[thirdparty/hostap.git] / wpa_supplicant / offchannel.c

/*
 * wpa_supplicant - Off-channel Action frame TX/RX
 * Copyright (c) 2009-2010, Atheros Communications
 * Copyright (c) 2011, Qualcomm Atheros
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 */

#include "includes.h"

#include "common.h"
#include "utils/eloop.h"
#include "wpa_supplicant_i.h"
#include "p2p_supplicant.h"
#include "driver_i.h"
#include "offchannel.h"


static struct wpa_supplicant *
wpas_get_tx_interface(struct wpa_supplicant *wpa_s, const u8 *src)
{
	struct wpa_supplicant *iface;

	if (os_memcmp(src, wpa_s->own_addr, ETH_ALEN) == 0) {
#ifdef CONFIG_P2P
		if (wpa_s->p2p_mgmt && wpa_s != wpa_s->parent &&
		    wpa_s->parent->ap_iface &&
		    os_memcmp(wpa_s->parent->own_addr,
			      wpa_s->own_addr, ETH_ALEN) == 0 &&
		    wpabuf_len(wpa_s->pending_action_tx) >= 2 &&
		    *wpabuf_head_u8(wpa_s->pending_action_tx) !=
		    WLAN_ACTION_PUBLIC) {
			/*
			 * When P2P Device interface has same MAC address as
			 * the GO interface, make sure non-Public Action frames
			 * are sent through the GO interface. The P2P Device
			 * interface can only send Public Action frames.
			 */
			wpa_printf(MSG_DEBUG,
				   "P2P: Use GO interface %s instead of interface %s for Action TX",
				   wpa_s->parent->ifname, wpa_s->ifname);
			return wpa_s->parent;
		}
#endif /* CONFIG_P2P */
		return wpa_s;
	}

	/*
	 * Try to find a group interface that matches with the source address.
	 */
	iface = wpa_s->global->ifaces;
	while (iface) {
		if (os_memcmp(src, iface->own_addr, ETH_ALEN) == 0)
			break;
		iface = iface->next;
	}
	if (iface) {
		wpa_printf(MSG_DEBUG, "P2P: Use group interface %s "
			   "instead of interface %s for Action TX",
			   iface->ifname, wpa_s->ifname);
		return iface;
	}

	return wpa_s;
}


static void wpas_send_action_cb(void *eloop_ctx, void *timeout_ctx)
{
	struct wpa_supplicant *wpa_s = eloop_ctx;
	struct wpa_supplicant *iface;
	int res;
	int without_roc;

	without_roc = wpa_s->pending_action_without_roc;
	wpa_s->pending_action_without_roc = 0;
	wpa_printf(MSG_DEBUG,
		   "Off-channel: Send Action callback (without_roc=%d pending_action_tx=%p pending_action_tx_done=%d)",
		   without_roc, wpa_s->pending_action_tx,
		   !!wpa_s->pending_action_tx_done);

	if (wpa_s->pending_action_tx == NULL || wpa_s->pending_action_tx_done)
		return;

	/*
	 * This call is likely going to be on the P2P device instance if the
	 * driver uses a separate interface for that purpose. However, some
	 * Action frames are actually sent within a P2P Group and when that is
	 * the case, we need to follow power saving (e.g., GO buffering the
	 * frame for a client in PS mode or a client following the advertised
	 * NoA from its GO). To make that easier for the driver, select the
	 * correct group interface here.
	 */
	iface = wpas_get_tx_interface(wpa_s, wpa_s->pending_action_src);

	if (wpa_s->off_channel_freq != wpa_s->pending_action_freq &&
	    wpa_s->pending_action_freq != 0 &&
	    wpa_s->pending_action_freq != iface->assoc_freq) {
		wpa_printf(MSG_DEBUG, "Off-channel: Pending Action frame TX "
			   "waiting for another freq=%u (off_channel_freq=%u "
			   "assoc_freq=%u)",
			   wpa_s->pending_action_freq,
			   wpa_s->off_channel_freq,
			   iface->assoc_freq);
		if (without_roc && wpa_s->off_channel_freq == 0) {
			unsigned int duration = 200;
			/*
			 * We may get here if wpas_send_action() found us to be
			 * on the correct channel, but remain-on-channel cancel
			 * event was received before getting here.
			 */
			wpa_printf(MSG_DEBUG, "Off-channel: Schedule "
				   "remain-on-channel to send Action frame");
#ifdef CONFIG_TESTING_OPTIONS
			if (wpa_s->extra_roc_dur) {
				wpa_printf(MSG_DEBUG,
					   "TESTING: Increase ROC duration %u -> %u",
					   duration,
					   duration + wpa_s->extra_roc_dur);
				duration += wpa_s->extra_roc_dur;
	}
#endif /* CONFIG_TESTING_OPTIONS */
			if (wpa_drv_remain_on_channel(
				    wpa_s, wpa_s->pending_action_freq,
				    duration) < 0) {
				wpa_printf(MSG_DEBUG, "Off-channel: Failed to "
					   "request driver to remain on "
					   "channel (%u MHz) for Action Frame "
					   "TX", wpa_s->pending_action_freq);
			} else {
				wpa_s->off_channel_freq = 0;
				wpa_s->roc_waiting_drv_freq =
					wpa_s->pending_action_freq;
			}
		}
		return;
	}

	wpa_printf(MSG_DEBUG, "Off-channel: Sending pending Action frame to "
		   MACSTR " using interface %s (pending_action_tx=%p)",
		   MAC2STR(wpa_s->pending_action_dst), iface->ifname,
		   wpa_s->pending_action_tx);
	res = wpa_drv_send_action(iface, wpa_s->pending_action_freq, 0,
				  wpa_s->pending_action_dst,
				  wpa_s->pending_action_src,
				  wpa_s->pending_action_bssid,
				  wpabuf_head(wpa_s->pending_action_tx),
				  wpabuf_len(wpa_s->pending_action_tx),
				  wpa_s->pending_action_no_cck);
	if (res) {
		wpa_printf(MSG_DEBUG, "Off-channel: Failed to send the "
			   "pending Action frame");
		/*
		 * Use fake TX status event to allow state machines to
		 * continue.
		 */
		offchannel_send_action_tx_status(
			wpa_s, wpa_s->pending_action_dst,
			wpabuf_head(wpa_s->pending_action_tx),
			wpabuf_len(wpa_s->pending_action_tx),
			OFFCHANNEL_SEND_ACTION_FAILED);
	}
}


/**
 * offchannel_send_action_tx_status - TX status callback
 * @wpa_s: Pointer to wpa_supplicant data
 * @dst: Destination MAC address of the transmitted Action frame
 * @data: Transmitted frame payload
 * @data_len: Length of @data in bytes
 * @result: TX status
 *
 * This function is called whenever the driver indicates a TX status event for
 * a frame sent by offchannel_send_action() using wpa_drv_send_action().
 */
void offchannel_send_action_tx_status(
	struct wpa_supplicant *wpa_s, const u8 *dst, const u8 *data,
	size_t data_len, enum offchannel_send_action_result result)
{
	if (wpa_s->pending_action_tx == NULL) {
		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
			   "no pending operation");
		return;
	}

	if (os_memcmp(dst, wpa_s->pending_action_dst, ETH_ALEN) != 0) {
		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
			   "unknown destination address");
		return;
	}

	/* Accept report only if the contents of the frame matches */
	if (data_len - wpabuf_len(wpa_s->pending_action_tx) != 24 ||
	    os_memcmp(data + 24, wpabuf_head(wpa_s->pending_action_tx),
		      wpabuf_len(wpa_s->pending_action_tx)) != 0) {
		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
				   "mismatching contents with pending frame");
		wpa_hexdump(MSG_MSGDUMP, "TX status frame data",
			    data, data_len);
		wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
				wpa_s->pending_action_tx);
		return;
	}

	wpa_printf(MSG_DEBUG,
		   "Off-channel: Delete matching pending action frame (dst="
		   MACSTR " pending_action_tx=%p)", MAC2STR(dst),
		   wpa_s->pending_action_tx);
	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
			wpa_s->pending_action_tx);
	wpabuf_free(wpa_s->pending_action_tx);
	wpa_s->pending_action_tx = NULL;

	wpa_printf(MSG_DEBUG, "Off-channel: TX status result=%d cb=%p",
		   result, wpa_s->pending_action_tx_status_cb);

	if (wpa_s->pending_action_tx_status_cb) {
		wpa_s->pending_action_tx_status_cb(
			wpa_s, wpa_s->pending_action_freq,
			wpa_s->pending_action_dst, wpa_s->pending_action_src,
			wpa_s->pending_action_bssid,
			data, data_len, result);
	}

#ifdef CONFIG_P2P
	if (wpa_s->global->p2p_long_listen > 0) {
		/* Continue the listen */
		wpa_printf(MSG_DEBUG, "P2P: Continuing long Listen state");
		wpas_p2p_listen_start(wpa_s, wpa_s->global->p2p_long_listen);
	}
#endif /* CONFIG_P2P */
}


/**
 * offchannel_send_action - Request off-channel Action frame TX
 * @wpa_s: Pointer to wpa_supplicant data
 * @freq: The frequency in MHz indicating the channel on which the frame is to
 *	transmitted or 0 for the current channel (only if associated)
 * @dst: Action frame destination MAC address
 * @src: Action frame source MAC address
 * @bssid: Action frame BSSID
 * @buf: Frame to transmit starting from the Category field
 * @len: Length of @buf in bytes
 * @wait_time: Wait time for response in milliseconds
 * @tx_cb: Callback function for indicating TX status or %NULL for no callback
 * @no_cck: Whether CCK rates are to be disallowed for TX rate selection
 * Returns: 0 on success or -1 on failure
 *
 * This function is used to request an Action frame to be transmitted on the
 * current operating channel or on another channel (off-channel). The actual
 * frame transmission will be delayed until the driver is ready on the specified
 * channel. The @wait_time parameter can be used to request the driver to remain
 * awake on the channel to wait for a response.
 */
int offchannel_send_action(struct wpa_supplicant *wpa_s, unsigned int freq,
			   const u8 *dst, const u8 *src, const u8 *bssid,
			   const u8 *buf, size_t len, unsigned int wait_time,
			   void (*tx_cb)(struct wpa_supplicant *wpa_s,
					 unsigned int freq, const u8 *dst,
					 const u8 *src, const u8 *bssid,
					 const u8 *data, size_t data_len,
					 enum offchannel_send_action_result
					 result),
			   int no_cck)
{
	wpa_printf(MSG_DEBUG, "Off-channel: Send action frame: freq=%d dst="
		   MACSTR " src=" MACSTR " bssid=" MACSTR " len=%d",
		   freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
		   (int) len);

	wpa_s->pending_action_tx_status_cb = tx_cb;

	if (wpa_s->pending_action_tx) {
		wpa_printf(MSG_DEBUG, "Off-channel: Dropped pending Action "
			   "frame TX to " MACSTR " (pending_action_tx=%p)",
			   MAC2STR(wpa_s->pending_action_dst),
			   wpa_s->pending_action_tx);
		wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
				wpa_s->pending_action_tx);
		wpabuf_free(wpa_s->pending_action_tx);
	}
	wpa_s->pending_action_tx_done = 0;
	wpa_s->pending_action_tx = wpabuf_alloc(len);
	if (wpa_s->pending_action_tx == NULL) {
		wpa_printf(MSG_DEBUG, "Off-channel: Failed to allocate Action "
			   "frame TX buffer (len=%llu)",
			   (unsigned long long) len);
		return -1;
	}
	wpabuf_put_data(wpa_s->pending_action_tx, buf, len);
	os_memcpy(wpa_s->pending_action_src, src, ETH_ALEN);
	os_memcpy(wpa_s->pending_action_dst, dst, ETH_ALEN);
	os_memcpy(wpa_s->pending_action_bssid, bssid, ETH_ALEN);
	wpa_s->pending_action_freq = freq;
	wpa_s->pending_action_no_cck = no_cck;
	wpa_printf(MSG_DEBUG,
		   "Off-channel: Stored pending action frame (dst=" MACSTR
		   " pending_action_tx=%p)",
		   MAC2STR(dst), wpa_s->pending_action_tx);
	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
			wpa_s->pending_action_tx);

	if (freq != 0 && wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) {
		struct wpa_supplicant *iface;
		int ret;

		iface = wpas_get_tx_interface(wpa_s, src);
		wpa_s->action_tx_wait_time = wait_time;
		if (wait_time)
			wpa_s->action_tx_wait_time_used = 1;

		ret = wpa_drv_send_action(
			iface, wpa_s->pending_action_freq,
			wait_time, wpa_s->pending_action_dst,
			wpa_s->pending_action_src, wpa_s->pending_action_bssid,
			wpabuf_head(wpa_s->pending_action_tx),
			wpabuf_len(wpa_s->pending_action_tx),
			wpa_s->pending_action_no_cck);
		if (ret == 0)
			wpa_s->pending_action_tx_done = 1;
		return ret;
	}

	if (freq) {
		struct wpa_supplicant *tx_iface;
		tx_iface = wpas_get_tx_interface(wpa_s, src);
		if (tx_iface->assoc_freq == freq) {
			wpa_printf(MSG_DEBUG, "Off-channel: Already on "
				   "requested channel (TX interface operating "
				   "channel)");
			freq = 0;
		}
	}

	if (wpa_s->off_channel_freq == freq || freq == 0) {
		wpa_printf(MSG_DEBUG, "Off-channel: Already on requested "
			   "channel; send Action frame immediately");
		/* TODO: Would there ever be need to extend the current
		 * duration on the channel? */
		wpa_s->pending_action_without_roc = 1;
		eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
		eloop_register_timeout(0, 0, wpas_send_action_cb, wpa_s, NULL);
		return 0;
	}
	wpa_s->pending_action_without_roc = 0;

	if (wpa_s->roc_waiting_drv_freq == freq) {
		wpa_printf(MSG_DEBUG, "Off-channel: Already waiting for "
			   "driver to get to frequency %u MHz; continue "
			   "waiting to send the Action frame", freq);
		return 0;
	}

	wpa_printf(MSG_DEBUG, "Off-channel: Schedule Action frame to be "
		   "transmitted once the driver gets to the requested "
		   "channel");
	if (wait_time > wpa_s->max_remain_on_chan)
		wait_time = wpa_s->max_remain_on_chan;
	else if (wait_time == 0)
		wait_time = 20;
#ifdef CONFIG_TESTING_OPTIONS
	if (wpa_s->extra_roc_dur) {
		wpa_printf(MSG_DEBUG, "TESTING: Increase ROC duration %u -> %u",
			   wait_time, wait_time + wpa_s->extra_roc_dur);
		wait_time += wpa_s->extra_roc_dur;
	}
#endif /* CONFIG_TESTING_OPTIONS */
	if (wpa_drv_remain_on_channel(wpa_s, freq, wait_time) < 0) {
		wpa_printf(MSG_DEBUG, "Off-channel: Failed to request driver "
			   "to remain on channel (%u MHz) for Action "
			   "Frame TX", freq);
		return -1;
	}
	wpa_s->off_channel_freq = 0;
	wpa_s->roc_waiting_drv_freq = freq;

	return 0;
}


/**
 * offchannel_send_send_action_done - Notify completion of Action frame sequence
 * @wpa_s: Pointer to wpa_supplicant data
 *
 * This function can be used to cancel a wait for additional response frames on
 * the channel that was used with offchannel_send_action().
 */
void offchannel_send_action_done(struct wpa_supplicant *wpa_s)
{
	wpa_printf(MSG_DEBUG,
		   "Off-channel: Action frame sequence done notification: pending_action_tx=%p drv_offchan_tx=%d action_tx_wait_time=%d off_channel_freq=%d roc_waiting_drv_freq=%d",
		   wpa_s->pending_action_tx,
		   !!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX),
		   wpa_s->action_tx_wait_time, wpa_s->off_channel_freq,
		   wpa_s->roc_waiting_drv_freq);
	wpabuf_free(wpa_s->pending_action_tx);
	wpa_s->pending_action_tx = NULL;
	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX &&
	    (wpa_s->action_tx_wait_time || wpa_s->action_tx_wait_time_used))
		wpa_drv_send_action_cancel_wait(wpa_s);
	else if (wpa_s->off_channel_freq || wpa_s->roc_waiting_drv_freq) {
		wpa_drv_cancel_remain_on_channel(wpa_s);
		wpa_s->off_channel_freq = 0;
		wpa_s->roc_waiting_drv_freq = 0;
	}
	wpa_s->action_tx_wait_time_used = 0;
}


/**
 * offchannel_remain_on_channel_cb - Remain-on-channel callback function
 * @wpa_s: Pointer to wpa_supplicant data
 * @freq: Frequency (in MHz) of the selected channel
 * @duration: Duration of the remain-on-channel operation in milliseconds
 *
 * This function is called whenever the driver notifies beginning of a
 * remain-on-channel operation.
 */
void offchannel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
				     unsigned int freq, unsigned int duration)
{
	wpa_s->roc_waiting_drv_freq = 0;
	wpa_s->off_channel_freq = freq;
	wpas_send_action_cb(wpa_s, NULL);
}


/**
 * offchannel_cancel_remain_on_channel_cb - Remain-on-channel stopped callback
 * @wpa_s: Pointer to wpa_supplicant data
 * @freq: Frequency (in MHz) of the selected channel
 *
 * This function is called whenever the driver notifies termination of a
 * remain-on-channel operation.
 */
void offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
					    unsigned int freq)
{
	wpa_s->off_channel_freq = 0;
}


/**
 * offchannel_pending_action_tx - Check whether there is a pending Action TX
 * @wpa_s: Pointer to wpa_supplicant data
 * Returns: Pointer to pending frame or %NULL if no pending operation
 *
 * This function can be used to check whether there is a pending Action frame TX
 * operation. The returned pointer should be used only for checking whether it
 * is %NULL (no pending frame) or to print the pointer value in debug
 * information (i.e., the pointer should not be dereferenced).
 */
const void * offchannel_pending_action_tx(struct wpa_supplicant *wpa_s)
{
	return wpa_s->pending_action_tx;
}


/**
 * offchannel_clear_pending_action_tx - Clear pending Action frame TX
 * @wpa_s: Pointer to wpa_supplicant data
 */
void offchannel_clear_pending_action_tx(struct wpa_supplicant *wpa_s)
{
	wpa_printf(MSG_DEBUG,
		   "Off-channel: Clear pending Action frame TX (pending_action_tx=%p",
		   wpa_s->pending_action_tx);
	wpabuf_free(wpa_s->pending_action_tx);
	wpa_s->pending_action_tx = NULL;
}


/**
 * offchannel_deinit - Deinit off-channel operations
 * @wpa_s: Pointer to wpa_supplicant data
 *
 * This function is used to free up any allocated resources for off-channel
 * operations.
 */
void offchannel_deinit(struct wpa_supplicant *wpa_s)
{
	offchannel_clear_pending_action_tx(wpa_s);
	eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
}
Commit	Line	Data
24f6497c JM	1	/*
	2	* wpa_supplicant - Off-channel Action frame TX/RX
	3	* Copyright (c) 2009-2010, Atheros Communications
	4	* Copyright (c) 2011, Qualcomm Atheros
	5	*
e22d4d95 JM	6	* This software may be distributed under the terms of the BSD license.
e22d4d95 JM	7	* See README for more details.
24f6497c JM	8	*/
	9
	10	#include "includes.h"
	11
	12	#include "common.h"
	13	#include "utils/eloop.h"
	14	#include "wpa_supplicant_i.h"
49e1e9ca	15	#include "p2p_supplicant.h"
24f6497c JM	16	#include "driver_i.h"
	17	#include "offchannel.h"
	18
	19
	20
	21	static struct wpa_supplicant *
	22	wpas_get_tx_interface(struct wpa_supplicant wpa_s, const u8 src)
	23	{
	24	struct wpa_supplicant *iface;
	25
a26c9c2e LD	26	if (os_memcmp(src, wpa_s->own_addr, ETH_ALEN) == 0) {
	27	#ifdef CONFIG_P2P
	28	if (wpa_s->p2p_mgmt && wpa_s != wpa_s->parent &&
	29	wpa_s->parent->ap_iface &&
	30	os_memcmp(wpa_s->parent->own_addr,
	31	wpa_s->own_addr, ETH_ALEN) == 0 &&
	32	wpabuf_len(wpa_s->pending_action_tx) >= 2 &&
	33	*wpabuf_head_u8(wpa_s->pending_action_tx) !=
	34	WLAN_ACTION_PUBLIC) {
	35	/*
	36	* When P2P Device interface has same MAC address as
	37	* the GO interface, make sure non-Public Action frames
	38	* are sent through the GO interface. The P2P Device
	39	* interface can only send Public Action frames.
	40	*/
	41	wpa_printf(MSG_DEBUG,
	42	"P2P: Use GO interface %s instead of interface %s for Action TX",
	43	wpa_s->parent->ifname, wpa_s->ifname);
	44	return wpa_s->parent;
	45	}
	46	#endif /* CONFIG_P2P */
24f6497c	47	return wpa_s;
a26c9c2e	48	}
24f6497c JM	49
	50	/*
	51	* Try to find a group interface that matches with the source address.
	52	*/
	53	iface = wpa_s->global->ifaces;
	54	while (iface) {
8e3afd7f	55	if (os_memcmp(src, iface->own_addr, ETH_ALEN) == 0)
24f6497c JM	56	break;
	57	iface = iface->next;
	58	}
	59	if (iface) {
	60	wpa_printf(MSG_DEBUG, "P2P: Use group interface %s "
	61	"instead of interface %s for Action TX",
	62	iface->ifname, wpa_s->ifname);
	63	return iface;
	64	}
	65
	66	return wpa_s;
	67	}
	68
	69
	70	static void wpas_send_action_cb(void eloop_ctx, void timeout_ctx)
	71	{
	72	struct wpa_supplicant *wpa_s = eloop_ctx;
	73	struct wpa_supplicant *iface;
	74	int res;
	75	int without_roc;
	76
	77	without_roc = wpa_s->pending_action_without_roc;
	78	wpa_s->pending_action_without_roc = 0;
d4b951f3 JM	79	wpa_printf(MSG_DEBUG,
	80	"Off-channel: Send Action callback (without_roc=%d pending_action_tx=%p pending_action_tx_done=%d)",
	81	without_roc, wpa_s->pending_action_tx,
	82	!!wpa_s->pending_action_tx_done);
24f6497c	83
d4b951f3	84	if (wpa_s->pending_action_tx == NULL \|\| wpa_s->pending_action_tx_done)
24f6497c JM	85	return;
	86
	87	/*
	88	* This call is likely going to be on the P2P device instance if the
	89	* driver uses a separate interface for that purpose. However, some
	90	* Action frames are actually sent within a P2P Group and when that is
	91	* the case, we need to follow power saving (e.g., GO buffering the
	92	* frame for a client in PS mode or a client following the advertised
	93	* NoA from its GO). To make that easier for the driver, select the
	94	* correct group interface here.
	95	*/
	96	iface = wpas_get_tx_interface(wpa_s, wpa_s->pending_action_src);
	97
	98	if (wpa_s->off_channel_freq != wpa_s->pending_action_freq &&
	99	wpa_s->pending_action_freq != 0 &&
	100	wpa_s->pending_action_freq != iface->assoc_freq) {
	101	wpa_printf(MSG_DEBUG, "Off-channel: Pending Action frame TX "
	102	"waiting for another freq=%u (off_channel_freq=%u "
	103	"assoc_freq=%u)",
	104	wpa_s->pending_action_freq,
	105	wpa_s->off_channel_freq,
	106	iface->assoc_freq);
	107	if (without_roc && wpa_s->off_channel_freq == 0) {
1f94e4ee	108	unsigned int duration = 200;
24f6497c JM	109	/*
	110	* We may get here if wpas_send_action() found us to be
	111	* on the correct channel, but remain-on-channel cancel
	112	* event was received before getting here.
	113	*/
	114	wpa_printf(MSG_DEBUG, "Off-channel: Schedule "
	115	"remain-on-channel to send Action frame");
1f94e4ee JM	116	#ifdef CONFIG_TESTING_OPTIONS
	117	if (wpa_s->extra_roc_dur) {
	118	wpa_printf(MSG_DEBUG,
	119	"TESTING: Increase ROC duration %u -> %u",
	120	duration,
	121	duration + wpa_s->extra_roc_dur);
	122	duration += wpa_s->extra_roc_dur;
	123	}
	124	#endif /* CONFIG_TESTING_OPTIONS */
24f6497c	125	if (wpa_drv_remain_on_channel(
1f94e4ee JM	126	wpa_s, wpa_s->pending_action_freq,
1f94e4ee JM	127	duration) < 0) {
24f6497c JM	128	wpa_printf(MSG_DEBUG, "Off-channel: Failed to "
	129	"request driver to remain on "
	130	"channel (%u MHz) for Action Frame "
	131	"TX", wpa_s->pending_action_freq);
	132	} else {
	133	wpa_s->off_channel_freq = 0;
	134	wpa_s->roc_waiting_drv_freq =
	135	wpa_s->pending_action_freq;
	136	}
	137	}
	138	return;
	139	}
	140
	141	wpa_printf(MSG_DEBUG, "Off-channel: Sending pending Action frame to "
e699a7a9 JM	142	MACSTR " using interface %s (pending_action_tx=%p)",
	143	MAC2STR(wpa_s->pending_action_dst), iface->ifname,
	144	wpa_s->pending_action_tx);
24f6497c JM	145	res = wpa_drv_send_action(iface, wpa_s->pending_action_freq, 0,
	146	wpa_s->pending_action_dst,
	147	wpa_s->pending_action_src,
	148	wpa_s->pending_action_bssid,
	149	wpabuf_head(wpa_s->pending_action_tx),
b106173a JM	150	wpabuf_len(wpa_s->pending_action_tx),
b106173a JM	151	wpa_s->pending_action_no_cck);
24f6497c JM	152	if (res) {
	153	wpa_printf(MSG_DEBUG, "Off-channel: Failed to send the "
	154	"pending Action frame");
	155	/*
	156	* Use fake TX status event to allow state machines to
	157	* continue.
	158	*/
	159	offchannel_send_action_tx_status(
	160	wpa_s, wpa_s->pending_action_dst,
	161	wpabuf_head(wpa_s->pending_action_tx),
	162	wpabuf_len(wpa_s->pending_action_tx),
	163	OFFCHANNEL_SEND_ACTION_FAILED);
	164	}
	165	}
	166
	167
b4419c62 JM	168	/**
	169	* offchannel_send_action_tx_status - TX status callback
	170	* @wpa_s: Pointer to wpa_supplicant data
	171	* @dst: Destination MAC address of the transmitted Action frame
	172	* @data: Transmitted frame payload
	173	* @data_len: Length of @data in bytes
	174	* @result: TX status
	175	*
	176	* This function is called whenever the driver indicates a TX status event for
	177	* a frame sent by offchannel_send_action() using wpa_drv_send_action().
	178	*/
24f6497c JM	179	void offchannel_send_action_tx_status(
	180	struct wpa_supplicant wpa_s, const u8 dst, const u8 *data,
	181	size_t data_len, enum offchannel_send_action_result result)
	182	{
	183	if (wpa_s->pending_action_tx == NULL) {
	184	wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
	185	"no pending operation");
	186	return;
	187	}
	188
	189	if (os_memcmp(dst, wpa_s->pending_action_dst, ETH_ALEN) != 0) {
	190	wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
	191	"unknown destination address");
	192	return;
	193	}
	194
47d986e6 PLL	195	/* Accept report only if the contents of the frame matches */
	196	if (data_len - wpabuf_len(wpa_s->pending_action_tx) != 24 \|\|
	197	os_memcmp(data + 24, wpabuf_head(wpa_s->pending_action_tx),
	198	wpabuf_len(wpa_s->pending_action_tx)) != 0) {
	199	wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
	200	"mismatching contents with pending frame");
	201	wpa_hexdump(MSG_MSGDUMP, "TX status frame data",
	202	data, data_len);
	203	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
	204	wpa_s->pending_action_tx);
	205	return;
	206	}
	207
e699a7a9 JM	208	wpa_printf(MSG_DEBUG,
	209	"Off-channel: Delete matching pending action frame (dst="
	210	MACSTR " pending_action_tx=%p)", MAC2STR(dst),
	211	wpa_s->pending_action_tx);
	212	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
	213	wpa_s->pending_action_tx);
24f6497c JM	214	wpabuf_free(wpa_s->pending_action_tx);
	215	wpa_s->pending_action_tx = NULL;
	216
	217	wpa_printf(MSG_DEBUG, "Off-channel: TX status result=%d cb=%p",
	218	result, wpa_s->pending_action_tx_status_cb);
	219
	220	if (wpa_s->pending_action_tx_status_cb) {
	221	wpa_s->pending_action_tx_status_cb(
	222	wpa_s, wpa_s->pending_action_freq,
	223	wpa_s->pending_action_dst, wpa_s->pending_action_src,
	224	wpa_s->pending_action_bssid,
	225	data, data_len, result);
	226	}
49e1e9ca JJ	227
49e1e9ca JJ	228	#ifdef CONFIG_P2P
b7bb2c02	229	if (wpa_s->global->p2p_long_listen > 0) {
49e1e9ca JJ	230	/* Continue the listen */
49e1e9ca JJ	231	wpa_printf(MSG_DEBUG, "P2P: Continuing long Listen state");
b7bb2c02	232	wpas_p2p_listen_start(wpa_s, wpa_s->global->p2p_long_listen);
49e1e9ca JJ	233	}
49e1e9ca JJ	234	#endif /* CONFIG_P2P */
24f6497c JM	235	}
	236
	237
b4419c62 JM	238	/**
	239	* offchannel_send_action - Request off-channel Action frame TX
	240	* @wpa_s: Pointer to wpa_supplicant data
	241	* @freq: The frequency in MHz indicating the channel on which the frame is to
	242	* transmitted or 0 for the current channel (only if associated)
	243	* @dst: Action frame destination MAC address
	244	* @src: Action frame source MAC address
	245	* @bssid: Action frame BSSID
	246	* @buf: Frame to transmit starting from the Category field
	247	* @len: Length of @buf in bytes
	248	* @wait_time: Wait time for response in milliseconds
bc95d583	249	* @tx_cb: Callback function for indicating TX status or %NULL for no callback
b4419c62 JM	250	* @no_cck: Whether CCK rates are to be disallowed for TX rate selection
	251	* Returns: 0 on success or -1 on failure
	252	*
	253	* This function is used to request an Action frame to be transmitted on the
	254	* current operating channel or on another channel (off-channel). The actual
	255	* frame transmission will be delayed until the driver is ready on the specified
	256	* channel. The @wait_time parameter can be used to request the driver to remain
	257	* awake on the channel to wait for a response.
	258	*/
24f6497c JM	259	int offchannel_send_action(struct wpa_supplicant *wpa_s, unsigned int freq,
	260	const u8 dst, const u8 src, const u8 *bssid,
	261	const u8 *buf, size_t len, unsigned int wait_time,
	262	void (tx_cb)(struct wpa_supplicant wpa_s,
	263	unsigned int freq, const u8 *dst,
	264	const u8 src, const u8 bssid,
	265	const u8 *data, size_t data_len,
	266	enum offchannel_send_action_result
b106173a JM	267	result),
b106173a JM	268	int no_cck)
24f6497c JM	269	{
	270	wpa_printf(MSG_DEBUG, "Off-channel: Send action frame: freq=%d dst="
	271	MACSTR " src=" MACSTR " bssid=" MACSTR " len=%d",
	272	freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
	273	(int) len);
	274
	275	wpa_s->pending_action_tx_status_cb = tx_cb;
	276
	277	if (wpa_s->pending_action_tx) {
	278	wpa_printf(MSG_DEBUG, "Off-channel: Dropped pending Action "
e699a7a9 JM	279	"frame TX to " MACSTR " (pending_action_tx=%p)",
	280	MAC2STR(wpa_s->pending_action_dst),
	281	wpa_s->pending_action_tx);
	282	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
	283	wpa_s->pending_action_tx);
24f6497c JM	284	wpabuf_free(wpa_s->pending_action_tx);
24f6497c JM	285	}
d4b951f3	286	wpa_s->pending_action_tx_done = 0;
24f6497c JM	287	wpa_s->pending_action_tx = wpabuf_alloc(len);
	288	if (wpa_s->pending_action_tx == NULL) {
	289	wpa_printf(MSG_DEBUG, "Off-channel: Failed to allocate Action "
	290	"frame TX buffer (len=%llu)",
	291	(unsigned long long) len);
	292	return -1;
	293	}
	294	wpabuf_put_data(wpa_s->pending_action_tx, buf, len);
	295	os_memcpy(wpa_s->pending_action_src, src, ETH_ALEN);
	296	os_memcpy(wpa_s->pending_action_dst, dst, ETH_ALEN);
	297	os_memcpy(wpa_s->pending_action_bssid, bssid, ETH_ALEN);
	298	wpa_s->pending_action_freq = freq;
b106173a	299	wpa_s->pending_action_no_cck = no_cck;
e699a7a9 JM	300	wpa_printf(MSG_DEBUG,
	301	"Off-channel: Stored pending action frame (dst=" MACSTR
	302	" pending_action_tx=%p)",
	303	MAC2STR(dst), wpa_s->pending_action_tx);
	304	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
	305	wpa_s->pending_action_tx);
24f6497c JM	306
	307	if (freq != 0 && wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) {
	308	struct wpa_supplicant *iface;
d4b951f3	309	int ret;
24f6497c	310
8e3afd7f	311	iface = wpas_get_tx_interface(wpa_s, src);
24f6497c	312	wpa_s->action_tx_wait_time = wait_time;
d4d76d98 JM	313	if (wait_time)
d4d76d98 JM	314	wpa_s->action_tx_wait_time_used = 1;
24f6497c	315
d4b951f3	316	ret = wpa_drv_send_action(
b106173a JM	317	iface, wpa_s->pending_action_freq,
	318	wait_time, wpa_s->pending_action_dst,
	319	wpa_s->pending_action_src, wpa_s->pending_action_bssid,
	320	wpabuf_head(wpa_s->pending_action_tx),
	321	wpabuf_len(wpa_s->pending_action_tx),
	322	wpa_s->pending_action_no_cck);
d4b951f3 JM	323	if (ret == 0)
	324	wpa_s->pending_action_tx_done = 1;
	325	return ret;
24f6497c JM	326	}
	327
	328	if (freq) {
	329	struct wpa_supplicant *tx_iface;
	330	tx_iface = wpas_get_tx_interface(wpa_s, src);
	331	if (tx_iface->assoc_freq == freq) {
	332	wpa_printf(MSG_DEBUG, "Off-channel: Already on "
	333	"requested channel (TX interface operating "
	334	"channel)");
	335	freq = 0;
	336	}
	337	}
	338
	339	if (wpa_s->off_channel_freq == freq \|\| freq == 0) {
	340	wpa_printf(MSG_DEBUG, "Off-channel: Already on requested "
	341	"channel; send Action frame immediately");
	342	/* TODO: Would there ever be need to extend the current
	343	* duration on the channel? */
	344	wpa_s->pending_action_without_roc = 1;
	345	eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
	346	eloop_register_timeout(0, 0, wpas_send_action_cb, wpa_s, NULL);
	347	return 0;
	348	}
	349	wpa_s->pending_action_without_roc = 0;
	350
	351	if (wpa_s->roc_waiting_drv_freq == freq) {
	352	wpa_printf(MSG_DEBUG, "Off-channel: Already waiting for "
	353	"driver to get to frequency %u MHz; continue "
	354	"waiting to send the Action frame", freq);
	355	return 0;
	356	}
	357
	358	wpa_printf(MSG_DEBUG, "Off-channel: Schedule Action frame to be "
	359	"transmitted once the driver gets to the requested "
	360	"channel");
	361	if (wait_time > wpa_s->max_remain_on_chan)
	362	wait_time = wpa_s->max_remain_on_chan;
a2ea8d64 WJL	363	else if (wait_time == 0)
a2ea8d64 WJL	364	wait_time = 20;
1f94e4ee JM	365	#ifdef CONFIG_TESTING_OPTIONS
	366	if (wpa_s->extra_roc_dur) {
	367	wpa_printf(MSG_DEBUG, "TESTING: Increase ROC duration %u -> %u",
	368	wait_time, wait_time + wpa_s->extra_roc_dur);
	369	wait_time += wpa_s->extra_roc_dur;
	370	}
	371	#endif /* CONFIG_TESTING_OPTIONS */
24f6497c JM	372	if (wpa_drv_remain_on_channel(wpa_s, freq, wait_time) < 0) {
	373	wpa_printf(MSG_DEBUG, "Off-channel: Failed to request driver "
	374	"to remain on channel (%u MHz) for Action "
	375	"Frame TX", freq);
	376	return -1;
	377	}
	378	wpa_s->off_channel_freq = 0;
	379	wpa_s->roc_waiting_drv_freq = freq;
	380
	381	return 0;
	382	}
	383
	384
b4419c62 JM	385	/**
	386	* offchannel_send_send_action_done - Notify completion of Action frame sequence
	387	* @wpa_s: Pointer to wpa_supplicant data
	388	*
	389	* This function can be used to cancel a wait for additional response frames on
	390	* the channel that was used with offchannel_send_action().
	391	*/
24f6497c JM	392	void offchannel_send_action_done(struct wpa_supplicant *wpa_s)
24f6497c JM	393	{
66eaf8a2 JM	394	wpa_printf(MSG_DEBUG,
	395	"Off-channel: Action frame sequence done notification: pending_action_tx=%p drv_offchan_tx=%d action_tx_wait_time=%d off_channel_freq=%d roc_waiting_drv_freq=%d",
	396	wpa_s->pending_action_tx,
	397	!!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX),
	398	wpa_s->action_tx_wait_time, wpa_s->off_channel_freq,
	399	wpa_s->roc_waiting_drv_freq);
24f6497c JM	400	wpabuf_free(wpa_s->pending_action_tx);
	401	wpa_s->pending_action_tx = NULL;
	402	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX &&
d4d76d98	403	(wpa_s->action_tx_wait_time \|\| wpa_s->action_tx_wait_time_used))
24f6497c	404	wpa_drv_send_action_cancel_wait(wpa_s);
66eaf8a2	405	else if (wpa_s->off_channel_freq \|\| wpa_s->roc_waiting_drv_freq) {
24f6497c JM	406	wpa_drv_cancel_remain_on_channel(wpa_s);
	407	wpa_s->off_channel_freq = 0;
	408	wpa_s->roc_waiting_drv_freq = 0;
	409	}
d4d76d98	410	wpa_s->action_tx_wait_time_used = 0;
24f6497c JM	411	}
	412
	413
b4419c62 JM	414	/**
	415	* offchannel_remain_on_channel_cb - Remain-on-channel callback function
	416	* @wpa_s: Pointer to wpa_supplicant data
	417	* @freq: Frequency (in MHz) of the selected channel
	418	* @duration: Duration of the remain-on-channel operation in milliseconds
	419	*
	420	* This function is called whenever the driver notifies beginning of a
	421	* remain-on-channel operation.
	422	*/
24f6497c JM	423	void offchannel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
	424	unsigned int freq, unsigned int duration)
	425	{
	426	wpa_s->roc_waiting_drv_freq = 0;
	427	wpa_s->off_channel_freq = freq;
	428	wpas_send_action_cb(wpa_s, NULL);
	429	}
	430
	431
b4419c62 JM	432	/**
	433	* offchannel_cancel_remain_on_channel_cb - Remain-on-channel stopped callback
	434	* @wpa_s: Pointer to wpa_supplicant data
	435	* @freq: Frequency (in MHz) of the selected channel
	436	*
	437	* This function is called whenever the driver notifies termination of a
	438	* remain-on-channel operation.
	439	*/
24f6497c JM	440	void offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
	441	unsigned int freq)
	442	{
	443	wpa_s->off_channel_freq = 0;
	444	}
	445
	446
2f3101d8 JM	447	/**
	448	* offchannel_pending_action_tx - Check whether there is a pending Action TX
	449	* @wpa_s: Pointer to wpa_supplicant data
	450	* Returns: Pointer to pending frame or %NULL if no pending operation
	451	*
	452	* This function can be used to check whether there is a pending Action frame TX
	453	* operation. The returned pointer should be used only for checking whether it
	454	* is %NULL (no pending frame) or to print the pointer value in debug
	455	* information (i.e., the pointer should not be dereferenced).
	456	*/
	457	const void * offchannel_pending_action_tx(struct wpa_supplicant *wpa_s)
	458	{
	459	return wpa_s->pending_action_tx;
	460	}
	461
	462
	463	/**
	464	* offchannel_clear_pending_action_tx - Clear pending Action frame TX
	465	* @wpa_s: Pointer to wpa_supplicant data
	466	*/
	467	void offchannel_clear_pending_action_tx(struct wpa_supplicant *wpa_s)
	468	{
e699a7a9 JM	469	wpa_printf(MSG_DEBUG,
	470	"Off-channel: Clear pending Action frame TX (pending_action_tx=%p",
	471	wpa_s->pending_action_tx);
2f3101d8 JM	472	wpabuf_free(wpa_s->pending_action_tx);
	473	wpa_s->pending_action_tx = NULL;
	474	}
	475
	476
b4419c62 JM	477	/**
	478	* offchannel_deinit - Deinit off-channel operations
	479	* @wpa_s: Pointer to wpa_supplicant data
	480	*
	481	* This function is used to free up any allocated resources for off-channel
	482	* operations.
	483	*/
24f6497c JM	484	void offchannel_deinit(struct wpa_supplicant *wpa_s)
24f6497c JM	485	{
2f3101d8	486	offchannel_clear_pending_action_tx(wpa_s);
24f6497c JM	487	eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
24f6497c JM	488	}