linux/net/mac80211/offchannel.c
<<
>>
Prefs
   1/*
   2 * Off-channel operation helpers
   3 *
   4 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   5 * Copyright 2004, Instant802 Networks, Inc.
   6 * Copyright 2005, Devicescape Software, Inc.
   7 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9 * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
  10 *
  11 * This program is free software; you can redistribute it and/or modify
  12 * it under the terms of the GNU General Public License version 2 as
  13 * published by the Free Software Foundation.
  14 */
  15#include <linux/export.h>
  16#include <net/mac80211.h>
  17#include "ieee80211_i.h"
  18#include "driver-ops.h"
  19
  20/*
  21 * Tell our hardware to disable PS.
  22 * Optionally inform AP that we will go to sleep so that it will buffer
  23 * the frames while we are doing off-channel work.  This is optional
  24 * because we *may* be doing work on-operating channel, and want our
  25 * hardware unconditionally awake, but still let the AP send us normal frames.
  26 */
  27static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
  28{
  29        struct ieee80211_local *local = sdata->local;
  30        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
  31
  32        local->offchannel_ps_enabled = false;
  33
  34        /* FIXME: what to do when local->pspolling is true? */
  35
  36        del_timer_sync(&local->dynamic_ps_timer);
  37        del_timer_sync(&ifmgd->bcn_mon_timer);
  38        del_timer_sync(&ifmgd->conn_mon_timer);
  39
  40        cancel_work_sync(&local->dynamic_ps_enable_work);
  41
  42        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
  43                local->offchannel_ps_enabled = true;
  44                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
  45                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
  46        }
  47
  48        if (!local->offchannel_ps_enabled ||
  49            !ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
  50                /*
  51                 * If power save was enabled, no need to send a nullfunc
  52                 * frame because AP knows that we are sleeping. But if the
  53                 * hardware is creating the nullfunc frame for power save
  54                 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
  55                 * enabled) and power save was enabled, the firmware just
  56                 * sent a null frame with power save disabled. So we need
  57                 * to send a new nullfunc frame to inform the AP that we
  58                 * are again sleeping.
  59                 */
  60                ieee80211_send_nullfunc(local, sdata, true);
  61}
  62
  63/* inform AP that we are awake again, unless power save is enabled */
  64static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
  65{
  66        struct ieee80211_local *local = sdata->local;
  67
  68        if (!local->ps_sdata)
  69                ieee80211_send_nullfunc(local, sdata, false);
  70        else if (local->offchannel_ps_enabled) {
  71                /*
  72                 * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
  73                 * will send a nullfunc frame with the powersave bit set
  74                 * even though the AP already knows that we are sleeping.
  75                 * This could be avoided by sending a null frame with power
  76                 * save bit disabled before enabling the power save, but
  77                 * this doesn't gain anything.
  78                 *
  79                 * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
  80                 * to send a nullfunc frame because AP already knows that
  81                 * we are sleeping, let's just enable power save mode in
  82                 * hardware.
  83                 */
  84                /* TODO:  Only set hardware if CONF_PS changed?
  85                 * TODO:  Should we set offchannel_ps_enabled to false?
  86                 */
  87                local->hw.conf.flags |= IEEE80211_CONF_PS;
  88                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
  89        } else if (local->hw.conf.dynamic_ps_timeout > 0) {
  90                /*
  91                 * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
  92                 * had been running before leaving the operating channel,
  93                 * restart the timer now and send a nullfunc frame to inform
  94                 * the AP that we are awake.
  95                 */
  96                ieee80211_send_nullfunc(local, sdata, false);
  97                mod_timer(&local->dynamic_ps_timer, jiffies +
  98                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
  99        }
 100
 101        ieee80211_sta_reset_beacon_monitor(sdata);
 102        ieee80211_sta_reset_conn_monitor(sdata);
 103}
 104
 105void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
 106{
 107        struct ieee80211_sub_if_data *sdata;
 108
 109        if (WARN_ON(local->use_chanctx))
 110                return;
 111
 112        /*
 113         * notify the AP about us leaving the channel and stop all
 114         * STA interfaces.
 115         */
 116
 117        /*
 118         * Stop queues and transmit all frames queued by the driver
 119         * before sending nullfunc to enable powersave at the AP.
 120         */
 121        ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
 122                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 123                                        false);
 124        ieee80211_flush_queues(local, NULL, false);
 125
 126        mutex_lock(&local->iflist_mtx);
 127        list_for_each_entry(sdata, &local->interfaces, list) {
 128                if (!ieee80211_sdata_running(sdata))
 129                        continue;
 130
 131                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
 132                    sdata->vif.type == NL80211_IFTYPE_NAN)
 133                        continue;
 134
 135                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 136                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 137
 138                /* Check to see if we should disable beaconing. */
 139                if (sdata->vif.bss_conf.enable_beacon) {
 140                        set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 141                                &sdata->state);
 142                        sdata->vif.bss_conf.enable_beacon = false;
 143                        ieee80211_bss_info_change_notify(
 144                                sdata, BSS_CHANGED_BEACON_ENABLED);
 145                }
 146
 147                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 148                    sdata->u.mgd.associated)
 149                        ieee80211_offchannel_ps_enable(sdata);
 150        }
 151        mutex_unlock(&local->iflist_mtx);
 152}
 153
 154void ieee80211_offchannel_return(struct ieee80211_local *local)
 155{
 156        struct ieee80211_sub_if_data *sdata;
 157
 158        if (WARN_ON(local->use_chanctx))
 159                return;
 160
 161        mutex_lock(&local->iflist_mtx);
 162        list_for_each_entry(sdata, &local->interfaces, list) {
 163                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 164                        continue;
 165
 166                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 167                        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 168
 169                if (!ieee80211_sdata_running(sdata))
 170                        continue;
 171
 172                /* Tell AP we're back */
 173                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 174                    sdata->u.mgd.associated)
 175                        ieee80211_offchannel_ps_disable(sdata);
 176
 177                if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 178                                       &sdata->state)) {
 179                        sdata->vif.bss_conf.enable_beacon = true;
 180                        ieee80211_bss_info_change_notify(
 181                                sdata, BSS_CHANGED_BEACON_ENABLED);
 182                }
 183        }
 184        mutex_unlock(&local->iflist_mtx);
 185
 186        ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
 187                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 188                                        false);
 189}
 190
 191static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
 192{
 193        /* was never transmitted */
 194        if (roc->frame) {
 195                cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie,
 196                                        roc->frame->data, roc->frame->len,
 197                                        false, GFP_KERNEL);
 198                ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame);
 199        }
 200
 201        if (!roc->mgmt_tx_cookie)
 202                cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
 203                                                   roc->cookie, roc->chan,
 204                                                   GFP_KERNEL);
 205
 206        list_del(&roc->list);
 207        kfree(roc);
 208}
 209
 210static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local,
 211                                                 unsigned long now)
 212{
 213        struct ieee80211_roc_work *roc, *tmp;
 214        long remaining_dur_min = LONG_MAX;
 215
 216        lockdep_assert_held(&local->mtx);
 217
 218        list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 219                long remaining;
 220
 221                if (!roc->started)
 222                        break;
 223
 224                remaining = roc->start_time +
 225                            msecs_to_jiffies(roc->duration) -
 226                            now;
 227
 228                /* In case of HW ROC, it is possible that the HW finished the
 229                 * ROC session before the actual requested time. In such a case
 230                 * end the ROC session (disregarding the remaining time).
 231                 */
 232                if (roc->abort || roc->hw_begun || remaining <= 0)
 233                        ieee80211_roc_notify_destroy(roc);
 234                else
 235                        remaining_dur_min = min(remaining_dur_min, remaining);
 236        }
 237
 238        return remaining_dur_min;
 239}
 240
 241static bool ieee80211_recalc_sw_work(struct ieee80211_local *local,
 242                                     unsigned long now)
 243{
 244        long dur = ieee80211_end_finished_rocs(local, now);
 245
 246        if (dur == LONG_MAX)
 247                return false;
 248
 249        mod_delayed_work(local->workqueue, &local->roc_work, dur);
 250        return true;
 251}
 252
 253static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
 254                                         unsigned long start_time)
 255{
 256        if (WARN_ON(roc->notified))
 257                return;
 258
 259        roc->start_time = start_time;
 260        roc->started = true;
 261
 262        if (roc->mgmt_tx_cookie) {
 263                if (!WARN_ON(!roc->frame)) {
 264                        ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7,
 265                                                  roc->chan->band);
 266                        roc->frame = NULL;
 267                }
 268        } else {
 269                cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie,
 270                                          roc->chan, roc->req_duration,
 271                                          GFP_KERNEL);
 272        }
 273
 274        roc->notified = true;
 275}
 276
 277static void ieee80211_hw_roc_start(struct work_struct *work)
 278{
 279        struct ieee80211_local *local =
 280                container_of(work, struct ieee80211_local, hw_roc_start);
 281        struct ieee80211_roc_work *roc;
 282
 283        mutex_lock(&local->mtx);
 284
 285        list_for_each_entry(roc, &local->roc_list, list) {
 286                if (!roc->started)
 287                        break;
 288
 289                roc->hw_begun = true;
 290                ieee80211_handle_roc_started(roc, local->hw_roc_start_time);
 291        }
 292
 293        mutex_unlock(&local->mtx);
 294}
 295
 296void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
 297{
 298        struct ieee80211_local *local = hw_to_local(hw);
 299
 300        local->hw_roc_start_time = jiffies;
 301
 302        trace_api_ready_on_channel(local);
 303
 304        ieee80211_queue_work(hw, &local->hw_roc_start);
 305}
 306EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
 307
 308static void _ieee80211_start_next_roc(struct ieee80211_local *local)
 309{
 310        struct ieee80211_roc_work *roc, *tmp;
 311        enum ieee80211_roc_type type;
 312        u32 min_dur, max_dur;
 313
 314        lockdep_assert_held(&local->mtx);
 315
 316        if (WARN_ON(list_empty(&local->roc_list)))
 317                return;
 318
 319        roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 320                               list);
 321
 322        if (WARN_ON(roc->started))
 323                return;
 324
 325        min_dur = roc->duration;
 326        max_dur = roc->duration;
 327        type = roc->type;
 328
 329        list_for_each_entry(tmp, &local->roc_list, list) {
 330                if (tmp == roc)
 331                        continue;
 332                if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 333                        break;
 334                max_dur = max(tmp->duration, max_dur);
 335                min_dur = min(tmp->duration, min_dur);
 336                type = max(tmp->type, type);
 337        }
 338
 339        if (local->ops->remain_on_channel) {
 340                int ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
 341                                                max_dur, type);
 342
 343                if (ret) {
 344                        wiphy_warn(local->hw.wiphy,
 345                                   "failed to start next HW ROC (%d)\n", ret);
 346                        /*
 347                         * queue the work struct again to avoid recursion
 348                         * when multiple failures occur
 349                         */
 350                        list_for_each_entry(tmp, &local->roc_list, list) {
 351                                if (tmp->sdata != roc->sdata ||
 352                                    tmp->chan != roc->chan)
 353                                        break;
 354                                tmp->started = true;
 355                                tmp->abort = true;
 356                        }
 357                        ieee80211_queue_work(&local->hw, &local->hw_roc_done);
 358                        return;
 359                }
 360
 361                /* we'll notify about the start once the HW calls back */
 362                list_for_each_entry(tmp, &local->roc_list, list) {
 363                        if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 364                                break;
 365                        tmp->started = true;
 366                }
 367        } else {
 368                /* If actually operating on the desired channel (with at least
 369                 * 20 MHz channel width) don't stop all the operations but still
 370                 * treat it as though the ROC operation started properly, so
 371                 * other ROC operations won't interfere with this one.
 372                 */
 373                roc->on_channel = roc->chan == local->_oper_chandef.chan &&
 374                                  local->_oper_chandef.width != NL80211_CHAN_WIDTH_5 &&
 375                                  local->_oper_chandef.width != NL80211_CHAN_WIDTH_10;
 376
 377                /* start this ROC */
 378                ieee80211_recalc_idle(local);
 379
 380                if (!roc->on_channel) {
 381                        ieee80211_offchannel_stop_vifs(local);
 382
 383                        local->tmp_channel = roc->chan;
 384                        ieee80211_hw_config(local, 0);
 385                }
 386
 387                ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
 388                                             msecs_to_jiffies(min_dur));
 389
 390                /* tell userspace or send frame(s) */
 391                list_for_each_entry(tmp, &local->roc_list, list) {
 392                        if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 393                                break;
 394
 395                        tmp->on_channel = roc->on_channel;
 396                        ieee80211_handle_roc_started(tmp, jiffies);
 397                }
 398        }
 399}
 400
 401void ieee80211_start_next_roc(struct ieee80211_local *local)
 402{
 403        struct ieee80211_roc_work *roc;
 404
 405        lockdep_assert_held(&local->mtx);
 406
 407        if (list_empty(&local->roc_list)) {
 408                ieee80211_run_deferred_scan(local);
 409                return;
 410        }
 411
 412        /* defer roc if driver is not started (i.e. during reconfig) */
 413        if (local->in_reconfig)
 414                return;
 415
 416        roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 417                               list);
 418
 419        if (WARN_ON_ONCE(roc->started))
 420                return;
 421
 422        if (local->ops->remain_on_channel) {
 423                _ieee80211_start_next_roc(local);
 424        } else {
 425                /* delay it a bit */
 426                ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
 427                                             round_jiffies_relative(HZ/2));
 428        }
 429}
 430
 431static void __ieee80211_roc_work(struct ieee80211_local *local)
 432{
 433        struct ieee80211_roc_work *roc;
 434        bool on_channel;
 435
 436        lockdep_assert_held(&local->mtx);
 437
 438        if (WARN_ON(local->ops->remain_on_channel))
 439                return;
 440
 441        roc = list_first_entry_or_null(&local->roc_list,
 442                                       struct ieee80211_roc_work, list);
 443        if (!roc)
 444                return;
 445
 446        if (!roc->started) {
 447                WARN_ON(local->use_chanctx);
 448                _ieee80211_start_next_roc(local);
 449        } else {
 450                on_channel = roc->on_channel;
 451                if (ieee80211_recalc_sw_work(local, jiffies))
 452                        return;
 453
 454                /* careful - roc pointer became invalid during recalc */
 455
 456                if (!on_channel) {
 457                        ieee80211_flush_queues(local, NULL, false);
 458
 459                        local->tmp_channel = NULL;
 460                        ieee80211_hw_config(local, 0);
 461
 462                        ieee80211_offchannel_return(local);
 463                }
 464
 465                ieee80211_recalc_idle(local);
 466                ieee80211_start_next_roc(local);
 467        }
 468}
 469
 470static void ieee80211_roc_work(struct work_struct *work)
 471{
 472        struct ieee80211_local *local =
 473                container_of(work, struct ieee80211_local, roc_work.work);
 474
 475        mutex_lock(&local->mtx);
 476        __ieee80211_roc_work(local);
 477        mutex_unlock(&local->mtx);
 478}
 479
 480static void ieee80211_hw_roc_done(struct work_struct *work)
 481{
 482        struct ieee80211_local *local =
 483                container_of(work, struct ieee80211_local, hw_roc_done);
 484
 485        mutex_lock(&local->mtx);
 486
 487        ieee80211_end_finished_rocs(local, jiffies);
 488
 489        /* if there's another roc, start it now */
 490        ieee80211_start_next_roc(local);
 491
 492        mutex_unlock(&local->mtx);
 493}
 494
 495void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
 496{
 497        struct ieee80211_local *local = hw_to_local(hw);
 498
 499        trace_api_remain_on_channel_expired(local);
 500
 501        ieee80211_queue_work(hw, &local->hw_roc_done);
 502}
 503EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
 504
 505static bool
 506ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
 507                                  struct ieee80211_roc_work *new_roc,
 508                                  struct ieee80211_roc_work *cur_roc)
 509{
 510        unsigned long now = jiffies;
 511        unsigned long remaining;
 512
 513        if (WARN_ON(!cur_roc->started))
 514                return false;
 515
 516        /* if it was scheduled in the hardware, but not started yet,
 517         * we can only combine if the older one had a longer duration
 518         */
 519        if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration)
 520                return false;
 521
 522        remaining = cur_roc->start_time +
 523                    msecs_to_jiffies(cur_roc->duration) -
 524                    now;
 525
 526        /* if it doesn't fit entirely, schedule a new one */
 527        if (new_roc->duration > jiffies_to_msecs(remaining))
 528                return false;
 529
 530        /* add just after the current one so we combine their finish later */
 531        list_add(&new_roc->list, &cur_roc->list);
 532
 533        /* if the existing one has already begun then let this one also
 534         * begin, otherwise they'll both be marked properly by the work
 535         * struct that runs once the driver notifies us of the beginning
 536         */
 537        if (cur_roc->hw_begun) {
 538                new_roc->hw_begun = true;
 539                ieee80211_handle_roc_started(new_roc, now);
 540        }
 541
 542        return true;
 543}
 544
 545static int ieee80211_start_roc_work(struct ieee80211_local *local,
 546                                    struct ieee80211_sub_if_data *sdata,
 547                                    struct ieee80211_channel *channel,
 548                                    unsigned int duration, u64 *cookie,
 549                                    struct sk_buff *txskb,
 550                                    enum ieee80211_roc_type type)
 551{
 552        struct ieee80211_roc_work *roc, *tmp;
 553        bool queued = false, combine_started = true;
 554        int ret;
 555
 556        lockdep_assert_held(&local->mtx);
 557
 558        if (local->use_chanctx && !local->ops->remain_on_channel)
 559                return -EOPNOTSUPP;
 560
 561        roc = kzalloc(sizeof(*roc), GFP_KERNEL);
 562        if (!roc)
 563                return -ENOMEM;
 564
 565        /*
 566         * If the duration is zero, then the driver
 567         * wouldn't actually do anything. Set it to
 568         * 10 for now.
 569         *
 570         * TODO: cancel the off-channel operation
 571         *       when we get the SKB's TX status and
 572         *       the wait time was zero before.
 573         */
 574        if (!duration)
 575                duration = 10;
 576
 577        roc->chan = channel;
 578        roc->duration = duration;
 579        roc->req_duration = duration;
 580        roc->frame = txskb;
 581        roc->type = type;
 582        roc->sdata = sdata;
 583
 584        /*
 585         * cookie is either the roc cookie (for normal roc)
 586         * or the SKB (for mgmt TX)
 587         */
 588        if (!txskb) {
 589                roc->cookie = ieee80211_mgmt_tx_cookie(local);
 590                *cookie = roc->cookie;
 591        } else {
 592                roc->mgmt_tx_cookie = *cookie;
 593        }
 594
 595        /* if there's no need to queue, handle it immediately */
 596        if (list_empty(&local->roc_list) &&
 597            !local->scanning && !ieee80211_is_radar_required(local)) {
 598                /* if not HW assist, just queue & schedule work */
 599                if (!local->ops->remain_on_channel) {
 600                        list_add_tail(&roc->list, &local->roc_list);
 601                        ieee80211_queue_delayed_work(&local->hw,
 602                                                     &local->roc_work, 0);
 603                } else {
 604                        /* otherwise actually kick it off here
 605                         * (for error handling)
 606                         */
 607                        ret = drv_remain_on_channel(local, sdata, channel,
 608                                                    duration, type);
 609                        if (ret) {
 610                                kfree(roc);
 611                                return ret;
 612                        }
 613                        roc->started = true;
 614                        list_add_tail(&roc->list, &local->roc_list);
 615                }
 616
 617                return 0;
 618        }
 619
 620        /* otherwise handle queueing */
 621
 622        list_for_each_entry(tmp, &local->roc_list, list) {
 623                if (tmp->chan != channel || tmp->sdata != sdata)
 624                        continue;
 625
 626                /*
 627                 * Extend this ROC if possible: If it hasn't started, add
 628                 * just after the new one to combine.
 629                 */
 630                if (!tmp->started) {
 631                        list_add(&roc->list, &tmp->list);
 632                        queued = true;
 633                        break;
 634                }
 635
 636                if (!combine_started)
 637                        continue;
 638
 639                if (!local->ops->remain_on_channel) {
 640                        /* If there's no hardware remain-on-channel, and
 641                         * doing so won't push us over the maximum r-o-c
 642                         * we allow, then we can just add the new one to
 643                         * the list and mark it as having started now.
 644                         * If it would push over the limit, don't try to
 645                         * combine with other started ones (that haven't
 646                         * been running as long) but potentially sort it
 647                         * with others that had the same fate.
 648                         */
 649                        unsigned long now = jiffies;
 650                        u32 elapsed = jiffies_to_msecs(now - tmp->start_time);
 651                        struct wiphy *wiphy = local->hw.wiphy;
 652                        u32 max_roc = wiphy->max_remain_on_channel_duration;
 653
 654                        if (elapsed + roc->duration > max_roc) {
 655                                combine_started = false;
 656                                continue;
 657                        }
 658
 659                        list_add(&roc->list, &tmp->list);
 660                        queued = true;
 661                        roc->on_channel = tmp->on_channel;
 662                        ieee80211_handle_roc_started(roc, now);
 663                        ieee80211_recalc_sw_work(local, now);
 664                        break;
 665                }
 666
 667                queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp);
 668                if (queued)
 669                        break;
 670                /* if it wasn't queued, perhaps it can be combined with
 671                 * another that also couldn't get combined previously,
 672                 * but no need to check for already started ones, since
 673                 * that can't work.
 674                 */
 675                combine_started = false;
 676        }
 677
 678        if (!queued)
 679                list_add_tail(&roc->list, &local->roc_list);
 680
 681        return 0;
 682}
 683
 684int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 685                                struct ieee80211_channel *chan,
 686                                unsigned int duration, u64 *cookie)
 687{
 688        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 689        struct ieee80211_local *local = sdata->local;
 690        int ret;
 691
 692        mutex_lock(&local->mtx);
 693        ret = ieee80211_start_roc_work(local, sdata, chan,
 694                                       duration, cookie, NULL,
 695                                       IEEE80211_ROC_TYPE_NORMAL);
 696        mutex_unlock(&local->mtx);
 697
 698        return ret;
 699}
 700
 701static int ieee80211_cancel_roc(struct ieee80211_local *local,
 702                                u64 cookie, bool mgmt_tx)
 703{
 704        struct ieee80211_roc_work *roc, *tmp, *found = NULL;
 705        int ret;
 706
 707        if (!cookie)
 708                return -ENOENT;
 709
 710        flush_work(&local->hw_roc_start);
 711
 712        mutex_lock(&local->mtx);
 713        list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 714                if (!mgmt_tx && roc->cookie != cookie)
 715                        continue;
 716                else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
 717                        continue;
 718
 719                found = roc;
 720                break;
 721        }
 722
 723        if (!found) {
 724                mutex_unlock(&local->mtx);
 725                return -ENOENT;
 726        }
 727
 728        if (!found->started) {
 729                ieee80211_roc_notify_destroy(found);
 730                goto out_unlock;
 731        }
 732
 733        if (local->ops->remain_on_channel) {
 734                ret = drv_cancel_remain_on_channel(local);
 735                if (WARN_ON_ONCE(ret)) {
 736                        mutex_unlock(&local->mtx);
 737                        return ret;
 738                }
 739
 740                /* TODO:
 741                 * if multiple items were combined here then we really shouldn't
 742                 * cancel them all - we should wait for as much time as needed
 743                 * for the longest remaining one, and only then cancel ...
 744                 */
 745                list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 746                        if (!roc->started)
 747                                break;
 748                        if (roc == found)
 749                                found = NULL;
 750                        ieee80211_roc_notify_destroy(roc);
 751                }
 752
 753                /* that really must not happen - it was started */
 754                WARN_ON(found);
 755
 756                ieee80211_start_next_roc(local);
 757        } else {
 758                /* go through work struct to return to the operating channel */
 759                found->abort = true;
 760                mod_delayed_work(local->workqueue, &local->roc_work, 0);
 761        }
 762
 763 out_unlock:
 764        mutex_unlock(&local->mtx);
 765
 766        return 0;
 767}
 768
 769int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 770                                       struct wireless_dev *wdev, u64 cookie)
 771{
 772        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 773        struct ieee80211_local *local = sdata->local;
 774
 775        return ieee80211_cancel_roc(local, cookie, false);
 776}
 777
 778int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 779                      struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 780{
 781        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 782        struct ieee80211_local *local = sdata->local;
 783        struct sk_buff *skb;
 784        struct sta_info *sta;
 785        const struct ieee80211_mgmt *mgmt = (void *)params->buf;
 786        bool need_offchan = false;
 787        u32 flags;
 788        int ret;
 789        u8 *data;
 790
 791        if (params->dont_wait_for_ack)
 792                flags = IEEE80211_TX_CTL_NO_ACK;
 793        else
 794                flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
 795                        IEEE80211_TX_CTL_REQ_TX_STATUS;
 796
 797        if (params->no_cck)
 798                flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 799
 800        switch (sdata->vif.type) {
 801        case NL80211_IFTYPE_ADHOC:
 802                if (!sdata->vif.bss_conf.ibss_joined)
 803                        need_offchan = true;
 804                /* fall through */
 805#ifdef CONFIG_MAC80211_MESH
 806        case NL80211_IFTYPE_MESH_POINT:
 807                if (ieee80211_vif_is_mesh(&sdata->vif) &&
 808                    !sdata->u.mesh.mesh_id_len)
 809                        need_offchan = true;
 810                /* fall through */
 811#endif
 812        case NL80211_IFTYPE_AP:
 813        case NL80211_IFTYPE_AP_VLAN:
 814        case NL80211_IFTYPE_P2P_GO:
 815                if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 816                    !ieee80211_vif_is_mesh(&sdata->vif) &&
 817                    !rcu_access_pointer(sdata->bss->beacon))
 818                        need_offchan = true;
 819                if (!ieee80211_is_action(mgmt->frame_control) ||
 820                    mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
 821                    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
 822                    mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT)
 823                        break;
 824                rcu_read_lock();
 825                sta = sta_info_get_bss(sdata, mgmt->da);
 826                rcu_read_unlock();
 827                if (!sta)
 828                        return -ENOLINK;
 829                break;
 830        case NL80211_IFTYPE_STATION:
 831        case NL80211_IFTYPE_P2P_CLIENT:
 832                sdata_lock(sdata);
 833                if (!sdata->u.mgd.associated ||
 834                    (params->offchan && params->wait &&
 835                     local->ops->remain_on_channel &&
 836                     memcmp(sdata->u.mgd.associated->bssid,
 837                            mgmt->bssid, ETH_ALEN)))
 838                        need_offchan = true;
 839                sdata_unlock(sdata);
 840                break;
 841        case NL80211_IFTYPE_P2P_DEVICE:
 842                need_offchan = true;
 843                break;
 844        case NL80211_IFTYPE_NAN:
 845        default:
 846                return -EOPNOTSUPP;
 847        }
 848
 849        /* configurations requiring offchan cannot work if no channel has been
 850         * specified
 851         */
 852        if (need_offchan && !params->chan)
 853                return -EINVAL;
 854
 855        mutex_lock(&local->mtx);
 856
 857        /* Check if the operating channel is the requested channel */
 858        if (!need_offchan) {
 859                struct ieee80211_chanctx_conf *chanctx_conf;
 860
 861                rcu_read_lock();
 862                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 863
 864                if (chanctx_conf) {
 865                        need_offchan = params->chan &&
 866                                       (params->chan !=
 867                                        chanctx_conf->def.chan);
 868                } else if (!params->chan) {
 869                        ret = -EINVAL;
 870                        rcu_read_unlock();
 871                        goto out_unlock;
 872                } else {
 873                        need_offchan = true;
 874                }
 875                rcu_read_unlock();
 876        }
 877
 878        if (need_offchan && !params->offchan) {
 879                ret = -EBUSY;
 880                goto out_unlock;
 881        }
 882
 883        skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
 884        if (!skb) {
 885                ret = -ENOMEM;
 886                goto out_unlock;
 887        }
 888        skb_reserve(skb, local->hw.extra_tx_headroom);
 889
 890        data = skb_put_data(skb, params->buf, params->len);
 891
 892        /* Update CSA counters */
 893        if (sdata->vif.csa_active &&
 894            (sdata->vif.type == NL80211_IFTYPE_AP ||
 895             sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
 896             sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
 897            params->n_csa_offsets) {
 898                int i;
 899                struct beacon_data *beacon = NULL;
 900
 901                rcu_read_lock();
 902
 903                if (sdata->vif.type == NL80211_IFTYPE_AP)
 904                        beacon = rcu_dereference(sdata->u.ap.beacon);
 905                else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
 906                        beacon = rcu_dereference(sdata->u.ibss.presp);
 907                else if (ieee80211_vif_is_mesh(&sdata->vif))
 908                        beacon = rcu_dereference(sdata->u.mesh.beacon);
 909
 910                if (beacon)
 911                        for (i = 0; i < params->n_csa_offsets; i++)
 912                                data[params->csa_offsets[i]] =
 913                                        beacon->csa_current_counter;
 914
 915                rcu_read_unlock();
 916        }
 917
 918        IEEE80211_SKB_CB(skb)->flags = flags;
 919
 920        skb->dev = sdata->dev;
 921
 922        if (!params->dont_wait_for_ack) {
 923                /* make a copy to preserve the frame contents
 924                 * in case of encryption.
 925                 */
 926                ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);
 927                if (ret) {
 928                        kfree_skb(skb);
 929                        goto out_unlock;
 930                }
 931        } else {
 932                /* Assign a dummy non-zero cookie, it's not sent to
 933                 * userspace in this case but we rely on its value
 934                 * internally in the need_offchan case to distinguish
 935                 * mgmt-tx from remain-on-channel.
 936                 */
 937                *cookie = 0xffffffff;
 938        }
 939
 940        if (!need_offchan) {
 941                ieee80211_tx_skb(sdata, skb);
 942                ret = 0;
 943                goto out_unlock;
 944        }
 945
 946        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
 947                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
 948        if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
 949                IEEE80211_SKB_CB(skb)->hw_queue =
 950                        local->hw.offchannel_tx_hw_queue;
 951
 952        /* This will handle all kinds of coalescing and immediate TX */
 953        ret = ieee80211_start_roc_work(local, sdata, params->chan,
 954                                       params->wait, cookie, skb,
 955                                       IEEE80211_ROC_TYPE_MGMT_TX);
 956        if (ret)
 957                ieee80211_free_txskb(&local->hw, skb);
 958 out_unlock:
 959        mutex_unlock(&local->mtx);
 960        return ret;
 961}
 962
 963int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 964                                  struct wireless_dev *wdev, u64 cookie)
 965{
 966        struct ieee80211_local *local = wiphy_priv(wiphy);
 967
 968        return ieee80211_cancel_roc(local, cookie, true);
 969}
 970
 971void ieee80211_roc_setup(struct ieee80211_local *local)
 972{
 973        INIT_WORK(&local->hw_roc_start, ieee80211_hw_roc_start);
 974        INIT_WORK(&local->hw_roc_done, ieee80211_hw_roc_done);
 975        INIT_DELAYED_WORK(&local->roc_work, ieee80211_roc_work);
 976        INIT_LIST_HEAD(&local->roc_list);
 977}
 978
 979void ieee80211_roc_purge(struct ieee80211_local *local,
 980                         struct ieee80211_sub_if_data *sdata)
 981{
 982        struct ieee80211_roc_work *roc, *tmp;
 983        bool work_to_do = false;
 984
 985        mutex_lock(&local->mtx);
 986        list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 987                if (sdata && roc->sdata != sdata)
 988                        continue;
 989
 990                if (roc->started) {
 991                        if (local->ops->remain_on_channel) {
 992                                /* can race, so ignore return value */
 993                                drv_cancel_remain_on_channel(local);
 994                                ieee80211_roc_notify_destroy(roc);
 995                        } else {
 996                                roc->abort = true;
 997                                work_to_do = true;
 998                        }
 999                } else {
1000                        ieee80211_roc_notify_destroy(roc);
1001                }
1002        }
1003        if (work_to_do)
1004                __ieee80211_roc_work(local);
1005        mutex_unlock(&local->mtx);
1006}
1007