1 // SPDX-License-Identifier: GPL-2.0-only
3 * Off-channel operation helpers
5 * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
6 * Copyright 2004, Instant802 Networks, Inc.
7 * Copyright 2005, Devicescape Software, Inc.
8 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
9 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
10 * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
11 * Copyright (C) 2019, 2022-2023 Intel Corporation
13 #include <linux/export.h>
14 #include <net/mac80211.h>
15 #include "ieee80211_i.h"
16 #include "driver-ops.h"
19 * Tell our hardware to disable PS.
20 * Optionally inform AP that we will go to sleep so that it will buffer
21 * the frames while we are doing off-channel work. This is optional
22 * because we *may* be doing work on-operating channel, and want our
23 * hardware unconditionally awake, but still let the AP send us normal frames.
25 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
27 struct ieee80211_local *local = sdata->local;
28 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
29 bool offchannel_ps_enabled = false;
31 /* FIXME: what to do when local->pspolling is true? */
33 del_timer_sync(&local->dynamic_ps_timer);
34 del_timer_sync(&ifmgd->bcn_mon_timer);
35 del_timer_sync(&ifmgd->conn_mon_timer);
37 wiphy_work_cancel(local->hw.wiphy, &local->dynamic_ps_enable_work);
39 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
40 offchannel_ps_enabled = true;
41 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
42 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
45 if (!offchannel_ps_enabled ||
46 !ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
48 * If power save was enabled, no need to send a nullfunc
49 * frame because AP knows that we are sleeping. But if the
50 * hardware is creating the nullfunc frame for power save
51 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
52 * enabled) and power save was enabled, the firmware just
53 * sent a null frame with power save disabled. So we need
54 * to send a new nullfunc frame to inform the AP that we
57 ieee80211_send_nullfunc(local, sdata, true);
60 /* inform AP that we are awake again */
61 static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
63 struct ieee80211_local *local = sdata->local;
66 ieee80211_send_nullfunc(local, sdata, false);
67 else if (local->hw.conf.dynamic_ps_timeout > 0) {
69 * the dynamic_ps_timer had been running before leaving the
70 * operating channel, restart the timer now and send a nullfunc
71 * frame to inform the AP that we are awake so that AP sends
72 * the buffered packets (if any).
74 ieee80211_send_nullfunc(local, sdata, false);
75 mod_timer(&local->dynamic_ps_timer, jiffies +
76 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
79 ieee80211_sta_reset_beacon_monitor(sdata);
80 ieee80211_sta_reset_conn_monitor(sdata);
83 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
85 struct ieee80211_sub_if_data *sdata;
87 lockdep_assert_wiphy(local->hw.wiphy);
89 if (WARN_ON(local->use_chanctx))
93 * notify the AP about us leaving the channel and stop all
98 * Stop queues and transmit all frames queued by the driver
99 * before sending nullfunc to enable powersave at the AP.
101 ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
102 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
104 ieee80211_flush_queues(local, NULL, false);
106 list_for_each_entry(sdata, &local->interfaces, list) {
107 if (!ieee80211_sdata_running(sdata))
110 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
111 sdata->vif.type == NL80211_IFTYPE_NAN)
114 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
115 set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
117 /* Check to see if we should disable beaconing. */
118 if (sdata->vif.bss_conf.enable_beacon) {
119 set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
121 sdata->vif.bss_conf.enable_beacon = false;
122 ieee80211_link_info_change_notify(
123 sdata, &sdata->deflink,
124 BSS_CHANGED_BEACON_ENABLED);
127 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
128 sdata->u.mgd.associated)
129 ieee80211_offchannel_ps_enable(sdata);
133 void ieee80211_offchannel_return(struct ieee80211_local *local)
135 struct ieee80211_sub_if_data *sdata;
137 lockdep_assert_wiphy(local->hw.wiphy);
139 if (WARN_ON(local->use_chanctx))
142 list_for_each_entry(sdata, &local->interfaces, list) {
143 if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
146 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
147 clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
149 if (!ieee80211_sdata_running(sdata))
152 /* Tell AP we're back */
153 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
154 sdata->u.mgd.associated)
155 ieee80211_offchannel_ps_disable(sdata);
157 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
159 sdata->vif.bss_conf.enable_beacon = true;
160 ieee80211_link_info_change_notify(
161 sdata, &sdata->deflink,
162 BSS_CHANGED_BEACON_ENABLED);
166 ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
167 IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
171 static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
173 /* was never transmitted */
175 cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie,
176 roc->frame->data, roc->frame->len,
178 ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame);
181 if (!roc->mgmt_tx_cookie)
182 cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
183 roc->cookie, roc->chan,
186 cfg80211_tx_mgmt_expired(&roc->sdata->wdev,
188 roc->chan, GFP_KERNEL);
190 list_del(&roc->list);
194 static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local,
197 struct ieee80211_roc_work *roc, *tmp;
198 long remaining_dur_min = LONG_MAX;
200 lockdep_assert_wiphy(local->hw.wiphy);
202 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
208 remaining = roc->start_time +
209 msecs_to_jiffies(roc->duration) -
212 /* In case of HW ROC, it is possible that the HW finished the
213 * ROC session before the actual requested time. In such a case
214 * end the ROC session (disregarding the remaining time).
216 if (roc->abort || roc->hw_begun || remaining <= 0)
217 ieee80211_roc_notify_destroy(roc);
219 remaining_dur_min = min(remaining_dur_min, remaining);
222 return remaining_dur_min;
225 static bool ieee80211_recalc_sw_work(struct ieee80211_local *local,
228 long dur = ieee80211_end_finished_rocs(local, now);
233 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, dur);
237 static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
238 unsigned long start_time)
240 if (WARN_ON(roc->notified))
243 roc->start_time = start_time;
246 if (roc->mgmt_tx_cookie) {
247 if (!WARN_ON(!roc->frame)) {
248 ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7,
253 cfg80211_ready_on_channel(&roc->sdata->wdev, roc->cookie,
254 roc->chan, roc->req_duration,
258 roc->notified = true;
261 static void ieee80211_hw_roc_start(struct wiphy *wiphy, struct wiphy_work *work)
263 struct ieee80211_local *local =
264 container_of(work, struct ieee80211_local, hw_roc_start);
265 struct ieee80211_roc_work *roc;
267 lockdep_assert_wiphy(local->hw.wiphy);
269 list_for_each_entry(roc, &local->roc_list, list) {
273 roc->hw_begun = true;
274 ieee80211_handle_roc_started(roc, local->hw_roc_start_time);
278 void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
280 struct ieee80211_local *local = hw_to_local(hw);
282 local->hw_roc_start_time = jiffies;
284 trace_api_ready_on_channel(local);
286 wiphy_work_queue(hw->wiphy, &local->hw_roc_start);
288 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
290 static void _ieee80211_start_next_roc(struct ieee80211_local *local)
292 struct ieee80211_roc_work *roc, *tmp;
293 enum ieee80211_roc_type type;
294 u32 min_dur, max_dur;
296 lockdep_assert_wiphy(local->hw.wiphy);
298 if (WARN_ON(list_empty(&local->roc_list)))
301 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
304 if (WARN_ON(roc->started))
307 min_dur = roc->duration;
308 max_dur = roc->duration;
311 list_for_each_entry(tmp, &local->roc_list, list) {
314 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
316 max_dur = max(tmp->duration, max_dur);
317 min_dur = min(tmp->duration, min_dur);
318 type = max(tmp->type, type);
321 if (local->ops->remain_on_channel) {
322 int ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
326 wiphy_warn(local->hw.wiphy,
327 "failed to start next HW ROC (%d)\n", ret);
329 * queue the work struct again to avoid recursion
330 * when multiple failures occur
332 list_for_each_entry(tmp, &local->roc_list, list) {
333 if (tmp->sdata != roc->sdata ||
334 tmp->chan != roc->chan)
339 wiphy_work_queue(local->hw.wiphy, &local->hw_roc_done);
343 /* we'll notify about the start once the HW calls back */
344 list_for_each_entry(tmp, &local->roc_list, list) {
345 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
350 /* If actually operating on the desired channel (with at least
351 * 20 MHz channel width) don't stop all the operations but still
352 * treat it as though the ROC operation started properly, so
353 * other ROC operations won't interfere with this one.
355 roc->on_channel = roc->chan == local->_oper_chandef.chan &&
356 local->_oper_chandef.width != NL80211_CHAN_WIDTH_5 &&
357 local->_oper_chandef.width != NL80211_CHAN_WIDTH_10;
360 ieee80211_recalc_idle(local);
362 if (!roc->on_channel) {
363 ieee80211_offchannel_stop_vifs(local);
365 local->tmp_channel = roc->chan;
366 ieee80211_hw_config(local, 0);
369 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work,
370 msecs_to_jiffies(min_dur));
372 /* tell userspace or send frame(s) */
373 list_for_each_entry(tmp, &local->roc_list, list) {
374 if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
377 tmp->on_channel = roc->on_channel;
378 ieee80211_handle_roc_started(tmp, jiffies);
383 void ieee80211_start_next_roc(struct ieee80211_local *local)
385 struct ieee80211_roc_work *roc;
387 lockdep_assert_wiphy(local->hw.wiphy);
389 if (list_empty(&local->roc_list)) {
390 ieee80211_run_deferred_scan(local);
394 /* defer roc if driver is not started (i.e. during reconfig) */
395 if (local->in_reconfig)
398 roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
401 if (WARN_ON_ONCE(roc->started))
404 if (local->ops->remain_on_channel) {
405 _ieee80211_start_next_roc(local);
408 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work,
409 round_jiffies_relative(HZ / 2));
413 static void __ieee80211_roc_work(struct ieee80211_local *local)
415 struct ieee80211_roc_work *roc;
418 lockdep_assert_wiphy(local->hw.wiphy);
420 if (WARN_ON(local->ops->remain_on_channel))
423 roc = list_first_entry_or_null(&local->roc_list,
424 struct ieee80211_roc_work, list);
429 WARN_ON(local->use_chanctx);
430 _ieee80211_start_next_roc(local);
432 on_channel = roc->on_channel;
433 if (ieee80211_recalc_sw_work(local, jiffies))
436 /* careful - roc pointer became invalid during recalc */
439 ieee80211_flush_queues(local, NULL, false);
441 local->tmp_channel = NULL;
442 ieee80211_hw_config(local, 0);
444 ieee80211_offchannel_return(local);
447 ieee80211_recalc_idle(local);
448 ieee80211_start_next_roc(local);
452 static void ieee80211_roc_work(struct wiphy *wiphy, struct wiphy_work *work)
454 struct ieee80211_local *local =
455 container_of(work, struct ieee80211_local, roc_work.work);
457 lockdep_assert_wiphy(local->hw.wiphy);
459 __ieee80211_roc_work(local);
462 static void ieee80211_hw_roc_done(struct wiphy *wiphy, struct wiphy_work *work)
464 struct ieee80211_local *local =
465 container_of(work, struct ieee80211_local, hw_roc_done);
467 lockdep_assert_wiphy(local->hw.wiphy);
469 ieee80211_end_finished_rocs(local, jiffies);
471 /* if there's another roc, start it now */
472 ieee80211_start_next_roc(local);
475 void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
477 struct ieee80211_local *local = hw_to_local(hw);
479 trace_api_remain_on_channel_expired(local);
481 wiphy_work_queue(hw->wiphy, &local->hw_roc_done);
483 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
486 ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
487 struct ieee80211_roc_work *new_roc,
488 struct ieee80211_roc_work *cur_roc)
490 unsigned long now = jiffies;
491 unsigned long remaining;
493 if (WARN_ON(!cur_roc->started))
496 /* if it was scheduled in the hardware, but not started yet,
497 * we can only combine if the older one had a longer duration
499 if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration)
502 remaining = cur_roc->start_time +
503 msecs_to_jiffies(cur_roc->duration) -
506 /* if it doesn't fit entirely, schedule a new one */
507 if (new_roc->duration > jiffies_to_msecs(remaining))
510 /* add just after the current one so we combine their finish later */
511 list_add(&new_roc->list, &cur_roc->list);
513 /* if the existing one has already begun then let this one also
514 * begin, otherwise they'll both be marked properly by the work
515 * struct that runs once the driver notifies us of the beginning
517 if (cur_roc->hw_begun) {
518 new_roc->hw_begun = true;
519 ieee80211_handle_roc_started(new_roc, now);
525 static int ieee80211_start_roc_work(struct ieee80211_local *local,
526 struct ieee80211_sub_if_data *sdata,
527 struct ieee80211_channel *channel,
528 unsigned int duration, u64 *cookie,
529 struct sk_buff *txskb,
530 enum ieee80211_roc_type type)
532 struct ieee80211_roc_work *roc, *tmp;
533 bool queued = false, combine_started = true;
536 lockdep_assert_wiphy(local->hw.wiphy);
538 if (channel->freq_offset)
539 /* this may work, but is untested */
542 if (local->use_chanctx && !local->ops->remain_on_channel)
545 roc = kzalloc(sizeof(*roc), GFP_KERNEL);
550 * If the duration is zero, then the driver
551 * wouldn't actually do anything. Set it to
554 * TODO: cancel the off-channel operation
555 * when we get the SKB's TX status and
556 * the wait time was zero before.
562 roc->duration = duration;
563 roc->req_duration = duration;
569 * cookie is either the roc cookie (for normal roc)
570 * or the SKB (for mgmt TX)
573 roc->cookie = ieee80211_mgmt_tx_cookie(local);
574 *cookie = roc->cookie;
576 roc->mgmt_tx_cookie = *cookie;
579 /* if there's no need to queue, handle it immediately */
580 if (list_empty(&local->roc_list) &&
581 !local->scanning && !ieee80211_is_radar_required(local)) {
582 /* if not HW assist, just queue & schedule work */
583 if (!local->ops->remain_on_channel) {
584 list_add_tail(&roc->list, &local->roc_list);
585 wiphy_delayed_work_queue(local->hw.wiphy,
586 &local->roc_work, 0);
588 /* otherwise actually kick it off here
589 * (for error handling)
591 ret = drv_remain_on_channel(local, sdata, channel,
598 list_add_tail(&roc->list, &local->roc_list);
604 /* otherwise handle queueing */
606 list_for_each_entry(tmp, &local->roc_list, list) {
607 if (tmp->chan != channel || tmp->sdata != sdata)
611 * Extend this ROC if possible: If it hasn't started, add
612 * just after the new one to combine.
615 list_add(&roc->list, &tmp->list);
620 if (!combine_started)
623 if (!local->ops->remain_on_channel) {
624 /* If there's no hardware remain-on-channel, and
625 * doing so won't push us over the maximum r-o-c
626 * we allow, then we can just add the new one to
627 * the list and mark it as having started now.
628 * If it would push over the limit, don't try to
629 * combine with other started ones (that haven't
630 * been running as long) but potentially sort it
631 * with others that had the same fate.
633 unsigned long now = jiffies;
634 u32 elapsed = jiffies_to_msecs(now - tmp->start_time);
635 struct wiphy *wiphy = local->hw.wiphy;
636 u32 max_roc = wiphy->max_remain_on_channel_duration;
638 if (elapsed + roc->duration > max_roc) {
639 combine_started = false;
643 list_add(&roc->list, &tmp->list);
645 roc->on_channel = tmp->on_channel;
646 ieee80211_handle_roc_started(roc, now);
647 ieee80211_recalc_sw_work(local, now);
651 queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp);
654 /* if it wasn't queued, perhaps it can be combined with
655 * another that also couldn't get combined previously,
656 * but no need to check for already started ones, since
659 combine_started = false;
663 list_add_tail(&roc->list, &local->roc_list);
668 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
669 struct ieee80211_channel *chan,
670 unsigned int duration, u64 *cookie)
672 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
673 struct ieee80211_local *local = sdata->local;
675 lockdep_assert_wiphy(local->hw.wiphy);
677 return ieee80211_start_roc_work(local, sdata, chan,
678 duration, cookie, NULL,
679 IEEE80211_ROC_TYPE_NORMAL);
682 static int ieee80211_cancel_roc(struct ieee80211_local *local,
683 u64 cookie, bool mgmt_tx)
685 struct ieee80211_roc_work *roc, *tmp, *found = NULL;
688 lockdep_assert_wiphy(local->hw.wiphy);
693 wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start);
695 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
696 if (!mgmt_tx && roc->cookie != cookie)
698 else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
709 if (!found->started) {
710 ieee80211_roc_notify_destroy(found);
714 if (local->ops->remain_on_channel) {
715 ret = drv_cancel_remain_on_channel(local, roc->sdata);
716 if (WARN_ON_ONCE(ret)) {
721 * We could be racing against the notification from the driver:
722 * + driver is handling the notification on CPU0
723 * + user space is cancelling the remain on channel and
724 * schedules the hw_roc_done worker.
726 * Now hw_roc_done might start to run after the next roc will
727 * start and mac80211 will think that this second roc has
729 * Cancel the work to make sure that all the pending workers
730 * have completed execution.
731 * Note that this assumes that by the time the driver returns
732 * from drv_cancel_remain_on_channel, it has completed all
733 * the processing of related notifications.
735 wiphy_work_cancel(local->hw.wiphy, &local->hw_roc_done);
738 * if multiple items were combined here then we really shouldn't
739 * cancel them all - we should wait for as much time as needed
740 * for the longest remaining one, and only then cancel ...
742 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
747 ieee80211_roc_notify_destroy(roc);
750 /* that really must not happen - it was started */
753 ieee80211_start_next_roc(local);
755 /* go through work struct to return to the operating channel */
757 wiphy_delayed_work_queue(local->hw.wiphy, &local->roc_work, 0);
765 int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
766 struct wireless_dev *wdev, u64 cookie)
768 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
769 struct ieee80211_local *local = sdata->local;
771 return ieee80211_cancel_roc(local, cookie, false);
774 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
775 struct cfg80211_mgmt_tx_params *params, u64 *cookie)
777 struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
778 struct ieee80211_local *local = sdata->local;
780 struct sta_info *sta = NULL;
781 const struct ieee80211_mgmt *mgmt = (void *)params->buf;
782 bool need_offchan = false;
783 bool mlo_sta = false;
789 lockdep_assert_wiphy(local->hw.wiphy);
791 if (params->dont_wait_for_ack)
792 flags = IEEE80211_TX_CTL_NO_ACK;
794 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
795 IEEE80211_TX_CTL_REQ_TX_STATUS;
798 flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
800 switch (sdata->vif.type) {
801 case NL80211_IFTYPE_ADHOC:
802 if (!sdata->vif.cfg.ibss_joined)
804 #ifdef CONFIG_MAC80211_MESH
806 case NL80211_IFTYPE_MESH_POINT:
807 if (ieee80211_vif_is_mesh(&sdata->vif) &&
808 !sdata->u.mesh.mesh_id_len)
812 case NL80211_IFTYPE_AP:
813 case NL80211_IFTYPE_AP_VLAN:
814 case NL80211_IFTYPE_P2P_GO:
815 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
816 !ieee80211_vif_is_mesh(&sdata->vif) &&
821 sta = sta_info_get_bss(sdata, mgmt->da);
822 mlo_sta = sta && sta->sta.mlo;
824 if (!ieee80211_is_action(mgmt->frame_control) ||
825 mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
826 mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
827 mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
836 if (params->link_id >= 0 &&
837 !(sta->sta.valid_links & BIT(params->link_id))) {
841 link_id = params->link_id;
844 case NL80211_IFTYPE_STATION:
845 case NL80211_IFTYPE_P2P_CLIENT:
846 if (!sdata->u.mgd.associated ||
847 (params->offchan && params->wait &&
848 local->ops->remain_on_channel &&
849 memcmp(sdata->vif.cfg.ap_addr, mgmt->bssid, ETH_ALEN))) {
851 } else if (sdata->u.mgd.associated &&
852 ether_addr_equal(sdata->vif.cfg.ap_addr, mgmt->da)) {
853 sta = sta_info_get_bss(sdata, mgmt->da);
854 mlo_sta = sta && sta->sta.mlo;
857 case NL80211_IFTYPE_P2P_DEVICE:
860 case NL80211_IFTYPE_NAN:
865 /* configurations requiring offchan cannot work if no channel has been
868 if (need_offchan && !params->chan)
871 /* Check if the operating channel is the requested channel */
872 if (!params->chan && mlo_sta) {
873 need_offchan = false;
874 } else if (!need_offchan) {
875 struct ieee80211_chanctx_conf *chanctx_conf = NULL;
879 /* Check all the links first */
880 for (i = 0; i < ARRAY_SIZE(sdata->vif.link_conf); i++) {
881 struct ieee80211_bss_conf *conf;
883 conf = rcu_dereference(sdata->vif.link_conf[i]);
887 chanctx_conf = rcu_dereference(conf->chanctx_conf);
891 if (mlo_sta && params->chan == chanctx_conf->def.chan &&
892 ether_addr_equal(sdata->vif.addr, mgmt->sa)) {
897 if (ether_addr_equal(conf->addr, mgmt->sa))
904 need_offchan = params->chan &&
906 chanctx_conf->def.chan);
913 if (need_offchan && !params->offchan) {
918 skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
923 skb_reserve(skb, local->hw.extra_tx_headroom);
925 data = skb_put_data(skb, params->buf, params->len);
927 /* Update CSA counters */
928 if (sdata->vif.bss_conf.csa_active &&
929 (sdata->vif.type == NL80211_IFTYPE_AP ||
930 sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
931 sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
932 params->n_csa_offsets) {
934 struct beacon_data *beacon = NULL;
938 if (sdata->vif.type == NL80211_IFTYPE_AP)
939 beacon = rcu_dereference(sdata->deflink.u.ap.beacon);
940 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
941 beacon = rcu_dereference(sdata->u.ibss.presp);
942 else if (ieee80211_vif_is_mesh(&sdata->vif))
943 beacon = rcu_dereference(sdata->u.mesh.beacon);
946 for (i = 0; i < params->n_csa_offsets; i++)
947 data[params->csa_offsets[i]] =
948 beacon->cntdwn_current_counter;
953 IEEE80211_SKB_CB(skb)->flags = flags;
955 skb->dev = sdata->dev;
957 if (!params->dont_wait_for_ack) {
958 /* make a copy to preserve the frame contents
959 * in case of encryption.
961 ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);
967 /* Assign a dummy non-zero cookie, it's not sent to
968 * userspace in this case but we rely on its value
969 * internally in the need_offchan case to distinguish
970 * mgmt-tx from remain-on-channel.
972 *cookie = 0xffffffff;
976 ieee80211_tx_skb_tid(sdata, skb, 7, link_id);
981 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
982 IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
983 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
984 IEEE80211_SKB_CB(skb)->hw_queue =
985 local->hw.offchannel_tx_hw_queue;
987 /* This will handle all kinds of coalescing and immediate TX */
988 ret = ieee80211_start_roc_work(local, sdata, params->chan,
989 params->wait, cookie, skb,
990 IEEE80211_ROC_TYPE_MGMT_TX);
992 ieee80211_free_txskb(&local->hw, skb);
997 int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
998 struct wireless_dev *wdev, u64 cookie)
1000 struct ieee80211_local *local = wiphy_priv(wiphy);
1002 return ieee80211_cancel_roc(local, cookie, true);
1005 void ieee80211_roc_setup(struct ieee80211_local *local)
1007 wiphy_work_init(&local->hw_roc_start, ieee80211_hw_roc_start);
1008 wiphy_work_init(&local->hw_roc_done, ieee80211_hw_roc_done);
1009 wiphy_delayed_work_init(&local->roc_work, ieee80211_roc_work);
1010 INIT_LIST_HEAD(&local->roc_list);
1013 void ieee80211_roc_purge(struct ieee80211_local *local,
1014 struct ieee80211_sub_if_data *sdata)
1016 struct ieee80211_roc_work *roc, *tmp;
1017 bool work_to_do = false;
1019 lockdep_assert_wiphy(local->hw.wiphy);
1021 list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
1022 if (sdata && roc->sdata != sdata)
1026 if (local->ops->remain_on_channel) {
1027 /* can race, so ignore return value */
1028 drv_cancel_remain_on_channel(local, roc->sdata);
1029 ieee80211_roc_notify_destroy(roc);
1035 ieee80211_roc_notify_destroy(roc);
1039 __ieee80211_roc_work(local);