1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Off-channel operation helpers 4 * 5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi> 6 * Copyright 2004, Instant802 Networks, Inc. 7 * Copyright 2005, Devicescape Software, Inc. 8 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net> 10 * Copyright 2009 Johannes Berg <johannes@sipsolutions.net> 11 * Copyright (C) 2019, 2022-2023 Intel Corporation 12 */ 13 #include <linux/export.h> 14 #include <net/mac80211.h> 15 #include "ieee80211_i.h" 16 #include "driver-ops.h" 17 18 /* 19 * Tell our hardware to disable PS. 20 * Optionally inform AP that we will go to sleep so that it will buffer 21 * the frames while we are doing off-channel work. This is optional 22 * because we *may* be doing work on-operating channel, and want our 23 * hardware unconditionally awake, but still let the AP send us normal frames. 24 */ 25 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata) 26 { 27 struct ieee80211_local *local = sdata->local; 28 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 29 bool offchannel_ps_enabled = false; 30 31 /* FIXME: what to do when local->pspolling is true? */ 32 33 del_timer_sync(&local->dynamic_ps_timer); 34 del_timer_sync(&ifmgd->bcn_mon_timer); 35 del_timer_sync(&ifmgd->conn_mon_timer); 36 37 wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work); 38 39 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 40 offchannel_ps_enabled = true; 41 local->hw.conf.flags &= ~IEEE80211_CONF_PS; 42 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); 43 } 44 45 if (!offchannel_ps_enabled || 46 !ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 47 /* 48 * If power save was enabled, no need to send a nullfunc 49 * frame because AP knows that we are sleeping. But if the 50 * hardware is creating the nullfunc frame for power save 51 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not 52 * enabled) and power save was enabled, the firmware just 53 * sent a null frame with power save disabled. So we need 54 * to send a new nullfunc frame to inform the AP that we 55 * are again sleeping. 56 */ 57 ieee80211_send_nullfunc(local, sdata, true); 58 } 59 60 /* inform AP that we are awake again */ 61 static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata) 62 { 63 struct ieee80211_local *local = sdata->local; 64 65 if (!local->ps_sdata) 66 ieee80211_send_nullfunc(local, sdata, false); 67 else if (local->hw.conf.dynamic_ps_timeout > 0) { 68 /* 69 * the dynamic_ps_timer had been running before leaving the 70 * operating channel, restart the timer now and send a nullfunc 71 * frame to inform the AP that we are awake so that AP sends 72 * the buffered packets (if any). 73 */ 74 ieee80211_send_nullfunc(local, sdata, false); 75 mod_timer(&local->dynamic_ps_timer, jiffies + 76 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 77 } 78 79 ieee80211_sta_reset_beacon_monitor(sdata); 80 ieee80211_sta_reset_conn_monitor(sdata); 81 } 82 83 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local) 84 { 85 struct ieee80211_sub_if_data *sdata; 86 87 lockdep_assert_wiphy(local->hw.wiphy); 88 89 if (WARN_ON(local->use_chanctx)) 90 return; 91 92 /* 93 * notify the AP about us leaving the channel and stop all 94 * STA interfaces. 95 */ 96 97 /* 98 * Stop queues and transmit all frames queued by the driver 99 * before sending nullfunc to enable powersave at the AP. 100 */ 101 ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP, 102 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL, 103 false); 104 ieee80211_flush_queues(local, NULL, false); 105 106 list_for_each_entry(sdata, &local->interfaces, list) { 107 if (!ieee80211_sdata_running(sdata)) 108 continue; 109 110 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE || 111 sdata->vif.type == NL80211_IFTYPE_NAN) 112 continue; 113 114 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 115 set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state); 116 117 /* Check to see if we should disable beaconing. */ 118 if (sdata->vif.bss_conf.enable_beacon) { 119 set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, 120 &sdata->state); 121 sdata->vif.bss_conf.enable_beacon = false; 122 ieee80211_link_info_change_notify( 123 sdata, &sdata->deflink, 124 BSS_CHANGED_BEACON_ENABLED); 125 } 126 127 if (sdata->vif.type == NL80211_IFTYPE_STATION && 128 sdata->u.mgd.associated) 129 ieee80211_offchannel_ps_enable(sdata); 130 } 131 } 132 133 void ieee80211_offchannel_return(struct ieee80211_local *local) 134 { 135 struct ieee80211_sub_if_data *sdata; 136 137 lockdep_assert_wiphy(local->hw.wiphy); 138 139 if (WARN_ON(local->use_chanctx)) 140 return; 141 142 list_for_each_entry(sdata, &local->interfaces, list) { 143 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) 144 continue; 145 146 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 147 clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state); 148 149 if (!ieee80211_sdata_running(sdata)) 150 continue; 151 152 /* Tell AP we're back */ 153 if (sdata->vif.type == NL80211_IFTYPE_STATION && 154 sdata->u.mgd.associated) 155 ieee80211_offchannel_ps_disable(sdata); 156 157 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, 158 &sdata->state)) { 159 sdata->vif.bss_conf.enable_beacon = true; 160 ieee80211_link_info_change_notify( 161 sdata, &sdata->deflink, 162 BSS_CHANGED_BEACON_ENABLED); 163 } 164 } 165 166 ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP, 167 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL, 168 false); 169 } 170 171 static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc) 172 { 173 /* was never transmitted */ 174 if (roc->frame) { 175 cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie, 176 roc->frame->data, roc->frame->len, 177 false, GFP_KERNEL); 178 ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame); 179 } 180 181 if (!roc->mgmt_tx_cookie) 182 cfg80211_remain_on_channel_expired(&roc->sdata->wdev, 183 roc->cookie, roc->chan, 184 GFP_KERNEL); 185 else 186 cfg80211_tx_mgmt_expired(&roc->sdata->wdev, 187 roc->mgmt_tx_cookie, 188 roc->chan, GFP_KERNEL); 189 190 list_del(&roc->list); 191 kfree(roc); 192 } 193 194 static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local, 195 unsigned long now) 196 { 197 struct ieee80211_roc_work *roc, *tmp; 198 long remaining_dur_min = LONG_MAX; 199 200 lockdep_assert_wiphy(local->hw.wiphy); 201 202 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 203 long remaining; 204 205 if (!roc->started) 206 break; 207 208 remaining = roc->start_time + 209 msecs_to_jiffies(roc->duration) - 210 now; 211 212 /* In case of HW ROC, it is possible that the HW finished the 213 * ROC session before the actual requested time. In such a case 214 * end the ROC session (disregarding the remaining time). 215 */ 216 if (roc->abort || roc->hw_begun || remaining <= 0) 217 ieee80211_roc_notify_destroy(roc); 218 else 219 remaining_dur_min = min(remaining_dur_min, remaining); 220 } 221 222 return remaining_dur_min; 223 } 224 225 static bool ieee80211_recalc_sw_work(struct ieee80211_local *local, 226 unsigned long now) 227 { 228 long dur = ieee80211_end_finished_rocs(local, now); 229 230 if (dur == LONG_MAX) 231 return false; 232 233 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, dur); 234 return true; 235 } 236 237 static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc, 238 unsigned long start_time) 239 { 240 if (WARN_ON(roc->notified)) 241 return; 242 243 roc->start_time = start_time; 244 roc->started = true; 245 246 if (roc->mgmt_tx_cookie) { 247 if (!WARN_ON(!roc->frame)) { 248 ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7, 249 roc->chan->band); 250 roc->frame = NULL; 251 } 252 } else { 253 cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie, 254 roc->chan, roc->req_duration, 255 GFP_KERNEL); 256 } 257 258 roc->notified = true; 259 } 260 261 static void ieee80211_hw_roc_start(struct wiphy *wiphy, struct wiphy_work *work) 262 { 263 struct ieee80211_local *local = 264 container_of(work, struct ieee80211_local, hw_roc_start); 265 struct ieee80211_roc_work *roc; 266 267 lockdep_assert_wiphy(local->hw.wiphy); 268 269 list_for_each_entry(roc, &local->roc_list, list) { 270 if (!roc->started) 271 break; 272 273 roc->hw_begun = true; 274 ieee80211_handle_roc_started(roc, local->hw_roc_start_time); 275 } 276 } 277 278 void ieee80211_ready_on_channel(struct ieee80211_hw *hw) 279 { 280 struct ieee80211_local *local = hw_to_local(hw); 281 282 local->hw_roc_start_time = jiffies; 283 284 trace_api_ready_on_channel(local); 285 286 wiphy_work_queue(hw->wiphy, &local->hw_roc_start); 287 } 288 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel); 289 290 static void _ieee80211_start_next_roc(struct ieee80211_local *local) 291 { 292 struct ieee80211_roc_work *roc, *tmp; 293 enum ieee80211_roc_type type; 294 u32 min_dur, max_dur; 295 296 lockdep_assert_wiphy(local->hw.wiphy); 297 298 if (WARN_ON(list_empty(&local->roc_list))) 299 return; 300 301 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work, 302 list); 303 304 if (WARN_ON(roc->started)) 305 return; 306 307 min_dur = roc->duration; 308 max_dur = roc->duration; 309 type = roc->type; 310 311 list_for_each_entry(tmp, &local->roc_list, list) { 312 if (tmp == roc) 313 continue; 314 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 315 break; 316 max_dur = max(tmp->duration, max_dur); 317 min_dur = min(tmp->duration, min_dur); 318 type = max(tmp->type, type); 319 } 320 321 if (local->ops->remain_on_channel) { 322 int ret = drv_remain_on_channel(local, roc->sdata, roc->chan, 323 max_dur, type); 324 325 if (ret) { 326 wiphy_warn(local->hw.wiphy, 327 "failed to start next HW ROC (%d)\n", ret); 328 /* 329 * queue the work struct again to avoid recursion 330 * when multiple failures occur 331 */ 332 list_for_each_entry(tmp, &local->roc_list, list) { 333 if (tmp->sdata != roc->sdata || 334 tmp->chan != roc->chan) 335 break; 336 tmp->started = true; 337 tmp->abort = true; 338 } 339 wiphy_work_queue(local->hw.wiphy, &local->hw_roc_done); 340 return; 341 } 342 343 /* we'll notify about the start once the HW calls back */ 344 list_for_each_entry(tmp, &local->roc_list, list) { 345 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 346 break; 347 tmp->started = true; 348 } 349 } else { 350 /* If actually operating on the desired channel (with at least 351 * 20 MHz channel width) don't stop all the operations but still 352 * treat it as though the ROC operation started properly, so 353 * other ROC operations won't interfere with this one. 354 */ 355 roc->on_channel = roc->chan == local->_oper_chandef.chan && 356 local->_oper_chandef.width != NL80211_CHAN_WIDTH_5 && 357 local->_oper_chandef.width != NL80211_CHAN_WIDTH_10; 358 359 /* start this ROC */ 360 ieee80211_recalc_idle(local); 361 362 if (!roc->on_channel) { 363 ieee80211_offchannel_stop_vifs(local); 364 365 local->tmp_channel = roc->chan; 366 ieee80211_hw_config(local, 0); 367 } 368 369 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 370 msecs_to_jiffies(min_dur)); 371 372 /* tell userspace or send frame(s) */ 373 list_for_each_entry(tmp, &local->roc_list, list) { 374 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan) 375 break; 376 377 tmp->on_channel = roc->on_channel; 378 ieee80211_handle_roc_started(tmp, jiffies); 379 } 380 } 381 } 382 383 void ieee80211_start_next_roc(struct ieee80211_local *local) 384 { 385 struct ieee80211_roc_work *roc; 386 387 lockdep_assert_wiphy(local->hw.wiphy); 388 389 if (list_empty(&local->roc_list)) { 390 ieee80211_run_deferred_scan(local); 391 return; 392 } 393 394 /* defer roc if driver is not started (i.e. during reconfig) */ 395 if (local->in_reconfig) 396 return; 397 398 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work, 399 list); 400 401 if (WARN_ON_ONCE(roc->started)) 402 return; 403 404 if (local->ops->remain_on_channel) { 405 _ieee80211_start_next_roc(local); 406 } else { 407 /* delay it a bit */ 408 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 409 round_jiffies_relative(HZ / 2)); 410 } 411 } 412 413 static void __ieee80211_roc_work(struct ieee80211_local *local) 414 { 415 struct ieee80211_roc_work *roc; 416 bool on_channel; 417 418 lockdep_assert_wiphy(local->hw.wiphy); 419 420 if (WARN_ON(local->ops->remain_on_channel)) 421 return; 422 423 roc = list_first_entry_or_null(&local->roc_list, 424 struct ieee80211_roc_work, list); 425 if (!roc) 426 return; 427 428 if (!roc->started) { 429 WARN_ON(local->use_chanctx); 430 _ieee80211_start_next_roc(local); 431 } else { 432 on_channel = roc->on_channel; 433 if (ieee80211_recalc_sw_work(local, jiffies)) 434 return; 435 436 /* careful - roc pointer became invalid during recalc */ 437 438 if (!on_channel) { 439 ieee80211_flush_queues(local, NULL, false); 440 441 local->tmp_channel = NULL; 442 ieee80211_hw_config(local, 0); 443 444 ieee80211_offchannel_return(local); 445 } 446 447 ieee80211_recalc_idle(local); 448 ieee80211_start_next_roc(local); 449 } 450 } 451 452 static void ieee80211_roc_work(struct wiphy *wiphy, struct wiphy_work *work) 453 { 454 struct ieee80211_local *local = 455 container_of(work, struct ieee80211_local, roc_work.work); 456 457 lockdep_assert_wiphy(local->hw.wiphy); 458 459 __ieee80211_roc_work(local); 460 } 461 462 static void ieee80211_hw_roc_done(struct wiphy *wiphy, struct wiphy_work *work) 463 { 464 struct ieee80211_local *local = 465 container_of(work, struct ieee80211_local, hw_roc_done); 466 467 lockdep_assert_wiphy(local->hw.wiphy); 468 469 ieee80211_end_finished_rocs(local, jiffies); 470 471 /* if there's another roc, start it now */ 472 ieee80211_start_next_roc(local); 473 } 474 475 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw) 476 { 477 struct ieee80211_local *local = hw_to_local(hw); 478 479 trace_api_remain_on_channel_expired(local); 480 481 wiphy_work_queue(hw->wiphy, &local->hw_roc_done); 482 } 483 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired); 484 485 static bool 486 ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local, 487 struct ieee80211_roc_work *new_roc, 488 struct ieee80211_roc_work *cur_roc) 489 { 490 unsigned long now = jiffies; 491 unsigned long remaining; 492 493 if (WARN_ON(!cur_roc->started)) 494 return false; 495 496 /* if it was scheduled in the hardware, but not started yet, 497 * we can only combine if the older one had a longer duration 498 */ 499 if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration) 500 return false; 501 502 remaining = cur_roc->start_time + 503 msecs_to_jiffies(cur_roc->duration) - 504 now; 505 506 /* if it doesn't fit entirely, schedule a new one */ 507 if (new_roc->duration > jiffies_to_msecs(remaining)) 508 return false; 509 510 /* add just after the current one so we combine their finish later */ 511 list_add(&new_roc->list, &cur_roc->list); 512 513 /* if the existing one has already begun then let this one also 514 * begin, otherwise they'll both be marked properly by the work 515 * struct that runs once the driver notifies us of the beginning 516 */ 517 if (cur_roc->hw_begun) { 518 new_roc->hw_begun = true; 519 ieee80211_handle_roc_started(new_roc, now); 520 } 521 522 return true; 523 } 524 525 static int ieee80211_start_roc_work(struct ieee80211_local *local, 526 struct ieee80211_sub_if_data *sdata, 527 struct ieee80211_channel *channel, 528 unsigned int duration, u64 *cookie, 529 struct sk_buff *txskb, 530 enum ieee80211_roc_type type) 531 { 532 struct ieee80211_roc_work *roc, *tmp; 533 bool queued = false, combine_started = true; 534 int ret; 535 536 lockdep_assert_wiphy(local->hw.wiphy); 537 538 if (channel->freq_offset) 539 /* this may work, but is untested */ 540 return -EOPNOTSUPP; 541 542 if (local->use_chanctx && !local->ops->remain_on_channel) 543 return -EOPNOTSUPP; 544 545 roc = kzalloc(sizeof(*roc), GFP_KERNEL); 546 if (!roc) 547 return -ENOMEM; 548 549 /* 550 * If the duration is zero, then the driver 551 * wouldn't actually do anything. Set it to 552 * 10 for now. 553 * 554 * TODO: cancel the off-channel operation 555 * when we get the SKB's TX status and 556 * the wait time was zero before. 557 */ 558 if (!duration) 559 duration = 10; 560 561 roc->chan = channel; 562 roc->duration = duration; 563 roc->req_duration = duration; 564 roc->frame = txskb; 565 roc->type = type; 566 roc->sdata = sdata; 567 568 /* 569 * cookie is either the roc cookie (for normal roc) 570 * or the SKB (for mgmt TX) 571 */ 572 if (!txskb) { 573 roc->cookie = ieee80211_mgmt_tx_cookie(local); 574 *cookie = roc->cookie; 575 } else { 576 roc->mgmt_tx_cookie = *cookie; 577 } 578 579 /* if there's no need to queue, handle it immediately */ 580 if (list_empty(&local->roc_list) && 581 !local->scanning && !ieee80211_is_radar_required(local)) { 582 /* if not HW assist, just queue & schedule work */ 583 if (!local->ops->remain_on_channel) { 584 list_add_tail(&roc->list, &local->roc_list); 585 wiphy_delayed_work_queue(local->hw.wiphy, 586 &local->roc_work, 0); 587 } else { 588 /* otherwise actually kick it off here 589 * (for error handling) 590 */ 591 ret = drv_remain_on_channel(local, sdata, channel, 592 duration, type); 593 if (ret) { 594 kfree(roc); 595 return ret; 596 } 597 roc->started = true; 598 list_add_tail(&roc->list, &local->roc_list); 599 } 600 601 return 0; 602 } 603 604 /* otherwise handle queueing */ 605 606 list_for_each_entry(tmp, &local->roc_list, list) { 607 if (tmp->chan != channel || tmp->sdata != sdata) 608 continue; 609 610 /* 611 * Extend this ROC if possible: If it hasn't started, add 612 * just after the new one to combine. 613 */ 614 if (!tmp->started) { 615 list_add(&roc->list, &tmp->list); 616 queued = true; 617 break; 618 } 619 620 if (!combine_started) 621 continue; 622 623 if (!local->ops->remain_on_channel) { 624 /* If there's no hardware remain-on-channel, and 625 * doing so won't push us over the maximum r-o-c 626 * we allow, then we can just add the new one to 627 * the list and mark it as having started now. 628 * If it would push over the limit, don't try to 629 * combine with other started ones (that haven't 630 * been running as long) but potentially sort it 631 * with others that had the same fate. 632 */ 633 unsigned long now = jiffies; 634 u32 elapsed = jiffies_to_msecs(now - tmp->start_time); 635 struct wiphy *wiphy = local->hw.wiphy; 636 u32 max_roc = wiphy->max_remain_on_channel_duration; 637 638 if (elapsed + roc->duration > max_roc) { 639 combine_started = false; 640 continue; 641 } 642 643 list_add(&roc->list, &tmp->list); 644 queued = true; 645 roc->on_channel = tmp->on_channel; 646 ieee80211_handle_roc_started(roc, now); 647 ieee80211_recalc_sw_work(local, now); 648 break; 649 } 650 651 queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp); 652 if (queued) 653 break; 654 /* if it wasn't queued, perhaps it can be combined with 655 * another that also couldn't get combined previously, 656 * but no need to check for already started ones, since 657 * that can't work. 658 */ 659 combine_started = false; 660 } 661 662 if (!queued) 663 list_add_tail(&roc->list, &local->roc_list); 664 665 return 0; 666 } 667 668 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev, 669 struct ieee80211_channel *chan, 670 unsigned int duration, u64 *cookie) 671 { 672 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 673 struct ieee80211_local *local = sdata->local; 674 675 lockdep_assert_wiphy(local->hw.wiphy); 676 677 return ieee80211_start_roc_work(local, sdata, chan, 678 duration, cookie, NULL, 679 IEEE80211_ROC_TYPE_NORMAL); 680 } 681 682 static int ieee80211_cancel_roc(struct ieee80211_local *local, 683 u64 cookie, bool mgmt_tx) 684 { 685 struct ieee80211_roc_work *roc, *tmp, *found = NULL; 686 int ret; 687 688 lockdep_assert_wiphy(local->hw.wiphy); 689 690 if (!cookie) 691 return -ENOENT; 692 693 wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start); 694 695 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 696 if (!mgmt_tx && roc->cookie != cookie) 697 continue; 698 else if (mgmt_tx && roc->mgmt_tx_cookie != cookie) 699 continue; 700 701 found = roc; 702 break; 703 } 704 705 if (!found) { 706 return -ENOENT; 707 } 708 709 if (!found->started) { 710 ieee80211_roc_notify_destroy(found); 711 goto out_unlock; 712 } 713 714 if (local->ops->remain_on_channel) { 715 ret = drv_cancel_remain_on_channel(local, roc->sdata); 716 if (WARN_ON_ONCE(ret)) { 717 return ret; 718 } 719 720 /* 721 * We could be racing against the notification from the driver: 722 * + driver is handling the notification on CPU0 723 * + user space is cancelling the remain on channel and 724 * schedules the hw_roc_done worker. 725 * 726 * Now hw_roc_done might start to run after the next roc will 727 * start and mac80211 will think that this second roc has 728 * ended prematurely. 729 * Cancel the work to make sure that all the pending workers 730 * have completed execution. 731 * Note that this assumes that by the time the driver returns 732 * from drv_cancel_remain_on_channel, it has completed all 733 * the processing of related notifications. 734 */ 735 wiphy_work_cancel(local->hw.wiphy, &local->hw_roc_done); 736 737 /* TODO: 738 * if multiple items were combined here then we really shouldn't 739 * cancel them all - we should wait for as much time as needed 740 * for the longest remaining one, and only then cancel ... 741 */ 742 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 743 if (!roc->started) 744 break; 745 if (roc == found) 746 found = NULL; 747 ieee80211_roc_notify_destroy(roc); 748 } 749 750 /* that really must not happen - it was started */ 751 WARN_ON(found); 752 753 ieee80211_start_next_roc(local); 754 } else { 755 /* go through work struct to return to the operating channel */ 756 found->abort = true; 757 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 0); 758 } 759 760 out_unlock: 761 762 return 0; 763 } 764 765 int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy, 766 struct wireless_dev *wdev, u64 cookie) 767 { 768 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 769 struct ieee80211_local *local = sdata->local; 770 771 return ieee80211_cancel_roc(local, cookie, false); 772 } 773 774 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, 775 struct cfg80211_mgmt_tx_params *params, u64 *cookie) 776 { 777 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); 778 struct ieee80211_local *local = sdata->local; 779 struct sk_buff *skb; 780 struct sta_info *sta = NULL; 781 const struct ieee80211_mgmt *mgmt = (void *)params->buf; 782 bool need_offchan = false; 783 bool mlo_sta = false; 784 int link_id = -1; 785 u32 flags; 786 int ret; 787 u8 *data; 788 789 lockdep_assert_wiphy(local->hw.wiphy); 790 791 if (params->dont_wait_for_ack) 792 flags = IEEE80211_TX_CTL_NO_ACK; 793 else 794 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX | 795 IEEE80211_TX_CTL_REQ_TX_STATUS; 796 797 if (params->no_cck) 798 flags |= IEEE80211_TX_CTL_NO_CCK_RATE; 799 800 switch (sdata->vif.type) { 801 case NL80211_IFTYPE_ADHOC: 802 if (!sdata->vif.cfg.ibss_joined) 803 need_offchan = true; 804 #ifdef CONFIG_MAC80211_MESH 805 fallthrough; 806 case NL80211_IFTYPE_MESH_POINT: 807 if (ieee80211_vif_is_mesh(&sdata->vif) && 808 !sdata->u.mesh.mesh_id_len) 809 need_offchan = true; 810 #endif 811 fallthrough; 812 case NL80211_IFTYPE_AP: 813 case NL80211_IFTYPE_AP_VLAN: 814 case NL80211_IFTYPE_P2P_GO: 815 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 816 !ieee80211_vif_is_mesh(&sdata->vif) && 817 !sdata->bss->active) 818 need_offchan = true; 819 820 rcu_read_lock(); 821 sta = sta_info_get_bss(sdata, mgmt->da); 822 mlo_sta = sta && sta->sta.mlo; 823 824 if (!ieee80211_is_action(mgmt->frame_control) || 825 mgmt->u.action.category == WLAN_CATEGORY_PUBLIC || 826 mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED || 827 mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) { 828 rcu_read_unlock(); 829 break; 830 } 831 832 if (!sta) { 833 rcu_read_unlock(); 834 return -ENOLINK; 835 } 836 if (params->link_id >= 0 && 837 !(sta->sta.valid_links & BIT(params->link_id))) { 838 rcu_read_unlock(); 839 return -ENOLINK; 840 } 841 link_id = params->link_id; 842 rcu_read_unlock(); 843 break; 844 case NL80211_IFTYPE_STATION: 845 case NL80211_IFTYPE_P2P_CLIENT: 846 if (!sdata->u.mgd.associated || 847 (params->offchan && params->wait && 848 local->ops->remain_on_channel && 849 memcmp(sdata->vif.cfg.ap_addr, mgmt->bssid, ETH_ALEN))) { 850 need_offchan = true; 851 } else if (sdata->u.mgd.associated && 852 ether_addr_equal(sdata->vif.cfg.ap_addr, mgmt->da)) { 853 sta = sta_info_get_bss(sdata, mgmt->da); 854 mlo_sta = sta && sta->sta.mlo; 855 } 856 break; 857 case NL80211_IFTYPE_P2P_DEVICE: 858 need_offchan = true; 859 break; 860 case NL80211_IFTYPE_NAN: 861 default: 862 return -EOPNOTSUPP; 863 } 864 865 /* configurations requiring offchan cannot work if no channel has been 866 * specified 867 */ 868 if (need_offchan && !params->chan) 869 return -EINVAL; 870 871 /* Check if the operating channel is the requested channel */ 872 if (!params->chan && mlo_sta) { 873 need_offchan = false; 874 } else if (!need_offchan) { 875 struct ieee80211_chanctx_conf *chanctx_conf = NULL; 876 int i; 877 878 rcu_read_lock(); 879 /* Check all the links first */ 880 for (i = 0; i < ARRAY_SIZE(sdata->vif.link_conf); i++) { 881 struct ieee80211_bss_conf *conf; 882 883 conf = rcu_dereference(sdata->vif.link_conf[i]); 884 if (!conf) 885 continue; 886 887 chanctx_conf = rcu_dereference(conf->chanctx_conf); 888 if (!chanctx_conf) 889 continue; 890 891 if (mlo_sta && params->chan == chanctx_conf->def.chan && 892 ether_addr_equal(sdata->vif.addr, mgmt->sa)) { 893 link_id = i; 894 break; 895 } 896 897 if (ether_addr_equal(conf->addr, mgmt->sa)) 898 break; 899 900 chanctx_conf = NULL; 901 } 902 903 if (chanctx_conf) { 904 need_offchan = params->chan && 905 (params->chan != 906 chanctx_conf->def.chan); 907 } else { 908 need_offchan = true; 909 } 910 rcu_read_unlock(); 911 } 912 913 if (need_offchan && !params->offchan) { 914 ret = -EBUSY; 915 goto out_unlock; 916 } 917 918 skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len); 919 if (!skb) { 920 ret = -ENOMEM; 921 goto out_unlock; 922 } 923 skb_reserve(skb, local->hw.extra_tx_headroom); 924 925 data = skb_put_data(skb, params->buf, params->len); 926 927 /* Update CSA counters */ 928 if (sdata->vif.bss_conf.csa_active && 929 (sdata->vif.type == NL80211_IFTYPE_AP || 930 sdata->vif.type == NL80211_IFTYPE_MESH_POINT || 931 sdata->vif.type == NL80211_IFTYPE_ADHOC) && 932 params->n_csa_offsets) { 933 int i; 934 struct beacon_data *beacon = NULL; 935 936 rcu_read_lock(); 937 938 if (sdata->vif.type == NL80211_IFTYPE_AP) 939 beacon = rcu_dereference(sdata->deflink.u.ap.beacon); 940 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 941 beacon = rcu_dereference(sdata->u.ibss.presp); 942 else if (ieee80211_vif_is_mesh(&sdata->vif)) 943 beacon = rcu_dereference(sdata->u.mesh.beacon); 944 945 if (beacon) 946 for (i = 0; i < params->n_csa_offsets; i++) 947 data[params->csa_offsets[i]] = 948 beacon->cntdwn_current_counter; 949 950 rcu_read_unlock(); 951 } 952 953 IEEE80211_SKB_CB(skb)->flags = flags; 954 955 skb->dev = sdata->dev; 956 957 if (!params->dont_wait_for_ack) { 958 /* make a copy to preserve the frame contents 959 * in case of encryption. 960 */ 961 ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL); 962 if (ret) { 963 kfree_skb(skb); 964 goto out_unlock; 965 } 966 } else { 967 /* Assign a dummy non-zero cookie, it's not sent to 968 * userspace in this case but we rely on its value 969 * internally in the need_offchan case to distinguish 970 * mgmt-tx from remain-on-channel. 971 */ 972 *cookie = 0xffffffff; 973 } 974 975 if (!need_offchan) { 976 ieee80211_tx_skb_tid(sdata, skb, 7, link_id); 977 ret = 0; 978 goto out_unlock; 979 } 980 981 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN | 982 IEEE80211_TX_INTFL_OFFCHAN_TX_OK; 983 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 984 IEEE80211_SKB_CB(skb)->hw_queue = 985 local->hw.offchannel_tx_hw_queue; 986 987 /* This will handle all kinds of coalescing and immediate TX */ 988 ret = ieee80211_start_roc_work(local, sdata, params->chan, 989 params->wait, cookie, skb, 990 IEEE80211_ROC_TYPE_MGMT_TX); 991 if (ret) 992 ieee80211_free_txskb(&local->hw, skb); 993 out_unlock: 994 return ret; 995 } 996 997 int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy, 998 struct wireless_dev *wdev, u64 cookie) 999 { 1000 struct ieee80211_local *local = wiphy_priv(wiphy); 1001 1002 return ieee80211_cancel_roc(local, cookie, true); 1003 } 1004 1005 void ieee80211_roc_setup(struct ieee80211_local *local) 1006 { 1007 wiphy_work_init(&local->hw_roc_start, ieee80211_hw_roc_start); 1008 wiphy_work_init(&local->hw_roc_done, ieee80211_hw_roc_done); 1009 wiphy_delayed_work_init(&local->roc_work, ieee80211_roc_work); 1010 INIT_LIST_HEAD(&local->roc_list); 1011 } 1012 1013 void ieee80211_roc_purge(struct ieee80211_local *local, 1014 struct ieee80211_sub_if_data *sdata) 1015 { 1016 struct ieee80211_roc_work *roc, *tmp; 1017 bool work_to_do = false; 1018 1019 lockdep_assert_wiphy(local->hw.wiphy); 1020 1021 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { 1022 if (sdata && roc->sdata != sdata) 1023 continue; 1024 1025 if (roc->started) { 1026 if (local->ops->remain_on_channel) { 1027 /* can race, so ignore return value */ 1028 drv_cancel_remain_on_channel(local, roc->sdata); 1029 ieee80211_roc_notify_destroy(roc); 1030 } else { 1031 roc->abort = true; 1032 work_to_do = true; 1033 } 1034 } else { 1035 ieee80211_roc_notify_destroy(roc); 1036 } 1037 } 1038 if (work_to_do) 1039 __ieee80211_roc_work(local); 1040 } 1041