1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
7  * Copyright (C) 2018 Intel Corporation
8  */
9 
10 /*
11  * TODO:
12  * - Add TSF sync and fix IBSS beacon transmission by adding
13  *   competition for "air time" at TBTT
14  * - RX filtering based on filter configuration (data->rx_filter)
15  */
16 
17 #include <linux/list.h>
18 #include <linux/slab.h>
19 #include <linux/spinlock.h>
20 #include <net/dst.h>
21 #include <net/xfrm.h>
22 #include <net/mac80211.h>
23 #include <net/ieee80211_radiotap.h>
24 #include <linux/if_arp.h>
25 #include <linux/rtnetlink.h>
26 #include <linux/etherdevice.h>
27 #include <linux/platform_device.h>
28 #include <linux/debugfs.h>
29 #include <linux/module.h>
30 #include <linux/ktime.h>
31 #include <net/genetlink.h>
32 #include <net/net_namespace.h>
33 #include <net/netns/generic.h>
34 #include <linux/rhashtable.h>
35 #include <linux/nospec.h>
36 #include "mac80211_hwsim.h"
37 
38 #define WARN_QUEUE 100
39 #define MAX_QUEUE 200
40 
41 MODULE_AUTHOR("Jouni Malinen");
42 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
43 MODULE_LICENSE("GPL");
44 
45 static int radios = 2;
46 module_param(radios, int, 0444);
47 MODULE_PARM_DESC(radios, "Number of simulated radios");
48 
49 static int channels = 1;
50 module_param(channels, int, 0444);
51 MODULE_PARM_DESC(channels, "Number of concurrent channels");
52 
53 static bool paged_rx = false;
54 module_param(paged_rx, bool, 0644);
55 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
56 
57 static bool rctbl = false;
58 module_param(rctbl, bool, 0444);
59 MODULE_PARM_DESC(rctbl, "Handle rate control table");
60 
61 static bool support_p2p_device = true;
62 module_param(support_p2p_device, bool, 0444);
63 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
64 
65 /**
66  * enum hwsim_regtest - the type of regulatory tests we offer
67  *
68  * These are the different values you can use for the regtest
69  * module parameter. This is useful to help test world roaming
70  * and the driver regulatory_hint() call and combinations of these.
71  * If you want to do specific alpha2 regulatory domain tests simply
72  * use the userspace regulatory request as that will be respected as
73  * well without the need of this module parameter. This is designed
74  * only for testing the driver regulatory request, world roaming
75  * and all possible combinations.
76  *
77  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
78  * 	this is the default value.
79  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
80  *	hint, only one driver regulatory hint will be sent as such the
81  * 	secondary radios are expected to follow.
82  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
83  * 	request with all radios reporting the same regulatory domain.
84  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
85  * 	different regulatory domains requests. Expected behaviour is for
86  * 	an intersection to occur but each device will still use their
87  * 	respective regulatory requested domains. Subsequent radios will
88  * 	use the resulting intersection.
89  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
90  *	this by using a custom beacon-capable regulatory domain for the first
91  *	radio. All other device world roam.
92  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
93  * 	domain requests. All radios will adhere to this custom world regulatory
94  * 	domain.
95  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
96  * 	domain requests. The first radio will adhere to the first custom world
97  * 	regulatory domain, the second one to the second custom world regulatory
98  * 	domain. All other devices will world roam.
99  * @HWSIM_REGTEST_STRICT_FOLLOW_: Used for testing strict regulatory domain
100  *	settings, only the first radio will send a regulatory domain request
101  *	and use strict settings. The rest of the radios are expected to follow.
102  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
103  *	settings. All radios will adhere to this.
104  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
105  *	domain settings, combined with secondary driver regulatory domain
106  *	settings. The first radio will get a strict regulatory domain setting
107  *	using the first driver regulatory request and the second radio will use
108  *	non-strict settings using the second driver regulatory request. All
109  *	other devices should follow the intersection created between the
110  *	first two.
111  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
112  * 	at least 6 radios for a complete test. We will test in this order:
113  * 	1 - driver custom world regulatory domain
114  * 	2 - second custom world regulatory domain
115  * 	3 - first driver regulatory domain request
116  * 	4 - second driver regulatory domain request
117  * 	5 - strict regulatory domain settings using the third driver regulatory
118  * 	    domain request
119  * 	6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
120  * 	           regulatory requests.
121  */
122 enum hwsim_regtest {
123 	HWSIM_REGTEST_DISABLED = 0,
124 	HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
125 	HWSIM_REGTEST_DRIVER_REG_ALL = 2,
126 	HWSIM_REGTEST_DIFF_COUNTRY = 3,
127 	HWSIM_REGTEST_WORLD_ROAM = 4,
128 	HWSIM_REGTEST_CUSTOM_WORLD = 5,
129 	HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
130 	HWSIM_REGTEST_STRICT_FOLLOW = 7,
131 	HWSIM_REGTEST_STRICT_ALL = 8,
132 	HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
133 	HWSIM_REGTEST_ALL = 10,
134 };
135 
136 /* Set to one of the HWSIM_REGTEST_* values above */
137 static int regtest = HWSIM_REGTEST_DISABLED;
138 module_param(regtest, int, 0444);
139 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
140 
141 static const char *hwsim_alpha2s[] = {
142 	"FI",
143 	"AL",
144 	"US",
145 	"DE",
146 	"JP",
147 	"AL",
148 };
149 
150 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
151 	.n_reg_rules = 4,
152 	.alpha2 =  "99",
153 	.reg_rules = {
154 		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
155 		REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
156 		REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
157 		REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
158 	}
159 };
160 
161 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
162 	.n_reg_rules = 2,
163 	.alpha2 =  "99",
164 	.reg_rules = {
165 		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
166 		REG_RULE(5725-10, 5850+10, 40, 0, 30,
167 			 NL80211_RRF_NO_IR),
168 	}
169 };
170 
171 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
172 	&hwsim_world_regdom_custom_01,
173 	&hwsim_world_regdom_custom_02,
174 };
175 
176 struct hwsim_vif_priv {
177 	u32 magic;
178 	u8 bssid[ETH_ALEN];
179 	bool assoc;
180 	bool bcn_en;
181 	u16 aid;
182 };
183 
184 #define HWSIM_VIF_MAGIC	0x69537748
185 
hwsim_check_magic(struct ieee80211_vif * vif)186 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
187 {
188 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
189 	WARN(vp->magic != HWSIM_VIF_MAGIC,
190 	     "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
191 	     vif, vp->magic, vif->addr, vif->type, vif->p2p);
192 }
193 
hwsim_set_magic(struct ieee80211_vif * vif)194 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
195 {
196 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
197 	vp->magic = HWSIM_VIF_MAGIC;
198 }
199 
hwsim_clear_magic(struct ieee80211_vif * vif)200 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
201 {
202 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
203 	vp->magic = 0;
204 }
205 
206 struct hwsim_sta_priv {
207 	u32 magic;
208 };
209 
210 #define HWSIM_STA_MAGIC	0x6d537749
211 
hwsim_check_sta_magic(struct ieee80211_sta * sta)212 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
213 {
214 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
215 	WARN_ON(sp->magic != HWSIM_STA_MAGIC);
216 }
217 
hwsim_set_sta_magic(struct ieee80211_sta * sta)218 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
219 {
220 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
221 	sp->magic = HWSIM_STA_MAGIC;
222 }
223 
hwsim_clear_sta_magic(struct ieee80211_sta * sta)224 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
225 {
226 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
227 	sp->magic = 0;
228 }
229 
230 struct hwsim_chanctx_priv {
231 	u32 magic;
232 };
233 
234 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
235 
hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf * c)236 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
237 {
238 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
239 	WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
240 }
241 
hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf * c)242 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
243 {
244 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
245 	cp->magic = HWSIM_CHANCTX_MAGIC;
246 }
247 
hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf * c)248 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
249 {
250 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
251 	cp->magic = 0;
252 }
253 
254 static unsigned int hwsim_net_id;
255 
256 static DEFINE_IDA(hwsim_netgroup_ida);
257 
258 struct hwsim_net {
259 	int netgroup;
260 	u32 wmediumd;
261 };
262 
hwsim_net_get_netgroup(struct net * net)263 static inline int hwsim_net_get_netgroup(struct net *net)
264 {
265 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
266 
267 	return hwsim_net->netgroup;
268 }
269 
hwsim_net_set_netgroup(struct net * net)270 static inline int hwsim_net_set_netgroup(struct net *net)
271 {
272 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
273 
274 	hwsim_net->netgroup = ida_simple_get(&hwsim_netgroup_ida,
275 					     0, 0, GFP_KERNEL);
276 	return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
277 }
278 
hwsim_net_get_wmediumd(struct net * net)279 static inline u32 hwsim_net_get_wmediumd(struct net *net)
280 {
281 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
282 
283 	return hwsim_net->wmediumd;
284 }
285 
hwsim_net_set_wmediumd(struct net * net,u32 portid)286 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
287 {
288 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
289 
290 	hwsim_net->wmediumd = portid;
291 }
292 
293 static struct class *hwsim_class;
294 
295 static struct net_device *hwsim_mon; /* global monitor netdev */
296 
297 #define CHAN2G(_freq)  { \
298 	.band = NL80211_BAND_2GHZ, \
299 	.center_freq = (_freq), \
300 	.hw_value = (_freq), \
301 	.max_power = 20, \
302 }
303 
304 #define CHAN5G(_freq) { \
305 	.band = NL80211_BAND_5GHZ, \
306 	.center_freq = (_freq), \
307 	.hw_value = (_freq), \
308 	.max_power = 20, \
309 }
310 
311 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
312 	CHAN2G(2412), /* Channel 1 */
313 	CHAN2G(2417), /* Channel 2 */
314 	CHAN2G(2422), /* Channel 3 */
315 	CHAN2G(2427), /* Channel 4 */
316 	CHAN2G(2432), /* Channel 5 */
317 	CHAN2G(2437), /* Channel 6 */
318 	CHAN2G(2442), /* Channel 7 */
319 	CHAN2G(2447), /* Channel 8 */
320 	CHAN2G(2452), /* Channel 9 */
321 	CHAN2G(2457), /* Channel 10 */
322 	CHAN2G(2462), /* Channel 11 */
323 	CHAN2G(2467), /* Channel 12 */
324 	CHAN2G(2472), /* Channel 13 */
325 	CHAN2G(2484), /* Channel 14 */
326 };
327 
328 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
329 	CHAN5G(5180), /* Channel 36 */
330 	CHAN5G(5200), /* Channel 40 */
331 	CHAN5G(5220), /* Channel 44 */
332 	CHAN5G(5240), /* Channel 48 */
333 
334 	CHAN5G(5260), /* Channel 52 */
335 	CHAN5G(5280), /* Channel 56 */
336 	CHAN5G(5300), /* Channel 60 */
337 	CHAN5G(5320), /* Channel 64 */
338 
339 	CHAN5G(5500), /* Channel 100 */
340 	CHAN5G(5520), /* Channel 104 */
341 	CHAN5G(5540), /* Channel 108 */
342 	CHAN5G(5560), /* Channel 112 */
343 	CHAN5G(5580), /* Channel 116 */
344 	CHAN5G(5600), /* Channel 120 */
345 	CHAN5G(5620), /* Channel 124 */
346 	CHAN5G(5640), /* Channel 128 */
347 	CHAN5G(5660), /* Channel 132 */
348 	CHAN5G(5680), /* Channel 136 */
349 	CHAN5G(5700), /* Channel 140 */
350 
351 	CHAN5G(5745), /* Channel 149 */
352 	CHAN5G(5765), /* Channel 153 */
353 	CHAN5G(5785), /* Channel 157 */
354 	CHAN5G(5805), /* Channel 161 */
355 	CHAN5G(5825), /* Channel 165 */
356 	CHAN5G(5845), /* Channel 169 */
357 };
358 
359 static const struct ieee80211_rate hwsim_rates[] = {
360 	{ .bitrate = 10 },
361 	{ .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
362 	{ .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
363 	{ .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
364 	{ .bitrate = 60 },
365 	{ .bitrate = 90 },
366 	{ .bitrate = 120 },
367 	{ .bitrate = 180 },
368 	{ .bitrate = 240 },
369 	{ .bitrate = 360 },
370 	{ .bitrate = 480 },
371 	{ .bitrate = 540 }
372 };
373 
374 static const u32 hwsim_ciphers[] = {
375 	WLAN_CIPHER_SUITE_WEP40,
376 	WLAN_CIPHER_SUITE_WEP104,
377 	WLAN_CIPHER_SUITE_TKIP,
378 	WLAN_CIPHER_SUITE_CCMP,
379 	WLAN_CIPHER_SUITE_CCMP_256,
380 	WLAN_CIPHER_SUITE_GCMP,
381 	WLAN_CIPHER_SUITE_GCMP_256,
382 	WLAN_CIPHER_SUITE_AES_CMAC,
383 	WLAN_CIPHER_SUITE_BIP_CMAC_256,
384 	WLAN_CIPHER_SUITE_BIP_GMAC_128,
385 	WLAN_CIPHER_SUITE_BIP_GMAC_256,
386 };
387 
388 #define OUI_QCA 0x001374
389 #define QCA_NL80211_SUBCMD_TEST 1
390 enum qca_nl80211_vendor_subcmds {
391 	QCA_WLAN_VENDOR_ATTR_TEST = 8,
392 	QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
393 };
394 
395 static const struct nla_policy
396 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
397 	[QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
398 };
399 
mac80211_hwsim_vendor_cmd_test(struct wiphy * wiphy,struct wireless_dev * wdev,const void * data,int data_len)400 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
401 					  struct wireless_dev *wdev,
402 					  const void *data, int data_len)
403 {
404 	struct sk_buff *skb;
405 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
406 	int err;
407 	u32 val;
408 
409 	err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
410 				   data_len, hwsim_vendor_test_policy, NULL);
411 	if (err)
412 		return err;
413 	if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
414 		return -EINVAL;
415 	val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
416 	wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
417 
418 	/* Send a vendor event as a test. Note that this would not normally be
419 	 * done within a command handler, but rather, based on some other
420 	 * trigger. For simplicity, this command is used to trigger the event
421 	 * here.
422 	 *
423 	 * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
424 	 */
425 	skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
426 	if (skb) {
427 		/* skb_put() or nla_put() will fill up data within
428 		 * NL80211_ATTR_VENDOR_DATA.
429 		 */
430 
431 		/* Add vendor data */
432 		nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
433 
434 		/* Send the event - this will call nla_nest_end() */
435 		cfg80211_vendor_event(skb, GFP_KERNEL);
436 	}
437 
438 	/* Send a response to the command */
439 	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
440 	if (!skb)
441 		return -ENOMEM;
442 
443 	/* skb_put() or nla_put() will fill up data within
444 	 * NL80211_ATTR_VENDOR_DATA
445 	 */
446 	nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
447 
448 	return cfg80211_vendor_cmd_reply(skb);
449 }
450 
451 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
452 	{
453 		.info = { .vendor_id = OUI_QCA,
454 			  .subcmd = QCA_NL80211_SUBCMD_TEST },
455 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
456 		.doit = mac80211_hwsim_vendor_cmd_test,
457 		.policy = hwsim_vendor_test_policy,
458 		.maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
459 	}
460 };
461 
462 /* Advertise support vendor specific events */
463 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
464 	{ .vendor_id = OUI_QCA, .subcmd = 1 },
465 };
466 
467 static spinlock_t hwsim_radio_lock;
468 static LIST_HEAD(hwsim_radios);
469 static struct rhashtable hwsim_radios_rht;
470 static int hwsim_radio_idx;
471 static int hwsim_radios_generation = 1;
472 
473 static struct platform_driver mac80211_hwsim_driver = {
474 	.driver = {
475 		.name = "mac80211_hwsim",
476 	},
477 };
478 
479 struct mac80211_hwsim_data {
480 	struct list_head list;
481 	struct rhash_head rht;
482 	struct ieee80211_hw *hw;
483 	struct device *dev;
484 	struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
485 	struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
486 	struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
487 	struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
488 	struct ieee80211_iface_combination if_combination;
489 	struct ieee80211_iface_limit if_limits[3];
490 	int n_if_limits;
491 
492 	u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
493 
494 	struct mac_address addresses[2];
495 	int channels, idx;
496 	bool use_chanctx;
497 	bool destroy_on_close;
498 	u32 portid;
499 	char alpha2[2];
500 	const struct ieee80211_regdomain *regd;
501 
502 	struct ieee80211_channel *tmp_chan;
503 	struct ieee80211_channel *roc_chan;
504 	u32 roc_duration;
505 	struct delayed_work roc_start;
506 	struct delayed_work roc_done;
507 	struct delayed_work hw_scan;
508 	struct cfg80211_scan_request *hw_scan_request;
509 	struct ieee80211_vif *hw_scan_vif;
510 	int scan_chan_idx;
511 	u8 scan_addr[ETH_ALEN];
512 	struct {
513 		struct ieee80211_channel *channel;
514 		unsigned long next_start, start, end;
515 	} survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
516 		      ARRAY_SIZE(hwsim_channels_5ghz)];
517 
518 	struct ieee80211_channel *channel;
519 	u64 beacon_int	/* beacon interval in us */;
520 	unsigned int rx_filter;
521 	bool started, idle, scanning;
522 	struct mutex mutex;
523 	struct hrtimer beacon_timer;
524 	enum ps_mode {
525 		PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
526 	} ps;
527 	bool ps_poll_pending;
528 	struct dentry *debugfs;
529 
530 	uintptr_t pending_cookie;
531 	struct sk_buff_head pending;	/* packets pending */
532 	/*
533 	 * Only radios in the same group can communicate together (the
534 	 * channel has to match too). Each bit represents a group. A
535 	 * radio can be in more than one group.
536 	 */
537 	u64 group;
538 
539 	/* group shared by radios created in the same netns */
540 	int netgroup;
541 	/* wmediumd portid responsible for netgroup of this radio */
542 	u32 wmediumd;
543 
544 	/* difference between this hw's clock and the real clock, in usecs */
545 	s64 tsf_offset;
546 	s64 bcn_delta;
547 	/* absolute beacon transmission time. Used to cover up "tx" delay. */
548 	u64 abs_bcn_ts;
549 
550 	/* Stats */
551 	u64 tx_pkts;
552 	u64 rx_pkts;
553 	u64 tx_bytes;
554 	u64 rx_bytes;
555 	u64 tx_dropped;
556 	u64 tx_failed;
557 };
558 
559 static const struct rhashtable_params hwsim_rht_params = {
560 	.nelem_hint = 2,
561 	.automatic_shrinking = true,
562 	.key_len = ETH_ALEN,
563 	.key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
564 	.head_offset = offsetof(struct mac80211_hwsim_data, rht),
565 };
566 
567 struct hwsim_radiotap_hdr {
568 	struct ieee80211_radiotap_header hdr;
569 	__le64 rt_tsft;
570 	u8 rt_flags;
571 	u8 rt_rate;
572 	__le16 rt_channel;
573 	__le16 rt_chbitmask;
574 } __packed;
575 
576 struct hwsim_radiotap_ack_hdr {
577 	struct ieee80211_radiotap_header hdr;
578 	u8 rt_flags;
579 	u8 pad;
580 	__le16 rt_channel;
581 	__le16 rt_chbitmask;
582 } __packed;
583 
584 /* MAC80211_HWSIM netlink family */
585 static struct genl_family hwsim_genl_family;
586 
587 enum hwsim_multicast_groups {
588 	HWSIM_MCGRP_CONFIG,
589 };
590 
591 static const struct genl_multicast_group hwsim_mcgrps[] = {
592 	[HWSIM_MCGRP_CONFIG] = { .name = "config", },
593 };
594 
595 /* MAC80211_HWSIM netlink policy */
596 
597 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
598 	[HWSIM_ATTR_ADDR_RECEIVER] = { .type = NLA_UNSPEC, .len = ETH_ALEN },
599 	[HWSIM_ATTR_ADDR_TRANSMITTER] = { .type = NLA_UNSPEC, .len = ETH_ALEN },
600 	[HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
601 			       .len = IEEE80211_MAX_DATA_LEN },
602 	[HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
603 	[HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
604 	[HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
605 	[HWSIM_ATTR_TX_INFO] = { .type = NLA_UNSPEC,
606 				 .len = IEEE80211_TX_MAX_RATES *
607 					sizeof(struct hwsim_tx_rate)},
608 	[HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
609 	[HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
610 	[HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
611 	[HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
612 	[HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
613 	[HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
614 	[HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
615 	[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
616 	[HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
617 	[HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
618 	[HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
619 	[HWSIM_ATTR_PERM_ADDR] = { .type = NLA_UNSPEC, .len = ETH_ALEN },
620 	[HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
621 	[HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
622 };
623 
624 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
625 				    struct sk_buff *skb,
626 				    struct ieee80211_channel *chan);
627 
628 /* sysfs attributes */
hwsim_send_ps_poll(void * dat,u8 * mac,struct ieee80211_vif * vif)629 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
630 {
631 	struct mac80211_hwsim_data *data = dat;
632 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
633 	struct sk_buff *skb;
634 	struct ieee80211_pspoll *pspoll;
635 
636 	if (!vp->assoc)
637 		return;
638 
639 	wiphy_dbg(data->hw->wiphy,
640 		  "%s: send PS-Poll to %pM for aid %d\n",
641 		  __func__, vp->bssid, vp->aid);
642 
643 	skb = dev_alloc_skb(sizeof(*pspoll));
644 	if (!skb)
645 		return;
646 	pspoll = skb_put(skb, sizeof(*pspoll));
647 	pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
648 					    IEEE80211_STYPE_PSPOLL |
649 					    IEEE80211_FCTL_PM);
650 	pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
651 	memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
652 	memcpy(pspoll->ta, mac, ETH_ALEN);
653 
654 	rcu_read_lock();
655 	mac80211_hwsim_tx_frame(data->hw, skb,
656 				rcu_dereference(vif->chanctx_conf)->def.chan);
657 	rcu_read_unlock();
658 }
659 
hwsim_send_nullfunc(struct mac80211_hwsim_data * data,u8 * mac,struct ieee80211_vif * vif,int ps)660 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
661 				struct ieee80211_vif *vif, int ps)
662 {
663 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
664 	struct sk_buff *skb;
665 	struct ieee80211_hdr *hdr;
666 
667 	if (!vp->assoc)
668 		return;
669 
670 	wiphy_dbg(data->hw->wiphy,
671 		  "%s: send data::nullfunc to %pM ps=%d\n",
672 		  __func__, vp->bssid, ps);
673 
674 	skb = dev_alloc_skb(sizeof(*hdr));
675 	if (!skb)
676 		return;
677 	hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
678 	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
679 					 IEEE80211_STYPE_NULLFUNC |
680 					 IEEE80211_FCTL_TODS |
681 					 (ps ? IEEE80211_FCTL_PM : 0));
682 	hdr->duration_id = cpu_to_le16(0);
683 	memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
684 	memcpy(hdr->addr2, mac, ETH_ALEN);
685 	memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
686 
687 	rcu_read_lock();
688 	mac80211_hwsim_tx_frame(data->hw, skb,
689 				rcu_dereference(vif->chanctx_conf)->def.chan);
690 	rcu_read_unlock();
691 }
692 
693 
hwsim_send_nullfunc_ps(void * dat,u8 * mac,struct ieee80211_vif * vif)694 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
695 				   struct ieee80211_vif *vif)
696 {
697 	struct mac80211_hwsim_data *data = dat;
698 	hwsim_send_nullfunc(data, mac, vif, 1);
699 }
700 
hwsim_send_nullfunc_no_ps(void * dat,u8 * mac,struct ieee80211_vif * vif)701 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
702 				      struct ieee80211_vif *vif)
703 {
704 	struct mac80211_hwsim_data *data = dat;
705 	hwsim_send_nullfunc(data, mac, vif, 0);
706 }
707 
hwsim_fops_ps_read(void * dat,u64 * val)708 static int hwsim_fops_ps_read(void *dat, u64 *val)
709 {
710 	struct mac80211_hwsim_data *data = dat;
711 	*val = data->ps;
712 	return 0;
713 }
714 
hwsim_fops_ps_write(void * dat,u64 val)715 static int hwsim_fops_ps_write(void *dat, u64 val)
716 {
717 	struct mac80211_hwsim_data *data = dat;
718 	enum ps_mode old_ps;
719 
720 	if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
721 	    val != PS_MANUAL_POLL)
722 		return -EINVAL;
723 
724 	if (val == PS_MANUAL_POLL) {
725 		if (data->ps != PS_ENABLED)
726 			return -EINVAL;
727 		local_bh_disable();
728 		ieee80211_iterate_active_interfaces_atomic(
729 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
730 			hwsim_send_ps_poll, data);
731 		local_bh_enable();
732 		return 0;
733 	}
734 	old_ps = data->ps;
735 	data->ps = val;
736 
737 	local_bh_disable();
738 	if (old_ps == PS_DISABLED && val != PS_DISABLED) {
739 		ieee80211_iterate_active_interfaces_atomic(
740 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
741 			hwsim_send_nullfunc_ps, data);
742 	} else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
743 		ieee80211_iterate_active_interfaces_atomic(
744 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
745 			hwsim_send_nullfunc_no_ps, data);
746 	}
747 	local_bh_enable();
748 
749 	return 0;
750 }
751 
752 DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
753 			"%llu\n");
754 
hwsim_write_simulate_radar(void * dat,u64 val)755 static int hwsim_write_simulate_radar(void *dat, u64 val)
756 {
757 	struct mac80211_hwsim_data *data = dat;
758 
759 	ieee80211_radar_detected(data->hw);
760 
761 	return 0;
762 }
763 
764 DEFINE_SIMPLE_ATTRIBUTE(hwsim_simulate_radar, NULL,
765 			hwsim_write_simulate_radar, "%llu\n");
766 
hwsim_fops_group_read(void * dat,u64 * val)767 static int hwsim_fops_group_read(void *dat, u64 *val)
768 {
769 	struct mac80211_hwsim_data *data = dat;
770 	*val = data->group;
771 	return 0;
772 }
773 
hwsim_fops_group_write(void * dat,u64 val)774 static int hwsim_fops_group_write(void *dat, u64 val)
775 {
776 	struct mac80211_hwsim_data *data = dat;
777 	data->group = val;
778 	return 0;
779 }
780 
781 DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_group,
782 			hwsim_fops_group_read, hwsim_fops_group_write,
783 			"%llx\n");
784 
hwsim_mon_xmit(struct sk_buff * skb,struct net_device * dev)785 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
786 					struct net_device *dev)
787 {
788 	/* TODO: allow packet injection */
789 	dev_kfree_skb(skb);
790 	return NETDEV_TX_OK;
791 }
792 
mac80211_hwsim_get_tsf_raw(void)793 static inline u64 mac80211_hwsim_get_tsf_raw(void)
794 {
795 	return ktime_to_us(ktime_get_real());
796 }
797 
__mac80211_hwsim_get_tsf(struct mac80211_hwsim_data * data)798 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
799 {
800 	u64 now = mac80211_hwsim_get_tsf_raw();
801 	return cpu_to_le64(now + data->tsf_offset);
802 }
803 
mac80211_hwsim_get_tsf(struct ieee80211_hw * hw,struct ieee80211_vif * vif)804 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
805 				  struct ieee80211_vif *vif)
806 {
807 	struct mac80211_hwsim_data *data = hw->priv;
808 	return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
809 }
810 
mac80211_hwsim_set_tsf(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u64 tsf)811 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
812 		struct ieee80211_vif *vif, u64 tsf)
813 {
814 	struct mac80211_hwsim_data *data = hw->priv;
815 	u64 now = mac80211_hwsim_get_tsf(hw, vif);
816 	u32 bcn_int = data->beacon_int;
817 	u64 delta = abs(tsf - now);
818 
819 	/* adjust after beaconing with new timestamp at old TBTT */
820 	if (tsf > now) {
821 		data->tsf_offset += delta;
822 		data->bcn_delta = do_div(delta, bcn_int);
823 	} else {
824 		data->tsf_offset -= delta;
825 		data->bcn_delta = -(s64)do_div(delta, bcn_int);
826 	}
827 }
828 
mac80211_hwsim_monitor_rx(struct ieee80211_hw * hw,struct sk_buff * tx_skb,struct ieee80211_channel * chan)829 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
830 				      struct sk_buff *tx_skb,
831 				      struct ieee80211_channel *chan)
832 {
833 	struct mac80211_hwsim_data *data = hw->priv;
834 	struct sk_buff *skb;
835 	struct hwsim_radiotap_hdr *hdr;
836 	u16 flags;
837 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
838 	struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
839 
840 	if (WARN_ON(!txrate))
841 		return;
842 
843 	if (!netif_running(hwsim_mon))
844 		return;
845 
846 	skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
847 	if (skb == NULL)
848 		return;
849 
850 	hdr = skb_push(skb, sizeof(*hdr));
851 	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
852 	hdr->hdr.it_pad = 0;
853 	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
854 	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
855 					  (1 << IEEE80211_RADIOTAP_RATE) |
856 					  (1 << IEEE80211_RADIOTAP_TSFT) |
857 					  (1 << IEEE80211_RADIOTAP_CHANNEL));
858 	hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
859 	hdr->rt_flags = 0;
860 	hdr->rt_rate = txrate->bitrate / 5;
861 	hdr->rt_channel = cpu_to_le16(chan->center_freq);
862 	flags = IEEE80211_CHAN_2GHZ;
863 	if (txrate->flags & IEEE80211_RATE_ERP_G)
864 		flags |= IEEE80211_CHAN_OFDM;
865 	else
866 		flags |= IEEE80211_CHAN_CCK;
867 	hdr->rt_chbitmask = cpu_to_le16(flags);
868 
869 	skb->dev = hwsim_mon;
870 	skb_reset_mac_header(skb);
871 	skb->ip_summed = CHECKSUM_UNNECESSARY;
872 	skb->pkt_type = PACKET_OTHERHOST;
873 	skb->protocol = htons(ETH_P_802_2);
874 	memset(skb->cb, 0, sizeof(skb->cb));
875 	netif_rx(skb);
876 }
877 
878 
mac80211_hwsim_monitor_ack(struct ieee80211_channel * chan,const u8 * addr)879 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
880 				       const u8 *addr)
881 {
882 	struct sk_buff *skb;
883 	struct hwsim_radiotap_ack_hdr *hdr;
884 	u16 flags;
885 	struct ieee80211_hdr *hdr11;
886 
887 	if (!netif_running(hwsim_mon))
888 		return;
889 
890 	skb = dev_alloc_skb(100);
891 	if (skb == NULL)
892 		return;
893 
894 	hdr = skb_put(skb, sizeof(*hdr));
895 	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
896 	hdr->hdr.it_pad = 0;
897 	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
898 	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
899 					  (1 << IEEE80211_RADIOTAP_CHANNEL));
900 	hdr->rt_flags = 0;
901 	hdr->pad = 0;
902 	hdr->rt_channel = cpu_to_le16(chan->center_freq);
903 	flags = IEEE80211_CHAN_2GHZ;
904 	hdr->rt_chbitmask = cpu_to_le16(flags);
905 
906 	hdr11 = skb_put(skb, 10);
907 	hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
908 					   IEEE80211_STYPE_ACK);
909 	hdr11->duration_id = cpu_to_le16(0);
910 	memcpy(hdr11->addr1, addr, ETH_ALEN);
911 
912 	skb->dev = hwsim_mon;
913 	skb_reset_mac_header(skb);
914 	skb->ip_summed = CHECKSUM_UNNECESSARY;
915 	skb->pkt_type = PACKET_OTHERHOST;
916 	skb->protocol = htons(ETH_P_802_2);
917 	memset(skb->cb, 0, sizeof(skb->cb));
918 	netif_rx(skb);
919 }
920 
921 struct mac80211_hwsim_addr_match_data {
922 	u8 addr[ETH_ALEN];
923 	bool ret;
924 };
925 
mac80211_hwsim_addr_iter(void * data,u8 * mac,struct ieee80211_vif * vif)926 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
927 				     struct ieee80211_vif *vif)
928 {
929 	struct mac80211_hwsim_addr_match_data *md = data;
930 
931 	if (memcmp(mac, md->addr, ETH_ALEN) == 0)
932 		md->ret = true;
933 }
934 
mac80211_hwsim_addr_match(struct mac80211_hwsim_data * data,const u8 * addr)935 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
936 				      const u8 *addr)
937 {
938 	struct mac80211_hwsim_addr_match_data md = {
939 		.ret = false,
940 	};
941 
942 	if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
943 		return true;
944 
945 	memcpy(md.addr, addr, ETH_ALEN);
946 
947 	ieee80211_iterate_active_interfaces_atomic(data->hw,
948 						   IEEE80211_IFACE_ITER_NORMAL,
949 						   mac80211_hwsim_addr_iter,
950 						   &md);
951 
952 	return md.ret;
953 }
954 
hwsim_ps_rx_ok(struct mac80211_hwsim_data * data,struct sk_buff * skb)955 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
956 			   struct sk_buff *skb)
957 {
958 	switch (data->ps) {
959 	case PS_DISABLED:
960 		return true;
961 	case PS_ENABLED:
962 		return false;
963 	case PS_AUTO_POLL:
964 		/* TODO: accept (some) Beacons by default and other frames only
965 		 * if pending PS-Poll has been sent */
966 		return true;
967 	case PS_MANUAL_POLL:
968 		/* Allow unicast frames to own address if there is a pending
969 		 * PS-Poll */
970 		if (data->ps_poll_pending &&
971 		    mac80211_hwsim_addr_match(data, skb->data + 4)) {
972 			data->ps_poll_pending = false;
973 			return true;
974 		}
975 		return false;
976 	}
977 
978 	return true;
979 }
980 
hwsim_unicast_netgroup(struct mac80211_hwsim_data * data,struct sk_buff * skb,int portid)981 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
982 				  struct sk_buff *skb, int portid)
983 {
984 	struct net *net;
985 	bool found = false;
986 	int res = -ENOENT;
987 
988 	rcu_read_lock();
989 	for_each_net_rcu(net) {
990 		if (data->netgroup == hwsim_net_get_netgroup(net)) {
991 			res = genlmsg_unicast(net, skb, portid);
992 			found = true;
993 			break;
994 		}
995 	}
996 	rcu_read_unlock();
997 
998 	if (!found)
999 		nlmsg_free(skb);
1000 
1001 	return res;
1002 }
1003 
trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate * rate)1004 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1005 {
1006 	u16 result = 0;
1007 
1008 	if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1009 		result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1010 	if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1011 		result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1012 	if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1013 		result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1014 	if (rate->flags & IEEE80211_TX_RC_MCS)
1015 		result |= MAC80211_HWSIM_TX_RC_MCS;
1016 	if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1017 		result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1018 	if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1019 		result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1020 	if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1021 		result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1022 	if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1023 		result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1024 	if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1025 		result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1026 	if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1027 		result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1028 	if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1029 		result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1030 
1031 	return result;
1032 }
1033 
mac80211_hwsim_tx_frame_nl(struct ieee80211_hw * hw,struct sk_buff * my_skb,int dst_portid)1034 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1035 				       struct sk_buff *my_skb,
1036 				       int dst_portid)
1037 {
1038 	struct sk_buff *skb;
1039 	struct mac80211_hwsim_data *data = hw->priv;
1040 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1041 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1042 	void *msg_head;
1043 	unsigned int hwsim_flags = 0;
1044 	int i;
1045 	struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1046 	struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1047 	uintptr_t cookie;
1048 
1049 	if (data->ps != PS_DISABLED)
1050 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1051 	/* If the queue contains MAX_QUEUE skb's drop some */
1052 	if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1053 		/* Droping until WARN_QUEUE level */
1054 		while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1055 			ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1056 			data->tx_dropped++;
1057 		}
1058 	}
1059 
1060 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1061 	if (skb == NULL)
1062 		goto nla_put_failure;
1063 
1064 	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1065 			       HWSIM_CMD_FRAME);
1066 	if (msg_head == NULL) {
1067 		pr_debug("mac80211_hwsim: problem with msg_head\n");
1068 		goto nla_put_failure;
1069 	}
1070 
1071 	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1072 		    ETH_ALEN, data->addresses[1].addr))
1073 		goto nla_put_failure;
1074 
1075 	/* We get the skb->data */
1076 	if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1077 		goto nla_put_failure;
1078 
1079 	/* We get the flags for this transmission, and we translate them to
1080 	   wmediumd flags  */
1081 
1082 	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1083 		hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1084 
1085 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1086 		hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1087 
1088 	if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1089 		goto nla_put_failure;
1090 
1091 	if (nla_put_u32(skb, HWSIM_ATTR_FREQ, data->channel->center_freq))
1092 		goto nla_put_failure;
1093 
1094 	/* We get the tx control (rate and retries) info*/
1095 
1096 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1097 		tx_attempts[i].idx = info->status.rates[i].idx;
1098 		tx_attempts_flags[i].idx = info->status.rates[i].idx;
1099 		tx_attempts[i].count = info->status.rates[i].count;
1100 		tx_attempts_flags[i].flags =
1101 				trans_tx_rate_flags_ieee2hwsim(
1102 						&info->status.rates[i]);
1103 	}
1104 
1105 	if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1106 		    sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1107 		    tx_attempts))
1108 		goto nla_put_failure;
1109 
1110 	if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1111 		    sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1112 		    tx_attempts_flags))
1113 		goto nla_put_failure;
1114 
1115 	/* We create a cookie to identify this skb */
1116 	data->pending_cookie++;
1117 	cookie = data->pending_cookie;
1118 	info->rate_driver_data[0] = (void *)cookie;
1119 	if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1120 		goto nla_put_failure;
1121 
1122 	genlmsg_end(skb, msg_head);
1123 	if (hwsim_unicast_netgroup(data, skb, dst_portid))
1124 		goto err_free_txskb;
1125 
1126 	/* Enqueue the packet */
1127 	skb_queue_tail(&data->pending, my_skb);
1128 	data->tx_pkts++;
1129 	data->tx_bytes += my_skb->len;
1130 	return;
1131 
1132 nla_put_failure:
1133 	nlmsg_free(skb);
1134 err_free_txskb:
1135 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1136 	ieee80211_free_txskb(hw, my_skb);
1137 	data->tx_failed++;
1138 }
1139 
hwsim_chans_compat(struct ieee80211_channel * c1,struct ieee80211_channel * c2)1140 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1141 			       struct ieee80211_channel *c2)
1142 {
1143 	if (!c1 || !c2)
1144 		return false;
1145 
1146 	return c1->center_freq == c2->center_freq;
1147 }
1148 
1149 struct tx_iter_data {
1150 	struct ieee80211_channel *channel;
1151 	bool receive;
1152 };
1153 
mac80211_hwsim_tx_iter(void * _data,u8 * addr,struct ieee80211_vif * vif)1154 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1155 				   struct ieee80211_vif *vif)
1156 {
1157 	struct tx_iter_data *data = _data;
1158 
1159 	if (!vif->chanctx_conf)
1160 		return;
1161 
1162 	if (!hwsim_chans_compat(data->channel,
1163 				rcu_dereference(vif->chanctx_conf)->def.chan))
1164 		return;
1165 
1166 	data->receive = true;
1167 }
1168 
mac80211_hwsim_add_vendor_rtap(struct sk_buff * skb)1169 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1170 {
1171 	/*
1172 	 * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1173 	 * e.g. like this:
1174 	 * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1175 	 * (but you should use a valid OUI, not that)
1176 	 *
1177 	 * If anyone wants to 'donate' a radiotap OUI/subns code
1178 	 * please send a patch removing this #ifdef and changing
1179 	 * the values accordingly.
1180 	 */
1181 #ifdef HWSIM_RADIOTAP_OUI
1182 	struct ieee80211_vendor_radiotap *rtap;
1183 
1184 	/*
1185 	 * Note that this code requires the headroom in the SKB
1186 	 * that was allocated earlier.
1187 	 */
1188 	rtap = skb_push(skb, sizeof(*rtap) + 8 + 4);
1189 	rtap->oui[0] = HWSIM_RADIOTAP_OUI[0];
1190 	rtap->oui[1] = HWSIM_RADIOTAP_OUI[1];
1191 	rtap->oui[2] = HWSIM_RADIOTAP_OUI[2];
1192 	rtap->subns = 127;
1193 
1194 	/*
1195 	 * Radiotap vendor namespaces can (and should) also be
1196 	 * split into fields by using the standard radiotap
1197 	 * presence bitmap mechanism. Use just BIT(0) here for
1198 	 * the presence bitmap.
1199 	 */
1200 	rtap->present = BIT(0);
1201 	/* We have 8 bytes of (dummy) data */
1202 	rtap->len = 8;
1203 	/* For testing, also require it to be aligned */
1204 	rtap->align = 8;
1205 	/* And also test that padding works, 4 bytes */
1206 	rtap->pad = 4;
1207 	/* push the data */
1208 	memcpy(rtap->data, "ABCDEFGH", 8);
1209 	/* make sure to clear padding, mac80211 doesn't */
1210 	memset(rtap->data + 8, 0, 4);
1211 
1212 	IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
1213 #endif
1214 }
1215 
mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw * hw,struct sk_buff * skb,struct ieee80211_channel * chan)1216 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1217 					  struct sk_buff *skb,
1218 					  struct ieee80211_channel *chan)
1219 {
1220 	struct mac80211_hwsim_data *data = hw->priv, *data2;
1221 	bool ack = false;
1222 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1223 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1224 	struct ieee80211_rx_status rx_status;
1225 	u64 now;
1226 
1227 	memset(&rx_status, 0, sizeof(rx_status));
1228 	rx_status.flag |= RX_FLAG_MACTIME_START;
1229 	rx_status.freq = chan->center_freq;
1230 	rx_status.band = chan->band;
1231 	if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1232 		rx_status.rate_idx =
1233 			ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1234 		rx_status.nss =
1235 			ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1236 		rx_status.encoding = RX_ENC_VHT;
1237 	} else {
1238 		rx_status.rate_idx = info->control.rates[0].idx;
1239 		if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1240 			rx_status.encoding = RX_ENC_HT;
1241 	}
1242 	if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1243 		rx_status.bw = RATE_INFO_BW_40;
1244 	else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1245 		rx_status.bw = RATE_INFO_BW_80;
1246 	else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1247 		rx_status.bw = RATE_INFO_BW_160;
1248 	else
1249 		rx_status.bw = RATE_INFO_BW_20;
1250 	if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1251 		rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1252 	/* TODO: simulate real signal strength (and optional packet loss) */
1253 	rx_status.signal = -50;
1254 	if (info->control.vif)
1255 		rx_status.signal += info->control.vif->bss_conf.txpower;
1256 
1257 	if (data->ps != PS_DISABLED)
1258 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1259 
1260 	/* release the skb's source info */
1261 	skb_orphan(skb);
1262 	skb_dst_drop(skb);
1263 	skb->mark = 0;
1264 	skb_ext_reset(skb);
1265 	nf_reset_ct(skb);
1266 
1267 	/*
1268 	 * Get absolute mactime here so all HWs RX at the "same time", and
1269 	 * absolute TX time for beacon mactime so the timestamp matches.
1270 	 * Giving beacons a different mactime than non-beacons looks messy, but
1271 	 * it helps the Toffset be exact and a ~10us mactime discrepancy
1272 	 * probably doesn't really matter.
1273 	 */
1274 	if (ieee80211_is_beacon(hdr->frame_control) ||
1275 	    ieee80211_is_probe_resp(hdr->frame_control)) {
1276 		rx_status.boottime_ns = ktime_get_boottime_ns();
1277 		now = data->abs_bcn_ts;
1278 	} else {
1279 		now = mac80211_hwsim_get_tsf_raw();
1280 	}
1281 
1282 	/* Copy skb to all enabled radios that are on the current frequency */
1283 	spin_lock(&hwsim_radio_lock);
1284 	list_for_each_entry(data2, &hwsim_radios, list) {
1285 		struct sk_buff *nskb;
1286 		struct tx_iter_data tx_iter_data = {
1287 			.receive = false,
1288 			.channel = chan,
1289 		};
1290 
1291 		if (data == data2)
1292 			continue;
1293 
1294 		if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1295 		    !hwsim_ps_rx_ok(data2, skb))
1296 			continue;
1297 
1298 		if (!(data->group & data2->group))
1299 			continue;
1300 
1301 		if (data->netgroup != data2->netgroup)
1302 			continue;
1303 
1304 		if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1305 		    !hwsim_chans_compat(chan, data2->channel)) {
1306 			ieee80211_iterate_active_interfaces_atomic(
1307 				data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1308 				mac80211_hwsim_tx_iter, &tx_iter_data);
1309 			if (!tx_iter_data.receive)
1310 				continue;
1311 		}
1312 
1313 		/*
1314 		 * reserve some space for our vendor and the normal
1315 		 * radiotap header, since we're copying anyway
1316 		 */
1317 		if (skb->len < PAGE_SIZE && paged_rx) {
1318 			struct page *page = alloc_page(GFP_ATOMIC);
1319 
1320 			if (!page)
1321 				continue;
1322 
1323 			nskb = dev_alloc_skb(128);
1324 			if (!nskb) {
1325 				__free_page(page);
1326 				continue;
1327 			}
1328 
1329 			memcpy(page_address(page), skb->data, skb->len);
1330 			skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1331 		} else {
1332 			nskb = skb_copy(skb, GFP_ATOMIC);
1333 			if (!nskb)
1334 				continue;
1335 		}
1336 
1337 		if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1338 			ack = true;
1339 
1340 		rx_status.mactime = now + data2->tsf_offset;
1341 
1342 		memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
1343 
1344 		mac80211_hwsim_add_vendor_rtap(nskb);
1345 
1346 		data2->rx_pkts++;
1347 		data2->rx_bytes += nskb->len;
1348 		ieee80211_rx_irqsafe(data2->hw, nskb);
1349 	}
1350 	spin_unlock(&hwsim_radio_lock);
1351 
1352 	return ack;
1353 }
1354 
mac80211_hwsim_tx(struct ieee80211_hw * hw,struct ieee80211_tx_control * control,struct sk_buff * skb)1355 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1356 			      struct ieee80211_tx_control *control,
1357 			      struct sk_buff *skb)
1358 {
1359 	struct mac80211_hwsim_data *data = hw->priv;
1360 	struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1361 	struct ieee80211_hdr *hdr = (void *)skb->data;
1362 	struct ieee80211_chanctx_conf *chanctx_conf;
1363 	struct ieee80211_channel *channel;
1364 	bool ack;
1365 	u32 _portid;
1366 
1367 	if (WARN_ON(skb->len < 10)) {
1368 		/* Should not happen; just a sanity check for addr1 use */
1369 		ieee80211_free_txskb(hw, skb);
1370 		return;
1371 	}
1372 
1373 	if (!data->use_chanctx) {
1374 		channel = data->channel;
1375 	} else if (txi->hw_queue == 4) {
1376 		channel = data->tmp_chan;
1377 	} else {
1378 		chanctx_conf = rcu_dereference(txi->control.vif->chanctx_conf);
1379 		if (chanctx_conf)
1380 			channel = chanctx_conf->def.chan;
1381 		else
1382 			channel = NULL;
1383 	}
1384 
1385 	if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
1386 		ieee80211_free_txskb(hw, skb);
1387 		return;
1388 	}
1389 
1390 	if (data->idle && !data->tmp_chan) {
1391 		wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
1392 		ieee80211_free_txskb(hw, skb);
1393 		return;
1394 	}
1395 
1396 	if (txi->control.vif)
1397 		hwsim_check_magic(txi->control.vif);
1398 	if (control->sta)
1399 		hwsim_check_sta_magic(control->sta);
1400 
1401 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1402 		ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
1403 				       txi->control.rates,
1404 				       ARRAY_SIZE(txi->control.rates));
1405 
1406 	if (skb->len >= 24 + 8 &&
1407 	    ieee80211_is_probe_resp(hdr->frame_control)) {
1408 		/* fake header transmission time */
1409 		struct ieee80211_mgmt *mgmt;
1410 		struct ieee80211_rate *txrate;
1411 		u64 ts;
1412 
1413 		mgmt = (struct ieee80211_mgmt *)skb->data;
1414 		txrate = ieee80211_get_tx_rate(hw, txi);
1415 		ts = mac80211_hwsim_get_tsf_raw();
1416 		mgmt->u.probe_resp.timestamp =
1417 			cpu_to_le64(ts + data->tsf_offset +
1418 				    24 * 8 * 10 / txrate->bitrate);
1419 	}
1420 
1421 	mac80211_hwsim_monitor_rx(hw, skb, channel);
1422 
1423 	/* wmediumd mode check */
1424 	_portid = READ_ONCE(data->wmediumd);
1425 
1426 	if (_portid)
1427 		return mac80211_hwsim_tx_frame_nl(hw, skb, _portid);
1428 
1429 	/* NO wmediumd detected, perfect medium simulation */
1430 	data->tx_pkts++;
1431 	data->tx_bytes += skb->len;
1432 	ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
1433 
1434 	if (ack && skb->len >= 16)
1435 		mac80211_hwsim_monitor_ack(channel, hdr->addr2);
1436 
1437 	ieee80211_tx_info_clear_status(txi);
1438 
1439 	/* frame was transmitted at most favorable rate at first attempt */
1440 	txi->control.rates[0].count = 1;
1441 	txi->control.rates[1].idx = -1;
1442 
1443 	if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
1444 		txi->flags |= IEEE80211_TX_STAT_ACK;
1445 	ieee80211_tx_status_irqsafe(hw, skb);
1446 }
1447 
1448 
mac80211_hwsim_start(struct ieee80211_hw * hw)1449 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
1450 {
1451 	struct mac80211_hwsim_data *data = hw->priv;
1452 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
1453 	data->started = true;
1454 	return 0;
1455 }
1456 
1457 
mac80211_hwsim_stop(struct ieee80211_hw * hw)1458 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
1459 {
1460 	struct mac80211_hwsim_data *data = hw->priv;
1461 	data->started = false;
1462 	hrtimer_cancel(&data->beacon_timer);
1463 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
1464 }
1465 
1466 
mac80211_hwsim_add_interface(struct ieee80211_hw * hw,struct ieee80211_vif * vif)1467 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
1468 					struct ieee80211_vif *vif)
1469 {
1470 	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
1471 		  __func__, ieee80211_vif_type_p2p(vif),
1472 		  vif->addr);
1473 	hwsim_set_magic(vif);
1474 
1475 	vif->cab_queue = 0;
1476 	vif->hw_queue[IEEE80211_AC_VO] = 0;
1477 	vif->hw_queue[IEEE80211_AC_VI] = 1;
1478 	vif->hw_queue[IEEE80211_AC_BE] = 2;
1479 	vif->hw_queue[IEEE80211_AC_BK] = 3;
1480 
1481 	return 0;
1482 }
1483 
1484 
mac80211_hwsim_change_interface(struct ieee80211_hw * hw,struct ieee80211_vif * vif,enum nl80211_iftype newtype,bool newp2p)1485 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
1486 					   struct ieee80211_vif *vif,
1487 					   enum nl80211_iftype newtype,
1488 					   bool newp2p)
1489 {
1490 	newtype = ieee80211_iftype_p2p(newtype, newp2p);
1491 	wiphy_dbg(hw->wiphy,
1492 		  "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
1493 		  __func__, ieee80211_vif_type_p2p(vif),
1494 		    newtype, vif->addr);
1495 	hwsim_check_magic(vif);
1496 
1497 	/*
1498 	 * interface may change from non-AP to AP in
1499 	 * which case this needs to be set up again
1500 	 */
1501 	vif->cab_queue = 0;
1502 
1503 	return 0;
1504 }
1505 
mac80211_hwsim_remove_interface(struct ieee80211_hw * hw,struct ieee80211_vif * vif)1506 static void mac80211_hwsim_remove_interface(
1507 	struct ieee80211_hw *hw, struct ieee80211_vif *vif)
1508 {
1509 	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
1510 		  __func__, ieee80211_vif_type_p2p(vif),
1511 		  vif->addr);
1512 	hwsim_check_magic(vif);
1513 	hwsim_clear_magic(vif);
1514 }
1515 
mac80211_hwsim_tx_frame(struct ieee80211_hw * hw,struct sk_buff * skb,struct ieee80211_channel * chan)1516 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
1517 				    struct sk_buff *skb,
1518 				    struct ieee80211_channel *chan)
1519 {
1520 	struct mac80211_hwsim_data *data = hw->priv;
1521 	u32 _pid = READ_ONCE(data->wmediumd);
1522 
1523 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
1524 		struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1525 		ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
1526 				       txi->control.rates,
1527 				       ARRAY_SIZE(txi->control.rates));
1528 	}
1529 
1530 	mac80211_hwsim_monitor_rx(hw, skb, chan);
1531 
1532 	if (_pid)
1533 		return mac80211_hwsim_tx_frame_nl(hw, skb, _pid);
1534 
1535 	mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
1536 	dev_kfree_skb(skb);
1537 }
1538 
mac80211_hwsim_beacon_tx(void * arg,u8 * mac,struct ieee80211_vif * vif)1539 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
1540 				     struct ieee80211_vif *vif)
1541 {
1542 	struct mac80211_hwsim_data *data = arg;
1543 	struct ieee80211_hw *hw = data->hw;
1544 	struct ieee80211_tx_info *info;
1545 	struct ieee80211_rate *txrate;
1546 	struct ieee80211_mgmt *mgmt;
1547 	struct sk_buff *skb;
1548 
1549 	hwsim_check_magic(vif);
1550 
1551 	if (vif->type != NL80211_IFTYPE_AP &&
1552 	    vif->type != NL80211_IFTYPE_MESH_POINT &&
1553 	    vif->type != NL80211_IFTYPE_ADHOC)
1554 		return;
1555 
1556 	skb = ieee80211_beacon_get(hw, vif);
1557 	if (skb == NULL)
1558 		return;
1559 	info = IEEE80211_SKB_CB(skb);
1560 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1561 		ieee80211_get_tx_rates(vif, NULL, skb,
1562 				       info->control.rates,
1563 				       ARRAY_SIZE(info->control.rates));
1564 
1565 	txrate = ieee80211_get_tx_rate(hw, info);
1566 
1567 	mgmt = (struct ieee80211_mgmt *) skb->data;
1568 	/* fake header transmission time */
1569 	data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
1570 	mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
1571 					       data->tsf_offset +
1572 					       24 * 8 * 10 / txrate->bitrate);
1573 
1574 	mac80211_hwsim_tx_frame(hw, skb,
1575 				rcu_dereference(vif->chanctx_conf)->def.chan);
1576 
1577 	if (vif->csa_active && ieee80211_csa_is_complete(vif))
1578 		ieee80211_csa_finish(vif);
1579 }
1580 
1581 static enum hrtimer_restart
mac80211_hwsim_beacon(struct hrtimer * timer)1582 mac80211_hwsim_beacon(struct hrtimer *timer)
1583 {
1584 	struct mac80211_hwsim_data *data =
1585 		container_of(timer, struct mac80211_hwsim_data, beacon_timer);
1586 	struct ieee80211_hw *hw = data->hw;
1587 	u64 bcn_int = data->beacon_int;
1588 
1589 	if (!data->started)
1590 		return HRTIMER_NORESTART;
1591 
1592 	ieee80211_iterate_active_interfaces_atomic(
1593 		hw, IEEE80211_IFACE_ITER_NORMAL,
1594 		mac80211_hwsim_beacon_tx, data);
1595 
1596 	/* beacon at new TBTT + beacon interval */
1597 	if (data->bcn_delta) {
1598 		bcn_int -= data->bcn_delta;
1599 		data->bcn_delta = 0;
1600 	}
1601 	hrtimer_forward(&data->beacon_timer, hrtimer_get_expires(timer),
1602 			ns_to_ktime(bcn_int * NSEC_PER_USEC));
1603 	return HRTIMER_RESTART;
1604 }
1605 
1606 static const char * const hwsim_chanwidths[] = {
1607 	[NL80211_CHAN_WIDTH_20_NOHT] = "noht",
1608 	[NL80211_CHAN_WIDTH_20] = "ht20",
1609 	[NL80211_CHAN_WIDTH_40] = "ht40",
1610 	[NL80211_CHAN_WIDTH_80] = "vht80",
1611 	[NL80211_CHAN_WIDTH_80P80] = "vht80p80",
1612 	[NL80211_CHAN_WIDTH_160] = "vht160",
1613 };
1614 
mac80211_hwsim_config(struct ieee80211_hw * hw,u32 changed)1615 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
1616 {
1617 	struct mac80211_hwsim_data *data = hw->priv;
1618 	struct ieee80211_conf *conf = &hw->conf;
1619 	static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
1620 		[IEEE80211_SMPS_AUTOMATIC] = "auto",
1621 		[IEEE80211_SMPS_OFF] = "off",
1622 		[IEEE80211_SMPS_STATIC] = "static",
1623 		[IEEE80211_SMPS_DYNAMIC] = "dynamic",
1624 	};
1625 	int idx;
1626 
1627 	if (conf->chandef.chan)
1628 		wiphy_dbg(hw->wiphy,
1629 			  "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
1630 			  __func__,
1631 			  conf->chandef.chan->center_freq,
1632 			  conf->chandef.center_freq1,
1633 			  conf->chandef.center_freq2,
1634 			  hwsim_chanwidths[conf->chandef.width],
1635 			  !!(conf->flags & IEEE80211_CONF_IDLE),
1636 			  !!(conf->flags & IEEE80211_CONF_PS),
1637 			  smps_modes[conf->smps_mode]);
1638 	else
1639 		wiphy_dbg(hw->wiphy,
1640 			  "%s (freq=0 idle=%d ps=%d smps=%s)\n",
1641 			  __func__,
1642 			  !!(conf->flags & IEEE80211_CONF_IDLE),
1643 			  !!(conf->flags & IEEE80211_CONF_PS),
1644 			  smps_modes[conf->smps_mode]);
1645 
1646 	data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
1647 
1648 	WARN_ON(conf->chandef.chan && data->use_chanctx);
1649 
1650 	mutex_lock(&data->mutex);
1651 	if (data->scanning && conf->chandef.chan) {
1652 		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
1653 			if (data->survey_data[idx].channel == data->channel) {
1654 				data->survey_data[idx].start =
1655 					data->survey_data[idx].next_start;
1656 				data->survey_data[idx].end = jiffies;
1657 				break;
1658 			}
1659 		}
1660 
1661 		data->channel = conf->chandef.chan;
1662 
1663 		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
1664 			if (data->survey_data[idx].channel &&
1665 			    data->survey_data[idx].channel != data->channel)
1666 				continue;
1667 			data->survey_data[idx].channel = data->channel;
1668 			data->survey_data[idx].next_start = jiffies;
1669 			break;
1670 		}
1671 	} else {
1672 		data->channel = conf->chandef.chan;
1673 	}
1674 	mutex_unlock(&data->mutex);
1675 
1676 	if (!data->started || !data->beacon_int)
1677 		hrtimer_cancel(&data->beacon_timer);
1678 	else if (!hrtimer_is_queued(&data->beacon_timer)) {
1679 		u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
1680 		u32 bcn_int = data->beacon_int;
1681 		u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
1682 
1683 		hrtimer_start(&data->beacon_timer,
1684 			      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
1685 			      HRTIMER_MODE_REL_SOFT);
1686 	}
1687 
1688 	return 0;
1689 }
1690 
1691 
mac80211_hwsim_configure_filter(struct ieee80211_hw * hw,unsigned int changed_flags,unsigned int * total_flags,u64 multicast)1692 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
1693 					    unsigned int changed_flags,
1694 					    unsigned int *total_flags,u64 multicast)
1695 {
1696 	struct mac80211_hwsim_data *data = hw->priv;
1697 
1698 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
1699 
1700 	data->rx_filter = 0;
1701 	if (*total_flags & FIF_ALLMULTI)
1702 		data->rx_filter |= FIF_ALLMULTI;
1703 
1704 	*total_flags = data->rx_filter;
1705 }
1706 
mac80211_hwsim_bcn_en_iter(void * data,u8 * mac,struct ieee80211_vif * vif)1707 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
1708 				       struct ieee80211_vif *vif)
1709 {
1710 	unsigned int *count = data;
1711 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1712 
1713 	if (vp->bcn_en)
1714 		(*count)++;
1715 }
1716 
mac80211_hwsim_bss_info_changed(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_bss_conf * info,u32 changed)1717 static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
1718 					    struct ieee80211_vif *vif,
1719 					    struct ieee80211_bss_conf *info,
1720 					    u32 changed)
1721 {
1722 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1723 	struct mac80211_hwsim_data *data = hw->priv;
1724 
1725 	hwsim_check_magic(vif);
1726 
1727 	wiphy_dbg(hw->wiphy, "%s(changed=0x%x vif->addr=%pM)\n",
1728 		  __func__, changed, vif->addr);
1729 
1730 	if (changed & BSS_CHANGED_BSSID) {
1731 		wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
1732 			  __func__, info->bssid);
1733 		memcpy(vp->bssid, info->bssid, ETH_ALEN);
1734 	}
1735 
1736 	if (changed & BSS_CHANGED_ASSOC) {
1737 		wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
1738 			  info->assoc, info->aid);
1739 		vp->assoc = info->assoc;
1740 		vp->aid = info->aid;
1741 	}
1742 
1743 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
1744 		wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
1745 			  info->enable_beacon, info->beacon_int);
1746 		vp->bcn_en = info->enable_beacon;
1747 		if (data->started &&
1748 		    !hrtimer_is_queued(&data->beacon_timer) &&
1749 		    info->enable_beacon) {
1750 			u64 tsf, until_tbtt;
1751 			u32 bcn_int;
1752 			data->beacon_int = info->beacon_int * 1024;
1753 			tsf = mac80211_hwsim_get_tsf(hw, vif);
1754 			bcn_int = data->beacon_int;
1755 			until_tbtt = bcn_int - do_div(tsf, bcn_int);
1756 
1757 			hrtimer_start(&data->beacon_timer,
1758 				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
1759 				      HRTIMER_MODE_REL_SOFT);
1760 		} else if (!info->enable_beacon) {
1761 			unsigned int count = 0;
1762 			ieee80211_iterate_active_interfaces_atomic(
1763 				data->hw, IEEE80211_IFACE_ITER_NORMAL,
1764 				mac80211_hwsim_bcn_en_iter, &count);
1765 			wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
1766 				  count);
1767 			if (count == 0) {
1768 				hrtimer_cancel(&data->beacon_timer);
1769 				data->beacon_int = 0;
1770 			}
1771 		}
1772 	}
1773 
1774 	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
1775 		wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
1776 			  info->use_cts_prot);
1777 	}
1778 
1779 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
1780 		wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
1781 			  info->use_short_preamble);
1782 	}
1783 
1784 	if (changed & BSS_CHANGED_ERP_SLOT) {
1785 		wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
1786 	}
1787 
1788 	if (changed & BSS_CHANGED_HT) {
1789 		wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
1790 			  info->ht_operation_mode);
1791 	}
1792 
1793 	if (changed & BSS_CHANGED_BASIC_RATES) {
1794 		wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
1795 			  (unsigned long long) info->basic_rates);
1796 	}
1797 
1798 	if (changed & BSS_CHANGED_TXPOWER)
1799 		wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
1800 }
1801 
mac80211_hwsim_sta_add(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta)1802 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
1803 				  struct ieee80211_vif *vif,
1804 				  struct ieee80211_sta *sta)
1805 {
1806 	hwsim_check_magic(vif);
1807 	hwsim_set_sta_magic(sta);
1808 
1809 	return 0;
1810 }
1811 
mac80211_hwsim_sta_remove(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta)1812 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
1813 				     struct ieee80211_vif *vif,
1814 				     struct ieee80211_sta *sta)
1815 {
1816 	hwsim_check_magic(vif);
1817 	hwsim_clear_sta_magic(sta);
1818 
1819 	return 0;
1820 }
1821 
mac80211_hwsim_sta_notify(struct ieee80211_hw * hw,struct ieee80211_vif * vif,enum sta_notify_cmd cmd,struct ieee80211_sta * sta)1822 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
1823 				      struct ieee80211_vif *vif,
1824 				      enum sta_notify_cmd cmd,
1825 				      struct ieee80211_sta *sta)
1826 {
1827 	hwsim_check_magic(vif);
1828 
1829 	switch (cmd) {
1830 	case STA_NOTIFY_SLEEP:
1831 	case STA_NOTIFY_AWAKE:
1832 		/* TODO: make good use of these flags */
1833 		break;
1834 	default:
1835 		WARN(1, "Invalid sta notify: %d\n", cmd);
1836 		break;
1837 	}
1838 }
1839 
mac80211_hwsim_set_tim(struct ieee80211_hw * hw,struct ieee80211_sta * sta,bool set)1840 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
1841 				  struct ieee80211_sta *sta,
1842 				  bool set)
1843 {
1844 	hwsim_check_sta_magic(sta);
1845 	return 0;
1846 }
1847 
mac80211_hwsim_conf_tx(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u16 queue,const struct ieee80211_tx_queue_params * params)1848 static int mac80211_hwsim_conf_tx(
1849 	struct ieee80211_hw *hw,
1850 	struct ieee80211_vif *vif, u16 queue,
1851 	const struct ieee80211_tx_queue_params *params)
1852 {
1853 	wiphy_dbg(hw->wiphy,
1854 		  "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
1855 		  __func__, queue,
1856 		  params->txop, params->cw_min,
1857 		  params->cw_max, params->aifs);
1858 	return 0;
1859 }
1860 
mac80211_hwsim_get_survey(struct ieee80211_hw * hw,int idx,struct survey_info * survey)1861 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
1862 				     struct survey_info *survey)
1863 {
1864 	struct mac80211_hwsim_data *hwsim = hw->priv;
1865 
1866 	if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
1867 		return -ENOENT;
1868 
1869 	mutex_lock(&hwsim->mutex);
1870 	survey->channel = hwsim->survey_data[idx].channel;
1871 	if (!survey->channel) {
1872 		mutex_unlock(&hwsim->mutex);
1873 		return -ENOENT;
1874 	}
1875 
1876 	/*
1877 	 * Magically conjured dummy values --- this is only ok for simulated hardware.
1878 	 *
1879 	 * A real driver which cannot determine real values noise MUST NOT
1880 	 * report any, especially not a magically conjured ones :-)
1881 	 */
1882 	survey->filled = SURVEY_INFO_NOISE_DBM |
1883 			 SURVEY_INFO_TIME |
1884 			 SURVEY_INFO_TIME_BUSY;
1885 	survey->noise = -92;
1886 	survey->time =
1887 		jiffies_to_msecs(hwsim->survey_data[idx].end -
1888 				 hwsim->survey_data[idx].start);
1889 	/* report 12.5% of channel time is used */
1890 	survey->time_busy = survey->time/8;
1891 	mutex_unlock(&hwsim->mutex);
1892 
1893 	return 0;
1894 }
1895 
1896 #ifdef CONFIG_NL80211_TESTMODE
1897 /*
1898  * This section contains example code for using netlink
1899  * attributes with the testmode command in nl80211.
1900  */
1901 
1902 /* These enums need to be kept in sync with userspace */
1903 enum hwsim_testmode_attr {
1904 	__HWSIM_TM_ATTR_INVALID	= 0,
1905 	HWSIM_TM_ATTR_CMD	= 1,
1906 	HWSIM_TM_ATTR_PS	= 2,
1907 
1908 	/* keep last */
1909 	__HWSIM_TM_ATTR_AFTER_LAST,
1910 	HWSIM_TM_ATTR_MAX	= __HWSIM_TM_ATTR_AFTER_LAST - 1
1911 };
1912 
1913 enum hwsim_testmode_cmd {
1914 	HWSIM_TM_CMD_SET_PS		= 0,
1915 	HWSIM_TM_CMD_GET_PS		= 1,
1916 	HWSIM_TM_CMD_STOP_QUEUES	= 2,
1917 	HWSIM_TM_CMD_WAKE_QUEUES	= 3,
1918 };
1919 
1920 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
1921 	[HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
1922 	[HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
1923 };
1924 
mac80211_hwsim_testmode_cmd(struct ieee80211_hw * hw,struct ieee80211_vif * vif,void * data,int len)1925 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
1926 				       struct ieee80211_vif *vif,
1927 				       void *data, int len)
1928 {
1929 	struct mac80211_hwsim_data *hwsim = hw->priv;
1930 	struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
1931 	struct sk_buff *skb;
1932 	int err, ps;
1933 
1934 	err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
1935 				   hwsim_testmode_policy, NULL);
1936 	if (err)
1937 		return err;
1938 
1939 	if (!tb[HWSIM_TM_ATTR_CMD])
1940 		return -EINVAL;
1941 
1942 	switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
1943 	case HWSIM_TM_CMD_SET_PS:
1944 		if (!tb[HWSIM_TM_ATTR_PS])
1945 			return -EINVAL;
1946 		ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
1947 		return hwsim_fops_ps_write(hwsim, ps);
1948 	case HWSIM_TM_CMD_GET_PS:
1949 		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
1950 						nla_total_size(sizeof(u32)));
1951 		if (!skb)
1952 			return -ENOMEM;
1953 		if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
1954 			goto nla_put_failure;
1955 		return cfg80211_testmode_reply(skb);
1956 	case HWSIM_TM_CMD_STOP_QUEUES:
1957 		ieee80211_stop_queues(hw);
1958 		return 0;
1959 	case HWSIM_TM_CMD_WAKE_QUEUES:
1960 		ieee80211_wake_queues(hw);
1961 		return 0;
1962 	default:
1963 		return -EOPNOTSUPP;
1964 	}
1965 
1966  nla_put_failure:
1967 	kfree_skb(skb);
1968 	return -ENOBUFS;
1969 }
1970 #endif
1971 
mac80211_hwsim_ampdu_action(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_ampdu_params * params)1972 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
1973 				       struct ieee80211_vif *vif,
1974 				       struct ieee80211_ampdu_params *params)
1975 {
1976 	struct ieee80211_sta *sta = params->sta;
1977 	enum ieee80211_ampdu_mlme_action action = params->action;
1978 	u16 tid = params->tid;
1979 
1980 	switch (action) {
1981 	case IEEE80211_AMPDU_TX_START:
1982 		ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1983 		break;
1984 	case IEEE80211_AMPDU_TX_STOP_CONT:
1985 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
1986 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
1987 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
1988 		break;
1989 	case IEEE80211_AMPDU_TX_OPERATIONAL:
1990 		break;
1991 	case IEEE80211_AMPDU_RX_START:
1992 	case IEEE80211_AMPDU_RX_STOP:
1993 		break;
1994 	default:
1995 		return -EOPNOTSUPP;
1996 	}
1997 
1998 	return 0;
1999 }
2000 
mac80211_hwsim_flush(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u32 queues,bool drop)2001 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2002 				 struct ieee80211_vif *vif,
2003 				 u32 queues, bool drop)
2004 {
2005 	/* Not implemented, queues only on kernel side */
2006 }
2007 
hw_scan_work(struct work_struct * work)2008 static void hw_scan_work(struct work_struct *work)
2009 {
2010 	struct mac80211_hwsim_data *hwsim =
2011 		container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2012 	struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2013 	int dwell, i;
2014 
2015 	mutex_lock(&hwsim->mutex);
2016 	if (hwsim->scan_chan_idx >= req->n_channels) {
2017 		struct cfg80211_scan_info info = {
2018 			.aborted = false,
2019 		};
2020 
2021 		wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2022 		ieee80211_scan_completed(hwsim->hw, &info);
2023 		hwsim->hw_scan_request = NULL;
2024 		hwsim->hw_scan_vif = NULL;
2025 		hwsim->tmp_chan = NULL;
2026 		mutex_unlock(&hwsim->mutex);
2027 		return;
2028 	}
2029 
2030 	wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2031 		  req->channels[hwsim->scan_chan_idx]->center_freq);
2032 
2033 	hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2034 	if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2035 				      IEEE80211_CHAN_RADAR) ||
2036 	    !req->n_ssids) {
2037 		dwell = 120;
2038 	} else {
2039 		dwell = 30;
2040 		/* send probes */
2041 		for (i = 0; i < req->n_ssids; i++) {
2042 			struct sk_buff *probe;
2043 			struct ieee80211_mgmt *mgmt;
2044 
2045 			probe = ieee80211_probereq_get(hwsim->hw,
2046 						       hwsim->scan_addr,
2047 						       req->ssids[i].ssid,
2048 						       req->ssids[i].ssid_len,
2049 						       req->ie_len);
2050 			if (!probe)
2051 				continue;
2052 
2053 			mgmt = (struct ieee80211_mgmt *) probe->data;
2054 			memcpy(mgmt->da, req->bssid, ETH_ALEN);
2055 			memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2056 
2057 			if (req->ie_len)
2058 				skb_put_data(probe, req->ie, req->ie_len);
2059 
2060 			local_bh_disable();
2061 			mac80211_hwsim_tx_frame(hwsim->hw, probe,
2062 						hwsim->tmp_chan);
2063 			local_bh_enable();
2064 		}
2065 	}
2066 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2067 				     msecs_to_jiffies(dwell));
2068 	hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2069 	hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2070 	hwsim->survey_data[hwsim->scan_chan_idx].end =
2071 		jiffies + msecs_to_jiffies(dwell);
2072 	hwsim->scan_chan_idx++;
2073 	mutex_unlock(&hwsim->mutex);
2074 }
2075 
mac80211_hwsim_hw_scan(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_scan_request * hw_req)2076 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2077 				  struct ieee80211_vif *vif,
2078 				  struct ieee80211_scan_request *hw_req)
2079 {
2080 	struct mac80211_hwsim_data *hwsim = hw->priv;
2081 	struct cfg80211_scan_request *req = &hw_req->req;
2082 
2083 	mutex_lock(&hwsim->mutex);
2084 	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2085 		mutex_unlock(&hwsim->mutex);
2086 		return -EBUSY;
2087 	}
2088 	hwsim->hw_scan_request = req;
2089 	hwsim->hw_scan_vif = vif;
2090 	hwsim->scan_chan_idx = 0;
2091 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2092 		get_random_mask_addr(hwsim->scan_addr,
2093 				     hw_req->req.mac_addr,
2094 				     hw_req->req.mac_addr_mask);
2095 	else
2096 		memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
2097 	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2098 	mutex_unlock(&hwsim->mutex);
2099 
2100 	wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
2101 
2102 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
2103 
2104 	return 0;
2105 }
2106 
mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw * hw,struct ieee80211_vif * vif)2107 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
2108 					  struct ieee80211_vif *vif)
2109 {
2110 	struct mac80211_hwsim_data *hwsim = hw->priv;
2111 	struct cfg80211_scan_info info = {
2112 		.aborted = true,
2113 	};
2114 
2115 	wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
2116 
2117 	cancel_delayed_work_sync(&hwsim->hw_scan);
2118 
2119 	mutex_lock(&hwsim->mutex);
2120 	ieee80211_scan_completed(hwsim->hw, &info);
2121 	hwsim->tmp_chan = NULL;
2122 	hwsim->hw_scan_request = NULL;
2123 	hwsim->hw_scan_vif = NULL;
2124 	mutex_unlock(&hwsim->mutex);
2125 }
2126 
mac80211_hwsim_sw_scan(struct ieee80211_hw * hw,struct ieee80211_vif * vif,const u8 * mac_addr)2127 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
2128 				   struct ieee80211_vif *vif,
2129 				   const u8 *mac_addr)
2130 {
2131 	struct mac80211_hwsim_data *hwsim = hw->priv;
2132 
2133 	mutex_lock(&hwsim->mutex);
2134 
2135 	if (hwsim->scanning) {
2136 		pr_debug("two hwsim sw_scans detected!\n");
2137 		goto out;
2138 	}
2139 
2140 	pr_debug("hwsim sw_scan request, prepping stuff\n");
2141 
2142 	memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
2143 	hwsim->scanning = true;
2144 	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2145 
2146 out:
2147 	mutex_unlock(&hwsim->mutex);
2148 }
2149 
mac80211_hwsim_sw_scan_complete(struct ieee80211_hw * hw,struct ieee80211_vif * vif)2150 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
2151 					    struct ieee80211_vif *vif)
2152 {
2153 	struct mac80211_hwsim_data *hwsim = hw->priv;
2154 
2155 	mutex_lock(&hwsim->mutex);
2156 
2157 	pr_debug("hwsim sw_scan_complete\n");
2158 	hwsim->scanning = false;
2159 	eth_zero_addr(hwsim->scan_addr);
2160 
2161 	mutex_unlock(&hwsim->mutex);
2162 }
2163 
hw_roc_start(struct work_struct * work)2164 static void hw_roc_start(struct work_struct *work)
2165 {
2166 	struct mac80211_hwsim_data *hwsim =
2167 		container_of(work, struct mac80211_hwsim_data, roc_start.work);
2168 
2169 	mutex_lock(&hwsim->mutex);
2170 
2171 	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
2172 	hwsim->tmp_chan = hwsim->roc_chan;
2173 	ieee80211_ready_on_channel(hwsim->hw);
2174 
2175 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
2176 				     msecs_to_jiffies(hwsim->roc_duration));
2177 
2178 	mutex_unlock(&hwsim->mutex);
2179 }
2180 
hw_roc_done(struct work_struct * work)2181 static void hw_roc_done(struct work_struct *work)
2182 {
2183 	struct mac80211_hwsim_data *hwsim =
2184 		container_of(work, struct mac80211_hwsim_data, roc_done.work);
2185 
2186 	mutex_lock(&hwsim->mutex);
2187 	ieee80211_remain_on_channel_expired(hwsim->hw);
2188 	hwsim->tmp_chan = NULL;
2189 	mutex_unlock(&hwsim->mutex);
2190 
2191 	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
2192 }
2193 
mac80211_hwsim_roc(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_channel * chan,int duration,enum ieee80211_roc_type type)2194 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
2195 			      struct ieee80211_vif *vif,
2196 			      struct ieee80211_channel *chan,
2197 			      int duration,
2198 			      enum ieee80211_roc_type type)
2199 {
2200 	struct mac80211_hwsim_data *hwsim = hw->priv;
2201 
2202 	mutex_lock(&hwsim->mutex);
2203 	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2204 		mutex_unlock(&hwsim->mutex);
2205 		return -EBUSY;
2206 	}
2207 
2208 	hwsim->roc_chan = chan;
2209 	hwsim->roc_duration = duration;
2210 	mutex_unlock(&hwsim->mutex);
2211 
2212 	wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
2213 		  chan->center_freq, duration);
2214 	ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
2215 
2216 	return 0;
2217 }
2218 
mac80211_hwsim_croc(struct ieee80211_hw * hw,struct ieee80211_vif * vif)2219 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
2220 			       struct ieee80211_vif *vif)
2221 {
2222 	struct mac80211_hwsim_data *hwsim = hw->priv;
2223 
2224 	cancel_delayed_work_sync(&hwsim->roc_start);
2225 	cancel_delayed_work_sync(&hwsim->roc_done);
2226 
2227 	mutex_lock(&hwsim->mutex);
2228 	hwsim->tmp_chan = NULL;
2229 	mutex_unlock(&hwsim->mutex);
2230 
2231 	wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
2232 
2233 	return 0;
2234 }
2235 
mac80211_hwsim_add_chanctx(struct ieee80211_hw * hw,struct ieee80211_chanctx_conf * ctx)2236 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
2237 				      struct ieee80211_chanctx_conf *ctx)
2238 {
2239 	hwsim_set_chanctx_magic(ctx);
2240 	wiphy_dbg(hw->wiphy,
2241 		  "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2242 		  ctx->def.chan->center_freq, ctx->def.width,
2243 		  ctx->def.center_freq1, ctx->def.center_freq2);
2244 	return 0;
2245 }
2246 
mac80211_hwsim_remove_chanctx(struct ieee80211_hw * hw,struct ieee80211_chanctx_conf * ctx)2247 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
2248 					  struct ieee80211_chanctx_conf *ctx)
2249 {
2250 	wiphy_dbg(hw->wiphy,
2251 		  "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2252 		  ctx->def.chan->center_freq, ctx->def.width,
2253 		  ctx->def.center_freq1, ctx->def.center_freq2);
2254 	hwsim_check_chanctx_magic(ctx);
2255 	hwsim_clear_chanctx_magic(ctx);
2256 }
2257 
mac80211_hwsim_change_chanctx(struct ieee80211_hw * hw,struct ieee80211_chanctx_conf * ctx,u32 changed)2258 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
2259 					  struct ieee80211_chanctx_conf *ctx,
2260 					  u32 changed)
2261 {
2262 	hwsim_check_chanctx_magic(ctx);
2263 	wiphy_dbg(hw->wiphy,
2264 		  "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2265 		  ctx->def.chan->center_freq, ctx->def.width,
2266 		  ctx->def.center_freq1, ctx->def.center_freq2);
2267 }
2268 
mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_chanctx_conf * ctx)2269 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
2270 					     struct ieee80211_vif *vif,
2271 					     struct ieee80211_chanctx_conf *ctx)
2272 {
2273 	hwsim_check_magic(vif);
2274 	hwsim_check_chanctx_magic(ctx);
2275 
2276 	return 0;
2277 }
2278 
mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_chanctx_conf * ctx)2279 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
2280 						struct ieee80211_vif *vif,
2281 						struct ieee80211_chanctx_conf *ctx)
2282 {
2283 	hwsim_check_magic(vif);
2284 	hwsim_check_chanctx_magic(ctx);
2285 }
2286 
2287 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
2288 	"tx_pkts_nic",
2289 	"tx_bytes_nic",
2290 	"rx_pkts_nic",
2291 	"rx_bytes_nic",
2292 	"d_tx_dropped",
2293 	"d_tx_failed",
2294 	"d_ps_mode",
2295 	"d_group",
2296 };
2297 
2298 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
2299 
mac80211_hwsim_get_et_strings(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u32 sset,u8 * data)2300 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
2301 					  struct ieee80211_vif *vif,
2302 					  u32 sset, u8 *data)
2303 {
2304 	if (sset == ETH_SS_STATS)
2305 		memcpy(data, *mac80211_hwsim_gstrings_stats,
2306 		       sizeof(mac80211_hwsim_gstrings_stats));
2307 }
2308 
mac80211_hwsim_get_et_sset_count(struct ieee80211_hw * hw,struct ieee80211_vif * vif,int sset)2309 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
2310 					    struct ieee80211_vif *vif, int sset)
2311 {
2312 	if (sset == ETH_SS_STATS)
2313 		return MAC80211_HWSIM_SSTATS_LEN;
2314 	return 0;
2315 }
2316 
mac80211_hwsim_get_et_stats(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ethtool_stats * stats,u64 * data)2317 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
2318 					struct ieee80211_vif *vif,
2319 					struct ethtool_stats *stats, u64 *data)
2320 {
2321 	struct mac80211_hwsim_data *ar = hw->priv;
2322 	int i = 0;
2323 
2324 	data[i++] = ar->tx_pkts;
2325 	data[i++] = ar->tx_bytes;
2326 	data[i++] = ar->rx_pkts;
2327 	data[i++] = ar->rx_bytes;
2328 	data[i++] = ar->tx_dropped;
2329 	data[i++] = ar->tx_failed;
2330 	data[i++] = ar->ps;
2331 	data[i++] = ar->group;
2332 
2333 	WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
2334 }
2335 
2336 #define HWSIM_COMMON_OPS					\
2337 	.tx = mac80211_hwsim_tx,				\
2338 	.start = mac80211_hwsim_start,				\
2339 	.stop = mac80211_hwsim_stop,				\
2340 	.add_interface = mac80211_hwsim_add_interface,		\
2341 	.change_interface = mac80211_hwsim_change_interface,	\
2342 	.remove_interface = mac80211_hwsim_remove_interface,	\
2343 	.config = mac80211_hwsim_config,			\
2344 	.configure_filter = mac80211_hwsim_configure_filter,	\
2345 	.bss_info_changed = mac80211_hwsim_bss_info_changed,	\
2346 	.sta_add = mac80211_hwsim_sta_add,			\
2347 	.sta_remove = mac80211_hwsim_sta_remove,		\
2348 	.sta_notify = mac80211_hwsim_sta_notify,		\
2349 	.set_tim = mac80211_hwsim_set_tim,			\
2350 	.conf_tx = mac80211_hwsim_conf_tx,			\
2351 	.get_survey = mac80211_hwsim_get_survey,		\
2352 	CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)	\
2353 	.ampdu_action = mac80211_hwsim_ampdu_action,		\
2354 	.flush = mac80211_hwsim_flush,				\
2355 	.get_tsf = mac80211_hwsim_get_tsf,			\
2356 	.set_tsf = mac80211_hwsim_set_tsf,			\
2357 	.get_et_sset_count = mac80211_hwsim_get_et_sset_count,	\
2358 	.get_et_stats = mac80211_hwsim_get_et_stats,		\
2359 	.get_et_strings = mac80211_hwsim_get_et_strings,
2360 
2361 static const struct ieee80211_ops mac80211_hwsim_ops = {
2362 	HWSIM_COMMON_OPS
2363 	.sw_scan_start = mac80211_hwsim_sw_scan,
2364 	.sw_scan_complete = mac80211_hwsim_sw_scan_complete,
2365 };
2366 
2367 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
2368 	HWSIM_COMMON_OPS
2369 	.hw_scan = mac80211_hwsim_hw_scan,
2370 	.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,
2371 	.sw_scan_start = NULL,
2372 	.sw_scan_complete = NULL,
2373 	.remain_on_channel = mac80211_hwsim_roc,
2374 	.cancel_remain_on_channel = mac80211_hwsim_croc,
2375 	.add_chanctx = mac80211_hwsim_add_chanctx,
2376 	.remove_chanctx = mac80211_hwsim_remove_chanctx,
2377 	.change_chanctx = mac80211_hwsim_change_chanctx,
2378 	.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,
2379 	.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx,
2380 };
2381 
2382 struct hwsim_new_radio_params {
2383 	unsigned int channels;
2384 	const char *reg_alpha2;
2385 	const struct ieee80211_regdomain *regd;
2386 	bool reg_strict;
2387 	bool p2p_device;
2388 	bool use_chanctx;
2389 	bool destroy_on_close;
2390 	const char *hwname;
2391 	bool no_vif;
2392 	const u8 *perm_addr;
2393 	u32 iftypes;
2394 	u32 *ciphers;
2395 	u8 n_ciphers;
2396 };
2397 
hwsim_mcast_config_msg(struct sk_buff * mcast_skb,struct genl_info * info)2398 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
2399 				   struct genl_info *info)
2400 {
2401 	if (info)
2402 		genl_notify(&hwsim_genl_family, mcast_skb, info,
2403 			    HWSIM_MCGRP_CONFIG, GFP_KERNEL);
2404 	else
2405 		genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
2406 				  HWSIM_MCGRP_CONFIG, GFP_KERNEL);
2407 }
2408 
append_radio_msg(struct sk_buff * skb,int id,struct hwsim_new_radio_params * param)2409 static int append_radio_msg(struct sk_buff *skb, int id,
2410 			    struct hwsim_new_radio_params *param)
2411 {
2412 	int ret;
2413 
2414 	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
2415 	if (ret < 0)
2416 		return ret;
2417 
2418 	if (param->channels) {
2419 		ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
2420 		if (ret < 0)
2421 			return ret;
2422 	}
2423 
2424 	if (param->reg_alpha2) {
2425 		ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
2426 			      param->reg_alpha2);
2427 		if (ret < 0)
2428 			return ret;
2429 	}
2430 
2431 	if (param->regd) {
2432 		int i;
2433 
2434 		for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
2435 			if (hwsim_world_regdom_custom[i] != param->regd)
2436 				continue;
2437 
2438 			ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
2439 			if (ret < 0)
2440 				return ret;
2441 			break;
2442 		}
2443 	}
2444 
2445 	if (param->reg_strict) {
2446 		ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
2447 		if (ret < 0)
2448 			return ret;
2449 	}
2450 
2451 	if (param->p2p_device) {
2452 		ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
2453 		if (ret < 0)
2454 			return ret;
2455 	}
2456 
2457 	if (param->use_chanctx) {
2458 		ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
2459 		if (ret < 0)
2460 			return ret;
2461 	}
2462 
2463 	if (param->hwname) {
2464 		ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
2465 			      strlen(param->hwname), param->hwname);
2466 		if (ret < 0)
2467 			return ret;
2468 	}
2469 
2470 	return 0;
2471 }
2472 
hwsim_mcast_new_radio(int id,struct genl_info * info,struct hwsim_new_radio_params * param)2473 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
2474 				  struct hwsim_new_radio_params *param)
2475 {
2476 	struct sk_buff *mcast_skb;
2477 	void *data;
2478 
2479 	mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
2480 	if (!mcast_skb)
2481 		return;
2482 
2483 	data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
2484 			   HWSIM_CMD_NEW_RADIO);
2485 	if (!data)
2486 		goto out_err;
2487 
2488 	if (append_radio_msg(mcast_skb, id, param) < 0)
2489 		goto out_err;
2490 
2491 	genlmsg_end(mcast_skb, data);
2492 
2493 	hwsim_mcast_config_msg(mcast_skb, info);
2494 	return;
2495 
2496 out_err:
2497 	nlmsg_free(mcast_skb);
2498 }
2499 
2500 static const struct ieee80211_sband_iftype_data he_capa_2ghz[] = {
2501 	{
2502 		/* TODO: should we support other types, e.g., P2P?*/
2503 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
2504 			      BIT(NL80211_IFTYPE_AP),
2505 		.he_cap = {
2506 			.has_he = true,
2507 			.he_cap_elem = {
2508 				.mac_cap_info[0] =
2509 					IEEE80211_HE_MAC_CAP0_HTC_HE,
2510 				.mac_cap_info[1] =
2511 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
2512 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2513 				.mac_cap_info[2] =
2514 					IEEE80211_HE_MAC_CAP2_BSR |
2515 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
2516 					IEEE80211_HE_MAC_CAP2_ACK_EN,
2517 				.mac_cap_info[3] =
2518 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2519 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2520 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2521 				.phy_cap_info[1] =
2522 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2523 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2524 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2525 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2526 				.phy_cap_info[2] =
2527 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
2528 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
2529 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
2530 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
2531 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
2532 
2533 				/* Leave all the other PHY capability bytes
2534 				 * unset, as DCM, beam forming, RU and PPE
2535 				 * threshold information are not supported
2536 				 */
2537 			},
2538 			.he_mcs_nss_supp = {
2539 				.rx_mcs_80 = cpu_to_le16(0xfffa),
2540 				.tx_mcs_80 = cpu_to_le16(0xfffa),
2541 				.rx_mcs_160 = cpu_to_le16(0xffff),
2542 				.tx_mcs_160 = cpu_to_le16(0xffff),
2543 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
2544 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
2545 			},
2546 		},
2547 	},
2548 #ifdef CONFIG_MAC80211_MESH
2549 	{
2550 		/* TODO: should we support other types, e.g., IBSS?*/
2551 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
2552 		.he_cap = {
2553 			.has_he = true,
2554 			.he_cap_elem = {
2555 				.mac_cap_info[0] =
2556 					IEEE80211_HE_MAC_CAP0_HTC_HE,
2557 				.mac_cap_info[1] =
2558 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2559 				.mac_cap_info[2] =
2560 					IEEE80211_HE_MAC_CAP2_ACK_EN,
2561 				.mac_cap_info[3] =
2562 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2563 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2564 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2565 				.phy_cap_info[1] =
2566 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2567 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2568 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2569 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2570 				.phy_cap_info[2] = 0,
2571 
2572 				/* Leave all the other PHY capability bytes
2573 				 * unset, as DCM, beam forming, RU and PPE
2574 				 * threshold information are not supported
2575 				 */
2576 			},
2577 			.he_mcs_nss_supp = {
2578 				.rx_mcs_80 = cpu_to_le16(0xfffa),
2579 				.tx_mcs_80 = cpu_to_le16(0xfffa),
2580 				.rx_mcs_160 = cpu_to_le16(0xffff),
2581 				.tx_mcs_160 = cpu_to_le16(0xffff),
2582 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
2583 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
2584 			},
2585 		},
2586 	},
2587 #endif
2588 };
2589 
2590 static const struct ieee80211_sband_iftype_data he_capa_5ghz[] = {
2591 	{
2592 		/* TODO: should we support other types, e.g., P2P?*/
2593 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
2594 			      BIT(NL80211_IFTYPE_AP),
2595 		.he_cap = {
2596 			.has_he = true,
2597 			.he_cap_elem = {
2598 				.mac_cap_info[0] =
2599 					IEEE80211_HE_MAC_CAP0_HTC_HE,
2600 				.mac_cap_info[1] =
2601 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
2602 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2603 				.mac_cap_info[2] =
2604 					IEEE80211_HE_MAC_CAP2_BSR |
2605 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
2606 					IEEE80211_HE_MAC_CAP2_ACK_EN,
2607 				.mac_cap_info[3] =
2608 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2609 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2610 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2611 				.phy_cap_info[0] =
2612 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
2613 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
2614 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
2615 				.phy_cap_info[1] =
2616 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2617 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2618 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2619 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2620 				.phy_cap_info[2] =
2621 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
2622 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
2623 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
2624 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
2625 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
2626 
2627 				/* Leave all the other PHY capability bytes
2628 				 * unset, as DCM, beam forming, RU and PPE
2629 				 * threshold information are not supported
2630 				 */
2631 			},
2632 			.he_mcs_nss_supp = {
2633 				.rx_mcs_80 = cpu_to_le16(0xfffa),
2634 				.tx_mcs_80 = cpu_to_le16(0xfffa),
2635 				.rx_mcs_160 = cpu_to_le16(0xfffa),
2636 				.tx_mcs_160 = cpu_to_le16(0xfffa),
2637 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
2638 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
2639 			},
2640 		},
2641 	},
2642 #ifdef CONFIG_MAC80211_MESH
2643 	{
2644 		/* TODO: should we support other types, e.g., IBSS?*/
2645 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
2646 		.he_cap = {
2647 			.has_he = true,
2648 			.he_cap_elem = {
2649 				.mac_cap_info[0] =
2650 					IEEE80211_HE_MAC_CAP0_HTC_HE,
2651 				.mac_cap_info[1] =
2652 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2653 				.mac_cap_info[2] =
2654 					IEEE80211_HE_MAC_CAP2_ACK_EN,
2655 				.mac_cap_info[3] =
2656 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2657 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2658 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2659 				.phy_cap_info[0] =
2660 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
2661 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
2662 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
2663 				.phy_cap_info[1] =
2664 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2665 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2666 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2667 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2668 				.phy_cap_info[2] = 0,
2669 
2670 				/* Leave all the other PHY capability bytes
2671 				 * unset, as DCM, beam forming, RU and PPE
2672 				 * threshold information are not supported
2673 				 */
2674 			},
2675 			.he_mcs_nss_supp = {
2676 				.rx_mcs_80 = cpu_to_le16(0xfffa),
2677 				.tx_mcs_80 = cpu_to_le16(0xfffa),
2678 				.rx_mcs_160 = cpu_to_le16(0xfffa),
2679 				.tx_mcs_160 = cpu_to_le16(0xfffa),
2680 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
2681 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
2682 			},
2683 		},
2684 	},
2685 #endif
2686 };
2687 
mac80211_hwsim_he_capab(struct ieee80211_supported_band * sband)2688 static void mac80211_hwsim_he_capab(struct ieee80211_supported_band *sband)
2689 {
2690 	u16 n_iftype_data;
2691 
2692 	if (sband->band == NL80211_BAND_2GHZ) {
2693 		n_iftype_data = ARRAY_SIZE(he_capa_2ghz);
2694 		sband->iftype_data =
2695 			(struct ieee80211_sband_iftype_data *)he_capa_2ghz;
2696 	} else if (sband->band == NL80211_BAND_5GHZ) {
2697 		n_iftype_data = ARRAY_SIZE(he_capa_5ghz);
2698 		sband->iftype_data =
2699 			(struct ieee80211_sband_iftype_data *)he_capa_5ghz;
2700 	} else {
2701 		return;
2702 	}
2703 
2704 	sband->n_iftype_data = n_iftype_data;
2705 }
2706 
2707 #ifdef CONFIG_MAC80211_MESH
2708 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
2709 #else
2710 #define HWSIM_MESH_BIT 0
2711 #endif
2712 
2713 #define HWSIM_DEFAULT_IF_LIMIT \
2714 	(BIT(NL80211_IFTYPE_STATION) | \
2715 	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
2716 	 BIT(NL80211_IFTYPE_AP) | \
2717 	 BIT(NL80211_IFTYPE_P2P_GO) | \
2718 	 HWSIM_MESH_BIT)
2719 
2720 #define HWSIM_IFTYPE_SUPPORT_MASK \
2721 	(BIT(NL80211_IFTYPE_STATION) | \
2722 	 BIT(NL80211_IFTYPE_AP) | \
2723 	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
2724 	 BIT(NL80211_IFTYPE_P2P_GO) | \
2725 	 BIT(NL80211_IFTYPE_ADHOC) | \
2726 	 BIT(NL80211_IFTYPE_MESH_POINT))
2727 
mac80211_hwsim_new_radio(struct genl_info * info,struct hwsim_new_radio_params * param)2728 static int mac80211_hwsim_new_radio(struct genl_info *info,
2729 				    struct hwsim_new_radio_params *param)
2730 {
2731 	int err;
2732 	u8 addr[ETH_ALEN];
2733 	struct mac80211_hwsim_data *data;
2734 	struct ieee80211_hw *hw;
2735 	enum nl80211_band band;
2736 	const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
2737 	struct net *net;
2738 	int idx, i;
2739 	int n_limits = 0;
2740 
2741 	if (WARN_ON(param->channels > 1 && !param->use_chanctx))
2742 		return -EINVAL;
2743 
2744 	spin_lock_bh(&hwsim_radio_lock);
2745 	idx = hwsim_radio_idx++;
2746 	spin_unlock_bh(&hwsim_radio_lock);
2747 
2748 	if (param->use_chanctx)
2749 		ops = &mac80211_hwsim_mchan_ops;
2750 	hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
2751 	if (!hw) {
2752 		pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
2753 		err = -ENOMEM;
2754 		goto failed;
2755 	}
2756 
2757 	/* ieee80211_alloc_hw_nm may have used a default name */
2758 	param->hwname = wiphy_name(hw->wiphy);
2759 
2760 	if (info)
2761 		net = genl_info_net(info);
2762 	else
2763 		net = &init_net;
2764 	wiphy_net_set(hw->wiphy, net);
2765 
2766 	data = hw->priv;
2767 	data->hw = hw;
2768 
2769 	data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
2770 	if (IS_ERR(data->dev)) {
2771 		printk(KERN_DEBUG
2772 		       "mac80211_hwsim: device_create failed (%ld)\n",
2773 		       PTR_ERR(data->dev));
2774 		err = -ENOMEM;
2775 		goto failed_drvdata;
2776 	}
2777 	data->dev->driver = &mac80211_hwsim_driver.driver;
2778 	err = device_bind_driver(data->dev);
2779 	if (err != 0) {
2780 		pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
2781 		       err);
2782 		goto failed_bind;
2783 	}
2784 
2785 	skb_queue_head_init(&data->pending);
2786 
2787 	SET_IEEE80211_DEV(hw, data->dev);
2788 	if (!param->perm_addr) {
2789 		eth_zero_addr(addr);
2790 		addr[0] = 0x02;
2791 		addr[3] = idx >> 8;
2792 		addr[4] = idx;
2793 		memcpy(data->addresses[0].addr, addr, ETH_ALEN);
2794 		/* Why need here second address ? */
2795 		memcpy(data->addresses[1].addr, addr, ETH_ALEN);
2796 		data->addresses[1].addr[0] |= 0x40;
2797 		hw->wiphy->n_addresses = 2;
2798 		hw->wiphy->addresses = data->addresses;
2799 		/* possible address clash is checked at hash table insertion */
2800 	} else {
2801 		memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
2802 		/* compatibility with automatically generated mac addr */
2803 		memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
2804 		hw->wiphy->n_addresses = 2;
2805 		hw->wiphy->addresses = data->addresses;
2806 	}
2807 
2808 	data->channels = param->channels;
2809 	data->use_chanctx = param->use_chanctx;
2810 	data->idx = idx;
2811 	data->destroy_on_close = param->destroy_on_close;
2812 	if (info)
2813 		data->portid = info->snd_portid;
2814 
2815 	/* setup interface limits, only on interface types we support */
2816 	if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
2817 		data->if_limits[n_limits].max = 1;
2818 		data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
2819 		n_limits++;
2820 	}
2821 
2822 	if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
2823 		data->if_limits[n_limits].max = 2048;
2824 		/*
2825 		 * For this case, we may only support a subset of
2826 		 * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
2827 		 * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
2828 		 */
2829 		data->if_limits[n_limits].types =
2830 					HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
2831 		n_limits++;
2832 	}
2833 
2834 	if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
2835 		data->if_limits[n_limits].max = 1;
2836 		data->if_limits[n_limits].types =
2837 						BIT(NL80211_IFTYPE_P2P_DEVICE);
2838 		n_limits++;
2839 	}
2840 
2841 	if (data->use_chanctx) {
2842 		hw->wiphy->max_scan_ssids = 255;
2843 		hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
2844 		hw->wiphy->max_remain_on_channel_duration = 1000;
2845 		data->if_combination.radar_detect_widths = 0;
2846 		data->if_combination.num_different_channels = data->channels;
2847 	} else {
2848 		data->if_combination.num_different_channels = 1;
2849 		data->if_combination.radar_detect_widths =
2850 					BIT(NL80211_CHAN_WIDTH_20_NOHT) |
2851 					BIT(NL80211_CHAN_WIDTH_20) |
2852 					BIT(NL80211_CHAN_WIDTH_40) |
2853 					BIT(NL80211_CHAN_WIDTH_80) |
2854 					BIT(NL80211_CHAN_WIDTH_160);
2855 	}
2856 
2857 	if (!n_limits) {
2858 		err = -EINVAL;
2859 		goto failed_hw;
2860 	}
2861 
2862 	data->if_combination.max_interfaces = 0;
2863 	for (i = 0; i < n_limits; i++)
2864 		data->if_combination.max_interfaces +=
2865 			data->if_limits[i].max;
2866 
2867 	data->if_combination.n_limits = n_limits;
2868 	data->if_combination.limits = data->if_limits;
2869 
2870 	/*
2871 	 * If we actually were asked to support combinations,
2872 	 * advertise them - if there's only a single thing like
2873 	 * only IBSS then don't advertise it as combinations.
2874 	 */
2875 	if (data->if_combination.max_interfaces > 1) {
2876 		hw->wiphy->iface_combinations = &data->if_combination;
2877 		hw->wiphy->n_iface_combinations = 1;
2878 	}
2879 
2880 	if (param->ciphers) {
2881 		memcpy(data->ciphers, param->ciphers,
2882 		       param->n_ciphers * sizeof(u32));
2883 		hw->wiphy->cipher_suites = data->ciphers;
2884 		hw->wiphy->n_cipher_suites = param->n_ciphers;
2885 	}
2886 
2887 	INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
2888 	INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
2889 	INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
2890 
2891 	hw->queues = 5;
2892 	hw->offchannel_tx_hw_queue = 4;
2893 
2894 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
2895 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
2896 	ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
2897 	ieee80211_hw_set(hw, QUEUE_CONTROL);
2898 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
2899 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
2900 	ieee80211_hw_set(hw, MFP_CAPABLE);
2901 	ieee80211_hw_set(hw, SIGNAL_DBM);
2902 	ieee80211_hw_set(hw, SUPPORTS_PS);
2903 	ieee80211_hw_set(hw, TDLS_WIDER_BW);
2904 	if (rctbl)
2905 		ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
2906 	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
2907 
2908 	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
2909 			    WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
2910 			    WIPHY_FLAG_AP_UAPSD |
2911 			    WIPHY_FLAG_HAS_CHANNEL_SWITCH;
2912 	hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
2913 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
2914 			       NL80211_FEATURE_STATIC_SMPS |
2915 			       NL80211_FEATURE_DYNAMIC_SMPS |
2916 			       NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
2917 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
2918 
2919 	hw->wiphy->interface_modes = param->iftypes;
2920 
2921 	/* ask mac80211 to reserve space for magic */
2922 	hw->vif_data_size = sizeof(struct hwsim_vif_priv);
2923 	hw->sta_data_size = sizeof(struct hwsim_sta_priv);
2924 	hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
2925 
2926 	memcpy(data->channels_2ghz, hwsim_channels_2ghz,
2927 		sizeof(hwsim_channels_2ghz));
2928 	memcpy(data->channels_5ghz, hwsim_channels_5ghz,
2929 		sizeof(hwsim_channels_5ghz));
2930 	memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
2931 
2932 	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
2933 		struct ieee80211_supported_band *sband = &data->bands[band];
2934 
2935 		sband->band = band;
2936 
2937 		switch (band) {
2938 		case NL80211_BAND_2GHZ:
2939 			sband->channels = data->channels_2ghz;
2940 			sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
2941 			sband->bitrates = data->rates;
2942 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
2943 			break;
2944 		case NL80211_BAND_5GHZ:
2945 			sband->channels = data->channels_5ghz;
2946 			sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
2947 			sband->bitrates = data->rates + 4;
2948 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
2949 
2950 			sband->vht_cap.vht_supported = true;
2951 			sband->vht_cap.cap =
2952 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
2953 				IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
2954 				IEEE80211_VHT_CAP_RXLDPC |
2955 				IEEE80211_VHT_CAP_SHORT_GI_80 |
2956 				IEEE80211_VHT_CAP_SHORT_GI_160 |
2957 				IEEE80211_VHT_CAP_TXSTBC |
2958 				IEEE80211_VHT_CAP_RXSTBC_4 |
2959 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
2960 			sband->vht_cap.vht_mcs.rx_mcs_map =
2961 				cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
2962 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
2963 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
2964 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
2965 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
2966 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
2967 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
2968 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
2969 			sband->vht_cap.vht_mcs.tx_mcs_map =
2970 				sband->vht_cap.vht_mcs.rx_mcs_map;
2971 			break;
2972 		default:
2973 			continue;
2974 		}
2975 
2976 		sband->ht_cap.ht_supported = true;
2977 		sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
2978 				    IEEE80211_HT_CAP_GRN_FLD |
2979 				    IEEE80211_HT_CAP_SGI_20 |
2980 				    IEEE80211_HT_CAP_SGI_40 |
2981 				    IEEE80211_HT_CAP_DSSSCCK40;
2982 		sband->ht_cap.ampdu_factor = 0x3;
2983 		sband->ht_cap.ampdu_density = 0x6;
2984 		memset(&sband->ht_cap.mcs, 0,
2985 		       sizeof(sband->ht_cap.mcs));
2986 		sband->ht_cap.mcs.rx_mask[0] = 0xff;
2987 		sband->ht_cap.mcs.rx_mask[1] = 0xff;
2988 		sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
2989 
2990 		mac80211_hwsim_he_capab(sband);
2991 
2992 		hw->wiphy->bands[band] = sband;
2993 	}
2994 
2995 	/* By default all radios belong to the first group */
2996 	data->group = 1;
2997 	mutex_init(&data->mutex);
2998 
2999 	data->netgroup = hwsim_net_get_netgroup(net);
3000 	data->wmediumd = hwsim_net_get_wmediumd(net);
3001 
3002 	/* Enable frame retransmissions for lossy channels */
3003 	hw->max_rates = 4;
3004 	hw->max_rate_tries = 11;
3005 
3006 	hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
3007 	hw->wiphy->n_vendor_commands =
3008 		ARRAY_SIZE(mac80211_hwsim_vendor_commands);
3009 	hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
3010 	hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
3011 
3012 	if (param->reg_strict)
3013 		hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
3014 	if (param->regd) {
3015 		data->regd = param->regd;
3016 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
3017 		wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
3018 		/* give the regulatory workqueue a chance to run */
3019 		schedule_timeout_interruptible(1);
3020 	}
3021 
3022 	if (param->no_vif)
3023 		ieee80211_hw_set(hw, NO_AUTO_VIF);
3024 
3025 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
3026 
3027 	hrtimer_init(&data->beacon_timer, CLOCK_MONOTONIC,
3028 		     HRTIMER_MODE_ABS_SOFT);
3029 	data->beacon_timer.function = mac80211_hwsim_beacon;
3030 
3031 	err = ieee80211_register_hw(hw);
3032 	if (err < 0) {
3033 		pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
3034 		       err);
3035 		goto failed_hw;
3036 	}
3037 
3038 	wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
3039 
3040 	if (param->reg_alpha2) {
3041 		data->alpha2[0] = param->reg_alpha2[0];
3042 		data->alpha2[1] = param->reg_alpha2[1];
3043 		regulatory_hint(hw->wiphy, param->reg_alpha2);
3044 	}
3045 
3046 	data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
3047 	debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
3048 	debugfs_create_file("group", 0666, data->debugfs, data,
3049 			    &hwsim_fops_group);
3050 	if (!data->use_chanctx)
3051 		debugfs_create_file("dfs_simulate_radar", 0222,
3052 				    data->debugfs,
3053 				    data, &hwsim_simulate_radar);
3054 
3055 	spin_lock_bh(&hwsim_radio_lock);
3056 	err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
3057 				     hwsim_rht_params);
3058 	if (err < 0) {
3059 		if (info) {
3060 			GENL_SET_ERR_MSG(info, "perm addr already present");
3061 			NL_SET_BAD_ATTR(info->extack,
3062 					info->attrs[HWSIM_ATTR_PERM_ADDR]);
3063 		}
3064 		spin_unlock_bh(&hwsim_radio_lock);
3065 		goto failed_final_insert;
3066 	}
3067 
3068 	list_add_tail(&data->list, &hwsim_radios);
3069 	hwsim_radios_generation++;
3070 	spin_unlock_bh(&hwsim_radio_lock);
3071 
3072 	hwsim_mcast_new_radio(idx, info, param);
3073 
3074 	return idx;
3075 
3076 failed_final_insert:
3077 	debugfs_remove_recursive(data->debugfs);
3078 	ieee80211_unregister_hw(data->hw);
3079 failed_hw:
3080 	device_release_driver(data->dev);
3081 failed_bind:
3082 	device_unregister(data->dev);
3083 failed_drvdata:
3084 	ieee80211_free_hw(hw);
3085 failed:
3086 	return err;
3087 }
3088 
hwsim_mcast_del_radio(int id,const char * hwname,struct genl_info * info)3089 static void hwsim_mcast_del_radio(int id, const char *hwname,
3090 				  struct genl_info *info)
3091 {
3092 	struct sk_buff *skb;
3093 	void *data;
3094 	int ret;
3095 
3096 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3097 	if (!skb)
3098 		return;
3099 
3100 	data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
3101 			   HWSIM_CMD_DEL_RADIO);
3102 	if (!data)
3103 		goto error;
3104 
3105 	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
3106 	if (ret < 0)
3107 		goto error;
3108 
3109 	ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
3110 		      hwname);
3111 	if (ret < 0)
3112 		goto error;
3113 
3114 	genlmsg_end(skb, data);
3115 
3116 	hwsim_mcast_config_msg(skb, info);
3117 
3118 	return;
3119 
3120 error:
3121 	nlmsg_free(skb);
3122 }
3123 
mac80211_hwsim_del_radio(struct mac80211_hwsim_data * data,const char * hwname,struct genl_info * info)3124 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
3125 				     const char *hwname,
3126 				     struct genl_info *info)
3127 {
3128 	hwsim_mcast_del_radio(data->idx, hwname, info);
3129 	debugfs_remove_recursive(data->debugfs);
3130 	ieee80211_unregister_hw(data->hw);
3131 	device_release_driver(data->dev);
3132 	device_unregister(data->dev);
3133 	ieee80211_free_hw(data->hw);
3134 }
3135 
mac80211_hwsim_get_radio(struct sk_buff * skb,struct mac80211_hwsim_data * data,u32 portid,u32 seq,struct netlink_callback * cb,int flags)3136 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
3137 				    struct mac80211_hwsim_data *data,
3138 				    u32 portid, u32 seq,
3139 				    struct netlink_callback *cb, int flags)
3140 {
3141 	void *hdr;
3142 	struct hwsim_new_radio_params param = { };
3143 	int res = -EMSGSIZE;
3144 
3145 	hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
3146 			  HWSIM_CMD_GET_RADIO);
3147 	if (!hdr)
3148 		return -EMSGSIZE;
3149 
3150 	if (cb)
3151 		genl_dump_check_consistent(cb, hdr);
3152 
3153 	if (data->alpha2[0] && data->alpha2[1])
3154 		param.reg_alpha2 = data->alpha2;
3155 
3156 	param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
3157 					REGULATORY_STRICT_REG);
3158 	param.p2p_device = !!(data->hw->wiphy->interface_modes &
3159 					BIT(NL80211_IFTYPE_P2P_DEVICE));
3160 	param.use_chanctx = data->use_chanctx;
3161 	param.regd = data->regd;
3162 	param.channels = data->channels;
3163 	param.hwname = wiphy_name(data->hw->wiphy);
3164 
3165 	res = append_radio_msg(skb, data->idx, &param);
3166 	if (res < 0)
3167 		goto out_err;
3168 
3169 	genlmsg_end(skb, hdr);
3170 	return 0;
3171 
3172 out_err:
3173 	genlmsg_cancel(skb, hdr);
3174 	return res;
3175 }
3176 
mac80211_hwsim_free(void)3177 static void mac80211_hwsim_free(void)
3178 {
3179 	struct mac80211_hwsim_data *data;
3180 
3181 	spin_lock_bh(&hwsim_radio_lock);
3182 	while ((data = list_first_entry_or_null(&hwsim_radios,
3183 						struct mac80211_hwsim_data,
3184 						list))) {
3185 		list_del(&data->list);
3186 		spin_unlock_bh(&hwsim_radio_lock);
3187 		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
3188 					 NULL);
3189 		spin_lock_bh(&hwsim_radio_lock);
3190 	}
3191 	spin_unlock_bh(&hwsim_radio_lock);
3192 	class_destroy(hwsim_class);
3193 }
3194 
3195 static const struct net_device_ops hwsim_netdev_ops = {
3196 	.ndo_start_xmit 	= hwsim_mon_xmit,
3197 	.ndo_set_mac_address 	= eth_mac_addr,
3198 	.ndo_validate_addr	= eth_validate_addr,
3199 };
3200 
hwsim_mon_setup(struct net_device * dev)3201 static void hwsim_mon_setup(struct net_device *dev)
3202 {
3203 	dev->netdev_ops = &hwsim_netdev_ops;
3204 	dev->needs_free_netdev = true;
3205 	ether_setup(dev);
3206 	dev->priv_flags |= IFF_NO_QUEUE;
3207 	dev->type = ARPHRD_IEEE80211_RADIOTAP;
3208 	eth_zero_addr(dev->dev_addr);
3209 	dev->dev_addr[0] = 0x12;
3210 }
3211 
get_hwsim_data_ref_from_addr(const u8 * addr)3212 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
3213 {
3214 	return rhashtable_lookup_fast(&hwsim_radios_rht,
3215 				      addr,
3216 				      hwsim_rht_params);
3217 }
3218 
hwsim_register_wmediumd(struct net * net,u32 portid)3219 static void hwsim_register_wmediumd(struct net *net, u32 portid)
3220 {
3221 	struct mac80211_hwsim_data *data;
3222 
3223 	hwsim_net_set_wmediumd(net, portid);
3224 
3225 	spin_lock_bh(&hwsim_radio_lock);
3226 	list_for_each_entry(data, &hwsim_radios, list) {
3227 		if (data->netgroup == hwsim_net_get_netgroup(net))
3228 			data->wmediumd = portid;
3229 	}
3230 	spin_unlock_bh(&hwsim_radio_lock);
3231 }
3232 
hwsim_tx_info_frame_received_nl(struct sk_buff * skb_2,struct genl_info * info)3233 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
3234 					   struct genl_info *info)
3235 {
3236 
3237 	struct ieee80211_hdr *hdr;
3238 	struct mac80211_hwsim_data *data2;
3239 	struct ieee80211_tx_info *txi;
3240 	struct hwsim_tx_rate *tx_attempts;
3241 	u64 ret_skb_cookie;
3242 	struct sk_buff *skb, *tmp;
3243 	const u8 *src;
3244 	unsigned int hwsim_flags;
3245 	int i;
3246 	bool found = false;
3247 
3248 	if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
3249 	    !info->attrs[HWSIM_ATTR_FLAGS] ||
3250 	    !info->attrs[HWSIM_ATTR_COOKIE] ||
3251 	    !info->attrs[HWSIM_ATTR_SIGNAL] ||
3252 	    !info->attrs[HWSIM_ATTR_TX_INFO])
3253 		goto out;
3254 
3255 	src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
3256 	hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
3257 	ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
3258 
3259 	data2 = get_hwsim_data_ref_from_addr(src);
3260 	if (!data2)
3261 		goto out;
3262 
3263 	if (hwsim_net_get_netgroup(genl_info_net(info)) != data2->netgroup)
3264 		goto out;
3265 
3266 	if (info->snd_portid != data2->wmediumd)
3267 		goto out;
3268 
3269 	/* look for the skb matching the cookie passed back from user */
3270 	skb_queue_walk_safe(&data2->pending, skb, tmp) {
3271 		u64 skb_cookie;
3272 
3273 		txi = IEEE80211_SKB_CB(skb);
3274 		skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0];
3275 
3276 		if (skb_cookie == ret_skb_cookie) {
3277 			skb_unlink(skb, &data2->pending);
3278 			found = true;
3279 			break;
3280 		}
3281 	}
3282 
3283 	/* not found */
3284 	if (!found)
3285 		goto out;
3286 
3287 	/* Tx info received because the frame was broadcasted on user space,
3288 	 so we get all the necessary info: tx attempts and skb control buff */
3289 
3290 	tx_attempts = (struct hwsim_tx_rate *)nla_data(
3291 		       info->attrs[HWSIM_ATTR_TX_INFO]);
3292 
3293 	/* now send back TX status */
3294 	txi = IEEE80211_SKB_CB(skb);
3295 
3296 	ieee80211_tx_info_clear_status(txi);
3297 
3298 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
3299 		txi->status.rates[i].idx = tx_attempts[i].idx;
3300 		txi->status.rates[i].count = tx_attempts[i].count;
3301 	}
3302 
3303 	txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
3304 
3305 	if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
3306 	   (hwsim_flags & HWSIM_TX_STAT_ACK)) {
3307 		if (skb->len >= 16) {
3308 			hdr = (struct ieee80211_hdr *) skb->data;
3309 			mac80211_hwsim_monitor_ack(data2->channel,
3310 						   hdr->addr2);
3311 		}
3312 		txi->flags |= IEEE80211_TX_STAT_ACK;
3313 	}
3314 	ieee80211_tx_status_irqsafe(data2->hw, skb);
3315 	return 0;
3316 out:
3317 	return -EINVAL;
3318 
3319 }
3320 
hwsim_cloned_frame_received_nl(struct sk_buff * skb_2,struct genl_info * info)3321 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
3322 					  struct genl_info *info)
3323 {
3324 	struct mac80211_hwsim_data *data2;
3325 	struct ieee80211_rx_status rx_status;
3326 	struct ieee80211_hdr *hdr;
3327 	const u8 *dst;
3328 	int frame_data_len;
3329 	void *frame_data;
3330 	struct sk_buff *skb = NULL;
3331 
3332 	if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
3333 	    !info->attrs[HWSIM_ATTR_FRAME] ||
3334 	    !info->attrs[HWSIM_ATTR_RX_RATE] ||
3335 	    !info->attrs[HWSIM_ATTR_SIGNAL])
3336 		goto out;
3337 
3338 	dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
3339 	frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
3340 	frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
3341 
3342 	/* Allocate new skb here */
3343 	skb = alloc_skb(frame_data_len, GFP_KERNEL);
3344 	if (skb == NULL)
3345 		goto err;
3346 
3347 	if (frame_data_len > IEEE80211_MAX_DATA_LEN)
3348 		goto err;
3349 
3350 	/* Copy the data */
3351 	skb_put_data(skb, frame_data, frame_data_len);
3352 
3353 	data2 = get_hwsim_data_ref_from_addr(dst);
3354 	if (!data2)
3355 		goto out;
3356 
3357 	if (hwsim_net_get_netgroup(genl_info_net(info)) != data2->netgroup)
3358 		goto out;
3359 
3360 	if (info->snd_portid != data2->wmediumd)
3361 		goto out;
3362 
3363 	/* check if radio is configured properly */
3364 
3365 	if (data2->idle || !data2->started)
3366 		goto out;
3367 
3368 	/* A frame is received from user space */
3369 	memset(&rx_status, 0, sizeof(rx_status));
3370 	if (info->attrs[HWSIM_ATTR_FREQ]) {
3371 		/* throw away off-channel packets, but allow both the temporary
3372 		 * ("hw" scan/remain-on-channel) and regular channel, since the
3373 		 * internal datapath also allows this
3374 		 */
3375 		mutex_lock(&data2->mutex);
3376 		rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
3377 
3378 		if (rx_status.freq != data2->channel->center_freq &&
3379 		    (!data2->tmp_chan ||
3380 		     rx_status.freq != data2->tmp_chan->center_freq)) {
3381 			mutex_unlock(&data2->mutex);
3382 			goto out;
3383 		}
3384 		mutex_unlock(&data2->mutex);
3385 	} else {
3386 		rx_status.freq = data2->channel->center_freq;
3387 	}
3388 
3389 	rx_status.band = data2->channel->band;
3390 	rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
3391 	rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
3392 
3393 	hdr = (void *)skb->data;
3394 
3395 	if (ieee80211_is_beacon(hdr->frame_control) ||
3396 	    ieee80211_is_probe_resp(hdr->frame_control))
3397 		rx_status.boottime_ns = ktime_get_boottime_ns();
3398 
3399 	memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
3400 	data2->rx_pkts++;
3401 	data2->rx_bytes += skb->len;
3402 	ieee80211_rx_irqsafe(data2->hw, skb);
3403 
3404 	return 0;
3405 err:
3406 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
3407 out:
3408 	dev_kfree_skb(skb);
3409 	return -EINVAL;
3410 }
3411 
hwsim_register_received_nl(struct sk_buff * skb_2,struct genl_info * info)3412 static int hwsim_register_received_nl(struct sk_buff *skb_2,
3413 				      struct genl_info *info)
3414 {
3415 	struct net *net = genl_info_net(info);
3416 	struct mac80211_hwsim_data *data;
3417 	int chans = 1;
3418 
3419 	spin_lock_bh(&hwsim_radio_lock);
3420 	list_for_each_entry(data, &hwsim_radios, list)
3421 		chans = max(chans, data->channels);
3422 	spin_unlock_bh(&hwsim_radio_lock);
3423 
3424 	/* In the future we should revise the userspace API and allow it
3425 	 * to set a flag that it does support multi-channel, then we can
3426 	 * let this pass conditionally on the flag.
3427 	 * For current userspace, prohibit it since it won't work right.
3428 	 */
3429 	if (chans > 1)
3430 		return -EOPNOTSUPP;
3431 
3432 	if (hwsim_net_get_wmediumd(net))
3433 		return -EBUSY;
3434 
3435 	hwsim_register_wmediumd(net, info->snd_portid);
3436 
3437 	pr_debug("mac80211_hwsim: received a REGISTER, "
3438 	       "switching to wmediumd mode with pid %d\n", info->snd_portid);
3439 
3440 	return 0;
3441 }
3442 
3443 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
hwsim_known_ciphers(const u32 * ciphers,int n_ciphers)3444 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
3445 {
3446 	int i;
3447 
3448 	for (i = 0; i < n_ciphers; i++) {
3449 		int j;
3450 		int found = 0;
3451 
3452 		for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
3453 			if (ciphers[i] == hwsim_ciphers[j]) {
3454 				found = 1;
3455 				break;
3456 			}
3457 		}
3458 
3459 		if (!found)
3460 			return false;
3461 	}
3462 
3463 	return true;
3464 }
3465 
hwsim_new_radio_nl(struct sk_buff * msg,struct genl_info * info)3466 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
3467 {
3468 	struct hwsim_new_radio_params param = { 0 };
3469 	const char *hwname = NULL;
3470 	int ret;
3471 
3472 	param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
3473 	param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
3474 	param.channels = channels;
3475 	param.destroy_on_close =
3476 		info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
3477 
3478 	if (info->attrs[HWSIM_ATTR_CHANNELS])
3479 		param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
3480 
3481 	if (param.channels < 1) {
3482 		GENL_SET_ERR_MSG(info, "must have at least one channel");
3483 		return -EINVAL;
3484 	}
3485 
3486 	if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
3487 		GENL_SET_ERR_MSG(info, "too many channels specified");
3488 		return -EINVAL;
3489 	}
3490 
3491 	if (info->attrs[HWSIM_ATTR_NO_VIF])
3492 		param.no_vif = true;
3493 
3494 	if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
3495 		param.use_chanctx = true;
3496 	else
3497 		param.use_chanctx = (param.channels > 1);
3498 
3499 	if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
3500 		param.reg_alpha2 =
3501 			nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
3502 
3503 	if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
3504 		u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
3505 
3506 		if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
3507 			return -EINVAL;
3508 
3509 		idx = array_index_nospec(idx,
3510 					 ARRAY_SIZE(hwsim_world_regdom_custom));
3511 		param.regd = hwsim_world_regdom_custom[idx];
3512 	}
3513 
3514 	if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
3515 		if (!is_valid_ether_addr(
3516 				nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
3517 			GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
3518 			NL_SET_BAD_ATTR(info->extack,
3519 					info->attrs[HWSIM_ATTR_PERM_ADDR]);
3520 			return -EINVAL;
3521 		}
3522 
3523 		param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
3524 	}
3525 
3526 	if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
3527 		param.iftypes =
3528 			nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
3529 
3530 		if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
3531 			NL_SET_ERR_MSG_ATTR(info->extack,
3532 					    info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
3533 					    "cannot support more iftypes than kernel");
3534 			return -EINVAL;
3535 		}
3536 	} else {
3537 		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
3538 	}
3539 
3540 	/* ensure both flag and iftype support is honored */
3541 	if (param.p2p_device ||
3542 	    param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
3543 		param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
3544 		param.p2p_device = true;
3545 	}
3546 
3547 	if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
3548 		u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
3549 
3550 		param.ciphers =
3551 			nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
3552 
3553 		if (len % sizeof(u32)) {
3554 			NL_SET_ERR_MSG_ATTR(info->extack,
3555 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
3556 					    "bad cipher list length");
3557 			return -EINVAL;
3558 		}
3559 
3560 		param.n_ciphers = len / sizeof(u32);
3561 
3562 		if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
3563 			NL_SET_ERR_MSG_ATTR(info->extack,
3564 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
3565 					    "too many ciphers specified");
3566 			return -EINVAL;
3567 		}
3568 
3569 		if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
3570 			NL_SET_ERR_MSG_ATTR(info->extack,
3571 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
3572 					    "unsupported ciphers specified");
3573 			return -EINVAL;
3574 		}
3575 	}
3576 
3577 	if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
3578 		hwname = kasprintf(GFP_KERNEL, "%.*s",
3579 				   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
3580 				   (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
3581 		if (!hwname)
3582 			return -ENOMEM;
3583 		param.hwname = hwname;
3584 	}
3585 
3586 	ret = mac80211_hwsim_new_radio(info, &param);
3587 	kfree(hwname);
3588 	return ret;
3589 }
3590 
hwsim_del_radio_nl(struct sk_buff * msg,struct genl_info * info)3591 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
3592 {
3593 	struct mac80211_hwsim_data *data;
3594 	s64 idx = -1;
3595 	const char *hwname = NULL;
3596 
3597 	if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
3598 		idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
3599 	} else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
3600 		hwname = kasprintf(GFP_KERNEL, "%.*s",
3601 				   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
3602 				   (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
3603 		if (!hwname)
3604 			return -ENOMEM;
3605 	} else
3606 		return -EINVAL;
3607 
3608 	spin_lock_bh(&hwsim_radio_lock);
3609 	list_for_each_entry(data, &hwsim_radios, list) {
3610 		if (idx >= 0) {
3611 			if (data->idx != idx)
3612 				continue;
3613 		} else {
3614 			if (!hwname ||
3615 			    strcmp(hwname, wiphy_name(data->hw->wiphy)))
3616 				continue;
3617 		}
3618 
3619 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
3620 			continue;
3621 
3622 		list_del(&data->list);
3623 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
3624 				       hwsim_rht_params);
3625 		hwsim_radios_generation++;
3626 		spin_unlock_bh(&hwsim_radio_lock);
3627 		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
3628 					 info);
3629 		kfree(hwname);
3630 		return 0;
3631 	}
3632 	spin_unlock_bh(&hwsim_radio_lock);
3633 
3634 	kfree(hwname);
3635 	return -ENODEV;
3636 }
3637 
hwsim_get_radio_nl(struct sk_buff * msg,struct genl_info * info)3638 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
3639 {
3640 	struct mac80211_hwsim_data *data;
3641 	struct sk_buff *skb;
3642 	int idx, res = -ENODEV;
3643 
3644 	if (!info->attrs[HWSIM_ATTR_RADIO_ID])
3645 		return -EINVAL;
3646 	idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
3647 
3648 	spin_lock_bh(&hwsim_radio_lock);
3649 	list_for_each_entry(data, &hwsim_radios, list) {
3650 		if (data->idx != idx)
3651 			continue;
3652 
3653 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
3654 			continue;
3655 
3656 		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3657 		if (!skb) {
3658 			res = -ENOMEM;
3659 			goto out_err;
3660 		}
3661 
3662 		res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
3663 					       info->snd_seq, NULL, 0);
3664 		if (res < 0) {
3665 			nlmsg_free(skb);
3666 			goto out_err;
3667 		}
3668 
3669 		res = genlmsg_reply(skb, info);
3670 		break;
3671 	}
3672 
3673 out_err:
3674 	spin_unlock_bh(&hwsim_radio_lock);
3675 
3676 	return res;
3677 }
3678 
hwsim_dump_radio_nl(struct sk_buff * skb,struct netlink_callback * cb)3679 static int hwsim_dump_radio_nl(struct sk_buff *skb,
3680 			       struct netlink_callback *cb)
3681 {
3682 	int last_idx = cb->args[0] - 1;
3683 	struct mac80211_hwsim_data *data = NULL;
3684 	int res = 0;
3685 	void *hdr;
3686 
3687 	spin_lock_bh(&hwsim_radio_lock);
3688 	cb->seq = hwsim_radios_generation;
3689 
3690 	if (last_idx >= hwsim_radio_idx-1)
3691 		goto done;
3692 
3693 	list_for_each_entry(data, &hwsim_radios, list) {
3694 		if (data->idx <= last_idx)
3695 			continue;
3696 
3697 		if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
3698 			continue;
3699 
3700 		res = mac80211_hwsim_get_radio(skb, data,
3701 					       NETLINK_CB(cb->skb).portid,
3702 					       cb->nlh->nlmsg_seq, cb,
3703 					       NLM_F_MULTI);
3704 		if (res < 0)
3705 			break;
3706 
3707 		last_idx = data->idx;
3708 	}
3709 
3710 	cb->args[0] = last_idx + 1;
3711 
3712 	/* list changed, but no new element sent, set interrupted flag */
3713 	if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
3714 		hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
3715 				  cb->nlh->nlmsg_seq, &hwsim_genl_family,
3716 				  NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
3717 		if (hdr) {
3718 			genl_dump_check_consistent(cb, hdr);
3719 			genlmsg_end(skb, hdr);
3720 		} else {
3721 			res = -EMSGSIZE;
3722 		}
3723 	}
3724 
3725 done:
3726 	spin_unlock_bh(&hwsim_radio_lock);
3727 	return res ?: skb->len;
3728 }
3729 
3730 /* Generic Netlink operations array */
3731 static const struct genl_ops hwsim_ops[] = {
3732 	{
3733 		.cmd = HWSIM_CMD_REGISTER,
3734 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3735 		.doit = hwsim_register_received_nl,
3736 		.flags = GENL_UNS_ADMIN_PERM,
3737 	},
3738 	{
3739 		.cmd = HWSIM_CMD_FRAME,
3740 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3741 		.doit = hwsim_cloned_frame_received_nl,
3742 	},
3743 	{
3744 		.cmd = HWSIM_CMD_TX_INFO_FRAME,
3745 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3746 		.doit = hwsim_tx_info_frame_received_nl,
3747 	},
3748 	{
3749 		.cmd = HWSIM_CMD_NEW_RADIO,
3750 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3751 		.doit = hwsim_new_radio_nl,
3752 		.flags = GENL_UNS_ADMIN_PERM,
3753 	},
3754 	{
3755 		.cmd = HWSIM_CMD_DEL_RADIO,
3756 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3757 		.doit = hwsim_del_radio_nl,
3758 		.flags = GENL_UNS_ADMIN_PERM,
3759 	},
3760 	{
3761 		.cmd = HWSIM_CMD_GET_RADIO,
3762 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3763 		.doit = hwsim_get_radio_nl,
3764 		.dumpit = hwsim_dump_radio_nl,
3765 	},
3766 };
3767 
3768 static struct genl_family hwsim_genl_family __ro_after_init = {
3769 	.name = "MAC80211_HWSIM",
3770 	.version = 1,
3771 	.maxattr = HWSIM_ATTR_MAX,
3772 	.policy = hwsim_genl_policy,
3773 	.netnsok = true,
3774 	.module = THIS_MODULE,
3775 	.ops = hwsim_ops,
3776 	.n_ops = ARRAY_SIZE(hwsim_ops),
3777 	.mcgrps = hwsim_mcgrps,
3778 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
3779 };
3780 
remove_user_radios(u32 portid)3781 static void remove_user_radios(u32 portid)
3782 {
3783 	struct mac80211_hwsim_data *entry, *tmp;
3784 	LIST_HEAD(list);
3785 
3786 	spin_lock_bh(&hwsim_radio_lock);
3787 	list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
3788 		if (entry->destroy_on_close && entry->portid == portid) {
3789 			list_move(&entry->list, &list);
3790 			rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
3791 					       hwsim_rht_params);
3792 			hwsim_radios_generation++;
3793 		}
3794 	}
3795 	spin_unlock_bh(&hwsim_radio_lock);
3796 
3797 	list_for_each_entry_safe(entry, tmp, &list, list) {
3798 		list_del(&entry->list);
3799 		mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
3800 					 NULL);
3801 	}
3802 }
3803 
mac80211_hwsim_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)3804 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
3805 					 unsigned long state,
3806 					 void *_notify)
3807 {
3808 	struct netlink_notify *notify = _notify;
3809 
3810 	if (state != NETLINK_URELEASE)
3811 		return NOTIFY_DONE;
3812 
3813 	remove_user_radios(notify->portid);
3814 
3815 	if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
3816 		printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
3817 		       " socket, switching to perfect channel medium\n");
3818 		hwsim_register_wmediumd(notify->net, 0);
3819 	}
3820 	return NOTIFY_DONE;
3821 
3822 }
3823 
3824 static struct notifier_block hwsim_netlink_notifier = {
3825 	.notifier_call = mac80211_hwsim_netlink_notify,
3826 };
3827 
hwsim_init_netlink(void)3828 static int __init hwsim_init_netlink(void)
3829 {
3830 	int rc;
3831 
3832 	printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
3833 
3834 	rc = genl_register_family(&hwsim_genl_family);
3835 	if (rc)
3836 		goto failure;
3837 
3838 	rc = netlink_register_notifier(&hwsim_netlink_notifier);
3839 	if (rc) {
3840 		genl_unregister_family(&hwsim_genl_family);
3841 		goto failure;
3842 	}
3843 
3844 	return 0;
3845 
3846 failure:
3847 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
3848 	return -EINVAL;
3849 }
3850 
hwsim_init_net(struct net * net)3851 static __net_init int hwsim_init_net(struct net *net)
3852 {
3853 	return hwsim_net_set_netgroup(net);
3854 }
3855 
hwsim_exit_net(struct net * net)3856 static void __net_exit hwsim_exit_net(struct net *net)
3857 {
3858 	struct mac80211_hwsim_data *data, *tmp;
3859 	LIST_HEAD(list);
3860 
3861 	spin_lock_bh(&hwsim_radio_lock);
3862 	list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
3863 		if (!net_eq(wiphy_net(data->hw->wiphy), net))
3864 			continue;
3865 
3866 		/* Radios created in init_net are returned to init_net. */
3867 		if (data->netgroup == hwsim_net_get_netgroup(&init_net))
3868 			continue;
3869 
3870 		list_move(&data->list, &list);
3871 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
3872 				       hwsim_rht_params);
3873 		hwsim_radios_generation++;
3874 	}
3875 	spin_unlock_bh(&hwsim_radio_lock);
3876 
3877 	list_for_each_entry_safe(data, tmp, &list, list) {
3878 		list_del(&data->list);
3879 		mac80211_hwsim_del_radio(data,
3880 					 wiphy_name(data->hw->wiphy),
3881 					 NULL);
3882 	}
3883 
3884 	ida_simple_remove(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
3885 }
3886 
3887 static struct pernet_operations hwsim_net_ops = {
3888 	.init = hwsim_init_net,
3889 	.exit = hwsim_exit_net,
3890 	.id   = &hwsim_net_id,
3891 	.size = sizeof(struct hwsim_net),
3892 };
3893 
hwsim_exit_netlink(void)3894 static void hwsim_exit_netlink(void)
3895 {
3896 	/* unregister the notifier */
3897 	netlink_unregister_notifier(&hwsim_netlink_notifier);
3898 	/* unregister the family */
3899 	genl_unregister_family(&hwsim_genl_family);
3900 }
3901 
init_mac80211_hwsim(void)3902 static int __init init_mac80211_hwsim(void)
3903 {
3904 	int i, err;
3905 
3906 	if (radios < 0 || radios > 100)
3907 		return -EINVAL;
3908 
3909 	if (channels < 1)
3910 		return -EINVAL;
3911 
3912 	spin_lock_init(&hwsim_radio_lock);
3913 
3914 	err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
3915 	if (err)
3916 		return err;
3917 
3918 	err = register_pernet_device(&hwsim_net_ops);
3919 	if (err)
3920 		goto out_free_rht;
3921 
3922 	err = platform_driver_register(&mac80211_hwsim_driver);
3923 	if (err)
3924 		goto out_unregister_pernet;
3925 
3926 	err = hwsim_init_netlink();
3927 	if (err)
3928 		goto out_unregister_driver;
3929 
3930 	hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
3931 	if (IS_ERR(hwsim_class)) {
3932 		err = PTR_ERR(hwsim_class);
3933 		goto out_exit_netlink;
3934 	}
3935 
3936 	for (i = 0; i < radios; i++) {
3937 		struct hwsim_new_radio_params param = { 0 };
3938 
3939 		param.channels = channels;
3940 
3941 		switch (regtest) {
3942 		case HWSIM_REGTEST_DIFF_COUNTRY:
3943 			if (i < ARRAY_SIZE(hwsim_alpha2s))
3944 				param.reg_alpha2 = hwsim_alpha2s[i];
3945 			break;
3946 		case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
3947 			if (!i)
3948 				param.reg_alpha2 = hwsim_alpha2s[0];
3949 			break;
3950 		case HWSIM_REGTEST_STRICT_ALL:
3951 			param.reg_strict = true;
3952 			/* fall through */
3953 		case HWSIM_REGTEST_DRIVER_REG_ALL:
3954 			param.reg_alpha2 = hwsim_alpha2s[0];
3955 			break;
3956 		case HWSIM_REGTEST_WORLD_ROAM:
3957 			if (i == 0)
3958 				param.regd = &hwsim_world_regdom_custom_01;
3959 			break;
3960 		case HWSIM_REGTEST_CUSTOM_WORLD:
3961 			param.regd = &hwsim_world_regdom_custom_01;
3962 			break;
3963 		case HWSIM_REGTEST_CUSTOM_WORLD_2:
3964 			if (i == 0)
3965 				param.regd = &hwsim_world_regdom_custom_01;
3966 			else if (i == 1)
3967 				param.regd = &hwsim_world_regdom_custom_02;
3968 			break;
3969 		case HWSIM_REGTEST_STRICT_FOLLOW:
3970 			if (i == 0) {
3971 				param.reg_strict = true;
3972 				param.reg_alpha2 = hwsim_alpha2s[0];
3973 			}
3974 			break;
3975 		case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
3976 			if (i == 0) {
3977 				param.reg_strict = true;
3978 				param.reg_alpha2 = hwsim_alpha2s[0];
3979 			} else if (i == 1) {
3980 				param.reg_alpha2 = hwsim_alpha2s[1];
3981 			}
3982 			break;
3983 		case HWSIM_REGTEST_ALL:
3984 			switch (i) {
3985 			case 0:
3986 				param.regd = &hwsim_world_regdom_custom_01;
3987 				break;
3988 			case 1:
3989 				param.regd = &hwsim_world_regdom_custom_02;
3990 				break;
3991 			case 2:
3992 				param.reg_alpha2 = hwsim_alpha2s[0];
3993 				break;
3994 			case 3:
3995 				param.reg_alpha2 = hwsim_alpha2s[1];
3996 				break;
3997 			case 4:
3998 				param.reg_strict = true;
3999 				param.reg_alpha2 = hwsim_alpha2s[2];
4000 				break;
4001 			}
4002 			break;
4003 		default:
4004 			break;
4005 		}
4006 
4007 		param.p2p_device = support_p2p_device;
4008 		param.use_chanctx = channels > 1;
4009 		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
4010 		if (param.p2p_device)
4011 			param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
4012 
4013 		err = mac80211_hwsim_new_radio(NULL, &param);
4014 		if (err < 0)
4015 			goto out_free_radios;
4016 	}
4017 
4018 	hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
4019 				 hwsim_mon_setup);
4020 	if (hwsim_mon == NULL) {
4021 		err = -ENOMEM;
4022 		goto out_free_radios;
4023 	}
4024 
4025 	rtnl_lock();
4026 	err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
4027 	if (err < 0) {
4028 		rtnl_unlock();
4029 		goto out_free_mon;
4030 	}
4031 
4032 	err = register_netdevice(hwsim_mon);
4033 	if (err < 0) {
4034 		rtnl_unlock();
4035 		goto out_free_mon;
4036 	}
4037 	rtnl_unlock();
4038 
4039 	return 0;
4040 
4041 out_free_mon:
4042 	free_netdev(hwsim_mon);
4043 out_free_radios:
4044 	mac80211_hwsim_free();
4045 out_exit_netlink:
4046 	hwsim_exit_netlink();
4047 out_unregister_driver:
4048 	platform_driver_unregister(&mac80211_hwsim_driver);
4049 out_unregister_pernet:
4050 	unregister_pernet_device(&hwsim_net_ops);
4051 out_free_rht:
4052 	rhashtable_destroy(&hwsim_radios_rht);
4053 	return err;
4054 }
4055 module_init(init_mac80211_hwsim);
4056 
exit_mac80211_hwsim(void)4057 static void __exit exit_mac80211_hwsim(void)
4058 {
4059 	pr_debug("mac80211_hwsim: unregister radios\n");
4060 
4061 	hwsim_exit_netlink();
4062 
4063 	mac80211_hwsim_free();
4064 
4065 	rhashtable_destroy(&hwsim_radios_rht);
4066 	unregister_netdev(hwsim_mon);
4067 	platform_driver_unregister(&mac80211_hwsim_driver);
4068 	unregister_pernet_device(&hwsim_net_ops);
4069 }
4070 module_exit(exit_mac80211_hwsim);
4071