net/mac80211/offchannel.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Off-channel operation helpers
   4  *
   5  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   6  * Copyright 2004, Instant802 Networks, Inc.
   7  * Copyright 2005, Devicescape Software, Inc.
   8  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   9  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  10  * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
  11  * Copyright (C) 2019, 2022-2023 Intel Corporation
  12  */
  13 #include <linux/export.h>
  14 #include <net/mac80211.h>
  15 #include "ieee80211_i.h"
  16 #include "driver-ops.h"
  17
  18 /*
  19  * Tell our hardware to disable PS.
  20  * Optionally inform AP that we will go to sleep so that it will buffer
  21  * the frames while we are doing off-channel work.  This is optional
  22  * because we *may* be doing work on-operating channel, and want our
  23  * hardware unconditionally awake, but still let the AP send us normal frames.
  24  */
  25 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
  26 {
  27         struct ieee80211_local *local = sdata->local;
  28         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
  29         bool offchannel_ps_enabled = false;
  30
  31         /* FIXME: what to do when local->pspolling is true? */
  32
  33         del_timer_sync(&local->dynamic_ps_timer);
  34         del_timer_sync(&ifmgd->bcn_mon_timer);
  35         del_timer_sync(&ifmgd->conn_mon_timer);
  36
  37         wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work);
  38
  39         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
  40                 offchannel_ps_enabled = true;
  41                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
  42                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
  43         }
  44
  45         if (!offchannel_ps_enabled ||
  46             !ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
  47                 /*
  48                  * If power save was enabled, no need to send a nullfunc
  49                  * frame because AP knows that we are sleeping. But if the
  50                  * hardware is creating the nullfunc frame for power save
  51                  * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
  52                  * enabled) and power save was enabled, the firmware just
  53                  * sent a null frame with power save disabled. So we need
  54                  * to send a new nullfunc frame to inform the AP that we
  55                  * are again sleeping.
  56                  */
  57                 ieee80211_send_nullfunc(local, sdata, true);
  58 }
  59
  60 /* inform AP that we are awake again */
  61 static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
  62 {
  63         struct ieee80211_local *local = sdata->local;
  64
  65         if (!local->ps_sdata)
  66                 ieee80211_send_nullfunc(local, sdata, false);
  67         else if (local->hw.conf.dynamic_ps_timeout > 0) {
  68                 /*
  69                  * the dynamic_ps_timer had been running before leaving the
  70                  * operating channel, restart the timer now and send a nullfunc
  71                  * frame to inform the AP that we are awake so that AP sends
  72                  * the buffered packets (if any).
  73                  */
  74                 ieee80211_send_nullfunc(local, sdata, false);
  75                 mod_timer(&local->dynamic_ps_timer, jiffies +
  76                           msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
  77         }
  78
  79         ieee80211_sta_reset_beacon_monitor(sdata);
  80         ieee80211_sta_reset_conn_monitor(sdata);
  81 }
  82
  83 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
  84 {
  85         struct ieee80211_sub_if_data *sdata;
  86
  87         lockdep_assert_wiphy(local->hw.wiphy);
  88
  89         if (WARN_ON(!local->emulate_chanctx))
  90                 return;
  91
  92         /*
  93          * notify the AP about us leaving the channel and stop all
  94          * STA interfaces.
  95          */
  96
  97         /*
  98          * Stop queues and transmit all frames queued by the driver
  99          * before sending nullfunc to enable powersave at the AP.
 100          */
 101         ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
 102                                         IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 103                                         false);
 104         ieee80211_flush_queues(local, NULL, false);
 105
 106         list_for_each_entry(sdata, &local->interfaces, list) {
 107                 if (!ieee80211_sdata_running(sdata))
 108                         continue;
 109
 110                 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
 111                     sdata->vif.type == NL80211_IFTYPE_NAN)
 112                         continue;
 113
 114                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 115                         set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 116
 117                 /* Check to see if we should disable beaconing. */
 118                 if (sdata->vif.bss_conf.enable_beacon) {
 119                         set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 120                                 &sdata->state);
 121                         sdata->vif.bss_conf.enable_beacon = false;
 122                         ieee80211_link_info_change_notify(
 123                                 sdata, &sdata->deflink,
 124                                 BSS_CHANGED_BEACON_ENABLED);
 125                 }
 126
 127                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 128                     sdata->u.mgd.associated)
 129                         ieee80211_offchannel_ps_enable(sdata);
 130         }
 131 }
 132
 133 void ieee80211_offchannel_return(struct ieee80211_local *local)
 134 {
 135         struct ieee80211_sub_if_data *sdata;
 136
 137         lockdep_assert_wiphy(local->hw.wiphy);
 138
 139         if (WARN_ON(!local->emulate_chanctx))
 140                 return;
 141
 142         list_for_each_entry(sdata, &local->interfaces, list) {
 143                 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 144                         continue;
 145
 146                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 147                         clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 148
 149                 if (!ieee80211_sdata_running(sdata))
 150                         continue;
 151
 152                 /* Tell AP we're back */
 153                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 154                     sdata->u.mgd.associated)
 155                         ieee80211_offchannel_ps_disable(sdata);
 156
 157                 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 158                                        &sdata->state)) {
 159                         sdata->vif.bss_conf.enable_beacon = true;
 160                         ieee80211_link_info_change_notify(
 161                                 sdata, &sdata->deflink,
 162                                 BSS_CHANGED_BEACON_ENABLED);
 163                 }
 164         }
 165
 166         ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
 167                                         IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 168                                         false);
 169 }
 170
 171 static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
 172 {
 173         /* was never transmitted */
 174         if (roc->frame) {
 175                 cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie,
 176                                         roc->frame->data, roc->frame->len,
 177                                         false, GFP_KERNEL);
 178                 ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame);
 179         }
 180
 181         if (!roc->mgmt_tx_cookie)
 182                 cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
 183                                                    roc->cookie, roc->chan,
 184                                                    GFP_KERNEL);
 185         else
 186                 cfg80211_tx_mgmt_expired(&roc->sdata->wdev,
 187                                          roc->mgmt_tx_cookie,
 188                                          roc->chan, GFP_KERNEL);
 189
 190         list_del(&roc->list);
 191         kfree(roc);
 192 }
 193
 194 static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local,
 195                                                  unsigned long now)
 196 {
 197         struct ieee80211_roc_work *roc, *tmp;
 198         long remaining_dur_min = LONG_MAX;
 199
 200         lockdep_assert_wiphy(local->hw.wiphy);
 201
 202         list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 203                 long remaining;
 204
 205                 if (!roc->started)
 206                         break;
 207
 208                 remaining = roc->start_time +
 209                             msecs_to_jiffies(roc->duration) -
 210                             now;
 211
 212                 /* In case of HW ROC, it is possible that the HW finished the
 213                  * ROC session before the actual requested time. In such a case
 214                  * end the ROC session (disregarding the remaining time).
 215                  */
 216                 if (roc->abort || roc->hw_begun || remaining <= 0)
 217                         ieee80211_roc_notify_destroy(roc);
 218                 else
 219                         remaining_dur_min = min(remaining_dur_min, remaining);
 220         }
 221
 222         return remaining_dur_min;
 223 }
 224
 225 static bool ieee80211_recalc_sw_work(struct ieee80211_local *local,
 226                                      unsigned long now)
 227 {
 228         long dur = ieee80211_end_finished_rocs(local, now);
 229
 230         if (dur == LONG_MAX)
 231                 return false;
 232
 233         wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, dur);
 234         return true;
 235 }
 236
 237 static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
 238                                          unsigned long start_time)
 239 {
 240         if (WARN_ON(roc->notified))
 241                 return;
 242
 243         roc->start_time = start_time;
 244         roc->started = true;
 245
 246         if (roc->mgmt_tx_cookie) {
 247                 if (!WARN_ON(!roc->frame)) {
 248                         ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7,
 249                                                   roc->chan->band);
 250                         roc->frame = NULL;
 251                 }
 252         } else {
 253                 cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie,
 254                                           roc->chan, roc->req_duration,
 255                                           GFP_KERNEL);
 256         }
 257
 258         roc->notified = true;
 259 }
 260
 261 static void ieee80211_hw_roc_start(struct wiphy *wiphy, struct wiphy_work *work)
 262 {
 263         struct ieee80211_local *local =
 264                 container_of(work, struct ieee80211_local, hw_roc_start);
 265         struct ieee80211_roc_work *roc;
 266
 267         lockdep_assert_wiphy(local->hw.wiphy);
 268
 269         list_for_each_entry(roc, &local->roc_list, list) {
 270                 if (!roc->started)
 271                         break;
 272
 273                 roc->hw_begun = true;
 274                 ieee80211_handle_roc_started(roc, local->hw_roc_start_time);
 275         }
 276 }
 277
 278 void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
 279 {
 280         struct ieee80211_local *local = hw_to_local(hw);
 281
 282         local->hw_roc_start_time = jiffies;
 283
 284         trace_api_ready_on_channel(local);
 285
 286         wiphy_work_queue(hw->wiphy, &local->hw_roc_start);
 287 }
 288 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
 289
 290 static void _ieee80211_start_next_roc(struct ieee80211_local *local)
 291 {
 292         struct ieee80211_roc_work *roc, *tmp;
 293         enum ieee80211_roc_type type;
 294         u32 min_dur, max_dur;
 295
 296         lockdep_assert_wiphy(local->hw.wiphy);
 297
 298         if (WARN_ON(list_empty(&local->roc_list)))
 299                 return;
 300
 301         roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 302                                list);
 303
 304         if (WARN_ON(roc->started))
 305                 return;
 306
 307         min_dur = roc->duration;
 308         max_dur = roc->duration;
 309         type = roc->type;
 310
 311         list_for_each_entry(tmp, &local->roc_list, list) {
 312                 if (tmp == roc)
 313                         continue;
 314                 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 315                         break;
 316                 max_dur = max(tmp->duration, max_dur);
 317                 min_dur = min(tmp->duration, min_dur);
 318                 type = max(tmp->type, type);
 319         }
 320
 321         if (local->ops->remain_on_channel) {
 322                 int ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
 323                                                 max_dur, type);
 324
 325                 if (ret) {
 326                         wiphy_warn(local->hw.wiphy,
 327                                    "failed to start next HW ROC (%d)\n", ret);
 328                         /*
 329                          * queue the work struct again to avoid recursion
 330                          * when multiple failures occur
 331                          */
 332                         list_for_each_entry(tmp, &local->roc_list, list) {
 333                                 if (tmp->sdata != roc->sdata ||
 334                                     tmp->chan != roc->chan)
 335                                         break;
 336                                 tmp->started = true;
 337                                 tmp->abort = true;
 338                         }
 339                         wiphy_work_queue(local->hw.wiphy, &local->hw_roc_done);
 340                         return;
 341                 }
 342
 343                 /* we'll notify about the start once the HW calls back */
 344                 list_for_each_entry(tmp, &local->roc_list, list) {
 345                         if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 346                                 break;
 347                         tmp->started = true;
 348                 }
 349         } else {
 350                 /* If actually operating on the desired channel (with at least
 351                  * 20 MHz channel width) don't stop all the operations but still
 352                  * treat it as though the ROC operation started properly, so
 353                  * other ROC operations won't interfere with this one.
 354                  *
 355                  * Note: scan can't run, tmp_channel is what we use, so this
 356                  * must be the currently active channel.
 357                  */
 358                 roc->on_channel = roc->chan == local->hw.conf.chandef.chan &&
 359                                   local->hw.conf.chandef.width != NL80211_CHAN_WIDTH_5 &&
 360                                   local->hw.conf.chandef.width != NL80211_CHAN_WIDTH_10;
 361
 362                 /* start this ROC */
 363                 ieee80211_recalc_idle(local);
 364
 365                 if (!roc->on_channel) {
 366                         ieee80211_offchannel_stop_vifs(local);
 367
 368                         local->tmp_channel = roc->chan;
 369                         ieee80211_hw_conf_chan(local);
 370                 }
 371
 372                 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work,
 373                                          msecs_to_jiffies(min_dur));
 374
 375                 /* tell userspace or send frame(s) */
 376                 list_for_each_entry(tmp, &local->roc_list, list) {
 377                         if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 378                                 break;
 379
 380                         tmp->on_channel = roc->on_channel;
 381                         ieee80211_handle_roc_started(tmp, jiffies);
 382                 }
 383         }
 384 }
 385
 386 void ieee80211_start_next_roc(struct ieee80211_local *local)
 387 {
 388         struct ieee80211_roc_work *roc;
 389
 390         lockdep_assert_wiphy(local->hw.wiphy);
 391
 392         if (list_empty(&local->roc_list)) {
 393                 ieee80211_run_deferred_scan(local);
 394                 return;
 395         }
 396
 397         /* defer roc if driver is not started (i.e. during reconfig) */
 398         if (local->in_reconfig)
 399                 return;
 400
 401         roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 402                                list);
 403
 404         if (WARN_ON_ONCE(roc->started))
 405                 return;
 406
 407         if (local->ops->remain_on_channel) {
 408                 _ieee80211_start_next_roc(local);
 409         } else {
 410                 /* delay it a bit */
 411                 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work,
 412                                          round_jiffies_relative(HZ / 2));
 413         }
 414 }
 415
 416 static void __ieee80211_roc_work(struct ieee80211_local *local)
 417 {
 418         struct ieee80211_roc_work *roc;
 419         bool on_channel;
 420
 421         lockdep_assert_wiphy(local->hw.wiphy);
 422
 423         if (WARN_ON(local->ops->remain_on_channel))
 424                 return;
 425
 426         roc = list_first_entry_or_null(&local->roc_list,
 427                                        struct ieee80211_roc_work, list);
 428         if (!roc)
 429                 return;
 430
 431         if (!roc->started) {
 432                 WARN_ON(!local->emulate_chanctx);
 433                 _ieee80211_start_next_roc(local);
 434         } else {
 435                 on_channel = roc->on_channel;
 436                 if (ieee80211_recalc_sw_work(local, jiffies))
 437                         return;
 438
 439                 /* careful - roc pointer became invalid during recalc */
 440
 441                 if (!on_channel) {
 442                         ieee80211_flush_queues(local, NULL, false);
 443
 444                         local->tmp_channel = NULL;
 445                         ieee80211_hw_conf_chan(local);
 446
 447                         ieee80211_offchannel_return(local);
 448                 }
 449
 450                 ieee80211_recalc_idle(local);
 451                 ieee80211_start_next_roc(local);
 452         }
 453 }
 454
 455 static void ieee80211_roc_work(struct wiphy *wiphy, struct wiphy_work *work)
 456 {
 457         struct ieee80211_local *local =
 458                 container_of(work, struct ieee80211_local, roc_work.work);
 459
 460         lockdep_assert_wiphy(local->hw.wiphy);
 461
 462         __ieee80211_roc_work(local);
 463 }
 464
 465 static void ieee80211_hw_roc_done(struct wiphy *wiphy, struct wiphy_work *work)
 466 {
 467         struct ieee80211_local *local =
 468                 container_of(work, struct ieee80211_local, hw_roc_done);
 469
 470         lockdep_assert_wiphy(local->hw.wiphy);
 471
 472         ieee80211_end_finished_rocs(local, jiffies);
 473
 474         /* if there's another roc, start it now */
 475         ieee80211_start_next_roc(local);
 476 }
 477
 478 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
 479 {
 480         struct ieee80211_local *local = hw_to_local(hw);
 481
 482         trace_api_remain_on_channel_expired(local);
 483
 484         wiphy_work_queue(hw->wiphy, &local->hw_roc_done);
 485 }
 486 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
 487
 488 static bool
 489 ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
 490                                   struct ieee80211_roc_work *new_roc,
 491                                   struct ieee80211_roc_work *cur_roc)
 492 {
 493         unsigned long now = jiffies;
 494         unsigned long remaining;
 495
 496         if (WARN_ON(!cur_roc->started))
 497                 return false;
 498
 499         /* if it was scheduled in the hardware, but not started yet,
 500          * we can only combine if the older one had a longer duration
 501          */
 502         if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration)
 503                 return false;
 504
 505         remaining = cur_roc->start_time +
 506                     msecs_to_jiffies(cur_roc->duration) -
 507                     now;
 508
 509         /* if it doesn't fit entirely, schedule a new one */
 510         if (new_roc->duration > jiffies_to_msecs(remaining))
 511                 return false;
 512
 513         /* add just after the current one so we combine their finish later */
 514         list_add(&new_roc->list, &cur_roc->list);
 515
 516         /* if the existing one has already begun then let this one also
 517          * begin, otherwise they'll both be marked properly by the work
 518          * struct that runs once the driver notifies us of the beginning
 519          */
 520         if (cur_roc->hw_begun) {
 521                 new_roc->hw_begun = true;
 522                 ieee80211_handle_roc_started(new_roc, now);
 523         }
 524
 525         return true;
 526 }
 527
 528 static int ieee80211_start_roc_work(struct ieee80211_local *local,
 529                                     struct ieee80211_sub_if_data *sdata,
 530                                     struct ieee80211_channel *channel,
 531                                     unsigned int duration, u64 *cookie,
 532                                     struct sk_buff *txskb,
 533                                     enum ieee80211_roc_type type)
 534 {
 535         struct ieee80211_roc_work *roc, *tmp;
 536         bool queued = false, combine_started = true;
 537         int ret;
 538
 539         lockdep_assert_wiphy(local->hw.wiphy);
 540
 541         if (channel->freq_offset)
 542                 /* this may work, but is untested */
 543                 return -EOPNOTSUPP;
 544
 545         if (!local->emulate_chanctx && !local->ops->remain_on_channel)
 546                 return -EOPNOTSUPP;
 547
 548         roc = kzalloc(sizeof(*roc), GFP_KERNEL);
 549         if (!roc)
 550                 return -ENOMEM;
 551
 552         /*
 553          * If the duration is zero, then the driver
 554          * wouldn't actually do anything. Set it to
 555          * 10 for now.
 556          *
 557          * TODO: cancel the off-channel operation
 558          *       when we get the SKB's TX status and
 559          *       the wait time was zero before.
 560          */
 561         if (!duration)
 562                 duration = 10;
 563
 564         roc->chan = channel;
 565         roc->duration = duration;
 566         roc->req_duration = duration;
 567         roc->frame = txskb;
 568         roc->type = type;
 569         roc->sdata = sdata;
 570
 571         /*
 572          * cookie is either the roc cookie (for normal roc)
 573          * or the SKB (for mgmt TX)
 574          */
 575         if (!txskb) {
 576                 roc->cookie = ieee80211_mgmt_tx_cookie(local);
 577                 *cookie = roc->cookie;
 578         } else {
 579                 roc->mgmt_tx_cookie = *cookie;
 580         }
 581
 582         /* if there's no need to queue, handle it immediately */
 583         if (list_empty(&local->roc_list) &&
 584             !local->scanning && !ieee80211_is_radar_required(local)) {
 585                 /* if not HW assist, just queue & schedule work */
 586                 if (!local->ops->remain_on_channel) {
 587                         list_add_tail(&roc->list, &local->roc_list);
 588                         wiphy_delayed_work_queue(local->hw.wiphy,
 589                                                  &local->roc_work, 0);
 590                 } else {
 591                         /* otherwise actually kick it off here
 592                          * (for error handling)
 593                          */
 594                         ret = drv_remain_on_channel(local, sdata, channel,
 595                                                     duration, type);
 596                         if (ret) {
 597                                 kfree(roc);
 598                                 return ret;
 599                         }
 600                         roc->started = true;
 601                         list_add_tail(&roc->list, &local->roc_list);
 602                 }
 603
 604                 return 0;
 605         }
 606
 607         /* otherwise handle queueing */
 608
 609         list_for_each_entry(tmp, &local->roc_list, list) {
 610                 if (tmp->chan != channel || tmp->sdata != sdata)
 611                         continue;
 612
 613                 /*
 614                  * Extend this ROC if possible: If it hasn't started, add
 615                  * just after the new one to combine.
 616                  */
 617                 if (!tmp->started) {
 618                         list_add(&roc->list, &tmp->list);
 619                         queued = true;
 620                         break;
 621                 }
 622
 623                 if (!combine_started)
 624                         continue;
 625
 626                 if (!local->ops->remain_on_channel) {
 627                         /* If there's no hardware remain-on-channel, and
 628                          * doing so won't push us over the maximum r-o-c
 629                          * we allow, then we can just add the new one to
 630                          * the list and mark it as having started now.
 631                          * If it would push over the limit, don't try to
 632                          * combine with other started ones (that haven't
 633                          * been running as long) but potentially sort it
 634                          * with others that had the same fate.
 635                          */
 636                         unsigned long now = jiffies;
 637                         u32 elapsed = jiffies_to_msecs(now - tmp->start_time);
 638                         struct wiphy *wiphy = local->hw.wiphy;
 639                         u32 max_roc = wiphy->max_remain_on_channel_duration;
 640
 641                         if (elapsed + roc->duration > max_roc) {
 642                                 combine_started = false;
 643                                 continue;
 644                         }
 645
 646                         list_add(&roc->list, &tmp->list);
 647                         queued = true;
 648                         roc->on_channel = tmp->on_channel;
 649                         ieee80211_handle_roc_started(roc, now);
 650                         ieee80211_recalc_sw_work(local, now);
 651                         break;
 652                 }
 653
 654                 queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp);
 655                 if (queued)
 656                         break;
 657                 /* if it wasn't queued, perhaps it can be combined with
 658                  * another that also couldn't get combined previously,
 659                  * but no need to check for already started ones, since
 660                  * that can't work.
 661                  */
 662                 combine_started = false;
 663         }
 664
 665         if (!queued)
 666                 list_add_tail(&roc->list, &local->roc_list);
 667
 668         return 0;
 669 }
 670
 671 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 672                                 struct ieee80211_channel *chan,
 673                                 unsigned int duration, u64 *cookie)
 674 {
 675         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 676         struct ieee80211_local *local = sdata->local;
 677
 678         lockdep_assert_wiphy(local->hw.wiphy);
 679
 680         return ieee80211_start_roc_work(local, sdata, chan,
 681                                         duration, cookie, NULL,
 682                                         IEEE80211_ROC_TYPE_NORMAL);
 683 }
 684
 685 static int ieee80211_cancel_roc(struct ieee80211_local *local,
 686                                 u64 cookie, bool mgmt_tx)
 687 {
 688         struct ieee80211_roc_work *roc, *tmp, *found = NULL;
 689         int ret;
 690
 691         lockdep_assert_wiphy(local->hw.wiphy);
 692
 693         if (!cookie)
 694                 return -ENOENT;
 695
 696         wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start);
 697
 698         list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 699                 if (!mgmt_tx && roc->cookie != cookie)
 700                         continue;
 701                 else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
 702                         continue;
 703
 704                 found = roc;
 705                 break;
 706         }
 707
 708         if (!found) {
 709                 return -ENOENT;
 710         }
 711
 712         if (!found->started) {
 713                 ieee80211_roc_notify_destroy(found);
 714                 goto out_unlock;
 715         }
 716
 717         if (local->ops->remain_on_channel) {
 718                 ret = drv_cancel_remain_on_channel(local, roc->sdata);
 719                 if (WARN_ON_ONCE(ret)) {
 720                         return ret;
 721                 }
 722
 723                 /*
 724                  * We could be racing against the notification from the driver:
 725                  *  + driver is handling the notification on CPU0
 726                  *  + user space is cancelling the remain on channel and
 727                  *    schedules the hw_roc_done worker.
 728                  *
 729                  *  Now hw_roc_done might start to run after the next roc will
 730                  *  start and mac80211 will think that this second roc has
 731                  *  ended prematurely.
 732                  *  Cancel the work to make sure that all the pending workers
 733                  *  have completed execution.
 734                  *  Note that this assumes that by the time the driver returns
 735                  *  from drv_cancel_remain_on_channel, it has completed all
 736                  *  the processing of related notifications.
 737                  */
 738                 wiphy_work_cancel(local->hw.wiphy, &local->hw_roc_done);
 739
 740                 /* TODO:
 741                  * if multiple items were combined here then we really shouldn't
 742                  * cancel them all - we should wait for as much time as needed
 743                  * for the longest remaining one, and only then cancel ...
 744                  */
 745                 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 746                         if (!roc->started)
 747                                 break;
 748                         if (roc == found)
 749                                 found = NULL;
 750                         ieee80211_roc_notify_destroy(roc);
 751                 }
 752
 753                 /* that really must not happen - it was started */
 754                 WARN_ON(found);
 755
 756                 ieee80211_start_next_roc(local);
 757         } else {
 758                 /* go through work struct to return to the operating channel */
 759                 found->abort = true;
 760                 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 0);
 761         }
 762
 763  out_unlock:
 764
 765         return 0;
 766 }
 767
 768 int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 769                                        struct wireless_dev *wdev, u64 cookie)
 770 {
 771         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 772         struct ieee80211_local *local = sdata->local;
 773
 774         return ieee80211_cancel_roc(local, cookie, false);
 775 }
 776
 777 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 778                       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 779 {
 780         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 781         struct ieee80211_local *local = sdata->local;
 782         struct sk_buff *skb;
 783         struct sta_info *sta = NULL;
 784         const struct ieee80211_mgmt *mgmt = (void *)params->buf;
 785         bool need_offchan = false;
 786         bool mlo_sta = false;
 787         int link_id = -1;
 788         u32 flags;
 789         int ret;
 790         u8 *data;
 791
 792         lockdep_assert_wiphy(local->hw.wiphy);
 793
 794         if (params->dont_wait_for_ack)
 795                 flags = IEEE80211_TX_CTL_NO_ACK;
 796         else
 797                 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
 798                         IEEE80211_TX_CTL_REQ_TX_STATUS;
 799
 800         if (params->no_cck)
 801                 flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 802
 803         switch (sdata->vif.type) {
 804         case NL80211_IFTYPE_ADHOC:
 805                 if (!sdata->vif.cfg.ibss_joined)
 806                         need_offchan = true;
 807 #ifdef CONFIG_MAC80211_MESH
 808                 fallthrough;
 809         case NL80211_IFTYPE_MESH_POINT:
 810                 if (ieee80211_vif_is_mesh(&sdata->vif) &&
 811                     !sdata->u.mesh.mesh_id_len)
 812                         need_offchan = true;
 813 #endif
 814                 fallthrough;
 815         case NL80211_IFTYPE_AP:
 816         case NL80211_IFTYPE_AP_VLAN:
 817         case NL80211_IFTYPE_P2P_GO:
 818                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 819                     !ieee80211_vif_is_mesh(&sdata->vif) &&
 820                     !sdata->bss->active)
 821                         need_offchan = true;
 822
 823                 rcu_read_lock();
 824                 sta = sta_info_get_bss(sdata, mgmt->da);
 825                 mlo_sta = sta && sta->sta.mlo;
 826
 827                 if (!ieee80211_is_action(mgmt->frame_control) ||
 828                     mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
 829                     mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
 830                     mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
 831                         rcu_read_unlock();
 832                         break;
 833                 }
 834
 835                 if (!sta) {
 836                         rcu_read_unlock();
 837                         return -ENOLINK;
 838                 }
 839                 if (params->link_id >= 0 &&
 840                     !(sta->sta.valid_links & BIT(params->link_id))) {
 841                         rcu_read_unlock();
 842                         return -ENOLINK;
 843                 }
 844                 link_id = params->link_id;
 845                 rcu_read_unlock();
 846                 break;
 847         case NL80211_IFTYPE_STATION:
 848         case NL80211_IFTYPE_P2P_CLIENT:
 849                 if (!sdata->u.mgd.associated ||
 850                     (params->offchan && params->wait &&
 851                      local->ops->remain_on_channel &&
 852                      memcmp(sdata->vif.cfg.ap_addr, mgmt->bssid, ETH_ALEN))) {
 853                         need_offchan = true;
 854                 } else if (sdata->u.mgd.associated &&
 855                            ether_addr_equal(sdata->vif.cfg.ap_addr, mgmt->da)) {
 856                         sta = sta_info_get_bss(sdata, mgmt->da);
 857                         mlo_sta = sta && sta->sta.mlo;
 858                 }
 859                 break;
 860         case NL80211_IFTYPE_P2P_DEVICE:
 861                 need_offchan = true;
 862                 break;
 863         case NL80211_IFTYPE_NAN:
 864         default:
 865                 return -EOPNOTSUPP;
 866         }
 867
 868         /* configurations requiring offchan cannot work if no channel has been
 869          * specified
 870          */
 871         if (need_offchan && !params->chan)
 872                 return -EINVAL;
 873
 874         /* Check if the operating channel is the requested channel */
 875         if (!params->chan && mlo_sta) {
 876                 need_offchan = false;
 877         } else if (!need_offchan) {
 878                 struct ieee80211_chanctx_conf *chanctx_conf = NULL;
 879                 int i;
 880
 881                 rcu_read_lock();
 882                 /* Check all the links first */
 883                 for (i = 0; i < ARRAY_SIZE(sdata->vif.link_conf); i++) {
 884                         struct ieee80211_bss_conf *conf;
 885
 886                         conf = rcu_dereference(sdata->vif.link_conf[i]);
 887                         if (!conf)
 888                                 continue;
 889
 890                         chanctx_conf = rcu_dereference(conf->chanctx_conf);
 891                         if (!chanctx_conf)
 892                                 continue;
 893
 894                         if (mlo_sta && params->chan == chanctx_conf->def.chan &&
 895                             ether_addr_equal(sdata->vif.addr, mgmt->sa)) {
 896                                 link_id = i;
 897                                 break;
 898                         }
 899
 900                         if (ether_addr_equal(conf->addr, mgmt->sa))
 901                                 break;
 902
 903                         chanctx_conf = NULL;
 904                 }
 905
 906                 if (chanctx_conf) {
 907                         need_offchan = params->chan &&
 908                                        (params->chan !=
 909                                         chanctx_conf->def.chan);
 910                 } else {
 911                         need_offchan = true;
 912                 }
 913                 rcu_read_unlock();
 914         }
 915
 916         if (need_offchan && !params->offchan) {
 917                 ret = -EBUSY;
 918                 goto out_unlock;
 919         }
 920
 921         skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
 922         if (!skb) {
 923                 ret = -ENOMEM;
 924                 goto out_unlock;
 925         }
 926         skb_reserve(skb, local->hw.extra_tx_headroom);
 927
 928         data = skb_put_data(skb, params->buf, params->len);
 929
 930         /* Update CSA counters */
 931         if (sdata->vif.bss_conf.csa_active &&
 932             (sdata->vif.type == NL80211_IFTYPE_AP ||
 933              sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
 934              sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
 935             params->n_csa_offsets) {
 936                 int i;
 937                 struct beacon_data *beacon = NULL;
 938
 939                 rcu_read_lock();
 940
 941                 if (sdata->vif.type == NL80211_IFTYPE_AP)
 942                         beacon = rcu_dereference(sdata->deflink.u.ap.beacon);
 943                 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
 944                         beacon = rcu_dereference(sdata->u.ibss.presp);
 945                 else if (ieee80211_vif_is_mesh(&sdata->vif))
 946                         beacon = rcu_dereference(sdata->u.mesh.beacon);
 947
 948                 if (beacon)
 949                         for (i = 0; i < params->n_csa_offsets; i++)
 950                                 data[params->csa_offsets[i]] =
 951                                         beacon->cntdwn_current_counter;
 952
 953                 rcu_read_unlock();
 954         }
 955
 956         IEEE80211_SKB_CB(skb)->flags = flags;
 957
 958         skb->dev = sdata->dev;
 959
 960         if (!params->dont_wait_for_ack) {
 961                 /* make a copy to preserve the frame contents
 962                  * in case of encryption.
 963                  */
 964                 ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);
 965                 if (ret) {
 966                         kfree_skb(skb);
 967                         goto out_unlock;
 968                 }
 969         } else {
 970                 /* Assign a dummy non-zero cookie, it's not sent to
 971                  * userspace in this case but we rely on its value
 972                  * internally in the need_offchan case to distinguish
 973                  * mgmt-tx from remain-on-channel.
 974                  */
 975                 *cookie = 0xffffffff;
 976         }
 977
 978         if (!need_offchan) {
 979                 ieee80211_tx_skb_tid(sdata, skb, 7, link_id);
 980                 ret = 0;
 981                 goto out_unlock;
 982         }
 983
 984         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
 985                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
 986         if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
 987                 IEEE80211_SKB_CB(skb)->hw_queue =
 988                         local->hw.offchannel_tx_hw_queue;
 989
 990         /* This will handle all kinds of coalescing and immediate TX */
 991         ret = ieee80211_start_roc_work(local, sdata, params->chan,
 992                                        params->wait, cookie, skb,
 993                                        IEEE80211_ROC_TYPE_MGMT_TX);
 994         if (ret)
 995                 ieee80211_free_txskb(&local->hw, skb);
 996  out_unlock:
 997         return ret;
 998 }
 999
1000 int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
1001                                   struct wireless_dev *wdev, u64 cookie)
1002 {
1003         struct ieee80211_local *local = wiphy_priv(wiphy);
1004
1005         return ieee80211_cancel_roc(local, cookie, true);
1006 }
1007
1008 void ieee80211_roc_setup(struct ieee80211_local *local)
1009 {
1010         wiphy_work_init(&local->hw_roc_start, ieee80211_hw_roc_start);
1011         wiphy_work_init(&local->hw_roc_done, ieee80211_hw_roc_done);
1012         wiphy_delayed_work_init(&local->roc_work, ieee80211_roc_work);
1013         INIT_LIST_HEAD(&local->roc_list);
1014 }
1015
1016 void ieee80211_roc_purge(struct ieee80211_local *local,
1017                          struct ieee80211_sub_if_data *sdata)
1018 {
1019         struct ieee80211_roc_work *roc, *tmp;
1020         bool work_to_do = false;
1021
1022         lockdep_assert_wiphy(local->hw.wiphy);
1023
1024         list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
1025                 if (sdata && roc->sdata != sdata)
1026                         continue;
1027
1028                 if (roc->started) {
1029                         if (local->ops->remain_on_channel) {
1030                                 /* can race, so ignore return value */
1031                                 drv_cancel_remain_on_channel(local, roc->sdata);
1032                                 ieee80211_roc_notify_destroy(roc);
1033                         } else {
1034                                 roc->abort = true;
1035                                 work_to_do = true;
1036                         }
1037                 } else {
1038                         ieee80211_roc_notify_destroy(roc);
1039                 }
1040         }
1041         if (work_to_do)
1042                 __ieee80211_roc_work(local);
1043 }