1/* 2 * wpa_supplicant - Off-channel Action frame TX/RX 3 * Copyright (c) 2009-2010, Atheros Communications 4 * Copyright (c) 2011, Qualcomm Atheros 5 * 6 * This software may be distributed under the terms of the BSD license. 7 * See README for more details. 8 */ 9 10#include "includes.h" 11 12#include "common.h" 13#include "utils/eloop.h" 14#include "wpa_supplicant_i.h" 15#include "p2p_supplicant.h" 16#include "driver_i.h" 17#include "offchannel.h" 18 19 20 21static struct wpa_supplicant * 22wpas_get_tx_interface(struct wpa_supplicant *wpa_s, const u8 *src) 23{ 24 struct wpa_supplicant *iface; 25 26 if (os_memcmp(src, wpa_s->own_addr, ETH_ALEN) == 0) 27 return wpa_s; 28 29 /* 30 * Try to find a group interface that matches with the source address. 31 */ 32 iface = wpa_s->global->ifaces; 33 while (iface) { 34 if (os_memcmp(wpa_s->pending_action_src, 35 iface->own_addr, ETH_ALEN) == 0) 36 break; 37 iface = iface->next; 38 } 39 if (iface) { 40 wpa_printf(MSG_DEBUG, "P2P: Use group interface %s " 41 "instead of interface %s for Action TX", 42 iface->ifname, wpa_s->ifname); 43 return iface; 44 } 45 46 return wpa_s; 47} 48 49 50static void wpas_send_action_cb(void *eloop_ctx, void *timeout_ctx) 51{ 52 struct wpa_supplicant *wpa_s = eloop_ctx; 53 struct wpa_supplicant *iface; 54 int res; 55 int without_roc; 56 57 without_roc = wpa_s->pending_action_without_roc; 58 wpa_s->pending_action_without_roc = 0; 59 wpa_printf(MSG_DEBUG, 60 "Off-channel: Send Action callback (without_roc=%d pending_action_tx=%p pending_action_tx_done=%d)", 61 without_roc, wpa_s->pending_action_tx, 62 !!wpa_s->pending_action_tx_done); 63 64 if (wpa_s->pending_action_tx == NULL || wpa_s->pending_action_tx_done) 65 return; 66 67 /* 68 * This call is likely going to be on the P2P device instance if the 69 * driver uses a separate interface for that purpose. However, some 70 * Action frames are actually sent within a P2P Group and when that is 71 * the case, we need to follow power saving (e.g., GO buffering the 72 * frame for a client in PS mode or a client following the advertised 73 * NoA from its GO). To make that easier for the driver, select the 74 * correct group interface here. 75 */ 76 iface = wpas_get_tx_interface(wpa_s, wpa_s->pending_action_src); 77 78 if (wpa_s->off_channel_freq != wpa_s->pending_action_freq && 79 wpa_s->pending_action_freq != 0 && 80 wpa_s->pending_action_freq != iface->assoc_freq) { 81 wpa_printf(MSG_DEBUG, "Off-channel: Pending Action frame TX " 82 "waiting for another freq=%u (off_channel_freq=%u " 83 "assoc_freq=%u)", 84 wpa_s->pending_action_freq, 85 wpa_s->off_channel_freq, 86 iface->assoc_freq); 87 if (without_roc && wpa_s->off_channel_freq == 0) { 88 /* 89 * We may get here if wpas_send_action() found us to be 90 * on the correct channel, but remain-on-channel cancel 91 * event was received before getting here. 92 */ 93 wpa_printf(MSG_DEBUG, "Off-channel: Schedule " 94 "remain-on-channel to send Action frame"); 95 if (wpa_drv_remain_on_channel( 96 wpa_s, wpa_s->pending_action_freq, 200) < 97 0) { 98 wpa_printf(MSG_DEBUG, "Off-channel: Failed to " 99 "request driver to remain on " 100 "channel (%u MHz) for Action Frame " 101 "TX", wpa_s->pending_action_freq); 102 } else { 103 wpa_s->off_channel_freq = 0; 104 wpa_s->roc_waiting_drv_freq = 105 wpa_s->pending_action_freq; 106 } 107 } 108 return; 109 } 110 111 wpa_printf(MSG_DEBUG, "Off-channel: Sending pending Action frame to " 112 MACSTR " using interface %s", 113 MAC2STR(wpa_s->pending_action_dst), iface->ifname); 114 res = wpa_drv_send_action(iface, wpa_s->pending_action_freq, 0, 115 wpa_s->pending_action_dst, 116 wpa_s->pending_action_src, 117 wpa_s->pending_action_bssid, 118 wpabuf_head(wpa_s->pending_action_tx), 119 wpabuf_len(wpa_s->pending_action_tx), 120 wpa_s->pending_action_no_cck); 121 if (res) { 122 wpa_printf(MSG_DEBUG, "Off-channel: Failed to send the " 123 "pending Action frame"); 124 /* 125 * Use fake TX status event to allow state machines to 126 * continue. 127 */ 128 offchannel_send_action_tx_status( 129 wpa_s, wpa_s->pending_action_dst, 130 wpabuf_head(wpa_s->pending_action_tx), 131 wpabuf_len(wpa_s->pending_action_tx), 132 OFFCHANNEL_SEND_ACTION_FAILED); 133 } 134} 135 136 137/** 138 * offchannel_send_action_tx_status - TX status callback 139 * @wpa_s: Pointer to wpa_supplicant data 140 * @dst: Destination MAC address of the transmitted Action frame 141 * @data: Transmitted frame payload 142 * @data_len: Length of @data in bytes 143 * @result: TX status 144 * 145 * This function is called whenever the driver indicates a TX status event for 146 * a frame sent by offchannel_send_action() using wpa_drv_send_action(). 147 */ 148void offchannel_send_action_tx_status( 149 struct wpa_supplicant *wpa_s, const u8 *dst, const u8 *data, 150 size_t data_len, enum offchannel_send_action_result result) 151{ 152 if (wpa_s->pending_action_tx == NULL) { 153 wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - " 154 "no pending operation"); 155 return; 156 } 157 158 if (os_memcmp(dst, wpa_s->pending_action_dst, ETH_ALEN) != 0) { 159 wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - " 160 "unknown destination address"); 161 return; 162 } 163 164 /* Accept report only if the contents of the frame matches */ 165 if (data_len - wpabuf_len(wpa_s->pending_action_tx) != 24 || 166 os_memcmp(data + 24, wpabuf_head(wpa_s->pending_action_tx), 167 wpabuf_len(wpa_s->pending_action_tx)) != 0) { 168 wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - " 169 "mismatching contents with pending frame"); 170 wpa_hexdump(MSG_MSGDUMP, "TX status frame data", 171 data, data_len); 172 wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame", 173 wpa_s->pending_action_tx); 174 return; 175 } 176 177 wpa_printf(MSG_DEBUG, "Off-channel: Delete matching pending action frame"); 178 179 wpabuf_free(wpa_s->pending_action_tx); 180 wpa_s->pending_action_tx = NULL; 181 182 wpa_printf(MSG_DEBUG, "Off-channel: TX status result=%d cb=%p", 183 result, wpa_s->pending_action_tx_status_cb); 184 185 if (wpa_s->pending_action_tx_status_cb) { 186 wpa_s->pending_action_tx_status_cb( 187 wpa_s, wpa_s->pending_action_freq, 188 wpa_s->pending_action_dst, wpa_s->pending_action_src, 189 wpa_s->pending_action_bssid, 190 data, data_len, result); 191 } 192 193 if (wpa_s->p2p_long_listen > 0) { 194 /* Continue the listen */ 195 wpa_printf(MSG_DEBUG, "P2P: Continuing long Listen state"); 196 wpas_p2p_listen_start(wpa_s, wpa_s->p2p_long_listen); 197 } 198} 199 200 201/** 202 * offchannel_send_action - Request off-channel Action frame TX 203 * @wpa_s: Pointer to wpa_supplicant data 204 * @freq: The frequency in MHz indicating the channel on which the frame is to 205 * transmitted or 0 for the current channel (only if associated) 206 * @dst: Action frame destination MAC address 207 * @src: Action frame source MAC address 208 * @bssid: Action frame BSSID 209 * @buf: Frame to transmit starting from the Category field 210 * @len: Length of @buf in bytes 211 * @wait_time: Wait time for response in milliseconds 212 * @tx_cb: Callback function for indicating TX status or %NULL for now callback 213 * @no_cck: Whether CCK rates are to be disallowed for TX rate selection 214 * Returns: 0 on success or -1 on failure 215 * 216 * This function is used to request an Action frame to be transmitted on the 217 * current operating channel or on another channel (off-channel). The actual 218 * frame transmission will be delayed until the driver is ready on the specified 219 * channel. The @wait_time parameter can be used to request the driver to remain 220 * awake on the channel to wait for a response. 221 */ 222int offchannel_send_action(struct wpa_supplicant *wpa_s, unsigned int freq, 223 const u8 *dst, const u8 *src, const u8 *bssid, 224 const u8 *buf, size_t len, unsigned int wait_time, 225 void (*tx_cb)(struct wpa_supplicant *wpa_s, 226 unsigned int freq, const u8 *dst, 227 const u8 *src, const u8 *bssid, 228 const u8 *data, size_t data_len, 229 enum offchannel_send_action_result 230 result), 231 int no_cck) 232{ 233 wpa_printf(MSG_DEBUG, "Off-channel: Send action frame: freq=%d dst=" 234 MACSTR " src=" MACSTR " bssid=" MACSTR " len=%d", 235 freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid), 236 (int) len); 237 238 wpa_s->pending_action_tx_status_cb = tx_cb; 239 240 if (wpa_s->pending_action_tx) { 241 wpa_printf(MSG_DEBUG, "Off-channel: Dropped pending Action " 242 "frame TX to " MACSTR, 243 MAC2STR(wpa_s->pending_action_dst)); 244 wpabuf_free(wpa_s->pending_action_tx); 245 } 246 wpa_s->pending_action_tx_done = 0; 247 wpa_s->pending_action_tx = wpabuf_alloc(len); 248 if (wpa_s->pending_action_tx == NULL) { 249 wpa_printf(MSG_DEBUG, "Off-channel: Failed to allocate Action " 250 "frame TX buffer (len=%llu)", 251 (unsigned long long) len); 252 return -1; 253 } 254 wpabuf_put_data(wpa_s->pending_action_tx, buf, len); 255 os_memcpy(wpa_s->pending_action_src, src, ETH_ALEN); 256 os_memcpy(wpa_s->pending_action_dst, dst, ETH_ALEN); 257 os_memcpy(wpa_s->pending_action_bssid, bssid, ETH_ALEN); 258 wpa_s->pending_action_freq = freq; 259 wpa_s->pending_action_no_cck = no_cck; 260 261 if (freq != 0 && wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) { 262 struct wpa_supplicant *iface; 263 int ret; 264 265 iface = wpas_get_tx_interface(wpa_s, 266 wpa_s->pending_action_src); 267 wpa_s->action_tx_wait_time = wait_time; 268 269 ret = wpa_drv_send_action( 270 iface, wpa_s->pending_action_freq, 271 wait_time, wpa_s->pending_action_dst, 272 wpa_s->pending_action_src, wpa_s->pending_action_bssid, 273 wpabuf_head(wpa_s->pending_action_tx), 274 wpabuf_len(wpa_s->pending_action_tx), 275 wpa_s->pending_action_no_cck); 276 if (ret == 0) 277 wpa_s->pending_action_tx_done = 1; 278 return ret; 279 } 280 281 if (freq) { 282 struct wpa_supplicant *tx_iface; 283 tx_iface = wpas_get_tx_interface(wpa_s, src); 284 if (tx_iface->assoc_freq == freq) { 285 wpa_printf(MSG_DEBUG, "Off-channel: Already on " 286 "requested channel (TX interface operating " 287 "channel)"); 288 freq = 0; 289 } 290 } 291 292 if (wpa_s->off_channel_freq == freq || freq == 0) { 293 wpa_printf(MSG_DEBUG, "Off-channel: Already on requested " 294 "channel; send Action frame immediately"); 295 /* TODO: Would there ever be need to extend the current 296 * duration on the channel? */ 297 wpa_s->pending_action_without_roc = 1; 298 eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL); 299 eloop_register_timeout(0, 0, wpas_send_action_cb, wpa_s, NULL); 300 return 0; 301 } 302 wpa_s->pending_action_without_roc = 0; 303 304 if (wpa_s->roc_waiting_drv_freq == freq) { 305 wpa_printf(MSG_DEBUG, "Off-channel: Already waiting for " 306 "driver to get to frequency %u MHz; continue " 307 "waiting to send the Action frame", freq); 308 return 0; 309 } 310 311 wpa_printf(MSG_DEBUG, "Off-channel: Schedule Action frame to be " 312 "transmitted once the driver gets to the requested " 313 "channel"); 314 if (wait_time > wpa_s->max_remain_on_chan) 315 wait_time = wpa_s->max_remain_on_chan; 316 else if (wait_time == 0) 317 wait_time = 20; 318 if (wpa_drv_remain_on_channel(wpa_s, freq, wait_time) < 0) { 319 wpa_printf(MSG_DEBUG, "Off-channel: Failed to request driver " 320 "to remain on channel (%u MHz) for Action " 321 "Frame TX", freq); 322 return -1; 323 } 324 wpa_s->off_channel_freq = 0; 325 wpa_s->roc_waiting_drv_freq = freq; 326 327 return 0; 328} 329 330 331/** 332 * offchannel_send_send_action_done - Notify completion of Action frame sequence 333 * @wpa_s: Pointer to wpa_supplicant data 334 * 335 * This function can be used to cancel a wait for additional response frames on 336 * the channel that was used with offchannel_send_action(). 337 */ 338void offchannel_send_action_done(struct wpa_supplicant *wpa_s) 339{ 340 wpa_printf(MSG_DEBUG, "Off-channel: Action frame sequence done " 341 "notification"); 342 wpabuf_free(wpa_s->pending_action_tx); 343 wpa_s->pending_action_tx = NULL; 344 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX && 345 wpa_s->action_tx_wait_time) 346 wpa_drv_send_action_cancel_wait(wpa_s); 347 348 if (wpa_s->off_channel_freq || wpa_s->roc_waiting_drv_freq) { 349 wpa_drv_cancel_remain_on_channel(wpa_s); 350 wpa_s->off_channel_freq = 0; 351 wpa_s->roc_waiting_drv_freq = 0; 352 } 353} 354 355 356/** 357 * offchannel_remain_on_channel_cb - Remain-on-channel callback function 358 * @wpa_s: Pointer to wpa_supplicant data 359 * @freq: Frequency (in MHz) of the selected channel 360 * @duration: Duration of the remain-on-channel operation in milliseconds 361 * 362 * This function is called whenever the driver notifies beginning of a 363 * remain-on-channel operation. 364 */ 365void offchannel_remain_on_channel_cb(struct wpa_supplicant *wpa_s, 366 unsigned int freq, unsigned int duration) 367{ 368 wpa_s->roc_waiting_drv_freq = 0; 369 wpa_s->off_channel_freq = freq; 370 wpas_send_action_cb(wpa_s, NULL); 371} 372 373 374/** 375 * offchannel_cancel_remain_on_channel_cb - Remain-on-channel stopped callback 376 * @wpa_s: Pointer to wpa_supplicant data 377 * @freq: Frequency (in MHz) of the selected channel 378 * 379 * This function is called whenever the driver notifies termination of a 380 * remain-on-channel operation. 381 */ 382void offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s, 383 unsigned int freq) 384{ 385 wpa_s->off_channel_freq = 0; 386} 387 388 389/** 390 * offchannel_pending_action_tx - Check whether there is a pending Action TX 391 * @wpa_s: Pointer to wpa_supplicant data 392 * Returns: Pointer to pending frame or %NULL if no pending operation 393 * 394 * This function can be used to check whether there is a pending Action frame TX 395 * operation. The returned pointer should be used only for checking whether it 396 * is %NULL (no pending frame) or to print the pointer value in debug 397 * information (i.e., the pointer should not be dereferenced). 398 */ 399const void * offchannel_pending_action_tx(struct wpa_supplicant *wpa_s) 400{ 401 return wpa_s->pending_action_tx; 402} 403 404 405/** 406 * offchannel_clear_pending_action_tx - Clear pending Action frame TX 407 * @wpa_s: Pointer to wpa_supplicant data 408 */ 409void offchannel_clear_pending_action_tx(struct wpa_supplicant *wpa_s) 410{ 411 wpabuf_free(wpa_s->pending_action_tx); 412 wpa_s->pending_action_tx = NULL; 413} 414 415 416/** 417 * offchannel_deinit - Deinit off-channel operations 418 * @wpa_s: Pointer to wpa_supplicant data 419 * 420 * This function is used to free up any allocated resources for off-channel 421 * operations. 422 */ 423void offchannel_deinit(struct wpa_supplicant *wpa_s) 424{ 425 offchannel_clear_pending_action_tx(wpa_s); 426 eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL); 427} 428