1/* 2 * wpa_supplicant - Off-channel Action frame TX/RX 3 * Copyright (c) 2009-2010, Atheros Communications 4 * Copyright (c) 2011, Qualcomm Atheros 5 * 6 * This software may be distributed under the terms of the BSD license. 7 * See README for more details. 8 */ 9 10#include "includes.h" 11 12#include "common.h" 13#include "utils/eloop.h" 14#include "wpa_supplicant_i.h" 15#include "p2p_supplicant.h" 16#include "driver_i.h" 17#include "offchannel.h" 18 19 20 21static struct wpa_supplicant * 22wpas_get_tx_interface(struct wpa_supplicant *wpa_s, const u8 *src) 23{ 24 struct wpa_supplicant *iface; 25 26 if (os_memcmp(src, wpa_s->own_addr, ETH_ALEN) == 0) { 27#ifdef CONFIG_P2P 28 if (wpa_s->p2p_mgmt && wpa_s != wpa_s->parent && 29 wpa_s->parent->ap_iface && 30 os_memcmp(wpa_s->parent->own_addr, 31 wpa_s->own_addr, ETH_ALEN) == 0 && 32 wpabuf_len(wpa_s->pending_action_tx) >= 2 && 33 *wpabuf_head_u8(wpa_s->pending_action_tx) != 34 WLAN_ACTION_PUBLIC) { 35 /* 36 * When P2P Device interface has same MAC address as 37 * the GO interface, make sure non-Public Action frames 38 * are sent through the GO interface. The P2P Device 39 * interface can only send Public Action frames. 40 */ 41 wpa_printf(MSG_DEBUG, 42 "P2P: Use GO interface %s instead of interface %s for Action TX", 43 wpa_s->parent->ifname, wpa_s->ifname); 44 return wpa_s->parent; 45 } 46#endif /* CONFIG_P2P */ 47 return wpa_s; 48 } 49 50 /* 51 * Try to find a group interface that matches with the source address. 52 */ 53 iface = wpa_s->global->ifaces; 54 while (iface) { 55 if (os_memcmp(src, iface->own_addr, ETH_ALEN) == 0) 56 break; 57 iface = iface->next; 58 } 59 if (iface) { 60 wpa_printf(MSG_DEBUG, "P2P: Use group interface %s " 61 "instead of interface %s for Action TX", 62 iface->ifname, wpa_s->ifname); 63 return iface; 64 } 65 66 return wpa_s; 67} 68 69 70static void wpas_send_action_cb(void *eloop_ctx, void *timeout_ctx) 71{ 72 struct wpa_supplicant *wpa_s = eloop_ctx; 73 struct wpa_supplicant *iface; 74 int res; 75 int without_roc; 76 77 without_roc = wpa_s->pending_action_without_roc; 78 wpa_s->pending_action_without_roc = 0; 79 wpa_printf(MSG_DEBUG, 80 "Off-channel: Send Action callback (without_roc=%d pending_action_tx=%p pending_action_tx_done=%d)", 81 without_roc, wpa_s->pending_action_tx, 82 !!wpa_s->pending_action_tx_done); 83 84 if (wpa_s->pending_action_tx == NULL || wpa_s->pending_action_tx_done) 85 return; 86 87 /* 88 * This call is likely going to be on the P2P device instance if the 89 * driver uses a separate interface for that purpose. However, some 90 * Action frames are actually sent within a P2P Group and when that is 91 * the case, we need to follow power saving (e.g., GO buffering the 92 * frame for a client in PS mode or a client following the advertised 93 * NoA from its GO). To make that easier for the driver, select the 94 * correct group interface here. 95 */ 96 iface = wpas_get_tx_interface(wpa_s, wpa_s->pending_action_src); 97 98 if (wpa_s->off_channel_freq != wpa_s->pending_action_freq && 99 wpa_s->pending_action_freq != 0 && 100 wpa_s->pending_action_freq != iface->assoc_freq) { 101 wpa_printf(MSG_DEBUG, "Off-channel: Pending Action frame TX " 102 "waiting for another freq=%u (off_channel_freq=%u " 103 "assoc_freq=%u)", 104 wpa_s->pending_action_freq, 105 wpa_s->off_channel_freq, 106 iface->assoc_freq); 107 if (without_roc && wpa_s->off_channel_freq == 0) { 108 unsigned int duration = 200; 109 /* 110 * We may get here if wpas_send_action() found us to be 111 * on the correct channel, but remain-on-channel cancel 112 * event was received before getting here. 113 */ 114 wpa_printf(MSG_DEBUG, "Off-channel: Schedule " 115 "remain-on-channel to send Action frame"); 116#ifdef CONFIG_TESTING_OPTIONS 117 if (wpa_s->extra_roc_dur) { 118 wpa_printf(MSG_DEBUG, 119 "TESTING: Increase ROC duration %u -> %u", 120 duration, 121 duration + wpa_s->extra_roc_dur); 122 duration += wpa_s->extra_roc_dur; 123 } 124#endif /* CONFIG_TESTING_OPTIONS */ 125 if (wpa_drv_remain_on_channel( 126 wpa_s, wpa_s->pending_action_freq, 127 duration) < 0) { 128 wpa_printf(MSG_DEBUG, "Off-channel: Failed to " 129 "request driver to remain on " 130 "channel (%u MHz) for Action Frame " 131 "TX", wpa_s->pending_action_freq); 132 } else { 133 wpa_s->off_channel_freq = 0; 134 wpa_s->roc_waiting_drv_freq = 135 wpa_s->pending_action_freq; 136 } 137 } 138 return; 139 } 140 141 wpa_printf(MSG_DEBUG, "Off-channel: Sending pending Action frame to " 142 MACSTR " using interface %s (pending_action_tx=%p)", 143 MAC2STR(wpa_s->pending_action_dst), iface->ifname, 144 wpa_s->pending_action_tx); 145 res = wpa_drv_send_action(iface, wpa_s->pending_action_freq, 0, 146 wpa_s->pending_action_dst, 147 wpa_s->pending_action_src, 148 wpa_s->pending_action_bssid, 149 wpabuf_head(wpa_s->pending_action_tx), 150 wpabuf_len(wpa_s->pending_action_tx), 151 wpa_s->pending_action_no_cck); 152 if (res) { 153 wpa_printf(MSG_DEBUG, "Off-channel: Failed to send the " 154 "pending Action frame"); 155 /* 156 * Use fake TX status event to allow state machines to 157 * continue. 158 */ 159 offchannel_send_action_tx_status( 160 wpa_s, wpa_s->pending_action_dst, 161 wpabuf_head(wpa_s->pending_action_tx), 162 wpabuf_len(wpa_s->pending_action_tx), 163 OFFCHANNEL_SEND_ACTION_FAILED); 164 } 165} 166 167 168/** 169 * offchannel_send_action_tx_status - TX status callback 170 * @wpa_s: Pointer to wpa_supplicant data 171 * @dst: Destination MAC address of the transmitted Action frame 172 * @data: Transmitted frame payload 173 * @data_len: Length of @data in bytes 174 * @result: TX status 175 * 176 * This function is called whenever the driver indicates a TX status event for 177 * a frame sent by offchannel_send_action() using wpa_drv_send_action(). 178 */ 179void offchannel_send_action_tx_status( 180 struct wpa_supplicant *wpa_s, const u8 *dst, const u8 *data, 181 size_t data_len, enum offchannel_send_action_result result) 182{ 183 if (wpa_s->pending_action_tx == NULL) { 184 wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - " 185 "no pending operation"); 186 return; 187 } 188 189 if (os_memcmp(dst, wpa_s->pending_action_dst, ETH_ALEN) != 0) { 190 wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - " 191 "unknown destination address"); 192 return; 193 } 194 195 /* Accept report only if the contents of the frame matches */ 196 if (data_len - wpabuf_len(wpa_s->pending_action_tx) != 24 || 197 os_memcmp(data + 24, wpabuf_head(wpa_s->pending_action_tx), 198 wpabuf_len(wpa_s->pending_action_tx)) != 0) { 199 wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - " 200 "mismatching contents with pending frame"); 201 wpa_hexdump(MSG_MSGDUMP, "TX status frame data", 202 data, data_len); 203 wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame", 204 wpa_s->pending_action_tx); 205 return; 206 } 207 208 wpa_printf(MSG_DEBUG, 209 "Off-channel: Delete matching pending action frame (dst=" 210 MACSTR " pending_action_tx=%p)", MAC2STR(dst), 211 wpa_s->pending_action_tx); 212 wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame", 213 wpa_s->pending_action_tx); 214 wpabuf_free(wpa_s->pending_action_tx); 215 wpa_s->pending_action_tx = NULL; 216 217 wpa_printf(MSG_DEBUG, "Off-channel: TX status result=%d cb=%p", 218 result, wpa_s->pending_action_tx_status_cb); 219 220 if (wpa_s->pending_action_tx_status_cb) { 221 wpa_s->pending_action_tx_status_cb( 222 wpa_s, wpa_s->pending_action_freq, 223 wpa_s->pending_action_dst, wpa_s->pending_action_src, 224 wpa_s->pending_action_bssid, 225 data, data_len, result); 226 } 227 228#ifdef CONFIG_P2P 229 if (wpa_s->p2p_long_listen > 0) { 230 /* Continue the listen */ 231 wpa_printf(MSG_DEBUG, "P2P: Continuing long Listen state"); 232 wpas_p2p_listen_start(wpa_s, wpa_s->p2p_long_listen); 233 } 234#endif /* CONFIG_P2P */ 235} 236 237 238/** 239 * offchannel_send_action - Request off-channel Action frame TX 240 * @wpa_s: Pointer to wpa_supplicant data 241 * @freq: The frequency in MHz indicating the channel on which the frame is to 242 * transmitted or 0 for the current channel (only if associated) 243 * @dst: Action frame destination MAC address 244 * @src: Action frame source MAC address 245 * @bssid: Action frame BSSID 246 * @buf: Frame to transmit starting from the Category field 247 * @len: Length of @buf in bytes 248 * @wait_time: Wait time for response in milliseconds 249 * @tx_cb: Callback function for indicating TX status or %NULL for now callback 250 * @no_cck: Whether CCK rates are to be disallowed for TX rate selection 251 * Returns: 0 on success or -1 on failure 252 * 253 * This function is used to request an Action frame to be transmitted on the 254 * current operating channel or on another channel (off-channel). The actual 255 * frame transmission will be delayed until the driver is ready on the specified 256 * channel. The @wait_time parameter can be used to request the driver to remain 257 * awake on the channel to wait for a response. 258 */ 259int offchannel_send_action(struct wpa_supplicant *wpa_s, unsigned int freq, 260 const u8 *dst, const u8 *src, const u8 *bssid, 261 const u8 *buf, size_t len, unsigned int wait_time, 262 void (*tx_cb)(struct wpa_supplicant *wpa_s, 263 unsigned int freq, const u8 *dst, 264 const u8 *src, const u8 *bssid, 265 const u8 *data, size_t data_len, 266 enum offchannel_send_action_result 267 result), 268 int no_cck) 269{ 270 wpa_printf(MSG_DEBUG, "Off-channel: Send action frame: freq=%d dst=" 271 MACSTR " src=" MACSTR " bssid=" MACSTR " len=%d", 272 freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid), 273 (int) len); 274 275 wpa_s->pending_action_tx_status_cb = tx_cb; 276 277 if (wpa_s->pending_action_tx) { 278 wpa_printf(MSG_DEBUG, "Off-channel: Dropped pending Action " 279 "frame TX to " MACSTR " (pending_action_tx=%p)", 280 MAC2STR(wpa_s->pending_action_dst), 281 wpa_s->pending_action_tx); 282 wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame", 283 wpa_s->pending_action_tx); 284 wpabuf_free(wpa_s->pending_action_tx); 285 } 286 wpa_s->pending_action_tx_done = 0; 287 wpa_s->pending_action_tx = wpabuf_alloc(len); 288 if (wpa_s->pending_action_tx == NULL) { 289 wpa_printf(MSG_DEBUG, "Off-channel: Failed to allocate Action " 290 "frame TX buffer (len=%llu)", 291 (unsigned long long) len); 292 return -1; 293 } 294 wpabuf_put_data(wpa_s->pending_action_tx, buf, len); 295 os_memcpy(wpa_s->pending_action_src, src, ETH_ALEN); 296 os_memcpy(wpa_s->pending_action_dst, dst, ETH_ALEN); 297 os_memcpy(wpa_s->pending_action_bssid, bssid, ETH_ALEN); 298 wpa_s->pending_action_freq = freq; 299 wpa_s->pending_action_no_cck = no_cck; 300 wpa_printf(MSG_DEBUG, 301 "Off-channel: Stored pending action frame (dst=" MACSTR 302 " pending_action_tx=%p)", 303 MAC2STR(dst), wpa_s->pending_action_tx); 304 wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame", 305 wpa_s->pending_action_tx); 306 307 if (freq != 0 && wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) { 308 struct wpa_supplicant *iface; 309 int ret; 310 311 iface = wpas_get_tx_interface(wpa_s, src); 312 wpa_s->action_tx_wait_time = wait_time; 313 if (wait_time) 314 wpa_s->action_tx_wait_time_used = 1; 315 316 ret = wpa_drv_send_action( 317 iface, wpa_s->pending_action_freq, 318 wait_time, wpa_s->pending_action_dst, 319 wpa_s->pending_action_src, wpa_s->pending_action_bssid, 320 wpabuf_head(wpa_s->pending_action_tx), 321 wpabuf_len(wpa_s->pending_action_tx), 322 wpa_s->pending_action_no_cck); 323 if (ret == 0) 324 wpa_s->pending_action_tx_done = 1; 325 return ret; 326 } 327 328 if (freq) { 329 struct wpa_supplicant *tx_iface; 330 tx_iface = wpas_get_tx_interface(wpa_s, src); 331 if (tx_iface->assoc_freq == freq) { 332 wpa_printf(MSG_DEBUG, "Off-channel: Already on " 333 "requested channel (TX interface operating " 334 "channel)"); 335 freq = 0; 336 } 337 } 338 339 if (wpa_s->off_channel_freq == freq || freq == 0) { 340 wpa_printf(MSG_DEBUG, "Off-channel: Already on requested " 341 "channel; send Action frame immediately"); 342 /* TODO: Would there ever be need to extend the current 343 * duration on the channel? */ 344 wpa_s->pending_action_without_roc = 1; 345 eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL); 346 eloop_register_timeout(0, 0, wpas_send_action_cb, wpa_s, NULL); 347 return 0; 348 } 349 wpa_s->pending_action_without_roc = 0; 350 351 if (wpa_s->roc_waiting_drv_freq == freq) { 352 wpa_printf(MSG_DEBUG, "Off-channel: Already waiting for " 353 "driver to get to frequency %u MHz; continue " 354 "waiting to send the Action frame", freq); 355 return 0; 356 } 357 358 wpa_printf(MSG_DEBUG, "Off-channel: Schedule Action frame to be " 359 "transmitted once the driver gets to the requested " 360 "channel"); 361 if (wait_time > wpa_s->max_remain_on_chan) 362 wait_time = wpa_s->max_remain_on_chan; 363 else if (wait_time == 0) 364 wait_time = 20; 365#ifdef CONFIG_TESTING_OPTIONS 366 if (wpa_s->extra_roc_dur) { 367 wpa_printf(MSG_DEBUG, "TESTING: Increase ROC duration %u -> %u", 368 wait_time, wait_time + wpa_s->extra_roc_dur); 369 wait_time += wpa_s->extra_roc_dur; 370 } 371#endif /* CONFIG_TESTING_OPTIONS */ 372 if (wpa_drv_remain_on_channel(wpa_s, freq, wait_time) < 0) { 373 wpa_printf(MSG_DEBUG, "Off-channel: Failed to request driver " 374 "to remain on channel (%u MHz) for Action " 375 "Frame TX", freq); 376 return -1; 377 } 378 wpa_s->off_channel_freq = 0; 379 wpa_s->roc_waiting_drv_freq = freq; 380 381 return 0; 382} 383 384 385/** 386 * offchannel_send_send_action_done - Notify completion of Action frame sequence 387 * @wpa_s: Pointer to wpa_supplicant data 388 * 389 * This function can be used to cancel a wait for additional response frames on 390 * the channel that was used with offchannel_send_action(). 391 */ 392void offchannel_send_action_done(struct wpa_supplicant *wpa_s) 393{ 394 wpa_printf(MSG_DEBUG, 395 "Off-channel: Action frame sequence done notification: pending_action_tx=%p drv_offchan_tx=%d action_tx_wait_time=%d off_channel_freq=%d roc_waiting_drv_freq=%d", 396 wpa_s->pending_action_tx, 397 !!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX), 398 wpa_s->action_tx_wait_time, wpa_s->off_channel_freq, 399 wpa_s->roc_waiting_drv_freq); 400 wpabuf_free(wpa_s->pending_action_tx); 401 wpa_s->pending_action_tx = NULL; 402 if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX && 403 (wpa_s->action_tx_wait_time || wpa_s->action_tx_wait_time_used)) 404 wpa_drv_send_action_cancel_wait(wpa_s); 405 else if (wpa_s->off_channel_freq || wpa_s->roc_waiting_drv_freq) { 406 wpa_drv_cancel_remain_on_channel(wpa_s); 407 wpa_s->off_channel_freq = 0; 408 wpa_s->roc_waiting_drv_freq = 0; 409 } 410 wpa_s->action_tx_wait_time_used = 0; 411} 412 413 414/** 415 * offchannel_remain_on_channel_cb - Remain-on-channel callback function 416 * @wpa_s: Pointer to wpa_supplicant data 417 * @freq: Frequency (in MHz) of the selected channel 418 * @duration: Duration of the remain-on-channel operation in milliseconds 419 * 420 * This function is called whenever the driver notifies beginning of a 421 * remain-on-channel operation. 422 */ 423void offchannel_remain_on_channel_cb(struct wpa_supplicant *wpa_s, 424 unsigned int freq, unsigned int duration) 425{ 426 wpa_s->roc_waiting_drv_freq = 0; 427 wpa_s->off_channel_freq = freq; 428 wpas_send_action_cb(wpa_s, NULL); 429} 430 431 432/** 433 * offchannel_cancel_remain_on_channel_cb - Remain-on-channel stopped callback 434 * @wpa_s: Pointer to wpa_supplicant data 435 * @freq: Frequency (in MHz) of the selected channel 436 * 437 * This function is called whenever the driver notifies termination of a 438 * remain-on-channel operation. 439 */ 440void offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s, 441 unsigned int freq) 442{ 443 wpa_s->off_channel_freq = 0; 444} 445 446 447/** 448 * offchannel_pending_action_tx - Check whether there is a pending Action TX 449 * @wpa_s: Pointer to wpa_supplicant data 450 * Returns: Pointer to pending frame or %NULL if no pending operation 451 * 452 * This function can be used to check whether there is a pending Action frame TX 453 * operation. The returned pointer should be used only for checking whether it 454 * is %NULL (no pending frame) or to print the pointer value in debug 455 * information (i.e., the pointer should not be dereferenced). 456 */ 457const void * offchannel_pending_action_tx(struct wpa_supplicant *wpa_s) 458{ 459 return wpa_s->pending_action_tx; 460} 461 462 463/** 464 * offchannel_clear_pending_action_tx - Clear pending Action frame TX 465 * @wpa_s: Pointer to wpa_supplicant data 466 */ 467void offchannel_clear_pending_action_tx(struct wpa_supplicant *wpa_s) 468{ 469 wpa_printf(MSG_DEBUG, 470 "Off-channel: Clear pending Action frame TX (pending_action_tx=%p", 471 wpa_s->pending_action_tx); 472 wpabuf_free(wpa_s->pending_action_tx); 473 wpa_s->pending_action_tx = NULL; 474} 475 476 477/** 478 * offchannel_deinit - Deinit off-channel operations 479 * @wpa_s: Pointer to wpa_supplicant data 480 * 481 * This function is used to free up any allocated resources for off-channel 482 * operations. 483 */ 484void offchannel_deinit(struct wpa_supplicant *wpa_s) 485{ 486 offchannel_clear_pending_action_tx(wpa_s); 487 eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL); 488} 489