068 INIT_LIST_HEAD(&local->roc_list); 1069 } 1070 1071 void ieee80211_roc_purge(struct ieee80211_local *local, 1072 struct ieee80211_sub_if_data *sdata) 1073 { 1074 struct ieee80211_roc_work *roc, *tmp; 1075 bool work_to_do = false; 1076 1077 lockdep_assert_wiphy(local->hw.wiphy); 1078 1079 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 1080 if (sdata && roc->sdata != sdata) 1081 continue; 1082 1083 if (roc->started) { 1084 if (local->ops->remain_on_channel) { 1085 /* can race, so ignore return value */ 1086 drv_cancel_remain_on_channel(local, roc->sdata); 1087 ieee80211_roc_notify_destroy(roc); 1088 } else { 1089 roc->abort = true; 1090 work_to_do = true; 1091 } 1092 } else { 1093 ieee80211_roc_notify_destroy(roc); 1094 } 1095 } 1096 if (work_to_do) 1097 __ieee80211_roc_work(local); 1098 } 1099