PMSR (a.k.a. peer measurement) is generalized measurement between two
devices with Wi-Fi support. And currently FTM (a.k.a. fine time
measurement or flight time measurement) is the one and only measurement.

Add necessary functionalities for mac80211_hwsim to abort previous PMSR
request. The abortion request is sent to the wmedium where the PMSR request
is actually handled.

In detail, add new mac80211_hwsim command HWSIM_CMD_ABORT_PMSR. When
mac80211_hwsim receives the PMSR abortion request via
ieee80211_ops.abort_pmsr, the received cfg80211_pmsr_request is resent to
the wmediumd with command HWSIM_CMD_ABORT_PMSR and attribute
HWSIM_ATTR_PMSR_REQUEST. The attribute is formatted as the same way as
nl80211_pmsr_start() expects.
Signed-off-by: NJaewan Kim <jaewan@google.com>
Link: https://lore.kernel.org/r/20230322131637.2633968-5-jaewan@google.comSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

PMSR (a.k.a. peer measurement) is generalized measurement between two
Wi-Fi devices. And currently FTM (a.k.a. fine time measurement or flight
time measurement) is the one and only measurement. FTM is measured by
RTT (a.k.a. round trip time) of packets between two Wi-Fi devices.

Add necessary functionalities for mac80211_hwsim to start PMSR request by
passthrough the request to wmediumd via virtio. mac80211_hwsim can't
measure RTT for real because mac80211_hwsim the software simulator and
packets are sent almost immediately for real. This change expect wmediumd
to have all the location information of devices, so passthrough requests
to wmediumd.

In detail, add new mac80211_hwsim command HWSIM_CMD_ABORT_PMSR. When
mac80211_hwsim receives the PMSR start request via
ieee80211_ops.start_pmsr, the received cfg80211_pmsr_request is resent to
the wmediumd with command HWSIM_CMD_START_PMSR and attribute
HWSIM_ATTR_PMSR_REQUEST. The attribute is formatted as the same way as
nl80211_pmsr_start() expects.
Signed-off-by: NJaewan Kim <jaewan@google.com>
Link: https://lore.kernel.org/r/20230322131637.2633968-4-jaewan@google.comSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

PMSR (a.k.a. peer measurement) is generalized measurement between two
Wi-Fi devices. And currently FTM (a.k.a. fine time measurement or flight
time measurement) is the one and only measurement. FTM is measured by
RTT (a.k.a. round trip time) of packets between two Wi-Fi devices.

Add necessary functionality to allow mac80211_hwsim to be configured with
PMSR capability. The capability is mandatory to accept incoming PMSR
request because nl80211_pmsr_start() ignores incoming the request without
the PMSR capability.

In detail, add new mac80211_hwsim attribute HWSIM_ATTR_PMSR_SUPPORT.
HWSIM_ATTR_PMSR_SUPPORT is used to set PMSR capability when creating a new
radio. To send extra capability details, HWSIM_ATTR_PMSR_SUPPORT can have
nested PMSR capability attributes defined in the nl80211.h. Data format is
the same as cfg80211_pmsr_capabilities.

If HWSIM_ATTR_PMSR_SUPPORT is specified, mac80211_hwsim builds
cfg80211_pmsr_capabilities and sets wiphy.pmsr_capa.
Signed-off-by: NJaewan Kim <jaewan@google.com>
Link: https://lore.kernel.org/r/20230322131637.2633968-2-jaewan@google.comSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

Add support enhanced multi-BSS advertisements (EMA)
for profile periodicity up to 3 beacons.
Signed-off-by: NAloka Dixit <quic_alokad@quicinc.com>
Link: https://lore.kernel.org/r/20221206005040.3177-5-quic_alokad@quicinc.comSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

Advertise multiple BSSID support for up to 8 interfaces.
Do not send beacons from the non-transmitting interfaces.
Signed-off-by: NAloka Dixit <quic_alokad@quicinc.com>
Link: https://lore.kernel.org/r/20221206005040.3177-4-quic_alokad@quicinc.comSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

Move the beacon transmission to a separate function to facilitate
addition of EMA beacon transmission.
Signed-off-by: NAloka Dixit <quic_alokad@quicinc.com>
Link: https://lore.kernel.org/r/20221206005040.3177-3-quic_alokad@quicinc.comSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

To clean up drivers/net/wireless move the virtual drivers to a new virtual
directory. I did consider adding CONFIG_WLAN_VENDOR_VIRTUAL like other vendors
have but then dropped the idea as we are not real drivers.

There should be no changes in compilation or in Kconfig options, merely moving
files. The order in menuconfig is slightly changed, the virtual drivers are now
last in the list.
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230227121732.8967-2-kvalo@kernel.org

To be able to use a general function later for any kind of
TLV, separate the vendor TLV header/content in the structs.
Signed-off-by: NMordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: NGregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230305124407.8ac5195bb3e6.I19ad99c1ad3108453aede64bddf6ef1a7c4a0b74@changeid
[separate from the original combined patch]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The new TLV format enables adding TLVs after the fixed
fields in radiotap, as part of the radiotap header.
Support this and move vendor data to the TLV format,
allowing a reuse of the RX_FLAG_RADIOTAP_VENDOR_DATA as
the new RX_FLAG_RADIOTAP_TLV_AT_END flag.
Signed-off-by: NMordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: NGregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230301115906.b18fd5da8477.I576400ec40a7b35ef97a3b09a99b3a49e9174786@changeidSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

mac80211_hwsim always uses the probe request coming from mac80211,
which has support for minimal probe request content.
Signed-off-by: NIlan Peer <ilan.peer@intel.com>
Signed-off-by: NGregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230301115906.67d31166ffd1.I908b68c5127525da3388c0d61a3d5d221ba451f6@changeidSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

It is a frequent mistake to confuse the netlink port identifier with a
process identifier.  Try to reduce this confusion by renaming
that hold port identifiers portid instead of pid.

This change replicates following commit:
  commit 15e47304 ("netlink: Rename pid to portid to avoid confusion")
Signed-off-by: NJaewan Kim <jaewan@google.com>
Link: https://lore.kernel.org/r/20230130022252.1514647-1-jaewan@google.comSigned-off-by: NJohannes Berg <johannes.berg@intel.com>

Fixes a warning that occurs when rc table support is enabled
(IEEE80211_HW_SUPPORTS_RC_TABLE) in mac80211_hwsim and the PS mode
is changed via the exported debugfs attribute.

When the PS mode is changed, a packet is broadcasted via
hwsim_send_nullfunc by creating and transmitting a plain skb with only
header initialized. The ieee80211 rate array in the control buffer is
zero-initialized. When ratetbl support is enabled, ieee80211_get_tx_rates
is called for the skb with sta parameter set to NULL and thus no
ratetbl can be used. The final rate array then looks like
[-1,0; 0,0; 0,0; 0,0] which causes the warning in ieee80211_get_tx_rate.

The issue is fixed by setting the count of the first rate with idx '0'
to 1 and hence ieee80211_get_tx_rates won't overwrite it with idx '-1'.
Signed-off-by: NJonas Jelonek <jelonek.jonas@gmail.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

mac80211 is fully switching over to the internal TX queue (iTXQ)
implementation. Update all drivers not yet providing the now mandatory
wake_tx_queue() callback.

As an side effect the netdev interfaces of all updated drivers will
switch to the noqueue qdisc.
Signed-off-by: NAlexander Wetzel <alexander@wetzel-home.de>
[add staging drivers]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

If the tool on the other side (e.g. wmediumd) gets confused
about the rate, we hit a warning in mac80211. Silence that
by effectively duplicating the check here and dropping the
frame silently (in mac80211 it's dropped with the warning).
Reported-by: NSönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: NSönke Huster <shuster@seemoo.tu-darmstadt.de>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

By default, even in client mode, hwsim always had all links
active, where it then uses them in a round-robin fashion.
Re-enable that by activating all valid links work right after
the connection is authorized.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Add macros (and an exported function) to allow checking some
link RCU protected accesses that are happening in callbacks
from mac80211 and are thus under the correct lock.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In hwsim we now track when we receive NDP (or other frames
carrying a PM bit) to see if a link should be active, but
then of course we also need to transmit NDPs to at least
set a link to inactive when we deacivate it. Implement that
as well as sending an NDP when we activate a link, which
allows receiving frames before transmitting any.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Track the powersave bit on frames where we can look up
the STA by link addresses and set the links active or
inactive accordingly, and use this information to TX
only on links that are actually active in the peer.

Note that this doesn't implement powersave fully so
if no link is active things will not work right.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

With the link activation handling in mac80211, skip
any inactive links on TX.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In netlink RX, now that we can actually have multiple
channel contexts for MLO, things don't work well as we
only keep a single pointer, and then on link switching
we might NULL it, and hit the return if the channel is
NULL.

However, we already use mac80211_hwsim_tx_iter() which
deals with all this, so remove the test and adjust the
remaining code a bit.

This then means we no longer use the chanctx pointer,
so remove it as well.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Catch the bugs fixed in mac80211 by the previous commits
and warn if an invalid address is added (or removed).
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Refactor some common RX functionality between the netlink
and non-netlink paths, adding the special hwsim TLV (if
compiled) also in the netlink path.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Just as an additional check that mac80211 isn't doing
anything strange, add a check of the STA magic (which
gets assigned when the station is added, and cleared
when the station is removed).
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Now that we have proper multicast TX in mac80211, there's
no longer a need to fake something here.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

An invalid packet with a length shorter than the specified length in the
netlink header can lead to use-after-frees and slab-out-of-bounds in the
processing of the netlink attributes, such as the following:

  BUG: KASAN: slab-out-of-bounds in __nla_validate_parse+0x1258/0x2010
  Read of size 2 at addr ffff88800ac7952c by task kworker/0:1/12

  Workqueue: events hwsim_virtio_rx_work
  Call Trace:
   <TASK>
   dump_stack_lvl+0x45/0x5d
   print_report.cold+0x5e/0x5e5
   kasan_report+0xb1/0x1c0
   __nla_validate_parse+0x1258/0x2010
   __nla_parse+0x22/0x30
   hwsim_virtio_handle_cmd.isra.0+0x13f/0x2d0
   hwsim_virtio_rx_work+0x1b2/0x370
   process_one_work+0x8df/0x1530
   worker_thread+0x575/0x11a0
   kthread+0x29d/0x340
   ret_from_fork+0x22/0x30
 </TASK>

Discarding packets with an invalid length solves this.
Therefore, skb->len must be set at reception.

Change-Id: Ieaeb9a4c62d3beede274881a7c2722c6c6f477b6
Signed-off-by: NSoenke Huster <soenke.huster@eknoes.de>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

We had historically not checked that genlmsghdr.reserved
is 0 on input which prevents us from using those precious
bytes in the future.

One use case would be to extend the cmd field, which is
currently just 8 bits wide and 256 is not a lot of commands
for some core families.

To make sure that new families do the right thing by default
put the onus of opting out of validation on existing families.
Signed-off-by: NJakub Kicinski <kuba@kernel.org>
Acked-by: Paul Moore <paul@paul-moore.com> (NetLabel)
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The code for determining which links to update in wmediumd
or virtio was wrong, fix it to remove the deflink only if
there were no old links, and also add the deflink if there
are no other new links.

Fixes: c204d9df ("wifi: mac80211_hwsim: handle links for wmediumd/virtio")
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The next patch will require splitting the data here into
AP and non-AP because for EHT, the format of the MCS/NSS
support (struct ieee80211_eht_mcs_nss_supp) is different,
for AP the only_20mhz cannot be used.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

For wmediumd/virtio, handle both the RX channel for links,
as well as the link addresses when links are added/removed.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

There are two issues here: we need to do the translation
even in case mac80211 selected a link, and we should only
translate the A3 if it's the BSSID. Fix both.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Now that we have a pointer to the TX STA even when it's
not authenticated/... yet, fix the TX link selection in
hwsim to select only among the valid links for the STA,
requiring a STA pointer here. Also implement a simple
round-robin between links to make life more interesting.

While at it, also consider A3 when translating to link
addresses.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Use the link ID provided in TX frame metadata to select the correct
channel. For now, always select the link with the lowest link ID and
do some address translation.
Signed-off-by: NAndrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Make mac80211_hwsim_sta_rc_update() iterate over all the STA links.

This is somewhat temporary, we really should add the link to the
API, but then hwsim still calls it internally and would need this.
Signed-off-by: NAndrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In MLO, we need to transmit to another MLD and select
the link to it, which requires knowing the station.
But in TX, mac80211 will not give us a station that's
not added to the driver, which in the older add/remove
API is only done later.

Implement the new API in MLO so we know about the STA
at all times and get a pointer during TX as well.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Since struct ieee80211_bss_conf already contains link_id,
passing link_id is not necessary.
Signed-off-by: NGregory Greenman <gregory.greenman@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Since mac80211 already has a protected pointer to link_conf,
pass it to the driver to avoid additional RCU locking.
Signed-off-by: NGregory Greenman <gregory.greenman@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Take the link into account in the QoS settings (EDCA parameters)
APIs.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Align the mac80211 implementation with P802.11be_D2.0.
Signed-off-by: NIlan Peer <ilan.peer@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Do address matching with link addresses as well.
Signed-off-by: NAndrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Since links can be added and removed dynamically, we need to
somehow protect the sdata->link[] and vif->link_conf[] array
pointers from disappearing when accessing them without locks.
RCU-ify the pointers to achieve this, which requires quite a
bit of rework.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>