mac80211: rewrite remain-on-channel logic
[cascardo/linux.git] / net / mac80211 / offchannel.c
index 0440103..cfd3356 100644 (file)
@@ -187,11 +187,76 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
                                        false);
 }
 
-void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
+static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
 {
-       if (roc->notified)
+       /* was never transmitted */
+       if (roc->frame) {
+               cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie,
+                                       roc->frame->data, roc->frame->len,
+                                       false, GFP_KERNEL);
+               ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame);
+       }
+
+       if (!roc->mgmt_tx_cookie)
+               cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
+                                                  roc->cookie, roc->chan,
+                                                  GFP_KERNEL);
+
+       list_del(&roc->list);
+       kfree(roc);
+}
+
+static unsigned long ieee80211_end_finished_rocs(struct ieee80211_local *local,
+                                                unsigned long now)
+{
+       struct ieee80211_roc_work *roc, *tmp;
+       long remaining_dur_min = LONG_MAX;
+
+       lockdep_assert_held(&local->mtx);
+
+       list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
+               long remaining;
+
+               if (!roc->started)
+                       break;
+
+               remaining = roc->start_time +
+                           msecs_to_jiffies(roc->duration) -
+                           now;
+
+               if (roc->abort || remaining <= 0)
+                       ieee80211_roc_notify_destroy(roc);
+               else
+                       remaining_dur_min = min(remaining_dur_min, remaining);
+       }
+
+       return remaining_dur_min;
+}
+
+static bool ieee80211_recalc_sw_work(struct ieee80211_local *local,
+                                    unsigned long now)
+{
+       long dur = ieee80211_end_finished_rocs(local, now);
+
+       if (dur == LONG_MAX)
+               return false;
+
+       mod_delayed_work(local->workqueue, &local->roc_work, dur);
+       return true;
+}
+
+static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
+                                        unsigned long start_time)
+{
+       struct ieee80211_local *local = roc->sdata->local;
+
+       if (WARN_ON(roc->notified))
                return;
 
+       roc->start_time = start_time;
+       roc->started = true;
+       roc->hw_begun = true;
+
        if (roc->mgmt_tx_cookie) {
                if (!WARN_ON(!roc->frame)) {
                        ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7,
@@ -205,40 +270,26 @@ void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
        }
 
        roc->notified = true;
+
+       if (!local->ops->remain_on_channel)
+               ieee80211_recalc_sw_work(local, start_time);
 }
 
 static void ieee80211_hw_roc_start(struct work_struct *work)
 {
        struct ieee80211_local *local =
                container_of(work, struct ieee80211_local, hw_roc_start);
-       struct ieee80211_roc_work *roc, *dep, *tmp;
+       struct ieee80211_roc_work *roc;
 
        mutex_lock(&local->mtx);
 
-       if (list_empty(&local->roc_list))
-               goto out_unlock;
+       list_for_each_entry(roc, &local->roc_list, list) {
+               if (!roc->started)
+                       break;
 
-       roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
-                              list);
-
-       if (!roc->started)
-               goto out_unlock;
-
-       roc->hw_begun = true;
-       roc->hw_start_time = local->hw_roc_start_time;
-
-       ieee80211_handle_roc_started(roc);
-       list_for_each_entry_safe(dep, tmp, &roc->dependents, list) {
-               ieee80211_handle_roc_started(dep);
-
-               if (dep->duration > roc->duration) {
-                       u32 dur = dep->duration;
-                       dep->duration = dur - roc->duration;
-                       roc->duration = dur;
-                       list_move(&dep->list, &roc->list);
-               }
+               ieee80211_handle_roc_started(roc, local->hw_roc_start_time);
        }
- out_unlock:
+
        mutex_unlock(&local->mtx);
 }
 
@@ -254,34 +305,40 @@ void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
 
-void ieee80211_start_next_roc(struct ieee80211_local *local)
+static void _ieee80211_start_next_roc(struct ieee80211_local *local)
 {
-       struct ieee80211_roc_work *roc;
+       struct ieee80211_roc_work *roc, *tmp;
+       enum ieee80211_roc_type type;
+       u32 min_dur, max_dur;
 
        lockdep_assert_held(&local->mtx);
 
-       if (list_empty(&local->roc_list)) {
-               ieee80211_run_deferred_scan(local);
+       if (WARN_ON(list_empty(&local->roc_list)))
                return;
-       }
 
        roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
                               list);
 
-       if (WARN_ON_ONCE(roc->started))
+       if (WARN_ON(roc->started))
                return;
 
-       if (local->ops->remain_on_channel) {
-               int ret, duration = roc->duration;
-
-               /* XXX: duplicated, see ieee80211_start_roc_work() */
-               if (!duration)
-                       duration = 10;
+       min_dur = roc->duration;
+       max_dur = roc->duration;
+       type = roc->type;
 
-               ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
-                                           duration, roc->type);
+       list_for_each_entry(tmp, &local->roc_list, list) {
+               if (tmp == roc)
+                       continue;
+               if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
+                       break;
+               max_dur = max(tmp->duration, max_dur);
+               min_dur = min(tmp->duration, min_dur);
+               type = max(tmp->type, type);
+       }
 
-               roc->started = true;
+       if (local->ops->remain_on_channel) {
+               int ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
+                                               max_dur, type);
 
                if (ret) {
                        wiphy_warn(local->hw.wiphy,
@@ -290,74 +347,24 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
                         * queue the work struct again to avoid recursion
                         * when multiple failures occur
                         */
-                       ieee80211_remain_on_channel_expired(&local->hw);
+                       list_for_each_entry(tmp, &local->roc_list, list) {
+                               if (tmp->sdata != roc->sdata ||
+                                   tmp->chan != roc->chan)
+                                       break;
+                               tmp->started = true;
+                               tmp->abort = true;
+                       }
+                       ieee80211_queue_work(&local->hw, &local->hw_roc_done);
+                       return;
                }
-       } else {
-               /* delay it a bit */
-               ieee80211_queue_delayed_work(&local->hw, &roc->work,
-                                            round_jiffies_relative(HZ/2));
-       }
-}
-
-void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
-{
-       struct ieee80211_roc_work *dep, *tmp;
-
-       if (WARN_ON(roc->to_be_freed))
-               return;
-
-       /* was never transmitted */
-       if (roc->frame) {
-               cfg80211_mgmt_tx_status(&roc->sdata->wdev,
-                                       (unsigned long)roc->frame,
-                                       roc->frame->data, roc->frame->len,
-                                       false, GFP_KERNEL);
-               kfree_skb(roc->frame);
-       }
-
-       if (!roc->mgmt_tx_cookie)
-               cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
-                                                  roc->cookie, roc->chan,
-                                                  GFP_KERNEL);
-
-       list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
-               ieee80211_roc_notify_destroy(dep, true);
-
-       if (free)
-               kfree(roc);
-       else
-               roc->to_be_freed = true;
-}
-
-void ieee80211_sw_roc_work(struct work_struct *work)
-{
-       struct ieee80211_roc_work *roc =
-               container_of(work, struct ieee80211_roc_work, work.work);
-       struct ieee80211_sub_if_data *sdata = roc->sdata;
-       struct ieee80211_local *local = sdata->local;
-       bool started, on_channel;
-
-       mutex_lock(&local->mtx);
-
-       if (roc->to_be_freed)
-               goto out_unlock;
-
-       if (roc->abort)
-               goto finish;
-
-       if (WARN_ON(list_empty(&local->roc_list)))
-               goto out_unlock;
-
-       if (WARN_ON(roc != list_first_entry(&local->roc_list,
-                                           struct ieee80211_roc_work,
-                                           list)))
-               goto out_unlock;
-
-       if (!roc->started) {
-               struct ieee80211_roc_work *dep;
-
-               WARN_ON(local->use_chanctx);
 
+               /* we'll notify about the start once the HW calls back */
+               list_for_each_entry(tmp, &local->roc_list, list) {
+                       if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
+                               break;
+                       tmp->started = true;
+               }
+       } else {
                /* If actually operating on the desired channel (with at least
                 * 20 MHz channel width) don't stop all the operations but still
                 * treat it as though the ROC operation started properly, so
@@ -377,27 +384,72 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                        ieee80211_hw_config(local, 0);
                }
 
-               /* tell userspace or send frame */
-               ieee80211_handle_roc_started(roc);
-               list_for_each_entry(dep, &roc->dependents, list)
-                       ieee80211_handle_roc_started(dep);
+               ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
+                                            msecs_to_jiffies(min_dur));
+
+               /* tell userspace or send frame(s) */
+               list_for_each_entry(tmp, &local->roc_list, list) {
+                       if (tmp->sdata != roc->sdata || tmp->chan != roc->chan)
+                               break;
+
+                       tmp->on_channel = roc->on_channel;
+                       ieee80211_handle_roc_started(tmp, jiffies);
+               }
+       }
+}
+
+void ieee80211_start_next_roc(struct ieee80211_local *local)
+{
+       struct ieee80211_roc_work *roc;
+
+       lockdep_assert_held(&local->mtx);
+
+       if (list_empty(&local->roc_list)) {
+               ieee80211_run_deferred_scan(local);
+               return;
+       }
+
+       roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
+                              list);
+
+       if (WARN_ON_ONCE(roc->started))
+               return;
+
+       if (local->ops->remain_on_channel) {
+               _ieee80211_start_next_roc(local);
+       } else {
+               /* delay it a bit */
+               ieee80211_queue_delayed_work(&local->hw, &local->roc_work,
+                                            round_jiffies_relative(HZ/2));
+       }
+}
+
+static void __ieee80211_roc_work(struct ieee80211_local *local)
+{
+       struct ieee80211_roc_work *roc;
+       bool on_channel;
+
+       lockdep_assert_held(&local->mtx);
 
-               /* if it was pure TX, just finish right away */
-               if (!roc->duration)
-                       goto finish;
+       if (WARN_ON(local->ops->remain_on_channel))
+               return;
 
-               roc->started = true;
-               ieee80211_queue_delayed_work(&local->hw, &roc->work,
-                                            msecs_to_jiffies(roc->duration));
+       roc = list_first_entry_or_null(&local->roc_list,
+                                      struct ieee80211_roc_work, list);
+       if (!roc)
+               return;
+
+       if (!roc->started) {
+               WARN_ON(local->use_chanctx);
+               _ieee80211_start_next_roc(local);
        } else {
-               /* finish this ROC */
- finish:
-               list_del(&roc->list);
-               started = roc->started;
                on_channel = roc->on_channel;
-               ieee80211_roc_notify_destroy(roc, !roc->abort);
+               if (ieee80211_recalc_sw_work(local, jiffies))
+                       return;
+
+               /* careful - roc pointer became invalid during recalc */
 
-               if (started && !on_channel) {
+               if (!on_channel) {
                        ieee80211_flush_queues(local, NULL, false);
 
                        local->tmp_channel = NULL;
@@ -407,14 +459,17 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                }
 
                ieee80211_recalc_idle(local);
-
-               if (started)
-                       ieee80211_start_next_roc(local);
-               else if (list_empty(&local->roc_list))
-                       ieee80211_run_deferred_scan(local);
+               ieee80211_start_next_roc(local);
        }
+}
 
- out_unlock:
+static void ieee80211_roc_work(struct work_struct *work)
+{
+       struct ieee80211_local *local =
+               container_of(work, struct ieee80211_local, roc_work.work);
+
+       mutex_lock(&local->mtx);
+       __ieee80211_roc_work(local);
        mutex_unlock(&local->mtx);
 }
 
@@ -422,27 +477,14 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
 {
        struct ieee80211_local *local =
                container_of(work, struct ieee80211_local, hw_roc_done);
-       struct ieee80211_roc_work *roc;
 
        mutex_lock(&local->mtx);
 
-       if (list_empty(&local->roc_list))
-               goto out_unlock;
-
-       roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
-                              list);
-
-       if (!roc->started)
-               goto out_unlock;
-
-       list_del(&roc->list);
-
-       ieee80211_roc_notify_destroy(roc, true);
+       ieee80211_end_finished_rocs(local, jiffies);
 
        /* if there's another roc, start it now */
        ieee80211_start_next_roc(local);
 
- out_unlock:
        mutex_unlock(&local->mtx);
 }
 
@@ -456,47 +498,497 @@ void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
 
-void ieee80211_roc_setup(struct ieee80211_local *local)
+static bool
+ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
+                                 struct ieee80211_roc_work *new_roc,
+                                 struct ieee80211_roc_work *cur_roc)
 {
-       INIT_WORK(&local->hw_roc_start, ieee80211_hw_roc_start);
-       INIT_WORK(&local->hw_roc_done, ieee80211_hw_roc_done);
-       INIT_LIST_HEAD(&local->roc_list);
+       unsigned long now = jiffies;
+       unsigned long remaining;
+
+       if (WARN_ON(!cur_roc->started))
+               return false;
+
+       /* if it was scheduled in the hardware, but not started yet,
+        * we can only combine if the older one had a longer duration
+        */
+       if (!cur_roc->hw_begun && new_roc->duration > cur_roc->duration)
+               return false;
+
+       remaining = cur_roc->start_time +
+                   msecs_to_jiffies(cur_roc->duration) -
+                   now;
+
+       /* if it doesn't fit entirely, schedule a new one */
+       if (new_roc->duration > jiffies_to_msecs(remaining))
+               return false;
+
+       /* add just after the current one so we combine their finish later */
+       list_add(&new_roc->list, &cur_roc->list);
+
+       /* if the existing one has already begun then let this one also
+        * begin, otherwise they'll both be marked properly by the work
+        * struct that runs once the driver notifies us of the beginning
+        */
+       if (cur_roc->hw_begun)
+               ieee80211_handle_roc_started(new_roc, now);
+
+       return true;
 }
 
-void ieee80211_roc_purge(struct ieee80211_local *local,
-                        struct ieee80211_sub_if_data *sdata)
+static int ieee80211_start_roc_work(struct ieee80211_local *local,
+                                   struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_channel *channel,
+                                   unsigned int duration, u64 *cookie,
+                                   struct sk_buff *txskb,
+                                   enum ieee80211_roc_type type)
 {
        struct ieee80211_roc_work *roc, *tmp;
-       LIST_HEAD(tmp_list);
+       bool queued = false, combine_started = true;
+       int ret;
+
+       lockdep_assert_held(&local->mtx);
+
+       if (local->use_chanctx && !local->ops->remain_on_channel)
+               return -EOPNOTSUPP;
+
+       roc = kzalloc(sizeof(*roc), GFP_KERNEL);
+       if (!roc)
+               return -ENOMEM;
+
+       /*
+        * If the duration is zero, then the driver
+        * wouldn't actually do anything. Set it to
+        * 10 for now.
+        *
+        * TODO: cancel the off-channel operation
+        *       when we get the SKB's TX status and
+        *       the wait time was zero before.
+        */
+       if (!duration)
+               duration = 10;
+
+       roc->chan = channel;
+       roc->duration = duration;
+       roc->req_duration = duration;
+       roc->frame = txskb;
+       roc->type = type;
+       roc->sdata = sdata;
+
+       /*
+        * cookie is either the roc cookie (for normal roc)
+        * or the SKB (for mgmt TX)
+        */
+       if (!txskb) {
+               roc->cookie = ieee80211_mgmt_tx_cookie(local);
+               *cookie = roc->cookie;
+       } else {
+               roc->mgmt_tx_cookie = *cookie;
+       }
+
+       /* if there's no need to queue, handle it immediately */
+       if (list_empty(&local->roc_list) &&
+           !local->scanning && !ieee80211_is_radar_required(local)) {
+               /* if not HW assist, just queue & schedule work */
+               if (!local->ops->remain_on_channel) {
+                       list_add_tail(&roc->list, &local->roc_list);
+                       ieee80211_queue_delayed_work(&local->hw,
+                                                    &local->roc_work, 0);
+               } else {
+                       /* otherwise actually kick it off here
+                        * (for error handling)
+                        */
+                       ret = drv_remain_on_channel(local, sdata, channel,
+                                                   duration, type);
+                       if (ret) {
+                               kfree(roc);
+                               return ret;
+                       }
+                       roc->started = true;
+                       list_add_tail(&roc->list, &local->roc_list);
+               }
+
+               return 0;
+       }
+
+       /* otherwise handle queueing */
+
+       list_for_each_entry(tmp, &local->roc_list, list) {
+               if (tmp->chan != channel || tmp->sdata != sdata)
+                       continue;
+
+               /*
+                * Extend this ROC if possible: If it hasn't started, add
+                * just after the new one to combine.
+                */
+               if (!tmp->started) {
+                       list_add(&roc->list, &tmp->list);
+                       queued = true;
+                       break;
+               }
+
+               if (!combine_started)
+                       continue;
+
+               if (!local->ops->remain_on_channel) {
+                       /* If there's no hardware remain-on-channel, and
+                        * doing so won't push us over the maximum r-o-c
+                        * we allow, then we can just add the new one to
+                        * the list and mark it as having started now.
+                        * If it would push over the limit, don't try to
+                        * combine with other started ones (that haven't
+                        * been running as long) but potentially sort it
+                        * with others that had the same fate.
+                        */
+                       unsigned long now = jiffies;
+                       u32 elapsed = jiffies_to_msecs(now - tmp->start_time);
+                       struct wiphy *wiphy = local->hw.wiphy;
+                       u32 max_roc = wiphy->max_remain_on_channel_duration;
+
+                       if (elapsed + roc->duration > max_roc) {
+                               combine_started = false;
+                               continue;
+                       }
+
+                       list_add(&roc->list, &tmp->list);
+                       queued = true;
+                       roc->on_channel = tmp->on_channel;
+                       ieee80211_handle_roc_started(roc, now);
+                       break;
+               }
+
+               queued = ieee80211_coalesce_hw_started_roc(local, roc, tmp);
+               if (queued)
+                       break;
+               /* if it wasn't queued, perhaps it can be combined with
+                * another that also couldn't get combined previously,
+                * but no need to check for already started ones, since
+                * that can't work.
+                */
+               combine_started = false;
+       }
+
+       if (!queued)
+               list_add_tail(&roc->list, &local->roc_list);
+
+       return 0;
+}
+
+int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
+                               struct ieee80211_channel *chan,
+                               unsigned int duration, u64 *cookie)
+{
+       struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+       struct ieee80211_local *local = sdata->local;
+       int ret;
+
+       mutex_lock(&local->mtx);
+       ret = ieee80211_start_roc_work(local, sdata, chan,
+                                      duration, cookie, NULL,
+                                      IEEE80211_ROC_TYPE_NORMAL);
+       mutex_unlock(&local->mtx);
+
+       return ret;
+}
+
+static int ieee80211_cancel_roc(struct ieee80211_local *local,
+                               u64 cookie, bool mgmt_tx)
+{
+       struct ieee80211_roc_work *roc, *tmp, *found = NULL;
+       int ret;
 
        mutex_lock(&local->mtx);
        list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
-               if (sdata && roc->sdata != sdata)
+               if (!mgmt_tx && roc->cookie != cookie)
+                       continue;
+               else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
                        continue;
 
-               if (roc->started && local->ops->remain_on_channel) {
-                       /* can race, so ignore return value */
-                       drv_cancel_remain_on_channel(local);
+               found = roc;
+               break;
+       }
+
+       if (!found) {
+               mutex_unlock(&local->mtx);
+               return -ENOENT;
+       }
+
+       if (!found->started) {
+               ieee80211_roc_notify_destroy(found);
+               goto out_unlock;
+       }
+
+       if (local->ops->remain_on_channel) {
+               ret = drv_cancel_remain_on_channel(local);
+               if (WARN_ON_ONCE(ret)) {
+                       mutex_unlock(&local->mtx);
+                       return ret;
                }
 
-               list_move_tail(&roc->list, &tmp_list);
-               roc->abort = true;
+               /* TODO:
+                * if multiple items were combined here then we really shouldn't
+                * cancel them all - we should wait for as much time as needed
+                * for the longest remaining one, and only then cancel ...
+                */
+               list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
+                       if (!roc->started)
+                               break;
+                       if (roc == found)
+                               found = NULL;
+                       ieee80211_roc_notify_destroy(roc);
+               }
+
+               /* that really must not happen - it was started */
+               WARN_ON(found);
+
+               ieee80211_start_next_roc(local);
+       } else {
+               /* go through work struct to return to the operating channel */
+               found->abort = true;
+               mod_delayed_work(local->workqueue, &local->roc_work, 0);
        }
+
+ out_unlock:
        mutex_unlock(&local->mtx);
 
-       list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
-               if (local->ops->remain_on_channel) {
-                       list_del(&roc->list);
-                       ieee80211_roc_notify_destroy(roc, true);
+       return 0;
+}
+
+int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
+                                      struct wireless_dev *wdev, u64 cookie)
+{
+       struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+       struct ieee80211_local *local = sdata->local;
+
+       return ieee80211_cancel_roc(local, cookie, false);
+}
+
+int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
+                     struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+{
+       struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+       struct ieee80211_local *local = sdata->local;
+       struct sk_buff *skb;
+       struct sta_info *sta;
+       const struct ieee80211_mgmt *mgmt = (void *)params->buf;
+       bool need_offchan = false;
+       u32 flags;
+       int ret;
+       u8 *data;
+
+       if (params->dont_wait_for_ack)
+               flags = IEEE80211_TX_CTL_NO_ACK;
+       else
+               flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
+                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+       if (params->no_cck)
+               flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
+
+       switch (sdata->vif.type) {
+       case NL80211_IFTYPE_ADHOC:
+               if (!sdata->vif.bss_conf.ibss_joined)
+                       need_offchan = true;
+               /* fall through */
+#ifdef CONFIG_MAC80211_MESH
+       case NL80211_IFTYPE_MESH_POINT:
+               if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                   !sdata->u.mesh.mesh_id_len)
+                       need_offchan = true;
+               /* fall through */
+#endif
+       case NL80211_IFTYPE_AP:
+       case NL80211_IFTYPE_AP_VLAN:
+       case NL80211_IFTYPE_P2P_GO:
+               if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                   !ieee80211_vif_is_mesh(&sdata->vif) &&
+                   !rcu_access_pointer(sdata->bss->beacon))
+                       need_offchan = true;
+               if (!ieee80211_is_action(mgmt->frame_control) ||
+                   mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
+                   mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
+                   mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT)
+                       break;
+               rcu_read_lock();
+               sta = sta_info_get(sdata, mgmt->da);
+               rcu_read_unlock();
+               if (!sta)
+                       return -ENOLINK;
+               break;
+       case NL80211_IFTYPE_STATION:
+       case NL80211_IFTYPE_P2P_CLIENT:
+               sdata_lock(sdata);
+               if (!sdata->u.mgd.associated ||
+                   (params->offchan && params->wait &&
+                    local->ops->remain_on_channel &&
+                    memcmp(sdata->u.mgd.associated->bssid,
+                           mgmt->bssid, ETH_ALEN)))
+                       need_offchan = true;
+               sdata_unlock(sdata);
+               break;
+       case NL80211_IFTYPE_P2P_DEVICE:
+               need_offchan = true;
+               break;
+       default:
+               return -EOPNOTSUPP;
+       }
+
+       /* configurations requiring offchan cannot work if no channel has been
+        * specified
+        */
+       if (need_offchan && !params->chan)
+               return -EINVAL;
+
+       mutex_lock(&local->mtx);
+
+       /* Check if the operating channel is the requested channel */
+       if (!need_offchan) {
+               struct ieee80211_chanctx_conf *chanctx_conf;
+
+               rcu_read_lock();
+               chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+
+               if (chanctx_conf) {
+                       need_offchan = params->chan &&
+                                      (params->chan !=
+                                       chanctx_conf->def.chan);
+               } else if (!params->chan) {
+                       ret = -EINVAL;
+                       rcu_read_unlock();
+                       goto out_unlock;
                } else {
-                       ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
+                       need_offchan = true;
+               }
+               rcu_read_unlock();
+       }
+
+       if (need_offchan && !params->offchan) {
+               ret = -EBUSY;
+               goto out_unlock;
+       }
+
+       skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
+       if (!skb) {
+               ret = -ENOMEM;
+               goto out_unlock;
+       }
+       skb_reserve(skb, local->hw.extra_tx_headroom);
+
+       data = skb_put(skb, params->len);
+       memcpy(data, params->buf, params->len);
+
+       /* Update CSA counters */
+       if (sdata->vif.csa_active &&
+           (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
+           params->n_csa_offsets) {
+               int i;
+               struct beacon_data *beacon = NULL;
+
+               rcu_read_lock();
+
+               if (sdata->vif.type == NL80211_IFTYPE_AP)
+                       beacon = rcu_dereference(sdata->u.ap.beacon);
+               else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                       beacon = rcu_dereference(sdata->u.ibss.presp);
+               else if (ieee80211_vif_is_mesh(&sdata->vif))
+                       beacon = rcu_dereference(sdata->u.mesh.beacon);
+
+               if (beacon)
+                       for (i = 0; i < params->n_csa_offsets; i++)
+                               data[params->csa_offsets[i]] =
+                                       beacon->csa_current_counter;
+
+               rcu_read_unlock();
+       }
 
-                       /* work will clean up etc */
-                       flush_delayed_work(&roc->work);
-                       WARN_ON(!roc->to_be_freed);
-                       kfree(roc);
+       IEEE80211_SKB_CB(skb)->flags = flags;
+
+       skb->dev = sdata->dev;
+
+       if (!params->dont_wait_for_ack) {
+               /* make a copy to preserve the frame contents
+                * in case of encryption.
+                */
+               ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);
+               if (ret) {
+                       kfree_skb(skb);
+                       goto out_unlock;
                }
+       } else {
+               /* Assign a dummy non-zero cookie, it's not sent to
+                * userspace in this case but we rely on its value
+                * internally in the need_offchan case to distinguish
+                * mgmt-tx from remain-on-channel.
+                */
+               *cookie = 0xffffffff;
        }
 
-       WARN_ON_ONCE(!list_empty(&tmp_list));
+       if (!need_offchan) {
+               ieee80211_tx_skb(sdata, skb);
+               ret = 0;
+               goto out_unlock;
+       }
+
+       IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
+                                       IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
+       if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
+               IEEE80211_SKB_CB(skb)->hw_queue =
+                       local->hw.offchannel_tx_hw_queue;
+
+       /* This will handle all kinds of coalescing and immediate TX */
+       ret = ieee80211_start_roc_work(local, sdata, params->chan,
+                                      params->wait, cookie, skb,
+                                      IEEE80211_ROC_TYPE_MGMT_TX);
+       if (ret)
+               ieee80211_free_txskb(&local->hw, skb);
+ out_unlock:
+       mutex_unlock(&local->mtx);
+       return ret;
+}
+
+int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+                                 struct wireless_dev *wdev, u64 cookie)
+{
+       struct ieee80211_local *local = wiphy_priv(wiphy);
+
+       return ieee80211_cancel_roc(local, cookie, true);
+}
+
+void ieee80211_roc_setup(struct ieee80211_local *local)
+{
+       INIT_WORK(&local->hw_roc_start, ieee80211_hw_roc_start);
+       INIT_WORK(&local->hw_roc_done, ieee80211_hw_roc_done);
+       INIT_DELAYED_WORK(&local->roc_work, ieee80211_roc_work);
+       INIT_LIST_HEAD(&local->roc_list);
+}
+
+void ieee80211_roc_purge(struct ieee80211_local *local,
+                        struct ieee80211_sub_if_data *sdata)
+{
+       struct ieee80211_roc_work *roc, *tmp;
+       bool work_to_do = false;
+
+       mutex_lock(&local->mtx);
+       list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
+               if (sdata && roc->sdata != sdata)
+                       continue;
+
+               if (roc->started) {
+                       if (local->ops->remain_on_channel) {
+                               /* can race, so ignore return value */
+                               drv_cancel_remain_on_channel(local);
+                               ieee80211_roc_notify_destroy(roc);
+                       } else {
+                               roc->abort = true;
+                               work_to_do = true;
+                       }
+               } else {
+                       ieee80211_roc_notify_destroy(roc);
+               }
+       }
+       if (work_to_do)
+               __ieee80211_roc_work(local);
+       mutex_unlock(&local->mtx);
 }