1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
7  * Copyright (C) 2018 - 2022 Intel Corporation
8  */
9 
10 /*
11  * TODO:
12  * - Add TSF sync and fix IBSS beacon transmission by adding
13  *   competition for "air time" at TBTT
14  * - RX filtering based on filter configuration (data->rx_filter)
15  */
16 
17 #include <linux/list.h>
18 #include <linux/slab.h>
19 #include <linux/spinlock.h>
20 #include <net/dst.h>
21 #include <net/xfrm.h>
22 #include <net/mac80211.h>
23 #include <net/ieee80211_radiotap.h>
24 #include <linux/if_arp.h>
25 #include <linux/rtnetlink.h>
26 #include <linux/etherdevice.h>
27 #include <linux/platform_device.h>
28 #include <linux/debugfs.h>
29 #include <linux/module.h>
30 #include <linux/ktime.h>
31 #include <net/genetlink.h>
32 #include <net/net_namespace.h>
33 #include <net/netns/generic.h>
34 #include <linux/rhashtable.h>
35 #include <linux/nospec.h>
36 #include <linux/virtio.h>
37 #include <linux/virtio_ids.h>
38 #include <linux/virtio_config.h>
39 #include "mac80211_hwsim.h"
40 
41 #define WARN_QUEUE 100
42 #define MAX_QUEUE 200
43 
44 MODULE_AUTHOR("Jouni Malinen");
45 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
46 MODULE_LICENSE("GPL");
47 
48 static int radios = 2;
49 module_param(radios, int, 0444);
50 MODULE_PARM_DESC(radios, "Number of simulated radios");
51 
52 static int channels = 1;
53 module_param(channels, int, 0444);
54 MODULE_PARM_DESC(channels, "Number of concurrent channels");
55 
56 static bool paged_rx = false;
57 module_param(paged_rx, bool, 0644);
58 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
59 
60 static bool rctbl = false;
61 module_param(rctbl, bool, 0444);
62 MODULE_PARM_DESC(rctbl, "Handle rate control table");
63 
64 static bool support_p2p_device = true;
65 module_param(support_p2p_device, bool, 0444);
66 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
67 
68 static bool mlo;
69 module_param(mlo, bool, 0444);
70 MODULE_PARM_DESC(mlo, "Support MLO");
71 
72 /**
73  * enum hwsim_regtest - the type of regulatory tests we offer
74  *
75  * These are the different values you can use for the regtest
76  * module parameter. This is useful to help test world roaming
77  * and the driver regulatory_hint() call and combinations of these.
78  * If you want to do specific alpha2 regulatory domain tests simply
79  * use the userspace regulatory request as that will be respected as
80  * well without the need of this module parameter. This is designed
81  * only for testing the driver regulatory request, world roaming
82  * and all possible combinations.
83  *
84  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
85  * 	this is the default value.
86  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
87  *	hint, only one driver regulatory hint will be sent as such the
88  * 	secondary radios are expected to follow.
89  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
90  * 	request with all radios reporting the same regulatory domain.
91  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
92  * 	different regulatory domains requests. Expected behaviour is for
93  * 	an intersection to occur but each device will still use their
94  * 	respective regulatory requested domains. Subsequent radios will
95  * 	use the resulting intersection.
96  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
97  *	this by using a custom beacon-capable regulatory domain for the first
98  *	radio. All other device world roam.
99  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
100  * 	domain requests. All radios will adhere to this custom world regulatory
101  * 	domain.
102  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
103  * 	domain requests. The first radio will adhere to the first custom world
104  * 	regulatory domain, the second one to the second custom world regulatory
105  * 	domain. All other devices will world roam.
106  * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
107  *	settings, only the first radio will send a regulatory domain request
108  *	and use strict settings. The rest of the radios are expected to follow.
109  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
110  *	settings. All radios will adhere to this.
111  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
112  *	domain settings, combined with secondary driver regulatory domain
113  *	settings. The first radio will get a strict regulatory domain setting
114  *	using the first driver regulatory request and the second radio will use
115  *	non-strict settings using the second driver regulatory request. All
116  *	other devices should follow the intersection created between the
117  *	first two.
118  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
119  * 	at least 6 radios for a complete test. We will test in this order:
120  * 	1 - driver custom world regulatory domain
121  * 	2 - second custom world regulatory domain
122  * 	3 - first driver regulatory domain request
123  * 	4 - second driver regulatory domain request
124  * 	5 - strict regulatory domain settings using the third driver regulatory
125  * 	    domain request
126  * 	6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
127  * 	           regulatory requests.
128  */
129 enum hwsim_regtest {
130 	HWSIM_REGTEST_DISABLED = 0,
131 	HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
132 	HWSIM_REGTEST_DRIVER_REG_ALL = 2,
133 	HWSIM_REGTEST_DIFF_COUNTRY = 3,
134 	HWSIM_REGTEST_WORLD_ROAM = 4,
135 	HWSIM_REGTEST_CUSTOM_WORLD = 5,
136 	HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
137 	HWSIM_REGTEST_STRICT_FOLLOW = 7,
138 	HWSIM_REGTEST_STRICT_ALL = 8,
139 	HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
140 	HWSIM_REGTEST_ALL = 10,
141 };
142 
143 /* Set to one of the HWSIM_REGTEST_* values above */
144 static int regtest = HWSIM_REGTEST_DISABLED;
145 module_param(regtest, int, 0444);
146 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
147 
148 static const char *hwsim_alpha2s[] = {
149 	"FI",
150 	"AL",
151 	"US",
152 	"DE",
153 	"JP",
154 	"AL",
155 };
156 
157 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
158 	.n_reg_rules = 5,
159 	.alpha2 =  "99",
160 	.reg_rules = {
161 		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
162 		REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
163 		REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
164 		REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
165 		REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
166 	}
167 };
168 
169 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
170 	.n_reg_rules = 3,
171 	.alpha2 =  "99",
172 	.reg_rules = {
173 		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
174 		REG_RULE(5725-10, 5850+10, 40, 0, 30,
175 			 NL80211_RRF_NO_IR),
176 		REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
177 	}
178 };
179 
180 static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
181 	.n_reg_rules = 6,
182 	.alpha2 =  "99",
183 	.reg_rules = {
184 		REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
185 		REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
186 		REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
187 		REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
188 		REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
189 		REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
190 	}
191 };
192 
193 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
194 	&hwsim_world_regdom_custom_01,
195 	&hwsim_world_regdom_custom_02,
196 	&hwsim_world_regdom_custom_03,
197 };
198 
199 struct hwsim_vif_priv {
200 	u32 magic;
201 	u8 bssid[ETH_ALEN];
202 	bool assoc;
203 	bool bcn_en;
204 	u16 aid;
205 };
206 
207 #define HWSIM_VIF_MAGIC	0x69537748
208 
hwsim_check_magic(struct ieee80211_vif * vif)209 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
210 {
211 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
212 	WARN(vp->magic != HWSIM_VIF_MAGIC,
213 	     "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
214 	     vif, vp->magic, vif->addr, vif->type, vif->p2p);
215 }
216 
hwsim_set_magic(struct ieee80211_vif * vif)217 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
218 {
219 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
220 	vp->magic = HWSIM_VIF_MAGIC;
221 }
222 
hwsim_clear_magic(struct ieee80211_vif * vif)223 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
224 {
225 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
226 	vp->magic = 0;
227 }
228 
229 struct hwsim_sta_priv {
230 	u32 magic;
231 	unsigned int last_link;
232 	u16 active_links_rx;
233 };
234 
235 #define HWSIM_STA_MAGIC	0x6d537749
236 
hwsim_check_sta_magic(struct ieee80211_sta * sta)237 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
238 {
239 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
240 	WARN_ON(sp->magic != HWSIM_STA_MAGIC);
241 }
242 
hwsim_set_sta_magic(struct ieee80211_sta * sta)243 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
244 {
245 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
246 	sp->magic = HWSIM_STA_MAGIC;
247 }
248 
hwsim_clear_sta_magic(struct ieee80211_sta * sta)249 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
250 {
251 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
252 	sp->magic = 0;
253 }
254 
255 struct hwsim_chanctx_priv {
256 	u32 magic;
257 };
258 
259 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
260 
hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf * c)261 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
262 {
263 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
264 	WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
265 }
266 
hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf * c)267 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
268 {
269 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
270 	cp->magic = HWSIM_CHANCTX_MAGIC;
271 }
272 
hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf * c)273 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
274 {
275 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
276 	cp->magic = 0;
277 }
278 
279 static unsigned int hwsim_net_id;
280 
281 static DEFINE_IDA(hwsim_netgroup_ida);
282 
283 struct hwsim_net {
284 	int netgroup;
285 	u32 wmediumd;
286 };
287 
hwsim_net_get_netgroup(struct net * net)288 static inline int hwsim_net_get_netgroup(struct net *net)
289 {
290 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
291 
292 	return hwsim_net->netgroup;
293 }
294 
hwsim_net_set_netgroup(struct net * net)295 static inline int hwsim_net_set_netgroup(struct net *net)
296 {
297 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
298 
299 	hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
300 	return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
301 }
302 
hwsim_net_get_wmediumd(struct net * net)303 static inline u32 hwsim_net_get_wmediumd(struct net *net)
304 {
305 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
306 
307 	return hwsim_net->wmediumd;
308 }
309 
hwsim_net_set_wmediumd(struct net * net,u32 portid)310 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
311 {
312 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
313 
314 	hwsim_net->wmediumd = portid;
315 }
316 
317 static struct class *hwsim_class;
318 
319 static struct net_device *hwsim_mon; /* global monitor netdev */
320 
321 #define CHAN2G(_freq)  { \
322 	.band = NL80211_BAND_2GHZ, \
323 	.center_freq = (_freq), \
324 	.hw_value = (_freq), \
325 }
326 
327 #define CHAN5G(_freq) { \
328 	.band = NL80211_BAND_5GHZ, \
329 	.center_freq = (_freq), \
330 	.hw_value = (_freq), \
331 }
332 
333 #define CHAN6G(_freq) { \
334 	.band = NL80211_BAND_6GHZ, \
335 	.center_freq = (_freq), \
336 	.hw_value = (_freq), \
337 }
338 
339 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
340 	CHAN2G(2412), /* Channel 1 */
341 	CHAN2G(2417), /* Channel 2 */
342 	CHAN2G(2422), /* Channel 3 */
343 	CHAN2G(2427), /* Channel 4 */
344 	CHAN2G(2432), /* Channel 5 */
345 	CHAN2G(2437), /* Channel 6 */
346 	CHAN2G(2442), /* Channel 7 */
347 	CHAN2G(2447), /* Channel 8 */
348 	CHAN2G(2452), /* Channel 9 */
349 	CHAN2G(2457), /* Channel 10 */
350 	CHAN2G(2462), /* Channel 11 */
351 	CHAN2G(2467), /* Channel 12 */
352 	CHAN2G(2472), /* Channel 13 */
353 	CHAN2G(2484), /* Channel 14 */
354 };
355 
356 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
357 	CHAN5G(5180), /* Channel 36 */
358 	CHAN5G(5200), /* Channel 40 */
359 	CHAN5G(5220), /* Channel 44 */
360 	CHAN5G(5240), /* Channel 48 */
361 
362 	CHAN5G(5260), /* Channel 52 */
363 	CHAN5G(5280), /* Channel 56 */
364 	CHAN5G(5300), /* Channel 60 */
365 	CHAN5G(5320), /* Channel 64 */
366 
367 	CHAN5G(5500), /* Channel 100 */
368 	CHAN5G(5520), /* Channel 104 */
369 	CHAN5G(5540), /* Channel 108 */
370 	CHAN5G(5560), /* Channel 112 */
371 	CHAN5G(5580), /* Channel 116 */
372 	CHAN5G(5600), /* Channel 120 */
373 	CHAN5G(5620), /* Channel 124 */
374 	CHAN5G(5640), /* Channel 128 */
375 	CHAN5G(5660), /* Channel 132 */
376 	CHAN5G(5680), /* Channel 136 */
377 	CHAN5G(5700), /* Channel 140 */
378 
379 	CHAN5G(5745), /* Channel 149 */
380 	CHAN5G(5765), /* Channel 153 */
381 	CHAN5G(5785), /* Channel 157 */
382 	CHAN5G(5805), /* Channel 161 */
383 	CHAN5G(5825), /* Channel 165 */
384 	CHAN5G(5845), /* Channel 169 */
385 
386 	CHAN5G(5855), /* Channel 171 */
387 	CHAN5G(5860), /* Channel 172 */
388 	CHAN5G(5865), /* Channel 173 */
389 	CHAN5G(5870), /* Channel 174 */
390 
391 	CHAN5G(5875), /* Channel 175 */
392 	CHAN5G(5880), /* Channel 176 */
393 	CHAN5G(5885), /* Channel 177 */
394 	CHAN5G(5890), /* Channel 178 */
395 	CHAN5G(5895), /* Channel 179 */
396 	CHAN5G(5900), /* Channel 180 */
397 	CHAN5G(5905), /* Channel 181 */
398 
399 	CHAN5G(5910), /* Channel 182 */
400 	CHAN5G(5915), /* Channel 183 */
401 	CHAN5G(5920), /* Channel 184 */
402 	CHAN5G(5925), /* Channel 185 */
403 };
404 
405 static const struct ieee80211_channel hwsim_channels_6ghz[] = {
406 	CHAN6G(5955), /* Channel 1 */
407 	CHAN6G(5975), /* Channel 5 */
408 	CHAN6G(5995), /* Channel 9 */
409 	CHAN6G(6015), /* Channel 13 */
410 	CHAN6G(6035), /* Channel 17 */
411 	CHAN6G(6055), /* Channel 21 */
412 	CHAN6G(6075), /* Channel 25 */
413 	CHAN6G(6095), /* Channel 29 */
414 	CHAN6G(6115), /* Channel 33 */
415 	CHAN6G(6135), /* Channel 37 */
416 	CHAN6G(6155), /* Channel 41 */
417 	CHAN6G(6175), /* Channel 45 */
418 	CHAN6G(6195), /* Channel 49 */
419 	CHAN6G(6215), /* Channel 53 */
420 	CHAN6G(6235), /* Channel 57 */
421 	CHAN6G(6255), /* Channel 61 */
422 	CHAN6G(6275), /* Channel 65 */
423 	CHAN6G(6295), /* Channel 69 */
424 	CHAN6G(6315), /* Channel 73 */
425 	CHAN6G(6335), /* Channel 77 */
426 	CHAN6G(6355), /* Channel 81 */
427 	CHAN6G(6375), /* Channel 85 */
428 	CHAN6G(6395), /* Channel 89 */
429 	CHAN6G(6415), /* Channel 93 */
430 	CHAN6G(6435), /* Channel 97 */
431 	CHAN6G(6455), /* Channel 181 */
432 	CHAN6G(6475), /* Channel 105 */
433 	CHAN6G(6495), /* Channel 109 */
434 	CHAN6G(6515), /* Channel 113 */
435 	CHAN6G(6535), /* Channel 117 */
436 	CHAN6G(6555), /* Channel 121 */
437 	CHAN6G(6575), /* Channel 125 */
438 	CHAN6G(6595), /* Channel 129 */
439 	CHAN6G(6615), /* Channel 133 */
440 	CHAN6G(6635), /* Channel 137 */
441 	CHAN6G(6655), /* Channel 141 */
442 	CHAN6G(6675), /* Channel 145 */
443 	CHAN6G(6695), /* Channel 149 */
444 	CHAN6G(6715), /* Channel 153 */
445 	CHAN6G(6735), /* Channel 157 */
446 	CHAN6G(6755), /* Channel 161 */
447 	CHAN6G(6775), /* Channel 165 */
448 	CHAN6G(6795), /* Channel 169 */
449 	CHAN6G(6815), /* Channel 173 */
450 	CHAN6G(6835), /* Channel 177 */
451 	CHAN6G(6855), /* Channel 181 */
452 	CHAN6G(6875), /* Channel 185 */
453 	CHAN6G(6895), /* Channel 189 */
454 	CHAN6G(6915), /* Channel 193 */
455 	CHAN6G(6935), /* Channel 197 */
456 	CHAN6G(6955), /* Channel 201 */
457 	CHAN6G(6975), /* Channel 205 */
458 	CHAN6G(6995), /* Channel 209 */
459 	CHAN6G(7015), /* Channel 213 */
460 	CHAN6G(7035), /* Channel 217 */
461 	CHAN6G(7055), /* Channel 221 */
462 	CHAN6G(7075), /* Channel 225 */
463 	CHAN6G(7095), /* Channel 229 */
464 	CHAN6G(7115), /* Channel 233 */
465 };
466 
467 #define NUM_S1G_CHANS_US 51
468 static struct ieee80211_channel hwsim_channels_s1g[NUM_S1G_CHANS_US];
469 
470 static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
471 	.s1g = true,
472 	.cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
473 		 0,
474 		 0,
475 		 S1G_CAP3_MAX_MPDU_LEN,
476 		 0,
477 		 S1G_CAP5_AMPDU,
478 		 0,
479 		 S1G_CAP7_DUP_1MHZ,
480 		 S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
481 		 0},
482 	.nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
483 	/* RX Highest Supported Long GI Data Rate 0:7 */
484 		     0,
485 	/* RX Highest Supported Long GI Data Rate 0:7 */
486 	/* TX S1G MCS Map 0:6 */
487 		     0xfa,
488 	/* TX S1G MCS Map :7 */
489 	/* TX Highest Supported Long GI Data Rate 0:6 */
490 		     0x80,
491 	/* TX Highest Supported Long GI Data Rate 7:8 */
492 	/* Rx Single spatial stream and S1G-MCS Map for 1MHz */
493 	/* Tx Single spatial stream and S1G-MCS Map for 1MHz */
494 		     0 },
495 };
496 
hwsim_init_s1g_channels(struct ieee80211_channel * chans)497 static void hwsim_init_s1g_channels(struct ieee80211_channel *chans)
498 {
499 	int ch, freq;
500 
501 	for (ch = 0; ch < NUM_S1G_CHANS_US; ch++) {
502 		freq = 902000 + (ch + 1) * 500;
503 		chans[ch].band = NL80211_BAND_S1GHZ;
504 		chans[ch].center_freq = KHZ_TO_MHZ(freq);
505 		chans[ch].freq_offset = freq % 1000;
506 		chans[ch].hw_value = ch + 1;
507 	}
508 }
509 
510 static const struct ieee80211_rate hwsim_rates[] = {
511 	{ .bitrate = 10 },
512 	{ .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
513 	{ .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
514 	{ .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
515 	{ .bitrate = 60 },
516 	{ .bitrate = 90 },
517 	{ .bitrate = 120 },
518 	{ .bitrate = 180 },
519 	{ .bitrate = 240 },
520 	{ .bitrate = 360 },
521 	{ .bitrate = 480 },
522 	{ .bitrate = 540 }
523 };
524 
525 #define DEFAULT_RX_RSSI -50
526 
527 static const u32 hwsim_ciphers[] = {
528 	WLAN_CIPHER_SUITE_WEP40,
529 	WLAN_CIPHER_SUITE_WEP104,
530 	WLAN_CIPHER_SUITE_TKIP,
531 	WLAN_CIPHER_SUITE_CCMP,
532 	WLAN_CIPHER_SUITE_CCMP_256,
533 	WLAN_CIPHER_SUITE_GCMP,
534 	WLAN_CIPHER_SUITE_GCMP_256,
535 	WLAN_CIPHER_SUITE_AES_CMAC,
536 	WLAN_CIPHER_SUITE_BIP_CMAC_256,
537 	WLAN_CIPHER_SUITE_BIP_GMAC_128,
538 	WLAN_CIPHER_SUITE_BIP_GMAC_256,
539 };
540 
541 #define OUI_QCA 0x001374
542 #define QCA_NL80211_SUBCMD_TEST 1
543 enum qca_nl80211_vendor_subcmds {
544 	QCA_WLAN_VENDOR_ATTR_TEST = 8,
545 	QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
546 };
547 
548 static const struct nla_policy
549 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
550 	[QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
551 };
552 
mac80211_hwsim_vendor_cmd_test(struct wiphy * wiphy,struct wireless_dev * wdev,const void * data,int data_len)553 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
554 					  struct wireless_dev *wdev,
555 					  const void *data, int data_len)
556 {
557 	struct sk_buff *skb;
558 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
559 	int err;
560 	u32 val;
561 
562 	err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
563 				   data_len, hwsim_vendor_test_policy, NULL);
564 	if (err)
565 		return err;
566 	if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
567 		return -EINVAL;
568 	val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
569 	wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
570 
571 	/* Send a vendor event as a test. Note that this would not normally be
572 	 * done within a command handler, but rather, based on some other
573 	 * trigger. For simplicity, this command is used to trigger the event
574 	 * here.
575 	 *
576 	 * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
577 	 */
578 	skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
579 	if (skb) {
580 		/* skb_put() or nla_put() will fill up data within
581 		 * NL80211_ATTR_VENDOR_DATA.
582 		 */
583 
584 		/* Add vendor data */
585 		nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
586 
587 		/* Send the event - this will call nla_nest_end() */
588 		cfg80211_vendor_event(skb, GFP_KERNEL);
589 	}
590 
591 	/* Send a response to the command */
592 	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
593 	if (!skb)
594 		return -ENOMEM;
595 
596 	/* skb_put() or nla_put() will fill up data within
597 	 * NL80211_ATTR_VENDOR_DATA
598 	 */
599 	nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
600 
601 	return cfg80211_vendor_cmd_reply(skb);
602 }
603 
604 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
605 	{
606 		.info = { .vendor_id = OUI_QCA,
607 			  .subcmd = QCA_NL80211_SUBCMD_TEST },
608 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
609 		.doit = mac80211_hwsim_vendor_cmd_test,
610 		.policy = hwsim_vendor_test_policy,
611 		.maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
612 	}
613 };
614 
615 /* Advertise support vendor specific events */
616 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
617 	{ .vendor_id = OUI_QCA, .subcmd = 1 },
618 };
619 
620 static DEFINE_SPINLOCK(hwsim_radio_lock);
621 static LIST_HEAD(hwsim_radios);
622 static struct rhashtable hwsim_radios_rht;
623 static int hwsim_radio_idx;
624 static int hwsim_radios_generation = 1;
625 
626 static struct platform_driver mac80211_hwsim_driver = {
627 	.driver = {
628 		.name = "mac80211_hwsim",
629 	},
630 };
631 
632 struct mac80211_hwsim_link_data {
633 	u32 link_id;
634 	u64 beacon_int	/* beacon interval in us */;
635 	struct hrtimer beacon_timer;
636 };
637 
638 struct mac80211_hwsim_data {
639 	struct list_head list;
640 	struct rhash_head rht;
641 	struct ieee80211_hw *hw;
642 	struct device *dev;
643 	struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
644 	struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
645 	struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
646 	struct ieee80211_channel channels_6ghz[ARRAY_SIZE(hwsim_channels_6ghz)];
647 	struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
648 	struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
649 	struct ieee80211_iface_combination if_combination;
650 	struct ieee80211_iface_limit if_limits[3];
651 	int n_if_limits;
652 
653 	u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
654 
655 	struct mac_address addresses[2];
656 	int channels, idx;
657 	bool use_chanctx;
658 	bool destroy_on_close;
659 	u32 portid;
660 	char alpha2[2];
661 	const struct ieee80211_regdomain *regd;
662 
663 	struct ieee80211_channel *tmp_chan;
664 	struct ieee80211_channel *roc_chan;
665 	u32 roc_duration;
666 	struct delayed_work roc_start;
667 	struct delayed_work roc_done;
668 	struct delayed_work hw_scan;
669 	struct cfg80211_scan_request *hw_scan_request;
670 	struct ieee80211_vif *hw_scan_vif;
671 	int scan_chan_idx;
672 	u8 scan_addr[ETH_ALEN];
673 	struct {
674 		struct ieee80211_channel *channel;
675 		unsigned long next_start, start, end;
676 	} survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
677 		      ARRAY_SIZE(hwsim_channels_5ghz) +
678 		      ARRAY_SIZE(hwsim_channels_6ghz)];
679 
680 	struct ieee80211_channel *channel;
681 	enum nl80211_chan_width bw;
682 	unsigned int rx_filter;
683 	bool started, idle, scanning;
684 	struct mutex mutex;
685 	enum ps_mode {
686 		PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
687 	} ps;
688 	bool ps_poll_pending;
689 	struct dentry *debugfs;
690 
691 	atomic_t pending_cookie;
692 	struct sk_buff_head pending;	/* packets pending */
693 	/*
694 	 * Only radios in the same group can communicate together (the
695 	 * channel has to match too). Each bit represents a group. A
696 	 * radio can be in more than one group.
697 	 */
698 	u64 group;
699 
700 	/* group shared by radios created in the same netns */
701 	int netgroup;
702 	/* wmediumd portid responsible for netgroup of this radio */
703 	u32 wmediumd;
704 
705 	/* difference between this hw's clock and the real clock, in usecs */
706 	s64 tsf_offset;
707 	s64 bcn_delta;
708 	/* absolute beacon transmission time. Used to cover up "tx" delay. */
709 	u64 abs_bcn_ts;
710 
711 	/* Stats */
712 	u64 tx_pkts;
713 	u64 rx_pkts;
714 	u64 tx_bytes;
715 	u64 rx_bytes;
716 	u64 tx_dropped;
717 	u64 tx_failed;
718 
719 	/* RSSI in rx status of the receiver */
720 	int rx_rssi;
721 
722 	struct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];
723 };
724 
725 static const struct rhashtable_params hwsim_rht_params = {
726 	.nelem_hint = 2,
727 	.automatic_shrinking = true,
728 	.key_len = ETH_ALEN,
729 	.key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
730 	.head_offset = offsetof(struct mac80211_hwsim_data, rht),
731 };
732 
733 struct hwsim_radiotap_hdr {
734 	struct ieee80211_radiotap_header hdr;
735 	__le64 rt_tsft;
736 	u8 rt_flags;
737 	u8 rt_rate;
738 	__le16 rt_channel;
739 	__le16 rt_chbitmask;
740 } __packed;
741 
742 struct hwsim_radiotap_ack_hdr {
743 	struct ieee80211_radiotap_header hdr;
744 	u8 rt_flags;
745 	u8 pad;
746 	__le16 rt_channel;
747 	__le16 rt_chbitmask;
748 } __packed;
749 
750 /* MAC80211_HWSIM netlink family */
751 static struct genl_family hwsim_genl_family;
752 
753 enum hwsim_multicast_groups {
754 	HWSIM_MCGRP_CONFIG,
755 };
756 
757 static const struct genl_multicast_group hwsim_mcgrps[] = {
758 	[HWSIM_MCGRP_CONFIG] = { .name = "config", },
759 };
760 
761 /* MAC80211_HWSIM netlink policy */
762 
763 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
764 	[HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
765 	[HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
766 	[HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
767 			       .len = IEEE80211_MAX_DATA_LEN },
768 	[HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
769 	[HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
770 	[HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
771 	[HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
772 				 .len = IEEE80211_TX_MAX_RATES *
773 					sizeof(struct hwsim_tx_rate)},
774 	[HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
775 	[HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
776 	[HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
777 	[HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
778 	[HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
779 	[HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
780 	[HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
781 	[HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
782 	[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
783 	[HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
784 	[HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
785 	[HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
786 	[HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
787 	[HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
788 	[HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
789 	[HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
790 	[HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
791 };
792 
793 #if IS_REACHABLE(CONFIG_VIRTIO)
794 
795 /* MAC80211_HWSIM virtio queues */
796 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
797 static bool hwsim_virtio_enabled;
798 static DEFINE_SPINLOCK(hwsim_virtio_lock);
799 
800 static void hwsim_virtio_rx_work(struct work_struct *work);
801 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
802 
hwsim_tx_virtio(struct mac80211_hwsim_data * data,struct sk_buff * skb)803 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
804 			   struct sk_buff *skb)
805 {
806 	struct scatterlist sg[1];
807 	unsigned long flags;
808 	int err;
809 
810 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
811 	if (!hwsim_virtio_enabled) {
812 		err = -ENODEV;
813 		goto out_free;
814 	}
815 
816 	sg_init_one(sg, skb->head, skb_end_offset(skb));
817 	err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
818 				   GFP_ATOMIC);
819 	if (err)
820 		goto out_free;
821 	virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
822 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
823 	return 0;
824 
825 out_free:
826 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
827 	nlmsg_free(skb);
828 	return err;
829 }
830 #else
831 /* cause a linker error if this ends up being needed */
832 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
833 			   struct sk_buff *skb);
834 #define hwsim_virtio_enabled false
835 #endif
836 
hwsim_get_chanwidth(enum nl80211_chan_width bw)837 static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
838 {
839 	switch (bw) {
840 	case NL80211_CHAN_WIDTH_20_NOHT:
841 	case NL80211_CHAN_WIDTH_20:
842 		return 20;
843 	case NL80211_CHAN_WIDTH_40:
844 		return 40;
845 	case NL80211_CHAN_WIDTH_80:
846 		return 80;
847 	case NL80211_CHAN_WIDTH_80P80:
848 	case NL80211_CHAN_WIDTH_160:
849 		return 160;
850 	case NL80211_CHAN_WIDTH_320:
851 		return 320;
852 	case NL80211_CHAN_WIDTH_5:
853 		return 5;
854 	case NL80211_CHAN_WIDTH_10:
855 		return 10;
856 	case NL80211_CHAN_WIDTH_1:
857 		return 1;
858 	case NL80211_CHAN_WIDTH_2:
859 		return 2;
860 	case NL80211_CHAN_WIDTH_4:
861 		return 4;
862 	case NL80211_CHAN_WIDTH_8:
863 		return 8;
864 	case NL80211_CHAN_WIDTH_16:
865 		return 16;
866 	}
867 
868 	return INT_MAX;
869 }
870 
871 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
872 				    struct sk_buff *skb,
873 				    struct ieee80211_channel *chan);
874 
875 /* sysfs attributes */
hwsim_send_ps_poll(void * dat,u8 * mac,struct ieee80211_vif * vif)876 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
877 {
878 	struct mac80211_hwsim_data *data = dat;
879 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
880 	struct sk_buff *skb;
881 	struct ieee80211_pspoll *pspoll;
882 
883 	if (!vp->assoc)
884 		return;
885 
886 	wiphy_dbg(data->hw->wiphy,
887 		  "%s: send PS-Poll to %pM for aid %d\n",
888 		  __func__, vp->bssid, vp->aid);
889 
890 	skb = dev_alloc_skb(sizeof(*pspoll));
891 	if (!skb)
892 		return;
893 	pspoll = skb_put(skb, sizeof(*pspoll));
894 	pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
895 					    IEEE80211_STYPE_PSPOLL |
896 					    IEEE80211_FCTL_PM);
897 	pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
898 	memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
899 	memcpy(pspoll->ta, mac, ETH_ALEN);
900 
901 	rcu_read_lock();
902 	mac80211_hwsim_tx_frame(data->hw, skb,
903 				rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
904 	rcu_read_unlock();
905 }
906 
hwsim_send_nullfunc(struct mac80211_hwsim_data * data,u8 * mac,struct ieee80211_vif * vif,int ps)907 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
908 				struct ieee80211_vif *vif, int ps)
909 {
910 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
911 	struct sk_buff *skb;
912 	struct ieee80211_hdr *hdr;
913 	struct ieee80211_tx_info *cb;
914 
915 	if (!vp->assoc)
916 		return;
917 
918 	wiphy_dbg(data->hw->wiphy,
919 		  "%s: send data::nullfunc to %pM ps=%d\n",
920 		  __func__, vp->bssid, ps);
921 
922 	skb = dev_alloc_skb(sizeof(*hdr));
923 	if (!skb)
924 		return;
925 	hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
926 	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
927 					 IEEE80211_STYPE_NULLFUNC |
928 					 IEEE80211_FCTL_TODS |
929 					 (ps ? IEEE80211_FCTL_PM : 0));
930 	hdr->duration_id = cpu_to_le16(0);
931 	memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
932 	memcpy(hdr->addr2, mac, ETH_ALEN);
933 	memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
934 
935 	cb = IEEE80211_SKB_CB(skb);
936 	cb->control.rates[0].count = 1;
937 	cb->control.rates[1].idx = -1;
938 
939 	rcu_read_lock();
940 	mac80211_hwsim_tx_frame(data->hw, skb,
941 				rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
942 	rcu_read_unlock();
943 }
944 
945 
hwsim_send_nullfunc_ps(void * dat,u8 * mac,struct ieee80211_vif * vif)946 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
947 				   struct ieee80211_vif *vif)
948 {
949 	struct mac80211_hwsim_data *data = dat;
950 	hwsim_send_nullfunc(data, mac, vif, 1);
951 }
952 
hwsim_send_nullfunc_no_ps(void * dat,u8 * mac,struct ieee80211_vif * vif)953 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
954 				      struct ieee80211_vif *vif)
955 {
956 	struct mac80211_hwsim_data *data = dat;
957 	hwsim_send_nullfunc(data, mac, vif, 0);
958 }
959 
hwsim_fops_ps_read(void * dat,u64 * val)960 static int hwsim_fops_ps_read(void *dat, u64 *val)
961 {
962 	struct mac80211_hwsim_data *data = dat;
963 	*val = data->ps;
964 	return 0;
965 }
966 
hwsim_fops_ps_write(void * dat,u64 val)967 static int hwsim_fops_ps_write(void *dat, u64 val)
968 {
969 	struct mac80211_hwsim_data *data = dat;
970 	enum ps_mode old_ps;
971 
972 	if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
973 	    val != PS_MANUAL_POLL)
974 		return -EINVAL;
975 
976 	if (val == PS_MANUAL_POLL) {
977 		if (data->ps != PS_ENABLED)
978 			return -EINVAL;
979 		local_bh_disable();
980 		ieee80211_iterate_active_interfaces_atomic(
981 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
982 			hwsim_send_ps_poll, data);
983 		local_bh_enable();
984 		return 0;
985 	}
986 	old_ps = data->ps;
987 	data->ps = val;
988 
989 	local_bh_disable();
990 	if (old_ps == PS_DISABLED && val != PS_DISABLED) {
991 		ieee80211_iterate_active_interfaces_atomic(
992 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
993 			hwsim_send_nullfunc_ps, data);
994 	} else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
995 		ieee80211_iterate_active_interfaces_atomic(
996 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
997 			hwsim_send_nullfunc_no_ps, data);
998 	}
999 	local_bh_enable();
1000 
1001 	return 0;
1002 }
1003 
1004 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1005 			 "%llu\n");
1006 
hwsim_write_simulate_radar(void * dat,u64 val)1007 static int hwsim_write_simulate_radar(void *dat, u64 val)
1008 {
1009 	struct mac80211_hwsim_data *data = dat;
1010 
1011 	ieee80211_radar_detected(data->hw);
1012 
1013 	return 0;
1014 }
1015 
1016 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1017 			 hwsim_write_simulate_radar, "%llu\n");
1018 
hwsim_fops_group_read(void * dat,u64 * val)1019 static int hwsim_fops_group_read(void *dat, u64 *val)
1020 {
1021 	struct mac80211_hwsim_data *data = dat;
1022 	*val = data->group;
1023 	return 0;
1024 }
1025 
hwsim_fops_group_write(void * dat,u64 val)1026 static int hwsim_fops_group_write(void *dat, u64 val)
1027 {
1028 	struct mac80211_hwsim_data *data = dat;
1029 	data->group = val;
1030 	return 0;
1031 }
1032 
1033 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1034 			 hwsim_fops_group_read, hwsim_fops_group_write,
1035 			 "%llx\n");
1036 
hwsim_fops_rx_rssi_read(void * dat,u64 * val)1037 static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1038 {
1039 	struct mac80211_hwsim_data *data = dat;
1040 	*val = data->rx_rssi;
1041 	return 0;
1042 }
1043 
hwsim_fops_rx_rssi_write(void * dat,u64 val)1044 static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1045 {
1046 	struct mac80211_hwsim_data *data = dat;
1047 	int rssi = (int)val;
1048 
1049 	if (rssi >= 0 || rssi < -100)
1050 		return -EINVAL;
1051 
1052 	data->rx_rssi = rssi;
1053 	return 0;
1054 }
1055 
1056 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1057 			 hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1058 			 "%lld\n");
1059 
hwsim_mon_xmit(struct sk_buff * skb,struct net_device * dev)1060 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1061 					struct net_device *dev)
1062 {
1063 	/* TODO: allow packet injection */
1064 	dev_kfree_skb(skb);
1065 	return NETDEV_TX_OK;
1066 }
1067 
mac80211_hwsim_get_tsf_raw(void)1068 static inline u64 mac80211_hwsim_get_tsf_raw(void)
1069 {
1070 	return ktime_to_us(ktime_get_real());
1071 }
1072 
__mac80211_hwsim_get_tsf(struct mac80211_hwsim_data * data)1073 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1074 {
1075 	u64 now = mac80211_hwsim_get_tsf_raw();
1076 	return cpu_to_le64(now + data->tsf_offset);
1077 }
1078 
mac80211_hwsim_get_tsf(struct ieee80211_hw * hw,struct ieee80211_vif * vif)1079 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1080 				  struct ieee80211_vif *vif)
1081 {
1082 	struct mac80211_hwsim_data *data = hw->priv;
1083 	return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
1084 }
1085 
mac80211_hwsim_set_tsf(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u64 tsf)1086 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1087 		struct ieee80211_vif *vif, u64 tsf)
1088 {
1089 	struct mac80211_hwsim_data *data = hw->priv;
1090 	u64 now = mac80211_hwsim_get_tsf(hw, vif);
1091 	/* MLD not supported here */
1092 	u32 bcn_int = data->link_data[0].beacon_int;
1093 	u64 delta = abs(tsf - now);
1094 
1095 	/* adjust after beaconing with new timestamp at old TBTT */
1096 	if (tsf > now) {
1097 		data->tsf_offset += delta;
1098 		data->bcn_delta = do_div(delta, bcn_int);
1099 	} else {
1100 		data->tsf_offset -= delta;
1101 		data->bcn_delta = -(s64)do_div(delta, bcn_int);
1102 	}
1103 }
1104 
mac80211_hwsim_monitor_rx(struct ieee80211_hw * hw,struct sk_buff * tx_skb,struct ieee80211_channel * chan)1105 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1106 				      struct sk_buff *tx_skb,
1107 				      struct ieee80211_channel *chan)
1108 {
1109 	struct mac80211_hwsim_data *data = hw->priv;
1110 	struct sk_buff *skb;
1111 	struct hwsim_radiotap_hdr *hdr;
1112 	u16 flags, bitrate;
1113 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1114 	struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
1115 
1116 	if (!txrate)
1117 		bitrate = 0;
1118 	else
1119 		bitrate = txrate->bitrate;
1120 
1121 	if (!netif_running(hwsim_mon))
1122 		return;
1123 
1124 	skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1125 	if (skb == NULL)
1126 		return;
1127 
1128 	hdr = skb_push(skb, sizeof(*hdr));
1129 	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1130 	hdr->hdr.it_pad = 0;
1131 	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1132 	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1133 					  (1 << IEEE80211_RADIOTAP_RATE) |
1134 					  (1 << IEEE80211_RADIOTAP_TSFT) |
1135 					  (1 << IEEE80211_RADIOTAP_CHANNEL));
1136 	hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1137 	hdr->rt_flags = 0;
1138 	hdr->rt_rate = bitrate / 5;
1139 	hdr->rt_channel = cpu_to_le16(chan->center_freq);
1140 	flags = IEEE80211_CHAN_2GHZ;
1141 	if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1142 		flags |= IEEE80211_CHAN_OFDM;
1143 	else
1144 		flags |= IEEE80211_CHAN_CCK;
1145 	hdr->rt_chbitmask = cpu_to_le16(flags);
1146 
1147 	skb->dev = hwsim_mon;
1148 	skb_reset_mac_header(skb);
1149 	skb->ip_summed = CHECKSUM_UNNECESSARY;
1150 	skb->pkt_type = PACKET_OTHERHOST;
1151 	skb->protocol = htons(ETH_P_802_2);
1152 	memset(skb->cb, 0, sizeof(skb->cb));
1153 	netif_rx(skb);
1154 }
1155 
1156 
mac80211_hwsim_monitor_ack(struct ieee80211_channel * chan,const u8 * addr)1157 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
1158 				       const u8 *addr)
1159 {
1160 	struct sk_buff *skb;
1161 	struct hwsim_radiotap_ack_hdr *hdr;
1162 	u16 flags;
1163 	struct ieee80211_hdr *hdr11;
1164 
1165 	if (!netif_running(hwsim_mon))
1166 		return;
1167 
1168 	skb = dev_alloc_skb(100);
1169 	if (skb == NULL)
1170 		return;
1171 
1172 	hdr = skb_put(skb, sizeof(*hdr));
1173 	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1174 	hdr->hdr.it_pad = 0;
1175 	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1176 	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1177 					  (1 << IEEE80211_RADIOTAP_CHANNEL));
1178 	hdr->rt_flags = 0;
1179 	hdr->pad = 0;
1180 	hdr->rt_channel = cpu_to_le16(chan->center_freq);
1181 	flags = IEEE80211_CHAN_2GHZ;
1182 	hdr->rt_chbitmask = cpu_to_le16(flags);
1183 
1184 	hdr11 = skb_put(skb, 10);
1185 	hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1186 					   IEEE80211_STYPE_ACK);
1187 	hdr11->duration_id = cpu_to_le16(0);
1188 	memcpy(hdr11->addr1, addr, ETH_ALEN);
1189 
1190 	skb->dev = hwsim_mon;
1191 	skb_reset_mac_header(skb);
1192 	skb->ip_summed = CHECKSUM_UNNECESSARY;
1193 	skb->pkt_type = PACKET_OTHERHOST;
1194 	skb->protocol = htons(ETH_P_802_2);
1195 	memset(skb->cb, 0, sizeof(skb->cb));
1196 	netif_rx(skb);
1197 }
1198 
1199 struct mac80211_hwsim_addr_match_data {
1200 	u8 addr[ETH_ALEN];
1201 	bool ret;
1202 };
1203 
mac80211_hwsim_addr_iter(void * data,u8 * mac,struct ieee80211_vif * vif)1204 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1205 				     struct ieee80211_vif *vif)
1206 {
1207 	int i;
1208 	struct mac80211_hwsim_addr_match_data *md = data;
1209 
1210 	if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1211 		md->ret = true;
1212 		return;
1213 	}
1214 
1215 	/* Match the link address */
1216 	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1217 		struct ieee80211_bss_conf *conf;
1218 
1219 		conf = rcu_dereference(vif->link_conf[i]);
1220 		if (!conf)
1221 			continue;
1222 
1223 		if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1224 			md->ret = true;
1225 			return;
1226 		}
1227 	}
1228 }
1229 
mac80211_hwsim_addr_match(struct mac80211_hwsim_data * data,const u8 * addr)1230 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1231 				      const u8 *addr)
1232 {
1233 	struct mac80211_hwsim_addr_match_data md = {
1234 		.ret = false,
1235 	};
1236 
1237 	if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1238 		return true;
1239 
1240 	memcpy(md.addr, addr, ETH_ALEN);
1241 
1242 	ieee80211_iterate_active_interfaces_atomic(data->hw,
1243 						   IEEE80211_IFACE_ITER_NORMAL,
1244 						   mac80211_hwsim_addr_iter,
1245 						   &md);
1246 
1247 	return md.ret;
1248 }
1249 
hwsim_ps_rx_ok(struct mac80211_hwsim_data * data,struct sk_buff * skb)1250 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1251 			   struct sk_buff *skb)
1252 {
1253 	switch (data->ps) {
1254 	case PS_DISABLED:
1255 		return true;
1256 	case PS_ENABLED:
1257 		return false;
1258 	case PS_AUTO_POLL:
1259 		/* TODO: accept (some) Beacons by default and other frames only
1260 		 * if pending PS-Poll has been sent */
1261 		return true;
1262 	case PS_MANUAL_POLL:
1263 		/* Allow unicast frames to own address if there is a pending
1264 		 * PS-Poll */
1265 		if (data->ps_poll_pending &&
1266 		    mac80211_hwsim_addr_match(data, skb->data + 4)) {
1267 			data->ps_poll_pending = false;
1268 			return true;
1269 		}
1270 		return false;
1271 	}
1272 
1273 	return true;
1274 }
1275 
hwsim_unicast_netgroup(struct mac80211_hwsim_data * data,struct sk_buff * skb,int portid)1276 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1277 				  struct sk_buff *skb, int portid)
1278 {
1279 	struct net *net;
1280 	bool found = false;
1281 	int res = -ENOENT;
1282 
1283 	rcu_read_lock();
1284 	for_each_net_rcu(net) {
1285 		if (data->netgroup == hwsim_net_get_netgroup(net)) {
1286 			res = genlmsg_unicast(net, skb, portid);
1287 			found = true;
1288 			break;
1289 		}
1290 	}
1291 	rcu_read_unlock();
1292 
1293 	if (!found)
1294 		nlmsg_free(skb);
1295 
1296 	return res;
1297 }
1298 
mac80211_hwsim_config_mac_nl(struct ieee80211_hw * hw,const u8 * addr,bool add)1299 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1300 					 const u8 *addr, bool add)
1301 {
1302 	struct mac80211_hwsim_data *data = hw->priv;
1303 	u32 _portid = READ_ONCE(data->wmediumd);
1304 	struct sk_buff *skb;
1305 	void *msg_head;
1306 
1307 	WARN_ON(!is_valid_ether_addr(addr));
1308 
1309 	if (!_portid && !hwsim_virtio_enabled)
1310 		return;
1311 
1312 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1313 	if (!skb)
1314 		return;
1315 
1316 	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1317 			       add ? HWSIM_CMD_ADD_MAC_ADDR :
1318 				     HWSIM_CMD_DEL_MAC_ADDR);
1319 	if (!msg_head) {
1320 		pr_debug("mac80211_hwsim: problem with msg_head\n");
1321 		goto nla_put_failure;
1322 	}
1323 
1324 	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1325 		    ETH_ALEN, data->addresses[1].addr))
1326 		goto nla_put_failure;
1327 
1328 	if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1329 		goto nla_put_failure;
1330 
1331 	genlmsg_end(skb, msg_head);
1332 
1333 	if (hwsim_virtio_enabled)
1334 		hwsim_tx_virtio(data, skb);
1335 	else
1336 		hwsim_unicast_netgroup(data, skb, _portid);
1337 	return;
1338 nla_put_failure:
1339 	nlmsg_free(skb);
1340 }
1341 
trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate * rate)1342 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1343 {
1344 	u16 result = 0;
1345 
1346 	if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1347 		result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1348 	if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1349 		result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1350 	if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1351 		result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1352 	if (rate->flags & IEEE80211_TX_RC_MCS)
1353 		result |= MAC80211_HWSIM_TX_RC_MCS;
1354 	if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1355 		result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1356 	if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1357 		result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1358 	if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1359 		result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1360 	if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1361 		result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1362 	if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1363 		result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1364 	if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1365 		result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1366 	if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1367 		result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1368 
1369 	return result;
1370 }
1371 
mac80211_hwsim_tx_frame_nl(struct ieee80211_hw * hw,struct sk_buff * my_skb,int dst_portid,struct ieee80211_channel * channel)1372 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1373 				       struct sk_buff *my_skb,
1374 				       int dst_portid,
1375 				       struct ieee80211_channel *channel)
1376 {
1377 	struct sk_buff *skb;
1378 	struct mac80211_hwsim_data *data = hw->priv;
1379 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1380 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1381 	void *msg_head;
1382 	unsigned int hwsim_flags = 0;
1383 	int i;
1384 	struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1385 	struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1386 	uintptr_t cookie;
1387 
1388 	if (data->ps != PS_DISABLED)
1389 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1390 	/* If the queue contains MAX_QUEUE skb's drop some */
1391 	if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1392 		/* Dropping until WARN_QUEUE level */
1393 		while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1394 			ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1395 			data->tx_dropped++;
1396 		}
1397 	}
1398 
1399 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1400 	if (skb == NULL)
1401 		goto nla_put_failure;
1402 
1403 	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1404 			       HWSIM_CMD_FRAME);
1405 	if (msg_head == NULL) {
1406 		pr_debug("mac80211_hwsim: problem with msg_head\n");
1407 		goto nla_put_failure;
1408 	}
1409 
1410 	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1411 		    ETH_ALEN, data->addresses[1].addr))
1412 		goto nla_put_failure;
1413 
1414 	/* We get the skb->data */
1415 	if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1416 		goto nla_put_failure;
1417 
1418 	/* We get the flags for this transmission, and we translate them to
1419 	   wmediumd flags  */
1420 
1421 	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1422 		hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1423 
1424 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1425 		hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1426 
1427 	if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1428 		goto nla_put_failure;
1429 
1430 	if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1431 		goto nla_put_failure;
1432 
1433 	/* We get the tx control (rate and retries) info*/
1434 
1435 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1436 		tx_attempts[i].idx = info->status.rates[i].idx;
1437 		tx_attempts_flags[i].idx = info->status.rates[i].idx;
1438 		tx_attempts[i].count = info->status.rates[i].count;
1439 		tx_attempts_flags[i].flags =
1440 				trans_tx_rate_flags_ieee2hwsim(
1441 						&info->status.rates[i]);
1442 	}
1443 
1444 	if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1445 		    sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1446 		    tx_attempts))
1447 		goto nla_put_failure;
1448 
1449 	if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1450 		    sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1451 		    tx_attempts_flags))
1452 		goto nla_put_failure;
1453 
1454 	/* We create a cookie to identify this skb */
1455 	cookie = atomic_inc_return(&data->pending_cookie);
1456 	info->rate_driver_data[0] = (void *)cookie;
1457 	if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1458 		goto nla_put_failure;
1459 
1460 	genlmsg_end(skb, msg_head);
1461 
1462 	if (hwsim_virtio_enabled) {
1463 		if (hwsim_tx_virtio(data, skb))
1464 			goto err_free_txskb;
1465 	} else {
1466 		if (hwsim_unicast_netgroup(data, skb, dst_portid))
1467 			goto err_free_txskb;
1468 	}
1469 
1470 	/* Enqueue the packet */
1471 	skb_queue_tail(&data->pending, my_skb);
1472 	data->tx_pkts++;
1473 	data->tx_bytes += my_skb->len;
1474 	return;
1475 
1476 nla_put_failure:
1477 	nlmsg_free(skb);
1478 err_free_txskb:
1479 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1480 	ieee80211_free_txskb(hw, my_skb);
1481 	data->tx_failed++;
1482 }
1483 
hwsim_chans_compat(struct ieee80211_channel * c1,struct ieee80211_channel * c2)1484 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1485 			       struct ieee80211_channel *c2)
1486 {
1487 	if (!c1 || !c2)
1488 		return false;
1489 
1490 	return c1->center_freq == c2->center_freq;
1491 }
1492 
1493 struct tx_iter_data {
1494 	struct ieee80211_channel *channel;
1495 	bool receive;
1496 };
1497 
mac80211_hwsim_tx_iter(void * _data,u8 * addr,struct ieee80211_vif * vif)1498 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1499 				   struct ieee80211_vif *vif)
1500 {
1501 	struct tx_iter_data *data = _data;
1502 	int i;
1503 
1504 	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1505 		struct ieee80211_bss_conf *conf;
1506 		struct ieee80211_chanctx_conf *chanctx;
1507 
1508 		conf = rcu_dereference(vif->link_conf[i]);
1509 		if (!conf)
1510 			continue;
1511 
1512 		chanctx = rcu_dereference(conf->chanctx_conf);
1513 		if (!chanctx)
1514 			continue;
1515 
1516 		if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1517 			continue;
1518 
1519 		data->receive = true;
1520 		return;
1521 	}
1522 }
1523 
mac80211_hwsim_add_vendor_rtap(struct sk_buff * skb)1524 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1525 {
1526 	/*
1527 	 * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1528 	 * e.g. like this:
1529 	 * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1530 	 * (but you should use a valid OUI, not that)
1531 	 *
1532 	 * If anyone wants to 'donate' a radiotap OUI/subns code
1533 	 * please send a patch removing this #ifdef and changing
1534 	 * the values accordingly.
1535 	 */
1536 #ifdef HWSIM_RADIOTAP_OUI
1537 	struct ieee80211_vendor_radiotap *rtap;
1538 
1539 	/*
1540 	 * Note that this code requires the headroom in the SKB
1541 	 * that was allocated earlier.
1542 	 */
1543 	rtap = skb_push(skb, sizeof(*rtap) + 8 + 4);
1544 	rtap->oui[0] = HWSIM_RADIOTAP_OUI[0];
1545 	rtap->oui[1] = HWSIM_RADIOTAP_OUI[1];
1546 	rtap->oui[2] = HWSIM_RADIOTAP_OUI[2];
1547 	rtap->subns = 127;
1548 
1549 	/*
1550 	 * Radiotap vendor namespaces can (and should) also be
1551 	 * split into fields by using the standard radiotap
1552 	 * presence bitmap mechanism. Use just BIT(0) here for
1553 	 * the presence bitmap.
1554 	 */
1555 	rtap->present = BIT(0);
1556 	/* We have 8 bytes of (dummy) data */
1557 	rtap->len = 8;
1558 	/* For testing, also require it to be aligned */
1559 	rtap->align = 8;
1560 	/* And also test that padding works, 4 bytes */
1561 	rtap->pad = 4;
1562 	/* push the data */
1563 	memcpy(rtap->data, "ABCDEFGH", 8);
1564 	/* make sure to clear padding, mac80211 doesn't */
1565 	memset(rtap->data + 8, 0, 4);
1566 
1567 	IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
1568 #endif
1569 }
1570 
mac80211_hwsim_rx(struct mac80211_hwsim_data * data,struct ieee80211_rx_status * rx_status,struct sk_buff * skb)1571 static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1572 			      struct ieee80211_rx_status *rx_status,
1573 			      struct sk_buff *skb)
1574 {
1575 	struct ieee80211_hdr *hdr = (void *)skb->data;
1576 
1577 	if (!ieee80211_has_morefrags(hdr->frame_control) &&
1578 	    !is_multicast_ether_addr(hdr->addr1) &&
1579 	    (ieee80211_is_mgmt(hdr->frame_control) ||
1580 	     ieee80211_is_data(hdr->frame_control))) {
1581 		struct ieee80211_sta *sta;
1582 		unsigned int link_id;
1583 
1584 		rcu_read_lock();
1585 		sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1586 						       hdr->addr1, &link_id);
1587 		if (sta) {
1588 			struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1589 
1590 			if (ieee80211_has_pm(hdr->frame_control))
1591 				sp->active_links_rx &= ~BIT(link_id);
1592 			else
1593 				sp->active_links_rx |= BIT(link_id);
1594 		}
1595 		rcu_read_unlock();
1596 	}
1597 
1598 	memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1599 
1600 	mac80211_hwsim_add_vendor_rtap(skb);
1601 
1602 	data->rx_pkts++;
1603 	data->rx_bytes += skb->len;
1604 	ieee80211_rx_irqsafe(data->hw, skb);
1605 }
1606 
mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw * hw,struct sk_buff * skb,struct ieee80211_channel * chan)1607 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1608 					  struct sk_buff *skb,
1609 					  struct ieee80211_channel *chan)
1610 {
1611 	struct mac80211_hwsim_data *data = hw->priv, *data2;
1612 	bool ack = false;
1613 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1614 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1615 	struct ieee80211_rx_status rx_status;
1616 	u64 now;
1617 
1618 	memset(&rx_status, 0, sizeof(rx_status));
1619 	rx_status.flag |= RX_FLAG_MACTIME_START;
1620 	rx_status.freq = chan->center_freq;
1621 	rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1622 	rx_status.band = chan->band;
1623 	if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1624 		rx_status.rate_idx =
1625 			ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1626 		rx_status.nss =
1627 			ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1628 		rx_status.encoding = RX_ENC_VHT;
1629 	} else {
1630 		rx_status.rate_idx = info->control.rates[0].idx;
1631 		if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1632 			rx_status.encoding = RX_ENC_HT;
1633 	}
1634 	if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1635 		rx_status.bw = RATE_INFO_BW_40;
1636 	else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1637 		rx_status.bw = RATE_INFO_BW_80;
1638 	else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1639 		rx_status.bw = RATE_INFO_BW_160;
1640 	else
1641 		rx_status.bw = RATE_INFO_BW_20;
1642 	if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1643 		rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1644 	/* TODO: simulate optional packet loss */
1645 	rx_status.signal = data->rx_rssi;
1646 	if (info->control.vif)
1647 		rx_status.signal += info->control.vif->bss_conf.txpower;
1648 
1649 	if (data->ps != PS_DISABLED)
1650 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1651 
1652 	/* release the skb's source info */
1653 	skb_orphan(skb);
1654 	skb_dst_drop(skb);
1655 	skb->mark = 0;
1656 	skb_ext_reset(skb);
1657 	nf_reset_ct(skb);
1658 
1659 	/*
1660 	 * Get absolute mactime here so all HWs RX at the "same time", and
1661 	 * absolute TX time for beacon mactime so the timestamp matches.
1662 	 * Giving beacons a different mactime than non-beacons looks messy, but
1663 	 * it helps the Toffset be exact and a ~10us mactime discrepancy
1664 	 * probably doesn't really matter.
1665 	 */
1666 	if (ieee80211_is_beacon(hdr->frame_control) ||
1667 	    ieee80211_is_probe_resp(hdr->frame_control)) {
1668 		rx_status.boottime_ns = ktime_get_boottime_ns();
1669 		now = data->abs_bcn_ts;
1670 	} else {
1671 		now = mac80211_hwsim_get_tsf_raw();
1672 	}
1673 
1674 	/* Copy skb to all enabled radios that are on the current frequency */
1675 	spin_lock(&hwsim_radio_lock);
1676 	list_for_each_entry(data2, &hwsim_radios, list) {
1677 		struct sk_buff *nskb;
1678 		struct tx_iter_data tx_iter_data = {
1679 			.receive = false,
1680 			.channel = chan,
1681 		};
1682 
1683 		if (data == data2)
1684 			continue;
1685 
1686 		if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1687 		    !hwsim_ps_rx_ok(data2, skb))
1688 			continue;
1689 
1690 		if (!(data->group & data2->group))
1691 			continue;
1692 
1693 		if (data->netgroup != data2->netgroup)
1694 			continue;
1695 
1696 		if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1697 		    !hwsim_chans_compat(chan, data2->channel)) {
1698 			ieee80211_iterate_active_interfaces_atomic(
1699 				data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1700 				mac80211_hwsim_tx_iter, &tx_iter_data);
1701 			if (!tx_iter_data.receive)
1702 				continue;
1703 		}
1704 
1705 		/*
1706 		 * reserve some space for our vendor and the normal
1707 		 * radiotap header, since we're copying anyway
1708 		 */
1709 		if (skb->len < PAGE_SIZE && paged_rx) {
1710 			struct page *page = alloc_page(GFP_ATOMIC);
1711 
1712 			if (!page)
1713 				continue;
1714 
1715 			nskb = dev_alloc_skb(128);
1716 			if (!nskb) {
1717 				__free_page(page);
1718 				continue;
1719 			}
1720 
1721 			memcpy(page_address(page), skb->data, skb->len);
1722 			skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1723 		} else {
1724 			nskb = skb_copy(skb, GFP_ATOMIC);
1725 			if (!nskb)
1726 				continue;
1727 		}
1728 
1729 		if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1730 			ack = true;
1731 
1732 		rx_status.mactime = now + data2->tsf_offset;
1733 
1734 		mac80211_hwsim_rx(data2, &rx_status, nskb);
1735 	}
1736 	spin_unlock(&hwsim_radio_lock);
1737 
1738 	return ack;
1739 }
1740 
1741 static struct ieee80211_bss_conf *
mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data * data,struct ieee80211_vif * vif,struct ieee80211_sta * sta,struct ieee80211_hdr * hdr,struct ieee80211_link_sta ** link_sta)1742 mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
1743 			      struct ieee80211_vif *vif,
1744 			      struct ieee80211_sta *sta,
1745 			      struct ieee80211_hdr *hdr,
1746 			      struct ieee80211_link_sta **link_sta)
1747 {
1748 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1749 	int i;
1750 
1751 	if (!vif->valid_links)
1752 		return &vif->bss_conf;
1753 
1754 	WARN_ON(is_multicast_ether_addr(hdr->addr1));
1755 
1756 	if (WARN_ON_ONCE(!sta->valid_links))
1757 		return &vif->bss_conf;
1758 
1759 	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1760 		struct ieee80211_bss_conf *bss_conf;
1761 		unsigned int link_id;
1762 
1763 		/* round-robin the available link IDs */
1764 		link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
1765 
1766 		if (!(vif->active_links & BIT(link_id)))
1767 			continue;
1768 
1769 		if (!(sp->active_links_rx & BIT(link_id)))
1770 			continue;
1771 
1772 		*link_sta = rcu_dereference(sta->link[link_id]);
1773 		if (!*link_sta)
1774 			continue;
1775 
1776 		bss_conf = rcu_dereference(vif->link_conf[link_id]);
1777 		if (WARN_ON_ONCE(!bss_conf))
1778 			continue;
1779 
1780 		/* can happen while switching links */
1781 		if (!rcu_access_pointer(bss_conf->chanctx_conf))
1782 			continue;
1783 
1784 		sp->last_link = link_id;
1785 		return bss_conf;
1786 	}
1787 
1788 	return NULL;
1789 }
1790 
mac80211_hwsim_tx(struct ieee80211_hw * hw,struct ieee80211_tx_control * control,struct sk_buff * skb)1791 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1792 			      struct ieee80211_tx_control *control,
1793 			      struct sk_buff *skb)
1794 {
1795 	struct mac80211_hwsim_data *data = hw->priv;
1796 	struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1797 	struct ieee80211_hdr *hdr = (void *)skb->data;
1798 	struct ieee80211_chanctx_conf *chanctx_conf;
1799 	struct ieee80211_channel *channel;
1800 	bool ack;
1801 	enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1802 	u32 _portid, i;
1803 
1804 	if (WARN_ON(skb->len < 10)) {
1805 		/* Should not happen; just a sanity check for addr1 use */
1806 		ieee80211_free_txskb(hw, skb);
1807 		return;
1808 	}
1809 
1810 	if (!data->use_chanctx) {
1811 		channel = data->channel;
1812 		confbw = data->bw;
1813 	} else if (txi->hw_queue == 4) {
1814 		channel = data->tmp_chan;
1815 	} else {
1816 		u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
1817 				       IEEE80211_TX_CTRL_MLO_LINK);
1818 		struct ieee80211_vif *vif = txi->control.vif;
1819 		struct ieee80211_link_sta *link_sta = NULL;
1820 		struct ieee80211_sta *sta = control->sta;
1821 		struct ieee80211_bss_conf *bss_conf;
1822 
1823 		if (link != IEEE80211_LINK_UNSPECIFIED) {
1824 			bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
1825 			if (sta)
1826 				link_sta = rcu_dereference(sta->link[link]);
1827 		} else {
1828 			bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
1829 								 hdr, &link_sta);
1830 		}
1831 
1832 		if (WARN_ON(!bss_conf)) {
1833 			ieee80211_free_txskb(hw, skb);
1834 			return;
1835 		}
1836 
1837 		if (sta && sta->mlo) {
1838 			if (WARN_ON(!link_sta)) {
1839 				ieee80211_free_txskb(hw, skb);
1840 				return;
1841 			}
1842 			/* address translation to link addresses on TX */
1843 			ether_addr_copy(hdr->addr1, link_sta->addr);
1844 			ether_addr_copy(hdr->addr2, bss_conf->addr);
1845 			/* translate A3 only if it's the BSSID */
1846 			if (!ieee80211_has_tods(hdr->frame_control) &&
1847 			    !ieee80211_has_fromds(hdr->frame_control)) {
1848 				if (ether_addr_equal(hdr->addr3, sta->addr))
1849 					ether_addr_copy(hdr->addr3, link_sta->addr);
1850 				else if (ether_addr_equal(hdr->addr3, vif->addr))
1851 					ether_addr_copy(hdr->addr3, bss_conf->addr);
1852 			}
1853 			/* no need to look at A4, if present it's SA */
1854 		}
1855 
1856 		chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
1857 		if (chanctx_conf) {
1858 			channel = chanctx_conf->def.chan;
1859 			confbw = chanctx_conf->def.width;
1860 		} else {
1861 			channel = NULL;
1862 		}
1863 	}
1864 
1865 	if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
1866 		ieee80211_free_txskb(hw, skb);
1867 		return;
1868 	}
1869 
1870 	if (data->idle && !data->tmp_chan) {
1871 		wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
1872 		ieee80211_free_txskb(hw, skb);
1873 		return;
1874 	}
1875 
1876 	if (txi->control.vif)
1877 		hwsim_check_magic(txi->control.vif);
1878 	if (control->sta)
1879 		hwsim_check_sta_magic(control->sta);
1880 
1881 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1882 		ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
1883 				       txi->control.rates,
1884 				       ARRAY_SIZE(txi->control.rates));
1885 
1886 	for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
1887 		u16 rflags = txi->control.rates[i].flags;
1888 		/* initialize to data->bw for 5/10 MHz handling */
1889 		enum nl80211_chan_width bw = data->bw;
1890 
1891 		if (txi->control.rates[i].idx == -1)
1892 			break;
1893 
1894 		if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1895 			bw = NL80211_CHAN_WIDTH_40;
1896 		else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1897 			bw = NL80211_CHAN_WIDTH_80;
1898 		else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1899 			bw = NL80211_CHAN_WIDTH_160;
1900 
1901 		if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
1902 			return;
1903 	}
1904 
1905 	if (skb->len >= 24 + 8 &&
1906 	    ieee80211_is_probe_resp(hdr->frame_control)) {
1907 		/* fake header transmission time */
1908 		struct ieee80211_mgmt *mgmt;
1909 		struct ieee80211_rate *txrate;
1910 		/* TODO: get MCS */
1911 		int bitrate = 100;
1912 		u64 ts;
1913 
1914 		mgmt = (struct ieee80211_mgmt *)skb->data;
1915 		txrate = ieee80211_get_tx_rate(hw, txi);
1916 		if (txrate)
1917 			bitrate = txrate->bitrate;
1918 		ts = mac80211_hwsim_get_tsf_raw();
1919 		mgmt->u.probe_resp.timestamp =
1920 			cpu_to_le64(ts + data->tsf_offset +
1921 				    24 * 8 * 10 / bitrate);
1922 	}
1923 
1924 	mac80211_hwsim_monitor_rx(hw, skb, channel);
1925 
1926 	/* wmediumd mode check */
1927 	_portid = READ_ONCE(data->wmediumd);
1928 
1929 	if (_portid || hwsim_virtio_enabled)
1930 		return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
1931 
1932 	/* NO wmediumd detected, perfect medium simulation */
1933 	data->tx_pkts++;
1934 	data->tx_bytes += skb->len;
1935 	ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
1936 
1937 	if (ack && skb->len >= 16)
1938 		mac80211_hwsim_monitor_ack(channel, hdr->addr2);
1939 
1940 	ieee80211_tx_info_clear_status(txi);
1941 
1942 	/* frame was transmitted at most favorable rate at first attempt */
1943 	txi->control.rates[0].count = 1;
1944 	txi->control.rates[1].idx = -1;
1945 
1946 	if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
1947 		txi->flags |= IEEE80211_TX_STAT_ACK;
1948 	ieee80211_tx_status_irqsafe(hw, skb);
1949 }
1950 
1951 
mac80211_hwsim_start(struct ieee80211_hw * hw)1952 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
1953 {
1954 	struct mac80211_hwsim_data *data = hw->priv;
1955 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
1956 	data->started = true;
1957 	return 0;
1958 }
1959 
1960 
mac80211_hwsim_stop(struct ieee80211_hw * hw)1961 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
1962 {
1963 	struct mac80211_hwsim_data *data = hw->priv;
1964 	int i;
1965 
1966 	data->started = false;
1967 
1968 	for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
1969 		hrtimer_cancel(&data->link_data[i].beacon_timer);
1970 
1971 	while (!skb_queue_empty(&data->pending))
1972 		ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1973 
1974 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
1975 }
1976 
1977 
mac80211_hwsim_add_interface(struct ieee80211_hw * hw,struct ieee80211_vif * vif)1978 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
1979 					struct ieee80211_vif *vif)
1980 {
1981 	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
1982 		  __func__, ieee80211_vif_type_p2p(vif),
1983 		  vif->addr);
1984 	hwsim_set_magic(vif);
1985 
1986 	if (vif->type != NL80211_IFTYPE_MONITOR)
1987 		mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
1988 
1989 	vif->cab_queue = 0;
1990 	vif->hw_queue[IEEE80211_AC_VO] = 0;
1991 	vif->hw_queue[IEEE80211_AC_VI] = 1;
1992 	vif->hw_queue[IEEE80211_AC_BE] = 2;
1993 	vif->hw_queue[IEEE80211_AC_BK] = 3;
1994 
1995 	return 0;
1996 }
1997 
1998 
mac80211_hwsim_change_interface(struct ieee80211_hw * hw,struct ieee80211_vif * vif,enum nl80211_iftype newtype,bool newp2p)1999 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
2000 					   struct ieee80211_vif *vif,
2001 					   enum nl80211_iftype newtype,
2002 					   bool newp2p)
2003 {
2004 	newtype = ieee80211_iftype_p2p(newtype, newp2p);
2005 	wiphy_dbg(hw->wiphy,
2006 		  "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2007 		  __func__, ieee80211_vif_type_p2p(vif),
2008 		    newtype, vif->addr);
2009 	hwsim_check_magic(vif);
2010 
2011 	/*
2012 	 * interface may change from non-AP to AP in
2013 	 * which case this needs to be set up again
2014 	 */
2015 	vif->cab_queue = 0;
2016 
2017 	return 0;
2018 }
2019 
mac80211_hwsim_remove_interface(struct ieee80211_hw * hw,struct ieee80211_vif * vif)2020 static void mac80211_hwsim_remove_interface(
2021 	struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2022 {
2023 	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2024 		  __func__, ieee80211_vif_type_p2p(vif),
2025 		  vif->addr);
2026 	hwsim_check_magic(vif);
2027 	hwsim_clear_magic(vif);
2028 	if (vif->type != NL80211_IFTYPE_MONITOR)
2029 		mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2030 }
2031 
mac80211_hwsim_tx_frame(struct ieee80211_hw * hw,struct sk_buff * skb,struct ieee80211_channel * chan)2032 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2033 				    struct sk_buff *skb,
2034 				    struct ieee80211_channel *chan)
2035 {
2036 	struct mac80211_hwsim_data *data = hw->priv;
2037 	u32 _pid = READ_ONCE(data->wmediumd);
2038 
2039 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2040 		struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2041 		ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2042 				       txi->control.rates,
2043 				       ARRAY_SIZE(txi->control.rates));
2044 	}
2045 
2046 	mac80211_hwsim_monitor_rx(hw, skb, chan);
2047 
2048 	if (_pid || hwsim_virtio_enabled)
2049 		return mac80211_hwsim_tx_frame_nl(hw, skb, _pid, chan);
2050 
2051 	data->tx_pkts++;
2052 	data->tx_bytes += skb->len;
2053 	mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2054 	dev_kfree_skb(skb);
2055 }
2056 
mac80211_hwsim_beacon_tx(void * arg,u8 * mac,struct ieee80211_vif * vif)2057 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2058 				     struct ieee80211_vif *vif)
2059 {
2060 	struct mac80211_hwsim_link_data *link_data = arg;
2061 	u32 link_id = link_data->link_id;
2062 	struct ieee80211_bss_conf *link_conf;
2063 	struct mac80211_hwsim_data *data =
2064 		container_of(link_data, struct mac80211_hwsim_data,
2065 			     link_data[link_id]);
2066 	struct ieee80211_hw *hw = data->hw;
2067 	struct ieee80211_tx_info *info;
2068 	struct ieee80211_rate *txrate;
2069 	struct ieee80211_mgmt *mgmt;
2070 	struct sk_buff *skb;
2071 	/* TODO: get MCS */
2072 	int bitrate = 100;
2073 
2074 	hwsim_check_magic(vif);
2075 
2076 	link_conf = rcu_dereference(vif->link_conf[link_id]);
2077 	if (!link_conf)
2078 		return;
2079 
2080 	if (vif->type != NL80211_IFTYPE_AP &&
2081 	    vif->type != NL80211_IFTYPE_MESH_POINT &&
2082 	    vif->type != NL80211_IFTYPE_ADHOC &&
2083 	    vif->type != NL80211_IFTYPE_OCB)
2084 		return;
2085 
2086 	skb = ieee80211_beacon_get(hw, vif, link_data->link_id);
2087 	if (skb == NULL)
2088 		return;
2089 	info = IEEE80211_SKB_CB(skb);
2090 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2091 		ieee80211_get_tx_rates(vif, NULL, skb,
2092 				       info->control.rates,
2093 				       ARRAY_SIZE(info->control.rates));
2094 
2095 	txrate = ieee80211_get_tx_rate(hw, info);
2096 	if (txrate)
2097 		bitrate = txrate->bitrate;
2098 
2099 	mgmt = (struct ieee80211_mgmt *) skb->data;
2100 	/* fake header transmission time */
2101 	data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
2102 	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2103 		struct ieee80211_ext *ext = (void *) mgmt;
2104 
2105 		ext->u.s1g_beacon.timestamp = cpu_to_le32(data->abs_bcn_ts +
2106 							  data->tsf_offset +
2107 							  10 * 8 * 10 /
2108 							  bitrate);
2109 	} else {
2110 		mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
2111 						       data->tsf_offset +
2112 						       24 * 8 * 10 /
2113 						       bitrate);
2114 	}
2115 
2116 	mac80211_hwsim_tx_frame(hw, skb,
2117 			rcu_dereference(link_conf->chanctx_conf)->def.chan);
2118 
2119 	while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2120 		mac80211_hwsim_tx_frame(hw, skb,
2121 			rcu_dereference(link_conf->chanctx_conf)->def.chan);
2122 	}
2123 
2124 	if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif))
2125 		ieee80211_csa_finish(vif);
2126 }
2127 
2128 static enum hrtimer_restart
mac80211_hwsim_beacon(struct hrtimer * timer)2129 mac80211_hwsim_beacon(struct hrtimer *timer)
2130 {
2131 	struct mac80211_hwsim_link_data *link_data =
2132 		container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2133 	struct mac80211_hwsim_data *data =
2134 		container_of(link_data, struct mac80211_hwsim_data,
2135 			     link_data[link_data->link_id]);
2136 	struct ieee80211_hw *hw = data->hw;
2137 	u64 bcn_int = link_data->beacon_int;
2138 
2139 	if (!data->started)
2140 		return HRTIMER_NORESTART;
2141 
2142 	ieee80211_iterate_active_interfaces_atomic(
2143 		hw, IEEE80211_IFACE_ITER_NORMAL,
2144 		mac80211_hwsim_beacon_tx, link_data);
2145 
2146 	/* beacon at new TBTT + beacon interval */
2147 	if (data->bcn_delta) {
2148 		bcn_int -= data->bcn_delta;
2149 		data->bcn_delta = 0;
2150 	}
2151 	hrtimer_forward_now(&link_data->beacon_timer,
2152 			    ns_to_ktime(bcn_int * NSEC_PER_USEC));
2153 	return HRTIMER_RESTART;
2154 }
2155 
2156 static const char * const hwsim_chanwidths[] = {
2157 	[NL80211_CHAN_WIDTH_5] = "ht5",
2158 	[NL80211_CHAN_WIDTH_10] = "ht10",
2159 	[NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2160 	[NL80211_CHAN_WIDTH_20] = "ht20",
2161 	[NL80211_CHAN_WIDTH_40] = "ht40",
2162 	[NL80211_CHAN_WIDTH_80] = "vht80",
2163 	[NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2164 	[NL80211_CHAN_WIDTH_160] = "vht160",
2165 	[NL80211_CHAN_WIDTH_1] = "1MHz",
2166 	[NL80211_CHAN_WIDTH_2] = "2MHz",
2167 	[NL80211_CHAN_WIDTH_4] = "4MHz",
2168 	[NL80211_CHAN_WIDTH_8] = "8MHz",
2169 	[NL80211_CHAN_WIDTH_16] = "16MHz",
2170 };
2171 
mac80211_hwsim_config(struct ieee80211_hw * hw,u32 changed)2172 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
2173 {
2174 	struct mac80211_hwsim_data *data = hw->priv;
2175 	struct ieee80211_conf *conf = &hw->conf;
2176 	static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2177 		[IEEE80211_SMPS_AUTOMATIC] = "auto",
2178 		[IEEE80211_SMPS_OFF] = "off",
2179 		[IEEE80211_SMPS_STATIC] = "static",
2180 		[IEEE80211_SMPS_DYNAMIC] = "dynamic",
2181 	};
2182 	int idx;
2183 
2184 	if (conf->chandef.chan)
2185 		wiphy_dbg(hw->wiphy,
2186 			  "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2187 			  __func__,
2188 			  conf->chandef.chan->center_freq,
2189 			  conf->chandef.center_freq1,
2190 			  conf->chandef.center_freq2,
2191 			  hwsim_chanwidths[conf->chandef.width],
2192 			  !!(conf->flags & IEEE80211_CONF_IDLE),
2193 			  !!(conf->flags & IEEE80211_CONF_PS),
2194 			  smps_modes[conf->smps_mode]);
2195 	else
2196 		wiphy_dbg(hw->wiphy,
2197 			  "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2198 			  __func__,
2199 			  !!(conf->flags & IEEE80211_CONF_IDLE),
2200 			  !!(conf->flags & IEEE80211_CONF_PS),
2201 			  smps_modes[conf->smps_mode]);
2202 
2203 	data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2204 
2205 	WARN_ON(conf->chandef.chan && data->use_chanctx);
2206 
2207 	mutex_lock(&data->mutex);
2208 	if (data->scanning && conf->chandef.chan) {
2209 		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2210 			if (data->survey_data[idx].channel == data->channel) {
2211 				data->survey_data[idx].start =
2212 					data->survey_data[idx].next_start;
2213 				data->survey_data[idx].end = jiffies;
2214 				break;
2215 			}
2216 		}
2217 
2218 		data->channel = conf->chandef.chan;
2219 		data->bw = conf->chandef.width;
2220 
2221 		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2222 			if (data->survey_data[idx].channel &&
2223 			    data->survey_data[idx].channel != data->channel)
2224 				continue;
2225 			data->survey_data[idx].channel = data->channel;
2226 			data->survey_data[idx].next_start = jiffies;
2227 			break;
2228 		}
2229 	} else {
2230 		data->channel = conf->chandef.chan;
2231 		data->bw = conf->chandef.width;
2232 	}
2233 	mutex_unlock(&data->mutex);
2234 
2235 	for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2236 		struct mac80211_hwsim_link_data *link_data =
2237 			&data->link_data[idx];
2238 
2239 		if (!data->started || !link_data->beacon_int) {
2240 			hrtimer_cancel(&link_data->beacon_timer);
2241 		} else if (!hrtimer_is_queued(&link_data->beacon_timer)) {
2242 			u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2243 			u32 bcn_int = link_data->beacon_int;
2244 			u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2245 
2246 			hrtimer_start(&link_data->beacon_timer,
2247 				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2248 				      HRTIMER_MODE_REL_SOFT);
2249 		}
2250 	}
2251 
2252 	return 0;
2253 }
2254 
2255 
mac80211_hwsim_configure_filter(struct ieee80211_hw * hw,unsigned int changed_flags,unsigned int * total_flags,u64 multicast)2256 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2257 					    unsigned int changed_flags,
2258 					    unsigned int *total_flags,u64 multicast)
2259 {
2260 	struct mac80211_hwsim_data *data = hw->priv;
2261 
2262 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
2263 
2264 	data->rx_filter = 0;
2265 	if (*total_flags & FIF_ALLMULTI)
2266 		data->rx_filter |= FIF_ALLMULTI;
2267 	if (*total_flags & FIF_MCAST_ACTION)
2268 		data->rx_filter |= FIF_MCAST_ACTION;
2269 
2270 	*total_flags = data->rx_filter;
2271 }
2272 
mac80211_hwsim_bcn_en_iter(void * data,u8 * mac,struct ieee80211_vif * vif)2273 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2274 				       struct ieee80211_vif *vif)
2275 {
2276 	unsigned int *count = data;
2277 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2278 
2279 	if (vp->bcn_en)
2280 		(*count)++;
2281 }
2282 
mac80211_hwsim_vif_info_changed(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u64 changed)2283 static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2284 					    struct ieee80211_vif *vif,
2285 					    u64 changed)
2286 {
2287 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2288 
2289 	hwsim_check_magic(vif);
2290 
2291 	wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2292 		  __func__, changed, vif->addr);
2293 
2294 	if (changed & BSS_CHANGED_ASSOC) {
2295 		wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2296 			  vif->cfg.assoc, vif->cfg.aid);
2297 		vp->assoc = vif->cfg.assoc;
2298 		vp->aid = vif->cfg.aid;
2299 	}
2300 }
2301 
mac80211_hwsim_link_info_changed(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_bss_conf * info,u64 changed)2302 static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2303 					     struct ieee80211_vif *vif,
2304 					     struct ieee80211_bss_conf *info,
2305 					     u64 changed)
2306 {
2307 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2308 	struct mac80211_hwsim_data *data = hw->priv;
2309 	unsigned int link_id = info->link_id;
2310 	struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2311 
2312 	hwsim_check_magic(vif);
2313 
2314 	wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2315 		  __func__, (unsigned long long)changed, vif->addr, link_id);
2316 
2317 	if (changed & BSS_CHANGED_BSSID) {
2318 		wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2319 			  __func__, info->bssid);
2320 		memcpy(vp->bssid, info->bssid, ETH_ALEN);
2321 	}
2322 
2323 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
2324 		wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2325 			  info->enable_beacon, info->beacon_int);
2326 		vp->bcn_en = info->enable_beacon;
2327 		if (data->started &&
2328 		    !hrtimer_is_queued(&link_data->beacon_timer) &&
2329 		    info->enable_beacon) {
2330 			u64 tsf, until_tbtt;
2331 			u32 bcn_int;
2332 			link_data->beacon_int = info->beacon_int * 1024;
2333 			tsf = mac80211_hwsim_get_tsf(hw, vif);
2334 			bcn_int = link_data->beacon_int;
2335 			until_tbtt = bcn_int - do_div(tsf, bcn_int);
2336 
2337 			hrtimer_start(&link_data->beacon_timer,
2338 				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2339 				      HRTIMER_MODE_REL_SOFT);
2340 		} else if (!info->enable_beacon) {
2341 			unsigned int count = 0;
2342 			ieee80211_iterate_active_interfaces_atomic(
2343 				data->hw, IEEE80211_IFACE_ITER_NORMAL,
2344 				mac80211_hwsim_bcn_en_iter, &count);
2345 			wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2346 				  count);
2347 			if (count == 0) {
2348 				hrtimer_cancel(&link_data->beacon_timer);
2349 				link_data->beacon_int = 0;
2350 			}
2351 		}
2352 	}
2353 
2354 	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2355 		wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2356 			  info->use_cts_prot);
2357 	}
2358 
2359 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2360 		wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2361 			  info->use_short_preamble);
2362 	}
2363 
2364 	if (changed & BSS_CHANGED_ERP_SLOT) {
2365 		wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2366 	}
2367 
2368 	if (changed & BSS_CHANGED_HT) {
2369 		wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2370 			  info->ht_operation_mode);
2371 	}
2372 
2373 	if (changed & BSS_CHANGED_BASIC_RATES) {
2374 		wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2375 			  (unsigned long long) info->basic_rates);
2376 	}
2377 
2378 	if (changed & BSS_CHANGED_TXPOWER)
2379 		wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2380 }
2381 
2382 static void
mac80211_hwsim_sta_rc_update(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta,u32 changed)2383 mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2384 			     struct ieee80211_vif *vif,
2385 			     struct ieee80211_sta *sta,
2386 			     u32 changed)
2387 {
2388 	struct mac80211_hwsim_data *data = hw->priv;
2389 	u32 bw = U32_MAX;
2390 	int link_id;
2391 
2392 	rcu_read_lock();
2393 	for (link_id = 0;
2394 	     link_id < ARRAY_SIZE(vif->link_conf);
2395 	     link_id++) {
2396 		enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2397 		struct ieee80211_bss_conf *vif_conf;
2398 		struct ieee80211_link_sta *link_sta;
2399 
2400 		link_sta = rcu_dereference(sta->link[link_id]);
2401 
2402 		if (!link_sta)
2403 			continue;
2404 
2405 		switch (link_sta->bandwidth) {
2406 #define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2407 		C(20);
2408 		C(40);
2409 		C(80);
2410 		C(160);
2411 		C(320);
2412 #undef C
2413 		}
2414 
2415 		if (!data->use_chanctx) {
2416 			confbw = data->bw;
2417 		} else {
2418 			struct ieee80211_chanctx_conf *chanctx_conf;
2419 
2420 			vif_conf = rcu_dereference(vif->link_conf[link_id]);
2421 			if (WARN_ON(!vif_conf))
2422 				continue;
2423 
2424 			chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2425 
2426 			if (!WARN_ON(!chanctx_conf))
2427 				confbw = chanctx_conf->def.width;
2428 		}
2429 
2430 		WARN(bw > hwsim_get_chanwidth(confbw),
2431 		     "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2432 		     vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2433 		     hwsim_get_chanwidth(data->bw), data->bw);
2434 
2435 
2436 	}
2437 	rcu_read_unlock();
2438 
2439 
2440 }
2441 
mac80211_hwsim_sta_add(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta)2442 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2443 				  struct ieee80211_vif *vif,
2444 				  struct ieee80211_sta *sta)
2445 {
2446 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2447 
2448 	hwsim_check_magic(vif);
2449 	hwsim_set_sta_magic(sta);
2450 	mac80211_hwsim_sta_rc_update(hw, vif, sta, 0);
2451 
2452 	if (sta->valid_links) {
2453 		WARN(hweight16(sta->valid_links) > 1,
2454 		     "expect to add STA with single link, have 0x%x\n",
2455 		     sta->valid_links);
2456 		sp->active_links_rx = sta->valid_links;
2457 	}
2458 
2459 	return 0;
2460 }
2461 
mac80211_hwsim_sta_remove(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta)2462 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2463 				     struct ieee80211_vif *vif,
2464 				     struct ieee80211_sta *sta)
2465 {
2466 	hwsim_check_magic(vif);
2467 	hwsim_clear_sta_magic(sta);
2468 
2469 	return 0;
2470 }
2471 
mac80211_hwsim_sta_state(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta,enum ieee80211_sta_state old_state,enum ieee80211_sta_state new_state)2472 static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2473 				    struct ieee80211_vif *vif,
2474 				    struct ieee80211_sta *sta,
2475 				    enum ieee80211_sta_state old_state,
2476 				    enum ieee80211_sta_state new_state)
2477 {
2478 	if (new_state == IEEE80211_STA_NOTEXIST)
2479 		return mac80211_hwsim_sta_remove(hw, vif, sta);
2480 
2481 	if (old_state == IEEE80211_STA_NOTEXIST)
2482 		return mac80211_hwsim_sta_add(hw, vif, sta);
2483 
2484 	/*
2485 	 * when client is authorized (AP station marked as such),
2486 	 * enable all links
2487 	 */
2488 	if (vif->type == NL80211_IFTYPE_STATION &&
2489 	    new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2490 		ieee80211_set_active_links_async(vif, vif->valid_links);
2491 
2492 	return 0;
2493 }
2494 
mac80211_hwsim_sta_notify(struct ieee80211_hw * hw,struct ieee80211_vif * vif,enum sta_notify_cmd cmd,struct ieee80211_sta * sta)2495 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2496 				      struct ieee80211_vif *vif,
2497 				      enum sta_notify_cmd cmd,
2498 				      struct ieee80211_sta *sta)
2499 {
2500 	hwsim_check_magic(vif);
2501 
2502 	switch (cmd) {
2503 	case STA_NOTIFY_SLEEP:
2504 	case STA_NOTIFY_AWAKE:
2505 		/* TODO: make good use of these flags */
2506 		break;
2507 	default:
2508 		WARN(1, "Invalid sta notify: %d\n", cmd);
2509 		break;
2510 	}
2511 }
2512 
mac80211_hwsim_set_tim(struct ieee80211_hw * hw,struct ieee80211_sta * sta,bool set)2513 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2514 				  struct ieee80211_sta *sta,
2515 				  bool set)
2516 {
2517 	hwsim_check_sta_magic(sta);
2518 	return 0;
2519 }
2520 
mac80211_hwsim_conf_tx(struct ieee80211_hw * hw,struct ieee80211_vif * vif,unsigned int link_id,u16 queue,const struct ieee80211_tx_queue_params * params)2521 static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2522 				  struct ieee80211_vif *vif,
2523 				  unsigned int link_id, u16 queue,
2524 				  const struct ieee80211_tx_queue_params *params)
2525 {
2526 	wiphy_dbg(hw->wiphy,
2527 		  "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2528 		  __func__, queue,
2529 		  params->txop, params->cw_min,
2530 		  params->cw_max, params->aifs);
2531 	return 0;
2532 }
2533 
mac80211_hwsim_get_survey(struct ieee80211_hw * hw,int idx,struct survey_info * survey)2534 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2535 				     struct survey_info *survey)
2536 {
2537 	struct mac80211_hwsim_data *hwsim = hw->priv;
2538 
2539 	if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2540 		return -ENOENT;
2541 
2542 	mutex_lock(&hwsim->mutex);
2543 	survey->channel = hwsim->survey_data[idx].channel;
2544 	if (!survey->channel) {
2545 		mutex_unlock(&hwsim->mutex);
2546 		return -ENOENT;
2547 	}
2548 
2549 	/*
2550 	 * Magically conjured dummy values --- this is only ok for simulated hardware.
2551 	 *
2552 	 * A real driver which cannot determine real values noise MUST NOT
2553 	 * report any, especially not a magically conjured ones :-)
2554 	 */
2555 	survey->filled = SURVEY_INFO_NOISE_DBM |
2556 			 SURVEY_INFO_TIME |
2557 			 SURVEY_INFO_TIME_BUSY;
2558 	survey->noise = -92;
2559 	survey->time =
2560 		jiffies_to_msecs(hwsim->survey_data[idx].end -
2561 				 hwsim->survey_data[idx].start);
2562 	/* report 12.5% of channel time is used */
2563 	survey->time_busy = survey->time/8;
2564 	mutex_unlock(&hwsim->mutex);
2565 
2566 	return 0;
2567 }
2568 
2569 #ifdef CONFIG_NL80211_TESTMODE
2570 /*
2571  * This section contains example code for using netlink
2572  * attributes with the testmode command in nl80211.
2573  */
2574 
2575 /* These enums need to be kept in sync with userspace */
2576 enum hwsim_testmode_attr {
2577 	__HWSIM_TM_ATTR_INVALID	= 0,
2578 	HWSIM_TM_ATTR_CMD	= 1,
2579 	HWSIM_TM_ATTR_PS	= 2,
2580 
2581 	/* keep last */
2582 	__HWSIM_TM_ATTR_AFTER_LAST,
2583 	HWSIM_TM_ATTR_MAX	= __HWSIM_TM_ATTR_AFTER_LAST - 1
2584 };
2585 
2586 enum hwsim_testmode_cmd {
2587 	HWSIM_TM_CMD_SET_PS		= 0,
2588 	HWSIM_TM_CMD_GET_PS		= 1,
2589 	HWSIM_TM_CMD_STOP_QUEUES	= 2,
2590 	HWSIM_TM_CMD_WAKE_QUEUES	= 3,
2591 };
2592 
2593 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2594 	[HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2595 	[HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2596 };
2597 
mac80211_hwsim_testmode_cmd(struct ieee80211_hw * hw,struct ieee80211_vif * vif,void * data,int len)2598 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2599 				       struct ieee80211_vif *vif,
2600 				       void *data, int len)
2601 {
2602 	struct mac80211_hwsim_data *hwsim = hw->priv;
2603 	struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2604 	struct sk_buff *skb;
2605 	int err, ps;
2606 
2607 	err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2608 				   hwsim_testmode_policy, NULL);
2609 	if (err)
2610 		return err;
2611 
2612 	if (!tb[HWSIM_TM_ATTR_CMD])
2613 		return -EINVAL;
2614 
2615 	switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2616 	case HWSIM_TM_CMD_SET_PS:
2617 		if (!tb[HWSIM_TM_ATTR_PS])
2618 			return -EINVAL;
2619 		ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2620 		return hwsim_fops_ps_write(hwsim, ps);
2621 	case HWSIM_TM_CMD_GET_PS:
2622 		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2623 						nla_total_size(sizeof(u32)));
2624 		if (!skb)
2625 			return -ENOMEM;
2626 		if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2627 			goto nla_put_failure;
2628 		return cfg80211_testmode_reply(skb);
2629 	case HWSIM_TM_CMD_STOP_QUEUES:
2630 		ieee80211_stop_queues(hw);
2631 		return 0;
2632 	case HWSIM_TM_CMD_WAKE_QUEUES:
2633 		ieee80211_wake_queues(hw);
2634 		return 0;
2635 	default:
2636 		return -EOPNOTSUPP;
2637 	}
2638 
2639  nla_put_failure:
2640 	kfree_skb(skb);
2641 	return -ENOBUFS;
2642 }
2643 #endif
2644 
mac80211_hwsim_ampdu_action(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_ampdu_params * params)2645 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2646 				       struct ieee80211_vif *vif,
2647 				       struct ieee80211_ampdu_params *params)
2648 {
2649 	struct ieee80211_sta *sta = params->sta;
2650 	enum ieee80211_ampdu_mlme_action action = params->action;
2651 	u16 tid = params->tid;
2652 
2653 	switch (action) {
2654 	case IEEE80211_AMPDU_TX_START:
2655 		return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2656 	case IEEE80211_AMPDU_TX_STOP_CONT:
2657 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
2658 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2659 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2660 		break;
2661 	case IEEE80211_AMPDU_TX_OPERATIONAL:
2662 		break;
2663 	case IEEE80211_AMPDU_RX_START:
2664 	case IEEE80211_AMPDU_RX_STOP:
2665 		break;
2666 	default:
2667 		return -EOPNOTSUPP;
2668 	}
2669 
2670 	return 0;
2671 }
2672 
mac80211_hwsim_flush(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u32 queues,bool drop)2673 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2674 				 struct ieee80211_vif *vif,
2675 				 u32 queues, bool drop)
2676 {
2677 	/* Not implemented, queues only on kernel side */
2678 }
2679 
hw_scan_work(struct work_struct * work)2680 static void hw_scan_work(struct work_struct *work)
2681 {
2682 	struct mac80211_hwsim_data *hwsim =
2683 		container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2684 	struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2685 	int dwell, i;
2686 
2687 	mutex_lock(&hwsim->mutex);
2688 	if (hwsim->scan_chan_idx >= req->n_channels) {
2689 		struct cfg80211_scan_info info = {
2690 			.aborted = false,
2691 		};
2692 
2693 		wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2694 		ieee80211_scan_completed(hwsim->hw, &info);
2695 		hwsim->hw_scan_request = NULL;
2696 		hwsim->hw_scan_vif = NULL;
2697 		hwsim->tmp_chan = NULL;
2698 		mutex_unlock(&hwsim->mutex);
2699 		mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2700 					     false);
2701 		return;
2702 	}
2703 
2704 	wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2705 		  req->channels[hwsim->scan_chan_idx]->center_freq);
2706 
2707 	hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2708 	if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2709 				      IEEE80211_CHAN_RADAR) ||
2710 	    !req->n_ssids) {
2711 		dwell = 120;
2712 	} else {
2713 		dwell = 30;
2714 		/* send probes */
2715 		for (i = 0; i < req->n_ssids; i++) {
2716 			struct sk_buff *probe;
2717 			struct ieee80211_mgmt *mgmt;
2718 
2719 			probe = ieee80211_probereq_get(hwsim->hw,
2720 						       hwsim->scan_addr,
2721 						       req->ssids[i].ssid,
2722 						       req->ssids[i].ssid_len,
2723 						       req->ie_len);
2724 			if (!probe)
2725 				continue;
2726 
2727 			mgmt = (struct ieee80211_mgmt *) probe->data;
2728 			memcpy(mgmt->da, req->bssid, ETH_ALEN);
2729 			memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2730 
2731 			if (req->ie_len)
2732 				skb_put_data(probe, req->ie, req->ie_len);
2733 
2734 			rcu_read_lock();
2735 			if (!ieee80211_tx_prepare_skb(hwsim->hw,
2736 						      hwsim->hw_scan_vif,
2737 						      probe,
2738 						      hwsim->tmp_chan->band,
2739 						      NULL)) {
2740 				rcu_read_unlock();
2741 				kfree_skb(probe);
2742 				continue;
2743 			}
2744 
2745 			local_bh_disable();
2746 			mac80211_hwsim_tx_frame(hwsim->hw, probe,
2747 						hwsim->tmp_chan);
2748 			rcu_read_unlock();
2749 			local_bh_enable();
2750 		}
2751 	}
2752 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2753 				     msecs_to_jiffies(dwell));
2754 	hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2755 	hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2756 	hwsim->survey_data[hwsim->scan_chan_idx].end =
2757 		jiffies + msecs_to_jiffies(dwell);
2758 	hwsim->scan_chan_idx++;
2759 	mutex_unlock(&hwsim->mutex);
2760 }
2761 
mac80211_hwsim_hw_scan(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_scan_request * hw_req)2762 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2763 				  struct ieee80211_vif *vif,
2764 				  struct ieee80211_scan_request *hw_req)
2765 {
2766 	struct mac80211_hwsim_data *hwsim = hw->priv;
2767 	struct cfg80211_scan_request *req = &hw_req->req;
2768 
2769 	mutex_lock(&hwsim->mutex);
2770 	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2771 		mutex_unlock(&hwsim->mutex);
2772 		return -EBUSY;
2773 	}
2774 	hwsim->hw_scan_request = req;
2775 	hwsim->hw_scan_vif = vif;
2776 	hwsim->scan_chan_idx = 0;
2777 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2778 		get_random_mask_addr(hwsim->scan_addr,
2779 				     hw_req->req.mac_addr,
2780 				     hw_req->req.mac_addr_mask);
2781 	else
2782 		memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
2783 	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2784 	mutex_unlock(&hwsim->mutex);
2785 
2786 	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2787 	wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
2788 
2789 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
2790 
2791 	return 0;
2792 }
2793 
mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw * hw,struct ieee80211_vif * vif)2794 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
2795 					  struct ieee80211_vif *vif)
2796 {
2797 	struct mac80211_hwsim_data *hwsim = hw->priv;
2798 	struct cfg80211_scan_info info = {
2799 		.aborted = true,
2800 	};
2801 
2802 	wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
2803 
2804 	cancel_delayed_work_sync(&hwsim->hw_scan);
2805 
2806 	mutex_lock(&hwsim->mutex);
2807 	ieee80211_scan_completed(hwsim->hw, &info);
2808 	hwsim->tmp_chan = NULL;
2809 	hwsim->hw_scan_request = NULL;
2810 	hwsim->hw_scan_vif = NULL;
2811 	mutex_unlock(&hwsim->mutex);
2812 }
2813 
mac80211_hwsim_sw_scan(struct ieee80211_hw * hw,struct ieee80211_vif * vif,const u8 * mac_addr)2814 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
2815 				   struct ieee80211_vif *vif,
2816 				   const u8 *mac_addr)
2817 {
2818 	struct mac80211_hwsim_data *hwsim = hw->priv;
2819 
2820 	mutex_lock(&hwsim->mutex);
2821 
2822 	if (hwsim->scanning) {
2823 		pr_debug("two hwsim sw_scans detected!\n");
2824 		goto out;
2825 	}
2826 
2827 	pr_debug("hwsim sw_scan request, prepping stuff\n");
2828 
2829 	memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
2830 	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2831 	hwsim->scanning = true;
2832 	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2833 
2834 out:
2835 	mutex_unlock(&hwsim->mutex);
2836 }
2837 
mac80211_hwsim_sw_scan_complete(struct ieee80211_hw * hw,struct ieee80211_vif * vif)2838 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
2839 					    struct ieee80211_vif *vif)
2840 {
2841 	struct mac80211_hwsim_data *hwsim = hw->priv;
2842 
2843 	mutex_lock(&hwsim->mutex);
2844 
2845 	pr_debug("hwsim sw_scan_complete\n");
2846 	hwsim->scanning = false;
2847 	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
2848 	eth_zero_addr(hwsim->scan_addr);
2849 
2850 	mutex_unlock(&hwsim->mutex);
2851 }
2852 
hw_roc_start(struct work_struct * work)2853 static void hw_roc_start(struct work_struct *work)
2854 {
2855 	struct mac80211_hwsim_data *hwsim =
2856 		container_of(work, struct mac80211_hwsim_data, roc_start.work);
2857 
2858 	mutex_lock(&hwsim->mutex);
2859 
2860 	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
2861 	hwsim->tmp_chan = hwsim->roc_chan;
2862 	ieee80211_ready_on_channel(hwsim->hw);
2863 
2864 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
2865 				     msecs_to_jiffies(hwsim->roc_duration));
2866 
2867 	mutex_unlock(&hwsim->mutex);
2868 }
2869 
hw_roc_done(struct work_struct * work)2870 static void hw_roc_done(struct work_struct *work)
2871 {
2872 	struct mac80211_hwsim_data *hwsim =
2873 		container_of(work, struct mac80211_hwsim_data, roc_done.work);
2874 
2875 	mutex_lock(&hwsim->mutex);
2876 	ieee80211_remain_on_channel_expired(hwsim->hw);
2877 	hwsim->tmp_chan = NULL;
2878 	mutex_unlock(&hwsim->mutex);
2879 
2880 	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
2881 }
2882 
mac80211_hwsim_roc(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_channel * chan,int duration,enum ieee80211_roc_type type)2883 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
2884 			      struct ieee80211_vif *vif,
2885 			      struct ieee80211_channel *chan,
2886 			      int duration,
2887 			      enum ieee80211_roc_type type)
2888 {
2889 	struct mac80211_hwsim_data *hwsim = hw->priv;
2890 
2891 	mutex_lock(&hwsim->mutex);
2892 	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2893 		mutex_unlock(&hwsim->mutex);
2894 		return -EBUSY;
2895 	}
2896 
2897 	hwsim->roc_chan = chan;
2898 	hwsim->roc_duration = duration;
2899 	mutex_unlock(&hwsim->mutex);
2900 
2901 	wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
2902 		  chan->center_freq, duration);
2903 	ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
2904 
2905 	return 0;
2906 }
2907 
mac80211_hwsim_croc(struct ieee80211_hw * hw,struct ieee80211_vif * vif)2908 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
2909 			       struct ieee80211_vif *vif)
2910 {
2911 	struct mac80211_hwsim_data *hwsim = hw->priv;
2912 
2913 	cancel_delayed_work_sync(&hwsim->roc_start);
2914 	cancel_delayed_work_sync(&hwsim->roc_done);
2915 
2916 	mutex_lock(&hwsim->mutex);
2917 	hwsim->tmp_chan = NULL;
2918 	mutex_unlock(&hwsim->mutex);
2919 
2920 	wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
2921 
2922 	return 0;
2923 }
2924 
mac80211_hwsim_add_chanctx(struct ieee80211_hw * hw,struct ieee80211_chanctx_conf * ctx)2925 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
2926 				      struct ieee80211_chanctx_conf *ctx)
2927 {
2928 	hwsim_set_chanctx_magic(ctx);
2929 	wiphy_dbg(hw->wiphy,
2930 		  "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2931 		  ctx->def.chan->center_freq, ctx->def.width,
2932 		  ctx->def.center_freq1, ctx->def.center_freq2);
2933 	return 0;
2934 }
2935 
mac80211_hwsim_remove_chanctx(struct ieee80211_hw * hw,struct ieee80211_chanctx_conf * ctx)2936 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
2937 					  struct ieee80211_chanctx_conf *ctx)
2938 {
2939 	wiphy_dbg(hw->wiphy,
2940 		  "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2941 		  ctx->def.chan->center_freq, ctx->def.width,
2942 		  ctx->def.center_freq1, ctx->def.center_freq2);
2943 	hwsim_check_chanctx_magic(ctx);
2944 	hwsim_clear_chanctx_magic(ctx);
2945 }
2946 
mac80211_hwsim_change_chanctx(struct ieee80211_hw * hw,struct ieee80211_chanctx_conf * ctx,u32 changed)2947 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
2948 					  struct ieee80211_chanctx_conf *ctx,
2949 					  u32 changed)
2950 {
2951 	hwsim_check_chanctx_magic(ctx);
2952 	wiphy_dbg(hw->wiphy,
2953 		  "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2954 		  ctx->def.chan->center_freq, ctx->def.width,
2955 		  ctx->def.center_freq1, ctx->def.center_freq2);
2956 }
2957 
mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_bss_conf * link_conf,struct ieee80211_chanctx_conf * ctx)2958 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
2959 					     struct ieee80211_vif *vif,
2960 					     struct ieee80211_bss_conf *link_conf,
2961 					     struct ieee80211_chanctx_conf *ctx)
2962 {
2963 	hwsim_check_magic(vif);
2964 	hwsim_check_chanctx_magic(ctx);
2965 
2966 	/* if we activate a link while already associated wake it up */
2967 	if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
2968 		struct sk_buff *skb;
2969 
2970 		skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
2971 		if (skb) {
2972 			local_bh_disable();
2973 			mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
2974 			local_bh_enable();
2975 		}
2976 	}
2977 
2978 	return 0;
2979 }
2980 
mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_bss_conf * link_conf,struct ieee80211_chanctx_conf * ctx)2981 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
2982 						struct ieee80211_vif *vif,
2983 						struct ieee80211_bss_conf *link_conf,
2984 						struct ieee80211_chanctx_conf *ctx)
2985 {
2986 	hwsim_check_magic(vif);
2987 	hwsim_check_chanctx_magic(ctx);
2988 
2989 	/* if we deactivate a link while associated suspend it first */
2990 	if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
2991 		struct sk_buff *skb;
2992 
2993 		skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
2994 		if (skb) {
2995 			struct ieee80211_hdr *hdr = (void *)skb->data;
2996 
2997 			hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
2998 
2999 			local_bh_disable();
3000 			mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3001 			local_bh_enable();
3002 		}
3003 	}
3004 }
3005 
3006 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3007 	"tx_pkts_nic",
3008 	"tx_bytes_nic",
3009 	"rx_pkts_nic",
3010 	"rx_bytes_nic",
3011 	"d_tx_dropped",
3012 	"d_tx_failed",
3013 	"d_ps_mode",
3014 	"d_group",
3015 };
3016 
3017 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3018 
mac80211_hwsim_get_et_strings(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u32 sset,u8 * data)3019 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3020 					  struct ieee80211_vif *vif,
3021 					  u32 sset, u8 *data)
3022 {
3023 	if (sset == ETH_SS_STATS)
3024 		memcpy(data, *mac80211_hwsim_gstrings_stats,
3025 		       sizeof(mac80211_hwsim_gstrings_stats));
3026 }
3027 
mac80211_hwsim_get_et_sset_count(struct ieee80211_hw * hw,struct ieee80211_vif * vif,int sset)3028 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3029 					    struct ieee80211_vif *vif, int sset)
3030 {
3031 	if (sset == ETH_SS_STATS)
3032 		return MAC80211_HWSIM_SSTATS_LEN;
3033 	return 0;
3034 }
3035 
mac80211_hwsim_get_et_stats(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ethtool_stats * stats,u64 * data)3036 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3037 					struct ieee80211_vif *vif,
3038 					struct ethtool_stats *stats, u64 *data)
3039 {
3040 	struct mac80211_hwsim_data *ar = hw->priv;
3041 	int i = 0;
3042 
3043 	data[i++] = ar->tx_pkts;
3044 	data[i++] = ar->tx_bytes;
3045 	data[i++] = ar->rx_pkts;
3046 	data[i++] = ar->rx_bytes;
3047 	data[i++] = ar->tx_dropped;
3048 	data[i++] = ar->tx_failed;
3049 	data[i++] = ar->ps;
3050 	data[i++] = ar->group;
3051 
3052 	WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3053 }
3054 
mac80211_hwsim_tx_last_beacon(struct ieee80211_hw * hw)3055 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3056 {
3057 	return 1;
3058 }
3059 
mac80211_hwsim_set_rts_threshold(struct ieee80211_hw * hw,u32 value)3060 static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3061 {
3062 	return -EOPNOTSUPP;
3063 }
3064 
mac80211_hwsim_change_vif_links(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u16 old_links,u16 new_links,struct ieee80211_bss_conf * old[IEEE80211_MLD_MAX_NUM_LINKS])3065 static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3066 					   struct ieee80211_vif *vif,
3067 					   u16 old_links, u16 new_links,
3068 					   struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3069 {
3070 	unsigned long rem = old_links & ~new_links;
3071 	unsigned long add = new_links & ~old_links;
3072 	int i;
3073 
3074 	if (!old_links)
3075 		rem |= BIT(0);
3076 	if (!new_links)
3077 		add |= BIT(0);
3078 
3079 	for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS)
3080 		mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3081 
3082 	for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3083 		struct ieee80211_bss_conf *link_conf;
3084 
3085 		link_conf = link_conf_dereference_protected(vif, i);
3086 		if (WARN_ON(!link_conf))
3087 			continue;
3088 
3089 		mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3090 	}
3091 
3092 	return 0;
3093 }
3094 
mac80211_hwsim_change_sta_links(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta,u16 old_links,u16 new_links)3095 static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3096 					   struct ieee80211_vif *vif,
3097 					   struct ieee80211_sta *sta,
3098 					   u16 old_links, u16 new_links)
3099 {
3100 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3101 
3102 	hwsim_check_sta_magic(sta);
3103 
3104 	if (vif->type == NL80211_IFTYPE_STATION)
3105 		sp->active_links_rx = new_links;
3106 
3107 	return 0;
3108 }
3109 
3110 #define HWSIM_COMMON_OPS					\
3111 	.tx = mac80211_hwsim_tx,				\
3112 	.start = mac80211_hwsim_start,				\
3113 	.stop = mac80211_hwsim_stop,				\
3114 	.add_interface = mac80211_hwsim_add_interface,		\
3115 	.change_interface = mac80211_hwsim_change_interface,	\
3116 	.remove_interface = mac80211_hwsim_remove_interface,	\
3117 	.config = mac80211_hwsim_config,			\
3118 	.configure_filter = mac80211_hwsim_configure_filter,	\
3119 	.vif_cfg_changed = mac80211_hwsim_vif_info_changed,	\
3120 	.link_info_changed = mac80211_hwsim_link_info_changed,  \
3121 	.tx_last_beacon = mac80211_hwsim_tx_last_beacon,	\
3122 	.sta_notify = mac80211_hwsim_sta_notify,		\
3123 	.sta_rc_update = mac80211_hwsim_sta_rc_update,		\
3124 	.conf_tx = mac80211_hwsim_conf_tx,			\
3125 	.get_survey = mac80211_hwsim_get_survey,		\
3126 	CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)	\
3127 	.ampdu_action = mac80211_hwsim_ampdu_action,		\
3128 	.flush = mac80211_hwsim_flush,				\
3129 	.get_et_sset_count = mac80211_hwsim_get_et_sset_count,	\
3130 	.get_et_stats = mac80211_hwsim_get_et_stats,		\
3131 	.get_et_strings = mac80211_hwsim_get_et_strings,
3132 
3133 #define HWSIM_NON_MLO_OPS					\
3134 	.sta_add = mac80211_hwsim_sta_add,			\
3135 	.sta_remove = mac80211_hwsim_sta_remove,		\
3136 	.set_tim = mac80211_hwsim_set_tim,			\
3137 	.get_tsf = mac80211_hwsim_get_tsf,			\
3138 	.set_tsf = mac80211_hwsim_set_tsf,
3139 
3140 static const struct ieee80211_ops mac80211_hwsim_ops = {
3141 	HWSIM_COMMON_OPS
3142 	HWSIM_NON_MLO_OPS
3143 	.sw_scan_start = mac80211_hwsim_sw_scan,
3144 	.sw_scan_complete = mac80211_hwsim_sw_scan_complete,
3145 };
3146 
3147 #define HWSIM_CHANCTX_OPS					\
3148 	.hw_scan = mac80211_hwsim_hw_scan,			\
3149 	.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,	\
3150 	.remain_on_channel = mac80211_hwsim_roc,		\
3151 	.cancel_remain_on_channel = mac80211_hwsim_croc,	\
3152 	.add_chanctx = mac80211_hwsim_add_chanctx,		\
3153 	.remove_chanctx = mac80211_hwsim_remove_chanctx,	\
3154 	.change_chanctx = mac80211_hwsim_change_chanctx,	\
3155 	.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
3156 	.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx,
3157 
3158 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
3159 	HWSIM_COMMON_OPS
3160 	HWSIM_NON_MLO_OPS
3161 	HWSIM_CHANCTX_OPS
3162 };
3163 
3164 static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
3165 	HWSIM_COMMON_OPS
3166 	HWSIM_CHANCTX_OPS
3167 	.set_rts_threshold = mac80211_hwsim_set_rts_threshold,
3168 	.change_vif_links = mac80211_hwsim_change_vif_links,
3169 	.change_sta_links = mac80211_hwsim_change_sta_links,
3170 	.sta_state = mac80211_hwsim_sta_state,
3171 };
3172 
3173 struct hwsim_new_radio_params {
3174 	unsigned int channels;
3175 	const char *reg_alpha2;
3176 	const struct ieee80211_regdomain *regd;
3177 	bool reg_strict;
3178 	bool p2p_device;
3179 	bool use_chanctx;
3180 	bool destroy_on_close;
3181 	const char *hwname;
3182 	bool no_vif;
3183 	const u8 *perm_addr;
3184 	u32 iftypes;
3185 	u32 *ciphers;
3186 	u8 n_ciphers;
3187 	bool mlo;
3188 };
3189 
hwsim_mcast_config_msg(struct sk_buff * mcast_skb,struct genl_info * info)3190 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
3191 				   struct genl_info *info)
3192 {
3193 	if (info)
3194 		genl_notify(&hwsim_genl_family, mcast_skb, info,
3195 			    HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3196 	else
3197 		genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
3198 				  HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3199 }
3200 
append_radio_msg(struct sk_buff * skb,int id,struct hwsim_new_radio_params * param)3201 static int append_radio_msg(struct sk_buff *skb, int id,
3202 			    struct hwsim_new_radio_params *param)
3203 {
3204 	int ret;
3205 
3206 	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
3207 	if (ret < 0)
3208 		return ret;
3209 
3210 	if (param->channels) {
3211 		ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
3212 		if (ret < 0)
3213 			return ret;
3214 	}
3215 
3216 	if (param->reg_alpha2) {
3217 		ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
3218 			      param->reg_alpha2);
3219 		if (ret < 0)
3220 			return ret;
3221 	}
3222 
3223 	if (param->regd) {
3224 		int i;
3225 
3226 		for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
3227 			if (hwsim_world_regdom_custom[i] != param->regd)
3228 				continue;
3229 
3230 			ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
3231 			if (ret < 0)
3232 				return ret;
3233 			break;
3234 		}
3235 	}
3236 
3237 	if (param->reg_strict) {
3238 		ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
3239 		if (ret < 0)
3240 			return ret;
3241 	}
3242 
3243 	if (param->p2p_device) {
3244 		ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
3245 		if (ret < 0)
3246 			return ret;
3247 	}
3248 
3249 	if (param->use_chanctx) {
3250 		ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
3251 		if (ret < 0)
3252 			return ret;
3253 	}
3254 
3255 	if (param->hwname) {
3256 		ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
3257 			      strlen(param->hwname), param->hwname);
3258 		if (ret < 0)
3259 			return ret;
3260 	}
3261 
3262 	return 0;
3263 }
3264 
hwsim_mcast_new_radio(int id,struct genl_info * info,struct hwsim_new_radio_params * param)3265 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
3266 				  struct hwsim_new_radio_params *param)
3267 {
3268 	struct sk_buff *mcast_skb;
3269 	void *data;
3270 
3271 	mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3272 	if (!mcast_skb)
3273 		return;
3274 
3275 	data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
3276 			   HWSIM_CMD_NEW_RADIO);
3277 	if (!data)
3278 		goto out_err;
3279 
3280 	if (append_radio_msg(mcast_skb, id, param) < 0)
3281 		goto out_err;
3282 
3283 	genlmsg_end(mcast_skb, data);
3284 
3285 	hwsim_mcast_config_msg(mcast_skb, info);
3286 	return;
3287 
3288 out_err:
3289 	nlmsg_free(mcast_skb);
3290 }
3291 
3292 static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
3293 	{
3294 		.types_mask = BIT(NL80211_IFTYPE_STATION),
3295 		.he_cap = {
3296 			.has_he = true,
3297 			.he_cap_elem = {
3298 				.mac_cap_info[0] =
3299 					IEEE80211_HE_MAC_CAP0_HTC_HE,
3300 				.mac_cap_info[1] =
3301 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3302 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3303 				.mac_cap_info[2] =
3304 					IEEE80211_HE_MAC_CAP2_BSR |
3305 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3306 					IEEE80211_HE_MAC_CAP2_ACK_EN,
3307 				.mac_cap_info[3] =
3308 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3309 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3310 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3311 				.phy_cap_info[1] =
3312 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3313 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3314 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3315 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3316 				.phy_cap_info[2] =
3317 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3318 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3319 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3320 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3321 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3322 
3323 				/* Leave all the other PHY capability bytes
3324 				 * unset, as DCM, beam forming, RU and PPE
3325 				 * threshold information are not supported
3326 				 */
3327 			},
3328 			.he_mcs_nss_supp = {
3329 				.rx_mcs_80 = cpu_to_le16(0xfffa),
3330 				.tx_mcs_80 = cpu_to_le16(0xfffa),
3331 				.rx_mcs_160 = cpu_to_le16(0xffff),
3332 				.tx_mcs_160 = cpu_to_le16(0xffff),
3333 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
3334 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
3335 			},
3336 		},
3337 		.eht_cap = {
3338 			.has_eht = true,
3339 			.eht_cap_elem = {
3340 				.mac_cap_info[0] =
3341 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3342 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3343 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3344 				.phy_cap_info[0] =
3345 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3346 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3347 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3348 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3349 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
3350 				.phy_cap_info[3] =
3351 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3352 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3353 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3354 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3355 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3356 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3357 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3358 				.phy_cap_info[4] =
3359 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3360 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3361 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3362 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3363 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3364 				.phy_cap_info[5] =
3365 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3366 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3367 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3368 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3369 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3370 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3371 				.phy_cap_info[6] =
3372 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3373 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3374 				.phy_cap_info[7] =
3375 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
3376 			},
3377 
3378 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
3379 			 * Rx
3380 			 */
3381 			.eht_mcs_nss_supp = {
3382 				/*
3383 				 * Since B0, B1, B2 and B3 are not set in
3384 				 * the supported channel width set field in the
3385 				 * HE PHY capabilities information field the
3386 				 * device is a 20MHz only device on 2.4GHz band.
3387 				 */
3388 				.only_20mhz = {
3389 					.rx_tx_mcs7_max_nss = 0x88,
3390 					.rx_tx_mcs9_max_nss = 0x88,
3391 					.rx_tx_mcs11_max_nss = 0x88,
3392 					.rx_tx_mcs13_max_nss = 0x88,
3393 				},
3394 			},
3395 			/* PPE threshold information is not supported */
3396 		},
3397 	},
3398 	{
3399 		.types_mask = BIT(NL80211_IFTYPE_AP),
3400 		.he_cap = {
3401 			.has_he = true,
3402 			.he_cap_elem = {
3403 				.mac_cap_info[0] =
3404 					IEEE80211_HE_MAC_CAP0_HTC_HE,
3405 				.mac_cap_info[1] =
3406 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3407 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3408 				.mac_cap_info[2] =
3409 					IEEE80211_HE_MAC_CAP2_BSR |
3410 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3411 					IEEE80211_HE_MAC_CAP2_ACK_EN,
3412 				.mac_cap_info[3] =
3413 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3414 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3415 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3416 				.phy_cap_info[1] =
3417 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3418 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3419 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3420 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3421 				.phy_cap_info[2] =
3422 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3423 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3424 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3425 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3426 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3427 
3428 				/* Leave all the other PHY capability bytes
3429 				 * unset, as DCM, beam forming, RU and PPE
3430 				 * threshold information are not supported
3431 				 */
3432 			},
3433 			.he_mcs_nss_supp = {
3434 				.rx_mcs_80 = cpu_to_le16(0xfffa),
3435 				.tx_mcs_80 = cpu_to_le16(0xfffa),
3436 				.rx_mcs_160 = cpu_to_le16(0xffff),
3437 				.tx_mcs_160 = cpu_to_le16(0xffff),
3438 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
3439 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
3440 			},
3441 		},
3442 		.eht_cap = {
3443 			.has_eht = true,
3444 			.eht_cap_elem = {
3445 				.mac_cap_info[0] =
3446 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3447 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3448 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3449 				.phy_cap_info[0] =
3450 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3451 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3452 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3453 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3454 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
3455 				.phy_cap_info[3] =
3456 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3457 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3458 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3459 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3460 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3461 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3462 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3463 				.phy_cap_info[4] =
3464 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3465 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3466 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3467 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3468 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3469 				.phy_cap_info[5] =
3470 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3471 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3472 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3473 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3474 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3475 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3476 				.phy_cap_info[6] =
3477 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3478 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3479 				.phy_cap_info[7] =
3480 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
3481 			},
3482 
3483 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
3484 			 * Rx
3485 			 */
3486 			.eht_mcs_nss_supp = {
3487 				/*
3488 				 * Since B0, B1, B2 and B3 are not set in
3489 				 * the supported channel width set field in the
3490 				 * HE PHY capabilities information field the
3491 				 * device is a 20MHz only device on 2.4GHz band.
3492 				 */
3493 				.only_20mhz = {
3494 					.rx_tx_mcs7_max_nss = 0x88,
3495 					.rx_tx_mcs9_max_nss = 0x88,
3496 					.rx_tx_mcs11_max_nss = 0x88,
3497 					.rx_tx_mcs13_max_nss = 0x88,
3498 				},
3499 			},
3500 			/* PPE threshold information is not supported */
3501 		},
3502 	},
3503 #ifdef CONFIG_MAC80211_MESH
3504 	{
3505 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
3506 		.he_cap = {
3507 			.has_he = true,
3508 			.he_cap_elem = {
3509 				.mac_cap_info[0] =
3510 					IEEE80211_HE_MAC_CAP0_HTC_HE,
3511 				.mac_cap_info[1] =
3512 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3513 				.mac_cap_info[2] =
3514 					IEEE80211_HE_MAC_CAP2_ACK_EN,
3515 				.mac_cap_info[3] =
3516 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3517 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3518 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3519 				.phy_cap_info[1] =
3520 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3521 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3522 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3523 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3524 				.phy_cap_info[2] = 0,
3525 
3526 				/* Leave all the other PHY capability bytes
3527 				 * unset, as DCM, beam forming, RU and PPE
3528 				 * threshold information are not supported
3529 				 */
3530 			},
3531 			.he_mcs_nss_supp = {
3532 				.rx_mcs_80 = cpu_to_le16(0xfffa),
3533 				.tx_mcs_80 = cpu_to_le16(0xfffa),
3534 				.rx_mcs_160 = cpu_to_le16(0xffff),
3535 				.tx_mcs_160 = cpu_to_le16(0xffff),
3536 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
3537 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
3538 			},
3539 		},
3540 	},
3541 #endif
3542 };
3543 
3544 static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
3545 	{
3546 		/* TODO: should we support other types, e.g., P2P? */
3547 		.types_mask = BIT(NL80211_IFTYPE_STATION),
3548 		.he_cap = {
3549 			.has_he = true,
3550 			.he_cap_elem = {
3551 				.mac_cap_info[0] =
3552 					IEEE80211_HE_MAC_CAP0_HTC_HE,
3553 				.mac_cap_info[1] =
3554 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3555 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3556 				.mac_cap_info[2] =
3557 					IEEE80211_HE_MAC_CAP2_BSR |
3558 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3559 					IEEE80211_HE_MAC_CAP2_ACK_EN,
3560 				.mac_cap_info[3] =
3561 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3562 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3563 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3564 				.phy_cap_info[0] =
3565 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3566 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3567 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3568 				.phy_cap_info[1] =
3569 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3570 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3571 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3572 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3573 				.phy_cap_info[2] =
3574 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3575 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3576 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3577 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3578 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3579 
3580 				/* Leave all the other PHY capability bytes
3581 				 * unset, as DCM, beam forming, RU and PPE
3582 				 * threshold information are not supported
3583 				 */
3584 			},
3585 			.he_mcs_nss_supp = {
3586 				.rx_mcs_80 = cpu_to_le16(0xfffa),
3587 				.tx_mcs_80 = cpu_to_le16(0xfffa),
3588 				.rx_mcs_160 = cpu_to_le16(0xfffa),
3589 				.tx_mcs_160 = cpu_to_le16(0xfffa),
3590 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
3591 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
3592 			},
3593 		},
3594 		.eht_cap = {
3595 			.has_eht = true,
3596 			.eht_cap_elem = {
3597 				.mac_cap_info[0] =
3598 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3599 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3600 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3601 				.phy_cap_info[0] =
3602 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3603 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3604 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3605 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3606 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3607 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3608 				.phy_cap_info[1] =
3609 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3610 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
3611 				.phy_cap_info[2] =
3612 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3613 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
3614 				.phy_cap_info[3] =
3615 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3616 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3617 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3618 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3619 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3620 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3621 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3622 				.phy_cap_info[4] =
3623 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3624 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3625 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3626 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3627 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3628 				.phy_cap_info[5] =
3629 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3630 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3631 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3632 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3633 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3634 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3635 				.phy_cap_info[6] =
3636 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3637 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3638 				.phy_cap_info[7] =
3639 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3640 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3641 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3642 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3643 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
3644 			},
3645 
3646 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
3647 			 * Rx
3648 			 */
3649 			.eht_mcs_nss_supp = {
3650 				/*
3651 				 * As B1 and B2 are set in the supported
3652 				 * channel width set field in the HE PHY
3653 				 * capabilities information field include all
3654 				 * the following MCS/NSS.
3655 				 */
3656 				.bw._80 = {
3657 					.rx_tx_mcs9_max_nss = 0x88,
3658 					.rx_tx_mcs11_max_nss = 0x88,
3659 					.rx_tx_mcs13_max_nss = 0x88,
3660 				},
3661 				.bw._160 = {
3662 					.rx_tx_mcs9_max_nss = 0x88,
3663 					.rx_tx_mcs11_max_nss = 0x88,
3664 					.rx_tx_mcs13_max_nss = 0x88,
3665 				},
3666 			},
3667 			/* PPE threshold information is not supported */
3668 		},
3669 	},
3670 	{
3671 		.types_mask = BIT(NL80211_IFTYPE_AP),
3672 		.he_cap = {
3673 			.has_he = true,
3674 			.he_cap_elem = {
3675 				.mac_cap_info[0] =
3676 					IEEE80211_HE_MAC_CAP0_HTC_HE,
3677 				.mac_cap_info[1] =
3678 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3679 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3680 				.mac_cap_info[2] =
3681 					IEEE80211_HE_MAC_CAP2_BSR |
3682 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3683 					IEEE80211_HE_MAC_CAP2_ACK_EN,
3684 				.mac_cap_info[3] =
3685 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3686 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3687 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3688 				.phy_cap_info[0] =
3689 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3690 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3691 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3692 				.phy_cap_info[1] =
3693 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3694 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3695 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3696 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3697 				.phy_cap_info[2] =
3698 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3699 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3700 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3701 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3702 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3703 
3704 				/* Leave all the other PHY capability bytes
3705 				 * unset, as DCM, beam forming, RU and PPE
3706 				 * threshold information are not supported
3707 				 */
3708 			},
3709 			.he_mcs_nss_supp = {
3710 				.rx_mcs_80 = cpu_to_le16(0xfffa),
3711 				.tx_mcs_80 = cpu_to_le16(0xfffa),
3712 				.rx_mcs_160 = cpu_to_le16(0xfffa),
3713 				.tx_mcs_160 = cpu_to_le16(0xfffa),
3714 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
3715 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
3716 			},
3717 		},
3718 		.eht_cap = {
3719 			.has_eht = true,
3720 			.eht_cap_elem = {
3721 				.mac_cap_info[0] =
3722 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3723 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3724 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3725 				.phy_cap_info[0] =
3726 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3727 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3728 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3729 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3730 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3731 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3732 				.phy_cap_info[1] =
3733 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3734 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
3735 				.phy_cap_info[2] =
3736 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3737 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
3738 				.phy_cap_info[3] =
3739 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3740 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3741 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3742 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3743 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3744 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3745 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3746 				.phy_cap_info[4] =
3747 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3748 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3749 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3750 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3751 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3752 				.phy_cap_info[5] =
3753 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3754 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3755 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3756 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3757 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3758 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3759 				.phy_cap_info[6] =
3760 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3761 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3762 				.phy_cap_info[7] =
3763 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3764 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3765 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3766 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3767 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
3768 			},
3769 
3770 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
3771 			 * Rx
3772 			 */
3773 			.eht_mcs_nss_supp = {
3774 				/*
3775 				 * As B1 and B2 are set in the supported
3776 				 * channel width set field in the HE PHY
3777 				 * capabilities information field include all
3778 				 * the following MCS/NSS.
3779 				 */
3780 				.bw._80 = {
3781 					.rx_tx_mcs9_max_nss = 0x88,
3782 					.rx_tx_mcs11_max_nss = 0x88,
3783 					.rx_tx_mcs13_max_nss = 0x88,
3784 				},
3785 				.bw._160 = {
3786 					.rx_tx_mcs9_max_nss = 0x88,
3787 					.rx_tx_mcs11_max_nss = 0x88,
3788 					.rx_tx_mcs13_max_nss = 0x88,
3789 				},
3790 			},
3791 			/* PPE threshold information is not supported */
3792 		},
3793 	},
3794 #ifdef CONFIG_MAC80211_MESH
3795 	{
3796 		/* TODO: should we support other types, e.g., IBSS?*/
3797 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
3798 		.he_cap = {
3799 			.has_he = true,
3800 			.he_cap_elem = {
3801 				.mac_cap_info[0] =
3802 					IEEE80211_HE_MAC_CAP0_HTC_HE,
3803 				.mac_cap_info[1] =
3804 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3805 				.mac_cap_info[2] =
3806 					IEEE80211_HE_MAC_CAP2_ACK_EN,
3807 				.mac_cap_info[3] =
3808 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3809 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3810 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3811 				.phy_cap_info[0] =
3812 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3813 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3814 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3815 				.phy_cap_info[1] =
3816 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3817 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3818 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3819 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3820 				.phy_cap_info[2] = 0,
3821 
3822 				/* Leave all the other PHY capability bytes
3823 				 * unset, as DCM, beam forming, RU and PPE
3824 				 * threshold information are not supported
3825 				 */
3826 			},
3827 			.he_mcs_nss_supp = {
3828 				.rx_mcs_80 = cpu_to_le16(0xfffa),
3829 				.tx_mcs_80 = cpu_to_le16(0xfffa),
3830 				.rx_mcs_160 = cpu_to_le16(0xfffa),
3831 				.tx_mcs_160 = cpu_to_le16(0xfffa),
3832 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
3833 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
3834 			},
3835 		},
3836 	},
3837 #endif
3838 };
3839 
3840 static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
3841 	{
3842 		/* TODO: should we support other types, e.g., P2P? */
3843 		.types_mask = BIT(NL80211_IFTYPE_STATION),
3844 		.he_6ghz_capa = {
3845 			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
3846 					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
3847 					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
3848 					    IEEE80211_HE_6GHZ_CAP_SM_PS |
3849 					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
3850 					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
3851 					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
3852 		},
3853 		.he_cap = {
3854 			.has_he = true,
3855 			.he_cap_elem = {
3856 				.mac_cap_info[0] =
3857 					IEEE80211_HE_MAC_CAP0_HTC_HE,
3858 				.mac_cap_info[1] =
3859 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3860 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3861 				.mac_cap_info[2] =
3862 					IEEE80211_HE_MAC_CAP2_BSR |
3863 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3864 					IEEE80211_HE_MAC_CAP2_ACK_EN,
3865 				.mac_cap_info[3] =
3866 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3867 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3868 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3869 				.phy_cap_info[0] =
3870 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3871 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3872 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3873 				.phy_cap_info[1] =
3874 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3875 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3876 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3877 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3878 				.phy_cap_info[2] =
3879 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3880 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3881 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3882 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3883 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3884 
3885 				/* Leave all the other PHY capability bytes
3886 				 * unset, as DCM, beam forming, RU and PPE
3887 				 * threshold information are not supported
3888 				 */
3889 			},
3890 			.he_mcs_nss_supp = {
3891 				.rx_mcs_80 = cpu_to_le16(0xfffa),
3892 				.tx_mcs_80 = cpu_to_le16(0xfffa),
3893 				.rx_mcs_160 = cpu_to_le16(0xfffa),
3894 				.tx_mcs_160 = cpu_to_le16(0xfffa),
3895 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
3896 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
3897 			},
3898 		},
3899 		.eht_cap = {
3900 			.has_eht = true,
3901 			.eht_cap_elem = {
3902 				.mac_cap_info[0] =
3903 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3904 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3905 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3906 				.phy_cap_info[0] =
3907 					IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
3908 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3909 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3910 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3911 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3912 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3913 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3914 				.phy_cap_info[1] =
3915 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3916 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
3917 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
3918 				.phy_cap_info[2] =
3919 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3920 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
3921 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
3922 				.phy_cap_info[3] =
3923 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3924 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3925 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3926 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3927 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3928 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3929 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3930 				.phy_cap_info[4] =
3931 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3932 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3933 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3934 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3935 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3936 				.phy_cap_info[5] =
3937 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3938 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3939 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3940 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3941 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3942 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3943 				.phy_cap_info[6] =
3944 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3945 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
3946 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
3947 				.phy_cap_info[7] =
3948 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3949 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3950 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3951 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
3952 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3953 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
3954 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
3955 			},
3956 
3957 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
3958 			 * Rx
3959 			 */
3960 			.eht_mcs_nss_supp = {
3961 				/*
3962 				 * As B1 and B2 are set in the supported
3963 				 * channel width set field in the HE PHY
3964 				 * capabilities information field and 320MHz in
3965 				 * 6GHz is supported include all the following
3966 				 * MCS/NSS.
3967 				 */
3968 				.bw._80 = {
3969 					.rx_tx_mcs9_max_nss = 0x88,
3970 					.rx_tx_mcs11_max_nss = 0x88,
3971 					.rx_tx_mcs13_max_nss = 0x88,
3972 				},
3973 				.bw._160 = {
3974 					.rx_tx_mcs9_max_nss = 0x88,
3975 					.rx_tx_mcs11_max_nss = 0x88,
3976 					.rx_tx_mcs13_max_nss = 0x88,
3977 				},
3978 				.bw._320 = {
3979 					.rx_tx_mcs9_max_nss = 0x88,
3980 					.rx_tx_mcs11_max_nss = 0x88,
3981 					.rx_tx_mcs13_max_nss = 0x88,
3982 				},
3983 			},
3984 			/* PPE threshold information is not supported */
3985 		},
3986 	},
3987 	{
3988 		.types_mask = BIT(NL80211_IFTYPE_AP),
3989 		.he_6ghz_capa = {
3990 			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
3991 					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
3992 					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
3993 					    IEEE80211_HE_6GHZ_CAP_SM_PS |
3994 					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
3995 					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
3996 					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
3997 		},
3998 		.he_cap = {
3999 			.has_he = true,
4000 			.he_cap_elem = {
4001 				.mac_cap_info[0] =
4002 					IEEE80211_HE_MAC_CAP0_HTC_HE,
4003 				.mac_cap_info[1] =
4004 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4005 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4006 				.mac_cap_info[2] =
4007 					IEEE80211_HE_MAC_CAP2_BSR |
4008 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4009 					IEEE80211_HE_MAC_CAP2_ACK_EN,
4010 				.mac_cap_info[3] =
4011 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4012 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4013 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4014 				.phy_cap_info[0] =
4015 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4016 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4017 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4018 				.phy_cap_info[1] =
4019 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4020 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4021 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4022 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4023 				.phy_cap_info[2] =
4024 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4025 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4026 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4027 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4028 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4029 
4030 				/* Leave all the other PHY capability bytes
4031 				 * unset, as DCM, beam forming, RU and PPE
4032 				 * threshold information are not supported
4033 				 */
4034 			},
4035 			.he_mcs_nss_supp = {
4036 				.rx_mcs_80 = cpu_to_le16(0xfffa),
4037 				.tx_mcs_80 = cpu_to_le16(0xfffa),
4038 				.rx_mcs_160 = cpu_to_le16(0xfffa),
4039 				.tx_mcs_160 = cpu_to_le16(0xfffa),
4040 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4041 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4042 			},
4043 		},
4044 		.eht_cap = {
4045 			.has_eht = true,
4046 			.eht_cap_elem = {
4047 				.mac_cap_info[0] =
4048 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4049 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4050 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4051 				.phy_cap_info[0] =
4052 					IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4053 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4054 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4055 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4056 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4057 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4058 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4059 				.phy_cap_info[1] =
4060 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4061 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4062 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4063 				.phy_cap_info[2] =
4064 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4065 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4066 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4067 				.phy_cap_info[3] =
4068 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4069 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4070 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4071 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4072 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4073 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4074 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4075 				.phy_cap_info[4] =
4076 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4077 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4078 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4079 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4080 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4081 				.phy_cap_info[5] =
4082 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4083 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4084 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4085 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4086 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4087 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4088 				.phy_cap_info[6] =
4089 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4090 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4091 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4092 				.phy_cap_info[7] =
4093 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4094 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4095 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4096 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4097 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4098 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4099 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4100 			},
4101 
4102 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4103 			 * Rx
4104 			 */
4105 			.eht_mcs_nss_supp = {
4106 				/*
4107 				 * As B1 and B2 are set in the supported
4108 				 * channel width set field in the HE PHY
4109 				 * capabilities information field and 320MHz in
4110 				 * 6GHz is supported include all the following
4111 				 * MCS/NSS.
4112 				 */
4113 				.bw._80 = {
4114 					.rx_tx_mcs9_max_nss = 0x88,
4115 					.rx_tx_mcs11_max_nss = 0x88,
4116 					.rx_tx_mcs13_max_nss = 0x88,
4117 				},
4118 				.bw._160 = {
4119 					.rx_tx_mcs9_max_nss = 0x88,
4120 					.rx_tx_mcs11_max_nss = 0x88,
4121 					.rx_tx_mcs13_max_nss = 0x88,
4122 				},
4123 				.bw._320 = {
4124 					.rx_tx_mcs9_max_nss = 0x88,
4125 					.rx_tx_mcs11_max_nss = 0x88,
4126 					.rx_tx_mcs13_max_nss = 0x88,
4127 				},
4128 			},
4129 			/* PPE threshold information is not supported */
4130 		},
4131 	},
4132 #ifdef CONFIG_MAC80211_MESH
4133 	{
4134 		/* TODO: should we support other types, e.g., IBSS?*/
4135 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4136 		.he_6ghz_capa = {
4137 			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4138 					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4139 					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4140 					    IEEE80211_HE_6GHZ_CAP_SM_PS |
4141 					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4142 					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4143 					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4144 		},
4145 		.he_cap = {
4146 			.has_he = true,
4147 			.he_cap_elem = {
4148 				.mac_cap_info[0] =
4149 					IEEE80211_HE_MAC_CAP0_HTC_HE,
4150 				.mac_cap_info[1] =
4151 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4152 				.mac_cap_info[2] =
4153 					IEEE80211_HE_MAC_CAP2_ACK_EN,
4154 				.mac_cap_info[3] =
4155 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4156 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4157 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4158 				.phy_cap_info[0] =
4159 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4160 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4161 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4162 				.phy_cap_info[1] =
4163 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4164 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4165 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4166 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4167 				.phy_cap_info[2] = 0,
4168 
4169 				/* Leave all the other PHY capability bytes
4170 				 * unset, as DCM, beam forming, RU and PPE
4171 				 * threshold information are not supported
4172 				 */
4173 			},
4174 			.he_mcs_nss_supp = {
4175 				.rx_mcs_80 = cpu_to_le16(0xfffa),
4176 				.tx_mcs_80 = cpu_to_le16(0xfffa),
4177 				.rx_mcs_160 = cpu_to_le16(0xfffa),
4178 				.tx_mcs_160 = cpu_to_le16(0xfffa),
4179 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4180 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4181 			},
4182 		},
4183 	},
4184 #endif
4185 };
4186 
mac80211_hwsim_sband_capab(struct ieee80211_supported_band * sband)4187 static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
4188 {
4189 	u16 n_iftype_data;
4190 
4191 	if (sband->band == NL80211_BAND_2GHZ) {
4192 		n_iftype_data = ARRAY_SIZE(sband_capa_2ghz);
4193 		sband->iftype_data =
4194 			(struct ieee80211_sband_iftype_data *)sband_capa_2ghz;
4195 	} else if (sband->band == NL80211_BAND_5GHZ) {
4196 		n_iftype_data = ARRAY_SIZE(sband_capa_5ghz);
4197 		sband->iftype_data =
4198 			(struct ieee80211_sband_iftype_data *)sband_capa_5ghz;
4199 	} else if (sband->band == NL80211_BAND_6GHZ) {
4200 		n_iftype_data = ARRAY_SIZE(sband_capa_6ghz);
4201 		sband->iftype_data =
4202 			(struct ieee80211_sband_iftype_data *)sband_capa_6ghz;
4203 	} else {
4204 		return;
4205 	}
4206 
4207 	sband->n_iftype_data = n_iftype_data;
4208 }
4209 
4210 #ifdef CONFIG_MAC80211_MESH
4211 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
4212 #else
4213 #define HWSIM_MESH_BIT 0
4214 #endif
4215 
4216 #define HWSIM_DEFAULT_IF_LIMIT \
4217 	(BIT(NL80211_IFTYPE_STATION) | \
4218 	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4219 	 BIT(NL80211_IFTYPE_AP) | \
4220 	 BIT(NL80211_IFTYPE_P2P_GO) | \
4221 	 HWSIM_MESH_BIT)
4222 
4223 #define HWSIM_IFTYPE_SUPPORT_MASK \
4224 	(BIT(NL80211_IFTYPE_STATION) | \
4225 	 BIT(NL80211_IFTYPE_AP) | \
4226 	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4227 	 BIT(NL80211_IFTYPE_P2P_GO) | \
4228 	 BIT(NL80211_IFTYPE_ADHOC) | \
4229 	 BIT(NL80211_IFTYPE_MESH_POINT) | \
4230 	 BIT(NL80211_IFTYPE_OCB))
4231 
mac80211_hwsim_new_radio(struct genl_info * info,struct hwsim_new_radio_params * param)4232 static int mac80211_hwsim_new_radio(struct genl_info *info,
4233 				    struct hwsim_new_radio_params *param)
4234 {
4235 	int err;
4236 	u8 addr[ETH_ALEN];
4237 	struct mac80211_hwsim_data *data;
4238 	struct ieee80211_hw *hw;
4239 	enum nl80211_band band;
4240 	const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
4241 	struct net *net;
4242 	int idx, i;
4243 	int n_limits = 0;
4244 
4245 	if (WARN_ON(param->channels > 1 && !param->use_chanctx))
4246 		return -EINVAL;
4247 
4248 	spin_lock_bh(&hwsim_radio_lock);
4249 	idx = hwsim_radio_idx++;
4250 	spin_unlock_bh(&hwsim_radio_lock);
4251 
4252 	if (param->mlo)
4253 		ops = &mac80211_hwsim_mlo_ops;
4254 	else if (param->use_chanctx)
4255 		ops = &mac80211_hwsim_mchan_ops;
4256 	hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
4257 	if (!hw) {
4258 		pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
4259 		err = -ENOMEM;
4260 		goto failed;
4261 	}
4262 
4263 	/* ieee80211_alloc_hw_nm may have used a default name */
4264 	param->hwname = wiphy_name(hw->wiphy);
4265 
4266 	if (info)
4267 		net = genl_info_net(info);
4268 	else
4269 		net = &init_net;
4270 	wiphy_net_set(hw->wiphy, net);
4271 
4272 	data = hw->priv;
4273 	data->hw = hw;
4274 
4275 	data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
4276 	if (IS_ERR(data->dev)) {
4277 		printk(KERN_DEBUG
4278 		       "mac80211_hwsim: device_create failed (%ld)\n",
4279 		       PTR_ERR(data->dev));
4280 		err = -ENOMEM;
4281 		goto failed_drvdata;
4282 	}
4283 	data->dev->driver = &mac80211_hwsim_driver.driver;
4284 	err = device_bind_driver(data->dev);
4285 	if (err != 0) {
4286 		pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
4287 		       err);
4288 		goto failed_bind;
4289 	}
4290 
4291 	skb_queue_head_init(&data->pending);
4292 
4293 	SET_IEEE80211_DEV(hw, data->dev);
4294 	if (!param->perm_addr) {
4295 		eth_zero_addr(addr);
4296 		addr[0] = 0x02;
4297 		addr[3] = idx >> 8;
4298 		addr[4] = idx;
4299 		memcpy(data->addresses[0].addr, addr, ETH_ALEN);
4300 		/* Why need here second address ? */
4301 		memcpy(data->addresses[1].addr, addr, ETH_ALEN);
4302 		data->addresses[1].addr[0] |= 0x40;
4303 		hw->wiphy->n_addresses = 2;
4304 		hw->wiphy->addresses = data->addresses;
4305 		/* possible address clash is checked at hash table insertion */
4306 	} else {
4307 		memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
4308 		/* compatibility with automatically generated mac addr */
4309 		memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
4310 		hw->wiphy->n_addresses = 2;
4311 		hw->wiphy->addresses = data->addresses;
4312 	}
4313 
4314 	data->channels = param->channels;
4315 	data->use_chanctx = param->use_chanctx;
4316 	data->idx = idx;
4317 	data->destroy_on_close = param->destroy_on_close;
4318 	if (info)
4319 		data->portid = info->snd_portid;
4320 
4321 	/* setup interface limits, only on interface types we support */
4322 	if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
4323 		data->if_limits[n_limits].max = 1;
4324 		data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
4325 		n_limits++;
4326 	}
4327 
4328 	if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
4329 		data->if_limits[n_limits].max = 2048;
4330 		/*
4331 		 * For this case, we may only support a subset of
4332 		 * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
4333 		 * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
4334 		 */
4335 		data->if_limits[n_limits].types =
4336 					HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
4337 		n_limits++;
4338 	}
4339 
4340 	if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
4341 		data->if_limits[n_limits].max = 1;
4342 		data->if_limits[n_limits].types =
4343 						BIT(NL80211_IFTYPE_P2P_DEVICE);
4344 		n_limits++;
4345 	}
4346 
4347 	if (data->use_chanctx) {
4348 		hw->wiphy->max_scan_ssids = 255;
4349 		hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
4350 		hw->wiphy->max_remain_on_channel_duration = 1000;
4351 		data->if_combination.radar_detect_widths = 0;
4352 		data->if_combination.num_different_channels = data->channels;
4353 	} else {
4354 		data->if_combination.num_different_channels = 1;
4355 		data->if_combination.radar_detect_widths =
4356 					BIT(NL80211_CHAN_WIDTH_5) |
4357 					BIT(NL80211_CHAN_WIDTH_10) |
4358 					BIT(NL80211_CHAN_WIDTH_20_NOHT) |
4359 					BIT(NL80211_CHAN_WIDTH_20) |
4360 					BIT(NL80211_CHAN_WIDTH_40) |
4361 					BIT(NL80211_CHAN_WIDTH_80) |
4362 					BIT(NL80211_CHAN_WIDTH_160);
4363 	}
4364 
4365 	if (!n_limits) {
4366 		err = -EINVAL;
4367 		goto failed_hw;
4368 	}
4369 
4370 	data->if_combination.max_interfaces = 0;
4371 	for (i = 0; i < n_limits; i++)
4372 		data->if_combination.max_interfaces +=
4373 			data->if_limits[i].max;
4374 
4375 	data->if_combination.n_limits = n_limits;
4376 	data->if_combination.limits = data->if_limits;
4377 
4378 	/*
4379 	 * If we actually were asked to support combinations,
4380 	 * advertise them - if there's only a single thing like
4381 	 * only IBSS then don't advertise it as combinations.
4382 	 */
4383 	if (data->if_combination.max_interfaces > 1) {
4384 		hw->wiphy->iface_combinations = &data->if_combination;
4385 		hw->wiphy->n_iface_combinations = 1;
4386 	}
4387 
4388 	if (param->ciphers) {
4389 		memcpy(data->ciphers, param->ciphers,
4390 		       param->n_ciphers * sizeof(u32));
4391 		hw->wiphy->cipher_suites = data->ciphers;
4392 		hw->wiphy->n_cipher_suites = param->n_ciphers;
4393 	}
4394 
4395 	data->rx_rssi = DEFAULT_RX_RSSI;
4396 
4397 	INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
4398 	INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
4399 	INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
4400 
4401 	hw->queues = 5;
4402 	hw->offchannel_tx_hw_queue = 4;
4403 
4404 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
4405 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
4406 	ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
4407 	ieee80211_hw_set(hw, QUEUE_CONTROL);
4408 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
4409 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
4410 	ieee80211_hw_set(hw, MFP_CAPABLE);
4411 	ieee80211_hw_set(hw, SIGNAL_DBM);
4412 	ieee80211_hw_set(hw, SUPPORTS_PS);
4413 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
4414 	ieee80211_hw_set(hw, TDLS_WIDER_BW);
4415 	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
4416 
4417 	if (param->mlo) {
4418 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
4419 		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
4420 		ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
4421 		ieee80211_hw_set(hw, CONNECTION_MONITOR);
4422 		ieee80211_hw_set(hw, AP_LINK_PS);
4423 	} else {
4424 		ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
4425 		ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
4426 		if (rctbl)
4427 			ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
4428 	}
4429 
4430 	hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
4431 	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
4432 			    WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
4433 			    WIPHY_FLAG_AP_UAPSD |
4434 			    WIPHY_FLAG_SUPPORTS_5_10_MHZ |
4435 			    WIPHY_FLAG_HAS_CHANNEL_SWITCH;
4436 	hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
4437 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
4438 			       NL80211_FEATURE_STATIC_SMPS |
4439 			       NL80211_FEATURE_DYNAMIC_SMPS |
4440 			       NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
4441 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
4442 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
4443 	wiphy_ext_feature_set(hw->wiphy,
4444 			      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
4445 	wiphy_ext_feature_set(hw->wiphy,
4446 			      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
4447 
4448 	hw->wiphy->interface_modes = param->iftypes;
4449 
4450 	/* ask mac80211 to reserve space for magic */
4451 	hw->vif_data_size = sizeof(struct hwsim_vif_priv);
4452 	hw->sta_data_size = sizeof(struct hwsim_sta_priv);
4453 	hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
4454 
4455 	memcpy(data->channels_2ghz, hwsim_channels_2ghz,
4456 		sizeof(hwsim_channels_2ghz));
4457 	memcpy(data->channels_5ghz, hwsim_channels_5ghz,
4458 		sizeof(hwsim_channels_5ghz));
4459 	memcpy(data->channels_6ghz, hwsim_channels_6ghz,
4460 		sizeof(hwsim_channels_6ghz));
4461 	memcpy(data->channels_s1g, hwsim_channels_s1g,
4462 	       sizeof(hwsim_channels_s1g));
4463 	memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
4464 
4465 	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
4466 		struct ieee80211_supported_band *sband = &data->bands[band];
4467 
4468 		sband->band = band;
4469 
4470 		switch (band) {
4471 		case NL80211_BAND_2GHZ:
4472 			sband->channels = data->channels_2ghz;
4473 			sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
4474 			sband->bitrates = data->rates;
4475 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
4476 			break;
4477 		case NL80211_BAND_5GHZ:
4478 			sband->channels = data->channels_5ghz;
4479 			sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
4480 			sband->bitrates = data->rates + 4;
4481 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
4482 
4483 			sband->vht_cap.vht_supported = true;
4484 			sband->vht_cap.cap =
4485 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
4486 				IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
4487 				IEEE80211_VHT_CAP_RXLDPC |
4488 				IEEE80211_VHT_CAP_SHORT_GI_80 |
4489 				IEEE80211_VHT_CAP_SHORT_GI_160 |
4490 				IEEE80211_VHT_CAP_TXSTBC |
4491 				IEEE80211_VHT_CAP_RXSTBC_4 |
4492 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
4493 			sband->vht_cap.vht_mcs.rx_mcs_map =
4494 				cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
4495 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
4496 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
4497 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
4498 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
4499 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
4500 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
4501 					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
4502 			sband->vht_cap.vht_mcs.tx_mcs_map =
4503 				sband->vht_cap.vht_mcs.rx_mcs_map;
4504 			break;
4505 		case NL80211_BAND_6GHZ:
4506 			sband->channels = data->channels_6ghz;
4507 			sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
4508 			sband->bitrates = data->rates + 4;
4509 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
4510 			break;
4511 		case NL80211_BAND_S1GHZ:
4512 			memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
4513 			       sizeof(sband->s1g_cap));
4514 			sband->channels = data->channels_s1g;
4515 			sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
4516 			break;
4517 		default:
4518 			continue;
4519 		}
4520 
4521 		if (band != NL80211_BAND_6GHZ){
4522 			sband->ht_cap.ht_supported = true;
4523 			sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
4524 					    IEEE80211_HT_CAP_GRN_FLD |
4525 					    IEEE80211_HT_CAP_SGI_20 |
4526 					    IEEE80211_HT_CAP_SGI_40 |
4527 					    IEEE80211_HT_CAP_DSSSCCK40;
4528 			sband->ht_cap.ampdu_factor = 0x3;
4529 			sband->ht_cap.ampdu_density = 0x6;
4530 			memset(&sband->ht_cap.mcs, 0,
4531 			       sizeof(sband->ht_cap.mcs));
4532 			sband->ht_cap.mcs.rx_mask[0] = 0xff;
4533 			sband->ht_cap.mcs.rx_mask[1] = 0xff;
4534 			sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
4535 		}
4536 
4537 		mac80211_hwsim_sband_capab(sband);
4538 
4539 		hw->wiphy->bands[band] = sband;
4540 	}
4541 
4542 	/* By default all radios belong to the first group */
4543 	data->group = 1;
4544 	mutex_init(&data->mutex);
4545 
4546 	data->netgroup = hwsim_net_get_netgroup(net);
4547 	data->wmediumd = hwsim_net_get_wmediumd(net);
4548 
4549 	/* Enable frame retransmissions for lossy channels */
4550 	hw->max_rates = 4;
4551 	hw->max_rate_tries = 11;
4552 
4553 	hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
4554 	hw->wiphy->n_vendor_commands =
4555 		ARRAY_SIZE(mac80211_hwsim_vendor_commands);
4556 	hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
4557 	hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
4558 
4559 	if (param->reg_strict)
4560 		hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
4561 	if (param->regd) {
4562 		data->regd = param->regd;
4563 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
4564 		wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
4565 		/* give the regulatory workqueue a chance to run */
4566 		schedule_timeout_interruptible(1);
4567 	}
4568 
4569 	if (param->no_vif)
4570 		ieee80211_hw_set(hw, NO_AUTO_VIF);
4571 
4572 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
4573 
4574 	for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
4575 		hrtimer_init(&data->link_data[i].beacon_timer, CLOCK_MONOTONIC,
4576 			     HRTIMER_MODE_ABS_SOFT);
4577 		data->link_data[i].beacon_timer.function =
4578 			mac80211_hwsim_beacon;
4579 		data->link_data[i].link_id = i;
4580 	}
4581 
4582 	err = ieee80211_register_hw(hw);
4583 	if (err < 0) {
4584 		pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
4585 		       err);
4586 		goto failed_hw;
4587 	}
4588 
4589 	wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
4590 
4591 	if (param->reg_alpha2) {
4592 		data->alpha2[0] = param->reg_alpha2[0];
4593 		data->alpha2[1] = param->reg_alpha2[1];
4594 		regulatory_hint(hw->wiphy, param->reg_alpha2);
4595 	}
4596 
4597 	data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
4598 	debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
4599 	debugfs_create_file("group", 0666, data->debugfs, data,
4600 			    &hwsim_fops_group);
4601 	debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
4602 			    &hwsim_fops_rx_rssi);
4603 	if (!data->use_chanctx)
4604 		debugfs_create_file("dfs_simulate_radar", 0222,
4605 				    data->debugfs,
4606 				    data, &hwsim_simulate_radar);
4607 
4608 	spin_lock_bh(&hwsim_radio_lock);
4609 	err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
4610 				     hwsim_rht_params);
4611 	if (err < 0) {
4612 		if (info) {
4613 			GENL_SET_ERR_MSG(info, "perm addr already present");
4614 			NL_SET_BAD_ATTR(info->extack,
4615 					info->attrs[HWSIM_ATTR_PERM_ADDR]);
4616 		}
4617 		spin_unlock_bh(&hwsim_radio_lock);
4618 		goto failed_final_insert;
4619 	}
4620 
4621 	list_add_tail(&data->list, &hwsim_radios);
4622 	hwsim_radios_generation++;
4623 	spin_unlock_bh(&hwsim_radio_lock);
4624 
4625 	hwsim_mcast_new_radio(idx, info, param);
4626 
4627 	return idx;
4628 
4629 failed_final_insert:
4630 	debugfs_remove_recursive(data->debugfs);
4631 	ieee80211_unregister_hw(data->hw);
4632 failed_hw:
4633 	device_release_driver(data->dev);
4634 failed_bind:
4635 	device_unregister(data->dev);
4636 failed_drvdata:
4637 	ieee80211_free_hw(hw);
4638 failed:
4639 	return err;
4640 }
4641 
hwsim_mcast_del_radio(int id,const char * hwname,struct genl_info * info)4642 static void hwsim_mcast_del_radio(int id, const char *hwname,
4643 				  struct genl_info *info)
4644 {
4645 	struct sk_buff *skb;
4646 	void *data;
4647 	int ret;
4648 
4649 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4650 	if (!skb)
4651 		return;
4652 
4653 	data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
4654 			   HWSIM_CMD_DEL_RADIO);
4655 	if (!data)
4656 		goto error;
4657 
4658 	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
4659 	if (ret < 0)
4660 		goto error;
4661 
4662 	ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
4663 		      hwname);
4664 	if (ret < 0)
4665 		goto error;
4666 
4667 	genlmsg_end(skb, data);
4668 
4669 	hwsim_mcast_config_msg(skb, info);
4670 
4671 	return;
4672 
4673 error:
4674 	nlmsg_free(skb);
4675 }
4676 
mac80211_hwsim_del_radio(struct mac80211_hwsim_data * data,const char * hwname,struct genl_info * info)4677 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
4678 				     const char *hwname,
4679 				     struct genl_info *info)
4680 {
4681 	hwsim_mcast_del_radio(data->idx, hwname, info);
4682 	debugfs_remove_recursive(data->debugfs);
4683 	ieee80211_unregister_hw(data->hw);
4684 	device_release_driver(data->dev);
4685 	device_unregister(data->dev);
4686 	ieee80211_free_hw(data->hw);
4687 }
4688 
mac80211_hwsim_get_radio(struct sk_buff * skb,struct mac80211_hwsim_data * data,u32 portid,u32 seq,struct netlink_callback * cb,int flags)4689 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
4690 				    struct mac80211_hwsim_data *data,
4691 				    u32 portid, u32 seq,
4692 				    struct netlink_callback *cb, int flags)
4693 {
4694 	void *hdr;
4695 	struct hwsim_new_radio_params param = { };
4696 	int res = -EMSGSIZE;
4697 
4698 	hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
4699 			  HWSIM_CMD_GET_RADIO);
4700 	if (!hdr)
4701 		return -EMSGSIZE;
4702 
4703 	if (cb)
4704 		genl_dump_check_consistent(cb, hdr);
4705 
4706 	if (data->alpha2[0] && data->alpha2[1])
4707 		param.reg_alpha2 = data->alpha2;
4708 
4709 	param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
4710 					REGULATORY_STRICT_REG);
4711 	param.p2p_device = !!(data->hw->wiphy->interface_modes &
4712 					BIT(NL80211_IFTYPE_P2P_DEVICE));
4713 	param.use_chanctx = data->use_chanctx;
4714 	param.regd = data->regd;
4715 	param.channels = data->channels;
4716 	param.hwname = wiphy_name(data->hw->wiphy);
4717 
4718 	res = append_radio_msg(skb, data->idx, &param);
4719 	if (res < 0)
4720 		goto out_err;
4721 
4722 	genlmsg_end(skb, hdr);
4723 	return 0;
4724 
4725 out_err:
4726 	genlmsg_cancel(skb, hdr);
4727 	return res;
4728 }
4729 
mac80211_hwsim_free(void)4730 static void mac80211_hwsim_free(void)
4731 {
4732 	struct mac80211_hwsim_data *data;
4733 
4734 	spin_lock_bh(&hwsim_radio_lock);
4735 	while ((data = list_first_entry_or_null(&hwsim_radios,
4736 						struct mac80211_hwsim_data,
4737 						list))) {
4738 		list_del(&data->list);
4739 		spin_unlock_bh(&hwsim_radio_lock);
4740 		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
4741 					 NULL);
4742 		spin_lock_bh(&hwsim_radio_lock);
4743 	}
4744 	spin_unlock_bh(&hwsim_radio_lock);
4745 	class_destroy(hwsim_class);
4746 }
4747 
4748 static const struct net_device_ops hwsim_netdev_ops = {
4749 	.ndo_start_xmit 	= hwsim_mon_xmit,
4750 	.ndo_set_mac_address 	= eth_mac_addr,
4751 	.ndo_validate_addr	= eth_validate_addr,
4752 };
4753 
hwsim_mon_setup(struct net_device * dev)4754 static void hwsim_mon_setup(struct net_device *dev)
4755 {
4756 	u8 addr[ETH_ALEN];
4757 
4758 	dev->netdev_ops = &hwsim_netdev_ops;
4759 	dev->needs_free_netdev = true;
4760 	ether_setup(dev);
4761 	dev->priv_flags |= IFF_NO_QUEUE;
4762 	dev->type = ARPHRD_IEEE80211_RADIOTAP;
4763 	eth_zero_addr(addr);
4764 	addr[0] = 0x12;
4765 	eth_hw_addr_set(dev, addr);
4766 }
4767 
get_hwsim_data_ref_from_addr(const u8 * addr)4768 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
4769 {
4770 	return rhashtable_lookup_fast(&hwsim_radios_rht,
4771 				      addr,
4772 				      hwsim_rht_params);
4773 }
4774 
hwsim_register_wmediumd(struct net * net,u32 portid)4775 static void hwsim_register_wmediumd(struct net *net, u32 portid)
4776 {
4777 	struct mac80211_hwsim_data *data;
4778 
4779 	hwsim_net_set_wmediumd(net, portid);
4780 
4781 	spin_lock_bh(&hwsim_radio_lock);
4782 	list_for_each_entry(data, &hwsim_radios, list) {
4783 		if (data->netgroup == hwsim_net_get_netgroup(net))
4784 			data->wmediumd = portid;
4785 	}
4786 	spin_unlock_bh(&hwsim_radio_lock);
4787 }
4788 
hwsim_tx_info_frame_received_nl(struct sk_buff * skb_2,struct genl_info * info)4789 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
4790 					   struct genl_info *info)
4791 {
4792 
4793 	struct ieee80211_hdr *hdr;
4794 	struct mac80211_hwsim_data *data2;
4795 	struct ieee80211_tx_info *txi;
4796 	struct hwsim_tx_rate *tx_attempts;
4797 	u64 ret_skb_cookie;
4798 	struct sk_buff *skb, *tmp;
4799 	const u8 *src;
4800 	unsigned int hwsim_flags;
4801 	int i;
4802 	unsigned long flags;
4803 	bool found = false;
4804 
4805 	if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
4806 	    !info->attrs[HWSIM_ATTR_FLAGS] ||
4807 	    !info->attrs[HWSIM_ATTR_COOKIE] ||
4808 	    !info->attrs[HWSIM_ATTR_SIGNAL] ||
4809 	    !info->attrs[HWSIM_ATTR_TX_INFO])
4810 		goto out;
4811 
4812 	src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
4813 	hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
4814 	ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
4815 
4816 	data2 = get_hwsim_data_ref_from_addr(src);
4817 	if (!data2)
4818 		goto out;
4819 
4820 	if (!hwsim_virtio_enabled) {
4821 		if (hwsim_net_get_netgroup(genl_info_net(info)) !=
4822 		    data2->netgroup)
4823 			goto out;
4824 
4825 		if (info->snd_portid != data2->wmediumd)
4826 			goto out;
4827 	}
4828 
4829 	/* look for the skb matching the cookie passed back from user */
4830 	spin_lock_irqsave(&data2->pending.lock, flags);
4831 	skb_queue_walk_safe(&data2->pending, skb, tmp) {
4832 		uintptr_t skb_cookie;
4833 
4834 		txi = IEEE80211_SKB_CB(skb);
4835 		skb_cookie = (uintptr_t)txi->rate_driver_data[0];
4836 
4837 		if (skb_cookie == ret_skb_cookie) {
4838 			__skb_unlink(skb, &data2->pending);
4839 			found = true;
4840 			break;
4841 		}
4842 	}
4843 	spin_unlock_irqrestore(&data2->pending.lock, flags);
4844 
4845 	/* not found */
4846 	if (!found)
4847 		goto out;
4848 
4849 	/* Tx info received because the frame was broadcasted on user space,
4850 	 so we get all the necessary info: tx attempts and skb control buff */
4851 
4852 	tx_attempts = (struct hwsim_tx_rate *)nla_data(
4853 		       info->attrs[HWSIM_ATTR_TX_INFO]);
4854 
4855 	/* now send back TX status */
4856 	txi = IEEE80211_SKB_CB(skb);
4857 
4858 	ieee80211_tx_info_clear_status(txi);
4859 
4860 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
4861 		txi->status.rates[i].idx = tx_attempts[i].idx;
4862 		txi->status.rates[i].count = tx_attempts[i].count;
4863 	}
4864 
4865 	txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
4866 
4867 	if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
4868 	   (hwsim_flags & HWSIM_TX_STAT_ACK)) {
4869 		if (skb->len >= 16) {
4870 			hdr = (struct ieee80211_hdr *) skb->data;
4871 			mac80211_hwsim_monitor_ack(data2->channel,
4872 						   hdr->addr2);
4873 		}
4874 		txi->flags |= IEEE80211_TX_STAT_ACK;
4875 	}
4876 
4877 	if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
4878 		txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
4879 
4880 	ieee80211_tx_status_irqsafe(data2->hw, skb);
4881 	return 0;
4882 out:
4883 	return -EINVAL;
4884 
4885 }
4886 
hwsim_cloned_frame_received_nl(struct sk_buff * skb_2,struct genl_info * info)4887 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
4888 					  struct genl_info *info)
4889 {
4890 	struct mac80211_hwsim_data *data2;
4891 	struct ieee80211_rx_status rx_status;
4892 	struct ieee80211_hdr *hdr;
4893 	const u8 *dst;
4894 	int frame_data_len;
4895 	void *frame_data;
4896 	struct sk_buff *skb = NULL;
4897 	struct ieee80211_channel *channel = NULL;
4898 
4899 	if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
4900 	    !info->attrs[HWSIM_ATTR_FRAME] ||
4901 	    !info->attrs[HWSIM_ATTR_RX_RATE] ||
4902 	    !info->attrs[HWSIM_ATTR_SIGNAL])
4903 		goto out;
4904 
4905 	dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
4906 	frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
4907 	frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
4908 
4909 	/* Allocate new skb here */
4910 	skb = alloc_skb(frame_data_len, GFP_KERNEL);
4911 	if (skb == NULL)
4912 		goto err;
4913 
4914 	if (frame_data_len > IEEE80211_MAX_DATA_LEN)
4915 		goto err;
4916 
4917 	/* Copy the data */
4918 	skb_put_data(skb, frame_data, frame_data_len);
4919 
4920 	data2 = get_hwsim_data_ref_from_addr(dst);
4921 	if (!data2)
4922 		goto out;
4923 
4924 	if (data2->use_chanctx) {
4925 		if (data2->tmp_chan)
4926 			channel = data2->tmp_chan;
4927 	} else {
4928 		channel = data2->channel;
4929 	}
4930 
4931 	if (!hwsim_virtio_enabled) {
4932 		if (hwsim_net_get_netgroup(genl_info_net(info)) !=
4933 		    data2->netgroup)
4934 			goto out;
4935 
4936 		if (info->snd_portid != data2->wmediumd)
4937 			goto out;
4938 	}
4939 
4940 	/* check if radio is configured properly */
4941 
4942 	if ((data2->idle && !data2->tmp_chan) || !data2->started)
4943 		goto out;
4944 
4945 	/* A frame is received from user space */
4946 	memset(&rx_status, 0, sizeof(rx_status));
4947 	if (info->attrs[HWSIM_ATTR_FREQ]) {
4948 		struct tx_iter_data iter_data = {};
4949 
4950 		/* throw away off-channel packets, but allow both the temporary
4951 		 * ("hw" scan/remain-on-channel), regular channels and links,
4952 		 * since the internal datapath also allows this
4953 		 */
4954 		rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
4955 
4956 		iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
4957 							  rx_status.freq);
4958 		if (!iter_data.channel)
4959 			goto out;
4960 		rx_status.band = iter_data.channel->band;
4961 
4962 		mutex_lock(&data2->mutex);
4963 		if (!hwsim_chans_compat(iter_data.channel, channel)) {
4964 			ieee80211_iterate_active_interfaces_atomic(
4965 				data2->hw, IEEE80211_IFACE_ITER_NORMAL,
4966 				mac80211_hwsim_tx_iter, &iter_data);
4967 			if (!iter_data.receive) {
4968 				mutex_unlock(&data2->mutex);
4969 				goto out;
4970 			}
4971 		}
4972 		mutex_unlock(&data2->mutex);
4973 	} else if (!channel) {
4974 		goto out;
4975 	} else {
4976 		rx_status.freq = channel->center_freq;
4977 		rx_status.band = channel->band;
4978 	}
4979 
4980 	rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
4981 	if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
4982 		goto out;
4983 	rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
4984 
4985 	hdr = (void *)skb->data;
4986 
4987 	if (ieee80211_is_beacon(hdr->frame_control) ||
4988 	    ieee80211_is_probe_resp(hdr->frame_control))
4989 		rx_status.boottime_ns = ktime_get_boottime_ns();
4990 
4991 	mac80211_hwsim_rx(data2, &rx_status, skb);
4992 
4993 	return 0;
4994 err:
4995 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
4996 out:
4997 	dev_kfree_skb(skb);
4998 	return -EINVAL;
4999 }
5000 
hwsim_register_received_nl(struct sk_buff * skb_2,struct genl_info * info)5001 static int hwsim_register_received_nl(struct sk_buff *skb_2,
5002 				      struct genl_info *info)
5003 {
5004 	struct net *net = genl_info_net(info);
5005 	struct mac80211_hwsim_data *data;
5006 	int chans = 1;
5007 
5008 	spin_lock_bh(&hwsim_radio_lock);
5009 	list_for_each_entry(data, &hwsim_radios, list)
5010 		chans = max(chans, data->channels);
5011 	spin_unlock_bh(&hwsim_radio_lock);
5012 
5013 	/* In the future we should revise the userspace API and allow it
5014 	 * to set a flag that it does support multi-channel, then we can
5015 	 * let this pass conditionally on the flag.
5016 	 * For current userspace, prohibit it since it won't work right.
5017 	 */
5018 	if (chans > 1)
5019 		return -EOPNOTSUPP;
5020 
5021 	if (hwsim_net_get_wmediumd(net))
5022 		return -EBUSY;
5023 
5024 	hwsim_register_wmediumd(net, info->snd_portid);
5025 
5026 	pr_debug("mac80211_hwsim: received a REGISTER, "
5027 	       "switching to wmediumd mode with pid %d\n", info->snd_portid);
5028 
5029 	return 0;
5030 }
5031 
5032 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
hwsim_known_ciphers(const u32 * ciphers,int n_ciphers)5033 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
5034 {
5035 	int i;
5036 
5037 	for (i = 0; i < n_ciphers; i++) {
5038 		int j;
5039 		int found = 0;
5040 
5041 		for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
5042 			if (ciphers[i] == hwsim_ciphers[j]) {
5043 				found = 1;
5044 				break;
5045 			}
5046 		}
5047 
5048 		if (!found)
5049 			return false;
5050 	}
5051 
5052 	return true;
5053 }
5054 
hwsim_new_radio_nl(struct sk_buff * msg,struct genl_info * info)5055 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
5056 {
5057 	struct hwsim_new_radio_params param = { 0 };
5058 	const char *hwname = NULL;
5059 	int ret;
5060 
5061 	param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
5062 	param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
5063 	param.channels = channels;
5064 	param.destroy_on_close =
5065 		info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
5066 
5067 	if (info->attrs[HWSIM_ATTR_CHANNELS])
5068 		param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
5069 
5070 	if (param.channels < 1) {
5071 		GENL_SET_ERR_MSG(info, "must have at least one channel");
5072 		return -EINVAL;
5073 	}
5074 
5075 	if (info->attrs[HWSIM_ATTR_NO_VIF])
5076 		param.no_vif = true;
5077 
5078 	if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
5079 		param.use_chanctx = true;
5080 	else
5081 		param.use_chanctx = (param.channels > 1);
5082 
5083 	if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
5084 		param.reg_alpha2 =
5085 			nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
5086 
5087 	if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
5088 		u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
5089 
5090 		if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
5091 			return -EINVAL;
5092 
5093 		idx = array_index_nospec(idx,
5094 					 ARRAY_SIZE(hwsim_world_regdom_custom));
5095 		param.regd = hwsim_world_regdom_custom[idx];
5096 	}
5097 
5098 	if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
5099 		if (!is_valid_ether_addr(
5100 				nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
5101 			GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
5102 			NL_SET_BAD_ATTR(info->extack,
5103 					info->attrs[HWSIM_ATTR_PERM_ADDR]);
5104 			return -EINVAL;
5105 		}
5106 
5107 		param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
5108 	}
5109 
5110 	if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
5111 		param.iftypes =
5112 			nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
5113 
5114 		if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
5115 			NL_SET_ERR_MSG_ATTR(info->extack,
5116 					    info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
5117 					    "cannot support more iftypes than kernel");
5118 			return -EINVAL;
5119 		}
5120 	} else {
5121 		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5122 	}
5123 
5124 	/* ensure both flag and iftype support is honored */
5125 	if (param.p2p_device ||
5126 	    param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5127 		param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5128 		param.p2p_device = true;
5129 	}
5130 
5131 	if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
5132 		u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5133 
5134 		param.ciphers =
5135 			nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5136 
5137 		if (len % sizeof(u32)) {
5138 			NL_SET_ERR_MSG_ATTR(info->extack,
5139 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5140 					    "bad cipher list length");
5141 			return -EINVAL;
5142 		}
5143 
5144 		param.n_ciphers = len / sizeof(u32);
5145 
5146 		if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
5147 			NL_SET_ERR_MSG_ATTR(info->extack,
5148 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5149 					    "too many ciphers specified");
5150 			return -EINVAL;
5151 		}
5152 
5153 		if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
5154 			NL_SET_ERR_MSG_ATTR(info->extack,
5155 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5156 					    "unsupported ciphers specified");
5157 			return -EINVAL;
5158 		}
5159 	}
5160 
5161 	param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
5162 
5163 	if (param.mlo)
5164 		param.use_chanctx = true;
5165 
5166 	if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5167 		hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5168 				  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5169 				  GFP_KERNEL);
5170 		if (!hwname)
5171 			return -ENOMEM;
5172 		param.hwname = hwname;
5173 	}
5174 
5175 	ret = mac80211_hwsim_new_radio(info, &param);
5176 	kfree(hwname);
5177 	return ret;
5178 }
5179 
hwsim_del_radio_nl(struct sk_buff * msg,struct genl_info * info)5180 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
5181 {
5182 	struct mac80211_hwsim_data *data;
5183 	s64 idx = -1;
5184 	const char *hwname = NULL;
5185 
5186 	if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
5187 		idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
5188 	} else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5189 		hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5190 				  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5191 				  GFP_KERNEL);
5192 		if (!hwname)
5193 			return -ENOMEM;
5194 	} else
5195 		return -EINVAL;
5196 
5197 	spin_lock_bh(&hwsim_radio_lock);
5198 	list_for_each_entry(data, &hwsim_radios, list) {
5199 		if (idx >= 0) {
5200 			if (data->idx != idx)
5201 				continue;
5202 		} else {
5203 			if (!hwname ||
5204 			    strcmp(hwname, wiphy_name(data->hw->wiphy)))
5205 				continue;
5206 		}
5207 
5208 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
5209 			continue;
5210 
5211 		list_del(&data->list);
5212 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
5213 				       hwsim_rht_params);
5214 		hwsim_radios_generation++;
5215 		spin_unlock_bh(&hwsim_radio_lock);
5216 		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
5217 					 info);
5218 		kfree(hwname);
5219 		return 0;
5220 	}
5221 	spin_unlock_bh(&hwsim_radio_lock);
5222 
5223 	kfree(hwname);
5224 	return -ENODEV;
5225 }
5226 
hwsim_get_radio_nl(struct sk_buff * msg,struct genl_info * info)5227 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
5228 {
5229 	struct mac80211_hwsim_data *data;
5230 	struct sk_buff *skb;
5231 	int idx, res = -ENODEV;
5232 
5233 	if (!info->attrs[HWSIM_ATTR_RADIO_ID])
5234 		return -EINVAL;
5235 	idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
5236 
5237 	spin_lock_bh(&hwsim_radio_lock);
5238 	list_for_each_entry(data, &hwsim_radios, list) {
5239 		if (data->idx != idx)
5240 			continue;
5241 
5242 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
5243 			continue;
5244 
5245 		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5246 		if (!skb) {
5247 			res = -ENOMEM;
5248 			goto out_err;
5249 		}
5250 
5251 		res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
5252 					       info->snd_seq, NULL, 0);
5253 		if (res < 0) {
5254 			nlmsg_free(skb);
5255 			goto out_err;
5256 		}
5257 
5258 		res = genlmsg_reply(skb, info);
5259 		break;
5260 	}
5261 
5262 out_err:
5263 	spin_unlock_bh(&hwsim_radio_lock);
5264 
5265 	return res;
5266 }
5267 
hwsim_dump_radio_nl(struct sk_buff * skb,struct netlink_callback * cb)5268 static int hwsim_dump_radio_nl(struct sk_buff *skb,
5269 			       struct netlink_callback *cb)
5270 {
5271 	int last_idx = cb->args[0] - 1;
5272 	struct mac80211_hwsim_data *data = NULL;
5273 	int res = 0;
5274 	void *hdr;
5275 
5276 	spin_lock_bh(&hwsim_radio_lock);
5277 	cb->seq = hwsim_radios_generation;
5278 
5279 	if (last_idx >= hwsim_radio_idx-1)
5280 		goto done;
5281 
5282 	list_for_each_entry(data, &hwsim_radios, list) {
5283 		if (data->idx <= last_idx)
5284 			continue;
5285 
5286 		if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
5287 			continue;
5288 
5289 		res = mac80211_hwsim_get_radio(skb, data,
5290 					       NETLINK_CB(cb->skb).portid,
5291 					       cb->nlh->nlmsg_seq, cb,
5292 					       NLM_F_MULTI);
5293 		if (res < 0)
5294 			break;
5295 
5296 		last_idx = data->idx;
5297 	}
5298 
5299 	cb->args[0] = last_idx + 1;
5300 
5301 	/* list changed, but no new element sent, set interrupted flag */
5302 	if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
5303 		hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
5304 				  cb->nlh->nlmsg_seq, &hwsim_genl_family,
5305 				  NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
5306 		if (hdr) {
5307 			genl_dump_check_consistent(cb, hdr);
5308 			genlmsg_end(skb, hdr);
5309 		} else {
5310 			res = -EMSGSIZE;
5311 		}
5312 	}
5313 
5314 done:
5315 	spin_unlock_bh(&hwsim_radio_lock);
5316 	return res ?: skb->len;
5317 }
5318 
5319 /* Generic Netlink operations array */
5320 static const struct genl_small_ops hwsim_ops[] = {
5321 	{
5322 		.cmd = HWSIM_CMD_REGISTER,
5323 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5324 		.doit = hwsim_register_received_nl,
5325 		.flags = GENL_UNS_ADMIN_PERM,
5326 	},
5327 	{
5328 		.cmd = HWSIM_CMD_FRAME,
5329 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5330 		.doit = hwsim_cloned_frame_received_nl,
5331 	},
5332 	{
5333 		.cmd = HWSIM_CMD_TX_INFO_FRAME,
5334 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5335 		.doit = hwsim_tx_info_frame_received_nl,
5336 	},
5337 	{
5338 		.cmd = HWSIM_CMD_NEW_RADIO,
5339 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5340 		.doit = hwsim_new_radio_nl,
5341 		.flags = GENL_UNS_ADMIN_PERM,
5342 	},
5343 	{
5344 		.cmd = HWSIM_CMD_DEL_RADIO,
5345 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5346 		.doit = hwsim_del_radio_nl,
5347 		.flags = GENL_UNS_ADMIN_PERM,
5348 	},
5349 	{
5350 		.cmd = HWSIM_CMD_GET_RADIO,
5351 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5352 		.doit = hwsim_get_radio_nl,
5353 		.dumpit = hwsim_dump_radio_nl,
5354 	},
5355 };
5356 
5357 static struct genl_family hwsim_genl_family __ro_after_init = {
5358 	.name = "MAC80211_HWSIM",
5359 	.version = 1,
5360 	.maxattr = HWSIM_ATTR_MAX,
5361 	.policy = hwsim_genl_policy,
5362 	.netnsok = true,
5363 	.module = THIS_MODULE,
5364 	.small_ops = hwsim_ops,
5365 	.n_small_ops = ARRAY_SIZE(hwsim_ops),
5366 	.resv_start_op = HWSIM_CMD_DEL_MAC_ADDR + 1,
5367 	.mcgrps = hwsim_mcgrps,
5368 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
5369 };
5370 
remove_user_radios(u32 portid)5371 static void remove_user_radios(u32 portid)
5372 {
5373 	struct mac80211_hwsim_data *entry, *tmp;
5374 	LIST_HEAD(list);
5375 
5376 	spin_lock_bh(&hwsim_radio_lock);
5377 	list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
5378 		if (entry->destroy_on_close && entry->portid == portid) {
5379 			list_move(&entry->list, &list);
5380 			rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
5381 					       hwsim_rht_params);
5382 			hwsim_radios_generation++;
5383 		}
5384 	}
5385 	spin_unlock_bh(&hwsim_radio_lock);
5386 
5387 	list_for_each_entry_safe(entry, tmp, &list, list) {
5388 		list_del(&entry->list);
5389 		mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
5390 					 NULL);
5391 	}
5392 }
5393 
mac80211_hwsim_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)5394 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
5395 					 unsigned long state,
5396 					 void *_notify)
5397 {
5398 	struct netlink_notify *notify = _notify;
5399 
5400 	if (state != NETLINK_URELEASE)
5401 		return NOTIFY_DONE;
5402 
5403 	remove_user_radios(notify->portid);
5404 
5405 	if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
5406 		printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
5407 		       " socket, switching to perfect channel medium\n");
5408 		hwsim_register_wmediumd(notify->net, 0);
5409 	}
5410 	return NOTIFY_DONE;
5411 
5412 }
5413 
5414 static struct notifier_block hwsim_netlink_notifier = {
5415 	.notifier_call = mac80211_hwsim_netlink_notify,
5416 };
5417 
hwsim_init_netlink(void)5418 static int __init hwsim_init_netlink(void)
5419 {
5420 	int rc;
5421 
5422 	printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
5423 
5424 	rc = genl_register_family(&hwsim_genl_family);
5425 	if (rc)
5426 		goto failure;
5427 
5428 	rc = netlink_register_notifier(&hwsim_netlink_notifier);
5429 	if (rc) {
5430 		genl_unregister_family(&hwsim_genl_family);
5431 		goto failure;
5432 	}
5433 
5434 	return 0;
5435 
5436 failure:
5437 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
5438 	return -EINVAL;
5439 }
5440 
hwsim_init_net(struct net * net)5441 static __net_init int hwsim_init_net(struct net *net)
5442 {
5443 	return hwsim_net_set_netgroup(net);
5444 }
5445 
hwsim_exit_net(struct net * net)5446 static void __net_exit hwsim_exit_net(struct net *net)
5447 {
5448 	struct mac80211_hwsim_data *data, *tmp;
5449 	LIST_HEAD(list);
5450 
5451 	spin_lock_bh(&hwsim_radio_lock);
5452 	list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
5453 		if (!net_eq(wiphy_net(data->hw->wiphy), net))
5454 			continue;
5455 
5456 		/* Radios created in init_net are returned to init_net. */
5457 		if (data->netgroup == hwsim_net_get_netgroup(&init_net))
5458 			continue;
5459 
5460 		list_move(&data->list, &list);
5461 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
5462 				       hwsim_rht_params);
5463 		hwsim_radios_generation++;
5464 	}
5465 	spin_unlock_bh(&hwsim_radio_lock);
5466 
5467 	list_for_each_entry_safe(data, tmp, &list, list) {
5468 		list_del(&data->list);
5469 		mac80211_hwsim_del_radio(data,
5470 					 wiphy_name(data->hw->wiphy),
5471 					 NULL);
5472 	}
5473 
5474 	ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
5475 }
5476 
5477 static struct pernet_operations hwsim_net_ops = {
5478 	.init = hwsim_init_net,
5479 	.exit = hwsim_exit_net,
5480 	.id   = &hwsim_net_id,
5481 	.size = sizeof(struct hwsim_net),
5482 };
5483 
hwsim_exit_netlink(void)5484 static void hwsim_exit_netlink(void)
5485 {
5486 	/* unregister the notifier */
5487 	netlink_unregister_notifier(&hwsim_netlink_notifier);
5488 	/* unregister the family */
5489 	genl_unregister_family(&hwsim_genl_family);
5490 }
5491 
5492 #if IS_REACHABLE(CONFIG_VIRTIO)
hwsim_virtio_tx_done(struct virtqueue * vq)5493 static void hwsim_virtio_tx_done(struct virtqueue *vq)
5494 {
5495 	unsigned int len;
5496 	struct sk_buff *skb;
5497 	unsigned long flags;
5498 
5499 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
5500 	while ((skb = virtqueue_get_buf(vq, &len)))
5501 		nlmsg_free(skb);
5502 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5503 }
5504 
hwsim_virtio_handle_cmd(struct sk_buff * skb)5505 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
5506 {
5507 	struct nlmsghdr *nlh;
5508 	struct genlmsghdr *gnlh;
5509 	struct nlattr *tb[HWSIM_ATTR_MAX + 1];
5510 	struct genl_info info = {};
5511 	int err;
5512 
5513 	nlh = nlmsg_hdr(skb);
5514 	gnlh = nlmsg_data(nlh);
5515 
5516 	if (skb->len < nlh->nlmsg_len)
5517 		return -EINVAL;
5518 
5519 	err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
5520 			    hwsim_genl_policy, NULL);
5521 	if (err) {
5522 		pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
5523 		return err;
5524 	}
5525 
5526 	info.attrs = tb;
5527 
5528 	switch (gnlh->cmd) {
5529 	case HWSIM_CMD_FRAME:
5530 		hwsim_cloned_frame_received_nl(skb, &info);
5531 		break;
5532 	case HWSIM_CMD_TX_INFO_FRAME:
5533 		hwsim_tx_info_frame_received_nl(skb, &info);
5534 		break;
5535 	default:
5536 		pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
5537 		return -EPROTO;
5538 	}
5539 	return 0;
5540 }
5541 
hwsim_virtio_rx_work(struct work_struct * work)5542 static void hwsim_virtio_rx_work(struct work_struct *work)
5543 {
5544 	struct virtqueue *vq;
5545 	unsigned int len;
5546 	struct sk_buff *skb;
5547 	struct scatterlist sg[1];
5548 	int err;
5549 	unsigned long flags;
5550 
5551 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
5552 	if (!hwsim_virtio_enabled)
5553 		goto out_unlock;
5554 
5555 	skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
5556 	if (!skb)
5557 		goto out_unlock;
5558 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5559 
5560 	skb->data = skb->head;
5561 	skb_reset_tail_pointer(skb);
5562 	skb_put(skb, len);
5563 	hwsim_virtio_handle_cmd(skb);
5564 
5565 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
5566 	if (!hwsim_virtio_enabled) {
5567 		nlmsg_free(skb);
5568 		goto out_unlock;
5569 	}
5570 	vq = hwsim_vqs[HWSIM_VQ_RX];
5571 	sg_init_one(sg, skb->head, skb_end_offset(skb));
5572 	err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
5573 	if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
5574 		nlmsg_free(skb);
5575 	else
5576 		virtqueue_kick(vq);
5577 	schedule_work(&hwsim_virtio_rx);
5578 
5579 out_unlock:
5580 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5581 }
5582 
hwsim_virtio_rx_done(struct virtqueue * vq)5583 static void hwsim_virtio_rx_done(struct virtqueue *vq)
5584 {
5585 	schedule_work(&hwsim_virtio_rx);
5586 }
5587 
init_vqs(struct virtio_device * vdev)5588 static int init_vqs(struct virtio_device *vdev)
5589 {
5590 	vq_callback_t *callbacks[HWSIM_NUM_VQS] = {
5591 		[HWSIM_VQ_TX] = hwsim_virtio_tx_done,
5592 		[HWSIM_VQ_RX] = hwsim_virtio_rx_done,
5593 	};
5594 	const char *names[HWSIM_NUM_VQS] = {
5595 		[HWSIM_VQ_TX] = "tx",
5596 		[HWSIM_VQ_RX] = "rx",
5597 	};
5598 
5599 	return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
5600 			       hwsim_vqs, callbacks, names, NULL);
5601 }
5602 
fill_vq(struct virtqueue * vq)5603 static int fill_vq(struct virtqueue *vq)
5604 {
5605 	int i, err;
5606 	struct sk_buff *skb;
5607 	struct scatterlist sg[1];
5608 
5609 	for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
5610 		skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
5611 		if (!skb)
5612 			return -ENOMEM;
5613 
5614 		sg_init_one(sg, skb->head, skb_end_offset(skb));
5615 		err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
5616 		if (err) {
5617 			nlmsg_free(skb);
5618 			return err;
5619 		}
5620 	}
5621 	virtqueue_kick(vq);
5622 	return 0;
5623 }
5624 
remove_vqs(struct virtio_device * vdev)5625 static void remove_vqs(struct virtio_device *vdev)
5626 {
5627 	int i;
5628 
5629 	virtio_reset_device(vdev);
5630 
5631 	for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
5632 		struct virtqueue *vq = hwsim_vqs[i];
5633 		struct sk_buff *skb;
5634 
5635 		while ((skb = virtqueue_detach_unused_buf(vq)))
5636 			nlmsg_free(skb);
5637 	}
5638 
5639 	vdev->config->del_vqs(vdev);
5640 }
5641 
hwsim_virtio_probe(struct virtio_device * vdev)5642 static int hwsim_virtio_probe(struct virtio_device *vdev)
5643 {
5644 	int err;
5645 	unsigned long flags;
5646 
5647 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
5648 	if (hwsim_virtio_enabled) {
5649 		spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5650 		return -EEXIST;
5651 	}
5652 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5653 
5654 	err = init_vqs(vdev);
5655 	if (err)
5656 		return err;
5657 
5658 	virtio_device_ready(vdev);
5659 
5660 	err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
5661 	if (err)
5662 		goto out_remove;
5663 
5664 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
5665 	hwsim_virtio_enabled = true;
5666 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5667 
5668 	schedule_work(&hwsim_virtio_rx);
5669 	return 0;
5670 
5671 out_remove:
5672 	remove_vqs(vdev);
5673 	return err;
5674 }
5675 
hwsim_virtio_remove(struct virtio_device * vdev)5676 static void hwsim_virtio_remove(struct virtio_device *vdev)
5677 {
5678 	hwsim_virtio_enabled = false;
5679 
5680 	cancel_work_sync(&hwsim_virtio_rx);
5681 
5682 	remove_vqs(vdev);
5683 }
5684 
5685 /* MAC80211_HWSIM virtio device id table */
5686 static const struct virtio_device_id id_table[] = {
5687 	{ VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
5688 	{ 0 }
5689 };
5690 MODULE_DEVICE_TABLE(virtio, id_table);
5691 
5692 static struct virtio_driver virtio_hwsim = {
5693 	.driver.name = KBUILD_MODNAME,
5694 	.driver.owner = THIS_MODULE,
5695 	.id_table = id_table,
5696 	.probe = hwsim_virtio_probe,
5697 	.remove = hwsim_virtio_remove,
5698 };
5699 
hwsim_register_virtio_driver(void)5700 static int hwsim_register_virtio_driver(void)
5701 {
5702 	return register_virtio_driver(&virtio_hwsim);
5703 }
5704 
hwsim_unregister_virtio_driver(void)5705 static void hwsim_unregister_virtio_driver(void)
5706 {
5707 	unregister_virtio_driver(&virtio_hwsim);
5708 }
5709 #else
hwsim_register_virtio_driver(void)5710 static inline int hwsim_register_virtio_driver(void)
5711 {
5712 	return 0;
5713 }
5714 
hwsim_unregister_virtio_driver(void)5715 static inline void hwsim_unregister_virtio_driver(void)
5716 {
5717 }
5718 #endif
5719 
init_mac80211_hwsim(void)5720 static int __init init_mac80211_hwsim(void)
5721 {
5722 	int i, err;
5723 
5724 	if (radios < 0 || radios > 100)
5725 		return -EINVAL;
5726 
5727 	if (channels < 1)
5728 		return -EINVAL;
5729 
5730 	err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
5731 	if (err)
5732 		return err;
5733 
5734 	err = register_pernet_device(&hwsim_net_ops);
5735 	if (err)
5736 		goto out_free_rht;
5737 
5738 	err = platform_driver_register(&mac80211_hwsim_driver);
5739 	if (err)
5740 		goto out_unregister_pernet;
5741 
5742 	err = hwsim_init_netlink();
5743 	if (err)
5744 		goto out_unregister_driver;
5745 
5746 	err = hwsim_register_virtio_driver();
5747 	if (err)
5748 		goto out_exit_netlink;
5749 
5750 	hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
5751 	if (IS_ERR(hwsim_class)) {
5752 		err = PTR_ERR(hwsim_class);
5753 		goto out_exit_virtio;
5754 	}
5755 
5756 	hwsim_init_s1g_channels(hwsim_channels_s1g);
5757 
5758 	for (i = 0; i < radios; i++) {
5759 		struct hwsim_new_radio_params param = { 0 };
5760 
5761 		param.channels = channels;
5762 
5763 		switch (regtest) {
5764 		case HWSIM_REGTEST_DIFF_COUNTRY:
5765 			if (i < ARRAY_SIZE(hwsim_alpha2s))
5766 				param.reg_alpha2 = hwsim_alpha2s[i];
5767 			break;
5768 		case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
5769 			if (!i)
5770 				param.reg_alpha2 = hwsim_alpha2s[0];
5771 			break;
5772 		case HWSIM_REGTEST_STRICT_ALL:
5773 			param.reg_strict = true;
5774 			fallthrough;
5775 		case HWSIM_REGTEST_DRIVER_REG_ALL:
5776 			param.reg_alpha2 = hwsim_alpha2s[0];
5777 			break;
5778 		case HWSIM_REGTEST_WORLD_ROAM:
5779 			if (i == 0)
5780 				param.regd = &hwsim_world_regdom_custom_01;
5781 			break;
5782 		case HWSIM_REGTEST_CUSTOM_WORLD:
5783 			param.regd = &hwsim_world_regdom_custom_01;
5784 			break;
5785 		case HWSIM_REGTEST_CUSTOM_WORLD_2:
5786 			if (i == 0)
5787 				param.regd = &hwsim_world_regdom_custom_01;
5788 			else if (i == 1)
5789 				param.regd = &hwsim_world_regdom_custom_02;
5790 			break;
5791 		case HWSIM_REGTEST_STRICT_FOLLOW:
5792 			if (i == 0) {
5793 				param.reg_strict = true;
5794 				param.reg_alpha2 = hwsim_alpha2s[0];
5795 			}
5796 			break;
5797 		case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
5798 			if (i == 0) {
5799 				param.reg_strict = true;
5800 				param.reg_alpha2 = hwsim_alpha2s[0];
5801 			} else if (i == 1) {
5802 				param.reg_alpha2 = hwsim_alpha2s[1];
5803 			}
5804 			break;
5805 		case HWSIM_REGTEST_ALL:
5806 			switch (i) {
5807 			case 0:
5808 				param.regd = &hwsim_world_regdom_custom_01;
5809 				break;
5810 			case 1:
5811 				param.regd = &hwsim_world_regdom_custom_02;
5812 				break;
5813 			case 2:
5814 				param.reg_alpha2 = hwsim_alpha2s[0];
5815 				break;
5816 			case 3:
5817 				param.reg_alpha2 = hwsim_alpha2s[1];
5818 				break;
5819 			case 4:
5820 				param.reg_strict = true;
5821 				param.reg_alpha2 = hwsim_alpha2s[2];
5822 				break;
5823 			}
5824 			break;
5825 		default:
5826 			break;
5827 		}
5828 
5829 		param.p2p_device = support_p2p_device;
5830 		param.mlo = mlo;
5831 		param.use_chanctx = channels > 1 || mlo;
5832 		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5833 		if (param.p2p_device)
5834 			param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5835 
5836 		err = mac80211_hwsim_new_radio(NULL, &param);
5837 		if (err < 0)
5838 			goto out_free_radios;
5839 	}
5840 
5841 	hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
5842 				 hwsim_mon_setup);
5843 	if (hwsim_mon == NULL) {
5844 		err = -ENOMEM;
5845 		goto out_free_radios;
5846 	}
5847 
5848 	rtnl_lock();
5849 	err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
5850 	if (err < 0) {
5851 		rtnl_unlock();
5852 		goto out_free_mon;
5853 	}
5854 
5855 	err = register_netdevice(hwsim_mon);
5856 	if (err < 0) {
5857 		rtnl_unlock();
5858 		goto out_free_mon;
5859 	}
5860 	rtnl_unlock();
5861 
5862 	return 0;
5863 
5864 out_free_mon:
5865 	free_netdev(hwsim_mon);
5866 out_free_radios:
5867 	mac80211_hwsim_free();
5868 out_exit_virtio:
5869 	hwsim_unregister_virtio_driver();
5870 out_exit_netlink:
5871 	hwsim_exit_netlink();
5872 out_unregister_driver:
5873 	platform_driver_unregister(&mac80211_hwsim_driver);
5874 out_unregister_pernet:
5875 	unregister_pernet_device(&hwsim_net_ops);
5876 out_free_rht:
5877 	rhashtable_destroy(&hwsim_radios_rht);
5878 	return err;
5879 }
5880 module_init(init_mac80211_hwsim);
5881 
exit_mac80211_hwsim(void)5882 static void __exit exit_mac80211_hwsim(void)
5883 {
5884 	pr_debug("mac80211_hwsim: unregister radios\n");
5885 
5886 	hwsim_unregister_virtio_driver();
5887 	hwsim_exit_netlink();
5888 
5889 	mac80211_hwsim_free();
5890 
5891 	rhashtable_destroy(&hwsim_radios_rht);
5892 	unregister_netdev(hwsim_mon);
5893 	platform_driver_unregister(&mac80211_hwsim_driver);
5894 	unregister_pernet_device(&hwsim_net_ops);
5895 }
5896 module_exit(exit_mac80211_hwsim);
5897