7 files changed, 40 insertions, 25 deletions

diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 86ad2c341525..0eaa9092364b 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -399,6 +399,9 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_RATE_CTRL_PROBE: internal to mac80211, can be
  *      set by rate control algorithms to indicate probe rate, will
  *      be cleared for fragmented frames (except on the last fragment)
+ * @IEEE80211_TX_INTFL_OFFCHAN_TX_OK: Internal to mac80211. Used to indicate
+ *      that a frame can be transmitted while the queues are stopped for
+ *      off-channel operation.
  * @IEEE80211_TX_INTFL_NEED_TXPROCESSING: completely internal to mac80211,
  *      used to indicate that a pending frame requires TX processing before
  *      it can be sent out.
@@ -464,6 +467,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_STAT_AMPDU                 = BIT(10),
         IEEE80211_TX_STAT_AMPDU_NO_BACK         = BIT(11),
         IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(12),
+        IEEE80211_TX_INTFL_OFFCHAN_TX_OK        = BIT(13),
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8f6b593a921f..e3dec80cf617 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2749,7 +2749,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 goto out_unlock;
         }
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
         if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
                 IEEE80211_SKB_CB(skb)->hw_queue =
                         local->hw.offchannel_tx_hw_queue;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 5635dfc7da34..76cdcfcd614c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -809,6 +809,7 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
+        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 };
 
 #ifdef CONFIG_MAC80211_LEDS
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 76cacdb062c8..efb22763d56d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -685,7 +685,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
         if (powersave)
                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL))
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 82baf5b6ecf4..4c3ee3e8285c 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -113,6 +113,10 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
          * notify the AP about us leaving the channel and stop all
          * STA interfaces.
          */
+
+        ieee80211_stop_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
+
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
@@ -133,12 +137,9 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
                 }
 
-                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        netif_tx_stop_all_queues(sdata->dev);
-                        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                            sdata->u.mgd.associated)
-                                ieee80211_offchannel_ps_enable(sdata);
-                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.associated)
+                        ieee80211_offchannel_ps_enable(sdata);
         }
         mutex_unlock(&local->iflist_mtx);
 }
@@ -166,20 +167,6 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
                     sdata->u.mgd.associated)
                         ieee80211_offchannel_ps_disable(sdata);
 
-                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        /*
-                         * This may wake up queues even though the driver
-                         * currently has them stopped. This is not very
-                         * likely, since the driver won't have gotten any
-                         * (or hardly any) new packets while we weren't
-                         * on the right channel, and even if it happens
-                         * it will at most lead to queueing up one more
-                         * packet per queue in mac80211 rather than on
-                         * the interface qdisc.
-                         */
-                        netif_tx_wake_all_queues(sdata->dev);
-                }
-
                 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
                                        &sdata->state)) {
                         sdata->vif.bss_conf.enable_beacon = true;
@@ -188,6 +175,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
                 }
         }
         mutex_unlock(&local->iflist_mtx);
+
+        ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
 }
 
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index edd47d9acb99..d9e2df96f676 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -382,6 +382,11 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
         int i;
         struct ieee80211_sub_if_data *sdata;
         enum ieee80211_band band = local->hw.conf.channel->band;
+        u32 tx_flags;
+
+        tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
+        if (local->scan_req->no_cck)
+                tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 
         sdata = rcu_dereference_protected(local->scan_sdata,
                                           lockdep_is_held(&local->mtx));
@@ -393,9 +398,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                         local->scan_req->ssids[i].ssid_len,
                         local->scan_req->ie, local->scan_req->ie_len,
                         local->scan_req->rates[band], false,
-                        local->scan_req->no_cck ?
-                                IEEE80211_TX_CTL_NO_CCK_RATE : 0,
-                        local->hw.conf.channel, true);
+                        tx_flags, local->hw.conf.channel, true);
 
         /*
          * After sending probe requests, wait for probe responses
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 2ef0e19b06bb..f476aa6a771d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1230,6 +1230,21 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 if (local->queue_stop_reasons[q] ||
                     (!txpending && !skb_queue_empty(&local->pending[q]))) {
+                        if (unlikely(info->flags &
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK &&
+                                     local->queue_stop_reasons[q] &
+                                        ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL))) {
+                                /*
+                                 * Drop off-channel frames if queues are stopped
+                                 * for any reason other than off-channel
+                                 * operation. Never queue them.
+                                 */
+                                spin_unlock_irqrestore(
+                                        &local->queue_stop_reason_lock, flags);
+                                ieee80211_purge_tx_queue(&local->hw, skbs);
+                                return true;
+                        }
+
                         /*
                          * Since queue is stopped, queue up frames for later
                          * transmission from the tx-pending tasklet when the