2 * wpa_supplicant - Off-channel Action frame TX/RX
3 * Copyright (c) 2009-2010, Atheros Communications
4 * Copyright (c) 2011, Qualcomm Atheros
6 * This software may be distributed under the terms of the BSD license.
7 * See README for more details.
13 #include "utils/eloop.h"
14 #include "wpa_supplicant_i.h"
15 #include "p2p_supplicant.h"
17 #include "offchannel.h"
21 static struct wpa_supplicant
*
22 wpas_get_tx_interface(struct wpa_supplicant
*wpa_s
, const u8
*src
)
24 struct wpa_supplicant
*iface
;
26 if (os_memcmp(src
, wpa_s
->own_addr
, ETH_ALEN
) == 0) {
28 if (wpa_s
->p2p_mgmt
&& wpa_s
!= wpa_s
->parent
&&
29 wpa_s
->parent
->ap_iface
&&
30 os_memcmp(wpa_s
->parent
->own_addr
,
31 wpa_s
->own_addr
, ETH_ALEN
) == 0 &&
32 wpabuf_len(wpa_s
->pending_action_tx
) >= 2 &&
33 *wpabuf_head_u8(wpa_s
->pending_action_tx
) !=
36 * When P2P Device interface has same MAC address as
37 * the GO interface, make sure non-Public Action frames
38 * are sent through the GO interface. The P2P Device
39 * interface can only send Public Action frames.
42 "P2P: Use GO interface %s instead of interface %s for Action TX",
43 wpa_s
->parent
->ifname
, wpa_s
->ifname
);
46 #endif /* CONFIG_P2P */
51 * Try to find a group interface that matches with the source address.
53 iface
= wpa_s
->global
->ifaces
;
55 if (os_memcmp(src
, iface
->own_addr
, ETH_ALEN
) == 0)
60 wpa_printf(MSG_DEBUG
, "P2P: Use group interface %s "
61 "instead of interface %s for Action TX",
62 iface
->ifname
, wpa_s
->ifname
);
70 static void wpas_send_action_cb(void *eloop_ctx
, void *timeout_ctx
)
72 struct wpa_supplicant
*wpa_s
= eloop_ctx
;
73 struct wpa_supplicant
*iface
;
77 without_roc
= wpa_s
->pending_action_without_roc
;
78 wpa_s
->pending_action_without_roc
= 0;
80 "Off-channel: Send Action callback (without_roc=%d pending_action_tx=%p pending_action_tx_done=%d)",
81 without_roc
, wpa_s
->pending_action_tx
,
82 !!wpa_s
->pending_action_tx_done
);
84 if (wpa_s
->pending_action_tx
== NULL
|| wpa_s
->pending_action_tx_done
)
88 * This call is likely going to be on the P2P device instance if the
89 * driver uses a separate interface for that purpose. However, some
90 * Action frames are actually sent within a P2P Group and when that is
91 * the case, we need to follow power saving (e.g., GO buffering the
92 * frame for a client in PS mode or a client following the advertised
93 * NoA from its GO). To make that easier for the driver, select the
94 * correct group interface here.
96 iface
= wpas_get_tx_interface(wpa_s
, wpa_s
->pending_action_src
);
98 if (wpa_s
->off_channel_freq
!= wpa_s
->pending_action_freq
&&
99 wpa_s
->pending_action_freq
!= 0 &&
100 wpa_s
->pending_action_freq
!= iface
->assoc_freq
) {
101 wpa_printf(MSG_DEBUG
, "Off-channel: Pending Action frame TX "
102 "waiting for another freq=%u (off_channel_freq=%u "
104 wpa_s
->pending_action_freq
,
105 wpa_s
->off_channel_freq
,
107 if (without_roc
&& wpa_s
->off_channel_freq
== 0) {
108 unsigned int duration
= 200;
110 * We may get here if wpas_send_action() found us to be
111 * on the correct channel, but remain-on-channel cancel
112 * event was received before getting here.
114 wpa_printf(MSG_DEBUG
, "Off-channel: Schedule "
115 "remain-on-channel to send Action frame");
116 #ifdef CONFIG_TESTING_OPTIONS
117 if (wpa_s
->extra_roc_dur
) {
118 wpa_printf(MSG_DEBUG
,
119 "TESTING: Increase ROC duration %u -> %u",
121 duration
+ wpa_s
->extra_roc_dur
);
122 duration
+= wpa_s
->extra_roc_dur
;
124 #endif /* CONFIG_TESTING_OPTIONS */
125 if (wpa_drv_remain_on_channel(
126 wpa_s
, wpa_s
->pending_action_freq
,
128 wpa_printf(MSG_DEBUG
, "Off-channel: Failed to "
129 "request driver to remain on "
130 "channel (%u MHz) for Action Frame "
131 "TX", wpa_s
->pending_action_freq
);
133 wpa_s
->off_channel_freq
= 0;
134 wpa_s
->roc_waiting_drv_freq
=
135 wpa_s
->pending_action_freq
;
141 wpa_printf(MSG_DEBUG
, "Off-channel: Sending pending Action frame to "
142 MACSTR
" using interface %s (pending_action_tx=%p)",
143 MAC2STR(wpa_s
->pending_action_dst
), iface
->ifname
,
144 wpa_s
->pending_action_tx
);
145 res
= wpa_drv_send_action(iface
, wpa_s
->pending_action_freq
, 0,
146 wpa_s
->pending_action_dst
,
147 wpa_s
->pending_action_src
,
148 wpa_s
->pending_action_bssid
,
149 wpabuf_head(wpa_s
->pending_action_tx
),
150 wpabuf_len(wpa_s
->pending_action_tx
),
151 wpa_s
->pending_action_no_cck
);
153 wpa_printf(MSG_DEBUG
, "Off-channel: Failed to send the "
154 "pending Action frame");
156 * Use fake TX status event to allow state machines to
159 offchannel_send_action_tx_status(
160 wpa_s
, wpa_s
->pending_action_dst
,
161 wpabuf_head(wpa_s
->pending_action_tx
),
162 wpabuf_len(wpa_s
->pending_action_tx
),
163 OFFCHANNEL_SEND_ACTION_FAILED
);
169 * offchannel_send_action_tx_status - TX status callback
170 * @wpa_s: Pointer to wpa_supplicant data
171 * @dst: Destination MAC address of the transmitted Action frame
172 * @data: Transmitted frame payload
173 * @data_len: Length of @data in bytes
176 * This function is called whenever the driver indicates a TX status event for
177 * a frame sent by offchannel_send_action() using wpa_drv_send_action().
179 void offchannel_send_action_tx_status(
180 struct wpa_supplicant
*wpa_s
, const u8
*dst
, const u8
*data
,
181 size_t data_len
, enum offchannel_send_action_result result
)
183 if (wpa_s
->pending_action_tx
== NULL
) {
184 wpa_printf(MSG_DEBUG
, "Off-channel: Ignore Action TX status - "
185 "no pending operation");
189 if (os_memcmp(dst
, wpa_s
->pending_action_dst
, ETH_ALEN
) != 0) {
190 wpa_printf(MSG_DEBUG
, "Off-channel: Ignore Action TX status - "
191 "unknown destination address");
195 /* Accept report only if the contents of the frame matches */
196 if (data_len
- wpabuf_len(wpa_s
->pending_action_tx
) != 24 ||
197 os_memcmp(data
+ 24, wpabuf_head(wpa_s
->pending_action_tx
),
198 wpabuf_len(wpa_s
->pending_action_tx
)) != 0) {
199 wpa_printf(MSG_DEBUG
, "Off-channel: Ignore Action TX status - "
200 "mismatching contents with pending frame");
201 wpa_hexdump(MSG_MSGDUMP
, "TX status frame data",
203 wpa_hexdump_buf(MSG_MSGDUMP
, "Pending TX frame",
204 wpa_s
->pending_action_tx
);
208 wpa_printf(MSG_DEBUG
,
209 "Off-channel: Delete matching pending action frame (dst="
210 MACSTR
" pending_action_tx=%p)", MAC2STR(dst
),
211 wpa_s
->pending_action_tx
);
212 wpa_hexdump_buf(MSG_MSGDUMP
, "Pending TX frame",
213 wpa_s
->pending_action_tx
);
214 wpabuf_free(wpa_s
->pending_action_tx
);
215 wpa_s
->pending_action_tx
= NULL
;
217 wpa_printf(MSG_DEBUG
, "Off-channel: TX status result=%d cb=%p",
218 result
, wpa_s
->pending_action_tx_status_cb
);
220 if (wpa_s
->pending_action_tx_status_cb
) {
221 wpa_s
->pending_action_tx_status_cb(
222 wpa_s
, wpa_s
->pending_action_freq
,
223 wpa_s
->pending_action_dst
, wpa_s
->pending_action_src
,
224 wpa_s
->pending_action_bssid
,
225 data
, data_len
, result
);
229 if (wpa_s
->p2p_long_listen
> 0) {
230 /* Continue the listen */
231 wpa_printf(MSG_DEBUG
, "P2P: Continuing long Listen state");
232 wpas_p2p_listen_start(wpa_s
, wpa_s
->p2p_long_listen
);
234 #endif /* CONFIG_P2P */
239 * offchannel_send_action - Request off-channel Action frame TX
240 * @wpa_s: Pointer to wpa_supplicant data
241 * @freq: The frequency in MHz indicating the channel on which the frame is to
242 * transmitted or 0 for the current channel (only if associated)
243 * @dst: Action frame destination MAC address
244 * @src: Action frame source MAC address
245 * @bssid: Action frame BSSID
246 * @buf: Frame to transmit starting from the Category field
247 * @len: Length of @buf in bytes
248 * @wait_time: Wait time for response in milliseconds
249 * @tx_cb: Callback function for indicating TX status or %NULL for now callback
250 * @no_cck: Whether CCK rates are to be disallowed for TX rate selection
251 * Returns: 0 on success or -1 on failure
253 * This function is used to request an Action frame to be transmitted on the
254 * current operating channel or on another channel (off-channel). The actual
255 * frame transmission will be delayed until the driver is ready on the specified
256 * channel. The @wait_time parameter can be used to request the driver to remain
257 * awake on the channel to wait for a response.
259 int offchannel_send_action(struct wpa_supplicant
*wpa_s
, unsigned int freq
,
260 const u8
*dst
, const u8
*src
, const u8
*bssid
,
261 const u8
*buf
, size_t len
, unsigned int wait_time
,
262 void (*tx_cb
)(struct wpa_supplicant
*wpa_s
,
263 unsigned int freq
, const u8
*dst
,
264 const u8
*src
, const u8
*bssid
,
265 const u8
*data
, size_t data_len
,
266 enum offchannel_send_action_result
270 wpa_printf(MSG_DEBUG
, "Off-channel: Send action frame: freq=%d dst="
271 MACSTR
" src=" MACSTR
" bssid=" MACSTR
" len=%d",
272 freq
, MAC2STR(dst
), MAC2STR(src
), MAC2STR(bssid
),
275 wpa_s
->pending_action_tx_status_cb
= tx_cb
;
277 if (wpa_s
->pending_action_tx
) {
278 wpa_printf(MSG_DEBUG
, "Off-channel: Dropped pending Action "
279 "frame TX to " MACSTR
" (pending_action_tx=%p)",
280 MAC2STR(wpa_s
->pending_action_dst
),
281 wpa_s
->pending_action_tx
);
282 wpa_hexdump_buf(MSG_MSGDUMP
, "Pending TX frame",
283 wpa_s
->pending_action_tx
);
284 wpabuf_free(wpa_s
->pending_action_tx
);
286 wpa_s
->pending_action_tx_done
= 0;
287 wpa_s
->pending_action_tx
= wpabuf_alloc(len
);
288 if (wpa_s
->pending_action_tx
== NULL
) {
289 wpa_printf(MSG_DEBUG
, "Off-channel: Failed to allocate Action "
290 "frame TX buffer (len=%llu)",
291 (unsigned long long) len
);
294 wpabuf_put_data(wpa_s
->pending_action_tx
, buf
, len
);
295 os_memcpy(wpa_s
->pending_action_src
, src
, ETH_ALEN
);
296 os_memcpy(wpa_s
->pending_action_dst
, dst
, ETH_ALEN
);
297 os_memcpy(wpa_s
->pending_action_bssid
, bssid
, ETH_ALEN
);
298 wpa_s
->pending_action_freq
= freq
;
299 wpa_s
->pending_action_no_cck
= no_cck
;
300 wpa_printf(MSG_DEBUG
,
301 "Off-channel: Stored pending action frame (dst=" MACSTR
302 " pending_action_tx=%p)",
303 MAC2STR(dst
), wpa_s
->pending_action_tx
);
304 wpa_hexdump_buf(MSG_MSGDUMP
, "Pending TX frame",
305 wpa_s
->pending_action_tx
);
307 if (freq
!= 0 && wpa_s
->drv_flags
& WPA_DRIVER_FLAGS_OFFCHANNEL_TX
) {
308 struct wpa_supplicant
*iface
;
311 iface
= wpas_get_tx_interface(wpa_s
, src
);
312 wpa_s
->action_tx_wait_time
= wait_time
;
314 wpa_s
->action_tx_wait_time_used
= 1;
316 ret
= wpa_drv_send_action(
317 iface
, wpa_s
->pending_action_freq
,
318 wait_time
, wpa_s
->pending_action_dst
,
319 wpa_s
->pending_action_src
, wpa_s
->pending_action_bssid
,
320 wpabuf_head(wpa_s
->pending_action_tx
),
321 wpabuf_len(wpa_s
->pending_action_tx
),
322 wpa_s
->pending_action_no_cck
);
324 wpa_s
->pending_action_tx_done
= 1;
329 struct wpa_supplicant
*tx_iface
;
330 tx_iface
= wpas_get_tx_interface(wpa_s
, src
);
331 if (tx_iface
->assoc_freq
== freq
) {
332 wpa_printf(MSG_DEBUG
, "Off-channel: Already on "
333 "requested channel (TX interface operating "
339 if (wpa_s
->off_channel_freq
== freq
|| freq
== 0) {
340 wpa_printf(MSG_DEBUG
, "Off-channel: Already on requested "
341 "channel; send Action frame immediately");
342 /* TODO: Would there ever be need to extend the current
343 * duration on the channel? */
344 wpa_s
->pending_action_without_roc
= 1;
345 eloop_cancel_timeout(wpas_send_action_cb
, wpa_s
, NULL
);
346 eloop_register_timeout(0, 0, wpas_send_action_cb
, wpa_s
, NULL
);
349 wpa_s
->pending_action_without_roc
= 0;
351 if (wpa_s
->roc_waiting_drv_freq
== freq
) {
352 wpa_printf(MSG_DEBUG
, "Off-channel: Already waiting for "
353 "driver to get to frequency %u MHz; continue "
354 "waiting to send the Action frame", freq
);
358 wpa_printf(MSG_DEBUG
, "Off-channel: Schedule Action frame to be "
359 "transmitted once the driver gets to the requested "
361 if (wait_time
> wpa_s
->max_remain_on_chan
)
362 wait_time
= wpa_s
->max_remain_on_chan
;
363 else if (wait_time
== 0)
365 #ifdef CONFIG_TESTING_OPTIONS
366 if (wpa_s
->extra_roc_dur
) {
367 wpa_printf(MSG_DEBUG
, "TESTING: Increase ROC duration %u -> %u",
368 wait_time
, wait_time
+ wpa_s
->extra_roc_dur
);
369 wait_time
+= wpa_s
->extra_roc_dur
;
371 #endif /* CONFIG_TESTING_OPTIONS */
372 if (wpa_drv_remain_on_channel(wpa_s
, freq
, wait_time
) < 0) {
373 wpa_printf(MSG_DEBUG
, "Off-channel: Failed to request driver "
374 "to remain on channel (%u MHz) for Action "
378 wpa_s
->off_channel_freq
= 0;
379 wpa_s
->roc_waiting_drv_freq
= freq
;
386 * offchannel_send_send_action_done - Notify completion of Action frame sequence
387 * @wpa_s: Pointer to wpa_supplicant data
389 * This function can be used to cancel a wait for additional response frames on
390 * the channel that was used with offchannel_send_action().
392 void offchannel_send_action_done(struct wpa_supplicant
*wpa_s
)
394 wpa_printf(MSG_DEBUG
,
395 "Off-channel: Action frame sequence done notification: pending_action_tx=%p drv_offchan_tx=%d action_tx_wait_time=%d off_channel_freq=%d roc_waiting_drv_freq=%d",
396 wpa_s
->pending_action_tx
,
397 !!(wpa_s
->drv_flags
& WPA_DRIVER_FLAGS_OFFCHANNEL_TX
),
398 wpa_s
->action_tx_wait_time
, wpa_s
->off_channel_freq
,
399 wpa_s
->roc_waiting_drv_freq
);
400 wpabuf_free(wpa_s
->pending_action_tx
);
401 wpa_s
->pending_action_tx
= NULL
;
402 if (wpa_s
->drv_flags
& WPA_DRIVER_FLAGS_OFFCHANNEL_TX
&&
403 (wpa_s
->action_tx_wait_time
|| wpa_s
->action_tx_wait_time_used
))
404 wpa_drv_send_action_cancel_wait(wpa_s
);
405 else if (wpa_s
->off_channel_freq
|| wpa_s
->roc_waiting_drv_freq
) {
406 wpa_drv_cancel_remain_on_channel(wpa_s
);
407 wpa_s
->off_channel_freq
= 0;
408 wpa_s
->roc_waiting_drv_freq
= 0;
410 wpa_s
->action_tx_wait_time_used
= 0;
415 * offchannel_remain_on_channel_cb - Remain-on-channel callback function
416 * @wpa_s: Pointer to wpa_supplicant data
417 * @freq: Frequency (in MHz) of the selected channel
418 * @duration: Duration of the remain-on-channel operation in milliseconds
420 * This function is called whenever the driver notifies beginning of a
421 * remain-on-channel operation.
423 void offchannel_remain_on_channel_cb(struct wpa_supplicant
*wpa_s
,
424 unsigned int freq
, unsigned int duration
)
426 wpa_s
->roc_waiting_drv_freq
= 0;
427 wpa_s
->off_channel_freq
= freq
;
428 wpas_send_action_cb(wpa_s
, NULL
);
433 * offchannel_cancel_remain_on_channel_cb - Remain-on-channel stopped callback
434 * @wpa_s: Pointer to wpa_supplicant data
435 * @freq: Frequency (in MHz) of the selected channel
437 * This function is called whenever the driver notifies termination of a
438 * remain-on-channel operation.
440 void offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant
*wpa_s
,
443 wpa_s
->off_channel_freq
= 0;
448 * offchannel_pending_action_tx - Check whether there is a pending Action TX
449 * @wpa_s: Pointer to wpa_supplicant data
450 * Returns: Pointer to pending frame or %NULL if no pending operation
452 * This function can be used to check whether there is a pending Action frame TX
453 * operation. The returned pointer should be used only for checking whether it
454 * is %NULL (no pending frame) or to print the pointer value in debug
455 * information (i.e., the pointer should not be dereferenced).
457 const void * offchannel_pending_action_tx(struct wpa_supplicant
*wpa_s
)
459 return wpa_s
->pending_action_tx
;
464 * offchannel_clear_pending_action_tx - Clear pending Action frame TX
465 * @wpa_s: Pointer to wpa_supplicant data
467 void offchannel_clear_pending_action_tx(struct wpa_supplicant
*wpa_s
)
469 wpa_printf(MSG_DEBUG
,
470 "Off-channel: Clear pending Action frame TX (pending_action_tx=%p",
471 wpa_s
->pending_action_tx
);
472 wpabuf_free(wpa_s
->pending_action_tx
);
473 wpa_s
->pending_action_tx
= NULL
;
478 * offchannel_deinit - Deinit off-channel operations
479 * @wpa_s: Pointer to wpa_supplicant data
481 * This function is used to free up any allocated resources for off-channel
484 void offchannel_deinit(struct wpa_supplicant
*wpa_s
)
486 offchannel_clear_pending_action_tx(wpa_s
);
487 eloop_cancel_timeout(wpas_send_action_cb
, wpa_s
, NULL
);