1 /*
2  * wpa_supplicant - Off-channel Action frame TX/RX
3  * Copyright (c) 2009-2010, Atheros Communications
4  * Copyright (c) 2011, Qualcomm Atheros
5  *
6  * This software may be distributed under the terms of the BSD license.
7  * See README for more details.
8  */
9 
10 #include "includes.h"
11 
12 #include "common.h"
13 #include "utils/eloop.h"
14 #include "wpa_supplicant_i.h"
15 #include "p2p_supplicant.h"
16 #include "driver_i.h"
17 #include "offchannel.h"
18 
19 
20 
21 static struct wpa_supplicant *
wpas_get_tx_interface(struct wpa_supplicant * wpa_s,const u8 * src)22 wpas_get_tx_interface(struct wpa_supplicant *wpa_s, const u8 *src)
23 {
24 	struct wpa_supplicant *iface;
25 
26 	if (os_memcmp(src, wpa_s->own_addr, ETH_ALEN) == 0)
27 		return wpa_s;
28 
29 	/*
30 	 * Try to find a group interface that matches with the source address.
31 	 */
32 	iface = wpa_s->global->ifaces;
33 	while (iface) {
34 		if (os_memcmp(src, iface->own_addr, ETH_ALEN) == 0)
35 			break;
36 		iface = iface->next;
37 	}
38 	if (iface) {
39 		wpa_printf(MSG_DEBUG, "P2P: Use group interface %s "
40 			   "instead of interface %s for Action TX",
41 			   iface->ifname, wpa_s->ifname);
42 		return iface;
43 	}
44 
45 	return wpa_s;
46 }
47 
48 
wpas_send_action_cb(void * eloop_ctx,void * timeout_ctx)49 static void wpas_send_action_cb(void *eloop_ctx, void *timeout_ctx)
50 {
51 	struct wpa_supplicant *wpa_s = eloop_ctx;
52 	struct wpa_supplicant *iface;
53 	int res;
54 	int without_roc;
55 
56 	without_roc = wpa_s->pending_action_without_roc;
57 	wpa_s->pending_action_without_roc = 0;
58 	wpa_printf(MSG_DEBUG,
59 		   "Off-channel: Send Action callback (without_roc=%d pending_action_tx=%p pending_action_tx_done=%d)",
60 		   without_roc, wpa_s->pending_action_tx,
61 		   !!wpa_s->pending_action_tx_done);
62 
63 	if (wpa_s->pending_action_tx == NULL || wpa_s->pending_action_tx_done)
64 		return;
65 
66 	/*
67 	 * This call is likely going to be on the P2P device instance if the
68 	 * driver uses a separate interface for that purpose. However, some
69 	 * Action frames are actually sent within a P2P Group and when that is
70 	 * the case, we need to follow power saving (e.g., GO buffering the
71 	 * frame for a client in PS mode or a client following the advertised
72 	 * NoA from its GO). To make that easier for the driver, select the
73 	 * correct group interface here.
74 	 */
75 	iface = wpas_get_tx_interface(wpa_s, wpa_s->pending_action_src);
76 
77 	if (wpa_s->off_channel_freq != wpa_s->pending_action_freq &&
78 	    wpa_s->pending_action_freq != 0 &&
79 	    wpa_s->pending_action_freq != iface->assoc_freq) {
80 		wpa_printf(MSG_DEBUG, "Off-channel: Pending Action frame TX "
81 			   "waiting for another freq=%u (off_channel_freq=%u "
82 			   "assoc_freq=%u)",
83 			   wpa_s->pending_action_freq,
84 			   wpa_s->off_channel_freq,
85 			   iface->assoc_freq);
86 		if (without_roc && wpa_s->off_channel_freq == 0) {
87 			unsigned int duration = 200;
88 			/*
89 			 * We may get here if wpas_send_action() found us to be
90 			 * on the correct channel, but remain-on-channel cancel
91 			 * event was received before getting here.
92 			 */
93 			wpa_printf(MSG_DEBUG, "Off-channel: Schedule "
94 				   "remain-on-channel to send Action frame");
95 #ifdef CONFIG_TESTING_OPTIONS
96 			if (wpa_s->extra_roc_dur) {
97 				wpa_printf(MSG_DEBUG,
98 					   "TESTING: Increase ROC duration %u -> %u",
99 					   duration,
100 					   duration + wpa_s->extra_roc_dur);
101 				duration += wpa_s->extra_roc_dur;
102 	}
103 #endif /* CONFIG_TESTING_OPTIONS */
104 			if (wpa_drv_remain_on_channel(
105 				    wpa_s, wpa_s->pending_action_freq,
106 				    duration) < 0) {
107 				wpa_printf(MSG_DEBUG, "Off-channel: Failed to "
108 					   "request driver to remain on "
109 					   "channel (%u MHz) for Action Frame "
110 					   "TX", wpa_s->pending_action_freq);
111 			} else {
112 				wpa_s->off_channel_freq = 0;
113 				wpa_s->roc_waiting_drv_freq =
114 					wpa_s->pending_action_freq;
115 			}
116 		}
117 		return;
118 	}
119 
120 	wpa_printf(MSG_DEBUG, "Off-channel: Sending pending Action frame to "
121 		   MACSTR " using interface %s",
122 		   MAC2STR(wpa_s->pending_action_dst), iface->ifname);
123 	res = wpa_drv_send_action(iface, wpa_s->pending_action_freq, 0,
124 				  wpa_s->pending_action_dst,
125 				  wpa_s->pending_action_src,
126 				  wpa_s->pending_action_bssid,
127 				  wpabuf_head(wpa_s->pending_action_tx),
128 				  wpabuf_len(wpa_s->pending_action_tx),
129 				  wpa_s->pending_action_no_cck);
130 	if (res) {
131 		wpa_printf(MSG_DEBUG, "Off-channel: Failed to send the "
132 			   "pending Action frame");
133 		/*
134 		 * Use fake TX status event to allow state machines to
135 		 * continue.
136 		 */
137 		offchannel_send_action_tx_status(
138 			wpa_s, wpa_s->pending_action_dst,
139 			wpabuf_head(wpa_s->pending_action_tx),
140 			wpabuf_len(wpa_s->pending_action_tx),
141 			OFFCHANNEL_SEND_ACTION_FAILED);
142 	}
143 }
144 
145 
146 /**
147  * offchannel_send_action_tx_status - TX status callback
148  * @wpa_s: Pointer to wpa_supplicant data
149  * @dst: Destination MAC address of the transmitted Action frame
150  * @data: Transmitted frame payload
151  * @data_len: Length of @data in bytes
152  * @result: TX status
153  *
154  * This function is called whenever the driver indicates a TX status event for
155  * a frame sent by offchannel_send_action() using wpa_drv_send_action().
156  */
offchannel_send_action_tx_status(struct wpa_supplicant * wpa_s,const u8 * dst,const u8 * data,size_t data_len,enum offchannel_send_action_result result)157 void offchannel_send_action_tx_status(
158 	struct wpa_supplicant *wpa_s, const u8 *dst, const u8 *data,
159 	size_t data_len, enum offchannel_send_action_result result)
160 {
161 	if (wpa_s->pending_action_tx == NULL) {
162 		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
163 			   "no pending operation");
164 		return;
165 	}
166 
167 	if (os_memcmp(dst, wpa_s->pending_action_dst, ETH_ALEN) != 0) {
168 		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
169 			   "unknown destination address");
170 		return;
171 	}
172 
173 	/* Accept report only if the contents of the frame matches */
174 	if (data_len - wpabuf_len(wpa_s->pending_action_tx) != 24 ||
175 	    os_memcmp(data + 24, wpabuf_head(wpa_s->pending_action_tx),
176 		      wpabuf_len(wpa_s->pending_action_tx)) != 0) {
177 		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
178 				   "mismatching contents with pending frame");
179 		wpa_hexdump(MSG_MSGDUMP, "TX status frame data",
180 			    data, data_len);
181 		wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
182 				wpa_s->pending_action_tx);
183 		return;
184 	}
185 
186 	wpa_printf(MSG_DEBUG, "Off-channel: Delete matching pending action frame");
187 
188 	wpabuf_free(wpa_s->pending_action_tx);
189 	wpa_s->pending_action_tx = NULL;
190 
191 	wpa_printf(MSG_DEBUG, "Off-channel: TX status result=%d cb=%p",
192 		   result, wpa_s->pending_action_tx_status_cb);
193 
194 	if (wpa_s->pending_action_tx_status_cb) {
195 		wpa_s->pending_action_tx_status_cb(
196 			wpa_s, wpa_s->pending_action_freq,
197 			wpa_s->pending_action_dst, wpa_s->pending_action_src,
198 			wpa_s->pending_action_bssid,
199 			data, data_len, result);
200 	}
201 
202 #ifdef CONFIG_P2P
203 	if (wpa_s->p2p_long_listen > 0) {
204 		/* Continue the listen */
205 		wpa_printf(MSG_DEBUG, "P2P: Continuing long Listen state");
206 		wpas_p2p_listen_start(wpa_s, wpa_s->p2p_long_listen);
207 	}
208 #endif /* CONFIG_P2P */
209 }
210 
211 
212 /**
213  * offchannel_send_action - Request off-channel Action frame TX
214  * @wpa_s: Pointer to wpa_supplicant data
215  * @freq: The frequency in MHz indicating the channel on which the frame is to
216  *	transmitted or 0 for the current channel (only if associated)
217  * @dst: Action frame destination MAC address
218  * @src: Action frame source MAC address
219  * @bssid: Action frame BSSID
220  * @buf: Frame to transmit starting from the Category field
221  * @len: Length of @buf in bytes
222  * @wait_time: Wait time for response in milliseconds
223  * @tx_cb: Callback function for indicating TX status or %NULL for now callback
224  * @no_cck: Whether CCK rates are to be disallowed for TX rate selection
225  * Returns: 0 on success or -1 on failure
226  *
227  * This function is used to request an Action frame to be transmitted on the
228  * current operating channel or on another channel (off-channel). The actual
229  * frame transmission will be delayed until the driver is ready on the specified
230  * channel. The @wait_time parameter can be used to request the driver to remain
231  * awake on the channel to wait for a response.
232  */
offchannel_send_action(struct wpa_supplicant * wpa_s,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * buf,size_t len,unsigned int wait_time,void (* tx_cb)(struct wpa_supplicant * wpa_s,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * data,size_t data_len,enum offchannel_send_action_result result),int no_cck)233 int offchannel_send_action(struct wpa_supplicant *wpa_s, unsigned int freq,
234 			   const u8 *dst, const u8 *src, const u8 *bssid,
235 			   const u8 *buf, size_t len, unsigned int wait_time,
236 			   void (*tx_cb)(struct wpa_supplicant *wpa_s,
237 					 unsigned int freq, const u8 *dst,
238 					 const u8 *src, const u8 *bssid,
239 					 const u8 *data, size_t data_len,
240 					 enum offchannel_send_action_result
241 					 result),
242 			   int no_cck)
243 {
244 	wpa_printf(MSG_DEBUG, "Off-channel: Send action frame: freq=%d dst="
245 		   MACSTR " src=" MACSTR " bssid=" MACSTR " len=%d",
246 		   freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
247 		   (int) len);
248 
249 	wpa_s->pending_action_tx_status_cb = tx_cb;
250 
251 	if (wpa_s->pending_action_tx) {
252 		wpa_printf(MSG_DEBUG, "Off-channel: Dropped pending Action "
253 			   "frame TX to " MACSTR,
254 			   MAC2STR(wpa_s->pending_action_dst));
255 		wpabuf_free(wpa_s->pending_action_tx);
256 	}
257 	wpa_s->pending_action_tx_done = 0;
258 	wpa_s->pending_action_tx = wpabuf_alloc(len);
259 	if (wpa_s->pending_action_tx == NULL) {
260 		wpa_printf(MSG_DEBUG, "Off-channel: Failed to allocate Action "
261 			   "frame TX buffer (len=%llu)",
262 			   (unsigned long long) len);
263 		return -1;
264 	}
265 	wpabuf_put_data(wpa_s->pending_action_tx, buf, len);
266 	os_memcpy(wpa_s->pending_action_src, src, ETH_ALEN);
267 	os_memcpy(wpa_s->pending_action_dst, dst, ETH_ALEN);
268 	os_memcpy(wpa_s->pending_action_bssid, bssid, ETH_ALEN);
269 	wpa_s->pending_action_freq = freq;
270 	wpa_s->pending_action_no_cck = no_cck;
271 
272 	if (freq != 0 && wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) {
273 		struct wpa_supplicant *iface;
274 		int ret;
275 
276 		iface = wpas_get_tx_interface(wpa_s, src);
277 		wpa_s->action_tx_wait_time = wait_time;
278 
279 		ret = wpa_drv_send_action(
280 			iface, wpa_s->pending_action_freq,
281 			wait_time, wpa_s->pending_action_dst,
282 			wpa_s->pending_action_src, wpa_s->pending_action_bssid,
283 			wpabuf_head(wpa_s->pending_action_tx),
284 			wpabuf_len(wpa_s->pending_action_tx),
285 			wpa_s->pending_action_no_cck);
286 		if (ret == 0)
287 			wpa_s->pending_action_tx_done = 1;
288 		return ret;
289 	}
290 
291 	if (freq) {
292 		struct wpa_supplicant *tx_iface;
293 		tx_iface = wpas_get_tx_interface(wpa_s, src);
294 		if (tx_iface->assoc_freq == freq) {
295 			wpa_printf(MSG_DEBUG, "Off-channel: Already on "
296 				   "requested channel (TX interface operating "
297 				   "channel)");
298 			freq = 0;
299 		}
300 	}
301 
302 	if (wpa_s->off_channel_freq == freq || freq == 0) {
303 		wpa_printf(MSG_DEBUG, "Off-channel: Already on requested "
304 			   "channel; send Action frame immediately");
305 		/* TODO: Would there ever be need to extend the current
306 		 * duration on the channel? */
307 		wpa_s->pending_action_without_roc = 1;
308 		eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
309 		eloop_register_timeout(0, 0, wpas_send_action_cb, wpa_s, NULL);
310 		return 0;
311 	}
312 	wpa_s->pending_action_without_roc = 0;
313 
314 	if (wpa_s->roc_waiting_drv_freq == freq) {
315 		wpa_printf(MSG_DEBUG, "Off-channel: Already waiting for "
316 			   "driver to get to frequency %u MHz; continue "
317 			   "waiting to send the Action frame", freq);
318 		return 0;
319 	}
320 
321 	wpa_printf(MSG_DEBUG, "Off-channel: Schedule Action frame to be "
322 		   "transmitted once the driver gets to the requested "
323 		   "channel");
324 	if (wait_time > wpa_s->max_remain_on_chan)
325 		wait_time = wpa_s->max_remain_on_chan;
326 	else if (wait_time == 0)
327 		wait_time = 20;
328 #ifdef CONFIG_TESTING_OPTIONS
329 	if (wpa_s->extra_roc_dur) {
330 		wpa_printf(MSG_DEBUG, "TESTING: Increase ROC duration %u -> %u",
331 			   wait_time, wait_time + wpa_s->extra_roc_dur);
332 		wait_time += wpa_s->extra_roc_dur;
333 	}
334 #endif /* CONFIG_TESTING_OPTIONS */
335 	if (wpa_drv_remain_on_channel(wpa_s, freq, wait_time) < 0) {
336 		wpa_printf(MSG_DEBUG, "Off-channel: Failed to request driver "
337 			   "to remain on channel (%u MHz) for Action "
338 			   "Frame TX", freq);
339 		return -1;
340 	}
341 	wpa_s->off_channel_freq = 0;
342 	wpa_s->roc_waiting_drv_freq = freq;
343 
344 	return 0;
345 }
346 
347 
348 /**
349  * offchannel_send_send_action_done - Notify completion of Action frame sequence
350  * @wpa_s: Pointer to wpa_supplicant data
351  *
352  * This function can be used to cancel a wait for additional response frames on
353  * the channel that was used with offchannel_send_action().
354  */
offchannel_send_action_done(struct wpa_supplicant * wpa_s)355 void offchannel_send_action_done(struct wpa_supplicant *wpa_s)
356 {
357 	wpa_printf(MSG_DEBUG,
358 		   "Off-channel: Action frame sequence done notification: pending_action_tx=%p drv_offchan_tx=%d action_tx_wait_time=%d off_channel_freq=%d roc_waiting_drv_freq=%d",
359 		   wpa_s->pending_action_tx,
360 		   !!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX),
361 		   wpa_s->action_tx_wait_time, wpa_s->off_channel_freq,
362 		   wpa_s->roc_waiting_drv_freq);
363 	wpabuf_free(wpa_s->pending_action_tx);
364 	wpa_s->pending_action_tx = NULL;
365 	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX &&
366 	    wpa_s->action_tx_wait_time)
367 		wpa_drv_send_action_cancel_wait(wpa_s);
368 	else if (wpa_s->off_channel_freq || wpa_s->roc_waiting_drv_freq) {
369 		wpa_drv_cancel_remain_on_channel(wpa_s);
370 		wpa_s->off_channel_freq = 0;
371 		wpa_s->roc_waiting_drv_freq = 0;
372 	}
373 }
374 
375 
376 /**
377  * offchannel_remain_on_channel_cb - Remain-on-channel callback function
378  * @wpa_s: Pointer to wpa_supplicant data
379  * @freq: Frequency (in MHz) of the selected channel
380  * @duration: Duration of the remain-on-channel operation in milliseconds
381  *
382  * This function is called whenever the driver notifies beginning of a
383  * remain-on-channel operation.
384  */
offchannel_remain_on_channel_cb(struct wpa_supplicant * wpa_s,unsigned int freq,unsigned int duration)385 void offchannel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
386 				     unsigned int freq, unsigned int duration)
387 {
388 	wpa_s->roc_waiting_drv_freq = 0;
389 	wpa_s->off_channel_freq = freq;
390 	wpas_send_action_cb(wpa_s, NULL);
391 }
392 
393 
394 /**
395  * offchannel_cancel_remain_on_channel_cb - Remain-on-channel stopped callback
396  * @wpa_s: Pointer to wpa_supplicant data
397  * @freq: Frequency (in MHz) of the selected channel
398  *
399  * This function is called whenever the driver notifies termination of a
400  * remain-on-channel operation.
401  */
offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant * wpa_s,unsigned int freq)402 void offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
403 					    unsigned int freq)
404 {
405 	wpa_s->off_channel_freq = 0;
406 }
407 
408 
409 /**
410  * offchannel_pending_action_tx - Check whether there is a pending Action TX
411  * @wpa_s: Pointer to wpa_supplicant data
412  * Returns: Pointer to pending frame or %NULL if no pending operation
413  *
414  * This function can be used to check whether there is a pending Action frame TX
415  * operation. The returned pointer should be used only for checking whether it
416  * is %NULL (no pending frame) or to print the pointer value in debug
417  * information (i.e., the pointer should not be dereferenced).
418  */
offchannel_pending_action_tx(struct wpa_supplicant * wpa_s)419 const void * offchannel_pending_action_tx(struct wpa_supplicant *wpa_s)
420 {
421 	return wpa_s->pending_action_tx;
422 }
423 
424 
425 /**
426  * offchannel_clear_pending_action_tx - Clear pending Action frame TX
427  * @wpa_s: Pointer to wpa_supplicant data
428  */
offchannel_clear_pending_action_tx(struct wpa_supplicant * wpa_s)429 void offchannel_clear_pending_action_tx(struct wpa_supplicant *wpa_s)
430 {
431 	wpabuf_free(wpa_s->pending_action_tx);
432 	wpa_s->pending_action_tx = NULL;
433 }
434 
435 
436 /**
437  * offchannel_deinit - Deinit off-channel operations
438  * @wpa_s: Pointer to wpa_supplicant data
439  *
440  * This function is used to free up any allocated resources for off-channel
441  * operations.
442  */
offchannel_deinit(struct wpa_supplicant * wpa_s)443 void offchannel_deinit(struct wpa_supplicant *wpa_s)
444 {
445 	offchannel_clear_pending_action_tx(wpa_s);
446 	eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
447 }
448