net/mac80211/offchannel.c

   1 /*
   2  * Off-channel operation helpers
   3  *
   4  * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
   5  * Copyright 2004, Instant802 Networks, Inc.
   6  * Copyright 2005, Devicescape Software, Inc.
   7  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
   9  * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License version 2 as
  13  * published by the Free Software Foundation.
  14  */
  15 #include <linux/export.h>
  16 #include <net/mac80211.h>
  17 #include "ieee80211_i.h"
  18 #include "driver-ops.h"
  19
  20 /*
  21  * Tell our hardware to disable PS.
  22  * Optionally inform AP that we will go to sleep so that it will buffer
  23  * the frames while we are doing off-channel work.  This is optional
  24  * because we *may* be doing work on-operating channel, and want our
  25  * hardware unconditionally awake, but still let the AP send us normal frames.
  26  */
  27 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
  28 {
  29         struct ieee80211_local *local = sdata->local;
  30         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
  31
  32         local->offchannel_ps_enabled = false;
  33
  34         /* FIXME: what to do when local->pspolling is true? */
  35
  36         del_timer_sync(&local->dynamic_ps_timer);
  37         del_timer_sync(&ifmgd->bcn_mon_timer);
  38         del_timer_sync(&ifmgd->conn_mon_timer);
  39
  40         cancel_work_sync(&local->dynamic_ps_enable_work);
  41
  42         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
  43                 local->offchannel_ps_enabled = true;
  44                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
  45                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
  46         }
  47
  48         if (!local->offchannel_ps_enabled ||
  49             !ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
  50                 /*
  51                  * If power save was enabled, no need to send a nullfunc
  52                  * frame because AP knows that we are sleeping. But if the
  53                  * hardware is creating the nullfunc frame for power save
  54                  * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
  55                  * enabled) and power save was enabled, the firmware just
  56                  * sent a null frame with power save disabled. So we need
  57                  * to send a new nullfunc frame to inform the AP that we
  58                  * are again sleeping.
  59                  */
  60                 ieee80211_send_nullfunc(local, sdata, true);
  61 }
  62
  63 /* inform AP that we are awake again, unless power save is enabled */
  64 static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
  65 {
  66         struct ieee80211_local *local = sdata->local;
  67
  68         if (!local->ps_sdata)
  69                 ieee80211_send_nullfunc(local, sdata, false);
  70         else if (local->offchannel_ps_enabled) {
  71                 /*
  72                  * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
  73                  * will send a nullfunc frame with the powersave bit set
  74                  * even though the AP already knows that we are sleeping.
  75                  * This could be avoided by sending a null frame with power
  76                  * save bit disabled before enabling the power save, but
  77                  * this doesn't gain anything.
  78                  *
  79                  * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
  80                  * to send a nullfunc frame because AP already knows that
  81                  * we are sleeping, let's just enable power save mode in
  82                  * hardware.
  83                  */
  84                 /* TODO:  Only set hardware if CONF_PS changed?
  85                  * TODO:  Should we set offchannel_ps_enabled to false?
  86                  */
  87                 local->hw.conf.flags |= IEEE80211_CONF_PS;
  88                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
  89         } else if (local->hw.conf.dynamic_ps_timeout > 0) {
  90                 /*
  91                  * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
  92                  * had been running before leaving the operating channel,
  93                  * restart the timer now and send a nullfunc frame to inform
  94                  * the AP that we are awake.
  95                  */
  96                 ieee80211_send_nullfunc(local, sdata, false);
  97                 mod_timer(&local->dynamic_ps_timer, jiffies +
  98                           msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
  99         }
 100
 101         ieee80211_sta_reset_beacon_monitor(sdata);
 102         ieee80211_sta_reset_conn_monitor(sdata);
 103 }
 104
 105 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
 106 {
 107         struct ieee80211_sub_if_data *sdata;
 108
 109         if (WARN_ON(local->use_chanctx))
 110                 return;
 111
 112         /*
 113          * notify the AP about us leaving the channel and stop all
 114          * STA interfaces.
 115          */
 116
 117         /*
 118          * Stop queues and transmit all frames queued by the driver
 119          * before sending nullfunc to enable powersave at the AP.
 120          */
 121         ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
 122                                         IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 123                                         false);
 124         ieee80211_flush_queues(local, NULL, false);
 125
 126         mutex_lock(&local->iflist_mtx);
 127         list_for_each_entry(sdata, &local->interfaces, list) {
 128                 if (!ieee80211_sdata_running(sdata))
 129                         continue;
 130
 131                 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
 132                     sdata->vif.type == NL80211_IFTYPE_NAN)
 133                         continue;
 134
 135                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 136                         set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 137
 138                 /* Check to see if we should disable beaconing. */
 139                 if (sdata->vif.bss_conf.enable_beacon) {
 140                         set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 141                                 &sdata->state);
 142                         sdata->vif.bss_conf.enable_beacon = false;
 143                         ieee80211_bss_info_change_notify(
 144                                 sdata, BSS_CHANGED_BEACON_ENABLED);
 145                 }
 146
 147                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 148                     sdata->u.mgd.associated)
 149                         ieee80211_offchannel_ps_enable(sdata);
 150         }
 151         mutex_unlock(&local->iflist_mtx);
 152 }
 153
 154 void ieee80211_offchannel_return(struct ieee80211_local *local)
 155 {
 156         struct ieee80211_sub_if_data *sdata;
 157
 158         if (WARN_ON(local->use_chanctx))
 159                 return;
 160
 161         mutex_lock(&local->iflist_mtx);
 162         list_for_each_entry(sdata, &local->interfaces, list) {
 163                 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
 164                         continue;
 165
 166                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 167                         clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 168
 169                 if (!ieee80211_sdata_running(sdata))
 170                         continue;
 171
 172                 /* Tell AP we're back */
 173                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
 174                     sdata->u.mgd.associated)
 175                         ieee80211_offchannel_ps_disable(sdata);
 176
 177                 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 178                                        &sdata->state)) {
 179                         sdata->vif.bss_conf.enable_beacon = true;
 180                         ieee80211_bss_info_change_notify(
 181                                 sdata, BSS_CHANGED_BEACON_ENABLED);
 182                 }
 183         }
 184         mutex_unlock(&local->iflist_mtx);
 185
 186         ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
 187                                         IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 188                                         false);
 189 }
 190
 191 static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
 192 {
 193         /* was never transmitted */
 194         if (roc->frame) {
 195                 cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie,
 196                                         roc->frame->data, roc->frame->len,
 197                                         false, GFP_KERNEL);
 198                 ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame);
 199         }
 200
 201         if (!roc->mgmt_tx_cookie)
 202                 cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
 203                                                    roc->cookie, roc->chan,
 204                                                    GFP_KERNEL);
 205
 206         list_del(&roc->list);
 207         kfree(roc);
 208 }
 209
 210 static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local,
 211                                                  unsigned long now)
 212 {
 213         struct ieee80211_roc_work *roc, *tmp;
 214         long remaining_dur_min = LONG_MAX;
 215
 216         lockdep_assert_held(&local->mtx);
 217
 218         list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 219                 long remaining;
 220
 221                 if (!roc->started)
 222                         break;
 223
 224                 remaining = roc->start_time +
 225                             msecs_to_jiffies(roc->duration) -
 226                             now;
 227
 228                 /* In case of HW ROC, it is possible that the HW finished the
 229                  * ROC session before the actual requested time. In such a case
 230                  * end the ROC session (disregarding the remaining time).
 231                  */
 232                 if (roc->abort || roc->hw_begun || remaining <= 0)
 233                         ieee80211_roc_notify_destroy(roc);
 234                 else
 235                         remaining_dur_min = min(remaining_dur_min, remaining);
 236         }
 237
 238         return remaining_dur_min;
 239 }
 240
 241 static bool ieee80211_recalc_sw_work(struct ieee80211_local *local,
 242                                      unsigned long now)
 243 {
 244         long dur = ieee80211_end_finished_rocs(local, now);
 245
 246         if (dur == LONG_MAX)
 247                 return false;
 248
 249         mod_delayed_work(local->workqueue, &local->roc_work, dur);
 250         return true;
 251 }
 252
 253 static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
 254                                          unsigned long start_time)
 255 {
 256         if (WARN_ON(roc->notified))
 257                 return;
 258
 259         roc->start_time = start_time;
 260         roc->started = true;
 261
 262         if (roc->mgmt_tx_cookie) {
 263                 if (!WARN_ON(!roc->frame)) {
 264                         ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7,
 265                                                   roc->chan->band, 0);
 266                         roc->frame = NULL;
 267                 }
 268         } else {
 269                 cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie,
 270                                           roc->chan, roc->req_duration,
 271                                           GFP_KERNEL);
 272         }
 273
 274         roc->notified = true;
 275 }
 276
 277 static void ieee80211_hw_roc_start(struct work_struct *work)
 278 {
 279         struct ieee80211_local *local =
 280                 container_of(work, struct ieee80211_local, hw_roc_start);
 281         struct ieee80211_roc_work *roc;
 282
 283         mutex_lock(&local->mtx);
 284
 285         list_for_each_entry(roc, &local->roc_list, list) {
 286                 if (!roc->started)
 287                         break;
 288
 289                 roc->hw_begun = true;
 290                 ieee80211_handle_roc_started(roc, local->hw_roc_start_time);
 291         }
 292
 293         mutex_unlock(&local->mtx);
 294 }
 295
 296 void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
 297 {
 298         struct ieee80211_local *local = hw_to_local(hw);
 299
 300         local->hw_roc_start_time = jiffies;
 301
 302         trace_api_ready_on_channel(local);
 303
 304         ieee80211_queue_work(hw, &local->hw_roc_start);
 305 }
 306 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
 307
 308 static void _ieee80211_start_next_roc(struct ieee80211_local *local)
 309 {
 310         struct ieee80211_roc_work *roc, *tmp;
 311         enum ieee80211_roc_type type;
 312         u32 min_dur, max_dur;
 313
 314         lockdep_assert_held(&local->mtx);
 315
 316         if (WARN_ON(list_empty(&local->roc_list)))
 317                 return;
 318
 319         roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 320                                list);
 321
 322         if (WARN_ON(roc->started))
 323                 return;
 324
 325         min_dur = roc->duration;
 326         max_dur = roc->duration;
 327         type = roc->type;
 328
 329         list_for_each_entry(tmp, &local->roc_list, list) {
 330                 if (tmp == roc)
 331                         continue;
 332                 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 333                         break;
 334                 max_dur = max(tmp->duration, max_dur);
 335                 min_dur = min(tmp->duration, min_dur);
 336                 type = max(tmp->type, type);
 337         }
 338
 339         if (local->ops->remain_on_channel) {
 340                 int ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
 341                                                 max_dur, type);
 342
 343                 if (ret) {
 344                         wiphy_warn(local->hw.wiphy,
 345                                    "failed to start next HW ROC (%d)\n", ret);
 346                         /*
 347                          * queue the work struct again to avoid recursion
 348                          * when multiple failures occur
 349                          */
 350                         list_for_each_entry(tmp, &local->roc_list, list) {
 351                                 if (tmp->sdata != roc->sdata ||
 352                                     tmp->chan != roc->chan)
 353                                         break;
 354                                 tmp->started = true;
 355                                 tmp->abort = true;
 356                         }
 357                         ieee80211_queue_work(&local->hw, &local->hw_roc_done);
 358                         return;
 359                 }
 360
 361                 /* we'll notify about the start once the HW calls back */
 362                 list_for_each_entry(tmp, &local->roc_list, list) {
 363                         if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 364                                 break;
 365                         tmp->started = true;
 366                 }
 367         } else {
 368                 /* If actually operating on the desired channel (with at least
 369                  * 20 MHz channel width) don't stop all the operations but still
 370                  * treat it as though the ROC operation started properly, so
 371                  * other ROC operations won't interfere with this one.
 372                  */
 373                 roc->on_channel = roc->chan == local->_oper_chandef.chan &&
 374                                   local->_oper_chandef.width != NL80211_CHAN_WIDTH_5 &&
 375                                   local->_oper_chandef.width != NL80211_CHAN_WIDTH_10;
 376
 377                 /* start this ROC */
 378                 ieee80211_recalc_idle(local);
 379
 380                 if (!roc->on_channel) {
 381                         ieee80211_offchannel_stop_vifs(local);
 382
 383                         local->tmp_channel = roc->chan;
 384                         ieee80211_hw_config(local, 0);
 385                 }
 386
 387                 ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
 388                                              msecs_to_jiffies(min_dur));
 389
 390                 /* tell userspace or send frame(s) */
 391                 list_for_each_entry(tmp, &local->roc_list, list) {
 392                         if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
 393                                 break;
 394
 395                         tmp->on_channel = roc->on_channel;
 396                         ieee80211_handle_roc_started(tmp, jiffies);
 397                 }
 398         }
 399 }
 400
 401 void ieee80211_start_next_roc(struct ieee80211_local *local)
 402 {
 403         struct ieee80211_roc_work *roc;
 404
 405         lockdep_assert_held(&local->mtx);
 406
 407         if (list_empty(&local->roc_list)) {
 408                 ieee80211_run_deferred_scan(local);
 409                 return;
 410         }
 411
 412         /* defer roc if driver is not started (i.e. during reconfig) */
 413         if (local->in_reconfig)
 414                 return;
 415
 416         roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
 417                                list);
 418
 419         if (WARN_ON_ONCE(roc->started))
 420                 return;
 421
 422         if (local->ops->remain_on_channel) {
 423                 _ieee80211_start_next_roc(local);
 424         } else {
 425                 /* delay it a bit */
 426                 ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
 427                                              round_jiffies_relative(HZ/2));
 428         }
 429 }
 430
 431 static void __ieee80211_roc_work(struct ieee80211_local *local)
 432 {
 433         struct ieee80211_roc_work *roc;
 434         bool on_channel;
 435
 436         lockdep_assert_held(&local->mtx);
 437
 438         if (WARN_ON(local->ops->remain_on_channel))
 439                 return;
 440
 441         roc = list_first_entry_or_null(&local->roc_list,
 442                                        struct ieee80211_roc_work, list);
 443         if (!roc)
 444                 return;
 445
 446         if (!roc->started) {
 447                 WARN_ON(local->use_chanctx);
 448                 _ieee80211_start_next_roc(local);
 449         } else {
 450                 on_channel = roc->on_channel;
 451                 if (ieee80211_recalc_sw_work(local, jiffies))
 452                         return;
 453
 454                 /* careful - roc pointer became invalid during recalc */
 455
 456                 if (!on_channel) {
 457                         ieee80211_flush_queues(local, NULL, false);
 458
 459                         local->tmp_channel = NULL;
 460                         ieee80211_hw_config(local, 0);
 461
 462                         ieee80211_offchannel_return(local);
 463                 }
 464
 465                 ieee80211_recalc_idle(local);
 466                 ieee80211_start_next_roc(local);
 467         }
 468 }
 469
 470 static void ieee80211_roc_work(struct work_struct *work)
 471 {
 472         struct ieee80211_local *local =
 473                 container_of(work, struct ieee80211_local, roc_work.work);
 474
 475         mutex_lock(&local->mtx);
 476         __ieee80211_roc_work(local);
 477         mutex_unlock(&local->mtx);
 478 }
 479
 480 static void ieee80211_hw_roc_done(struct work_struct *work)
 481 {
 482         struct ieee80211_local *local =
 483                 container_of(work, struct ieee80211_local, hw_roc_done);
 484
 485         mutex_lock(&local->mtx);
 486
 487         ieee80211_end_finished_rocs(local, jiffies);
 488
 489         /* if there's another roc, start it now */
 490         ieee80211_start_next_roc(local);
 491
 492         mutex_unlock(&local->mtx);
 493 }
 494
 495 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
 496 {
 497         struct ieee80211_local *local = hw_to_local(hw);
 498
 499         trace_api_remain_on_channel_expired(local);
 500
 501         ieee80211_queue_work(hw, &local->hw_roc_done);
 502 }
 503 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
 504
 505 static bool
 506 ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
 507                                   struct ieee80211_roc_work *new_roc,
 508                                   struct ieee80211_roc_work *cur_roc)
 509 {
 510         unsigned long now = jiffies;
 511         unsigned long remaining;
 512
 513         if (WARN_ON(!cur_roc->started))
 514                 return false;
 515
 516         /* if it was scheduled in the hardware, but not started yet,
 517          * we can only combine if the older one had a longer duration
 518          */
 519         if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration)
 520                 return false;
 521
 522         remaining = cur_roc->start_time +
 523                     msecs_to_jiffies(cur_roc->duration) -
 524                     now;
 525
 526         /* if it doesn't fit entirely, schedule a new one */
 527         if (new_roc->duration > jiffies_to_msecs(remaining))
 528                 return false;
 529
 530         /* add just after the current one so we combine their finish later */
 531         list_add(&new_roc->list, &cur_roc->list);
 532
 533         /* if the existing one has already begun then let this one also
 534          * begin, otherwise they'll both be marked properly by the work
 535          * struct that runs once the driver notifies us of the beginning
 536          */
 537         if (cur_roc->hw_begun) {
 538                 new_roc->hw_begun = true;
 539                 ieee80211_handle_roc_started(new_roc, now);
 540         }
 541
 542         return true;
 543 }
 544
 545 static int ieee80211_start_roc_work(struct ieee80211_local *local,
 546                                     struct ieee80211_sub_if_data *sdata,
 547                                     struct ieee80211_channel *channel,
 548                                     unsigned int duration, u64 *cookie,
 549                                     struct sk_buff *txskb,
 550                                     enum ieee80211_roc_type type)
 551 {
 552         struct ieee80211_roc_work *roc, *tmp;
 553         bool queued = false, combine_started = true;
 554         int ret;
 555
 556         lockdep_assert_held(&local->mtx);
 557
 558         if (local->use_chanctx && !local->ops->remain_on_channel)
 559                 return -EOPNOTSUPP;
 560
 561         roc = kzalloc(sizeof(*roc), GFP_KERNEL);
 562         if (!roc)
 563                 return -ENOMEM;
 564
 565         /*
 566          * If the duration is zero, then the driver
 567          * wouldn't actually do anything. Set it to
 568          * 10 for now.
 569          *
 570          * TODO: cancel the off-channel operation
 571          *       when we get the SKB's TX status and
 572          *       the wait time was zero before.
 573          */
 574         if (!duration)
 575                 duration = 10;
 576
 577         roc->chan = channel;
 578         roc->duration = duration;
 579         roc->req_duration = duration;
 580         roc->frame = txskb;
 581         roc->type = type;
 582         roc->sdata = sdata;
 583
 584         /*
 585          * cookie is either the roc cookie (for normal roc)
 586          * or the SKB (for mgmt TX)
 587          */
 588         if (!txskb) {
 589                 roc->cookie = ieee80211_mgmt_tx_cookie(local);
 590                 *cookie = roc->cookie;
 591         } else {
 592                 roc->mgmt_tx_cookie = *cookie;
 593         }
 594
 595         /* if there's no need to queue, handle it immediately */
 596         if (list_empty(&local->roc_list) &&
 597             !local->scanning && !ieee80211_is_radar_required(local)) {
 598                 /* if not HW assist, just queue & schedule work */
 599                 if (!local->ops->remain_on_channel) {
 600                         list_add_tail(&roc->list, &local->roc_list);
 601                         ieee80211_queue_delayed_work(&local->hw,
 602                                                      &local->roc_work, 0);
 603                 } else {
 604                         /* otherwise actually kick it off here
 605                          * (for error handling)
 606                          */
 607                         ret = drv_remain_on_channel(local, sdata, channel,
 608                                                     duration, type);
 609                         if (ret) {
 610                                 kfree(roc);
 611                                 return ret;
 612                         }
 613                         roc->started = true;
 614                         list_add_tail(&roc->list, &local->roc_list);
 615                 }
 616
 617                 return 0;
 618         }
 619
 620         /* otherwise handle queueing */
 621
 622         list_for_each_entry(tmp, &local->roc_list, list) {
 623                 if (tmp->chan != channel || tmp->sdata != sdata)
 624                         continue;
 625
 626                 /*
 627                  * Extend this ROC if possible: If it hasn't started, add
 628                  * just after the new one to combine.
 629                  */
 630                 if (!tmp->started) {
 631                         list_add(&roc->list, &tmp->list);
 632                         queued = true;
 633                         break;
 634                 }
 635
 636                 if (!combine_started)
 637                         continue;
 638
 639                 if (!local->ops->remain_on_channel) {
 640                         /* If there's no hardware remain-on-channel, and
 641                          * doing so won't push us over the maximum r-o-c
 642                          * we allow, then we can just add the new one to
 643                          * the list and mark it as having started now.
 644                          * If it would push over the limit, don't try to
 645                          * combine with other started ones (that haven't
 646                          * been running as long) but potentially sort it
 647                          * with others that had the same fate.
 648                          */
 649                         unsigned long now = jiffies;
 650                         u32 elapsed = jiffies_to_msecs(now - tmp->start_time);
 651                         struct wiphy *wiphy = local->hw.wiphy;
 652                         u32 max_roc = wiphy->max_remain_on_channel_duration;
 653
 654                         if (elapsed + roc->duration > max_roc) {
 655                                 combine_started = false;
 656                                 continue;
 657                         }
 658
 659                         list_add(&roc->list, &tmp->list);
 660                         queued = true;
 661                         roc->on_channel = tmp->on_channel;
 662                         ieee80211_handle_roc_started(roc, now);
 663                         ieee80211_recalc_sw_work(local, now);
 664                         break;
 665                 }
 666
 667                 queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp);
 668                 if (queued)
 669                         break;
 670                 /* if it wasn't queued, perhaps it can be combined with
 671                  * another that also couldn't get combined previously,
 672                  * but no need to check for already started ones, since
 673                  * that can't work.
 674                  */
 675                 combine_started = false;
 676         }
 677
 678         if (!queued)
 679                 list_add_tail(&roc->list, &local->roc_list);
 680
 681         return 0;
 682 }
 683
 684 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 685                                 struct ieee80211_channel *chan,
 686                                 unsigned int duration, u64 *cookie)
 687 {
 688         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 689         struct ieee80211_local *local = sdata->local;
 690         int ret;
 691
 692         mutex_lock(&local->mtx);
 693         ret = ieee80211_start_roc_work(local, sdata, chan,
 694                                        duration, cookie, NULL,
 695                                        IEEE80211_ROC_TYPE_NORMAL);
 696         mutex_unlock(&local->mtx);
 697
 698         return ret;
 699 }
 700
 701 static int ieee80211_cancel_roc(struct ieee80211_local *local,
 702                                 u64 cookie, bool mgmt_tx)
 703 {
 704         struct ieee80211_roc_work *roc, *tmp, *found = NULL;
 705         int ret;
 706
 707         if (!cookie)
 708                 return -ENOENT;
 709
 710         flush_work(&local->hw_roc_start);
 711
 712         mutex_lock(&local->mtx);
 713         list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 714                 if (!mgmt_tx && roc->cookie != cookie)
 715                         continue;
 716                 else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
 717                         continue;
 718
 719                 found = roc;
 720                 break;
 721         }
 722
 723         if (!found) {
 724                 mutex_unlock(&local->mtx);
 725                 return -ENOENT;
 726         }
 727
 728         if (!found->started) {
 729                 ieee80211_roc_notify_destroy(found);
 730                 goto out_unlock;
 731         }
 732
 733         if (local->ops->remain_on_channel) {
 734                 ret = drv_cancel_remain_on_channel(local);
 735                 if (WARN_ON_ONCE(ret)) {
 736                         mutex_unlock(&local->mtx);
 737                         return ret;
 738                 }
 739
 740                 /* TODO:
 741                  * if multiple items were combined here then we really shouldn't
 742                  * cancel them all - we should wait for as much time as needed
 743                  * for the longest remaining one, and only then cancel ...
 744                  */
 745                 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 746                         if (!roc->started)
 747                                 break;
 748                         if (roc == found)
 749                                 found = NULL;
 750                         ieee80211_roc_notify_destroy(roc);
 751                 }
 752
 753                 /* that really must not happen - it was started */
 754                 WARN_ON(found);
 755
 756                 ieee80211_start_next_roc(local);
 757         } else {
 758                 /* go through work struct to return to the operating channel */
 759                 found->abort = true;
 760                 mod_delayed_work(local->workqueue, &local->roc_work, 0);
 761         }
 762
 763  out_unlock:
 764         mutex_unlock(&local->mtx);
 765
 766         return 0;
 767 }
 768
 769 int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 770                                        struct wireless_dev *wdev, u64 cookie)
 771 {
 772         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 773         struct ieee80211_local *local = sdata->local;
 774
 775         return ieee80211_cancel_roc(local, cookie, false);
 776 }
 777
 778 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 779                       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 780 {
 781         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 782         struct ieee80211_local *local = sdata->local;
 783         struct sk_buff *skb;
 784         struct sta_info *sta;
 785         const struct ieee80211_mgmt *mgmt = (void *)params->buf;
 786         bool need_offchan = false;
 787         u32 flags;
 788         int ret;
 789         u8 *data;
 790
 791         if (params->dont_wait_for_ack)
 792                 flags = IEEE80211_TX_CTL_NO_ACK;
 793         else
 794                 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
 795                         IEEE80211_TX_CTL_REQ_TX_STATUS;
 796
 797         if (params->no_cck)
 798                 flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 799
 800         switch (sdata->vif.type) {
 801         case NL80211_IFTYPE_ADHOC:
 802                 if (!sdata->vif.bss_conf.ibss_joined)
 803                         need_offchan = true;
 804 #ifdef CONFIG_MAC80211_MESH
 805                 /* fall through */
 806         case NL80211_IFTYPE_MESH_POINT:
 807                 if (ieee80211_vif_is_mesh(&sdata->vif) &&
 808                     !sdata->u.mesh.mesh_id_len)
 809                         need_offchan = true;
 810 #endif
 811                 /* fall through */
 812         case NL80211_IFTYPE_AP:
 813         case NL80211_IFTYPE_AP_VLAN:
 814         case NL80211_IFTYPE_P2P_GO:
 815                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 816                     !ieee80211_vif_is_mesh(&sdata->vif) &&
 817                     !rcu_access_pointer(sdata->bss->beacon))
 818                         need_offchan = true;
 819                 if (!ieee80211_is_action(mgmt->frame_control) ||
 820                     mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
 821                     mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
 822                     mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT)
 823                         break;
 824                 rcu_read_lock();
 825                 sta = sta_info_get_bss(sdata, mgmt->da);
 826                 rcu_read_unlock();
 827                 if (!sta)
 828                         return -ENOLINK;
 829                 break;
 830         case NL80211_IFTYPE_STATION:
 831         case NL80211_IFTYPE_P2P_CLIENT:
 832                 sdata_lock(sdata);
 833                 if (!sdata->u.mgd.associated ||
 834                     (params->offchan && params->wait &&
 835                      local->ops->remain_on_channel &&
 836                      memcmp(sdata->u.mgd.associated->bssid,
 837                             mgmt->bssid, ETH_ALEN)))
 838                         need_offchan = true;
 839                 sdata_unlock(sdata);
 840                 break;
 841         case NL80211_IFTYPE_P2P_DEVICE:
 842                 need_offchan = true;
 843                 break;
 844         case NL80211_IFTYPE_NAN:
 845         default:
 846                 return -EOPNOTSUPP;
 847         }
 848
 849         /* configurations requiring offchan cannot work if no channel has been
 850          * specified
 851          */
 852         if (need_offchan && !params->chan)
 853                 return -EINVAL;
 854
 855         mutex_lock(&local->mtx);
 856
 857         /* Check if the operating channel is the requested channel */
 858         if (!need_offchan) {
 859                 struct ieee80211_chanctx_conf *chanctx_conf;
 860
 861                 rcu_read_lock();
 862                 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 863
 864                 if (chanctx_conf) {
 865                         need_offchan = params->chan &&
 866                                        (params->chan !=
 867                                         chanctx_conf->def.chan);
 868                 } else if (!params->chan) {
 869                         ret = -EINVAL;
 870                         rcu_read_unlock();
 871                         goto out_unlock;
 872                 } else {
 873                         need_offchan = true;
 874                 }
 875                 rcu_read_unlock();
 876         }
 877
 878         if (need_offchan && !params->offchan) {
 879                 ret = -EBUSY;
 880                 goto out_unlock;
 881         }
 882
 883         skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
 884         if (!skb) {
 885                 ret = -ENOMEM;
 886                 goto out_unlock;
 887         }
 888         skb_reserve(skb, local->hw.extra_tx_headroom);
 889
 890         data = skb_put_data(skb, params->buf, params->len);
 891
 892         /* Update CSA counters */
 893         if (sdata->vif.csa_active &&
 894             (sdata->vif.type == NL80211_IFTYPE_AP ||
 895              sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
 896              sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
 897             params->n_csa_offsets) {
 898                 int i;
 899                 struct beacon_data *beacon = NULL;
 900
 901                 rcu_read_lock();
 902
 903                 if (sdata->vif.type == NL80211_IFTYPE_AP)
 904                         beacon = rcu_dereference(sdata->u.ap.beacon);
 905                 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
 906                         beacon = rcu_dereference(sdata->u.ibss.presp);
 907                 else if (ieee80211_vif_is_mesh(&sdata->vif))
 908                         beacon = rcu_dereference(sdata->u.mesh.beacon);
 909
 910                 if (beacon)
 911                         for (i = 0; i < params->n_csa_offsets; i++)
 912                                 data[params->csa_offsets[i]] =
 913                                         beacon->csa_current_counter;
 914
 915                 rcu_read_unlock();
 916         }
 917
 918         IEEE80211_SKB_CB(skb)->flags = flags;
 919
 920         skb->dev = sdata->dev;
 921
 922         if (!params->dont_wait_for_ack) {
 923                 /* make a copy to preserve the frame contents
 924                  * in case of encryption.
 925                  */
 926                 ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);
 927                 if (ret) {
 928                         kfree_skb(skb);
 929                         goto out_unlock;
 930                 }
 931         } else {
 932                 /* Assign a dummy non-zero cookie, it's not sent to
 933                  * userspace in this case but we rely on its value
 934                  * internally in the need_offchan case to distinguish
 935                  * mgmt-tx from remain-on-channel.
 936                  */
 937                 *cookie = 0xffffffff;
 938         }
 939
 940         if (!need_offchan) {
 941                 ieee80211_tx_skb(sdata, skb);
 942                 ret = 0;
 943                 goto out_unlock;
 944         }
 945
 946         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
 947                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
 948         if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
 949                 IEEE80211_SKB_CB(skb)->hw_queue =
 950                         local->hw.offchannel_tx_hw_queue;
 951
 952         /* This will handle all kinds of coalescing and immediate TX */
 953         ret = ieee80211_start_roc_work(local, sdata, params->chan,
 954                                        params->wait, cookie, skb,
 955                                        IEEE80211_ROC_TYPE_MGMT_TX);
 956         if (ret)
 957                 ieee80211_free_txskb(&local->hw, skb);
 958  out_unlock:
 959         mutex_unlock(&local->mtx);
 960         return ret;
 961 }
 962
 963 int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 964                                   struct wireless_dev *wdev, u64 cookie)
 965 {
 966         struct ieee80211_local *local = wiphy_priv(wiphy);
 967
 968         return ieee80211_cancel_roc(local, cookie, true);
 969 }
 970
 971 void ieee80211_roc_setup(struct ieee80211_local *local)
 972 {
 973         INIT_WORK(&local->hw_roc_start, ieee80211_hw_roc_start);
 974         INIT_WORK(&local->hw_roc_done, ieee80211_hw_roc_done);
 975         INIT_DELAYED_WORK(&local->roc_work, ieee80211_roc_work);
 976         INIT_LIST_HEAD(&local->roc_list);
 977 }
 978
 979 void ieee80211_roc_purge(struct ieee80211_local *local,
 980                          struct ieee80211_sub_if_data *sdata)
 981 {
 982         struct ieee80211_roc_work *roc, *tmp;
 983         bool work_to_do = false;
 984
 985         mutex_lock(&local->mtx);
 986         list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 987                 if (sdata && roc->sdata != sdata)
 988                         continue;
 989
 990                 if (roc->started) {
 991                         if (local->ops->remain_on_channel) {
 992                                 /* can race, so ignore return value */
 993                                 drv_cancel_remain_on_channel(local);
 994                                 ieee80211_roc_notify_destroy(roc);
 995                         } else {
 996                                 roc->abort = true;
 997                                 work_to_do = true;
 998                         }
 999                 } else {
1000                         ieee80211_roc_notify_destroy(roc);
1001                 }
1002         }
1003         if (work_to_do)
1004                 __ieee80211_roc_work(local);
1005         mutex_unlock(&local->mtx);
1006 }