drivers/net/wireless/mac80211_hwsim.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
   4  * Copyright (c) 2008, Jouni Malinen <[email protected]>
   5  * Copyright (c) 2011, Javier Lopez <[email protected]>
   6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
   7  * Copyright (C) 2018 - 2020 Intel Corporation
   8  */
   9
  10 /*
  11  * TODO:
  12  * - Add TSF sync and fix IBSS beacon transmission by adding
  13  *   competition for "air time" at TBTT
  14  * - RX filtering based on filter configuration (data->rx_filter)
  15  */
  16
  17 #include <linux/list.h>
  18 #include <linux/slab.h>
  19 #include <linux/spinlock.h>
  20 #include <net/dst.h>
  21 #include <net/xfrm.h>
  22 #include <net/mac80211.h>
  23 #include <net/ieee80211_radiotap.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/rtnetlink.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/platform_device.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/module.h>
  30 #include <linux/ktime.h>
  31 #include <net/genetlink.h>
  32 #include <net/net_namespace.h>
  33 #include <net/netns/generic.h>
  34 #include <linux/rhashtable.h>
  35 #include <linux/nospec.h>
  36 #include <linux/virtio.h>
  37 #include <linux/virtio_ids.h>
  38 #include <linux/virtio_config.h>
  39 #include "mac80211_hwsim.h"
  40
  41 #define WARN_QUEUE 100
  42 #define MAX_QUEUE 200
  43
  44 MODULE_AUTHOR("Jouni Malinen");
  45 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
  46 MODULE_LICENSE("GPL");
  47
  48 static int radios = 2;
  49 module_param(radios, int, 0444);
  50 MODULE_PARM_DESC(radios, "Number of simulated radios");
  51
  52 static int channels = 1;
  53 module_param(channels, int, 0444);
  54 MODULE_PARM_DESC(channels, "Number of concurrent channels");
  55
  56 static bool paged_rx = false;
  57 module_param(paged_rx, bool, 0644);
  58 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
  59
  60 static bool rctbl = false;
  61 module_param(rctbl, bool, 0444);
  62 MODULE_PARM_DESC(rctbl, "Handle rate control table");
  63
  64 static bool support_p2p_device = true;
  65 module_param(support_p2p_device, bool, 0444);
  66 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
  67
  68 /**
  69  * enum hwsim_regtest - the type of regulatory tests we offer
  70  *
  71  * These are the different values you can use for the regtest
  72  * module parameter. This is useful to help test world roaming
  73  * and the driver regulatory_hint() call and combinations of these.
  74  * If you want to do specific alpha2 regulatory domain tests simply
  75  * use the userspace regulatory request as that will be respected as
  76  * well without the need of this module parameter. This is designed
  77  * only for testing the driver regulatory request, world roaming
  78  * and all possible combinations.
  79  *
  80  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
  81  *      this is the default value.
  82  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
  83  *      hint, only one driver regulatory hint will be sent as such the
  84  *      secondary radios are expected to follow.
  85  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
  86  *      request with all radios reporting the same regulatory domain.
  87  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
  88  *      different regulatory domains requests. Expected behaviour is for
  89  *      an intersection to occur but each device will still use their
  90  *      respective regulatory requested domains. Subsequent radios will
  91  *      use the resulting intersection.
  92  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
  93  *      this by using a custom beacon-capable regulatory domain for the first
  94  *      radio. All other device world roam.
  95  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
  96  *      domain requests. All radios will adhere to this custom world regulatory
  97  *      domain.
  98  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
  99  *      domain requests. The first radio will adhere to the first custom world
 100  *      regulatory domain, the second one to the second custom world regulatory
 101  *      domain. All other devices will world roam.
 102  * @HWSIM_REGTEST_STRICT_FOLLOW_: Used for testing strict regulatory domain
 103  *      settings, only the first radio will send a regulatory domain request
 104  *      and use strict settings. The rest of the radios are expected to follow.
 105  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
 106  *      settings. All radios will adhere to this.
 107  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
 108  *      domain settings, combined with secondary driver regulatory domain
 109  *      settings. The first radio will get a strict regulatory domain setting
 110  *      using the first driver regulatory request and the second radio will use
 111  *      non-strict settings using the second driver regulatory request. All
 112  *      other devices should follow the intersection created between the
 113  *      first two.
 114  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
 115  *      at least 6 radios for a complete test. We will test in this order:
 116  *      1 - driver custom world regulatory domain
 117  *      2 - second custom world regulatory domain
 118  *      3 - first driver regulatory domain request
 119  *      4 - second driver regulatory domain request
 120  *      5 - strict regulatory domain settings using the third driver regulatory
 121  *          domain request
 122  *      6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
 123  *                 regulatory requests.
 124  */
 125 enum hwsim_regtest {
 126         HWSIM_REGTEST_DISABLED = 0,
 127         HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
 128         HWSIM_REGTEST_DRIVER_REG_ALL = 2,
 129         HWSIM_REGTEST_DIFF_COUNTRY = 3,
 130         HWSIM_REGTEST_WORLD_ROAM = 4,
 131         HWSIM_REGTEST_CUSTOM_WORLD = 5,
 132         HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
 133         HWSIM_REGTEST_STRICT_FOLLOW = 7,
 134         HWSIM_REGTEST_STRICT_ALL = 8,
 135         HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
 136         HWSIM_REGTEST_ALL = 10,
 137 };
 138
 139 /* Set to one of the HWSIM_REGTEST_* values above */
 140 static int regtest = HWSIM_REGTEST_DISABLED;
 141 module_param(regtest, int, 0444);
 142 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
 143
 144 static const char *hwsim_alpha2s[] = {
 145         "FI",
 146         "AL",
 147         "US",
 148         "DE",
 149         "JP",
 150         "AL",
 151 };
 152
 153 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
 154         .n_reg_rules = 5,
 155         .alpha2 =  "99",
 156         .reg_rules = {
 157                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 158                 REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
 159                 REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
 160                 REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
 161                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 162         }
 163 };
 164
 165 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
 166         .n_reg_rules = 3,
 167         .alpha2 =  "99",
 168         .reg_rules = {
 169                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 170                 REG_RULE(5725-10, 5850+10, 40, 0, 30,
 171                          NL80211_RRF_NO_IR),
 172                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 173         }
 174 };
 175
 176 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
 177         &hwsim_world_regdom_custom_01,
 178         &hwsim_world_regdom_custom_02,
 179 };
 180
 181 struct hwsim_vif_priv {
 182         u32 magic;
 183         u8 bssid[ETH_ALEN];
 184         bool assoc;
 185         bool bcn_en;
 186         u16 aid;
 187 };
 188
 189 #define HWSIM_VIF_MAGIC 0x69537748
 190
 191 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
 192 {
 193         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 194         WARN(vp->magic != HWSIM_VIF_MAGIC,
 195              "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
 196              vif, vp->magic, vif->addr, vif->type, vif->p2p);
 197 }
 198
 199 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
 200 {
 201         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 202         vp->magic = HWSIM_VIF_MAGIC;
 203 }
 204
 205 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
 206 {
 207         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 208         vp->magic = 0;
 209 }
 210
 211 struct hwsim_sta_priv {
 212         u32 magic;
 213 };
 214
 215 #define HWSIM_STA_MAGIC 0x6d537749
 216
 217 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
 218 {
 219         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 220         WARN_ON(sp->magic != HWSIM_STA_MAGIC);
 221 }
 222
 223 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
 224 {
 225         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 226         sp->magic = HWSIM_STA_MAGIC;
 227 }
 228
 229 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
 230 {
 231         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 232         sp->magic = 0;
 233 }
 234
 235 struct hwsim_chanctx_priv {
 236         u32 magic;
 237 };
 238
 239 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
 240
 241 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
 242 {
 243         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 244         WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
 245 }
 246
 247 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
 248 {
 249         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 250         cp->magic = HWSIM_CHANCTX_MAGIC;
 251 }
 252
 253 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
 254 {
 255         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 256         cp->magic = 0;
 257 }
 258
 259 static unsigned int hwsim_net_id;
 260
 261 static DEFINE_IDA(hwsim_netgroup_ida);
 262
 263 struct hwsim_net {
 264         int netgroup;
 265         u32 wmediumd;
 266 };
 267
 268 static inline int hwsim_net_get_netgroup(struct net *net)
 269 {
 270         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 271
 272         return hwsim_net->netgroup;
 273 }
 274
 275 static inline int hwsim_net_set_netgroup(struct net *net)
 276 {
 277         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 278
 279         hwsim_net->netgroup = ida_simple_get(&hwsim_netgroup_ida,
 280                                              0, 0, GFP_KERNEL);
 281         return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
 282 }
 283
 284 static inline u32 hwsim_net_get_wmediumd(struct net *net)
 285 {
 286         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 287
 288         return hwsim_net->wmediumd;
 289 }
 290
 291 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
 292 {
 293         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 294
 295         hwsim_net->wmediumd = portid;
 296 }
 297
 298 static struct class *hwsim_class;
 299
 300 static struct net_device *hwsim_mon; /* global monitor netdev */
 301
 302 #define CHAN2G(_freq)  { \
 303         .band = NL80211_BAND_2GHZ, \
 304         .center_freq = (_freq), \
 305         .hw_value = (_freq), \
 306 }
 307
 308 #define CHAN5G(_freq) { \
 309         .band = NL80211_BAND_5GHZ, \
 310         .center_freq = (_freq), \
 311         .hw_value = (_freq), \
 312 }
 313
 314 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
 315         CHAN2G(2412), /* Channel 1 */
 316         CHAN2G(2417), /* Channel 2 */
 317         CHAN2G(2422), /* Channel 3 */
 318         CHAN2G(2427), /* Channel 4 */
 319         CHAN2G(2432), /* Channel 5 */
 320         CHAN2G(2437), /* Channel 6 */
 321         CHAN2G(2442), /* Channel 7 */
 322         CHAN2G(2447), /* Channel 8 */
 323         CHAN2G(2452), /* Channel 9 */
 324         CHAN2G(2457), /* Channel 10 */
 325         CHAN2G(2462), /* Channel 11 */
 326         CHAN2G(2467), /* Channel 12 */
 327         CHAN2G(2472), /* Channel 13 */
 328         CHAN2G(2484), /* Channel 14 */
 329 };
 330
 331 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
 332         CHAN5G(5180), /* Channel 36 */
 333         CHAN5G(5200), /* Channel 40 */
 334         CHAN5G(5220), /* Channel 44 */
 335         CHAN5G(5240), /* Channel 48 */
 336
 337         CHAN5G(5260), /* Channel 52 */
 338         CHAN5G(5280), /* Channel 56 */
 339         CHAN5G(5300), /* Channel 60 */
 340         CHAN5G(5320), /* Channel 64 */
 341
 342         CHAN5G(5500), /* Channel 100 */
 343         CHAN5G(5520), /* Channel 104 */
 344         CHAN5G(5540), /* Channel 108 */
 345         CHAN5G(5560), /* Channel 112 */
 346         CHAN5G(5580), /* Channel 116 */
 347         CHAN5G(5600), /* Channel 120 */
 348         CHAN5G(5620), /* Channel 124 */
 349         CHAN5G(5640), /* Channel 128 */
 350         CHAN5G(5660), /* Channel 132 */
 351         CHAN5G(5680), /* Channel 136 */
 352         CHAN5G(5700), /* Channel 140 */
 353
 354         CHAN5G(5745), /* Channel 149 */
 355         CHAN5G(5765), /* Channel 153 */
 356         CHAN5G(5785), /* Channel 157 */
 357         CHAN5G(5805), /* Channel 161 */
 358         CHAN5G(5825), /* Channel 165 */
 359         CHAN5G(5845), /* Channel 169 */
 360
 361         CHAN5G(5855), /* Channel 171 */
 362         CHAN5G(5860), /* Channel 172 */
 363         CHAN5G(5865), /* Channel 173 */
 364         CHAN5G(5870), /* Channel 174 */
 365
 366         CHAN5G(5875), /* Channel 175 */
 367         CHAN5G(5880), /* Channel 176 */
 368         CHAN5G(5885), /* Channel 177 */
 369         CHAN5G(5890), /* Channel 178 */
 370         CHAN5G(5895), /* Channel 179 */
 371         CHAN5G(5900), /* Channel 180 */
 372         CHAN5G(5905), /* Channel 181 */
 373
 374         CHAN5G(5910), /* Channel 182 */
 375         CHAN5G(5915), /* Channel 183 */
 376         CHAN5G(5920), /* Channel 184 */
 377         CHAN5G(5925), /* Channel 185 */
 378 };
 379
 380 static const struct ieee80211_rate hwsim_rates[] = {
 381         { .bitrate = 10 },
 382         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 383         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 384         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 385         { .bitrate = 60 },
 386         { .bitrate = 90 },
 387         { .bitrate = 120 },
 388         { .bitrate = 180 },
 389         { .bitrate = 240 },
 390         { .bitrate = 360 },
 391         { .bitrate = 480 },
 392         { .bitrate = 540 }
 393 };
 394
 395 static const u32 hwsim_ciphers[] = {
 396         WLAN_CIPHER_SUITE_WEP40,
 397         WLAN_CIPHER_SUITE_WEP104,
 398         WLAN_CIPHER_SUITE_TKIP,
 399         WLAN_CIPHER_SUITE_CCMP,
 400         WLAN_CIPHER_SUITE_CCMP_256,
 401         WLAN_CIPHER_SUITE_GCMP,
 402         WLAN_CIPHER_SUITE_GCMP_256,
 403         WLAN_CIPHER_SUITE_AES_CMAC,
 404         WLAN_CIPHER_SUITE_BIP_CMAC_256,
 405         WLAN_CIPHER_SUITE_BIP_GMAC_128,
 406         WLAN_CIPHER_SUITE_BIP_GMAC_256,
 407 };
 408
 409 #define OUI_QCA 0x001374
 410 #define QCA_NL80211_SUBCMD_TEST 1
 411 enum qca_nl80211_vendor_subcmds {
 412         QCA_WLAN_VENDOR_ATTR_TEST = 8,
 413         QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
 414 };
 415
 416 static const struct nla_policy
 417 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
 418         [QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
 419 };
 420
 421 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
 422                                           struct wireless_dev *wdev,
 423                                           const void *data, int data_len)
 424 {
 425         struct sk_buff *skb;
 426         struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 427         int err;
 428         u32 val;
 429
 430         err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
 431                                    data_len, hwsim_vendor_test_policy, NULL);
 432         if (err)
 433                 return err;
 434         if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
 435                 return -EINVAL;
 436         val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
 437         wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
 438
 439         /* Send a vendor event as a test. Note that this would not normally be
 440          * done within a command handler, but rather, based on some other
 441          * trigger. For simplicity, this command is used to trigger the event
 442          * here.
 443          *
 444          * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
 445          */
 446         skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
 447         if (skb) {
 448                 /* skb_put() or nla_put() will fill up data within
 449                  * NL80211_ATTR_VENDOR_DATA.
 450                  */
 451
 452                 /* Add vendor data */
 453                 nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
 454
 455                 /* Send the event - this will call nla_nest_end() */
 456                 cfg80211_vendor_event(skb, GFP_KERNEL);
 457         }
 458
 459         /* Send a response to the command */
 460         skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
 461         if (!skb)
 462                 return -ENOMEM;
 463
 464         /* skb_put() or nla_put() will fill up data within
 465          * NL80211_ATTR_VENDOR_DATA
 466          */
 467         nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
 468
 469         return cfg80211_vendor_cmd_reply(skb);
 470 }
 471
 472 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
 473         {
 474                 .info = { .vendor_id = OUI_QCA,
 475                           .subcmd = QCA_NL80211_SUBCMD_TEST },
 476                 .flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
 477                 .doit = mac80211_hwsim_vendor_cmd_test,
 478                 .policy = hwsim_vendor_test_policy,
 479                 .maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
 480         }
 481 };
 482
 483 /* Advertise support vendor specific events */
 484 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
 485         { .vendor_id = OUI_QCA, .subcmd = 1 },
 486 };
 487
 488 static spinlock_t hwsim_radio_lock;
 489 static LIST_HEAD(hwsim_radios);
 490 static struct rhashtable hwsim_radios_rht;
 491 static int hwsim_radio_idx;
 492 static int hwsim_radios_generation = 1;
 493
 494 static struct platform_driver mac80211_hwsim_driver = {
 495         .driver = {
 496                 .name = "mac80211_hwsim",
 497         },
 498 };
 499
 500 struct mac80211_hwsim_data {
 501         struct list_head list;
 502         struct rhash_head rht;
 503         struct ieee80211_hw *hw;
 504         struct device *dev;
 505         struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 506         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
 507         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
 508         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 509         struct ieee80211_iface_combination if_combination;
 510         struct ieee80211_iface_limit if_limits[3];
 511         int n_if_limits;
 512
 513         u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
 514
 515         struct mac_address addresses[2];
 516         int channels, idx;
 517         bool use_chanctx;
 518         bool destroy_on_close;
 519         u32 portid;
 520         char alpha2[2];
 521         const struct ieee80211_regdomain *regd;
 522
 523         struct ieee80211_channel *tmp_chan;
 524         struct ieee80211_channel *roc_chan;
 525         u32 roc_duration;
 526         struct delayed_work roc_start;
 527         struct delayed_work roc_done;
 528         struct delayed_work hw_scan;
 529         struct cfg80211_scan_request *hw_scan_request;
 530         struct ieee80211_vif *hw_scan_vif;
 531         int scan_chan_idx;
 532         u8 scan_addr[ETH_ALEN];
 533         struct {
 534                 struct ieee80211_channel *channel;
 535                 unsigned long next_start, start, end;
 536         } survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
 537                       ARRAY_SIZE(hwsim_channels_5ghz)];
 538
 539         struct ieee80211_channel *channel;
 540         u64 beacon_int  /* beacon interval in us */;
 541         unsigned int rx_filter;
 542         bool started, idle, scanning;
 543         struct mutex mutex;
 544         struct hrtimer beacon_timer;
 545         enum ps_mode {
 546                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
 547         } ps;
 548         bool ps_poll_pending;
 549         struct dentry *debugfs;
 550
 551         uintptr_t pending_cookie;
 552         struct sk_buff_head pending;    /* packets pending */
 553         /*
 554          * Only radios in the same group can communicate together (the
 555          * channel has to match too). Each bit represents a group. A
 556          * radio can be in more than one group.
 557          */
 558         u64 group;
 559
 560         /* group shared by radios created in the same netns */
 561         int netgroup;
 562         /* wmediumd portid responsible for netgroup of this radio */
 563         u32 wmediumd;
 564
 565         /* difference between this hw's clock and the real clock, in usecs */
 566         s64 tsf_offset;
 567         s64 bcn_delta;
 568         /* absolute beacon transmission time. Used to cover up "tx" delay. */
 569         u64 abs_bcn_ts;
 570
 571         /* Stats */
 572         u64 tx_pkts;
 573         u64 rx_pkts;
 574         u64 tx_bytes;
 575         u64 rx_bytes;
 576         u64 tx_dropped;
 577         u64 tx_failed;
 578 };
 579
 580 static const struct rhashtable_params hwsim_rht_params = {
 581         .nelem_hint = 2,
 582         .automatic_shrinking = true,
 583         .key_len = ETH_ALEN,
 584         .key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
 585         .head_offset = offsetof(struct mac80211_hwsim_data, rht),
 586 };
 587
 588 struct hwsim_radiotap_hdr {
 589         struct ieee80211_radiotap_header hdr;
 590         __le64 rt_tsft;
 591         u8 rt_flags;
 592         u8 rt_rate;
 593         __le16 rt_channel;
 594         __le16 rt_chbitmask;
 595 } __packed;
 596
 597 struct hwsim_radiotap_ack_hdr {
 598         struct ieee80211_radiotap_header hdr;
 599         u8 rt_flags;
 600         u8 pad;
 601         __le16 rt_channel;
 602         __le16 rt_chbitmask;
 603 } __packed;
 604
 605 /* MAC80211_HWSIM netlink family */
 606 static struct genl_family hwsim_genl_family;
 607
 608 enum hwsim_multicast_groups {
 609         HWSIM_MCGRP_CONFIG,
 610 };
 611
 612 static const struct genl_multicast_group hwsim_mcgrps[] = {
 613         [HWSIM_MCGRP_CONFIG] = { .name = "config", },
 614 };
 615
 616 /* MAC80211_HWSIM netlink policy */
 617
 618 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
 619         [HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
 620         [HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
 621         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
 622                                .len = IEEE80211_MAX_DATA_LEN },
 623         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
 624         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
 625         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
 626         [HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
 627                                  .len = IEEE80211_TX_MAX_RATES *
 628                                         sizeof(struct hwsim_tx_rate)},
 629         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
 630         [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
 631         [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
 632         [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 633         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
 634         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 635         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
 636         [HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
 637         [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
 638         [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
 639         [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
 640         [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 641         [HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
 642         [HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 643         [HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
 644         [HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
 645 };
 646
 647 #if IS_REACHABLE(CONFIG_VIRTIO)
 648
 649 /* MAC80211_HWSIM virtio queues */
 650 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
 651 static bool hwsim_virtio_enabled;
 652 static spinlock_t hwsim_virtio_lock;
 653
 654 static void hwsim_virtio_rx_work(struct work_struct *work);
 655 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
 656
 657 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 658                            struct sk_buff *skb)
 659 {
 660         struct scatterlist sg[1];
 661         unsigned long flags;
 662         int err;
 663
 664         spin_lock_irqsave(&hwsim_virtio_lock, flags);
 665         if (!hwsim_virtio_enabled) {
 666                 err = -ENODEV;
 667                 goto out_free;
 668         }
 669
 670         sg_init_one(sg, skb->head, skb_end_offset(skb));
 671         err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
 672                                    GFP_ATOMIC);
 673         if (err)
 674                 goto out_free;
 675         virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
 676         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 677         return 0;
 678
 679 out_free:
 680         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 681         nlmsg_free(skb);
 682         return err;
 683 }
 684 #else
 685 /* cause a linker error if this ends up being needed */
 686 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 687                            struct sk_buff *skb);
 688 #define hwsim_virtio_enabled false
 689 #endif
 690
 691 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 692                                     struct sk_buff *skb,
 693                                     struct ieee80211_channel *chan);
 694
 695 /* sysfs attributes */
 696 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
 697 {
 698         struct mac80211_hwsim_data *data = dat;
 699         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 700         struct sk_buff *skb;
 701         struct ieee80211_pspoll *pspoll;
 702
 703         if (!vp->assoc)
 704                 return;
 705
 706         wiphy_dbg(data->hw->wiphy,
 707                   "%s: send PS-Poll to %pM for aid %d\n",
 708                   __func__, vp->bssid, vp->aid);
 709
 710         skb = dev_alloc_skb(sizeof(*pspoll));
 711         if (!skb)
 712                 return;
 713         pspoll = skb_put(skb, sizeof(*pspoll));
 714         pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
 715                                             IEEE80211_STYPE_PSPOLL |
 716                                             IEEE80211_FCTL_PM);
 717         pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
 718         memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
 719         memcpy(pspoll->ta, mac, ETH_ALEN);
 720
 721         rcu_read_lock();
 722         mac80211_hwsim_tx_frame(data->hw, skb,
 723                                 rcu_dereference(vif->chanctx_conf)->def.chan);
 724         rcu_read_unlock();
 725 }
 726
 727 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
 728                                 struct ieee80211_vif *vif, int ps)
 729 {
 730         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 731         struct sk_buff *skb;
 732         struct ieee80211_hdr *hdr;
 733
 734         if (!vp->assoc)
 735                 return;
 736
 737         wiphy_dbg(data->hw->wiphy,
 738                   "%s: send data::nullfunc to %pM ps=%d\n",
 739                   __func__, vp->bssid, ps);
 740
 741         skb = dev_alloc_skb(sizeof(*hdr));
 742         if (!skb)
 743                 return;
 744         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
 745         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
 746                                          IEEE80211_STYPE_NULLFUNC |
 747                                          IEEE80211_FCTL_TODS |
 748                                          (ps ? IEEE80211_FCTL_PM : 0));
 749         hdr->duration_id = cpu_to_le16(0);
 750         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
 751         memcpy(hdr->addr2, mac, ETH_ALEN);
 752         memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
 753
 754         rcu_read_lock();
 755         mac80211_hwsim_tx_frame(data->hw, skb,
 756                                 rcu_dereference(vif->chanctx_conf)->def.chan);
 757         rcu_read_unlock();
 758 }
 759
 760
 761 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
 762                                    struct ieee80211_vif *vif)
 763 {
 764         struct mac80211_hwsim_data *data = dat;
 765         hwsim_send_nullfunc(data, mac, vif, 1);
 766 }
 767
 768 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
 769                                       struct ieee80211_vif *vif)
 770 {
 771         struct mac80211_hwsim_data *data = dat;
 772         hwsim_send_nullfunc(data, mac, vif, 0);
 773 }
 774
 775 static int hwsim_fops_ps_read(void *dat, u64 *val)
 776 {
 777         struct mac80211_hwsim_data *data = dat;
 778         *val = data->ps;
 779         return 0;
 780 }
 781
 782 static int hwsim_fops_ps_write(void *dat, u64 val)
 783 {
 784         struct mac80211_hwsim_data *data = dat;
 785         enum ps_mode old_ps;
 786
 787         if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
 788             val != PS_MANUAL_POLL)
 789                 return -EINVAL;
 790
 791         if (val == PS_MANUAL_POLL) {
 792                 if (data->ps != PS_ENABLED)
 793                         return -EINVAL;
 794                 local_bh_disable();
 795                 ieee80211_iterate_active_interfaces_atomic(
 796                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 797                         hwsim_send_ps_poll, data);
 798                 local_bh_enable();
 799                 return 0;
 800         }
 801         old_ps = data->ps;
 802         data->ps = val;
 803
 804         local_bh_disable();
 805         if (old_ps == PS_DISABLED && val != PS_DISABLED) {
 806                 ieee80211_iterate_active_interfaces_atomic(
 807                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 808                         hwsim_send_nullfunc_ps, data);
 809         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
 810                 ieee80211_iterate_active_interfaces_atomic(
 811                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 812                         hwsim_send_nullfunc_no_ps, data);
 813         }
 814         local_bh_enable();
 815
 816         return 0;
 817 }
 818
 819 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
 820                          "%llu\n");
 821
 822 static int hwsim_write_simulate_radar(void *dat, u64 val)
 823 {
 824         struct mac80211_hwsim_data *data = dat;
 825
 826         ieee80211_radar_detected(data->hw);
 827
 828         return 0;
 829 }
 830
 831 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
 832                          hwsim_write_simulate_radar, "%llu\n");
 833
 834 static int hwsim_fops_group_read(void *dat, u64 *val)
 835 {
 836         struct mac80211_hwsim_data *data = dat;
 837         *val = data->group;
 838         return 0;
 839 }
 840
 841 static int hwsim_fops_group_write(void *dat, u64 val)
 842 {
 843         struct mac80211_hwsim_data *data = dat;
 844         data->group = val;
 845         return 0;
 846 }
 847
 848 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
 849                          hwsim_fops_group_read, hwsim_fops_group_write,
 850                          "%llx\n");
 851
 852 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
 853                                         struct net_device *dev)
 854 {
 855         /* TODO: allow packet injection */
 856         dev_kfree_skb(skb);
 857         return NETDEV_TX_OK;
 858 }
 859
 860 static inline u64 mac80211_hwsim_get_tsf_raw(void)
 861 {
 862         return ktime_to_us(ktime_get_real());
 863 }
 864
 865 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
 866 {
 867         u64 now = mac80211_hwsim_get_tsf_raw();
 868         return cpu_to_le64(now + data->tsf_offset);
 869 }
 870
 871 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
 872                                   struct ieee80211_vif *vif)
 873 {
 874         struct mac80211_hwsim_data *data = hw->priv;
 875         return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
 876 }
 877
 878 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
 879                 struct ieee80211_vif *vif, u64 tsf)
 880 {
 881         struct mac80211_hwsim_data *data = hw->priv;
 882         u64 now = mac80211_hwsim_get_tsf(hw, vif);
 883         u32 bcn_int = data->beacon_int;
 884         u64 delta = abs(tsf - now);
 885
 886         /* adjust after beaconing with new timestamp at old TBTT */
 887         if (tsf > now) {
 888                 data->tsf_offset += delta;
 889                 data->bcn_delta = do_div(delta, bcn_int);
 890         } else {
 891                 data->tsf_offset -= delta;
 892                 data->bcn_delta = -(s64)do_div(delta, bcn_int);
 893         }
 894 }
 895
 896 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
 897                                       struct sk_buff *tx_skb,
 898                                       struct ieee80211_channel *chan)
 899 {
 900         struct mac80211_hwsim_data *data = hw->priv;
 901         struct sk_buff *skb;
 902         struct hwsim_radiotap_hdr *hdr;
 903         u16 flags;
 904         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
 905         struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
 906
 907         if (WARN_ON(!txrate))
 908                 return;
 909
 910         if (!netif_running(hwsim_mon))
 911                 return;
 912
 913         skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
 914         if (skb == NULL)
 915                 return;
 916
 917         hdr = skb_push(skb, sizeof(*hdr));
 918         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
 919         hdr->hdr.it_pad = 0;
 920         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
 921         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
 922                                           (1 << IEEE80211_RADIOTAP_RATE) |
 923                                           (1 << IEEE80211_RADIOTAP_TSFT) |
 924                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
 925         hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
 926         hdr->rt_flags = 0;
 927         hdr->rt_rate = txrate->bitrate / 5;
 928         hdr->rt_channel = cpu_to_le16(chan->center_freq);
 929         flags = IEEE80211_CHAN_2GHZ;
 930         if (txrate->flags & IEEE80211_RATE_ERP_G)
 931                 flags |= IEEE80211_CHAN_OFDM;
 932         else
 933                 flags |= IEEE80211_CHAN_CCK;
 934         hdr->rt_chbitmask = cpu_to_le16(flags);
 935
 936         skb->dev = hwsim_mon;
 937         skb_reset_mac_header(skb);
 938         skb->ip_summed = CHECKSUM_UNNECESSARY;
 939         skb->pkt_type = PACKET_OTHERHOST;
 940         skb->protocol = htons(ETH_P_802_2);
 941         memset(skb->cb, 0, sizeof(skb->cb));
 942         netif_rx(skb);
 943 }
 944
 945
 946 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
 947                                        const u8 *addr)
 948 {
 949         struct sk_buff *skb;
 950         struct hwsim_radiotap_ack_hdr *hdr;
 951         u16 flags;
 952         struct ieee80211_hdr *hdr11;
 953
 954         if (!netif_running(hwsim_mon))
 955                 return;
 956
 957         skb = dev_alloc_skb(100);
 958         if (skb == NULL)
 959                 return;
 960
 961         hdr = skb_put(skb, sizeof(*hdr));
 962         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
 963         hdr->hdr.it_pad = 0;
 964         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
 965         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
 966                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
 967         hdr->rt_flags = 0;
 968         hdr->pad = 0;
 969         hdr->rt_channel = cpu_to_le16(chan->center_freq);
 970         flags = IEEE80211_CHAN_2GHZ;
 971         hdr->rt_chbitmask = cpu_to_le16(flags);
 972
 973         hdr11 = skb_put(skb, 10);
 974         hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
 975                                            IEEE80211_STYPE_ACK);
 976         hdr11->duration_id = cpu_to_le16(0);
 977         memcpy(hdr11->addr1, addr, ETH_ALEN);
 978
 979         skb->dev = hwsim_mon;
 980         skb_reset_mac_header(skb);
 981         skb->ip_summed = CHECKSUM_UNNECESSARY;
 982         skb->pkt_type = PACKET_OTHERHOST;
 983         skb->protocol = htons(ETH_P_802_2);
 984         memset(skb->cb, 0, sizeof(skb->cb));
 985         netif_rx(skb);
 986 }
 987
 988 struct mac80211_hwsim_addr_match_data {
 989         u8 addr[ETH_ALEN];
 990         bool ret;
 991 };
 992
 993 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
 994                                      struct ieee80211_vif *vif)
 995 {
 996         struct mac80211_hwsim_addr_match_data *md = data;
 997
 998         if (memcmp(mac, md->addr, ETH_ALEN) == 0)
 999                 md->ret = true;
1000 }
1001
1002 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1003                                       const u8 *addr)
1004 {
1005         struct mac80211_hwsim_addr_match_data md = {
1006                 .ret = false,
1007         };
1008
1009         if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1010                 return true;
1011
1012         memcpy(md.addr, addr, ETH_ALEN);
1013
1014         ieee80211_iterate_active_interfaces_atomic(data->hw,
1015                                                    IEEE80211_IFACE_ITER_NORMAL,
1016                                                    mac80211_hwsim_addr_iter,
1017                                                    &md);
1018
1019         return md.ret;
1020 }
1021
1022 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1023                            struct sk_buff *skb)
1024 {
1025         switch (data->ps) {
1026         case PS_DISABLED:
1027                 return true;
1028         case PS_ENABLED:
1029                 return false;
1030         case PS_AUTO_POLL:
1031                 /* TODO: accept (some) Beacons by default and other frames only
1032                  * if pending PS-Poll has been sent */
1033                 return true;
1034         case PS_MANUAL_POLL:
1035                 /* Allow unicast frames to own address if there is a pending
1036                  * PS-Poll */
1037                 if (data->ps_poll_pending &&
1038                     mac80211_hwsim_addr_match(data, skb->data + 4)) {
1039                         data->ps_poll_pending = false;
1040                         return true;
1041                 }
1042                 return false;
1043         }
1044
1045         return true;
1046 }
1047
1048 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1049                                   struct sk_buff *skb, int portid)
1050 {
1051         struct net *net;
1052         bool found = false;
1053         int res = -ENOENT;
1054
1055         rcu_read_lock();
1056         for_each_net_rcu(net) {
1057                 if (data->netgroup == hwsim_net_get_netgroup(net)) {
1058                         res = genlmsg_unicast(net, skb, portid);
1059                         found = true;
1060                         break;
1061                 }
1062         }
1063         rcu_read_unlock();
1064
1065         if (!found)
1066                 nlmsg_free(skb);
1067
1068         return res;
1069 }
1070
1071 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1072                                          const u8 *addr, bool add)
1073 {
1074         struct mac80211_hwsim_data *data = hw->priv;
1075         u32 _portid = READ_ONCE(data->wmediumd);
1076         struct sk_buff *skb;
1077         void *msg_head;
1078
1079         if (!_portid && !hwsim_virtio_enabled)
1080                 return;
1081
1082         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1083         if (!skb)
1084                 return;
1085
1086         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1087                                add ? HWSIM_CMD_ADD_MAC_ADDR :
1088                                      HWSIM_CMD_DEL_MAC_ADDR);
1089         if (!msg_head) {
1090                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1091                 goto nla_put_failure;
1092         }
1093
1094         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1095                     ETH_ALEN, data->addresses[1].addr))
1096                 goto nla_put_failure;
1097
1098         if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1099                 goto nla_put_failure;
1100
1101         genlmsg_end(skb, msg_head);
1102
1103         if (hwsim_virtio_enabled)
1104                 hwsim_tx_virtio(data, skb);
1105         else
1106                 hwsim_unicast_netgroup(data, skb, _portid);
1107         return;
1108 nla_put_failure:
1109         nlmsg_free(skb);
1110 }
1111
1112 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1113 {
1114         u16 result = 0;
1115
1116         if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1117                 result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1118         if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1119                 result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1120         if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1121                 result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1122         if (rate->flags & IEEE80211_TX_RC_MCS)
1123                 result |= MAC80211_HWSIM_TX_RC_MCS;
1124         if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1125                 result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1126         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1127                 result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1128         if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1129                 result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1130         if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1131                 result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1132         if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1133                 result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1134         if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1135                 result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1136         if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1137                 result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1138
1139         return result;
1140 }
1141
1142 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1143                                        struct sk_buff *my_skb,
1144                                        int dst_portid)
1145 {
1146         struct sk_buff *skb;
1147         struct mac80211_hwsim_data *data = hw->priv;
1148         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1149         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1150         void *msg_head;
1151         unsigned int hwsim_flags = 0;
1152         int i;
1153         struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1154         struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1155         uintptr_t cookie;
1156
1157         if (data->ps != PS_DISABLED)
1158                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1159         /* If the queue contains MAX_QUEUE skb's drop some */
1160         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1161                 /* Droping until WARN_QUEUE level */
1162                 while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1163                         ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1164                         data->tx_dropped++;
1165                 }
1166         }
1167
1168         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1169         if (skb == NULL)
1170                 goto nla_put_failure;
1171
1172         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1173                                HWSIM_CMD_FRAME);
1174         if (msg_head == NULL) {
1175                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1176                 goto nla_put_failure;
1177         }
1178
1179         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1180                     ETH_ALEN, data->addresses[1].addr))
1181                 goto nla_put_failure;
1182
1183         /* We get the skb->data */
1184         if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1185                 goto nla_put_failure;
1186
1187         /* We get the flags for this transmission, and we translate them to
1188            wmediumd flags  */
1189
1190         if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1191                 hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1192
1193         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1194                 hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1195
1196         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1197                 goto nla_put_failure;
1198
1199         if (nla_put_u32(skb, HWSIM_ATTR_FREQ, data->channel->center_freq))
1200                 goto nla_put_failure;
1201
1202         /* We get the tx control (rate and retries) info*/
1203
1204         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1205                 tx_attempts[i].idx = info->status.rates[i].idx;
1206                 tx_attempts_flags[i].idx = info->status.rates[i].idx;
1207                 tx_attempts[i].count = info->status.rates[i].count;
1208                 tx_attempts_flags[i].flags =
1209                                 trans_tx_rate_flags_ieee2hwsim(
1210                                                 &info->status.rates[i]);
1211         }
1212
1213         if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1214                     sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1215                     tx_attempts))
1216                 goto nla_put_failure;
1217
1218         if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1219                     sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1220                     tx_attempts_flags))
1221                 goto nla_put_failure;
1222
1223         /* We create a cookie to identify this skb */
1224         data->pending_cookie++;
1225         cookie = data->pending_cookie;
1226         info->rate_driver_data[0] = (void *)cookie;
1227         if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1228                 goto nla_put_failure;
1229
1230         genlmsg_end(skb, msg_head);
1231
1232         if (hwsim_virtio_enabled) {
1233                 if (hwsim_tx_virtio(data, skb))
1234                         goto err_free_txskb;
1235         } else {
1236                 if (hwsim_unicast_netgroup(data, skb, dst_portid))
1237                         goto err_free_txskb;
1238         }
1239
1240         /* Enqueue the packet */
1241         skb_queue_tail(&data->pending, my_skb);
1242         data->tx_pkts++;
1243         data->tx_bytes += my_skb->len;
1244         return;
1245
1246 nla_put_failure:
1247         nlmsg_free(skb);
1248 err_free_txskb:
1249         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1250         ieee80211_free_txskb(hw, my_skb);
1251         data->tx_failed++;
1252 }
1253
1254 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1255                                struct ieee80211_channel *c2)
1256 {
1257         if (!c1 || !c2)
1258                 return false;
1259
1260         return c1->center_freq == c2->center_freq;
1261 }
1262
1263 struct tx_iter_data {
1264         struct ieee80211_channel *channel;
1265         bool receive;
1266 };
1267
1268 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1269                                    struct ieee80211_vif *vif)
1270 {
1271         struct tx_iter_data *data = _data;
1272
1273         if (!vif->chanctx_conf)
1274                 return;
1275
1276         if (!hwsim_chans_compat(data->channel,
1277                                 rcu_dereference(vif->chanctx_conf)->def.chan))
1278                 return;
1279
1280         data->receive = true;
1281 }
1282
1283 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1284 {
1285         /*
1286          * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1287          * e.g. like this:
1288          * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1289          * (but you should use a valid OUI, not that)
1290          *
1291          * If anyone wants to 'donate' a radiotap OUI/subns code
1292          * please send a patch removing this #ifdef and changing
1293          * the values accordingly.
1294          */
1295 #ifdef HWSIM_RADIOTAP_OUI
1296         struct ieee80211_vendor_radiotap *rtap;
1297
1298         /*
1299          * Note that this code requires the headroom in the SKB
1300          * that was allocated earlier.
1301          */
1302         rtap = skb_push(skb, sizeof(*rtap) + 8 + 4);
1303         rtap->oui[0] = HWSIM_RADIOTAP_OUI[0];
1304         rtap->oui[1] = HWSIM_RADIOTAP_OUI[1];
1305         rtap->oui[2] = HWSIM_RADIOTAP_OUI[2];
1306         rtap->subns = 127;
1307
1308         /*
1309          * Radiotap vendor namespaces can (and should) also be
1310          * split into fields by using the standard radiotap
1311          * presence bitmap mechanism. Use just BIT(0) here for
1312          * the presence bitmap.
1313          */
1314         rtap->present = BIT(0);
1315         /* We have 8 bytes of (dummy) data */
1316         rtap->len = 8;
1317         /* For testing, also require it to be aligned */
1318         rtap->align = 8;
1319         /* And also test that padding works, 4 bytes */
1320         rtap->pad = 4;
1321         /* push the data */
1322         memcpy(rtap->data, "ABCDEFGH", 8);
1323         /* make sure to clear padding, mac80211 doesn't */
1324         memset(rtap->data + 8, 0, 4);
1325
1326         IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
1327 #endif
1328 }
1329
1330 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1331                                           struct sk_buff *skb,
1332                                           struct ieee80211_channel *chan)
1333 {
1334         struct mac80211_hwsim_data *data = hw->priv, *data2;
1335         bool ack = false;
1336         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1337         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1338         struct ieee80211_rx_status rx_status;
1339         u64 now;
1340
1341         memset(&rx_status, 0, sizeof(rx_status));
1342         rx_status.flag |= RX_FLAG_MACTIME_START;
1343         rx_status.freq = chan->center_freq;
1344         rx_status.band = chan->band;
1345         if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1346                 rx_status.rate_idx =
1347                         ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1348                 rx_status.nss =
1349                         ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1350                 rx_status.encoding = RX_ENC_VHT;
1351         } else {
1352                 rx_status.rate_idx = info->control.rates[0].idx;
1353                 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1354                         rx_status.encoding = RX_ENC_HT;
1355         }
1356         if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1357                 rx_status.bw = RATE_INFO_BW_40;
1358         else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1359                 rx_status.bw = RATE_INFO_BW_80;
1360         else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1361                 rx_status.bw = RATE_INFO_BW_160;
1362         else
1363                 rx_status.bw = RATE_INFO_BW_20;
1364         if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1365                 rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1366         /* TODO: simulate real signal strength (and optional packet loss) */
1367         rx_status.signal = -50;
1368         if (info->control.vif)
1369                 rx_status.signal += info->control.vif->bss_conf.txpower;
1370
1371         if (data->ps != PS_DISABLED)
1372                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1373
1374         /* release the skb's source info */
1375         skb_orphan(skb);
1376         skb_dst_drop(skb);
1377         skb->mark = 0;
1378         skb_ext_reset(skb);
1379         nf_reset_ct(skb);
1380
1381         /*
1382          * Get absolute mactime here so all HWs RX at the "same time", and
1383          * absolute TX time for beacon mactime so the timestamp matches.
1384          * Giving beacons a different mactime than non-beacons looks messy, but
1385          * it helps the Toffset be exact and a ~10us mactime discrepancy
1386          * probably doesn't really matter.
1387          */
1388         if (ieee80211_is_beacon(hdr->frame_control) ||
1389             ieee80211_is_probe_resp(hdr->frame_control)) {
1390                 rx_status.boottime_ns = ktime_get_boottime_ns();
1391                 now = data->abs_bcn_ts;
1392         } else {
1393                 now = mac80211_hwsim_get_tsf_raw();
1394         }
1395
1396         /* Copy skb to all enabled radios that are on the current frequency */
1397         spin_lock(&hwsim_radio_lock);
1398         list_for_each_entry(data2, &hwsim_radios, list) {
1399                 struct sk_buff *nskb;
1400                 struct tx_iter_data tx_iter_data = {
1401                         .receive = false,
1402                         .channel = chan,
1403                 };
1404
1405                 if (data == data2)
1406                         continue;
1407
1408                 if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1409                     !hwsim_ps_rx_ok(data2, skb))
1410                         continue;
1411
1412                 if (!(data->group & data2->group))
1413                         continue;
1414
1415                 if (data->netgroup != data2->netgroup)
1416                         continue;
1417
1418                 if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1419                     !hwsim_chans_compat(chan, data2->channel)) {
1420                         ieee80211_iterate_active_interfaces_atomic(
1421                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1422                                 mac80211_hwsim_tx_iter, &tx_iter_data);
1423                         if (!tx_iter_data.receive)
1424                                 continue;
1425                 }
1426
1427                 /*
1428                  * reserve some space for our vendor and the normal
1429                  * radiotap header, since we're copying anyway
1430                  */
1431                 if (skb->len < PAGE_SIZE && paged_rx) {
1432                         struct page *page = alloc_page(GFP_ATOMIC);
1433
1434                         if (!page)
1435                                 continue;
1436
1437                         nskb = dev_alloc_skb(128);
1438                         if (!nskb) {
1439                                 __free_page(page);
1440                                 continue;
1441                         }
1442
1443                         memcpy(page_address(page), skb->data, skb->len);
1444                         skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1445                 } else {
1446                         nskb = skb_copy(skb, GFP_ATOMIC);
1447                         if (!nskb)
1448                                 continue;
1449                 }
1450
1451                 if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1452                         ack = true;
1453
1454                 rx_status.mactime = now + data2->tsf_offset;
1455
1456                 memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
1457
1458                 mac80211_hwsim_add_vendor_rtap(nskb);
1459
1460                 data2->rx_pkts++;
1461                 data2->rx_bytes += nskb->len;
1462                 ieee80211_rx_irqsafe(data2->hw, nskb);
1463         }
1464         spin_unlock(&hwsim_radio_lock);
1465
1466         return ack;
1467 }
1468
1469 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1470                               struct ieee80211_tx_control *control,
1471                               struct sk_buff *skb)
1472 {
1473         struct mac80211_hwsim_data *data = hw->priv;
1474         struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1475         struct ieee80211_hdr *hdr = (void *)skb->data;
1476         struct ieee80211_chanctx_conf *chanctx_conf;
1477         struct ieee80211_channel *channel;
1478         bool ack;
1479         u32 _portid;
1480
1481         if (WARN_ON(skb->len < 10)) {
1482                 /* Should not happen; just a sanity check for addr1 use */
1483                 ieee80211_free_txskb(hw, skb);
1484                 return;
1485         }
1486
1487         if (!data->use_chanctx) {
1488                 channel = data->channel;
1489         } else if (txi->hw_queue == 4) {
1490                 channel = data->tmp_chan;
1491         } else {
1492                 chanctx_conf = rcu_dereference(txi->control.vif->chanctx_conf);
1493                 if (chanctx_conf)
1494                         channel = chanctx_conf->def.chan;
1495                 else
1496                         channel = NULL;
1497         }
1498
1499         if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
1500                 ieee80211_free_txskb(hw, skb);
1501                 return;
1502         }
1503
1504         if (data->idle && !data->tmp_chan) {
1505                 wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
1506                 ieee80211_free_txskb(hw, skb);
1507                 return;
1508         }
1509
1510         if (txi->control.vif)
1511                 hwsim_check_magic(txi->control.vif);
1512         if (control->sta)
1513                 hwsim_check_sta_magic(control->sta);
1514
1515         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1516                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
1517                                        txi->control.rates,
1518                                        ARRAY_SIZE(txi->control.rates));
1519
1520         if (skb->len >= 24 + 8 &&
1521             ieee80211_is_probe_resp(hdr->frame_control)) {
1522                 /* fake header transmission time */
1523                 struct ieee80211_mgmt *mgmt;
1524                 struct ieee80211_rate *txrate;
1525                 u64 ts;
1526
1527                 mgmt = (struct ieee80211_mgmt *)skb->data;
1528                 txrate = ieee80211_get_tx_rate(hw, txi);
1529                 ts = mac80211_hwsim_get_tsf_raw();
1530                 mgmt->u.probe_resp.timestamp =
1531                         cpu_to_le64(ts + data->tsf_offset +
1532                                     24 * 8 * 10 / txrate->bitrate);
1533         }
1534
1535         mac80211_hwsim_monitor_rx(hw, skb, channel);
1536
1537         /* wmediumd mode check */
1538         _portid = READ_ONCE(data->wmediumd);
1539
1540         if (_portid || hwsim_virtio_enabled)
1541                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid);
1542
1543         /* NO wmediumd detected, perfect medium simulation */
1544         data->tx_pkts++;
1545         data->tx_bytes += skb->len;
1546         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
1547
1548         if (ack && skb->len >= 16)
1549                 mac80211_hwsim_monitor_ack(channel, hdr->addr2);
1550
1551         ieee80211_tx_info_clear_status(txi);
1552
1553         /* frame was transmitted at most favorable rate at first attempt */
1554         txi->control.rates[0].count = 1;
1555         txi->control.rates[1].idx = -1;
1556
1557         if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
1558                 txi->flags |= IEEE80211_TX_STAT_ACK;
1559         ieee80211_tx_status_irqsafe(hw, skb);
1560 }
1561
1562
1563 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
1564 {
1565         struct mac80211_hwsim_data *data = hw->priv;
1566         wiphy_dbg(hw->wiphy, "%s\n", __func__);
1567         data->started = true;
1568         return 0;
1569 }
1570
1571
1572 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
1573 {
1574         struct mac80211_hwsim_data *data = hw->priv;
1575         data->started = false;
1576         hrtimer_cancel(&data->beacon_timer);
1577         wiphy_dbg(hw->wiphy, "%s\n", __func__);
1578 }
1579
1580
1581 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
1582                                         struct ieee80211_vif *vif)
1583 {
1584         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
1585                   __func__, ieee80211_vif_type_p2p(vif),
1586                   vif->addr);
1587         hwsim_set_magic(vif);
1588
1589         if (vif->type != NL80211_IFTYPE_MONITOR)
1590                 mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
1591
1592         vif->cab_queue = 0;
1593         vif->hw_queue[IEEE80211_AC_VO] = 0;
1594         vif->hw_queue[IEEE80211_AC_VI] = 1;
1595         vif->hw_queue[IEEE80211_AC_BE] = 2;
1596         vif->hw_queue[IEEE80211_AC_BK] = 3;
1597
1598         return 0;
1599 }
1600
1601
1602 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
1603                                            struct ieee80211_vif *vif,
1604                                            enum nl80211_iftype newtype,
1605                                            bool newp2p)
1606 {
1607         newtype = ieee80211_iftype_p2p(newtype, newp2p);
1608         wiphy_dbg(hw->wiphy,
1609                   "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
1610                   __func__, ieee80211_vif_type_p2p(vif),
1611                     newtype, vif->addr);
1612         hwsim_check_magic(vif);
1613
1614         /*
1615          * interface may change from non-AP to AP in
1616          * which case this needs to be set up again
1617          */
1618         vif->cab_queue = 0;
1619
1620         return 0;
1621 }
1622
1623 static void mac80211_hwsim_remove_interface(
1624         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
1625 {
1626         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
1627                   __func__, ieee80211_vif_type_p2p(vif),
1628                   vif->addr);
1629         hwsim_check_magic(vif);
1630         hwsim_clear_magic(vif);
1631         if (vif->type != NL80211_IFTYPE_MONITOR)
1632                 mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
1633 }
1634
1635 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
1636                                     struct sk_buff *skb,
1637                                     struct ieee80211_channel *chan)
1638 {
1639         struct mac80211_hwsim_data *data = hw->priv;
1640         u32 _pid = READ_ONCE(data->wmediumd);
1641
1642         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
1643                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1644                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
1645                                        txi->control.rates,
1646                                        ARRAY_SIZE(txi->control.rates));
1647         }
1648
1649         mac80211_hwsim_monitor_rx(hw, skb, chan);
1650
1651         if (_pid || hwsim_virtio_enabled)
1652                 return mac80211_hwsim_tx_frame_nl(hw, skb, _pid);
1653
1654         mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
1655         dev_kfree_skb(skb);
1656 }
1657
1658 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
1659                                      struct ieee80211_vif *vif)
1660 {
1661         struct mac80211_hwsim_data *data = arg;
1662         struct ieee80211_hw *hw = data->hw;
1663         struct ieee80211_tx_info *info;
1664         struct ieee80211_rate *txrate;
1665         struct ieee80211_mgmt *mgmt;
1666         struct sk_buff *skb;
1667
1668         hwsim_check_magic(vif);
1669
1670         if (vif->type != NL80211_IFTYPE_AP &&
1671             vif->type != NL80211_IFTYPE_MESH_POINT &&
1672             vif->type != NL80211_IFTYPE_ADHOC &&
1673             vif->type != NL80211_IFTYPE_OCB)
1674                 return;
1675
1676         skb = ieee80211_beacon_get(hw, vif);
1677         if (skb == NULL)
1678                 return;
1679         info = IEEE80211_SKB_CB(skb);
1680         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1681                 ieee80211_get_tx_rates(vif, NULL, skb,
1682                                        info->control.rates,
1683                                        ARRAY_SIZE(info->control.rates));
1684
1685         txrate = ieee80211_get_tx_rate(hw, info);
1686
1687         mgmt = (struct ieee80211_mgmt *) skb->data;
1688         /* fake header transmission time */
1689         data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
1690         mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
1691                                                data->tsf_offset +
1692                                                24 * 8 * 10 / txrate->bitrate);
1693
1694         mac80211_hwsim_tx_frame(hw, skb,
1695                                 rcu_dereference(vif->chanctx_conf)->def.chan);
1696
1697         while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
1698                 mac80211_hwsim_tx_frame(hw, skb,
1699                                 rcu_dereference(vif->chanctx_conf)->def.chan);
1700         }
1701
1702         if (vif->csa_active && ieee80211_csa_is_complete(vif))
1703                 ieee80211_csa_finish(vif);
1704 }
1705
1706 static enum hrtimer_restart
1707 mac80211_hwsim_beacon(struct hrtimer *timer)
1708 {
1709         struct mac80211_hwsim_data *data =
1710                 container_of(timer, struct mac80211_hwsim_data, beacon_timer);
1711         struct ieee80211_hw *hw = data->hw;
1712         u64 bcn_int = data->beacon_int;
1713
1714         if (!data->started)
1715                 return HRTIMER_NORESTART;
1716
1717         ieee80211_iterate_active_interfaces_atomic(
1718                 hw, IEEE80211_IFACE_ITER_NORMAL,
1719                 mac80211_hwsim_beacon_tx, data);
1720
1721         /* beacon at new TBTT + beacon interval */
1722         if (data->bcn_delta) {
1723                 bcn_int -= data->bcn_delta;
1724                 data->bcn_delta = 0;
1725         }
1726         hrtimer_forward(&data->beacon_timer, hrtimer_get_expires(timer),
1727                         ns_to_ktime(bcn_int * NSEC_PER_USEC));
1728         return HRTIMER_RESTART;
1729 }
1730
1731 static const char * const hwsim_chanwidths[] = {
1732         [NL80211_CHAN_WIDTH_5] = "ht5",
1733         [NL80211_CHAN_WIDTH_10] = "ht10",
1734         [NL80211_CHAN_WIDTH_20_NOHT] = "noht",
1735         [NL80211_CHAN_WIDTH_20] = "ht20",
1736         [NL80211_CHAN_WIDTH_40] = "ht40",
1737         [NL80211_CHAN_WIDTH_80] = "vht80",
1738         [NL80211_CHAN_WIDTH_80P80] = "vht80p80",
1739         [NL80211_CHAN_WIDTH_160] = "vht160",
1740 };
1741
1742 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
1743 {
1744         struct mac80211_hwsim_data *data = hw->priv;
1745         struct ieee80211_conf *conf = &hw->conf;
1746         static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
1747                 [IEEE80211_SMPS_AUTOMATIC] = "auto",
1748                 [IEEE80211_SMPS_OFF] = "off",
1749                 [IEEE80211_SMPS_STATIC] = "static",
1750                 [IEEE80211_SMPS_DYNAMIC] = "dynamic",
1751         };
1752         int idx;
1753
1754         if (conf->chandef.chan)
1755                 wiphy_dbg(hw->wiphy,
1756                           "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
1757                           __func__,
1758                           conf->chandef.chan->center_freq,
1759                           conf->chandef.center_freq1,
1760                           conf->chandef.center_freq2,
1761                           hwsim_chanwidths[conf->chandef.width],
1762                           !!(conf->flags & IEEE80211_CONF_IDLE),
1763                           !!(conf->flags & IEEE80211_CONF_PS),
1764                           smps_modes[conf->smps_mode]);
1765         else
1766                 wiphy_dbg(hw->wiphy,
1767                           "%s (freq=0 idle=%d ps=%d smps=%s)\n",
1768                           __func__,
1769                           !!(conf->flags & IEEE80211_CONF_IDLE),
1770                           !!(conf->flags & IEEE80211_CONF_PS),
1771                           smps_modes[conf->smps_mode]);
1772
1773         data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
1774
1775         WARN_ON(conf->chandef.chan && data->use_chanctx);
1776
1777         mutex_lock(&data->mutex);
1778         if (data->scanning && conf->chandef.chan) {
1779                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
1780                         if (data->survey_data[idx].channel == data->channel) {
1781                                 data->survey_data[idx].start =
1782                                         data->survey_data[idx].next_start;
1783                                 data->survey_data[idx].end = jiffies;
1784                                 break;
1785                         }
1786                 }
1787
1788                 data->channel = conf->chandef.chan;
1789
1790                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
1791                         if (data->survey_data[idx].channel &&
1792                             data->survey_data[idx].channel != data->channel)
1793                                 continue;
1794                         data->survey_data[idx].channel = data->channel;
1795                         data->survey_data[idx].next_start = jiffies;
1796                         break;
1797                 }
1798         } else {
1799                 data->channel = conf->chandef.chan;
1800         }
1801         mutex_unlock(&data->mutex);
1802
1803         if (!data->started || !data->beacon_int)
1804                 hrtimer_cancel(&data->beacon_timer);
1805         else if (!hrtimer_is_queued(&data->beacon_timer)) {
1806                 u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
1807                 u32 bcn_int = data->beacon_int;
1808                 u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
1809
1810                 hrtimer_start(&data->beacon_timer,
1811                               ns_to_ktime(until_tbtt * NSEC_PER_USEC),
1812                               HRTIMER_MODE_REL_SOFT);
1813         }
1814
1815         return 0;
1816 }
1817
1818
1819 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
1820                                             unsigned int changed_flags,
1821                                             unsigned int *total_flags,u64 multicast)
1822 {
1823         struct mac80211_hwsim_data *data = hw->priv;
1824
1825         wiphy_dbg(hw->wiphy, "%s\n", __func__);
1826
1827         data->rx_filter = 0;
1828         if (*total_flags & FIF_ALLMULTI)
1829                 data->rx_filter |= FIF_ALLMULTI;
1830         if (*total_flags & FIF_MCAST_ACTION)
1831                 data->rx_filter |= FIF_MCAST_ACTION;
1832
1833         *total_flags = data->rx_filter;
1834 }
1835
1836 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
1837                                        struct ieee80211_vif *vif)
1838 {
1839         unsigned int *count = data;
1840         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1841
1842         if (vp->bcn_en)
1843                 (*count)++;
1844 }
1845
1846 static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
1847                                             struct ieee80211_vif *vif,
1848                                             struct ieee80211_bss_conf *info,
1849                                             u32 changed)
1850 {
1851         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1852         struct mac80211_hwsim_data *data = hw->priv;
1853
1854         hwsim_check_magic(vif);
1855
1856         wiphy_dbg(hw->wiphy, "%s(changed=0x%x vif->addr=%pM)\n",
1857                   __func__, changed, vif->addr);
1858
1859         if (changed & BSS_CHANGED_BSSID) {
1860                 wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
1861                           __func__, info->bssid);
1862                 memcpy(vp->bssid, info->bssid, ETH_ALEN);
1863         }
1864
1865         if (changed & BSS_CHANGED_ASSOC) {
1866                 wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
1867                           info->assoc, info->aid);
1868                 vp->assoc = info->assoc;
1869                 vp->aid = info->aid;
1870         }
1871
1872         if (changed & BSS_CHANGED_BEACON_ENABLED) {
1873                 wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
1874                           info->enable_beacon, info->beacon_int);
1875                 vp->bcn_en = info->enable_beacon;
1876                 if (data->started &&
1877                     !hrtimer_is_queued(&data->beacon_timer) &&
1878                     info->enable_beacon) {
1879                         u64 tsf, until_tbtt;
1880                         u32 bcn_int;
1881                         data->beacon_int = info->beacon_int * 1024;
1882                         tsf = mac80211_hwsim_get_tsf(hw, vif);
1883                         bcn_int = data->beacon_int;
1884                         until_tbtt = bcn_int - do_div(tsf, bcn_int);
1885
1886                         hrtimer_start(&data->beacon_timer,
1887                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
1888                                       HRTIMER_MODE_REL_SOFT);
1889                 } else if (!info->enable_beacon) {
1890                         unsigned int count = 0;
1891                         ieee80211_iterate_active_interfaces_atomic(
1892                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
1893                                 mac80211_hwsim_bcn_en_iter, &count);
1894                         wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
1895                                   count);
1896                         if (count == 0) {
1897                                 hrtimer_cancel(&data->beacon_timer);
1898                                 data->beacon_int = 0;
1899                         }
1900                 }
1901         }
1902
1903         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
1904                 wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
1905                           info->use_cts_prot);
1906         }
1907
1908         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
1909                 wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
1910                           info->use_short_preamble);
1911         }
1912
1913         if (changed & BSS_CHANGED_ERP_SLOT) {
1914                 wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
1915         }
1916
1917         if (changed & BSS_CHANGED_HT) {
1918                 wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
1919                           info->ht_operation_mode);
1920         }
1921
1922         if (changed & BSS_CHANGED_BASIC_RATES) {
1923                 wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
1924                           (unsigned long long) info->basic_rates);
1925         }
1926
1927         if (changed & BSS_CHANGED_TXPOWER)
1928                 wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
1929 }
1930
1931 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
1932                                   struct ieee80211_vif *vif,
1933                                   struct ieee80211_sta *sta)
1934 {
1935         hwsim_check_magic(vif);
1936         hwsim_set_sta_magic(sta);
1937
1938         return 0;
1939 }
1940
1941 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
1942                                      struct ieee80211_vif *vif,
1943                                      struct ieee80211_sta *sta)
1944 {
1945         hwsim_check_magic(vif);
1946         hwsim_clear_sta_magic(sta);
1947
1948         return 0;
1949 }
1950
1951 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
1952                                       struct ieee80211_vif *vif,
1953                                       enum sta_notify_cmd cmd,
1954                                       struct ieee80211_sta *sta)
1955 {
1956         hwsim_check_magic(vif);
1957
1958         switch (cmd) {
1959         case STA_NOTIFY_SLEEP:
1960         case STA_NOTIFY_AWAKE:
1961                 /* TODO: make good use of these flags */
1962                 break;
1963         default:
1964                 WARN(1, "Invalid sta notify: %d\n", cmd);
1965                 break;
1966         }
1967 }
1968
1969 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
1970                                   struct ieee80211_sta *sta,
1971                                   bool set)
1972 {
1973         hwsim_check_sta_magic(sta);
1974         return 0;
1975 }
1976
1977 static int mac80211_hwsim_conf_tx(
1978         struct ieee80211_hw *hw,
1979         struct ieee80211_vif *vif, u16 queue,
1980         const struct ieee80211_tx_queue_params *params)
1981 {
1982         wiphy_dbg(hw->wiphy,
1983                   "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
1984                   __func__, queue,
1985                   params->txop, params->cw_min,
1986                   params->cw_max, params->aifs);
1987         return 0;
1988 }
1989
1990 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
1991                                      struct survey_info *survey)
1992 {
1993         struct mac80211_hwsim_data *hwsim = hw->priv;
1994
1995         if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
1996                 return -ENOENT;
1997
1998         mutex_lock(&hwsim->mutex);
1999         survey->channel = hwsim->survey_data[idx].channel;
2000         if (!survey->channel) {
2001                 mutex_unlock(&hwsim->mutex);
2002                 return -ENOENT;
2003         }
2004
2005         /*
2006          * Magically conjured dummy values --- this is only ok for simulated hardware.
2007          *
2008          * A real driver which cannot determine real values noise MUST NOT
2009          * report any, especially not a magically conjured ones :-)
2010          */
2011         survey->filled = SURVEY_INFO_NOISE_DBM |
2012                          SURVEY_INFO_TIME |
2013                          SURVEY_INFO_TIME_BUSY;
2014         survey->noise = -92;
2015         survey->time =
2016                 jiffies_to_msecs(hwsim->survey_data[idx].end -
2017                                  hwsim->survey_data[idx].start);
2018         /* report 12.5% of channel time is used */
2019         survey->time_busy = survey->time/8;
2020         mutex_unlock(&hwsim->mutex);
2021
2022         return 0;
2023 }
2024
2025 #ifdef CONFIG_NL80211_TESTMODE
2026 /*
2027  * This section contains example code for using netlink
2028  * attributes with the testmode command in nl80211.
2029  */
2030
2031 /* These enums need to be kept in sync with userspace */
2032 enum hwsim_testmode_attr {
2033         __HWSIM_TM_ATTR_INVALID = 0,
2034         HWSIM_TM_ATTR_CMD       = 1,
2035         HWSIM_TM_ATTR_PS        = 2,
2036
2037         /* keep last */
2038         __HWSIM_TM_ATTR_AFTER_LAST,
2039         HWSIM_TM_ATTR_MAX       = __HWSIM_TM_ATTR_AFTER_LAST - 1
2040 };
2041
2042 enum hwsim_testmode_cmd {
2043         HWSIM_TM_CMD_SET_PS             = 0,
2044         HWSIM_TM_CMD_GET_PS             = 1,
2045         HWSIM_TM_CMD_STOP_QUEUES        = 2,
2046         HWSIM_TM_CMD_WAKE_QUEUES        = 3,
2047 };
2048
2049 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2050         [HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2051         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2052 };
2053
2054 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2055                                        struct ieee80211_vif *vif,
2056                                        void *data, int len)
2057 {
2058         struct mac80211_hwsim_data *hwsim = hw->priv;
2059         struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2060         struct sk_buff *skb;
2061         int err, ps;
2062
2063         err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2064                                    hwsim_testmode_policy, NULL);
2065         if (err)
2066                 return err;
2067
2068         if (!tb[HWSIM_TM_ATTR_CMD])
2069                 return -EINVAL;
2070
2071         switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2072         case HWSIM_TM_CMD_SET_PS:
2073                 if (!tb[HWSIM_TM_ATTR_PS])
2074                         return -EINVAL;
2075                 ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2076                 return hwsim_fops_ps_write(hwsim, ps);
2077         case HWSIM_TM_CMD_GET_PS:
2078                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2079                                                 nla_total_size(sizeof(u32)));
2080                 if (!skb)
2081                         return -ENOMEM;
2082                 if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2083                         goto nla_put_failure;
2084                 return cfg80211_testmode_reply(skb);
2085         case HWSIM_TM_CMD_STOP_QUEUES:
2086                 ieee80211_stop_queues(hw);
2087                 return 0;
2088         case HWSIM_TM_CMD_WAKE_QUEUES:
2089                 ieee80211_wake_queues(hw);
2090                 return 0;
2091         default:
2092                 return -EOPNOTSUPP;
2093         }
2094
2095  nla_put_failure:
2096         kfree_skb(skb);
2097         return -ENOBUFS;
2098 }
2099 #endif
2100
2101 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2102                                        struct ieee80211_vif *vif,
2103                                        struct ieee80211_ampdu_params *params)
2104 {
2105         struct ieee80211_sta *sta = params->sta;
2106         enum ieee80211_ampdu_mlme_action action = params->action;
2107         u16 tid = params->tid;
2108
2109         switch (action) {
2110         case IEEE80211_AMPDU_TX_START:
2111                 return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2112         case IEEE80211_AMPDU_TX_STOP_CONT:
2113         case IEEE80211_AMPDU_TX_STOP_FLUSH:
2114         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2115                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2116                 break;
2117         case IEEE80211_AMPDU_TX_OPERATIONAL:
2118                 break;
2119         case IEEE80211_AMPDU_RX_START:
2120         case IEEE80211_AMPDU_RX_STOP:
2121                 break;
2122         default:
2123                 return -EOPNOTSUPP;
2124         }
2125
2126         return 0;
2127 }
2128
2129 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2130                                  struct ieee80211_vif *vif,
2131                                  u32 queues, bool drop)
2132 {
2133         /* Not implemented, queues only on kernel side */
2134 }
2135
2136 static void hw_scan_work(struct work_struct *work)
2137 {
2138         struct mac80211_hwsim_data *hwsim =
2139                 container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2140         struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2141         int dwell, i;
2142
2143         mutex_lock(&hwsim->mutex);
2144         if (hwsim->scan_chan_idx >= req->n_channels) {
2145                 struct cfg80211_scan_info info = {
2146                         .aborted = false,
2147                 };
2148
2149                 wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2150                 ieee80211_scan_completed(hwsim->hw, &info);
2151                 hwsim->hw_scan_request = NULL;
2152                 hwsim->hw_scan_vif = NULL;
2153                 hwsim->tmp_chan = NULL;
2154                 mutex_unlock(&hwsim->mutex);
2155                 mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2156                                              false);
2157                 return;
2158         }
2159
2160         wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2161                   req->channels[hwsim->scan_chan_idx]->center_freq);
2162
2163         hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2164         if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2165                                       IEEE80211_CHAN_RADAR) ||
2166             !req->n_ssids) {
2167                 dwell = 120;
2168         } else {
2169                 dwell = 30;
2170                 /* send probes */
2171                 for (i = 0; i < req->n_ssids; i++) {
2172                         struct sk_buff *probe;
2173                         struct ieee80211_mgmt *mgmt;
2174
2175                         probe = ieee80211_probereq_get(hwsim->hw,
2176                                                        hwsim->scan_addr,
2177                                                        req->ssids[i].ssid,
2178                                                        req->ssids[i].ssid_len,
2179                                                        req->ie_len);
2180                         if (!probe)
2181                                 continue;
2182
2183                         mgmt = (struct ieee80211_mgmt *) probe->data;
2184                         memcpy(mgmt->da, req->bssid, ETH_ALEN);
2185                         memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2186
2187                         if (req->ie_len)
2188                                 skb_put_data(probe, req->ie, req->ie_len);
2189
2190                         local_bh_disable();
2191                         mac80211_hwsim_tx_frame(hwsim->hw, probe,
2192                                                 hwsim->tmp_chan);
2193                         local_bh_enable();
2194                 }
2195         }
2196         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2197                                      msecs_to_jiffies(dwell));
2198         hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2199         hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2200         hwsim->survey_data[hwsim->scan_chan_idx].end =
2201                 jiffies + msecs_to_jiffies(dwell);
2202         hwsim->scan_chan_idx++;
2203         mutex_unlock(&hwsim->mutex);
2204 }
2205
2206 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2207                                   struct ieee80211_vif *vif,
2208                                   struct ieee80211_scan_request *hw_req)
2209 {
2210         struct mac80211_hwsim_data *hwsim = hw->priv;
2211         struct cfg80211_scan_request *req = &hw_req->req;
2212
2213         mutex_lock(&hwsim->mutex);
2214         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2215                 mutex_unlock(&hwsim->mutex);
2216                 return -EBUSY;
2217         }
2218         hwsim->hw_scan_request = req;
2219         hwsim->hw_scan_vif = vif;
2220         hwsim->scan_chan_idx = 0;
2221         if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2222                 get_random_mask_addr(hwsim->scan_addr,
2223                                      hw_req->req.mac_addr,
2224                                      hw_req->req.mac_addr_mask);
2225         else
2226                 memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
2227         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2228         mutex_unlock(&hwsim->mutex);
2229
2230         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2231         wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
2232
2233         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
2234
2235         return 0;
2236 }
2237
2238 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
2239                                           struct ieee80211_vif *vif)
2240 {
2241         struct mac80211_hwsim_data *hwsim = hw->priv;
2242         struct cfg80211_scan_info info = {
2243                 .aborted = true,
2244         };
2245
2246         wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
2247
2248         cancel_delayed_work_sync(&hwsim->hw_scan);
2249
2250         mutex_lock(&hwsim->mutex);
2251         ieee80211_scan_completed(hwsim->hw, &info);
2252         hwsim->tmp_chan = NULL;
2253         hwsim->hw_scan_request = NULL;
2254         hwsim->hw_scan_vif = NULL;
2255         mutex_unlock(&hwsim->mutex);
2256 }
2257
2258 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
2259                                    struct ieee80211_vif *vif,
2260                                    const u8 *mac_addr)
2261 {
2262         struct mac80211_hwsim_data *hwsim = hw->priv;
2263
2264         mutex_lock(&hwsim->mutex);
2265
2266         if (hwsim->scanning) {
2267                 pr_debug("two hwsim sw_scans detected!\n");
2268                 goto out;
2269         }
2270
2271         pr_debug("hwsim sw_scan request, prepping stuff\n");
2272
2273         memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
2274         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2275         hwsim->scanning = true;
2276         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2277
2278 out:
2279         mutex_unlock(&hwsim->mutex);
2280 }
2281
2282 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
2283                                             struct ieee80211_vif *vif)
2284 {
2285         struct mac80211_hwsim_data *hwsim = hw->priv;
2286
2287         mutex_lock(&hwsim->mutex);
2288
2289         pr_debug("hwsim sw_scan_complete\n");
2290         hwsim->scanning = false;
2291         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
2292         eth_zero_addr(hwsim->scan_addr);
2293
2294         mutex_unlock(&hwsim->mutex);
2295 }
2296
2297 static void hw_roc_start(struct work_struct *work)
2298 {
2299         struct mac80211_hwsim_data *hwsim =
2300                 container_of(work, struct mac80211_hwsim_data, roc_start.work);
2301
2302         mutex_lock(&hwsim->mutex);
2303
2304         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
2305         hwsim->tmp_chan = hwsim->roc_chan;
2306         ieee80211_ready_on_channel(hwsim->hw);
2307
2308         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
2309                                      msecs_to_jiffies(hwsim->roc_duration));
2310
2311         mutex_unlock(&hwsim->mutex);
2312 }
2313
2314 static void hw_roc_done(struct work_struct *work)
2315 {
2316         struct mac80211_hwsim_data *hwsim =
2317                 container_of(work, struct mac80211_hwsim_data, roc_done.work);
2318
2319         mutex_lock(&hwsim->mutex);
2320         ieee80211_remain_on_channel_expired(hwsim->hw);
2321         hwsim->tmp_chan = NULL;
2322         mutex_unlock(&hwsim->mutex);
2323
2324         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
2325 }
2326
2327 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
2328                               struct ieee80211_vif *vif,
2329                               struct ieee80211_channel *chan,
2330                               int duration,
2331                               enum ieee80211_roc_type type)
2332 {
2333         struct mac80211_hwsim_data *hwsim = hw->priv;
2334
2335         mutex_lock(&hwsim->mutex);
2336         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2337                 mutex_unlock(&hwsim->mutex);
2338                 return -EBUSY;
2339         }
2340
2341         hwsim->roc_chan = chan;
2342         hwsim->roc_duration = duration;
2343         mutex_unlock(&hwsim->mutex);
2344
2345         wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
2346                   chan->center_freq, duration);
2347         ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
2348
2349         return 0;
2350 }
2351
2352 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
2353                                struct ieee80211_vif *vif)
2354 {
2355         struct mac80211_hwsim_data *hwsim = hw->priv;
2356
2357         cancel_delayed_work_sync(&hwsim->roc_start);
2358         cancel_delayed_work_sync(&hwsim->roc_done);
2359
2360         mutex_lock(&hwsim->mutex);
2361         hwsim->tmp_chan = NULL;
2362         mutex_unlock(&hwsim->mutex);
2363
2364         wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
2365
2366         return 0;
2367 }
2368
2369 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
2370                                       struct ieee80211_chanctx_conf *ctx)
2371 {
2372         hwsim_set_chanctx_magic(ctx);
2373         wiphy_dbg(hw->wiphy,
2374                   "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2375                   ctx->def.chan->center_freq, ctx->def.width,
2376                   ctx->def.center_freq1, ctx->def.center_freq2);
2377         return 0;
2378 }
2379
2380 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
2381                                           struct ieee80211_chanctx_conf *ctx)
2382 {
2383         wiphy_dbg(hw->wiphy,
2384                   "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2385                   ctx->def.chan->center_freq, ctx->def.width,
2386                   ctx->def.center_freq1, ctx->def.center_freq2);
2387         hwsim_check_chanctx_magic(ctx);
2388         hwsim_clear_chanctx_magic(ctx);
2389 }
2390
2391 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
2392                                           struct ieee80211_chanctx_conf *ctx,
2393                                           u32 changed)
2394 {
2395         hwsim_check_chanctx_magic(ctx);
2396         wiphy_dbg(hw->wiphy,
2397                   "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2398                   ctx->def.chan->center_freq, ctx->def.width,
2399                   ctx->def.center_freq1, ctx->def.center_freq2);
2400 }
2401
2402 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
2403                                              struct ieee80211_vif *vif,
2404                                              struct ieee80211_chanctx_conf *ctx)
2405 {
2406         hwsim_check_magic(vif);
2407         hwsim_check_chanctx_magic(ctx);
2408
2409         return 0;
2410 }
2411
2412 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
2413                                                 struct ieee80211_vif *vif,
2414                                                 struct ieee80211_chanctx_conf *ctx)
2415 {
2416         hwsim_check_magic(vif);
2417         hwsim_check_chanctx_magic(ctx);
2418 }
2419
2420 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
2421         "tx_pkts_nic",
2422         "tx_bytes_nic",
2423         "rx_pkts_nic",
2424         "rx_bytes_nic",
2425         "d_tx_dropped",
2426         "d_tx_failed",
2427         "d_ps_mode",
2428         "d_group",
2429 };
2430
2431 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
2432
2433 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
2434                                           struct ieee80211_vif *vif,
2435                                           u32 sset, u8 *data)
2436 {
2437         if (sset == ETH_SS_STATS)
2438                 memcpy(data, *mac80211_hwsim_gstrings_stats,
2439                        sizeof(mac80211_hwsim_gstrings_stats));
2440 }
2441
2442 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
2443                                             struct ieee80211_vif *vif, int sset)
2444 {
2445         if (sset == ETH_SS_STATS)
2446                 return MAC80211_HWSIM_SSTATS_LEN;
2447         return 0;
2448 }
2449
2450 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
2451                                         struct ieee80211_vif *vif,
2452                                         struct ethtool_stats *stats, u64 *data)
2453 {
2454         struct mac80211_hwsim_data *ar = hw->priv;
2455         int i = 0;
2456
2457         data[i++] = ar->tx_pkts;
2458         data[i++] = ar->tx_bytes;
2459         data[i++] = ar->rx_pkts;
2460         data[i++] = ar->rx_bytes;
2461         data[i++] = ar->tx_dropped;
2462         data[i++] = ar->tx_failed;
2463         data[i++] = ar->ps;
2464         data[i++] = ar->group;
2465
2466         WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
2467 }
2468
2469 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
2470 {
2471         return 1;
2472 }
2473
2474 #define HWSIM_COMMON_OPS                                        \
2475         .tx = mac80211_hwsim_tx,                                \
2476         .start = mac80211_hwsim_start,                          \
2477         .stop = mac80211_hwsim_stop,                            \
2478         .add_interface = mac80211_hwsim_add_interface,          \
2479         .change_interface = mac80211_hwsim_change_interface,    \
2480         .remove_interface = mac80211_hwsim_remove_interface,    \
2481         .config = mac80211_hwsim_config,                        \
2482         .configure_filter = mac80211_hwsim_configure_filter,    \
2483         .bss_info_changed = mac80211_hwsim_bss_info_changed,    \
2484         .tx_last_beacon = mac80211_hwsim_tx_last_beacon,        \
2485         .sta_add = mac80211_hwsim_sta_add,                      \
2486         .sta_remove = mac80211_hwsim_sta_remove,                \
2487         .sta_notify = mac80211_hwsim_sta_notify,                \
2488         .set_tim = mac80211_hwsim_set_tim,                      \
2489         .conf_tx = mac80211_hwsim_conf_tx,                      \
2490         .get_survey = mac80211_hwsim_get_survey,                \
2491         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)      \
2492         .ampdu_action = mac80211_hwsim_ampdu_action,            \
2493         .flush = mac80211_hwsim_flush,                          \
2494         .get_tsf = mac80211_hwsim_get_tsf,                      \
2495         .set_tsf = mac80211_hwsim_set_tsf,                      \
2496         .get_et_sset_count = mac80211_hwsim_get_et_sset_count,  \
2497         .get_et_stats = mac80211_hwsim_get_et_stats,            \
2498         .get_et_strings = mac80211_hwsim_get_et_strings,
2499
2500 static const struct ieee80211_ops mac80211_hwsim_ops = {
2501         HWSIM_COMMON_OPS
2502         .sw_scan_start = mac80211_hwsim_sw_scan,
2503         .sw_scan_complete = mac80211_hwsim_sw_scan_complete,
2504 };
2505
2506 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
2507         HWSIM_COMMON_OPS
2508         .hw_scan = mac80211_hwsim_hw_scan,
2509         .cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,
2510         .sw_scan_start = NULL,
2511         .sw_scan_complete = NULL,
2512         .remain_on_channel = mac80211_hwsim_roc,
2513         .cancel_remain_on_channel = mac80211_hwsim_croc,
2514         .add_chanctx = mac80211_hwsim_add_chanctx,
2515         .remove_chanctx = mac80211_hwsim_remove_chanctx,
2516         .change_chanctx = mac80211_hwsim_change_chanctx,
2517         .assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,
2518         .unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx,
2519 };
2520
2521 struct hwsim_new_radio_params {
2522         unsigned int channels;
2523         const char *reg_alpha2;
2524         const struct ieee80211_regdomain *regd;
2525         bool reg_strict;
2526         bool p2p_device;
2527         bool use_chanctx;
2528         bool destroy_on_close;
2529         const char *hwname;
2530         bool no_vif;
2531         const u8 *perm_addr;
2532         u32 iftypes;
2533         u32 *ciphers;
2534         u8 n_ciphers;
2535 };
2536
2537 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
2538                                    struct genl_info *info)
2539 {
2540         if (info)
2541                 genl_notify(&hwsim_genl_family, mcast_skb, info,
2542                             HWSIM_MCGRP_CONFIG, GFP_KERNEL);
2543         else
2544                 genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
2545                                   HWSIM_MCGRP_CONFIG, GFP_KERNEL);
2546 }
2547
2548 static int append_radio_msg(struct sk_buff *skb, int id,
2549                             struct hwsim_new_radio_params *param)
2550 {
2551         int ret;
2552
2553         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
2554         if (ret < 0)
2555                 return ret;
2556
2557         if (param->channels) {
2558                 ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
2559                 if (ret < 0)
2560                         return ret;
2561         }
2562
2563         if (param->reg_alpha2) {
2564                 ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
2565                               param->reg_alpha2);
2566                 if (ret < 0)
2567                         return ret;
2568         }
2569
2570         if (param->regd) {
2571                 int i;
2572
2573                 for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
2574                         if (hwsim_world_regdom_custom[i] != param->regd)
2575                                 continue;
2576
2577                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
2578                         if (ret < 0)
2579                                 return ret;
2580                         break;
2581                 }
2582         }
2583
2584         if (param->reg_strict) {
2585                 ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
2586                 if (ret < 0)
2587                         return ret;
2588         }
2589
2590         if (param->p2p_device) {
2591                 ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
2592                 if (ret < 0)
2593                         return ret;
2594         }
2595
2596         if (param->use_chanctx) {
2597                 ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
2598                 if (ret < 0)
2599                         return ret;
2600         }
2601
2602         if (param->hwname) {
2603                 ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
2604                               strlen(param->hwname), param->hwname);
2605                 if (ret < 0)
2606                         return ret;
2607         }
2608
2609         return 0;
2610 }
2611
2612 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
2613                                   struct hwsim_new_radio_params *param)
2614 {
2615         struct sk_buff *mcast_skb;
2616         void *data;
2617
2618         mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
2619         if (!mcast_skb)
2620                 return;
2621
2622         data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
2623                            HWSIM_CMD_NEW_RADIO);
2624         if (!data)
2625                 goto out_err;
2626
2627         if (append_radio_msg(mcast_skb, id, param) < 0)
2628                 goto out_err;
2629
2630         genlmsg_end(mcast_skb, data);
2631
2632         hwsim_mcast_config_msg(mcast_skb, info);
2633         return;
2634
2635 out_err:
2636         nlmsg_free(mcast_skb);
2637 }
2638
2639 static const struct ieee80211_sband_iftype_data he_capa_2ghz[] = {
2640         {
2641                 /* TODO: should we support other types, e.g., P2P?*/
2642                 .types_mask = BIT(NL80211_IFTYPE_STATION) |
2643                               BIT(NL80211_IFTYPE_AP),
2644                 .he_cap = {
2645                         .has_he = true,
2646                         .he_cap_elem = {
2647                                 .mac_cap_info[0] =
2648                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
2649                                 .mac_cap_info[1] =
2650                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
2651                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2652                                 .mac_cap_info[2] =
2653                                         IEEE80211_HE_MAC_CAP2_BSR |
2654                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
2655                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
2656                                 .mac_cap_info[3] =
2657                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2658                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2659                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2660                                 .phy_cap_info[1] =
2661                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2662                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2663                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2664                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2665                                 .phy_cap_info[2] =
2666                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
2667                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
2668                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
2669                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
2670                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
2671
2672                                 /* Leave all the other PHY capability bytes
2673                                  * unset, as DCM, beam forming, RU and PPE
2674                                  * threshold information are not supported
2675                                  */
2676                         },
2677                         .he_mcs_nss_supp = {
2678                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
2679                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
2680                                 .rx_mcs_160 = cpu_to_le16(0xffff),
2681                                 .tx_mcs_160 = cpu_to_le16(0xffff),
2682                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
2683                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
2684                         },
2685                 },
2686         },
2687 #ifdef CONFIG_MAC80211_MESH
2688         {
2689                 /* TODO: should we support other types, e.g., IBSS?*/
2690                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
2691                 .he_cap = {
2692                         .has_he = true,
2693                         .he_cap_elem = {
2694                                 .mac_cap_info[0] =
2695                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
2696                                 .mac_cap_info[1] =
2697                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2698                                 .mac_cap_info[2] =
2699                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
2700                                 .mac_cap_info[3] =
2701                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2702                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2703                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2704                                 .phy_cap_info[1] =
2705                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2706                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2707                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2708                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2709                                 .phy_cap_info[2] = 0,
2710
2711                                 /* Leave all the other PHY capability bytes
2712                                  * unset, as DCM, beam forming, RU and PPE
2713                                  * threshold information are not supported
2714                                  */
2715                         },
2716                         .he_mcs_nss_supp = {
2717                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
2718                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
2719                                 .rx_mcs_160 = cpu_to_le16(0xffff),
2720                                 .tx_mcs_160 = cpu_to_le16(0xffff),
2721                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
2722                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
2723                         },
2724                 },
2725         },
2726 #endif
2727 };
2728
2729 static const struct ieee80211_sband_iftype_data he_capa_5ghz[] = {
2730         {
2731                 /* TODO: should we support other types, e.g., P2P?*/
2732                 .types_mask = BIT(NL80211_IFTYPE_STATION) |
2733                               BIT(NL80211_IFTYPE_AP),
2734                 .he_cap = {
2735                         .has_he = true,
2736                         .he_cap_elem = {
2737                                 .mac_cap_info[0] =
2738                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
2739                                 .mac_cap_info[1] =
2740                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
2741                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2742                                 .mac_cap_info[2] =
2743                                         IEEE80211_HE_MAC_CAP2_BSR |
2744                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
2745                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
2746                                 .mac_cap_info[3] =
2747                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2748                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2749                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2750                                 .phy_cap_info[0] =
2751                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
2752                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
2753                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
2754                                 .phy_cap_info[1] =
2755                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2756                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2757                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2758                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2759                                 .phy_cap_info[2] =
2760                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
2761                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
2762                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
2763                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
2764                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
2765
2766                                 /* Leave all the other PHY capability bytes
2767                                  * unset, as DCM, beam forming, RU and PPE
2768                                  * threshold information are not supported
2769                                  */
2770                         },
2771                         .he_mcs_nss_supp = {
2772                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
2773                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
2774                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
2775                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
2776                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
2777                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
2778                         },
2779                 },
2780         },
2781 #ifdef CONFIG_MAC80211_MESH
2782         {
2783                 /* TODO: should we support other types, e.g., IBSS?*/
2784                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
2785                 .he_cap = {
2786                         .has_he = true,
2787                         .he_cap_elem = {
2788                                 .mac_cap_info[0] =
2789                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
2790                                 .mac_cap_info[1] =
2791                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
2792                                 .mac_cap_info[2] =
2793                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
2794                                 .mac_cap_info[3] =
2795                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
2796                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2,
2797                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU,
2798                                 .phy_cap_info[0] =
2799                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
2800                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
2801                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
2802                                 .phy_cap_info[1] =
2803                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
2804                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
2805                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
2806                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
2807                                 .phy_cap_info[2] = 0,
2808
2809                                 /* Leave all the other PHY capability bytes
2810                                  * unset, as DCM, beam forming, RU and PPE
2811                                  * threshold information are not supported
2812                                  */
2813                         },
2814                         .he_mcs_nss_supp = {
2815                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
2816                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
2817                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
2818                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
2819                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
2820                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
2821                         },
2822                 },
2823         },
2824 #endif
2825 };
2826
2827 static void mac80211_hwsim_he_capab(struct ieee80211_supported_band *sband)
2828 {
2829         u16 n_iftype_data;
2830
2831         if (sband->band == NL80211_BAND_2GHZ) {
2832                 n_iftype_data = ARRAY_SIZE(he_capa_2ghz);
2833                 sband->iftype_data =
2834                         (struct ieee80211_sband_iftype_data *)he_capa_2ghz;
2835         } else if (sband->band == NL80211_BAND_5GHZ) {
2836                 n_iftype_data = ARRAY_SIZE(he_capa_5ghz);
2837                 sband->iftype_data =
2838                         (struct ieee80211_sband_iftype_data *)he_capa_5ghz;
2839         } else {
2840                 return;
2841         }
2842
2843         sband->n_iftype_data = n_iftype_data;
2844 }
2845
2846 #ifdef CONFIG_MAC80211_MESH
2847 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
2848 #else
2849 #define HWSIM_MESH_BIT 0
2850 #endif
2851
2852 #define HWSIM_DEFAULT_IF_LIMIT \
2853         (BIT(NL80211_IFTYPE_STATION) | \
2854          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
2855          BIT(NL80211_IFTYPE_AP) | \
2856          BIT(NL80211_IFTYPE_P2P_GO) | \
2857          HWSIM_MESH_BIT)
2858
2859 #define HWSIM_IFTYPE_SUPPORT_MASK \
2860         (BIT(NL80211_IFTYPE_STATION) | \
2861          BIT(NL80211_IFTYPE_AP) | \
2862          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
2863          BIT(NL80211_IFTYPE_P2P_GO) | \
2864          BIT(NL80211_IFTYPE_ADHOC) | \
2865          BIT(NL80211_IFTYPE_MESH_POINT) | \
2866          BIT(NL80211_IFTYPE_OCB))
2867
2868 static int mac80211_hwsim_new_radio(struct genl_info *info,
2869                                     struct hwsim_new_radio_params *param)
2870 {
2871         int err;
2872         u8 addr[ETH_ALEN];
2873         struct mac80211_hwsim_data *data;
2874         struct ieee80211_hw *hw;
2875         enum nl80211_band band;
2876         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
2877         struct net *net;
2878         int idx, i;
2879         int n_limits = 0;
2880
2881         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
2882                 return -EINVAL;
2883
2884         spin_lock_bh(&hwsim_radio_lock);
2885         idx = hwsim_radio_idx++;
2886         spin_unlock_bh(&hwsim_radio_lock);
2887
2888         if (param->use_chanctx)
2889                 ops = &mac80211_hwsim_mchan_ops;
2890         hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
2891         if (!hw) {
2892                 pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
2893                 err = -ENOMEM;
2894                 goto failed;
2895         }
2896
2897         /* ieee80211_alloc_hw_nm may have used a default name */
2898         param->hwname = wiphy_name(hw->wiphy);
2899
2900         if (info)
2901                 net = genl_info_net(info);
2902         else
2903                 net = &init_net;
2904         wiphy_net_set(hw->wiphy, net);
2905
2906         data = hw->priv;
2907         data->hw = hw;
2908
2909         data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
2910         if (IS_ERR(data->dev)) {
2911                 printk(KERN_DEBUG
2912                        "mac80211_hwsim: device_create failed (%ld)\n",
2913                        PTR_ERR(data->dev));
2914                 err = -ENOMEM;
2915                 goto failed_drvdata;
2916         }
2917         data->dev->driver = &mac80211_hwsim_driver.driver;
2918         err = device_bind_driver(data->dev);
2919         if (err != 0) {
2920                 pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
2921                        err);
2922                 goto failed_bind;
2923         }
2924
2925         skb_queue_head_init(&data->pending);
2926
2927         SET_IEEE80211_DEV(hw, data->dev);
2928         if (!param->perm_addr) {
2929                 eth_zero_addr(addr);
2930                 addr[0] = 0x02;
2931                 addr[3] = idx >> 8;
2932                 addr[4] = idx;
2933                 memcpy(data->addresses[0].addr, addr, ETH_ALEN);
2934                 /* Why need here second address ? */
2935                 memcpy(data->addresses[1].addr, addr, ETH_ALEN);
2936                 data->addresses[1].addr[0] |= 0x40;
2937                 hw->wiphy->n_addresses = 2;
2938                 hw->wiphy->addresses = data->addresses;
2939                 /* possible address clash is checked at hash table insertion */
2940         } else {
2941                 memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
2942                 /* compatibility with automatically generated mac addr */
2943                 memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
2944                 hw->wiphy->n_addresses = 2;
2945                 hw->wiphy->addresses = data->addresses;
2946         }
2947
2948         data->channels = param->channels;
2949         data->use_chanctx = param->use_chanctx;
2950         data->idx = idx;
2951         data->destroy_on_close = param->destroy_on_close;
2952         if (info)
2953                 data->portid = info->snd_portid;
2954
2955         /* setup interface limits, only on interface types we support */
2956         if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
2957                 data->if_limits[n_limits].max = 1;
2958                 data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
2959                 n_limits++;
2960         }
2961
2962         if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
2963                 data->if_limits[n_limits].max = 2048;
2964                 /*
2965                  * For this case, we may only support a subset of
2966                  * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
2967                  * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
2968                  */
2969                 data->if_limits[n_limits].types =
2970                                         HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
2971                 n_limits++;
2972         }
2973
2974         if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
2975                 data->if_limits[n_limits].max = 1;
2976                 data->if_limits[n_limits].types =
2977                                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
2978                 n_limits++;
2979         }
2980
2981         if (data->use_chanctx) {
2982                 hw->wiphy->max_scan_ssids = 255;
2983                 hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
2984                 hw->wiphy->max_remain_on_channel_duration = 1000;
2985                 data->if_combination.radar_detect_widths = 0;
2986                 data->if_combination.num_different_channels = data->channels;
2987         } else {
2988                 data->if_combination.num_different_channels = 1;
2989                 data->if_combination.radar_detect_widths =
2990                                         BIT(NL80211_CHAN_WIDTH_5) |
2991                                         BIT(NL80211_CHAN_WIDTH_10) |
2992                                         BIT(NL80211_CHAN_WIDTH_20_NOHT) |
2993                                         BIT(NL80211_CHAN_WIDTH_20) |
2994                                         BIT(NL80211_CHAN_WIDTH_40) |
2995                                         BIT(NL80211_CHAN_WIDTH_80) |
2996                                         BIT(NL80211_CHAN_WIDTH_160);
2997         }
2998
2999         if (!n_limits) {
3000                 err = -EINVAL;
3001                 goto failed_hw;
3002         }
3003
3004         data->if_combination.max_interfaces = 0;
3005         for (i = 0; i < n_limits; i++)
3006                 data->if_combination.max_interfaces +=
3007                         data->if_limits[i].max;
3008
3009         data->if_combination.n_limits = n_limits;
3010         data->if_combination.limits = data->if_limits;
3011
3012         /*
3013          * If we actually were asked to support combinations,
3014          * advertise them - if there's only a single thing like
3015          * only IBSS then don't advertise it as combinations.
3016          */
3017         if (data->if_combination.max_interfaces > 1) {
3018                 hw->wiphy->iface_combinations = &data->if_combination;
3019                 hw->wiphy->n_iface_combinations = 1;
3020         }
3021
3022         if (param->ciphers) {
3023                 memcpy(data->ciphers, param->ciphers,
3024                        param->n_ciphers * sizeof(u32));
3025                 hw->wiphy->cipher_suites = data->ciphers;
3026                 hw->wiphy->n_cipher_suites = param->n_ciphers;
3027         }
3028
3029         INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
3030         INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
3031         INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
3032
3033         hw->queues = 5;
3034         hw->offchannel_tx_hw_queue = 4;
3035
3036         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
3037         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
3038         ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
3039         ieee80211_hw_set(hw, QUEUE_CONTROL);
3040         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
3041         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
3042         ieee80211_hw_set(hw, MFP_CAPABLE);
3043         ieee80211_hw_set(hw, SIGNAL_DBM);
3044         ieee80211_hw_set(hw, SUPPORTS_PS);
3045         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
3046         ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
3047         ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
3048         ieee80211_hw_set(hw, TDLS_WIDER_BW);
3049         if (rctbl)
3050                 ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
3051         ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
3052
3053         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
3054         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
3055                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
3056                             WIPHY_FLAG_AP_UAPSD |
3057                             WIPHY_FLAG_SUPPORTS_5_10_MHZ |
3058                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
3059         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
3060                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
3061                                NL80211_FEATURE_STATIC_SMPS |
3062                                NL80211_FEATURE_DYNAMIC_SMPS |
3063                                NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
3064         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
3065         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
3066         wiphy_ext_feature_set(hw->wiphy,
3067                               NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
3068         wiphy_ext_feature_set(hw->wiphy,
3069                               NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
3070
3071         hw->wiphy->interface_modes = param->iftypes;
3072
3073         /* ask mac80211 to reserve space for magic */
3074         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
3075         hw->sta_data_size = sizeof(struct hwsim_sta_priv);
3076         hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
3077
3078         memcpy(data->channels_2ghz, hwsim_channels_2ghz,
3079                 sizeof(hwsim_channels_2ghz));
3080         memcpy(data->channels_5ghz, hwsim_channels_5ghz,
3081                 sizeof(hwsim_channels_5ghz));
3082         memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
3083
3084         for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
3085                 struct ieee80211_supported_band *sband = &data->bands[band];
3086
3087                 sband->band = band;
3088
3089                 switch (band) {
3090                 case NL80211_BAND_2GHZ:
3091                         sband->channels = data->channels_2ghz;
3092                         sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
3093                         sband->bitrates = data->rates;
3094                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
3095                         break;
3096                 case NL80211_BAND_5GHZ:
3097                         sband->channels = data->channels_5ghz;
3098                         sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
3099                         sband->bitrates = data->rates + 4;
3100                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
3101
3102                         sband->vht_cap.vht_supported = true;
3103                         sband->vht_cap.cap =
3104                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
3105                                 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
3106                                 IEEE80211_VHT_CAP_RXLDPC |
3107                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
3108                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
3109                                 IEEE80211_VHT_CAP_TXSTBC |
3110                                 IEEE80211_VHT_CAP_RXSTBC_4 |
3111                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
3112                         sband->vht_cap.vht_mcs.rx_mcs_map =
3113                                 cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
3114                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
3115                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
3116                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
3117                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
3118                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
3119                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
3120                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
3121                         sband->vht_cap.vht_mcs.tx_mcs_map =
3122                                 sband->vht_cap.vht_mcs.rx_mcs_map;
3123                         break;
3124                 default:
3125                         continue;
3126                 }
3127
3128                 sband->ht_cap.ht_supported = true;
3129                 sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
3130                                     IEEE80211_HT_CAP_GRN_FLD |
3131                                     IEEE80211_HT_CAP_SGI_20 |
3132                                     IEEE80211_HT_CAP_SGI_40 |
3133                                     IEEE80211_HT_CAP_DSSSCCK40;
3134                 sband->ht_cap.ampdu_factor = 0x3;
3135                 sband->ht_cap.ampdu_density = 0x6;
3136                 memset(&sband->ht_cap.mcs, 0,
3137                        sizeof(sband->ht_cap.mcs));
3138                 sband->ht_cap.mcs.rx_mask[0] = 0xff;
3139                 sband->ht_cap.mcs.rx_mask[1] = 0xff;
3140                 sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
3141
3142                 mac80211_hwsim_he_capab(sband);
3143
3144                 hw->wiphy->bands[band] = sband;
3145         }
3146
3147         /* By default all radios belong to the first group */
3148         data->group = 1;
3149         mutex_init(&data->mutex);
3150
3151         data->netgroup = hwsim_net_get_netgroup(net);
3152         data->wmediumd = hwsim_net_get_wmediumd(net);
3153
3154         /* Enable frame retransmissions for lossy channels */
3155         hw->max_rates = 4;
3156         hw->max_rate_tries = 11;
3157
3158         hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
3159         hw->wiphy->n_vendor_commands =
3160                 ARRAY_SIZE(mac80211_hwsim_vendor_commands);
3161         hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
3162         hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
3163
3164         if (param->reg_strict)
3165                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
3166         if (param->regd) {
3167                 data->regd = param->regd;
3168                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
3169                 wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
3170                 /* give the regulatory workqueue a chance to run */
3171                 schedule_timeout_interruptible(1);
3172         }
3173
3174         if (param->no_vif)
3175                 ieee80211_hw_set(hw, NO_AUTO_VIF);
3176
3177         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
3178
3179         hrtimer_init(&data->beacon_timer, CLOCK_MONOTONIC,
3180                      HRTIMER_MODE_ABS_SOFT);
3181         data->beacon_timer.function = mac80211_hwsim_beacon;
3182
3183         err = ieee80211_register_hw(hw);
3184         if (err < 0) {
3185                 pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
3186                        err);
3187                 goto failed_hw;
3188         }
3189
3190         wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
3191
3192         if (param->reg_alpha2) {
3193                 data->alpha2[0] = param->reg_alpha2[0];
3194                 data->alpha2[1] = param->reg_alpha2[1];
3195                 regulatory_hint(hw->wiphy, param->reg_alpha2);
3196         }
3197
3198         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
3199         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
3200         debugfs_create_file("group", 0666, data->debugfs, data,
3201                             &hwsim_fops_group);
3202         if (!data->use_chanctx)
3203                 debugfs_create_file("dfs_simulate_radar", 0222,
3204                                     data->debugfs,
3205                                     data, &hwsim_simulate_radar);
3206
3207         spin_lock_bh(&hwsim_radio_lock);
3208         err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
3209                                      hwsim_rht_params);
3210         if (err < 0) {
3211                 if (info) {
3212                         GENL_SET_ERR_MSG(info, "perm addr already present");
3213                         NL_SET_BAD_ATTR(info->extack,
3214                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
3215                 }
3216                 spin_unlock_bh(&hwsim_radio_lock);
3217                 goto failed_final_insert;
3218         }
3219
3220         list_add_tail(&data->list, &hwsim_radios);
3221         hwsim_radios_generation++;
3222         spin_unlock_bh(&hwsim_radio_lock);
3223
3224         hwsim_mcast_new_radio(idx, info, param);
3225
3226         return idx;
3227
3228 failed_final_insert:
3229         debugfs_remove_recursive(data->debugfs);
3230         ieee80211_unregister_hw(data->hw);
3231 failed_hw:
3232         device_release_driver(data->dev);
3233 failed_bind:
3234         device_unregister(data->dev);
3235 failed_drvdata:
3236         ieee80211_free_hw(hw);
3237 failed:
3238         return err;
3239 }
3240
3241 static void hwsim_mcast_del_radio(int id, const char *hwname,
3242                                   struct genl_info *info)
3243 {
3244         struct sk_buff *skb;
3245         void *data;
3246         int ret;
3247
3248         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3249         if (!skb)
3250                 return;
3251
3252         data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
3253                            HWSIM_CMD_DEL_RADIO);
3254         if (!data)
3255                 goto error;
3256
3257         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
3258         if (ret < 0)
3259                 goto error;
3260
3261         ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
3262                       hwname);
3263         if (ret < 0)
3264                 goto error;
3265
3266         genlmsg_end(skb, data);
3267
3268         hwsim_mcast_config_msg(skb, info);
3269
3270         return;
3271
3272 error:
3273         nlmsg_free(skb);
3274 }
3275
3276 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
3277                                      const char *hwname,
3278                                      struct genl_info *info)
3279 {
3280         hwsim_mcast_del_radio(data->idx, hwname, info);
3281         debugfs_remove_recursive(data->debugfs);
3282         ieee80211_unregister_hw(data->hw);
3283         device_release_driver(data->dev);
3284         device_unregister(data->dev);
3285         ieee80211_free_hw(data->hw);
3286 }
3287
3288 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
3289                                     struct mac80211_hwsim_data *data,
3290                                     u32 portid, u32 seq,
3291                                     struct netlink_callback *cb, int flags)
3292 {
3293         void *hdr;
3294         struct hwsim_new_radio_params param = { };
3295         int res = -EMSGSIZE;
3296
3297         hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
3298                           HWSIM_CMD_GET_RADIO);
3299         if (!hdr)
3300                 return -EMSGSIZE;
3301
3302         if (cb)
3303                 genl_dump_check_consistent(cb, hdr);
3304
3305         if (data->alpha2[0] && data->alpha2[1])
3306                 param.reg_alpha2 = data->alpha2;
3307
3308         param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
3309                                         REGULATORY_STRICT_REG);
3310         param.p2p_device = !!(data->hw->wiphy->interface_modes &
3311                                         BIT(NL80211_IFTYPE_P2P_DEVICE));
3312         param.use_chanctx = data->use_chanctx;
3313         param.regd = data->regd;
3314         param.channels = data->channels;
3315         param.hwname = wiphy_name(data->hw->wiphy);
3316
3317         res = append_radio_msg(skb, data->idx, &param);
3318         if (res < 0)
3319                 goto out_err;
3320
3321         genlmsg_end(skb, hdr);
3322         return 0;
3323
3324 out_err:
3325         genlmsg_cancel(skb, hdr);
3326         return res;
3327 }
3328
3329 static void mac80211_hwsim_free(void)
3330 {
3331         struct mac80211_hwsim_data *data;
3332
3333         spin_lock_bh(&hwsim_radio_lock);
3334         while ((data = list_first_entry_or_null(&hwsim_radios,
3335                                                 struct mac80211_hwsim_data,
3336                                                 list))) {
3337                 list_del(&data->list);
3338                 spin_unlock_bh(&hwsim_radio_lock);
3339                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
3340                                          NULL);
3341                 spin_lock_bh(&hwsim_radio_lock);
3342         }
3343         spin_unlock_bh(&hwsim_radio_lock);
3344         class_destroy(hwsim_class);
3345 }
3346
3347 static const struct net_device_ops hwsim_netdev_ops = {
3348         .ndo_start_xmit         = hwsim_mon_xmit,
3349         .ndo_set_mac_address    = eth_mac_addr,
3350         .ndo_validate_addr      = eth_validate_addr,
3351 };
3352
3353 static void hwsim_mon_setup(struct net_device *dev)
3354 {
3355         dev->netdev_ops = &hwsim_netdev_ops;
3356         dev->needs_free_netdev = true;
3357         ether_setup(dev);
3358         dev->priv_flags |= IFF_NO_QUEUE;
3359         dev->type = ARPHRD_IEEE80211_RADIOTAP;
3360         eth_zero_addr(dev->dev_addr);
3361         dev->dev_addr[0] = 0x12;
3362 }
3363
3364 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
3365 {
3366         return rhashtable_lookup_fast(&hwsim_radios_rht,
3367                                       addr,
3368                                       hwsim_rht_params);
3369 }
3370
3371 static void hwsim_register_wmediumd(struct net *net, u32 portid)
3372 {
3373         struct mac80211_hwsim_data *data;
3374
3375         hwsim_net_set_wmediumd(net, portid);
3376
3377         spin_lock_bh(&hwsim_radio_lock);
3378         list_for_each_entry(data, &hwsim_radios, list) {
3379                 if (data->netgroup == hwsim_net_get_netgroup(net))
3380                         data->wmediumd = portid;
3381         }
3382         spin_unlock_bh(&hwsim_radio_lock);
3383 }
3384
3385 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
3386                                            struct genl_info *info)
3387 {
3388
3389         struct ieee80211_hdr *hdr;
3390         struct mac80211_hwsim_data *data2;
3391         struct ieee80211_tx_info *txi;
3392         struct hwsim_tx_rate *tx_attempts;
3393         u64 ret_skb_cookie;
3394         struct sk_buff *skb, *tmp;
3395         const u8 *src;
3396         unsigned int hwsim_flags;
3397         int i;
3398         bool found = false;
3399
3400         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
3401             !info->attrs[HWSIM_ATTR_FLAGS] ||
3402             !info->attrs[HWSIM_ATTR_COOKIE] ||
3403             !info->attrs[HWSIM_ATTR_SIGNAL] ||
3404             !info->attrs[HWSIM_ATTR_TX_INFO])
3405                 goto out;
3406
3407         src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
3408         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
3409         ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
3410
3411         data2 = get_hwsim_data_ref_from_addr(src);
3412         if (!data2)
3413                 goto out;
3414
3415         if (!hwsim_virtio_enabled) {
3416                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
3417                     data2->netgroup)
3418                         goto out;
3419
3420                 if (info->snd_portid != data2->wmediumd)
3421                         goto out;
3422         }
3423
3424         /* look for the skb matching the cookie passed back from user */
3425         skb_queue_walk_safe(&data2->pending, skb, tmp) {
3426                 u64 skb_cookie;
3427
3428                 txi = IEEE80211_SKB_CB(skb);
3429                 skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0];
3430
3431                 if (skb_cookie == ret_skb_cookie) {
3432                         skb_unlink(skb, &data2->pending);
3433                         found = true;
3434                         break;
3435                 }
3436         }
3437
3438         /* not found */
3439         if (!found)
3440                 goto out;
3441
3442         /* Tx info received because the frame was broadcasted on user space,
3443          so we get all the necessary info: tx attempts and skb control buff */
3444
3445         tx_attempts = (struct hwsim_tx_rate *)nla_data(
3446                        info->attrs[HWSIM_ATTR_TX_INFO]);
3447
3448         /* now send back TX status */
3449         txi = IEEE80211_SKB_CB(skb);
3450
3451         ieee80211_tx_info_clear_status(txi);
3452
3453         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
3454                 txi->status.rates[i].idx = tx_attempts[i].idx;
3455                 txi->status.rates[i].count = tx_attempts[i].count;
3456         }
3457
3458         txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
3459
3460         if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
3461            (hwsim_flags & HWSIM_TX_STAT_ACK)) {
3462                 if (skb->len >= 16) {
3463                         hdr = (struct ieee80211_hdr *) skb->data;
3464                         mac80211_hwsim_monitor_ack(data2->channel,
3465                                                    hdr->addr2);
3466                 }
3467                 txi->flags |= IEEE80211_TX_STAT_ACK;
3468         }
3469         ieee80211_tx_status_irqsafe(data2->hw, skb);
3470         return 0;
3471 out:
3472         return -EINVAL;
3473
3474 }
3475
3476 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
3477                                           struct genl_info *info)
3478 {
3479         struct mac80211_hwsim_data *data2;
3480         struct ieee80211_rx_status rx_status;
3481         struct ieee80211_hdr *hdr;
3482         const u8 *dst;
3483         int frame_data_len;
3484         void *frame_data;
3485         struct sk_buff *skb = NULL;
3486
3487         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
3488             !info->attrs[HWSIM_ATTR_FRAME] ||
3489             !info->attrs[HWSIM_ATTR_RX_RATE] ||
3490             !info->attrs[HWSIM_ATTR_SIGNAL])
3491                 goto out;
3492
3493         dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
3494         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
3495         frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
3496
3497         /* Allocate new skb here */
3498         skb = alloc_skb(frame_data_len, GFP_KERNEL);
3499         if (skb == NULL)
3500                 goto err;
3501
3502         if (frame_data_len > IEEE80211_MAX_DATA_LEN)
3503                 goto err;
3504
3505         /* Copy the data */
3506         skb_put_data(skb, frame_data, frame_data_len);
3507
3508         data2 = get_hwsim_data_ref_from_addr(dst);
3509         if (!data2)
3510                 goto out;
3511
3512         if (!hwsim_virtio_enabled) {
3513                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
3514                     data2->netgroup)
3515                         goto out;
3516
3517                 if (info->snd_portid != data2->wmediumd)
3518                         goto out;
3519         }
3520
3521         /* check if radio is configured properly */
3522
3523         if (data2->idle || !data2->started)
3524                 goto out;
3525
3526         /* A frame is received from user space */
3527         memset(&rx_status, 0, sizeof(rx_status));
3528         if (info->attrs[HWSIM_ATTR_FREQ]) {
3529                 /* throw away off-channel packets, but allow both the temporary
3530                  * ("hw" scan/remain-on-channel) and regular channel, since the
3531                  * internal datapath also allows this
3532                  */
3533                 mutex_lock(&data2->mutex);
3534                 rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
3535
3536                 if (rx_status.freq != data2->channel->center_freq &&
3537                     (!data2->tmp_chan ||
3538                      rx_status.freq != data2->tmp_chan->center_freq)) {
3539                         mutex_unlock(&data2->mutex);
3540                         goto out;
3541                 }
3542                 mutex_unlock(&data2->mutex);
3543         } else {
3544                 rx_status.freq = data2->channel->center_freq;
3545         }
3546
3547         rx_status.band = data2->channel->band;
3548         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
3549         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
3550
3551         hdr = (void *)skb->data;
3552
3553         if (ieee80211_is_beacon(hdr->frame_control) ||
3554             ieee80211_is_probe_resp(hdr->frame_control))
3555                 rx_status.boottime_ns = ktime_get_boottime_ns();
3556
3557         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
3558         data2->rx_pkts++;
3559         data2->rx_bytes += skb->len;
3560         ieee80211_rx_irqsafe(data2->hw, skb);
3561
3562         return 0;
3563 err:
3564         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
3565 out:
3566         dev_kfree_skb(skb);
3567         return -EINVAL;
3568 }
3569
3570 static int hwsim_register_received_nl(struct sk_buff *skb_2,
3571                                       struct genl_info *info)
3572 {
3573         struct net *net = genl_info_net(info);
3574         struct mac80211_hwsim_data *data;
3575         int chans = 1;
3576
3577         spin_lock_bh(&hwsim_radio_lock);
3578         list_for_each_entry(data, &hwsim_radios, list)
3579                 chans = max(chans, data->channels);
3580         spin_unlock_bh(&hwsim_radio_lock);
3581
3582         /* In the future we should revise the userspace API and allow it
3583          * to set a flag that it does support multi-channel, then we can
3584          * let this pass conditionally on the flag.
3585          * For current userspace, prohibit it since it won't work right.
3586          */
3587         if (chans > 1)
3588                 return -EOPNOTSUPP;
3589
3590         if (hwsim_net_get_wmediumd(net))
3591                 return -EBUSY;
3592
3593         hwsim_register_wmediumd(net, info->snd_portid);
3594
3595         pr_debug("mac80211_hwsim: received a REGISTER, "
3596                "switching to wmediumd mode with pid %d\n", info->snd_portid);
3597
3598         return 0;
3599 }
3600
3601 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
3602 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
3603 {
3604         int i;
3605
3606         for (i = 0; i < n_ciphers; i++) {
3607                 int j;
3608                 int found = 0;
3609
3610                 for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
3611                         if (ciphers[i] == hwsim_ciphers[j]) {
3612                                 found = 1;
3613                                 break;
3614                         }
3615                 }
3616
3617                 if (!found)
3618                         return false;
3619         }
3620
3621         return true;
3622 }
3623
3624 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
3625 {
3626         struct hwsim_new_radio_params param = { 0 };
3627         const char *hwname = NULL;
3628         int ret;
3629
3630         param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
3631         param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
3632         param.channels = channels;
3633         param.destroy_on_close =
3634                 info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
3635
3636         if (info->attrs[HWSIM_ATTR_CHANNELS])
3637                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
3638
3639         if (param.channels < 1) {
3640                 GENL_SET_ERR_MSG(info, "must have at least one channel");
3641                 return -EINVAL;
3642         }
3643
3644         if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
3645                 GENL_SET_ERR_MSG(info, "too many channels specified");
3646                 return -EINVAL;
3647         }
3648
3649         if (info->attrs[HWSIM_ATTR_NO_VIF])
3650                 param.no_vif = true;
3651
3652         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
3653                 param.use_chanctx = true;
3654         else
3655                 param.use_chanctx = (param.channels > 1);
3656
3657         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
3658                 param.reg_alpha2 =
3659                         nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
3660
3661         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
3662                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
3663
3664                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
3665                         return -EINVAL;
3666
3667                 idx = array_index_nospec(idx,
3668                                          ARRAY_SIZE(hwsim_world_regdom_custom));
3669                 param.regd = hwsim_world_regdom_custom[idx];
3670         }
3671
3672         if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
3673                 if (!is_valid_ether_addr(
3674                                 nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
3675                         GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
3676                         NL_SET_BAD_ATTR(info->extack,
3677                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
3678                         return -EINVAL;
3679                 }
3680
3681                 param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
3682         }
3683
3684         if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
3685                 param.iftypes =
3686                         nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
3687
3688                 if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
3689                         NL_SET_ERR_MSG_ATTR(info->extack,
3690                                             info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
3691                                             "cannot support more iftypes than kernel");
3692                         return -EINVAL;
3693                 }
3694         } else {
3695                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
3696         }
3697
3698         /* ensure both flag and iftype support is honored */
3699         if (param.p2p_device ||
3700             param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
3701                 param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
3702                 param.p2p_device = true;
3703         }
3704
3705         if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
3706                 u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
3707
3708                 param.ciphers =
3709                         nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
3710
3711                 if (len % sizeof(u32)) {
3712                         NL_SET_ERR_MSG_ATTR(info->extack,
3713                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
3714                                             "bad cipher list length");
3715                         return -EINVAL;
3716                 }
3717
3718                 param.n_ciphers = len / sizeof(u32);
3719
3720                 if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
3721                         NL_SET_ERR_MSG_ATTR(info->extack,
3722                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
3723                                             "too many ciphers specified");
3724                         return -EINVAL;
3725                 }
3726
3727                 if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
3728                         NL_SET_ERR_MSG_ATTR(info->extack,
3729                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
3730                                             "unsupported ciphers specified");
3731                         return -EINVAL;
3732                 }
3733         }
3734
3735         if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
3736                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
3737                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
3738                                   GFP_KERNEL);
3739                 if (!hwname)
3740                         return -ENOMEM;
3741                 param.hwname = hwname;
3742         }
3743
3744         ret = mac80211_hwsim_new_radio(info, &param);
3745         kfree(hwname);
3746         return ret;
3747 }
3748
3749 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
3750 {
3751         struct mac80211_hwsim_data *data;
3752         s64 idx = -1;
3753         const char *hwname = NULL;
3754
3755         if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
3756                 idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
3757         } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
3758                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
3759                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
3760                                   GFP_KERNEL);
3761                 if (!hwname)
3762                         return -ENOMEM;
3763         } else
3764                 return -EINVAL;
3765
3766         spin_lock_bh(&hwsim_radio_lock);
3767         list_for_each_entry(data, &hwsim_radios, list) {
3768                 if (idx >= 0) {
3769                         if (data->idx != idx)
3770                                 continue;
3771                 } else {
3772                         if (!hwname ||
3773                             strcmp(hwname, wiphy_name(data->hw->wiphy)))
3774                                 continue;
3775                 }
3776
3777                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
3778                         continue;
3779
3780                 list_del(&data->list);
3781                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
3782                                        hwsim_rht_params);
3783                 hwsim_radios_generation++;
3784                 spin_unlock_bh(&hwsim_radio_lock);
3785                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
3786                                          info);
3787                 kfree(hwname);
3788                 return 0;
3789         }
3790         spin_unlock_bh(&hwsim_radio_lock);
3791
3792         kfree(hwname);
3793         return -ENODEV;
3794 }
3795
3796 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
3797 {
3798         struct mac80211_hwsim_data *data;
3799         struct sk_buff *skb;
3800         int idx, res = -ENODEV;
3801
3802         if (!info->attrs[HWSIM_ATTR_RADIO_ID])
3803                 return -EINVAL;
3804         idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
3805
3806         spin_lock_bh(&hwsim_radio_lock);
3807         list_for_each_entry(data, &hwsim_radios, list) {
3808                 if (data->idx != idx)
3809                         continue;
3810
3811                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
3812                         continue;
3813
3814                 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3815                 if (!skb) {
3816                         res = -ENOMEM;
3817                         goto out_err;
3818                 }
3819
3820                 res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
3821                                                info->snd_seq, NULL, 0);
3822                 if (res < 0) {
3823                         nlmsg_free(skb);
3824                         goto out_err;
3825                 }
3826
3827                 res = genlmsg_reply(skb, info);
3828                 break;
3829         }
3830
3831 out_err:
3832         spin_unlock_bh(&hwsim_radio_lock);
3833
3834         return res;
3835 }
3836
3837 static int hwsim_dump_radio_nl(struct sk_buff *skb,
3838                                struct netlink_callback *cb)
3839 {
3840         int last_idx = cb->args[0] - 1;
3841         struct mac80211_hwsim_data *data = NULL;
3842         int res = 0;
3843         void *hdr;
3844
3845         spin_lock_bh(&hwsim_radio_lock);
3846         cb->seq = hwsim_radios_generation;
3847
3848         if (last_idx >= hwsim_radio_idx-1)
3849                 goto done;
3850
3851         list_for_each_entry(data, &hwsim_radios, list) {
3852                 if (data->idx <= last_idx)
3853                         continue;
3854
3855                 if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
3856                         continue;
3857
3858                 res = mac80211_hwsim_get_radio(skb, data,
3859                                                NETLINK_CB(cb->skb).portid,
3860                                                cb->nlh->nlmsg_seq, cb,
3861                                                NLM_F_MULTI);
3862                 if (res < 0)
3863                         break;
3864
3865                 last_idx = data->idx;
3866         }
3867
3868         cb->args[0] = last_idx + 1;
3869
3870         /* list changed, but no new element sent, set interrupted flag */
3871         if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
3872                 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
3873                                   cb->nlh->nlmsg_seq, &hwsim_genl_family,
3874                                   NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
3875                 if (hdr) {
3876                         genl_dump_check_consistent(cb, hdr);
3877                         genlmsg_end(skb, hdr);
3878                 } else {
3879                         res = -EMSGSIZE;
3880                 }
3881         }
3882
3883 done:
3884         spin_unlock_bh(&hwsim_radio_lock);
3885         return res ?: skb->len;
3886 }
3887
3888 /* Generic Netlink operations array */
3889 static const struct genl_ops hwsim_ops[] = {
3890         {
3891                 .cmd = HWSIM_CMD_REGISTER,
3892                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3893                 .doit = hwsim_register_received_nl,
3894                 .flags = GENL_UNS_ADMIN_PERM,
3895         },
3896         {
3897                 .cmd = HWSIM_CMD_FRAME,
3898                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3899                 .doit = hwsim_cloned_frame_received_nl,
3900         },
3901         {
3902                 .cmd = HWSIM_CMD_TX_INFO_FRAME,
3903                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3904                 .doit = hwsim_tx_info_frame_received_nl,
3905         },
3906         {
3907                 .cmd = HWSIM_CMD_NEW_RADIO,
3908                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3909                 .doit = hwsim_new_radio_nl,
3910                 .flags = GENL_UNS_ADMIN_PERM,
3911         },
3912         {
3913                 .cmd = HWSIM_CMD_DEL_RADIO,
3914                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3915                 .doit = hwsim_del_radio_nl,
3916                 .flags = GENL_UNS_ADMIN_PERM,
3917         },
3918         {
3919                 .cmd = HWSIM_CMD_GET_RADIO,
3920                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3921                 .doit = hwsim_get_radio_nl,
3922                 .dumpit = hwsim_dump_radio_nl,
3923         },
3924 };
3925
3926 static struct genl_family hwsim_genl_family __ro_after_init = {
3927         .name = "MAC80211_HWSIM",
3928         .version = 1,
3929         .maxattr = HWSIM_ATTR_MAX,
3930         .policy = hwsim_genl_policy,
3931         .netnsok = true,
3932         .module = THIS_MODULE,
3933         .ops = hwsim_ops,
3934         .n_ops = ARRAY_SIZE(hwsim_ops),
3935         .mcgrps = hwsim_mcgrps,
3936         .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
3937 };
3938
3939 static void remove_user_radios(u32 portid)
3940 {
3941         struct mac80211_hwsim_data *entry, *tmp;
3942         LIST_HEAD(list);
3943
3944         spin_lock_bh(&hwsim_radio_lock);
3945         list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
3946                 if (entry->destroy_on_close && entry->portid == portid) {
3947                         list_move(&entry->list, &list);
3948                         rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
3949                                                hwsim_rht_params);
3950                         hwsim_radios_generation++;
3951                 }
3952         }
3953         spin_unlock_bh(&hwsim_radio_lock);
3954
3955         list_for_each_entry_safe(entry, tmp, &list, list) {
3956                 list_del(&entry->list);
3957                 mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
3958                                          NULL);
3959         }
3960 }
3961
3962 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
3963                                          unsigned long state,
3964                                          void *_notify)
3965 {
3966         struct netlink_notify *notify = _notify;
3967
3968         if (state != NETLINK_URELEASE)
3969                 return NOTIFY_DONE;
3970
3971         remove_user_radios(notify->portid);
3972
3973         if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
3974                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
3975                        " socket, switching to perfect channel medium\n");
3976                 hwsim_register_wmediumd(notify->net, 0);
3977         }
3978         return NOTIFY_DONE;
3979
3980 }
3981
3982 static struct notifier_block hwsim_netlink_notifier = {
3983         .notifier_call = mac80211_hwsim_netlink_notify,
3984 };
3985
3986 static int __init hwsim_init_netlink(void)
3987 {
3988         int rc;
3989
3990         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
3991
3992         rc = genl_register_family(&hwsim_genl_family);
3993         if (rc)
3994                 goto failure;
3995
3996         rc = netlink_register_notifier(&hwsim_netlink_notifier);
3997         if (rc) {
3998                 genl_unregister_family(&hwsim_genl_family);
3999                 goto failure;
4000         }
4001
4002         return 0;
4003
4004 failure:
4005         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
4006         return -EINVAL;
4007 }
4008
4009 static __net_init int hwsim_init_net(struct net *net)
4010 {
4011         return hwsim_net_set_netgroup(net);
4012 }
4013
4014 static void __net_exit hwsim_exit_net(struct net *net)
4015 {
4016         struct mac80211_hwsim_data *data, *tmp;
4017         LIST_HEAD(list);
4018
4019         spin_lock_bh(&hwsim_radio_lock);
4020         list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
4021                 if (!net_eq(wiphy_net(data->hw->wiphy), net))
4022                         continue;
4023
4024                 /* Radios created in init_net are returned to init_net. */
4025                 if (data->netgroup == hwsim_net_get_netgroup(&init_net))
4026                         continue;
4027
4028                 list_move(&data->list, &list);
4029                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
4030                                        hwsim_rht_params);
4031                 hwsim_radios_generation++;
4032         }
4033         spin_unlock_bh(&hwsim_radio_lock);
4034
4035         list_for_each_entry_safe(data, tmp, &list, list) {
4036                 list_del(&data->list);
4037                 mac80211_hwsim_del_radio(data,
4038                                          wiphy_name(data->hw->wiphy),
4039                                          NULL);
4040         }
4041
4042         ida_simple_remove(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
4043 }
4044
4045 static struct pernet_operations hwsim_net_ops = {
4046         .init = hwsim_init_net,
4047         .exit = hwsim_exit_net,
4048         .id   = &hwsim_net_id,
4049         .size = sizeof(struct hwsim_net),
4050 };
4051
4052 static void hwsim_exit_netlink(void)
4053 {
4054         /* unregister the notifier */
4055         netlink_unregister_notifier(&hwsim_netlink_notifier);
4056         /* unregister the family */
4057         genl_unregister_family(&hwsim_genl_family);
4058 }
4059
4060 #if IS_REACHABLE(CONFIG_VIRTIO)
4061 static void hwsim_virtio_tx_done(struct virtqueue *vq)
4062 {
4063         unsigned int len;
4064         struct sk_buff *skb;
4065         unsigned long flags;
4066
4067         spin_lock_irqsave(&hwsim_virtio_lock, flags);
4068         while ((skb = virtqueue_get_buf(vq, &len)))
4069                 nlmsg_free(skb);
4070         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
4071 }
4072
4073 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
4074 {
4075         struct nlmsghdr *nlh;
4076         struct genlmsghdr *gnlh;
4077         struct nlattr *tb[HWSIM_ATTR_MAX + 1];
4078         struct genl_info info = {};
4079         int err;
4080
4081         nlh = nlmsg_hdr(skb);
4082         gnlh = nlmsg_data(nlh);
4083         err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
4084                             hwsim_genl_policy, NULL);
4085         if (err) {
4086                 pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
4087                 return err;
4088         }
4089
4090         info.attrs = tb;
4091
4092         switch (gnlh->cmd) {
4093         case HWSIM_CMD_FRAME:
4094                 hwsim_cloned_frame_received_nl(skb, &info);
4095                 break;
4096         case HWSIM_CMD_TX_INFO_FRAME:
4097                 hwsim_tx_info_frame_received_nl(skb, &info);
4098                 break;
4099         default:
4100                 pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
4101                 return -EPROTO;
4102         }
4103         return 0;
4104 }
4105
4106 static void hwsim_virtio_rx_work(struct work_struct *work)
4107 {
4108         struct virtqueue *vq;
4109         unsigned int len;
4110         struct sk_buff *skb;
4111         struct scatterlist sg[1];
4112         int err;
4113         unsigned long flags;
4114
4115         spin_lock_irqsave(&hwsim_virtio_lock, flags);
4116         if (!hwsim_virtio_enabled)
4117                 goto out_unlock;
4118
4119         skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
4120         if (!skb)
4121                 goto out_unlock;
4122         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
4123
4124         skb->data = skb->head;
4125         skb_set_tail_pointer(skb, len);
4126         hwsim_virtio_handle_cmd(skb);
4127
4128         spin_lock_irqsave(&hwsim_virtio_lock, flags);
4129         if (!hwsim_virtio_enabled) {
4130                 nlmsg_free(skb);
4131                 goto out_unlock;
4132         }
4133         vq = hwsim_vqs[HWSIM_VQ_RX];
4134         sg_init_one(sg, skb->head, skb_end_offset(skb));
4135         err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
4136         if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
4137                 nlmsg_free(skb);
4138         else
4139                 virtqueue_kick(vq);
4140         schedule_work(&hwsim_virtio_rx);
4141
4142 out_unlock:
4143         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
4144 }
4145
4146 static void hwsim_virtio_rx_done(struct virtqueue *vq)
4147 {
4148         schedule_work(&hwsim_virtio_rx);
4149 }
4150
4151 static int init_vqs(struct virtio_device *vdev)
4152 {
4153         vq_callback_t *callbacks[HWSIM_NUM_VQS] = {
4154                 [HWSIM_VQ_TX] = hwsim_virtio_tx_done,
4155                 [HWSIM_VQ_RX] = hwsim_virtio_rx_done,
4156         };
4157         const char *names[HWSIM_NUM_VQS] = {
4158                 [HWSIM_VQ_TX] = "tx",
4159                 [HWSIM_VQ_RX] = "rx",
4160         };
4161
4162         return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
4163                                hwsim_vqs, callbacks, names, NULL);
4164 }
4165
4166 static int fill_vq(struct virtqueue *vq)
4167 {
4168         int i, err;
4169         struct sk_buff *skb;
4170         struct scatterlist sg[1];
4171
4172         for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
4173                 skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4174                 if (!skb)
4175                         return -ENOMEM;
4176
4177                 sg_init_one(sg, skb->head, skb_end_offset(skb));
4178                 err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
4179                 if (err) {
4180                         nlmsg_free(skb);
4181                         return err;
4182                 }
4183         }
4184         virtqueue_kick(vq);
4185         return 0;
4186 }
4187
4188 static void remove_vqs(struct virtio_device *vdev)
4189 {
4190         int i;
4191
4192         vdev->config->reset(vdev);
4193
4194         for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
4195                 struct virtqueue *vq = hwsim_vqs[i];
4196                 struct sk_buff *skb;
4197
4198                 while ((skb = virtqueue_detach_unused_buf(vq)))
4199                         nlmsg_free(skb);
4200         }
4201
4202         vdev->config->del_vqs(vdev);
4203 }
4204
4205 static int hwsim_virtio_probe(struct virtio_device *vdev)
4206 {
4207         int err;
4208         unsigned long flags;
4209
4210         spin_lock_irqsave(&hwsim_virtio_lock, flags);
4211         if (hwsim_virtio_enabled) {
4212                 spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
4213                 return -EEXIST;
4214         }
4215         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
4216
4217         err = init_vqs(vdev);
4218         if (err)
4219                 return err;
4220
4221         err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
4222         if (err)
4223                 goto out_remove;
4224
4225         spin_lock_irqsave(&hwsim_virtio_lock, flags);
4226         hwsim_virtio_enabled = true;
4227         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
4228
4229         schedule_work(&hwsim_virtio_rx);
4230         return 0;
4231
4232 out_remove:
4233         remove_vqs(vdev);
4234         return err;
4235 }
4236
4237 static void hwsim_virtio_remove(struct virtio_device *vdev)
4238 {
4239         hwsim_virtio_enabled = false;
4240
4241         cancel_work_sync(&hwsim_virtio_rx);
4242
4243         remove_vqs(vdev);
4244 }
4245
4246 /* MAC80211_HWSIM virtio device id table */
4247 static const struct virtio_device_id id_table[] = {
4248         { VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
4249         { 0 }
4250 };
4251 MODULE_DEVICE_TABLE(virtio, id_table);
4252
4253 static struct virtio_driver virtio_hwsim = {
4254         .driver.name = KBUILD_MODNAME,
4255         .driver.owner = THIS_MODULE,
4256         .id_table = id_table,
4257         .probe = hwsim_virtio_probe,
4258         .remove = hwsim_virtio_remove,
4259 };
4260
4261 static int hwsim_register_virtio_driver(void)
4262 {
4263         spin_lock_init(&hwsim_virtio_lock);
4264
4265         return register_virtio_driver(&virtio_hwsim);
4266 }
4267
4268 static void hwsim_unregister_virtio_driver(void)
4269 {
4270         unregister_virtio_driver(&virtio_hwsim);
4271 }
4272 #else
4273 static inline int hwsim_register_virtio_driver(void)
4274 {
4275         return 0;
4276 }
4277
4278 static inline void hwsim_unregister_virtio_driver(void)
4279 {
4280 }
4281 #endif
4282
4283 static int __init init_mac80211_hwsim(void)
4284 {
4285         int i, err;
4286
4287         if (radios < 0 || radios > 100)
4288                 return -EINVAL;
4289
4290         if (channels < 1)
4291                 return -EINVAL;
4292
4293         spin_lock_init(&hwsim_radio_lock);
4294
4295         err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
4296         if (err)
4297                 return err;
4298
4299         err = register_pernet_device(&hwsim_net_ops);
4300         if (err)
4301                 goto out_free_rht;
4302
4303         err = platform_driver_register(&mac80211_hwsim_driver);
4304         if (err)
4305                 goto out_unregister_pernet;
4306
4307         err = hwsim_init_netlink();
4308         if (err)
4309                 goto out_unregister_driver;
4310
4311         err = hwsim_register_virtio_driver();
4312         if (err)
4313                 goto out_exit_netlink;
4314
4315         hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
4316         if (IS_ERR(hwsim_class)) {
4317                 err = PTR_ERR(hwsim_class);
4318                 goto out_exit_virtio;
4319         }
4320
4321         for (i = 0; i < radios; i++) {
4322                 struct hwsim_new_radio_params param = { 0 };
4323
4324                 param.channels = channels;
4325
4326                 switch (regtest) {
4327                 case HWSIM_REGTEST_DIFF_COUNTRY:
4328                         if (i < ARRAY_SIZE(hwsim_alpha2s))
4329                                 param.reg_alpha2 = hwsim_alpha2s[i];
4330                         break;
4331                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
4332                         if (!i)
4333                                 param.reg_alpha2 = hwsim_alpha2s[0];
4334                         break;
4335                 case HWSIM_REGTEST_STRICT_ALL:
4336                         param.reg_strict = true;
4337                         /* fall through */
4338                 case HWSIM_REGTEST_DRIVER_REG_ALL:
4339                         param.reg_alpha2 = hwsim_alpha2s[0];
4340                         break;
4341                 case HWSIM_REGTEST_WORLD_ROAM:
4342                         if (i == 0)
4343                                 param.regd = &hwsim_world_regdom_custom_01;
4344                         break;
4345                 case HWSIM_REGTEST_CUSTOM_WORLD:
4346                         param.regd = &hwsim_world_regdom_custom_01;
4347                         break;
4348                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
4349                         if (i == 0)
4350                                 param.regd = &hwsim_world_regdom_custom_01;
4351                         else if (i == 1)
4352                                 param.regd = &hwsim_world_regdom_custom_02;
4353                         break;
4354                 case HWSIM_REGTEST_STRICT_FOLLOW:
4355                         if (i == 0) {
4356                                 param.reg_strict = true;
4357                                 param.reg_alpha2 = hwsim_alpha2s[0];
4358                         }
4359                         break;
4360                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
4361                         if (i == 0) {
4362                                 param.reg_strict = true;
4363                                 param.reg_alpha2 = hwsim_alpha2s[0];
4364                         } else if (i == 1) {
4365                                 param.reg_alpha2 = hwsim_alpha2s[1];
4366                         }
4367                         break;
4368                 case HWSIM_REGTEST_ALL:
4369                         switch (i) {
4370                         case 0:
4371                                 param.regd = &hwsim_world_regdom_custom_01;
4372                                 break;
4373                         case 1:
4374                                 param.regd = &hwsim_world_regdom_custom_02;
4375                                 break;
4376                         case 2:
4377                                 param.reg_alpha2 = hwsim_alpha2s[0];
4378                                 break;
4379                         case 3:
4380                                 param.reg_alpha2 = hwsim_alpha2s[1];
4381                                 break;
4382                         case 4:
4383                                 param.reg_strict = true;
4384                                 param.reg_alpha2 = hwsim_alpha2s[2];
4385                                 break;
4386                         }
4387                         break;
4388                 default:
4389                         break;
4390                 }
4391
4392                 param.p2p_device = support_p2p_device;
4393                 param.use_chanctx = channels > 1;
4394                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
4395                 if (param.p2p_device)
4396                         param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
4397
4398                 err = mac80211_hwsim_new_radio(NULL, &param);
4399                 if (err < 0)
4400                         goto out_free_radios;
4401         }
4402
4403         hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
4404                                  hwsim_mon_setup);
4405         if (hwsim_mon == NULL) {
4406                 err = -ENOMEM;
4407                 goto out_free_radios;
4408         }
4409
4410         rtnl_lock();
4411         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
4412         if (err < 0) {
4413                 rtnl_unlock();
4414                 goto out_free_mon;
4415         }
4416
4417         err = register_netdevice(hwsim_mon);
4418         if (err < 0) {
4419                 rtnl_unlock();
4420                 goto out_free_mon;
4421         }
4422         rtnl_unlock();
4423
4424         return 0;
4425
4426 out_free_mon:
4427         free_netdev(hwsim_mon);
4428 out_free_radios:
4429         mac80211_hwsim_free();
4430 out_exit_virtio:
4431         hwsim_unregister_virtio_driver();
4432 out_exit_netlink:
4433         hwsim_exit_netlink();
4434 out_unregister_driver:
4435         platform_driver_unregister(&mac80211_hwsim_driver);
4436 out_unregister_pernet:
4437         unregister_pernet_device(&hwsim_net_ops);
4438 out_free_rht:
4439         rhashtable_destroy(&hwsim_radios_rht);
4440         return err;
4441 }
4442 module_init(init_mac80211_hwsim);
4443
4444 static void __exit exit_mac80211_hwsim(void)
4445 {
4446         pr_debug("mac80211_hwsim: unregister radios\n");
4447
4448         hwsim_unregister_virtio_driver();
4449         hwsim_exit_netlink();
4450
4451         mac80211_hwsim_free();
4452
4453         rhashtable_destroy(&hwsim_radios_rht);
4454         unregister_netdev(hwsim_mon);
4455         platform_driver_unregister(&mac80211_hwsim_driver);
4456         unregister_pernet_device(&hwsim_net_ops);
4457 }
4458 module_exit(exit_mac80211_hwsim);