drivers/net/wireless/virtual/mac80211_hwsim.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
   4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
   6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
   7  * Copyright (C) 2018 - 2023 Intel Corporation
   8  */
   9
  10 /*
  11  * TODO:
  12  * - Add TSF sync and fix IBSS beacon transmission by adding
  13  *   competition for "air time" at TBTT
  14  * - RX filtering based on filter configuration (data->rx_filter)
  15  */
  16
  17 #include <linux/list.h>
  18 #include <linux/slab.h>
  19 #include <linux/spinlock.h>
  20 #include <net/dst.h>
  21 #include <net/xfrm.h>
  22 #include <net/mac80211.h>
  23 #include <net/ieee80211_radiotap.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/rtnetlink.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/platform_device.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/module.h>
  30 #include <linux/ktime.h>
  31 #include <net/genetlink.h>
  32 #include <net/net_namespace.h>
  33 #include <net/netns/generic.h>
  34 #include <linux/rhashtable.h>
  35 #include <linux/nospec.h>
  36 #include <linux/virtio.h>
  37 #include <linux/virtio_ids.h>
  38 #include <linux/virtio_config.h>
  39 #include "mac80211_hwsim.h"
  40
  41 #define WARN_QUEUE 100
  42 #define MAX_QUEUE 200
  43
  44 MODULE_AUTHOR("Jouni Malinen");
  45 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
  46 MODULE_LICENSE("GPL");
  47
  48 static int radios = 2;
  49 module_param(radios, int, 0444);
  50 MODULE_PARM_DESC(radios, "Number of simulated radios");
  51
  52 static int channels = 1;
  53 module_param(channels, int, 0444);
  54 MODULE_PARM_DESC(channels, "Number of concurrent channels");
  55
  56 static bool paged_rx = false;
  57 module_param(paged_rx, bool, 0644);
  58 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
  59
  60 static bool rctbl = false;
  61 module_param(rctbl, bool, 0444);
  62 MODULE_PARM_DESC(rctbl, "Handle rate control table");
  63
  64 static bool support_p2p_device = true;
  65 module_param(support_p2p_device, bool, 0444);
  66 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
  67
  68 static bool mlo;
  69 module_param(mlo, bool, 0444);
  70 MODULE_PARM_DESC(mlo, "Support MLO");
  71
  72 /**
  73  * enum hwsim_regtest - the type of regulatory tests we offer
  74  *
  75  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
  76  *      this is the default value.
  77  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
  78  *      hint, only one driver regulatory hint will be sent as such the
  79  *      secondary radios are expected to follow.
  80  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
  81  *      request with all radios reporting the same regulatory domain.
  82  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
  83  *      different regulatory domains requests. Expected behaviour is for
  84  *      an intersection to occur but each device will still use their
  85  *      respective regulatory requested domains. Subsequent radios will
  86  *      use the resulting intersection.
  87  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
  88  *      this by using a custom beacon-capable regulatory domain for the first
  89  *      radio. All other device world roam.
  90  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
  91  *      domain requests. All radios will adhere to this custom world regulatory
  92  *      domain.
  93  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
  94  *      domain requests. The first radio will adhere to the first custom world
  95  *      regulatory domain, the second one to the second custom world regulatory
  96  *      domain. All other devices will world roam.
  97  * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
  98  *      settings, only the first radio will send a regulatory domain request
  99  *      and use strict settings. The rest of the radios are expected to follow.
 100  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
 101  *      settings. All radios will adhere to this.
 102  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
 103  *      domain settings, combined with secondary driver regulatory domain
 104  *      settings. The first radio will get a strict regulatory domain setting
 105  *      using the first driver regulatory request and the second radio will use
 106  *      non-strict settings using the second driver regulatory request. All
 107  *      other devices should follow the intersection created between the
 108  *      first two.
 109  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
 110  *      at least 6 radios for a complete test. We will test in this order:
 111  *      1 - driver custom world regulatory domain
 112  *      2 - second custom world regulatory domain
 113  *      3 - first driver regulatory domain request
 114  *      4 - second driver regulatory domain request
 115  *      5 - strict regulatory domain settings using the third driver regulatory
 116  *          domain request
 117  *      6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
 118  *                 regulatory requests.
 119  *
 120  * These are the different values you can use for the regtest
 121  * module parameter. This is useful to help test world roaming
 122  * and the driver regulatory_hint() call and combinations of these.
 123  * If you want to do specific alpha2 regulatory domain tests simply
 124  * use the userspace regulatory request as that will be respected as
 125  * well without the need of this module parameter. This is designed
 126  * only for testing the driver regulatory request, world roaming
 127  * and all possible combinations.
 128  */
 129 enum hwsim_regtest {
 130         HWSIM_REGTEST_DISABLED = 0,
 131         HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
 132         HWSIM_REGTEST_DRIVER_REG_ALL = 2,
 133         HWSIM_REGTEST_DIFF_COUNTRY = 3,
 134         HWSIM_REGTEST_WORLD_ROAM = 4,
 135         HWSIM_REGTEST_CUSTOM_WORLD = 5,
 136         HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
 137         HWSIM_REGTEST_STRICT_FOLLOW = 7,
 138         HWSIM_REGTEST_STRICT_ALL = 8,
 139         HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
 140         HWSIM_REGTEST_ALL = 10,
 141 };
 142
 143 /* Set to one of the HWSIM_REGTEST_* values above */
 144 static int regtest = HWSIM_REGTEST_DISABLED;
 145 module_param(regtest, int, 0444);
 146 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
 147
 148 static const char *hwsim_alpha2s[] = {
 149         "FI",
 150         "AL",
 151         "US",
 152         "DE",
 153         "JP",
 154         "AL",
 155 };
 156
 157 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
 158         .n_reg_rules = 5,
 159         .alpha2 =  "99",
 160         .reg_rules = {
 161                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 162                 REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
 163                 REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
 164                 REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
 165                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 166         }
 167 };
 168
 169 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
 170         .n_reg_rules = 3,
 171         .alpha2 =  "99",
 172         .reg_rules = {
 173                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 174                 REG_RULE(5725-10, 5850+10, 40, 0, 30,
 175                          NL80211_RRF_NO_IR),
 176                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 177         }
 178 };
 179
 180 static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
 181         .n_reg_rules = 6,
 182         .alpha2 =  "99",
 183         .reg_rules = {
 184                 REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 185                 REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 186                 REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
 187                 REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
 188                 REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
 189                 REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
 190         }
 191 };
 192
 193 static const struct ieee80211_regdomain hwsim_world_regdom_custom_04 = {
 194         .n_reg_rules = 6,
 195         .alpha2 =  "99",
 196         .reg_rules = {
 197                 REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 198                 REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 199                 REG_RULE(5150 - 10, 5240 + 10, 80, 0, 30, 0),
 200                 REG_RULE(5260 - 10, 5320 + 10, 80, 0, 30,
 201                          NL80211_RRF_DFS_CONCURRENT | NL80211_RRF_DFS),
 202                 REG_RULE(5745 - 10, 5825 + 10, 80, 0, 30, 0),
 203                 REG_RULE(5855 - 10, 5925 + 10, 80, 0, 33, 0),
 204         }
 205 };
 206
 207 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
 208         &hwsim_world_regdom_custom_01,
 209         &hwsim_world_regdom_custom_02,
 210         &hwsim_world_regdom_custom_03,
 211         &hwsim_world_regdom_custom_04,
 212 };
 213
 214 struct hwsim_vif_priv {
 215         u32 magic;
 216         u8 bssid[ETH_ALEN];
 217         bool assoc;
 218         bool bcn_en;
 219         u16 aid;
 220 };
 221
 222 #define HWSIM_VIF_MAGIC 0x69537748
 223
 224 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
 225 {
 226         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 227         WARN(vp->magic != HWSIM_VIF_MAGIC,
 228              "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
 229              vif, vp->magic, vif->addr, vif->type, vif->p2p);
 230 }
 231
 232 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
 233 {
 234         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 235         vp->magic = HWSIM_VIF_MAGIC;
 236 }
 237
 238 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
 239 {
 240         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 241         vp->magic = 0;
 242 }
 243
 244 struct hwsim_sta_priv {
 245         u32 magic;
 246         unsigned int last_link;
 247         u16 active_links_rx;
 248 };
 249
 250 #define HWSIM_STA_MAGIC 0x6d537749
 251
 252 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
 253 {
 254         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 255         WARN_ON(sp->magic != HWSIM_STA_MAGIC);
 256 }
 257
 258 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
 259 {
 260         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 261         sp->magic = HWSIM_STA_MAGIC;
 262 }
 263
 264 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
 265 {
 266         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 267         sp->magic = 0;
 268 }
 269
 270 struct hwsim_chanctx_priv {
 271         u32 magic;
 272 };
 273
 274 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
 275
 276 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
 277 {
 278         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 279         WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
 280 }
 281
 282 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
 283 {
 284         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 285         cp->magic = HWSIM_CHANCTX_MAGIC;
 286 }
 287
 288 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
 289 {
 290         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 291         cp->magic = 0;
 292 }
 293
 294 static unsigned int hwsim_net_id;
 295
 296 static DEFINE_IDA(hwsim_netgroup_ida);
 297
 298 struct hwsim_net {
 299         int netgroup;
 300         u32 wmediumd;
 301 };
 302
 303 static inline int hwsim_net_get_netgroup(struct net *net)
 304 {
 305         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 306
 307         return hwsim_net->netgroup;
 308 }
 309
 310 static inline int hwsim_net_set_netgroup(struct net *net)
 311 {
 312         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 313
 314         hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
 315         return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
 316 }
 317
 318 static inline u32 hwsim_net_get_wmediumd(struct net *net)
 319 {
 320         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 321
 322         return hwsim_net->wmediumd;
 323 }
 324
 325 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
 326 {
 327         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 328
 329         hwsim_net->wmediumd = portid;
 330 }
 331
 332 static struct class *hwsim_class;
 333
 334 static struct net_device *hwsim_mon; /* global monitor netdev */
 335
 336 #define CHAN2G(_freq)  { \
 337         .band = NL80211_BAND_2GHZ, \
 338         .center_freq = (_freq), \
 339         .hw_value = (_freq), \
 340 }
 341
 342 #define CHAN5G(_freq) { \
 343         .band = NL80211_BAND_5GHZ, \
 344         .center_freq = (_freq), \
 345         .hw_value = (_freq), \
 346 }
 347
 348 #define CHAN6G(_freq) { \
 349         .band = NL80211_BAND_6GHZ, \
 350         .center_freq = (_freq), \
 351         .hw_value = (_freq), \
 352 }
 353
 354 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
 355         CHAN2G(2412), /* Channel 1 */
 356         CHAN2G(2417), /* Channel 2 */
 357         CHAN2G(2422), /* Channel 3 */
 358         CHAN2G(2427), /* Channel 4 */
 359         CHAN2G(2432), /* Channel 5 */
 360         CHAN2G(2437), /* Channel 6 */
 361         CHAN2G(2442), /* Channel 7 */
 362         CHAN2G(2447), /* Channel 8 */
 363         CHAN2G(2452), /* Channel 9 */
 364         CHAN2G(2457), /* Channel 10 */
 365         CHAN2G(2462), /* Channel 11 */
 366         CHAN2G(2467), /* Channel 12 */
 367         CHAN2G(2472), /* Channel 13 */
 368         CHAN2G(2484), /* Channel 14 */
 369 };
 370
 371 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
 372         CHAN5G(5180), /* Channel 36 */
 373         CHAN5G(5200), /* Channel 40 */
 374         CHAN5G(5220), /* Channel 44 */
 375         CHAN5G(5240), /* Channel 48 */
 376
 377         CHAN5G(5260), /* Channel 52 */
 378         CHAN5G(5280), /* Channel 56 */
 379         CHAN5G(5300), /* Channel 60 */
 380         CHAN5G(5320), /* Channel 64 */
 381
 382         CHAN5G(5500), /* Channel 100 */
 383         CHAN5G(5520), /* Channel 104 */
 384         CHAN5G(5540), /* Channel 108 */
 385         CHAN5G(5560), /* Channel 112 */
 386         CHAN5G(5580), /* Channel 116 */
 387         CHAN5G(5600), /* Channel 120 */
 388         CHAN5G(5620), /* Channel 124 */
 389         CHAN5G(5640), /* Channel 128 */
 390         CHAN5G(5660), /* Channel 132 */
 391         CHAN5G(5680), /* Channel 136 */
 392         CHAN5G(5700), /* Channel 140 */
 393
 394         CHAN5G(5745), /* Channel 149 */
 395         CHAN5G(5765), /* Channel 153 */
 396         CHAN5G(5785), /* Channel 157 */
 397         CHAN5G(5805), /* Channel 161 */
 398         CHAN5G(5825), /* Channel 165 */
 399         CHAN5G(5845), /* Channel 169 */
 400
 401         CHAN5G(5855), /* Channel 171 */
 402         CHAN5G(5860), /* Channel 172 */
 403         CHAN5G(5865), /* Channel 173 */
 404         CHAN5G(5870), /* Channel 174 */
 405
 406         CHAN5G(5875), /* Channel 175 */
 407         CHAN5G(5880), /* Channel 176 */
 408         CHAN5G(5885), /* Channel 177 */
 409         CHAN5G(5890), /* Channel 178 */
 410         CHAN5G(5895), /* Channel 179 */
 411         CHAN5G(5900), /* Channel 180 */
 412         CHAN5G(5905), /* Channel 181 */
 413
 414         CHAN5G(5910), /* Channel 182 */
 415         CHAN5G(5915), /* Channel 183 */
 416         CHAN5G(5920), /* Channel 184 */
 417         CHAN5G(5925), /* Channel 185 */
 418 };
 419
 420 static const struct ieee80211_channel hwsim_channels_6ghz[] = {
 421         CHAN6G(5955), /* Channel 1 */
 422         CHAN6G(5975), /* Channel 5 */
 423         CHAN6G(5995), /* Channel 9 */
 424         CHAN6G(6015), /* Channel 13 */
 425         CHAN6G(6035), /* Channel 17 */
 426         CHAN6G(6055), /* Channel 21 */
 427         CHAN6G(6075), /* Channel 25 */
 428         CHAN6G(6095), /* Channel 29 */
 429         CHAN6G(6115), /* Channel 33 */
 430         CHAN6G(6135), /* Channel 37 */
 431         CHAN6G(6155), /* Channel 41 */
 432         CHAN6G(6175), /* Channel 45 */
 433         CHAN6G(6195), /* Channel 49 */
 434         CHAN6G(6215), /* Channel 53 */
 435         CHAN6G(6235), /* Channel 57 */
 436         CHAN6G(6255), /* Channel 61 */
 437         CHAN6G(6275), /* Channel 65 */
 438         CHAN6G(6295), /* Channel 69 */
 439         CHAN6G(6315), /* Channel 73 */
 440         CHAN6G(6335), /* Channel 77 */
 441         CHAN6G(6355), /* Channel 81 */
 442         CHAN6G(6375), /* Channel 85 */
 443         CHAN6G(6395), /* Channel 89 */
 444         CHAN6G(6415), /* Channel 93 */
 445         CHAN6G(6435), /* Channel 97 */
 446         CHAN6G(6455), /* Channel 181 */
 447         CHAN6G(6475), /* Channel 105 */
 448         CHAN6G(6495), /* Channel 109 */
 449         CHAN6G(6515), /* Channel 113 */
 450         CHAN6G(6535), /* Channel 117 */
 451         CHAN6G(6555), /* Channel 121 */
 452         CHAN6G(6575), /* Channel 125 */
 453         CHAN6G(6595), /* Channel 129 */
 454         CHAN6G(6615), /* Channel 133 */
 455         CHAN6G(6635), /* Channel 137 */
 456         CHAN6G(6655), /* Channel 141 */
 457         CHAN6G(6675), /* Channel 145 */
 458         CHAN6G(6695), /* Channel 149 */
 459         CHAN6G(6715), /* Channel 153 */
 460         CHAN6G(6735), /* Channel 157 */
 461         CHAN6G(6755), /* Channel 161 */
 462         CHAN6G(6775), /* Channel 165 */
 463         CHAN6G(6795), /* Channel 169 */
 464         CHAN6G(6815), /* Channel 173 */
 465         CHAN6G(6835), /* Channel 177 */
 466         CHAN6G(6855), /* Channel 181 */
 467         CHAN6G(6875), /* Channel 185 */
 468         CHAN6G(6895), /* Channel 189 */
 469         CHAN6G(6915), /* Channel 193 */
 470         CHAN6G(6935), /* Channel 197 */
 471         CHAN6G(6955), /* Channel 201 */
 472         CHAN6G(6975), /* Channel 205 */
 473         CHAN6G(6995), /* Channel 209 */
 474         CHAN6G(7015), /* Channel 213 */
 475         CHAN6G(7035), /* Channel 217 */
 476         CHAN6G(7055), /* Channel 221 */
 477         CHAN6G(7075), /* Channel 225 */
 478         CHAN6G(7095), /* Channel 229 */
 479         CHAN6G(7115), /* Channel 233 */
 480 };
 481
 482 #define NUM_S1G_CHANS_US 51
 483 static struct ieee80211_channel hwsim_channels_s1g[NUM_S1G_CHANS_US];
 484
 485 static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
 486         .s1g = true,
 487         .cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
 488                  0,
 489                  0,
 490                  S1G_CAP3_MAX_MPDU_LEN,
 491                  0,
 492                  S1G_CAP5_AMPDU,
 493                  0,
 494                  S1G_CAP7_DUP_1MHZ,
 495                  S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
 496                  0},
 497         .nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
 498         /* RX Highest Supported Long GI Data Rate 0:7 */
 499                      0,
 500         /* RX Highest Supported Long GI Data Rate 0:7 */
 501         /* TX S1G MCS Map 0:6 */
 502                      0xfa,
 503         /* TX S1G MCS Map :7 */
 504         /* TX Highest Supported Long GI Data Rate 0:6 */
 505                      0x80,
 506         /* TX Highest Supported Long GI Data Rate 7:8 */
 507         /* Rx Single spatial stream and S1G-MCS Map for 1MHz */
 508         /* Tx Single spatial stream and S1G-MCS Map for 1MHz */
 509                      0 },
 510 };
 511
 512 static void hwsim_init_s1g_channels(struct ieee80211_channel *chans)
 513 {
 514         int ch, freq;
 515
 516         for (ch = 0; ch < NUM_S1G_CHANS_US; ch++) {
 517                 freq = 902000 + (ch + 1) * 500;
 518                 chans[ch].band = NL80211_BAND_S1GHZ;
 519                 chans[ch].center_freq = KHZ_TO_MHZ(freq);
 520                 chans[ch].freq_offset = freq % 1000;
 521                 chans[ch].hw_value = ch + 1;
 522         }
 523 }
 524
 525 static const struct ieee80211_rate hwsim_rates[] = {
 526         { .bitrate = 10 },
 527         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 528         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 529         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 530         { .bitrate = 60 },
 531         { .bitrate = 90 },
 532         { .bitrate = 120 },
 533         { .bitrate = 180 },
 534         { .bitrate = 240 },
 535         { .bitrate = 360 },
 536         { .bitrate = 480 },
 537         { .bitrate = 540 }
 538 };
 539
 540 #define DEFAULT_RX_RSSI -50
 541
 542 static const u32 hwsim_ciphers[] = {
 543         WLAN_CIPHER_SUITE_WEP40,
 544         WLAN_CIPHER_SUITE_WEP104,
 545         WLAN_CIPHER_SUITE_TKIP,
 546         WLAN_CIPHER_SUITE_CCMP,
 547         WLAN_CIPHER_SUITE_CCMP_256,
 548         WLAN_CIPHER_SUITE_GCMP,
 549         WLAN_CIPHER_SUITE_GCMP_256,
 550         WLAN_CIPHER_SUITE_AES_CMAC,
 551         WLAN_CIPHER_SUITE_BIP_CMAC_256,
 552         WLAN_CIPHER_SUITE_BIP_GMAC_128,
 553         WLAN_CIPHER_SUITE_BIP_GMAC_256,
 554 };
 555
 556 #define OUI_QCA 0x001374
 557 #define QCA_NL80211_SUBCMD_TEST 1
 558 enum qca_nl80211_vendor_subcmds {
 559         QCA_WLAN_VENDOR_ATTR_TEST = 8,
 560         QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
 561 };
 562
 563 static const struct nla_policy
 564 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
 565         [QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
 566 };
 567
 568 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
 569                                           struct wireless_dev *wdev,
 570                                           const void *data, int data_len)
 571 {
 572         struct sk_buff *skb;
 573         struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 574         int err;
 575         u32 val;
 576
 577         err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
 578                                    data_len, hwsim_vendor_test_policy, NULL);
 579         if (err)
 580                 return err;
 581         if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
 582                 return -EINVAL;
 583         val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
 584         wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
 585
 586         /* Send a vendor event as a test. Note that this would not normally be
 587          * done within a command handler, but rather, based on some other
 588          * trigger. For simplicity, this command is used to trigger the event
 589          * here.
 590          *
 591          * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
 592          */
 593         skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
 594         if (skb) {
 595                 /* skb_put() or nla_put() will fill up data within
 596                  * NL80211_ATTR_VENDOR_DATA.
 597                  */
 598
 599                 /* Add vendor data */
 600                 nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
 601
 602                 /* Send the event - this will call nla_nest_end() */
 603                 cfg80211_vendor_event(skb, GFP_KERNEL);
 604         }
 605
 606         /* Send a response to the command */
 607         skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
 608         if (!skb)
 609                 return -ENOMEM;
 610
 611         /* skb_put() or nla_put() will fill up data within
 612          * NL80211_ATTR_VENDOR_DATA
 613          */
 614         nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
 615
 616         return cfg80211_vendor_cmd_reply(skb);
 617 }
 618
 619 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
 620         {
 621                 .info = { .vendor_id = OUI_QCA,
 622                           .subcmd = QCA_NL80211_SUBCMD_TEST },
 623                 .flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
 624                 .doit = mac80211_hwsim_vendor_cmd_test,
 625                 .policy = hwsim_vendor_test_policy,
 626                 .maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
 627         }
 628 };
 629
 630 /* Advertise support vendor specific events */
 631 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
 632         { .vendor_id = OUI_QCA, .subcmd = 1 },
 633 };
 634
 635 static DEFINE_SPINLOCK(hwsim_radio_lock);
 636 static LIST_HEAD(hwsim_radios);
 637 static struct rhashtable hwsim_radios_rht;
 638 static int hwsim_radio_idx;
 639 static int hwsim_radios_generation = 1;
 640
 641 static struct platform_driver mac80211_hwsim_driver = {
 642         .driver = {
 643                 .name = "mac80211_hwsim",
 644         },
 645 };
 646
 647 struct mac80211_hwsim_link_data {
 648         u32 link_id;
 649         u64 beacon_int  /* beacon interval in us */;
 650         struct hrtimer beacon_timer;
 651 };
 652
 653 struct mac80211_hwsim_data {
 654         struct list_head list;
 655         struct rhash_head rht;
 656         struct ieee80211_hw *hw;
 657         struct device *dev;
 658         struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 659         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
 660         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
 661         struct ieee80211_channel channels_6ghz[ARRAY_SIZE(hwsim_channels_6ghz)];
 662         struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
 663         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 664         struct ieee80211_iface_combination if_combination;
 665         struct ieee80211_iface_limit if_limits[3];
 666         int n_if_limits;
 667
 668         u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
 669
 670         struct mac_address addresses[2];
 671         int channels, idx;
 672         bool use_chanctx;
 673         bool destroy_on_close;
 674         u32 portid;
 675         char alpha2[2];
 676         const struct ieee80211_regdomain *regd;
 677
 678         struct ieee80211_channel *tmp_chan;
 679         struct ieee80211_channel *roc_chan;
 680         u32 roc_duration;
 681         struct delayed_work roc_start;
 682         struct delayed_work roc_done;
 683         struct delayed_work hw_scan;
 684         struct cfg80211_scan_request *hw_scan_request;
 685         struct ieee80211_vif *hw_scan_vif;
 686         int scan_chan_idx;
 687         u8 scan_addr[ETH_ALEN];
 688         struct {
 689                 struct ieee80211_channel *channel;
 690                 unsigned long next_start, start, end;
 691         } survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
 692                       ARRAY_SIZE(hwsim_channels_5ghz) +
 693                       ARRAY_SIZE(hwsim_channels_6ghz)];
 694
 695         struct ieee80211_channel *channel;
 696         enum nl80211_chan_width bw;
 697         unsigned int rx_filter;
 698         bool started, idle, scanning;
 699         struct mutex mutex;
 700         enum ps_mode {
 701                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
 702         } ps;
 703         bool ps_poll_pending;
 704         struct dentry *debugfs;
 705
 706         atomic_t pending_cookie;
 707         struct sk_buff_head pending;    /* packets pending */
 708         /*
 709          * Only radios in the same group can communicate together (the
 710          * channel has to match too). Each bit represents a group. A
 711          * radio can be in more than one group.
 712          */
 713         u64 group;
 714
 715         /* group shared by radios created in the same netns */
 716         int netgroup;
 717         /* wmediumd portid responsible for netgroup of this radio */
 718         u32 wmediumd;
 719
 720         /* difference between this hw's clock and the real clock, in usecs */
 721         s64 tsf_offset;
 722         s64 bcn_delta;
 723         /* absolute beacon transmission time. Used to cover up "tx" delay. */
 724         u64 abs_bcn_ts;
 725
 726         /* Stats */
 727         u64 tx_pkts;
 728         u64 rx_pkts;
 729         u64 tx_bytes;
 730         u64 rx_bytes;
 731         u64 tx_dropped;
 732         u64 tx_failed;
 733
 734         /* RSSI in rx status of the receiver */
 735         int rx_rssi;
 736
 737         /* only used when pmsr capability is supplied */
 738         struct cfg80211_pmsr_capabilities pmsr_capa;
 739         struct cfg80211_pmsr_request *pmsr_request;
 740         struct wireless_dev *pmsr_request_wdev;
 741
 742         struct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];
 743 };
 744
 745 static const struct rhashtable_params hwsim_rht_params = {
 746         .nelem_hint = 2,
 747         .automatic_shrinking = true,
 748         .key_len = ETH_ALEN,
 749         .key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
 750         .head_offset = offsetof(struct mac80211_hwsim_data, rht),
 751 };
 752
 753 struct hwsim_radiotap_hdr {
 754         struct ieee80211_radiotap_header hdr;
 755         __le64 rt_tsft;
 756         u8 rt_flags;
 757         u8 rt_rate;
 758         __le16 rt_channel;
 759         __le16 rt_chbitmask;
 760 } __packed;
 761
 762 struct hwsim_radiotap_ack_hdr {
 763         struct ieee80211_radiotap_header hdr;
 764         u8 rt_flags;
 765         u8 pad;
 766         __le16 rt_channel;
 767         __le16 rt_chbitmask;
 768 } __packed;
 769
 770 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
 771 {
 772         return rhashtable_lookup_fast(&hwsim_radios_rht, addr, hwsim_rht_params);
 773 }
 774
 775 /* MAC80211_HWSIM netlink family */
 776 static struct genl_family hwsim_genl_family;
 777
 778 enum hwsim_multicast_groups {
 779         HWSIM_MCGRP_CONFIG,
 780 };
 781
 782 static const struct genl_multicast_group hwsim_mcgrps[] = {
 783         [HWSIM_MCGRP_CONFIG] = { .name = "config", },
 784 };
 785
 786 /* MAC80211_HWSIM netlink policy */
 787
 788 static const struct nla_policy
 789 hwsim_rate_info_policy[HWSIM_RATE_INFO_ATTR_MAX + 1] = {
 790         [HWSIM_RATE_INFO_ATTR_FLAGS] = { .type = NLA_U8 },
 791         [HWSIM_RATE_INFO_ATTR_MCS] = { .type = NLA_U8 },
 792         [HWSIM_RATE_INFO_ATTR_LEGACY] = { .type = NLA_U16 },
 793         [HWSIM_RATE_INFO_ATTR_NSS] = { .type = NLA_U8 },
 794         [HWSIM_RATE_INFO_ATTR_BW] = { .type = NLA_U8 },
 795         [HWSIM_RATE_INFO_ATTR_HE_GI] = { .type = NLA_U8 },
 796         [HWSIM_RATE_INFO_ATTR_HE_DCM] = { .type = NLA_U8 },
 797         [HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC] = { .type = NLA_U8 },
 798         [HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH] = { .type = NLA_U8 },
 799         [HWSIM_RATE_INFO_ATTR_EHT_GI] = { .type = NLA_U8 },
 800         [HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC] = { .type = NLA_U8 },
 801 };
 802
 803 static const struct nla_policy
 804 hwsim_ftm_result_policy[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1] = {
 805         [NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON] = { .type = NLA_U32 },
 806         [NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX] = { .type = NLA_U16 },
 807         [NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS] = { .type = NLA_U32 },
 808         [NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES] = { .type = NLA_U32 },
 809         [NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME] = { .type = NLA_U8 },
 810         [NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP] = { .type = NLA_U8 },
 811         [NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION] = { .type = NLA_U8 },
 812         [NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
 813         [NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG] = { .type = NLA_U32 },
 814         [NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD] = { .type = NLA_U32 },
 815         [NL80211_PMSR_FTM_RESP_ATTR_TX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 816         [NL80211_PMSR_FTM_RESP_ATTR_RX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 817         [NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG] = { .type = NLA_U64 },
 818         [NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE] = { .type = NLA_U64 },
 819         [NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD] = { .type = NLA_U64 },
 820         [NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG] = { .type = NLA_U64 },
 821         [NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE] = { .type = NLA_U64 },
 822         [NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD] = { .type = NLA_U64 },
 823         [NL80211_PMSR_FTM_RESP_ATTR_LCI] = { .type = NLA_STRING },
 824         [NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_STRING },
 825 };
 826
 827 static const struct nla_policy
 828 hwsim_pmsr_resp_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 829         [NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_result_policy),
 830 };
 831
 832 static const struct nla_policy
 833 hwsim_pmsr_resp_policy[NL80211_PMSR_RESP_ATTR_MAX + 1] = {
 834         [NL80211_PMSR_RESP_ATTR_STATUS] = { .type = NLA_U32 },
 835         [NL80211_PMSR_RESP_ATTR_HOST_TIME] = { .type = NLA_U64 },
 836         [NL80211_PMSR_RESP_ATTR_AP_TSF] = { .type = NLA_U64 },
 837         [NL80211_PMSR_RESP_ATTR_FINAL] = { .type = NLA_FLAG },
 838         [NL80211_PMSR_RESP_ATTR_DATA] = NLA_POLICY_NESTED(hwsim_pmsr_resp_type_policy),
 839 };
 840
 841 static const struct nla_policy
 842 hwsim_pmsr_peer_result_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 843         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 844         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_REJECT },
 845         [NL80211_PMSR_PEER_ATTR_REQ] = { .type = NLA_REJECT },
 846         [NL80211_PMSR_PEER_ATTR_RESP] = NLA_POLICY_NESTED(hwsim_pmsr_resp_policy),
 847 };
 848
 849 static const struct nla_policy
 850 hwsim_pmsr_peers_result_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 851         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 852         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 853         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 854         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 855         [NL80211_PMSR_ATTR_PEERS] = NLA_POLICY_NESTED_ARRAY(hwsim_pmsr_peer_result_policy),
 856 };
 857
 858 static const struct nla_policy
 859 hwsim_ftm_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
 860         [NL80211_PMSR_FTM_CAPA_ATTR_ASAP] = { .type = NLA_FLAG },
 861         [NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP] = { .type = NLA_FLAG },
 862         [NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI] = { .type = NLA_FLAG },
 863         [NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC] = { .type = NLA_FLAG },
 864         [NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES] = { .type = NLA_U32 },
 865         [NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS] = { .type = NLA_U32 },
 866         [NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT] = NLA_POLICY_MAX(NLA_U8, 15),
 867         [NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST] = NLA_POLICY_MAX(NLA_U8, 31),
 868         [NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 869         [NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 870 };
 871
 872 static const struct nla_policy
 873 hwsim_pmsr_capa_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 874         [NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_capa_policy),
 875 };
 876
 877 static const struct nla_policy
 878 hwsim_pmsr_capa_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 879         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_U32 },
 880         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_FLAG },
 881         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_FLAG },
 882         [NL80211_PMSR_ATTR_TYPE_CAPA] = NLA_POLICY_NESTED(hwsim_pmsr_capa_type_policy),
 883         [NL80211_PMSR_ATTR_PEERS] = { .type = NLA_REJECT }, // only for request.
 884 };
 885
 886 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
 887         [HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
 888         [HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
 889         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
 890                                .len = IEEE80211_MAX_DATA_LEN },
 891         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
 892         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
 893         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
 894         [HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
 895                                  .len = IEEE80211_TX_MAX_RATES *
 896                                         sizeof(struct hwsim_tx_rate)},
 897         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
 898         [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
 899         [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
 900         [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 901         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
 902         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 903         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
 904         [HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
 905         [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
 906         [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
 907         [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
 908         [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 909         [HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
 910         [HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 911         [HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
 912         [HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
 913         [HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 914         [HWSIM_ATTR_PMSR_SUPPORT] = NLA_POLICY_NESTED(hwsim_pmsr_capa_policy),
 915         [HWSIM_ATTR_PMSR_RESULT] = NLA_POLICY_NESTED(hwsim_pmsr_peers_result_policy),
 916 };
 917
 918 #if IS_REACHABLE(CONFIG_VIRTIO)
 919
 920 /* MAC80211_HWSIM virtio queues */
 921 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
 922 static bool hwsim_virtio_enabled;
 923 static DEFINE_SPINLOCK(hwsim_virtio_lock);
 924
 925 static void hwsim_virtio_rx_work(struct work_struct *work);
 926 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
 927
 928 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 929                            struct sk_buff *skb)
 930 {
 931         struct scatterlist sg[1];
 932         unsigned long flags;
 933         int err;
 934
 935         spin_lock_irqsave(&hwsim_virtio_lock, flags);
 936         if (!hwsim_virtio_enabled) {
 937                 err = -ENODEV;
 938                 goto out_free;
 939         }
 940
 941         sg_init_one(sg, skb->head, skb_end_offset(skb));
 942         err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
 943                                    GFP_ATOMIC);
 944         if (err)
 945                 goto out_free;
 946         virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
 947         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 948         return 0;
 949
 950 out_free:
 951         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 952         nlmsg_free(skb);
 953         return err;
 954 }
 955 #else
 956 /* cause a linker error if this ends up being needed */
 957 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 958                            struct sk_buff *skb);
 959 #define hwsim_virtio_enabled false
 960 #endif
 961
 962 static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
 963 {
 964         switch (bw) {
 965         case NL80211_CHAN_WIDTH_20_NOHT:
 966         case NL80211_CHAN_WIDTH_20:
 967                 return 20;
 968         case NL80211_CHAN_WIDTH_40:
 969                 return 40;
 970         case NL80211_CHAN_WIDTH_80:
 971                 return 80;
 972         case NL80211_CHAN_WIDTH_80P80:
 973         case NL80211_CHAN_WIDTH_160:
 974                 return 160;
 975         case NL80211_CHAN_WIDTH_320:
 976                 return 320;
 977         case NL80211_CHAN_WIDTH_5:
 978                 return 5;
 979         case NL80211_CHAN_WIDTH_10:
 980                 return 10;
 981         case NL80211_CHAN_WIDTH_1:
 982                 return 1;
 983         case NL80211_CHAN_WIDTH_2:
 984                 return 2;
 985         case NL80211_CHAN_WIDTH_4:
 986                 return 4;
 987         case NL80211_CHAN_WIDTH_8:
 988                 return 8;
 989         case NL80211_CHAN_WIDTH_16:
 990                 return 16;
 991         }
 992
 993         return INT_MAX;
 994 }
 995
 996 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 997                                     struct sk_buff *skb,
 998                                     struct ieee80211_channel *chan);
 999
1000 /* sysfs attributes */
1001 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
1002 {
1003         struct mac80211_hwsim_data *data = dat;
1004         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1005         struct sk_buff *skb;
1006         struct ieee80211_pspoll *pspoll;
1007
1008         if (!vp->assoc)
1009                 return;
1010
1011         wiphy_dbg(data->hw->wiphy,
1012                   "%s: send PS-Poll to %pM for aid %d\n",
1013                   __func__, vp->bssid, vp->aid);
1014
1015         skb = dev_alloc_skb(sizeof(*pspoll));
1016         if (!skb)
1017                 return;
1018         pspoll = skb_put(skb, sizeof(*pspoll));
1019         pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1020                                             IEEE80211_STYPE_PSPOLL |
1021                                             IEEE80211_FCTL_PM);
1022         pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
1023         memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
1024         memcpy(pspoll->ta, mac, ETH_ALEN);
1025
1026         rcu_read_lock();
1027         mac80211_hwsim_tx_frame(data->hw, skb,
1028                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1029         rcu_read_unlock();
1030 }
1031
1032 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
1033                                 struct ieee80211_vif *vif, int ps)
1034 {
1035         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1036         struct sk_buff *skb;
1037         struct ieee80211_hdr *hdr;
1038         struct ieee80211_tx_info *cb;
1039
1040         if (!vp->assoc)
1041                 return;
1042
1043         wiphy_dbg(data->hw->wiphy,
1044                   "%s: send data::nullfunc to %pM ps=%d\n",
1045                   __func__, vp->bssid, ps);
1046
1047         skb = dev_alloc_skb(sizeof(*hdr));
1048         if (!skb)
1049                 return;
1050         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
1051         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
1052                                          IEEE80211_STYPE_NULLFUNC |
1053                                          IEEE80211_FCTL_TODS |
1054                                          (ps ? IEEE80211_FCTL_PM : 0));
1055         hdr->duration_id = cpu_to_le16(0);
1056         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
1057         memcpy(hdr->addr2, mac, ETH_ALEN);
1058         memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
1059
1060         cb = IEEE80211_SKB_CB(skb);
1061         cb->control.rates[0].count = 1;
1062         cb->control.rates[1].idx = -1;
1063
1064         rcu_read_lock();
1065         mac80211_hwsim_tx_frame(data->hw, skb,
1066                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1067         rcu_read_unlock();
1068 }
1069
1070
1071 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
1072                                    struct ieee80211_vif *vif)
1073 {
1074         struct mac80211_hwsim_data *data = dat;
1075         hwsim_send_nullfunc(data, mac, vif, 1);
1076 }
1077
1078 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
1079                                       struct ieee80211_vif *vif)
1080 {
1081         struct mac80211_hwsim_data *data = dat;
1082         hwsim_send_nullfunc(data, mac, vif, 0);
1083 }
1084
1085 static int hwsim_fops_ps_read(void *dat, u64 *val)
1086 {
1087         struct mac80211_hwsim_data *data = dat;
1088         *val = data->ps;
1089         return 0;
1090 }
1091
1092 static int hwsim_fops_ps_write(void *dat, u64 val)
1093 {
1094         struct mac80211_hwsim_data *data = dat;
1095         enum ps_mode old_ps;
1096
1097         if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
1098             val != PS_MANUAL_POLL)
1099                 return -EINVAL;
1100
1101         if (val == PS_MANUAL_POLL) {
1102                 if (data->ps != PS_ENABLED)
1103                         return -EINVAL;
1104                 local_bh_disable();
1105                 ieee80211_iterate_active_interfaces_atomic(
1106                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1107                         hwsim_send_ps_poll, data);
1108                 local_bh_enable();
1109                 return 0;
1110         }
1111         old_ps = data->ps;
1112         data->ps = val;
1113
1114         local_bh_disable();
1115         if (old_ps == PS_DISABLED && val != PS_DISABLED) {
1116                 ieee80211_iterate_active_interfaces_atomic(
1117                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1118                         hwsim_send_nullfunc_ps, data);
1119         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
1120                 ieee80211_iterate_active_interfaces_atomic(
1121                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1122                         hwsim_send_nullfunc_no_ps, data);
1123         }
1124         local_bh_enable();
1125
1126         return 0;
1127 }
1128
1129 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1130                          "%llu\n");
1131
1132 static int hwsim_write_simulate_radar(void *dat, u64 val)
1133 {
1134         struct mac80211_hwsim_data *data = dat;
1135
1136         ieee80211_radar_detected(data->hw);
1137
1138         return 0;
1139 }
1140
1141 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1142                          hwsim_write_simulate_radar, "%llu\n");
1143
1144 static int hwsim_fops_group_read(void *dat, u64 *val)
1145 {
1146         struct mac80211_hwsim_data *data = dat;
1147         *val = data->group;
1148         return 0;
1149 }
1150
1151 static int hwsim_fops_group_write(void *dat, u64 val)
1152 {
1153         struct mac80211_hwsim_data *data = dat;
1154         data->group = val;
1155         return 0;
1156 }
1157
1158 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1159                          hwsim_fops_group_read, hwsim_fops_group_write,
1160                          "%llx\n");
1161
1162 static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1163 {
1164         struct mac80211_hwsim_data *data = dat;
1165         *val = data->rx_rssi;
1166         return 0;
1167 }
1168
1169 static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1170 {
1171         struct mac80211_hwsim_data *data = dat;
1172         int rssi = (int)val;
1173
1174         if (rssi >= 0 || rssi < -100)
1175                 return -EINVAL;
1176
1177         data->rx_rssi = rssi;
1178         return 0;
1179 }
1180
1181 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1182                          hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1183                          "%lld\n");
1184
1185 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1186                                         struct net_device *dev)
1187 {
1188         /* TODO: allow packet injection */
1189         dev_kfree_skb(skb);
1190         return NETDEV_TX_OK;
1191 }
1192
1193 static inline u64 mac80211_hwsim_get_tsf_raw(void)
1194 {
1195         return ktime_to_us(ktime_get_real());
1196 }
1197
1198 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1199 {
1200         u64 now = mac80211_hwsim_get_tsf_raw();
1201         return cpu_to_le64(now + data->tsf_offset);
1202 }
1203
1204 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1205                                   struct ieee80211_vif *vif)
1206 {
1207         struct mac80211_hwsim_data *data = hw->priv;
1208         return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
1209 }
1210
1211 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1212                 struct ieee80211_vif *vif, u64 tsf)
1213 {
1214         struct mac80211_hwsim_data *data = hw->priv;
1215         u64 now = mac80211_hwsim_get_tsf(hw, vif);
1216         /* MLD not supported here */
1217         u32 bcn_int = data->link_data[0].beacon_int;
1218         u64 delta = abs(tsf - now);
1219
1220         /* adjust after beaconing with new timestamp at old TBTT */
1221         if (tsf > now) {
1222                 data->tsf_offset += delta;
1223                 data->bcn_delta = do_div(delta, bcn_int);
1224         } else {
1225                 data->tsf_offset -= delta;
1226                 data->bcn_delta = -(s64)do_div(delta, bcn_int);
1227         }
1228 }
1229
1230 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1231                                       struct sk_buff *tx_skb,
1232                                       struct ieee80211_channel *chan)
1233 {
1234         struct mac80211_hwsim_data *data = hw->priv;
1235         struct sk_buff *skb;
1236         struct hwsim_radiotap_hdr *hdr;
1237         u16 flags, bitrate;
1238         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1239         struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
1240
1241         if (!txrate)
1242                 bitrate = 0;
1243         else
1244                 bitrate = txrate->bitrate;
1245
1246         if (!netif_running(hwsim_mon))
1247                 return;
1248
1249         skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1250         if (skb == NULL)
1251                 return;
1252
1253         hdr = skb_push(skb, sizeof(*hdr));
1254         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1255         hdr->hdr.it_pad = 0;
1256         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1257         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1258                                           (1 << IEEE80211_RADIOTAP_RATE) |
1259                                           (1 << IEEE80211_RADIOTAP_TSFT) |
1260                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1261         hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1262         hdr->rt_flags = 0;
1263         hdr->rt_rate = bitrate / 5;
1264         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1265         flags = IEEE80211_CHAN_2GHZ;
1266         if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1267                 flags |= IEEE80211_CHAN_OFDM;
1268         else
1269                 flags |= IEEE80211_CHAN_CCK;
1270         hdr->rt_chbitmask = cpu_to_le16(flags);
1271
1272         skb->dev = hwsim_mon;
1273         skb_reset_mac_header(skb);
1274         skb->ip_summed = CHECKSUM_UNNECESSARY;
1275         skb->pkt_type = PACKET_OTHERHOST;
1276         skb->protocol = htons(ETH_P_802_2);
1277         memset(skb->cb, 0, sizeof(skb->cb));
1278         netif_rx(skb);
1279 }
1280
1281
1282 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
1283                                        const u8 *addr)
1284 {
1285         struct sk_buff *skb;
1286         struct hwsim_radiotap_ack_hdr *hdr;
1287         u16 flags;
1288         struct ieee80211_hdr *hdr11;
1289
1290         if (!netif_running(hwsim_mon))
1291                 return;
1292
1293         skb = dev_alloc_skb(100);
1294         if (skb == NULL)
1295                 return;
1296
1297         hdr = skb_put(skb, sizeof(*hdr));
1298         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1299         hdr->hdr.it_pad = 0;
1300         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1301         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1302                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1303         hdr->rt_flags = 0;
1304         hdr->pad = 0;
1305         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1306         flags = IEEE80211_CHAN_2GHZ;
1307         hdr->rt_chbitmask = cpu_to_le16(flags);
1308
1309         hdr11 = skb_put(skb, 10);
1310         hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1311                                            IEEE80211_STYPE_ACK);
1312         hdr11->duration_id = cpu_to_le16(0);
1313         memcpy(hdr11->addr1, addr, ETH_ALEN);
1314
1315         skb->dev = hwsim_mon;
1316         skb_reset_mac_header(skb);
1317         skb->ip_summed = CHECKSUM_UNNECESSARY;
1318         skb->pkt_type = PACKET_OTHERHOST;
1319         skb->protocol = htons(ETH_P_802_2);
1320         memset(skb->cb, 0, sizeof(skb->cb));
1321         netif_rx(skb);
1322 }
1323
1324 struct mac80211_hwsim_addr_match_data {
1325         u8 addr[ETH_ALEN];
1326         bool ret;
1327 };
1328
1329 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1330                                      struct ieee80211_vif *vif)
1331 {
1332         int i;
1333         struct mac80211_hwsim_addr_match_data *md = data;
1334
1335         if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1336                 md->ret = true;
1337                 return;
1338         }
1339
1340         /* Match the link address */
1341         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1342                 struct ieee80211_bss_conf *conf;
1343
1344                 conf = rcu_dereference(vif->link_conf[i]);
1345                 if (!conf)
1346                         continue;
1347
1348                 if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1349                         md->ret = true;
1350                         return;
1351                 }
1352         }
1353 }
1354
1355 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1356                                       const u8 *addr)
1357 {
1358         struct mac80211_hwsim_addr_match_data md = {
1359                 .ret = false,
1360         };
1361
1362         if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1363                 return true;
1364
1365         memcpy(md.addr, addr, ETH_ALEN);
1366
1367         ieee80211_iterate_active_interfaces_atomic(data->hw,
1368                                                    IEEE80211_IFACE_ITER_NORMAL,
1369                                                    mac80211_hwsim_addr_iter,
1370                                                    &md);
1371
1372         return md.ret;
1373 }
1374
1375 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1376                            struct sk_buff *skb)
1377 {
1378         switch (data->ps) {
1379         case PS_DISABLED:
1380                 return true;
1381         case PS_ENABLED:
1382                 return false;
1383         case PS_AUTO_POLL:
1384                 /* TODO: accept (some) Beacons by default and other frames only
1385                  * if pending PS-Poll has been sent */
1386                 return true;
1387         case PS_MANUAL_POLL:
1388                 /* Allow unicast frames to own address if there is a pending
1389                  * PS-Poll */
1390                 if (data->ps_poll_pending &&
1391                     mac80211_hwsim_addr_match(data, skb->data + 4)) {
1392                         data->ps_poll_pending = false;
1393                         return true;
1394                 }
1395                 return false;
1396         }
1397
1398         return true;
1399 }
1400
1401 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1402                                   struct sk_buff *skb, int portid)
1403 {
1404         struct net *net;
1405         bool found = false;
1406         int res = -ENOENT;
1407
1408         rcu_read_lock();
1409         for_each_net_rcu(net) {
1410                 if (data->netgroup == hwsim_net_get_netgroup(net)) {
1411                         res = genlmsg_unicast(net, skb, portid);
1412                         found = true;
1413                         break;
1414                 }
1415         }
1416         rcu_read_unlock();
1417
1418         if (!found)
1419                 nlmsg_free(skb);
1420
1421         return res;
1422 }
1423
1424 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1425                                          const u8 *addr, bool add)
1426 {
1427         struct mac80211_hwsim_data *data = hw->priv;
1428         u32 _portid = READ_ONCE(data->wmediumd);
1429         struct sk_buff *skb;
1430         void *msg_head;
1431
1432         WARN_ON(!is_valid_ether_addr(addr));
1433
1434         if (!_portid && !hwsim_virtio_enabled)
1435                 return;
1436
1437         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1438         if (!skb)
1439                 return;
1440
1441         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1442                                add ? HWSIM_CMD_ADD_MAC_ADDR :
1443                                      HWSIM_CMD_DEL_MAC_ADDR);
1444         if (!msg_head) {
1445                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1446                 goto nla_put_failure;
1447         }
1448
1449         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1450                     ETH_ALEN, data->addresses[1].addr))
1451                 goto nla_put_failure;
1452
1453         if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1454                 goto nla_put_failure;
1455
1456         genlmsg_end(skb, msg_head);
1457
1458         if (hwsim_virtio_enabled)
1459                 hwsim_tx_virtio(data, skb);
1460         else
1461                 hwsim_unicast_netgroup(data, skb, _portid);
1462         return;
1463 nla_put_failure:
1464         nlmsg_free(skb);
1465 }
1466
1467 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1468 {
1469         u16 result = 0;
1470
1471         if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1472                 result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1473         if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1474                 result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1475         if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1476                 result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1477         if (rate->flags & IEEE80211_TX_RC_MCS)
1478                 result |= MAC80211_HWSIM_TX_RC_MCS;
1479         if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1480                 result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1481         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1482                 result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1483         if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1484                 result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1485         if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1486                 result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1487         if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1488                 result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1489         if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1490                 result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1491         if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1492                 result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1493
1494         return result;
1495 }
1496
1497 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1498                                        struct sk_buff *my_skb,
1499                                        int dst_portid,
1500                                        struct ieee80211_channel *channel)
1501 {
1502         struct sk_buff *skb;
1503         struct mac80211_hwsim_data *data = hw->priv;
1504         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1505         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1506         void *msg_head;
1507         unsigned int hwsim_flags = 0;
1508         int i;
1509         struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1510         struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1511         uintptr_t cookie;
1512
1513         if (data->ps != PS_DISABLED)
1514                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1515         /* If the queue contains MAX_QUEUE skb's drop some */
1516         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1517                 /* Dropping until WARN_QUEUE level */
1518                 while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1519                         ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1520                         data->tx_dropped++;
1521                 }
1522         }
1523
1524         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1525         if (skb == NULL)
1526                 goto nla_put_failure;
1527
1528         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1529                                HWSIM_CMD_FRAME);
1530         if (msg_head == NULL) {
1531                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1532                 goto nla_put_failure;
1533         }
1534
1535         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1536                     ETH_ALEN, data->addresses[1].addr))
1537                 goto nla_put_failure;
1538
1539         /* We get the skb->data */
1540         if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1541                 goto nla_put_failure;
1542
1543         /* We get the flags for this transmission, and we translate them to
1544            wmediumd flags  */
1545
1546         if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1547                 hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1548
1549         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1550                 hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1551
1552         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1553                 goto nla_put_failure;
1554
1555         if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1556                 goto nla_put_failure;
1557
1558         /* We get the tx control (rate and retries) info*/
1559
1560         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1561                 tx_attempts[i].idx = info->status.rates[i].idx;
1562                 tx_attempts_flags[i].idx = info->status.rates[i].idx;
1563                 tx_attempts[i].count = info->status.rates[i].count;
1564                 tx_attempts_flags[i].flags =
1565                                 trans_tx_rate_flags_ieee2hwsim(
1566                                                 &info->status.rates[i]);
1567         }
1568
1569         if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1570                     sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1571                     tx_attempts))
1572                 goto nla_put_failure;
1573
1574         if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1575                     sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1576                     tx_attempts_flags))
1577                 goto nla_put_failure;
1578
1579         /* We create a cookie to identify this skb */
1580         cookie = atomic_inc_return(&data->pending_cookie);
1581         info->rate_driver_data[0] = (void *)cookie;
1582         if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1583                 goto nla_put_failure;
1584
1585         genlmsg_end(skb, msg_head);
1586
1587         if (hwsim_virtio_enabled) {
1588                 if (hwsim_tx_virtio(data, skb))
1589                         goto err_free_txskb;
1590         } else {
1591                 if (hwsim_unicast_netgroup(data, skb, dst_portid))
1592                         goto err_free_txskb;
1593         }
1594
1595         /* Enqueue the packet */
1596         skb_queue_tail(&data->pending, my_skb);
1597         data->tx_pkts++;
1598         data->tx_bytes += my_skb->len;
1599         return;
1600
1601 nla_put_failure:
1602         nlmsg_free(skb);
1603 err_free_txskb:
1604         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1605         ieee80211_free_txskb(hw, my_skb);
1606         data->tx_failed++;
1607 }
1608
1609 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1610                                struct ieee80211_channel *c2)
1611 {
1612         if (!c1 || !c2)
1613                 return false;
1614
1615         return c1->center_freq == c2->center_freq;
1616 }
1617
1618 struct tx_iter_data {
1619         struct ieee80211_channel *channel;
1620         bool receive;
1621 };
1622
1623 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1624                                    struct ieee80211_vif *vif)
1625 {
1626         struct tx_iter_data *data = _data;
1627         int i;
1628
1629         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1630                 struct ieee80211_bss_conf *conf;
1631                 struct ieee80211_chanctx_conf *chanctx;
1632
1633                 conf = rcu_dereference(vif->link_conf[i]);
1634                 if (!conf)
1635                         continue;
1636
1637                 chanctx = rcu_dereference(conf->chanctx_conf);
1638                 if (!chanctx)
1639                         continue;
1640
1641                 if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1642                         continue;
1643
1644                 data->receive = true;
1645                 return;
1646         }
1647 }
1648
1649 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1650 {
1651         /*
1652          * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1653          * e.g. like this:
1654          * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1655          * (but you should use a valid OUI, not that)
1656          *
1657          * If anyone wants to 'donate' a radiotap OUI/subns code
1658          * please send a patch removing this #ifdef and changing
1659          * the values accordingly.
1660          */
1661 #ifdef HWSIM_RADIOTAP_OUI
1662         struct ieee80211_radiotap_vendor_tlv *rtap;
1663         static const char vendor_data[8] = "ABCDEFGH";
1664
1665         // Make sure no padding is needed
1666         BUILD_BUG_ON(sizeof(vendor_data) % 4);
1667         /* this is last radiotap info before the mac header, so
1668          * skb_reset_mac_header for mac8022 to know the end of
1669          * the radiotap TLV/beginning of the 802.11 header
1670          */
1671         skb_reset_mac_header(skb);
1672
1673         /*
1674          * Note that this code requires the headroom in the SKB
1675          * that was allocated earlier.
1676          */
1677         rtap = skb_push(skb, sizeof(*rtap) + sizeof(vendor_data));
1678
1679         rtap->len = cpu_to_le16(sizeof(*rtap) -
1680                                 sizeof(struct ieee80211_radiotap_tlv) +
1681                                 sizeof(vendor_data));
1682         rtap->type = cpu_to_le16(IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
1683
1684         rtap->content.oui[0] = HWSIM_RADIOTAP_OUI[0];
1685         rtap->content.oui[1] = HWSIM_RADIOTAP_OUI[1];
1686         rtap->content.oui[2] = HWSIM_RADIOTAP_OUI[2];
1687         rtap->content.oui_subtype = 127;
1688         /* clear reserved field */
1689         rtap->content.reserved = 0;
1690         rtap->content.vendor_type = 0;
1691         memcpy(rtap->content.data, vendor_data, sizeof(vendor_data));
1692
1693         IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
1694 #endif
1695 }
1696
1697 static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1698                               struct ieee80211_rx_status *rx_status,
1699                               struct sk_buff *skb)
1700 {
1701         struct ieee80211_hdr *hdr = (void *)skb->data;
1702
1703         if (!ieee80211_has_morefrags(hdr->frame_control) &&
1704             !is_multicast_ether_addr(hdr->addr1) &&
1705             (ieee80211_is_mgmt(hdr->frame_control) ||
1706              ieee80211_is_data(hdr->frame_control))) {
1707                 struct ieee80211_sta *sta;
1708                 unsigned int link_id;
1709
1710                 rcu_read_lock();
1711                 sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1712                                                        hdr->addr1, &link_id);
1713                 if (sta) {
1714                         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1715
1716                         if (ieee80211_has_pm(hdr->frame_control))
1717                                 sp->active_links_rx &= ~BIT(link_id);
1718                         else
1719                                 sp->active_links_rx |= BIT(link_id);
1720                 }
1721                 rcu_read_unlock();
1722         }
1723
1724         memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1725
1726         mac80211_hwsim_add_vendor_rtap(skb);
1727
1728         data->rx_pkts++;
1729         data->rx_bytes += skb->len;
1730         ieee80211_rx_irqsafe(data->hw, skb);
1731 }
1732
1733 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1734                                           struct sk_buff *skb,
1735                                           struct ieee80211_channel *chan)
1736 {
1737         struct mac80211_hwsim_data *data = hw->priv, *data2;
1738         bool ack = false;
1739         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1740         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1741         struct ieee80211_rx_status rx_status;
1742         u64 now;
1743
1744         memset(&rx_status, 0, sizeof(rx_status));
1745         rx_status.flag |= RX_FLAG_MACTIME_START;
1746         rx_status.freq = chan->center_freq;
1747         rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1748         rx_status.band = chan->band;
1749         if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1750                 rx_status.rate_idx =
1751                         ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1752                 rx_status.nss =
1753                         ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1754                 rx_status.encoding = RX_ENC_VHT;
1755         } else {
1756                 rx_status.rate_idx = info->control.rates[0].idx;
1757                 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1758                         rx_status.encoding = RX_ENC_HT;
1759         }
1760         if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1761                 rx_status.bw = RATE_INFO_BW_40;
1762         else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1763                 rx_status.bw = RATE_INFO_BW_80;
1764         else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1765                 rx_status.bw = RATE_INFO_BW_160;
1766         else
1767                 rx_status.bw = RATE_INFO_BW_20;
1768         if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1769                 rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1770         /* TODO: simulate optional packet loss */
1771         rx_status.signal = data->rx_rssi;
1772         if (info->control.vif)
1773                 rx_status.signal += info->control.vif->bss_conf.txpower;
1774
1775         if (data->ps != PS_DISABLED)
1776                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1777
1778         /* release the skb's source info */
1779         skb_orphan(skb);
1780         skb_dst_drop(skb);
1781         skb->mark = 0;
1782         skb_ext_reset(skb);
1783         nf_reset_ct(skb);
1784
1785         /*
1786          * Get absolute mactime here so all HWs RX at the "same time", and
1787          * absolute TX time for beacon mactime so the timestamp matches.
1788          * Giving beacons a different mactime than non-beacons looks messy, but
1789          * it helps the Toffset be exact and a ~10us mactime discrepancy
1790          * probably doesn't really matter.
1791          */
1792         if (ieee80211_is_beacon(hdr->frame_control) ||
1793             ieee80211_is_probe_resp(hdr->frame_control)) {
1794                 rx_status.boottime_ns = ktime_get_boottime_ns();
1795                 now = data->abs_bcn_ts;
1796         } else {
1797                 now = mac80211_hwsim_get_tsf_raw();
1798         }
1799
1800         /* Copy skb to all enabled radios that are on the current frequency */
1801         spin_lock(&hwsim_radio_lock);
1802         list_for_each_entry(data2, &hwsim_radios, list) {
1803                 struct sk_buff *nskb;
1804                 struct tx_iter_data tx_iter_data = {
1805                         .receive = false,
1806                         .channel = chan,
1807                 };
1808
1809                 if (data == data2)
1810                         continue;
1811
1812                 if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1813                     !hwsim_ps_rx_ok(data2, skb))
1814                         continue;
1815
1816                 if (!(data->group & data2->group))
1817                         continue;
1818
1819                 if (data->netgroup != data2->netgroup)
1820                         continue;
1821
1822                 if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1823                     !hwsim_chans_compat(chan, data2->channel)) {
1824                         ieee80211_iterate_active_interfaces_atomic(
1825                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1826                                 mac80211_hwsim_tx_iter, &tx_iter_data);
1827                         if (!tx_iter_data.receive)
1828                                 continue;
1829                 }
1830
1831                 /*
1832                  * reserve some space for our vendor and the normal
1833                  * radiotap header, since we're copying anyway
1834                  */
1835                 if (skb->len < PAGE_SIZE && paged_rx) {
1836                         struct page *page = alloc_page(GFP_ATOMIC);
1837
1838                         if (!page)
1839                                 continue;
1840
1841                         nskb = dev_alloc_skb(128);
1842                         if (!nskb) {
1843                                 __free_page(page);
1844                                 continue;
1845                         }
1846
1847                         memcpy(page_address(page), skb->data, skb->len);
1848                         skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1849                 } else {
1850                         nskb = skb_copy(skb, GFP_ATOMIC);
1851                         if (!nskb)
1852                                 continue;
1853                 }
1854
1855                 if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1856                         ack = true;
1857
1858                 rx_status.mactime = now + data2->tsf_offset;
1859
1860                 mac80211_hwsim_rx(data2, &rx_status, nskb);
1861         }
1862         spin_unlock(&hwsim_radio_lock);
1863
1864         return ack;
1865 }
1866
1867 static struct ieee80211_bss_conf *
1868 mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
1869                               struct ieee80211_vif *vif,
1870                               struct ieee80211_sta *sta,
1871                               struct ieee80211_hdr *hdr,
1872                               struct ieee80211_link_sta **link_sta)
1873 {
1874         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1875         int i;
1876
1877         if (!ieee80211_vif_is_mld(vif))
1878                 return &vif->bss_conf;
1879
1880         WARN_ON(is_multicast_ether_addr(hdr->addr1));
1881
1882         if (WARN_ON_ONCE(!sta || !sta->valid_links))
1883                 return &vif->bss_conf;
1884
1885         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1886                 struct ieee80211_bss_conf *bss_conf;
1887                 unsigned int link_id;
1888
1889                 /* round-robin the available link IDs */
1890                 link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
1891
1892                 if (!(vif->active_links & BIT(link_id)))
1893                         continue;
1894
1895                 if (!(sp->active_links_rx & BIT(link_id)))
1896                         continue;
1897
1898                 *link_sta = rcu_dereference(sta->link[link_id]);
1899                 if (!*link_sta)
1900                         continue;
1901
1902                 bss_conf = rcu_dereference(vif->link_conf[link_id]);
1903                 if (WARN_ON_ONCE(!bss_conf))
1904                         continue;
1905
1906                 /* can happen while switching links */
1907                 if (!rcu_access_pointer(bss_conf->chanctx_conf))
1908                         continue;
1909
1910                 sp->last_link = link_id;
1911                 return bss_conf;
1912         }
1913
1914         return NULL;
1915 }
1916
1917 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1918                               struct ieee80211_tx_control *control,
1919                               struct sk_buff *skb)
1920 {
1921         struct mac80211_hwsim_data *data = hw->priv;
1922         struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1923         struct ieee80211_hdr *hdr = (void *)skb->data;
1924         struct ieee80211_chanctx_conf *chanctx_conf;
1925         struct ieee80211_channel *channel;
1926         bool ack;
1927         enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1928         u32 _portid, i;
1929
1930         if (WARN_ON(skb->len < 10)) {
1931                 /* Should not happen; just a sanity check for addr1 use */
1932                 ieee80211_free_txskb(hw, skb);
1933                 return;
1934         }
1935
1936         if (!data->use_chanctx) {
1937                 channel = data->channel;
1938                 confbw = data->bw;
1939         } else if (txi->hw_queue == 4) {
1940                 channel = data->tmp_chan;
1941         } else {
1942                 u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
1943                                        IEEE80211_TX_CTRL_MLO_LINK);
1944                 struct ieee80211_vif *vif = txi->control.vif;
1945                 struct ieee80211_link_sta *link_sta = NULL;
1946                 struct ieee80211_sta *sta = control->sta;
1947                 struct ieee80211_bss_conf *bss_conf;
1948
1949                 if (link != IEEE80211_LINK_UNSPECIFIED) {
1950                         bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
1951                         if (sta)
1952                                 link_sta = rcu_dereference(sta->link[link]);
1953                 } else {
1954                         bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
1955                                                                  hdr, &link_sta);
1956                 }
1957
1958                 if (unlikely(!bss_conf)) {
1959                         /* if it's an MLO STA, it might have deactivated all
1960                          * links temporarily - but we don't handle real PS in
1961                          * this code yet, so just drop the frame in that case
1962                          */
1963                         WARN(link != IEEE80211_LINK_UNSPECIFIED || !sta || !sta->mlo,
1964                              "link:%d, sta:%pM, sta->mlo:%d\n",
1965                              link, sta ? sta->addr : NULL, sta ? sta->mlo : -1);
1966                         ieee80211_free_txskb(hw, skb);
1967                         return;
1968                 }
1969
1970                 if (sta && sta->mlo) {
1971                         if (WARN_ON(!link_sta)) {
1972                                 ieee80211_free_txskb(hw, skb);
1973                                 return;
1974                         }
1975                         /* address translation to link addresses on TX */
1976                         ether_addr_copy(hdr->addr1, link_sta->addr);
1977                         ether_addr_copy(hdr->addr2, bss_conf->addr);
1978                         /* translate A3 only if it's the BSSID */
1979                         if (!ieee80211_has_tods(hdr->frame_control) &&
1980                             !ieee80211_has_fromds(hdr->frame_control)) {
1981                                 if (ether_addr_equal(hdr->addr3, sta->addr))
1982                                         ether_addr_copy(hdr->addr3, link_sta->addr);
1983                                 else if (ether_addr_equal(hdr->addr3, vif->addr))
1984                                         ether_addr_copy(hdr->addr3, bss_conf->addr);
1985                         }
1986                         /* no need to look at A4, if present it's SA */
1987                 }
1988
1989                 chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
1990                 if (chanctx_conf) {
1991                         channel = chanctx_conf->def.chan;
1992                         confbw = chanctx_conf->def.width;
1993                 } else {
1994                         channel = NULL;
1995                 }
1996         }
1997
1998         if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
1999                 ieee80211_free_txskb(hw, skb);
2000                 return;
2001         }
2002
2003         if (data->idle && !data->tmp_chan) {
2004                 wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
2005                 ieee80211_free_txskb(hw, skb);
2006                 return;
2007         }
2008
2009         if (txi->control.vif)
2010                 hwsim_check_magic(txi->control.vif);
2011         if (control->sta)
2012                 hwsim_check_sta_magic(control->sta);
2013
2014         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2015                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
2016                                        txi->control.rates,
2017                                        ARRAY_SIZE(txi->control.rates));
2018
2019         for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
2020                 u16 rflags = txi->control.rates[i].flags;
2021                 /* initialize to data->bw for 5/10 MHz handling */
2022                 enum nl80211_chan_width bw = data->bw;
2023
2024                 if (txi->control.rates[i].idx == -1)
2025                         break;
2026
2027                 if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
2028                         bw = NL80211_CHAN_WIDTH_40;
2029                 else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
2030                         bw = NL80211_CHAN_WIDTH_80;
2031                 else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
2032                         bw = NL80211_CHAN_WIDTH_160;
2033
2034                 if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
2035                         return;
2036         }
2037
2038         if (skb->len >= 24 + 8 &&
2039             ieee80211_is_probe_resp(hdr->frame_control)) {
2040                 /* fake header transmission time */
2041                 struct ieee80211_mgmt *mgmt;
2042                 struct ieee80211_rate *txrate;
2043                 /* TODO: get MCS */
2044                 int bitrate = 100;
2045                 u64 ts;
2046
2047                 mgmt = (struct ieee80211_mgmt *)skb->data;
2048                 txrate = ieee80211_get_tx_rate(hw, txi);
2049                 if (txrate)
2050                         bitrate = txrate->bitrate;
2051                 ts = mac80211_hwsim_get_tsf_raw();
2052                 mgmt->u.probe_resp.timestamp =
2053                         cpu_to_le64(ts + data->tsf_offset +
2054                                     24 * 8 * 10 / bitrate);
2055         }
2056
2057         mac80211_hwsim_monitor_rx(hw, skb, channel);
2058
2059         /* wmediumd mode check */
2060         _portid = READ_ONCE(data->wmediumd);
2061
2062         if (_portid || hwsim_virtio_enabled)
2063                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
2064
2065         /* NO wmediumd detected, perfect medium simulation */
2066         data->tx_pkts++;
2067         data->tx_bytes += skb->len;
2068         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
2069
2070         if (ack && skb->len >= 16)
2071                 mac80211_hwsim_monitor_ack(channel, hdr->addr2);
2072
2073         ieee80211_tx_info_clear_status(txi);
2074
2075         /* frame was transmitted at most favorable rate at first attempt */
2076         txi->control.rates[0].count = 1;
2077         txi->control.rates[1].idx = -1;
2078
2079         if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
2080                 txi->flags |= IEEE80211_TX_STAT_ACK;
2081         ieee80211_tx_status_irqsafe(hw, skb);
2082 }
2083
2084
2085 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
2086 {
2087         struct mac80211_hwsim_data *data = hw->priv;
2088         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2089         data->started = true;
2090         return 0;
2091 }
2092
2093
2094 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
2095 {
2096         struct mac80211_hwsim_data *data = hw->priv;
2097         int i;
2098
2099         data->started = false;
2100
2101         for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
2102                 hrtimer_cancel(&data->link_data[i].beacon_timer);
2103
2104         while (!skb_queue_empty(&data->pending))
2105                 ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
2106
2107         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2108 }
2109
2110
2111 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
2112                                         struct ieee80211_vif *vif)
2113 {
2114         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2115                   __func__, ieee80211_vif_type_p2p(vif),
2116                   vif->addr);
2117         hwsim_set_magic(vif);
2118
2119         if (vif->type != NL80211_IFTYPE_MONITOR)
2120                 mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
2121
2122         vif->cab_queue = 0;
2123         vif->hw_queue[IEEE80211_AC_VO] = 0;
2124         vif->hw_queue[IEEE80211_AC_VI] = 1;
2125         vif->hw_queue[IEEE80211_AC_BE] = 2;
2126         vif->hw_queue[IEEE80211_AC_BK] = 3;
2127
2128         return 0;
2129 }
2130
2131
2132 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
2133                                            struct ieee80211_vif *vif,
2134                                            enum nl80211_iftype newtype,
2135                                            bool newp2p)
2136 {
2137         newtype = ieee80211_iftype_p2p(newtype, newp2p);
2138         wiphy_dbg(hw->wiphy,
2139                   "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2140                   __func__, ieee80211_vif_type_p2p(vif),
2141                     newtype, vif->addr);
2142         hwsim_check_magic(vif);
2143
2144         /*
2145          * interface may change from non-AP to AP in
2146          * which case this needs to be set up again
2147          */
2148         vif->cab_queue = 0;
2149
2150         return 0;
2151 }
2152
2153 static void mac80211_hwsim_remove_interface(
2154         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2155 {
2156         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2157                   __func__, ieee80211_vif_type_p2p(vif),
2158                   vif->addr);
2159         hwsim_check_magic(vif);
2160         hwsim_clear_magic(vif);
2161         if (vif->type != NL80211_IFTYPE_MONITOR)
2162                 mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2163 }
2164
2165 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2166                                     struct sk_buff *skb,
2167                                     struct ieee80211_channel *chan)
2168 {
2169         struct mac80211_hwsim_data *data = hw->priv;
2170         u32 _portid = READ_ONCE(data->wmediumd);
2171
2172         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2173                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2174                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2175                                        txi->control.rates,
2176                                        ARRAY_SIZE(txi->control.rates));
2177         }
2178
2179         mac80211_hwsim_monitor_rx(hw, skb, chan);
2180
2181         if (_portid || hwsim_virtio_enabled)
2182                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, chan);
2183
2184         data->tx_pkts++;
2185         data->tx_bytes += skb->len;
2186         mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2187         dev_kfree_skb(skb);
2188 }
2189
2190 static void __mac80211_hwsim_beacon_tx(struct ieee80211_bss_conf *link_conf,
2191                                        struct mac80211_hwsim_data *data,
2192                                        struct ieee80211_hw *hw,
2193                                        struct ieee80211_vif *vif,
2194                                        struct sk_buff *skb)
2195 {
2196         struct ieee80211_tx_info *info;
2197         struct ieee80211_rate *txrate;
2198         struct ieee80211_mgmt *mgmt;
2199         /* TODO: get MCS */
2200         int bitrate = 100;
2201
2202         info = IEEE80211_SKB_CB(skb);
2203         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2204                 ieee80211_get_tx_rates(vif, NULL, skb,
2205                                        info->control.rates,
2206                                        ARRAY_SIZE(info->control.rates));
2207
2208         txrate = ieee80211_get_tx_rate(hw, info);
2209         if (txrate)
2210                 bitrate = txrate->bitrate;
2211
2212         mgmt = (struct ieee80211_mgmt *) skb->data;
2213         /* fake header transmission time */
2214         data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
2215         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2216                 struct ieee80211_ext *ext = (void *) mgmt;
2217
2218                 ext->u.s1g_beacon.timestamp = cpu_to_le32(data->abs_bcn_ts +
2219                                                           data->tsf_offset +
2220                                                           10 * 8 * 10 /
2221                                                           bitrate);
2222         } else {
2223                 mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
2224                                                        data->tsf_offset +
2225                                                        24 * 8 * 10 /
2226                                                        bitrate);
2227         }
2228
2229         mac80211_hwsim_tx_frame(hw, skb,
2230                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2231 }
2232
2233 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2234                                      struct ieee80211_vif *vif)
2235 {
2236         struct mac80211_hwsim_link_data *link_data = arg;
2237         u32 link_id = link_data->link_id;
2238         struct ieee80211_bss_conf *link_conf;
2239         struct mac80211_hwsim_data *data =
2240                 container_of(link_data, struct mac80211_hwsim_data,
2241                              link_data[link_id]);
2242         struct ieee80211_hw *hw = data->hw;
2243         struct sk_buff *skb;
2244
2245         hwsim_check_magic(vif);
2246
2247         link_conf = rcu_dereference(vif->link_conf[link_id]);
2248         if (!link_conf)
2249                 return;
2250
2251         if (vif->type != NL80211_IFTYPE_AP &&
2252             vif->type != NL80211_IFTYPE_MESH_POINT &&
2253             vif->type != NL80211_IFTYPE_ADHOC &&
2254             vif->type != NL80211_IFTYPE_OCB)
2255                 return;
2256
2257         if (vif->mbssid_tx_vif && vif->mbssid_tx_vif != vif)
2258                 return;
2259
2260         if (vif->bss_conf.ema_ap) {
2261                 struct ieee80211_ema_beacons *ema;
2262                 u8 i = 0;
2263
2264                 ema = ieee80211_beacon_get_template_ema_list(hw, vif, link_id);
2265                 if (!ema || !ema->cnt)
2266                         return;
2267
2268                 for (i = 0; i < ema->cnt; i++) {
2269                         __mac80211_hwsim_beacon_tx(link_conf, data, hw, vif,
2270                                                    ema->bcn[i].skb);
2271                         ema->bcn[i].skb = NULL; /* Already freed */
2272                 }
2273                 ieee80211_beacon_free_ema_list(ema);
2274         } else {
2275                 skb = ieee80211_beacon_get(hw, vif, link_id);
2276                 if (!skb)
2277                         return;
2278
2279                 __mac80211_hwsim_beacon_tx(link_conf, data, hw, vif, skb);
2280         }
2281
2282         while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2283                 mac80211_hwsim_tx_frame(hw, skb,
2284                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2285         }
2286
2287         if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif))
2288                 ieee80211_csa_finish(vif);
2289 }
2290
2291 static enum hrtimer_restart
2292 mac80211_hwsim_beacon(struct hrtimer *timer)
2293 {
2294         struct mac80211_hwsim_link_data *link_data =
2295                 container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2296         struct mac80211_hwsim_data *data =
2297                 container_of(link_data, struct mac80211_hwsim_data,
2298                              link_data[link_data->link_id]);
2299         struct ieee80211_hw *hw = data->hw;
2300         u64 bcn_int = link_data->beacon_int;
2301
2302         if (!data->started)
2303                 return HRTIMER_NORESTART;
2304
2305         ieee80211_iterate_active_interfaces_atomic(
2306                 hw, IEEE80211_IFACE_ITER_NORMAL,
2307                 mac80211_hwsim_beacon_tx, link_data);
2308
2309         /* beacon at new TBTT + beacon interval */
2310         if (data->bcn_delta) {
2311                 bcn_int -= data->bcn_delta;
2312                 data->bcn_delta = 0;
2313         }
2314         hrtimer_forward_now(&link_data->beacon_timer,
2315                             ns_to_ktime(bcn_int * NSEC_PER_USEC));
2316         return HRTIMER_RESTART;
2317 }
2318
2319 static const char * const hwsim_chanwidths[] = {
2320         [NL80211_CHAN_WIDTH_5] = "ht5",
2321         [NL80211_CHAN_WIDTH_10] = "ht10",
2322         [NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2323         [NL80211_CHAN_WIDTH_20] = "ht20",
2324         [NL80211_CHAN_WIDTH_40] = "ht40",
2325         [NL80211_CHAN_WIDTH_80] = "vht80",
2326         [NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2327         [NL80211_CHAN_WIDTH_160] = "vht160",
2328         [NL80211_CHAN_WIDTH_1] = "1MHz",
2329         [NL80211_CHAN_WIDTH_2] = "2MHz",
2330         [NL80211_CHAN_WIDTH_4] = "4MHz",
2331         [NL80211_CHAN_WIDTH_8] = "8MHz",
2332         [NL80211_CHAN_WIDTH_16] = "16MHz",
2333 };
2334
2335 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
2336 {
2337         struct mac80211_hwsim_data *data = hw->priv;
2338         struct ieee80211_conf *conf = &hw->conf;
2339         static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2340                 [IEEE80211_SMPS_AUTOMATIC] = "auto",
2341                 [IEEE80211_SMPS_OFF] = "off",
2342                 [IEEE80211_SMPS_STATIC] = "static",
2343                 [IEEE80211_SMPS_DYNAMIC] = "dynamic",
2344         };
2345         int idx;
2346
2347         if (conf->chandef.chan)
2348                 wiphy_dbg(hw->wiphy,
2349                           "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2350                           __func__,
2351                           conf->chandef.chan->center_freq,
2352                           conf->chandef.center_freq1,
2353                           conf->chandef.center_freq2,
2354                           hwsim_chanwidths[conf->chandef.width],
2355                           !!(conf->flags & IEEE80211_CONF_IDLE),
2356                           !!(conf->flags & IEEE80211_CONF_PS),
2357                           smps_modes[conf->smps_mode]);
2358         else
2359                 wiphy_dbg(hw->wiphy,
2360                           "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2361                           __func__,
2362                           !!(conf->flags & IEEE80211_CONF_IDLE),
2363                           !!(conf->flags & IEEE80211_CONF_PS),
2364                           smps_modes[conf->smps_mode]);
2365
2366         data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2367
2368         WARN_ON(conf->chandef.chan && data->use_chanctx);
2369
2370         mutex_lock(&data->mutex);
2371         if (data->scanning && conf->chandef.chan) {
2372                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2373                         if (data->survey_data[idx].channel == data->channel) {
2374                                 data->survey_data[idx].start =
2375                                         data->survey_data[idx].next_start;
2376                                 data->survey_data[idx].end = jiffies;
2377                                 break;
2378                         }
2379                 }
2380
2381                 data->channel = conf->chandef.chan;
2382                 data->bw = conf->chandef.width;
2383
2384                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2385                         if (data->survey_data[idx].channel &&
2386                             data->survey_data[idx].channel != data->channel)
2387                                 continue;
2388                         data->survey_data[idx].channel = data->channel;
2389                         data->survey_data[idx].next_start = jiffies;
2390                         break;
2391                 }
2392         } else {
2393                 data->channel = conf->chandef.chan;
2394                 data->bw = conf->chandef.width;
2395         }
2396         mutex_unlock(&data->mutex);
2397
2398         for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2399                 struct mac80211_hwsim_link_data *link_data =
2400                         &data->link_data[idx];
2401
2402                 if (!data->started || !link_data->beacon_int) {
2403                         hrtimer_cancel(&link_data->beacon_timer);
2404                 } else if (!hrtimer_is_queued(&link_data->beacon_timer)) {
2405                         u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2406                         u32 bcn_int = link_data->beacon_int;
2407                         u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2408
2409                         hrtimer_start(&link_data->beacon_timer,
2410                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2411                                       HRTIMER_MODE_REL_SOFT);
2412                 }
2413         }
2414
2415         return 0;
2416 }
2417
2418
2419 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2420                                             unsigned int changed_flags,
2421                                             unsigned int *total_flags,u64 multicast)
2422 {
2423         struct mac80211_hwsim_data *data = hw->priv;
2424
2425         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2426
2427         data->rx_filter = 0;
2428         if (*total_flags & FIF_ALLMULTI)
2429                 data->rx_filter |= FIF_ALLMULTI;
2430         if (*total_flags & FIF_MCAST_ACTION)
2431                 data->rx_filter |= FIF_MCAST_ACTION;
2432
2433         *total_flags = data->rx_filter;
2434 }
2435
2436 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2437                                        struct ieee80211_vif *vif)
2438 {
2439         unsigned int *count = data;
2440         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2441
2442         if (vp->bcn_en)
2443                 (*count)++;
2444 }
2445
2446 static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2447                                             struct ieee80211_vif *vif,
2448                                             u64 changed)
2449 {
2450         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2451
2452         hwsim_check_magic(vif);
2453
2454         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2455                   __func__, changed, vif->addr);
2456
2457         if (changed & BSS_CHANGED_ASSOC) {
2458                 wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2459                           vif->cfg.assoc, vif->cfg.aid);
2460                 vp->assoc = vif->cfg.assoc;
2461                 vp->aid = vif->cfg.aid;
2462         }
2463
2464         if (vif->type == NL80211_IFTYPE_STATION &&
2465             changed & BSS_CHANGED_MLD_VALID_LINKS) {
2466                 u16 usable_links = ieee80211_vif_usable_links(vif);
2467
2468                 if (vif->active_links != usable_links)
2469                         ieee80211_set_active_links_async(vif, usable_links);
2470         }
2471 }
2472
2473 static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2474                                              struct ieee80211_vif *vif,
2475                                              struct ieee80211_bss_conf *info,
2476                                              u64 changed)
2477 {
2478         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2479         struct mac80211_hwsim_data *data = hw->priv;
2480         unsigned int link_id = info->link_id;
2481         struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2482
2483         hwsim_check_magic(vif);
2484
2485         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2486                   __func__, (unsigned long long)changed, vif->addr, link_id);
2487
2488         if (changed & BSS_CHANGED_BSSID) {
2489                 wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2490                           __func__, info->bssid);
2491                 memcpy(vp->bssid, info->bssid, ETH_ALEN);
2492         }
2493
2494         if (changed & BSS_CHANGED_BEACON_ENABLED) {
2495                 wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2496                           info->enable_beacon, info->beacon_int);
2497                 vp->bcn_en = info->enable_beacon;
2498                 if (data->started &&
2499                     !hrtimer_is_queued(&link_data->beacon_timer) &&
2500                     info->enable_beacon) {
2501                         u64 tsf, until_tbtt;
2502                         u32 bcn_int;
2503                         link_data->beacon_int = info->beacon_int * 1024;
2504                         tsf = mac80211_hwsim_get_tsf(hw, vif);
2505                         bcn_int = link_data->beacon_int;
2506                         until_tbtt = bcn_int - do_div(tsf, bcn_int);
2507
2508                         hrtimer_start(&link_data->beacon_timer,
2509                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2510                                       HRTIMER_MODE_REL_SOFT);
2511                 } else if (!info->enable_beacon) {
2512                         unsigned int count = 0;
2513                         ieee80211_iterate_active_interfaces_atomic(
2514                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
2515                                 mac80211_hwsim_bcn_en_iter, &count);
2516                         wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2517                                   count);
2518                         if (count == 0) {
2519                                 hrtimer_cancel(&link_data->beacon_timer);
2520                                 link_data->beacon_int = 0;
2521                         }
2522                 }
2523         }
2524
2525         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2526                 wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2527                           info->use_cts_prot);
2528         }
2529
2530         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2531                 wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2532                           info->use_short_preamble);
2533         }
2534
2535         if (changed & BSS_CHANGED_ERP_SLOT) {
2536                 wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2537         }
2538
2539         if (changed & BSS_CHANGED_HT) {
2540                 wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2541                           info->ht_operation_mode);
2542         }
2543
2544         if (changed & BSS_CHANGED_BASIC_RATES) {
2545                 wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2546                           (unsigned long long) info->basic_rates);
2547         }
2548
2549         if (changed & BSS_CHANGED_TXPOWER)
2550                 wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2551 }
2552
2553 static void
2554 mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2555                              struct ieee80211_vif *vif,
2556                              struct ieee80211_sta *sta,
2557                              u32 changed)
2558 {
2559         struct mac80211_hwsim_data *data = hw->priv;
2560         u32 bw = U32_MAX;
2561         int link_id;
2562
2563         rcu_read_lock();
2564         for (link_id = 0;
2565              link_id < ARRAY_SIZE(vif->link_conf);
2566              link_id++) {
2567                 enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2568                 struct ieee80211_bss_conf *vif_conf;
2569                 struct ieee80211_link_sta *link_sta;
2570
2571                 link_sta = rcu_dereference(sta->link[link_id]);
2572
2573                 if (!link_sta)
2574                         continue;
2575
2576                 switch (link_sta->bandwidth) {
2577 #define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2578                 C(20);
2579                 C(40);
2580                 C(80);
2581                 C(160);
2582                 C(320);
2583 #undef C
2584                 }
2585
2586                 if (!data->use_chanctx) {
2587                         confbw = data->bw;
2588                 } else {
2589                         struct ieee80211_chanctx_conf *chanctx_conf;
2590
2591                         vif_conf = rcu_dereference(vif->link_conf[link_id]);
2592                         if (WARN_ON(!vif_conf))
2593                                 continue;
2594
2595                         chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2596
2597                         if (!WARN_ON(!chanctx_conf))
2598                                 confbw = chanctx_conf->def.width;
2599                 }
2600
2601                 WARN(bw > hwsim_get_chanwidth(confbw),
2602                      "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2603                      vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2604                      hwsim_get_chanwidth(data->bw), data->bw);
2605
2606
2607         }
2608         rcu_read_unlock();
2609
2610
2611 }
2612
2613 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2614                                   struct ieee80211_vif *vif,
2615                                   struct ieee80211_sta *sta)
2616 {
2617         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2618
2619         hwsim_check_magic(vif);
2620         hwsim_set_sta_magic(sta);
2621         mac80211_hwsim_sta_rc_update(hw, vif, sta, 0);
2622
2623         if (sta->valid_links) {
2624                 WARN(hweight16(sta->valid_links) > 1,
2625                      "expect to add STA with single link, have 0x%x\n",
2626                      sta->valid_links);
2627                 sp->active_links_rx = sta->valid_links;
2628         }
2629
2630         return 0;
2631 }
2632
2633 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2634                                      struct ieee80211_vif *vif,
2635                                      struct ieee80211_sta *sta)
2636 {
2637         hwsim_check_magic(vif);
2638         hwsim_clear_sta_magic(sta);
2639
2640         return 0;
2641 }
2642
2643 static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2644                                     struct ieee80211_vif *vif,
2645                                     struct ieee80211_sta *sta,
2646                                     enum ieee80211_sta_state old_state,
2647                                     enum ieee80211_sta_state new_state)
2648 {
2649         if (new_state == IEEE80211_STA_NOTEXIST)
2650                 return mac80211_hwsim_sta_remove(hw, vif, sta);
2651
2652         if (old_state == IEEE80211_STA_NOTEXIST)
2653                 return mac80211_hwsim_sta_add(hw, vif, sta);
2654
2655         /*
2656          * when client is authorized (AP station marked as such),
2657          * enable all links
2658          */
2659         if (vif->type == NL80211_IFTYPE_STATION &&
2660             new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2661                 ieee80211_set_active_links_async(vif,
2662                                                  ieee80211_vif_usable_links(vif));
2663
2664         return 0;
2665 }
2666
2667 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2668                                       struct ieee80211_vif *vif,
2669                                       enum sta_notify_cmd cmd,
2670                                       struct ieee80211_sta *sta)
2671 {
2672         hwsim_check_magic(vif);
2673
2674         switch (cmd) {
2675         case STA_NOTIFY_SLEEP:
2676         case STA_NOTIFY_AWAKE:
2677                 /* TODO: make good use of these flags */
2678                 break;
2679         default:
2680                 WARN(1, "Invalid sta notify: %d\n", cmd);
2681                 break;
2682         }
2683 }
2684
2685 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2686                                   struct ieee80211_sta *sta,
2687                                   bool set)
2688 {
2689         hwsim_check_sta_magic(sta);
2690         return 0;
2691 }
2692
2693 static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2694                                   struct ieee80211_vif *vif,
2695                                   unsigned int link_id, u16 queue,
2696                                   const struct ieee80211_tx_queue_params *params)
2697 {
2698         wiphy_dbg(hw->wiphy,
2699                   "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2700                   __func__, queue,
2701                   params->txop, params->cw_min,
2702                   params->cw_max, params->aifs);
2703         return 0;
2704 }
2705
2706 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2707                                      struct survey_info *survey)
2708 {
2709         struct mac80211_hwsim_data *hwsim = hw->priv;
2710
2711         if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2712                 return -ENOENT;
2713
2714         mutex_lock(&hwsim->mutex);
2715         survey->channel = hwsim->survey_data[idx].channel;
2716         if (!survey->channel) {
2717                 mutex_unlock(&hwsim->mutex);
2718                 return -ENOENT;
2719         }
2720
2721         /*
2722          * Magically conjured dummy values --- this is only ok for simulated hardware.
2723          *
2724          * A real driver which cannot determine real values noise MUST NOT
2725          * report any, especially not a magically conjured ones :-)
2726          */
2727         survey->filled = SURVEY_INFO_NOISE_DBM |
2728                          SURVEY_INFO_TIME |
2729                          SURVEY_INFO_TIME_BUSY;
2730         survey->noise = -92;
2731         survey->time =
2732                 jiffies_to_msecs(hwsim->survey_data[idx].end -
2733                                  hwsim->survey_data[idx].start);
2734         /* report 12.5% of channel time is used */
2735         survey->time_busy = survey->time/8;
2736         mutex_unlock(&hwsim->mutex);
2737
2738         return 0;
2739 }
2740
2741 #ifdef CONFIG_NL80211_TESTMODE
2742 /*
2743  * This section contains example code for using netlink
2744  * attributes with the testmode command in nl80211.
2745  */
2746
2747 /* These enums need to be kept in sync with userspace */
2748 enum hwsim_testmode_attr {
2749         __HWSIM_TM_ATTR_INVALID = 0,
2750         HWSIM_TM_ATTR_CMD       = 1,
2751         HWSIM_TM_ATTR_PS        = 2,
2752
2753         /* keep last */
2754         __HWSIM_TM_ATTR_AFTER_LAST,
2755         HWSIM_TM_ATTR_MAX       = __HWSIM_TM_ATTR_AFTER_LAST - 1
2756 };
2757
2758 enum hwsim_testmode_cmd {
2759         HWSIM_TM_CMD_SET_PS             = 0,
2760         HWSIM_TM_CMD_GET_PS             = 1,
2761         HWSIM_TM_CMD_STOP_QUEUES        = 2,
2762         HWSIM_TM_CMD_WAKE_QUEUES        = 3,
2763 };
2764
2765 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2766         [HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2767         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2768 };
2769
2770 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2771                                        struct ieee80211_vif *vif,
2772                                        void *data, int len)
2773 {
2774         struct mac80211_hwsim_data *hwsim = hw->priv;
2775         struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2776         struct sk_buff *skb;
2777         int err, ps;
2778
2779         err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2780                                    hwsim_testmode_policy, NULL);
2781         if (err)
2782                 return err;
2783
2784         if (!tb[HWSIM_TM_ATTR_CMD])
2785                 return -EINVAL;
2786
2787         switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2788         case HWSIM_TM_CMD_SET_PS:
2789                 if (!tb[HWSIM_TM_ATTR_PS])
2790                         return -EINVAL;
2791                 ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2792                 return hwsim_fops_ps_write(hwsim, ps);
2793         case HWSIM_TM_CMD_GET_PS:
2794                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2795                                                 nla_total_size(sizeof(u32)));
2796                 if (!skb)
2797                         return -ENOMEM;
2798                 if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2799                         goto nla_put_failure;
2800                 return cfg80211_testmode_reply(skb);
2801         case HWSIM_TM_CMD_STOP_QUEUES:
2802                 ieee80211_stop_queues(hw);
2803                 return 0;
2804         case HWSIM_TM_CMD_WAKE_QUEUES:
2805                 ieee80211_wake_queues(hw);
2806                 return 0;
2807         default:
2808                 return -EOPNOTSUPP;
2809         }
2810
2811  nla_put_failure:
2812         kfree_skb(skb);
2813         return -ENOBUFS;
2814 }
2815 #endif
2816
2817 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2818                                        struct ieee80211_vif *vif,
2819                                        struct ieee80211_ampdu_params *params)
2820 {
2821         struct ieee80211_sta *sta = params->sta;
2822         enum ieee80211_ampdu_mlme_action action = params->action;
2823         u16 tid = params->tid;
2824
2825         switch (action) {
2826         case IEEE80211_AMPDU_TX_START:
2827                 return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2828         case IEEE80211_AMPDU_TX_STOP_CONT:
2829         case IEEE80211_AMPDU_TX_STOP_FLUSH:
2830         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2831                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2832                 break;
2833         case IEEE80211_AMPDU_TX_OPERATIONAL:
2834                 break;
2835         case IEEE80211_AMPDU_RX_START:
2836         case IEEE80211_AMPDU_RX_STOP:
2837                 break;
2838         default:
2839                 return -EOPNOTSUPP;
2840         }
2841
2842         return 0;
2843 }
2844
2845 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2846                                  struct ieee80211_vif *vif,
2847                                  u32 queues, bool drop)
2848 {
2849         /* Not implemented, queues only on kernel side */
2850 }
2851
2852 static void hw_scan_work(struct work_struct *work)
2853 {
2854         struct mac80211_hwsim_data *hwsim =
2855                 container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2856         struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2857         int dwell, i;
2858
2859         mutex_lock(&hwsim->mutex);
2860         if (hwsim->scan_chan_idx >= req->n_channels) {
2861                 struct cfg80211_scan_info info = {
2862                         .aborted = false,
2863                 };
2864
2865                 wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2866                 ieee80211_scan_completed(hwsim->hw, &info);
2867                 hwsim->hw_scan_request = NULL;
2868                 hwsim->hw_scan_vif = NULL;
2869                 hwsim->tmp_chan = NULL;
2870                 mutex_unlock(&hwsim->mutex);
2871                 mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2872                                              false);
2873                 return;
2874         }
2875
2876         wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2877                   req->channels[hwsim->scan_chan_idx]->center_freq);
2878
2879         hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2880         if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2881                                       IEEE80211_CHAN_RADAR) ||
2882             !req->n_ssids) {
2883                 dwell = 120;
2884         } else {
2885                 dwell = 30;
2886                 /* send probes */
2887                 for (i = 0; i < req->n_ssids; i++) {
2888                         struct sk_buff *probe;
2889                         struct ieee80211_mgmt *mgmt;
2890
2891                         probe = ieee80211_probereq_get(hwsim->hw,
2892                                                        hwsim->scan_addr,
2893                                                        req->ssids[i].ssid,
2894                                                        req->ssids[i].ssid_len,
2895                                                        req->ie_len);
2896                         if (!probe)
2897                                 continue;
2898
2899                         mgmt = (struct ieee80211_mgmt *) probe->data;
2900                         memcpy(mgmt->da, req->bssid, ETH_ALEN);
2901                         memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2902
2903                         if (req->ie_len)
2904                                 skb_put_data(probe, req->ie, req->ie_len);
2905
2906                         rcu_read_lock();
2907                         if (!ieee80211_tx_prepare_skb(hwsim->hw,
2908                                                       hwsim->hw_scan_vif,
2909                                                       probe,
2910                                                       hwsim->tmp_chan->band,
2911                                                       NULL)) {
2912                                 rcu_read_unlock();
2913                                 kfree_skb(probe);
2914                                 continue;
2915                         }
2916
2917                         local_bh_disable();
2918                         mac80211_hwsim_tx_frame(hwsim->hw, probe,
2919                                                 hwsim->tmp_chan);
2920                         rcu_read_unlock();
2921                         local_bh_enable();
2922                 }
2923         }
2924         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2925                                      msecs_to_jiffies(dwell));
2926         hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2927         hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2928         hwsim->survey_data[hwsim->scan_chan_idx].end =
2929                 jiffies + msecs_to_jiffies(dwell);
2930         hwsim->scan_chan_idx++;
2931         mutex_unlock(&hwsim->mutex);
2932 }
2933
2934 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2935                                   struct ieee80211_vif *vif,
2936                                   struct ieee80211_scan_request *hw_req)
2937 {
2938         struct mac80211_hwsim_data *hwsim = hw->priv;
2939         struct cfg80211_scan_request *req = &hw_req->req;
2940
2941         mutex_lock(&hwsim->mutex);
2942         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2943                 mutex_unlock(&hwsim->mutex);
2944                 return -EBUSY;
2945         }
2946         hwsim->hw_scan_request = req;
2947         hwsim->hw_scan_vif = vif;
2948         hwsim->scan_chan_idx = 0;
2949         if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2950                 get_random_mask_addr(hwsim->scan_addr,
2951                                      hw_req->req.mac_addr,
2952                                      hw_req->req.mac_addr_mask);
2953         else
2954                 memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
2955         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2956         mutex_unlock(&hwsim->mutex);
2957
2958         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2959         wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
2960
2961         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
2962
2963         return 0;
2964 }
2965
2966 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
2967                                           struct ieee80211_vif *vif)
2968 {
2969         struct mac80211_hwsim_data *hwsim = hw->priv;
2970         struct cfg80211_scan_info info = {
2971                 .aborted = true,
2972         };
2973
2974         wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
2975
2976         cancel_delayed_work_sync(&hwsim->hw_scan);
2977
2978         mutex_lock(&hwsim->mutex);
2979         ieee80211_scan_completed(hwsim->hw, &info);
2980         hwsim->tmp_chan = NULL;
2981         hwsim->hw_scan_request = NULL;
2982         hwsim->hw_scan_vif = NULL;
2983         mutex_unlock(&hwsim->mutex);
2984 }
2985
2986 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
2987                                    struct ieee80211_vif *vif,
2988                                    const u8 *mac_addr)
2989 {
2990         struct mac80211_hwsim_data *hwsim = hw->priv;
2991
2992         mutex_lock(&hwsim->mutex);
2993
2994         if (hwsim->scanning) {
2995                 pr_debug("two hwsim sw_scans detected!\n");
2996                 goto out;
2997         }
2998
2999         pr_debug("hwsim sw_scan request, prepping stuff\n");
3000
3001         memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
3002         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
3003         hwsim->scanning = true;
3004         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
3005
3006 out:
3007         mutex_unlock(&hwsim->mutex);
3008 }
3009
3010 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
3011                                             struct ieee80211_vif *vif)
3012 {
3013         struct mac80211_hwsim_data *hwsim = hw->priv;
3014
3015         mutex_lock(&hwsim->mutex);
3016
3017         pr_debug("hwsim sw_scan_complete\n");
3018         hwsim->scanning = false;
3019         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
3020         eth_zero_addr(hwsim->scan_addr);
3021
3022         mutex_unlock(&hwsim->mutex);
3023 }
3024
3025 static void hw_roc_start(struct work_struct *work)
3026 {
3027         struct mac80211_hwsim_data *hwsim =
3028                 container_of(work, struct mac80211_hwsim_data, roc_start.work);
3029
3030         mutex_lock(&hwsim->mutex);
3031
3032         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
3033         hwsim->tmp_chan = hwsim->roc_chan;
3034         ieee80211_ready_on_channel(hwsim->hw);
3035
3036         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
3037                                      msecs_to_jiffies(hwsim->roc_duration));
3038
3039         mutex_unlock(&hwsim->mutex);
3040 }
3041
3042 static void hw_roc_done(struct work_struct *work)
3043 {
3044         struct mac80211_hwsim_data *hwsim =
3045                 container_of(work, struct mac80211_hwsim_data, roc_done.work);
3046
3047         mutex_lock(&hwsim->mutex);
3048         ieee80211_remain_on_channel_expired(hwsim->hw);
3049         hwsim->tmp_chan = NULL;
3050         mutex_unlock(&hwsim->mutex);
3051
3052         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
3053 }
3054
3055 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
3056                               struct ieee80211_vif *vif,
3057                               struct ieee80211_channel *chan,
3058                               int duration,
3059                               enum ieee80211_roc_type type)
3060 {
3061         struct mac80211_hwsim_data *hwsim = hw->priv;
3062
3063         mutex_lock(&hwsim->mutex);
3064         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
3065                 mutex_unlock(&hwsim->mutex);
3066                 return -EBUSY;
3067         }
3068
3069         hwsim->roc_chan = chan;
3070         hwsim->roc_duration = duration;
3071         mutex_unlock(&hwsim->mutex);
3072
3073         wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
3074                   chan->center_freq, duration);
3075         ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
3076
3077         return 0;
3078 }
3079
3080 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
3081                                struct ieee80211_vif *vif)
3082 {
3083         struct mac80211_hwsim_data *hwsim = hw->priv;
3084
3085         cancel_delayed_work_sync(&hwsim->roc_start);
3086         cancel_delayed_work_sync(&hwsim->roc_done);
3087
3088         mutex_lock(&hwsim->mutex);
3089         hwsim->tmp_chan = NULL;
3090         mutex_unlock(&hwsim->mutex);
3091
3092         wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
3093
3094         return 0;
3095 }
3096
3097 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
3098                                       struct ieee80211_chanctx_conf *ctx)
3099 {
3100         hwsim_set_chanctx_magic(ctx);
3101         wiphy_dbg(hw->wiphy,
3102                   "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3103                   ctx->def.chan->center_freq, ctx->def.width,
3104                   ctx->def.center_freq1, ctx->def.center_freq2);
3105         return 0;
3106 }
3107
3108 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
3109                                           struct ieee80211_chanctx_conf *ctx)
3110 {
3111         wiphy_dbg(hw->wiphy,
3112                   "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3113                   ctx->def.chan->center_freq, ctx->def.width,
3114                   ctx->def.center_freq1, ctx->def.center_freq2);
3115         hwsim_check_chanctx_magic(ctx);
3116         hwsim_clear_chanctx_magic(ctx);
3117 }
3118
3119 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
3120                                           struct ieee80211_chanctx_conf *ctx,
3121                                           u32 changed)
3122 {
3123         hwsim_check_chanctx_magic(ctx);
3124         wiphy_dbg(hw->wiphy,
3125                   "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3126                   ctx->def.chan->center_freq, ctx->def.width,
3127                   ctx->def.center_freq1, ctx->def.center_freq2);
3128 }
3129
3130 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
3131                                              struct ieee80211_vif *vif,
3132                                              struct ieee80211_bss_conf *link_conf,
3133                                              struct ieee80211_chanctx_conf *ctx)
3134 {
3135         hwsim_check_magic(vif);
3136         hwsim_check_chanctx_magic(ctx);
3137
3138         /* if we activate a link while already associated wake it up */
3139         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3140                 struct sk_buff *skb;
3141
3142                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3143                 if (skb) {
3144                         local_bh_disable();
3145                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3146                         local_bh_enable();
3147                 }
3148         }
3149
3150         return 0;
3151 }
3152
3153 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
3154                                                 struct ieee80211_vif *vif,
3155                                                 struct ieee80211_bss_conf *link_conf,
3156                                                 struct ieee80211_chanctx_conf *ctx)
3157 {
3158         hwsim_check_magic(vif);
3159         hwsim_check_chanctx_magic(ctx);
3160
3161         /* if we deactivate a link while associated suspend it first */
3162         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3163                 struct sk_buff *skb;
3164
3165                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3166                 if (skb) {
3167                         struct ieee80211_hdr *hdr = (void *)skb->data;
3168
3169                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
3170
3171                         local_bh_disable();
3172                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3173                         local_bh_enable();
3174                 }
3175         }
3176 }
3177
3178 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3179         "tx_pkts_nic",
3180         "tx_bytes_nic",
3181         "rx_pkts_nic",
3182         "rx_bytes_nic",
3183         "d_tx_dropped",
3184         "d_tx_failed",
3185         "d_ps_mode",
3186         "d_group",
3187 };
3188
3189 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3190
3191 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3192                                           struct ieee80211_vif *vif,
3193                                           u32 sset, u8 *data)
3194 {
3195         if (sset == ETH_SS_STATS)
3196                 memcpy(data, mac80211_hwsim_gstrings_stats,
3197                        sizeof(mac80211_hwsim_gstrings_stats));
3198 }
3199
3200 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3201                                             struct ieee80211_vif *vif, int sset)
3202 {
3203         if (sset == ETH_SS_STATS)
3204                 return MAC80211_HWSIM_SSTATS_LEN;
3205         return 0;
3206 }
3207
3208 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3209                                         struct ieee80211_vif *vif,
3210                                         struct ethtool_stats *stats, u64 *data)
3211 {
3212         struct mac80211_hwsim_data *ar = hw->priv;
3213         int i = 0;
3214
3215         data[i++] = ar->tx_pkts;
3216         data[i++] = ar->tx_bytes;
3217         data[i++] = ar->rx_pkts;
3218         data[i++] = ar->rx_bytes;
3219         data[i++] = ar->tx_dropped;
3220         data[i++] = ar->tx_failed;
3221         data[i++] = ar->ps;
3222         data[i++] = ar->group;
3223
3224         WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3225 }
3226
3227 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3228 {
3229         return 1;
3230 }
3231
3232 static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3233 {
3234         return -EOPNOTSUPP;
3235 }
3236
3237 static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3238                                            struct ieee80211_vif *vif,
3239                                            u16 old_links, u16 new_links,
3240                                            struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3241 {
3242         unsigned long rem = old_links & ~new_links;
3243         unsigned long add = new_links & ~old_links;
3244         int i;
3245
3246         if (!old_links)
3247                 rem |= BIT(0);
3248         if (!new_links)
3249                 add |= BIT(0);
3250
3251         for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS)
3252                 mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3253
3254         for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3255                 struct ieee80211_bss_conf *link_conf;
3256
3257                 link_conf = link_conf_dereference_protected(vif, i);
3258                 if (WARN_ON(!link_conf))
3259                         continue;
3260
3261                 mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3262         }
3263
3264         return 0;
3265 }
3266
3267 static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3268                                            struct ieee80211_vif *vif,
3269                                            struct ieee80211_sta *sta,
3270                                            u16 old_links, u16 new_links)
3271 {
3272         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3273
3274         hwsim_check_sta_magic(sta);
3275
3276         if (vif->type == NL80211_IFTYPE_STATION)
3277                 sp->active_links_rx = new_links;
3278
3279         return 0;
3280 }
3281
3282 static int mac80211_hwsim_send_pmsr_ftm_request_peer(struct sk_buff *msg,
3283                                                      struct cfg80211_pmsr_ftm_request_peer *request)
3284 {
3285         struct nlattr *ftm;
3286
3287         if (!request->requested)
3288                 return -EINVAL;
3289
3290         ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
3291         if (!ftm)
3292                 return -ENOBUFS;
3293
3294         if (nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE, request->preamble))
3295                 return -ENOBUFS;
3296
3297         if (nla_put_u16(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD, request->burst_period))
3298                 return -ENOBUFS;
3299
3300         if (request->asap && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_ASAP))
3301                 return -ENOBUFS;
3302
3303         if (request->request_lci && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI))
3304                 return -ENOBUFS;
3305
3306         if (request->request_civicloc &&
3307             nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC))
3308                 return -ENOBUFS;
3309
3310         if (request->trigger_based && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED))
3311                 return -ENOBUFS;
3312
3313         if (request->non_trigger_based &&
3314             nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED))
3315                 return -ENOBUFS;
3316
3317         if (request->lmr_feedback && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK))
3318                 return -ENOBUFS;
3319
3320         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP, request->num_bursts_exp))
3321                 return -ENOBUFS;
3322
3323         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3324                 return -ENOBUFS;
3325
3326         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST, request->ftms_per_burst))
3327                 return -ENOBUFS;
3328
3329         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES, request->ftmr_retries))
3330                 return -ENOBUFS;
3331
3332         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3333                 return -ENOBUFS;
3334
3335         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, request->bss_color))
3336                 return -ENOBUFS;
3337
3338         nla_nest_end(msg, ftm);
3339
3340         return 0;
3341 }
3342
3343 static int mac80211_hwsim_send_pmsr_request_peer(struct sk_buff *msg,
3344                                                  struct cfg80211_pmsr_request_peer *request)
3345 {
3346         struct nlattr *peer, *chandef, *req, *data;
3347         int err;
3348
3349         peer = nla_nest_start(msg, NL80211_PMSR_ATTR_PEERS);
3350         if (!peer)
3351                 return -ENOBUFS;
3352
3353         if (nla_put(msg, NL80211_PMSR_PEER_ATTR_ADDR, ETH_ALEN,
3354                     request->addr))
3355                 return -ENOBUFS;
3356
3357         chandef = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_CHAN);
3358         if (!chandef)
3359                 return -ENOBUFS;
3360
3361         err = nl80211_send_chandef(msg, &request->chandef);
3362         if (err)
3363                 return err;
3364
3365         nla_nest_end(msg, chandef);
3366
3367         req = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_REQ);
3368         if (!req)
3369                 return -ENOBUFS;
3370
3371         if (request->report_ap_tsf && nla_put_flag(msg, NL80211_PMSR_REQ_ATTR_GET_AP_TSF))
3372                 return -ENOBUFS;
3373
3374         data = nla_nest_start(msg, NL80211_PMSR_REQ_ATTR_DATA);
3375         if (!data)
3376                 return -ENOBUFS;
3377
3378         err = mac80211_hwsim_send_pmsr_ftm_request_peer(msg, &request->ftm);
3379         if (err)
3380                 return err;
3381
3382         nla_nest_end(msg, data);
3383         nla_nest_end(msg, req);
3384         nla_nest_end(msg, peer);
3385
3386         return 0;
3387 }
3388
3389 static int mac80211_hwsim_send_pmsr_request(struct sk_buff *msg,
3390                                             struct cfg80211_pmsr_request *request)
3391 {
3392         struct nlattr *pmsr;
3393         int err;
3394
3395         pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
3396         if (!pmsr)
3397                 return -ENOBUFS;
3398
3399         if (nla_put_u32(msg, NL80211_ATTR_TIMEOUT, request->timeout))
3400                 return -ENOBUFS;
3401
3402         if (!is_zero_ether_addr(request->mac_addr)) {
3403                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, request->mac_addr))
3404                         return -ENOBUFS;
3405                 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, request->mac_addr_mask))
3406                         return -ENOBUFS;
3407         }
3408
3409         for (int i = 0; i < request->n_peers; i++) {
3410                 err = mac80211_hwsim_send_pmsr_request_peer(msg, &request->peers[i]);
3411                 if (err)
3412                         return err;
3413         }
3414
3415         nla_nest_end(msg, pmsr);
3416
3417         return 0;
3418 }
3419
3420 static int mac80211_hwsim_start_pmsr(struct ieee80211_hw *hw,
3421                                      struct ieee80211_vif *vif,
3422                                      struct cfg80211_pmsr_request *request)
3423 {
3424         struct mac80211_hwsim_data *data;
3425         struct sk_buff *skb = NULL;
3426         struct nlattr *pmsr;
3427         void *msg_head;
3428         u32 _portid;
3429         int err = 0;
3430
3431         data = hw->priv;
3432         _portid = READ_ONCE(data->wmediumd);
3433         if (!_portid && !hwsim_virtio_enabled)
3434                 return -EOPNOTSUPP;
3435
3436         mutex_lock(&data->mutex);
3437
3438         if (data->pmsr_request) {
3439                 err = -EBUSY;
3440                 goto out_free;
3441         }
3442
3443         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3444
3445         if (!skb) {
3446                 err = -ENOMEM;
3447                 goto out_free;
3448         }
3449
3450         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_START_PMSR);
3451
3452         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
3453                     ETH_ALEN, data->addresses[1].addr)) {
3454                 err = -ENOMEM;
3455                 goto out_free;
3456         }
3457
3458         pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3459         if (!pmsr) {
3460                 err = -ENOMEM;
3461                 goto out_free;
3462         }
3463
3464         err = mac80211_hwsim_send_pmsr_request(skb, request);
3465         if (err)
3466                 goto out_free;
3467
3468         nla_nest_end(skb, pmsr);
3469
3470         genlmsg_end(skb, msg_head);
3471         if (hwsim_virtio_enabled)
3472                 hwsim_tx_virtio(data, skb);
3473         else
3474                 hwsim_unicast_netgroup(data, skb, _portid);
3475
3476         data->pmsr_request = request;
3477         data->pmsr_request_wdev = ieee80211_vif_to_wdev(vif);
3478
3479 out_free:
3480         if (err && skb)
3481                 nlmsg_free(skb);
3482
3483         mutex_unlock(&data->mutex);
3484         return err;
3485 }
3486
3487 static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
3488                                       struct ieee80211_vif *vif,
3489                                       struct cfg80211_pmsr_request *request)
3490 {
3491         struct mac80211_hwsim_data *data;
3492         struct sk_buff *skb = NULL;
3493         struct nlattr *pmsr;
3494         void *msg_head;
3495         u32 _portid;
3496         int err = 0;
3497
3498         data = hw->priv;
3499         _portid = READ_ONCE(data->wmediumd);
3500         if (!_portid && !hwsim_virtio_enabled)
3501                 return;
3502
3503         mutex_lock(&data->mutex);
3504
3505         if (data->pmsr_request != request) {
3506                 err = -EINVAL;
3507                 goto out;
3508         }
3509
3510         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3511         if (!skb) {
3512                 err = -ENOMEM;
3513                 goto out;
3514         }
3515
3516         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_ABORT_PMSR);
3517
3518         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER, ETH_ALEN, data->addresses[1].addr))
3519                 goto out;
3520
3521         pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3522         if (!pmsr) {
3523                 err = -ENOMEM;
3524                 goto out;
3525         }
3526
3527         err = mac80211_hwsim_send_pmsr_request(skb, request);
3528         if (err)
3529                 goto out;
3530
3531         err = nla_nest_end(skb, pmsr);
3532         if (err)
3533                 goto out;
3534
3535         genlmsg_end(skb, msg_head);
3536         if (hwsim_virtio_enabled)
3537                 hwsim_tx_virtio(data, skb);
3538         else
3539                 hwsim_unicast_netgroup(data, skb, _portid);
3540
3541 out:
3542         if (err && skb)
3543                 nlmsg_free(skb);
3544
3545         mutex_unlock(&data->mutex);
3546 }
3547
3548 static int mac80211_hwsim_parse_rate_info(struct nlattr *rateattr,
3549                                           struct rate_info *rate_info,
3550                                           struct genl_info *info)
3551 {
3552         struct nlattr *tb[HWSIM_RATE_INFO_ATTR_MAX + 1];
3553         int ret;
3554
3555         ret = nla_parse_nested(tb, HWSIM_RATE_INFO_ATTR_MAX,
3556                                rateattr, hwsim_rate_info_policy, info->extack);
3557         if (ret)
3558                 return ret;
3559
3560         if (tb[HWSIM_RATE_INFO_ATTR_FLAGS])
3561                 rate_info->flags = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_FLAGS]);
3562
3563         if (tb[HWSIM_RATE_INFO_ATTR_MCS])
3564                 rate_info->mcs = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_MCS]);
3565
3566         if (tb[HWSIM_RATE_INFO_ATTR_LEGACY])
3567                 rate_info->legacy = nla_get_u16(tb[HWSIM_RATE_INFO_ATTR_LEGACY]);
3568
3569         if (tb[HWSIM_RATE_INFO_ATTR_NSS])
3570                 rate_info->nss = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_NSS]);
3571
3572         if (tb[HWSIM_RATE_INFO_ATTR_BW])
3573                 rate_info->bw = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_BW]);
3574
3575         if (tb[HWSIM_RATE_INFO_ATTR_HE_GI])
3576                 rate_info->he_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_GI]);
3577
3578         if (tb[HWSIM_RATE_INFO_ATTR_HE_DCM])
3579                 rate_info->he_dcm = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_DCM]);
3580
3581         if (tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC])
3582                 rate_info->he_ru_alloc =
3583                         nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC]);
3584
3585         if (tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH])
3586                 rate_info->n_bonded_ch = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH]);
3587
3588         if (tb[HWSIM_RATE_INFO_ATTR_EHT_GI])
3589                 rate_info->eht_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_GI]);
3590
3591         if (tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC])
3592                 rate_info->eht_ru_alloc = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC]);
3593
3594         return 0;
3595 }
3596
3597 static int mac80211_hwsim_parse_ftm_result(struct nlattr *ftm,
3598                                            struct cfg80211_pmsr_ftm_result *result,
3599                                            struct genl_info *info)
3600 {
3601         struct nlattr *tb[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1];
3602         int ret;
3603
3604         ret = nla_parse_nested(tb, NL80211_PMSR_FTM_RESP_ATTR_MAX,
3605                                ftm, hwsim_ftm_result_policy, info->extack);
3606         if (ret)
3607                 return ret;
3608
3609         if (tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON])
3610                 result->failure_reason = nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON]);
3611
3612         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX])
3613                 result->burst_index = nla_get_u16(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX]);
3614
3615         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]) {
3616                 result->num_ftmr_attempts_valid = 1;
3617                 result->num_ftmr_attempts =
3618                         nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]);
3619         }
3620
3621         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]) {
3622                 result->num_ftmr_successes_valid = 1;
3623                 result->num_ftmr_successes =
3624                         nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]);
3625         }
3626
3627         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME])
3628                 result->busy_retry_time =
3629                         nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME]);
3630
3631         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP])
3632                 result->num_bursts_exp = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP]);
3633
3634         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION])
3635                 result->burst_duration = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION]);
3636
3637         if (tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST])
3638                 result->ftms_per_burst = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST]);
3639
3640         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]) {
3641                 result->rssi_avg_valid = 1;
3642                 result->rssi_avg = nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]);
3643         }
3644         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]) {
3645                 result->rssi_spread_valid = 1;
3646                 result->rssi_spread =
3647                         nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]);
3648         }
3649
3650         if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE]) {
3651                 result->tx_rate_valid = 1;
3652                 ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE],
3653                                                      &result->tx_rate, info);
3654                 if (ret)
3655                         return ret;
3656         }
3657
3658         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE]) {
3659                 result->rx_rate_valid = 1;
3660                 ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE],
3661                                                      &result->rx_rate, info);
3662                 if (ret)
3663                         return ret;
3664         }
3665
3666         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]) {
3667                 result->rtt_avg_valid = 1;
3668                 result->rtt_avg =
3669                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]);
3670         }
3671         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]) {
3672                 result->rtt_variance_valid = 1;
3673                 result->rtt_variance =
3674                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]);
3675         }
3676         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]) {
3677                 result->rtt_spread_valid = 1;
3678                 result->rtt_spread =
3679                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]);
3680         }
3681         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]) {
3682                 result->dist_avg_valid = 1;
3683                 result->dist_avg =
3684                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]);
3685         }
3686         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]) {
3687                 result->dist_variance_valid = 1;
3688                 result->dist_variance =
3689                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]);
3690         }
3691         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]) {
3692                 result->dist_spread_valid = 1;
3693                 result->dist_spread =
3694                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]);
3695         }
3696
3697         if (tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]) {
3698                 result->lci = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3699                 result->lci_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3700         }
3701
3702         if (tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]) {
3703                 result->civicloc = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3704                 result->civicloc_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3705         }
3706
3707         return 0;
3708 }
3709
3710 static int mac80211_hwsim_parse_pmsr_resp(struct nlattr *resp,
3711                                           struct cfg80211_pmsr_result *result,
3712                                           struct genl_info *info)
3713 {
3714         struct nlattr *tb[NL80211_PMSR_RESP_ATTR_MAX + 1];
3715         struct nlattr *pmsr;
3716         int rem;
3717         int ret;
3718
3719         ret = nla_parse_nested(tb, NL80211_PMSR_RESP_ATTR_MAX, resp, hwsim_pmsr_resp_policy,
3720                                info->extack);
3721         if (ret)
3722                 return ret;
3723
3724         if (tb[NL80211_PMSR_RESP_ATTR_STATUS])
3725                 result->status = nla_get_u32(tb[NL80211_PMSR_RESP_ATTR_STATUS]);
3726
3727         if (tb[NL80211_PMSR_RESP_ATTR_HOST_TIME])
3728                 result->host_time = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_HOST_TIME]);
3729
3730         if (tb[NL80211_PMSR_RESP_ATTR_AP_TSF]) {
3731                 result->ap_tsf_valid = 1;
3732                 result->ap_tsf = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_AP_TSF]);
3733         }
3734
3735         result->final = !!tb[NL80211_PMSR_RESP_ATTR_FINAL];
3736
3737         if (!tb[NL80211_PMSR_RESP_ATTR_DATA])
3738                 return 0;
3739
3740         nla_for_each_nested(pmsr, tb[NL80211_PMSR_RESP_ATTR_DATA], rem) {
3741                 switch (nla_type(pmsr)) {
3742                 case NL80211_PMSR_TYPE_FTM:
3743                         result->type = NL80211_PMSR_TYPE_FTM;
3744                         ret = mac80211_hwsim_parse_ftm_result(pmsr, &result->ftm, info);
3745                         if (ret)
3746                                 return ret;
3747                         break;
3748                 default:
3749                         NL_SET_ERR_MSG_ATTR(info->extack, pmsr, "Unknown pmsr resp type");
3750                         return -EINVAL;
3751                 }
3752         }
3753
3754         return 0;
3755 }
3756
3757 static int mac80211_hwsim_parse_pmsr_result(struct nlattr *peer,
3758                                             struct cfg80211_pmsr_result *result,
3759                                             struct genl_info *info)
3760 {
3761         struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];
3762         int ret;
3763
3764         if (!peer)
3765                 return -EINVAL;
3766
3767         ret = nla_parse_nested(tb, NL80211_PMSR_PEER_ATTR_MAX, peer,
3768                                hwsim_pmsr_peer_result_policy, info->extack);
3769         if (ret)
3770                 return ret;
3771
3772         if (tb[NL80211_PMSR_PEER_ATTR_ADDR])
3773                 memcpy(result->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]),
3774                        ETH_ALEN);
3775
3776         if (tb[NL80211_PMSR_PEER_ATTR_RESP]) {
3777                 ret = mac80211_hwsim_parse_pmsr_resp(tb[NL80211_PMSR_PEER_ATTR_RESP], result, info);
3778                 if (ret)
3779                         return ret;
3780         }
3781
3782         return 0;
3783 };
3784
3785 static int hwsim_pmsr_report_nl(struct sk_buff *msg, struct genl_info *info)
3786 {
3787         struct mac80211_hwsim_data *data;
3788         struct nlattr *peers, *peer;
3789         struct nlattr *reqattr;
3790         const u8 *src;
3791         int err;
3792         int rem;
3793
3794         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER])
3795                 return -EINVAL;
3796
3797         src = nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
3798         data = get_hwsim_data_ref_from_addr(src);
3799         if (!data)
3800                 return -EINVAL;
3801
3802         mutex_lock(&data->mutex);
3803         if (!data->pmsr_request) {
3804                 err = -EINVAL;
3805                 goto out;
3806         }
3807
3808         reqattr = info->attrs[HWSIM_ATTR_PMSR_RESULT];
3809         if (!reqattr) {
3810                 err = -EINVAL;
3811                 goto out;
3812         }
3813
3814         peers = nla_find_nested(reqattr, NL80211_PMSR_ATTR_PEERS);
3815         if (!peers) {
3816                 err = -EINVAL;
3817                 goto out;
3818         }
3819
3820         nla_for_each_nested(peer, peers, rem) {
3821                 struct cfg80211_pmsr_result result;
3822
3823                 err = mac80211_hwsim_parse_pmsr_result(peer, &result, info);
3824                 if (err)
3825                         goto out;
3826
3827                 cfg80211_pmsr_report(data->pmsr_request_wdev,
3828                                      data->pmsr_request, &result, GFP_KERNEL);
3829         }
3830
3831         cfg80211_pmsr_complete(data->pmsr_request_wdev, data->pmsr_request, GFP_KERNEL);
3832
3833         err = 0;
3834 out:
3835         data->pmsr_request = NULL;
3836         data->pmsr_request_wdev = NULL;
3837
3838         mutex_unlock(&data->mutex);
3839         return err;
3840 }
3841
3842 #define HWSIM_COMMON_OPS                                        \
3843         .tx = mac80211_hwsim_tx,                                \
3844         .wake_tx_queue = ieee80211_handle_wake_tx_queue,        \
3845         .start = mac80211_hwsim_start,                          \
3846         .stop = mac80211_hwsim_stop,                            \
3847         .add_interface = mac80211_hwsim_add_interface,          \
3848         .change_interface = mac80211_hwsim_change_interface,    \
3849         .remove_interface = mac80211_hwsim_remove_interface,    \
3850         .config = mac80211_hwsim_config,                        \
3851         .configure_filter = mac80211_hwsim_configure_filter,    \
3852         .vif_cfg_changed = mac80211_hwsim_vif_info_changed,     \
3853         .link_info_changed = mac80211_hwsim_link_info_changed,  \
3854         .tx_last_beacon = mac80211_hwsim_tx_last_beacon,        \
3855         .sta_notify = mac80211_hwsim_sta_notify,                \
3856         .sta_rc_update = mac80211_hwsim_sta_rc_update,          \
3857         .conf_tx = mac80211_hwsim_conf_tx,                      \
3858         .get_survey = mac80211_hwsim_get_survey,                \
3859         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)      \
3860         .ampdu_action = mac80211_hwsim_ampdu_action,            \
3861         .flush = mac80211_hwsim_flush,                          \
3862         .get_et_sset_count = mac80211_hwsim_get_et_sset_count,  \
3863         .get_et_stats = mac80211_hwsim_get_et_stats,            \
3864         .get_et_strings = mac80211_hwsim_get_et_strings,        \
3865         .start_pmsr = mac80211_hwsim_start_pmsr,                \
3866         .abort_pmsr = mac80211_hwsim_abort_pmsr,
3867
3868 #define HWSIM_NON_MLO_OPS                                       \
3869         .sta_add = mac80211_hwsim_sta_add,                      \
3870         .sta_remove = mac80211_hwsim_sta_remove,                \
3871         .set_tim = mac80211_hwsim_set_tim,                      \
3872         .get_tsf = mac80211_hwsim_get_tsf,                      \
3873         .set_tsf = mac80211_hwsim_set_tsf,
3874
3875 static const struct ieee80211_ops mac80211_hwsim_ops = {
3876         HWSIM_COMMON_OPS
3877         HWSIM_NON_MLO_OPS
3878         .sw_scan_start = mac80211_hwsim_sw_scan,
3879         .sw_scan_complete = mac80211_hwsim_sw_scan_complete,
3880 };
3881
3882 #define HWSIM_CHANCTX_OPS                                       \
3883         .hw_scan = mac80211_hwsim_hw_scan,                      \
3884         .cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,        \
3885         .remain_on_channel = mac80211_hwsim_roc,                \
3886         .cancel_remain_on_channel = mac80211_hwsim_croc,        \
3887         .add_chanctx = mac80211_hwsim_add_chanctx,              \
3888         .remove_chanctx = mac80211_hwsim_remove_chanctx,        \
3889         .change_chanctx = mac80211_hwsim_change_chanctx,        \
3890         .assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
3891         .unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx,
3892
3893 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
3894         HWSIM_COMMON_OPS
3895         HWSIM_NON_MLO_OPS
3896         HWSIM_CHANCTX_OPS
3897 };
3898
3899 static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
3900         HWSIM_COMMON_OPS
3901         HWSIM_CHANCTX_OPS
3902         .set_rts_threshold = mac80211_hwsim_set_rts_threshold,
3903         .change_vif_links = mac80211_hwsim_change_vif_links,
3904         .change_sta_links = mac80211_hwsim_change_sta_links,
3905         .sta_state = mac80211_hwsim_sta_state,
3906 };
3907
3908 struct hwsim_new_radio_params {
3909         unsigned int channels;
3910         const char *reg_alpha2;
3911         const struct ieee80211_regdomain *regd;
3912         bool reg_strict;
3913         bool p2p_device;
3914         bool use_chanctx;
3915         bool destroy_on_close;
3916         const char *hwname;
3917         bool no_vif;
3918         const u8 *perm_addr;
3919         u32 iftypes;
3920         u32 *ciphers;
3921         u8 n_ciphers;
3922         bool mlo;
3923         const struct cfg80211_pmsr_capabilities *pmsr_capa;
3924 };
3925
3926 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
3927                                    struct genl_info *info)
3928 {
3929         if (info)
3930                 genl_notify(&hwsim_genl_family, mcast_skb, info,
3931                             HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3932         else
3933                 genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
3934                                   HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3935 }
3936
3937 static int append_radio_msg(struct sk_buff *skb, int id,
3938                             struct hwsim_new_radio_params *param)
3939 {
3940         int ret;
3941
3942         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
3943         if (ret < 0)
3944                 return ret;
3945
3946         if (param->channels) {
3947                 ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
3948                 if (ret < 0)
3949                         return ret;
3950         }
3951
3952         if (param->reg_alpha2) {
3953                 ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
3954                               param->reg_alpha2);
3955                 if (ret < 0)
3956                         return ret;
3957         }
3958
3959         if (param->regd) {
3960                 int i;
3961
3962                 for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
3963                         if (hwsim_world_regdom_custom[i] != param->regd)
3964                                 continue;
3965
3966                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
3967                         if (ret < 0)
3968                                 return ret;
3969                         break;
3970                 }
3971         }
3972
3973         if (param->reg_strict) {
3974                 ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
3975                 if (ret < 0)
3976                         return ret;
3977         }
3978
3979         if (param->p2p_device) {
3980                 ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
3981                 if (ret < 0)
3982                         return ret;
3983         }
3984
3985         if (param->use_chanctx) {
3986                 ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
3987                 if (ret < 0)
3988                         return ret;
3989         }
3990
3991         if (param->hwname) {
3992                 ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
3993                               strlen(param->hwname), param->hwname);
3994                 if (ret < 0)
3995                         return ret;
3996         }
3997
3998         return 0;
3999 }
4000
4001 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
4002                                   struct hwsim_new_radio_params *param)
4003 {
4004         struct sk_buff *mcast_skb;
4005         void *data;
4006
4007         mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4008         if (!mcast_skb)
4009                 return;
4010
4011         data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
4012                            HWSIM_CMD_NEW_RADIO);
4013         if (!data)
4014                 goto out_err;
4015
4016         if (append_radio_msg(mcast_skb, id, param) < 0)
4017                 goto out_err;
4018
4019         genlmsg_end(mcast_skb, data);
4020
4021         hwsim_mcast_config_msg(mcast_skb, info);
4022         return;
4023
4024 out_err:
4025         nlmsg_free(mcast_skb);
4026 }
4027
4028 static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
4029         {
4030                 .types_mask = BIT(NL80211_IFTYPE_STATION),
4031                 .he_cap = {
4032                         .has_he = true,
4033                         .he_cap_elem = {
4034                                 .mac_cap_info[0] =
4035                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4036                                 .mac_cap_info[1] =
4037                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4038                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4039                                 .mac_cap_info[2] =
4040                                         IEEE80211_HE_MAC_CAP2_BSR |
4041                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4042                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4043                                 .mac_cap_info[3] =
4044                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4045                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4046                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4047                                 .phy_cap_info[0] =
4048                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4049                                 .phy_cap_info[1] =
4050                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4051                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4052                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4053                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4054                                 .phy_cap_info[2] =
4055                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4056                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4057                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4058                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4059                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4060
4061                                 /* Leave all the other PHY capability bytes
4062                                  * unset, as DCM, beam forming, RU and PPE
4063                                  * threshold information are not supported
4064                                  */
4065                         },
4066                         .he_mcs_nss_supp = {
4067                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4068                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4069                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4070                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4071                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4072                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4073                         },
4074                 },
4075                 .eht_cap = {
4076                         .has_eht = true,
4077                         .eht_cap_elem = {
4078                                 .mac_cap_info[0] =
4079                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4080                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4081                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4082                                 .phy_cap_info[0] =
4083                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4084                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4085                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4086                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4087                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4088                                 .phy_cap_info[3] =
4089                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4090                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4091                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4092                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4093                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4094                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4095                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4096                                 .phy_cap_info[4] =
4097                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4098                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4099                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4100                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4101                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4102                                 .phy_cap_info[5] =
4103                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4104                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4105                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4106                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4107                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4108                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4109                                 .phy_cap_info[6] =
4110                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4111                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4112                                 .phy_cap_info[7] =
4113                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4114                         },
4115
4116                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4117                          * Rx
4118                          */
4119                         .eht_mcs_nss_supp = {
4120                                 /*
4121                                  * Since B0, B1, B2 and B3 are not set in
4122                                  * the supported channel width set field in the
4123                                  * HE PHY capabilities information field the
4124                                  * device is a 20MHz only device on 2.4GHz band.
4125                                  */
4126                                 .only_20mhz = {
4127                                         .rx_tx_mcs7_max_nss = 0x88,
4128                                         .rx_tx_mcs9_max_nss = 0x88,
4129                                         .rx_tx_mcs11_max_nss = 0x88,
4130                                         .rx_tx_mcs13_max_nss = 0x88,
4131                                 },
4132                         },
4133                         /* PPE threshold information is not supported */
4134                 },
4135         },
4136         {
4137                 .types_mask = BIT(NL80211_IFTYPE_AP),
4138                 .he_cap = {
4139                         .has_he = true,
4140                         .he_cap_elem = {
4141                                 .mac_cap_info[0] =
4142                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4143                                 .mac_cap_info[1] =
4144                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4145                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4146                                 .mac_cap_info[2] =
4147                                         IEEE80211_HE_MAC_CAP2_BSR |
4148                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4149                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4150                                 .mac_cap_info[3] =
4151                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4152                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4153                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4154                                 .phy_cap_info[0] =
4155                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4156                                 .phy_cap_info[1] =
4157                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4158                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4159                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4160                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4161                                 .phy_cap_info[2] =
4162                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4163                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4164                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4165                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4166                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4167
4168                                 /* Leave all the other PHY capability bytes
4169                                  * unset, as DCM, beam forming, RU and PPE
4170                                  * threshold information are not supported
4171                                  */
4172                         },
4173                         .he_mcs_nss_supp = {
4174                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4175                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4176                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4177                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4178                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4179                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4180                         },
4181                 },
4182                 .eht_cap = {
4183                         .has_eht = true,
4184                         .eht_cap_elem = {
4185                                 .mac_cap_info[0] =
4186                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4187                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4188                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4189                                 .phy_cap_info[0] =
4190                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4191                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4192                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4193                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4194                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4195                                 .phy_cap_info[3] =
4196                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4197                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4198                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4199                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4200                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4201                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4202                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4203                                 .phy_cap_info[4] =
4204                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4205                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4206                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4207                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4208                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4209                                 .phy_cap_info[5] =
4210                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4211                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4212                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4213                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4214                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4215                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4216                                 .phy_cap_info[6] =
4217                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4218                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4219                                 .phy_cap_info[7] =
4220                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4221                         },
4222
4223                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4224                          * Rx
4225                          */
4226                         .eht_mcs_nss_supp = {
4227                                 /*
4228                                  * Since B0, B1, B2 and B3 are not set in
4229                                  * the supported channel width set field in the
4230                                  * HE PHY capabilities information field the
4231                                  * device is a 20MHz only device on 2.4GHz band.
4232                                  */
4233                                 .only_20mhz = {
4234                                         .rx_tx_mcs7_max_nss = 0x88,
4235                                         .rx_tx_mcs9_max_nss = 0x88,
4236                                         .rx_tx_mcs11_max_nss = 0x88,
4237                                         .rx_tx_mcs13_max_nss = 0x88,
4238                                 },
4239                         },
4240                         /* PPE threshold information is not supported */
4241                 },
4242         },
4243 #ifdef CONFIG_MAC80211_MESH
4244         {
4245                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4246                 .he_cap = {
4247                         .has_he = true,
4248                         .he_cap_elem = {
4249                                 .mac_cap_info[0] =
4250                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4251                                 .mac_cap_info[1] =
4252                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4253                                 .mac_cap_info[2] =
4254                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4255                                 .mac_cap_info[3] =
4256                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4257                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4258                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4259                                 .phy_cap_info[0] =
4260                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4261                                 .phy_cap_info[1] =
4262                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4263                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4264                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4265                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4266                                 .phy_cap_info[2] = 0,
4267
4268                                 /* Leave all the other PHY capability bytes
4269                                  * unset, as DCM, beam forming, RU and PPE
4270                                  * threshold information are not supported
4271                                  */
4272                         },
4273                         .he_mcs_nss_supp = {
4274                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4275                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4276                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4277                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4278                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4279                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4280                         },
4281                 },
4282         },
4283 #endif
4284 };
4285
4286 static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
4287         {
4288                 /* TODO: should we support other types, e.g., P2P? */
4289                 .types_mask = BIT(NL80211_IFTYPE_STATION),
4290                 .he_cap = {
4291                         .has_he = true,
4292                         .he_cap_elem = {
4293                                 .mac_cap_info[0] =
4294                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4295                                 .mac_cap_info[1] =
4296                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4297                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4298                                 .mac_cap_info[2] =
4299                                         IEEE80211_HE_MAC_CAP2_BSR |
4300                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4301                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4302                                 .mac_cap_info[3] =
4303                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4304                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4305                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4306                                 .phy_cap_info[0] =
4307                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4308                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4309                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4310                                 .phy_cap_info[1] =
4311                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4312                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4313                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4314                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4315                                 .phy_cap_info[2] =
4316                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4317                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4318                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4319                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4320                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4321
4322                                 /* Leave all the other PHY capability bytes
4323                                  * unset, as DCM, beam forming, RU and PPE
4324                                  * threshold information are not supported
4325                                  */
4326                         },
4327                         .he_mcs_nss_supp = {
4328                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4329                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4330                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4331                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4332                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4333                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4334                         },
4335                 },
4336                 .eht_cap = {
4337                         .has_eht = true,
4338                         .eht_cap_elem = {
4339                                 .mac_cap_info[0] =
4340                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4341                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4342                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4343                                 .phy_cap_info[0] =
4344                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4345                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4346                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4347                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4348                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4349                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4350                                 .phy_cap_info[1] =
4351                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4352                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4353                                 .phy_cap_info[2] =
4354                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4355                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4356                                 .phy_cap_info[3] =
4357                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4358                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4359                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4360                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4361                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4362                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4363                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4364                                 .phy_cap_info[4] =
4365                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4366                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4367                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4368                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4369                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4370                                 .phy_cap_info[5] =
4371                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4372                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4373                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4374                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4375                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4376                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4377                                 .phy_cap_info[6] =
4378                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4379                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4380                                 .phy_cap_info[7] =
4381                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4382                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4383                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4384                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4385                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4386                         },
4387
4388                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4389                          * Rx
4390                          */
4391                         .eht_mcs_nss_supp = {
4392                                 /*
4393                                  * As B1 and B2 are set in the supported
4394                                  * channel width set field in the HE PHY
4395                                  * capabilities information field include all
4396                                  * the following MCS/NSS.
4397                                  */
4398                                 .bw._80 = {
4399                                         .rx_tx_mcs9_max_nss = 0x88,
4400                                         .rx_tx_mcs11_max_nss = 0x88,
4401                                         .rx_tx_mcs13_max_nss = 0x88,
4402                                 },
4403                                 .bw._160 = {
4404                                         .rx_tx_mcs9_max_nss = 0x88,
4405                                         .rx_tx_mcs11_max_nss = 0x88,
4406                                         .rx_tx_mcs13_max_nss = 0x88,
4407                                 },
4408                         },
4409                         /* PPE threshold information is not supported */
4410                 },
4411         },
4412         {
4413                 .types_mask = BIT(NL80211_IFTYPE_AP),
4414                 .he_cap = {
4415                         .has_he = true,
4416                         .he_cap_elem = {
4417                                 .mac_cap_info[0] =
4418                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4419                                 .mac_cap_info[1] =
4420                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4421                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4422                                 .mac_cap_info[2] =
4423                                         IEEE80211_HE_MAC_CAP2_BSR |
4424                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4425                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4426                                 .mac_cap_info[3] =
4427                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4428                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4429                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4430                                 .phy_cap_info[0] =
4431                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4432                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4433                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4434                                 .phy_cap_info[1] =
4435                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4436                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4437                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4438                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4439                                 .phy_cap_info[2] =
4440                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4441                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4442                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4443                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4444                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4445
4446                                 /* Leave all the other PHY capability bytes
4447                                  * unset, as DCM, beam forming, RU and PPE
4448                                  * threshold information are not supported
4449                                  */
4450                         },
4451                         .he_mcs_nss_supp = {
4452                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4453                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4454                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4455                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4456                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4457                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4458                         },
4459                 },
4460                 .eht_cap = {
4461                         .has_eht = true,
4462                         .eht_cap_elem = {
4463                                 .mac_cap_info[0] =
4464                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4465                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4466                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4467                                 .phy_cap_info[0] =
4468                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4469                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4470                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4471                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4472                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4473                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4474                                 .phy_cap_info[1] =
4475                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4476                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4477                                 .phy_cap_info[2] =
4478                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4479                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4480                                 .phy_cap_info[3] =
4481                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4482                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4483                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4484                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4485                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4486                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4487                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4488                                 .phy_cap_info[4] =
4489                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4490                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4491                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4492                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4493                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4494                                 .phy_cap_info[5] =
4495                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4496                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4497                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4498                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4499                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4500                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4501                                 .phy_cap_info[6] =
4502                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4503                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4504                                 .phy_cap_info[7] =
4505                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4506                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4507                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4508                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4509                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4510                         },
4511
4512                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4513                          * Rx
4514                          */
4515                         .eht_mcs_nss_supp = {
4516                                 /*
4517                                  * As B1 and B2 are set in the supported
4518                                  * channel width set field in the HE PHY
4519                                  * capabilities information field include all
4520                                  * the following MCS/NSS.
4521                                  */
4522                                 .bw._80 = {
4523                                         .rx_tx_mcs9_max_nss = 0x88,
4524                                         .rx_tx_mcs11_max_nss = 0x88,
4525                                         .rx_tx_mcs13_max_nss = 0x88,
4526                                 },
4527                                 .bw._160 = {
4528                                         .rx_tx_mcs9_max_nss = 0x88,
4529                                         .rx_tx_mcs11_max_nss = 0x88,
4530                                         .rx_tx_mcs13_max_nss = 0x88,
4531                                 },
4532                         },
4533                         /* PPE threshold information is not supported */
4534                 },
4535         },
4536 #ifdef CONFIG_MAC80211_MESH
4537         {
4538                 /* TODO: should we support other types, e.g., IBSS?*/
4539                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4540                 .he_cap = {
4541                         .has_he = true,
4542                         .he_cap_elem = {
4543                                 .mac_cap_info[0] =
4544                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4545                                 .mac_cap_info[1] =
4546                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4547                                 .mac_cap_info[2] =
4548                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4549                                 .mac_cap_info[3] =
4550                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4551                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4552                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4553                                 .phy_cap_info[0] =
4554                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4555                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4556                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4557                                 .phy_cap_info[1] =
4558                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4559                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4560                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4561                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4562                                 .phy_cap_info[2] = 0,
4563
4564                                 /* Leave all the other PHY capability bytes
4565                                  * unset, as DCM, beam forming, RU and PPE
4566                                  * threshold information are not supported
4567                                  */
4568                         },
4569                         .he_mcs_nss_supp = {
4570                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4571                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4572                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4573                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4574                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4575                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4576                         },
4577                 },
4578         },
4579 #endif
4580 };
4581
4582 static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
4583         {
4584                 /* TODO: should we support other types, e.g., P2P? */
4585                 .types_mask = BIT(NL80211_IFTYPE_STATION),
4586                 .he_6ghz_capa = {
4587                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4588                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4589                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4590                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4591                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4592                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4593                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4594                 },
4595                 .he_cap = {
4596                         .has_he = true,
4597                         .he_cap_elem = {
4598                                 .mac_cap_info[0] =
4599                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4600                                 .mac_cap_info[1] =
4601                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4602                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4603                                 .mac_cap_info[2] =
4604                                         IEEE80211_HE_MAC_CAP2_BSR |
4605                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4606                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4607                                 .mac_cap_info[3] =
4608                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4609                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4610                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4611                                 .phy_cap_info[0] =
4612                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4613                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4614                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4615                                 .phy_cap_info[1] =
4616                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4617                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4618                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4619                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4620                                 .phy_cap_info[2] =
4621                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4622                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4623                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4624                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4625                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4626
4627                                 /* Leave all the other PHY capability bytes
4628                                  * unset, as DCM, beam forming, RU and PPE
4629                                  * threshold information are not supported
4630                                  */
4631                         },
4632                         .he_mcs_nss_supp = {
4633                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4634                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4635                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4636                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4637                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4638                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4639                         },
4640                 },
4641                 .eht_cap = {
4642                         .has_eht = true,
4643                         .eht_cap_elem = {
4644                                 .mac_cap_info[0] =
4645                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4646                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4647                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4648                                 .phy_cap_info[0] =
4649                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4650                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4651                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4652                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4653                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4654                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4655                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4656                                 .phy_cap_info[1] =
4657                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4658                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4659                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4660                                 .phy_cap_info[2] =
4661                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4662                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4663                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4664                                 .phy_cap_info[3] =
4665                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4666                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4667                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4668                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4669                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4670                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4671                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4672                                 .phy_cap_info[4] =
4673                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4674                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4675                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4676                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4677                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4678                                 .phy_cap_info[5] =
4679                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4680                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4681                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4682                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4683                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4684                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4685                                 .phy_cap_info[6] =
4686                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4687                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4688                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4689                                 .phy_cap_info[7] =
4690                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4691                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4692                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4693                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4694                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4695                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4696                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4697                         },
4698
4699                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4700                          * Rx
4701                          */
4702                         .eht_mcs_nss_supp = {
4703                                 /*
4704                                  * As B1 and B2 are set in the supported
4705                                  * channel width set field in the HE PHY
4706                                  * capabilities information field and 320MHz in
4707                                  * 6GHz is supported include all the following
4708                                  * MCS/NSS.
4709                                  */
4710                                 .bw._80 = {
4711                                         .rx_tx_mcs9_max_nss = 0x88,
4712                                         .rx_tx_mcs11_max_nss = 0x88,
4713                                         .rx_tx_mcs13_max_nss = 0x88,
4714                                 },
4715                                 .bw._160 = {
4716                                         .rx_tx_mcs9_max_nss = 0x88,
4717                                         .rx_tx_mcs11_max_nss = 0x88,
4718                                         .rx_tx_mcs13_max_nss = 0x88,
4719                                 },
4720                                 .bw._320 = {
4721                                         .rx_tx_mcs9_max_nss = 0x88,
4722                                         .rx_tx_mcs11_max_nss = 0x88,
4723                                         .rx_tx_mcs13_max_nss = 0x88,
4724                                 },
4725                         },
4726                         /* PPE threshold information is not supported */
4727                 },
4728         },
4729         {
4730                 .types_mask = BIT(NL80211_IFTYPE_AP),
4731                 .he_6ghz_capa = {
4732                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4733                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4734                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4735                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4736                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4737                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4738                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4739                 },
4740                 .he_cap = {
4741                         .has_he = true,
4742                         .he_cap_elem = {
4743                                 .mac_cap_info[0] =
4744                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4745                                 .mac_cap_info[1] =
4746                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4747                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4748                                 .mac_cap_info[2] =
4749                                         IEEE80211_HE_MAC_CAP2_BSR |
4750                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4751                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4752                                 .mac_cap_info[3] =
4753                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4754                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4755                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4756                                 .phy_cap_info[0] =
4757                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4758                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4759                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4760                                 .phy_cap_info[1] =
4761                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4762                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4763                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4764                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4765                                 .phy_cap_info[2] =
4766                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4767                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4768                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4769                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4770                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4771
4772                                 /* Leave all the other PHY capability bytes
4773                                  * unset, as DCM, beam forming, RU and PPE
4774                                  * threshold information are not supported
4775                                  */
4776                         },
4777                         .he_mcs_nss_supp = {
4778                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4779                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4780                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4781                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4782                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4783                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4784                         },
4785                 },
4786                 .eht_cap = {
4787                         .has_eht = true,
4788                         .eht_cap_elem = {
4789                                 .mac_cap_info[0] =
4790                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4791                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4792                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4793                                 .phy_cap_info[0] =
4794                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4795                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4796                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4797                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4798                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4799                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4800                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4801                                 .phy_cap_info[1] =
4802                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4803                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4804                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4805                                 .phy_cap_info[2] =
4806                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4807                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4808                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4809                                 .phy_cap_info[3] =
4810                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4811                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4812                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4813                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4814                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4815                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4816                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4817                                 .phy_cap_info[4] =
4818                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4819                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4820                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4821                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4822                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4823                                 .phy_cap_info[5] =
4824                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4825                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4826                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4827                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4828                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4829                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4830                                 .phy_cap_info[6] =
4831                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4832                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4833                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4834                                 .phy_cap_info[7] =
4835                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4836                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4837                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4838                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4839                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4840                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4841                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4842                         },
4843
4844                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4845                          * Rx
4846                          */
4847                         .eht_mcs_nss_supp = {
4848                                 /*
4849                                  * As B1 and B2 are set in the supported
4850                                  * channel width set field in the HE PHY
4851                                  * capabilities information field and 320MHz in
4852                                  * 6GHz is supported include all the following
4853                                  * MCS/NSS.
4854                                  */
4855                                 .bw._80 = {
4856                                         .rx_tx_mcs9_max_nss = 0x88,
4857                                         .rx_tx_mcs11_max_nss = 0x88,
4858                                         .rx_tx_mcs13_max_nss = 0x88,
4859                                 },
4860                                 .bw._160 = {
4861                                         .rx_tx_mcs9_max_nss = 0x88,
4862                                         .rx_tx_mcs11_max_nss = 0x88,
4863                                         .rx_tx_mcs13_max_nss = 0x88,
4864                                 },
4865                                 .bw._320 = {
4866                                         .rx_tx_mcs9_max_nss = 0x88,
4867                                         .rx_tx_mcs11_max_nss = 0x88,
4868                                         .rx_tx_mcs13_max_nss = 0x88,
4869                                 },
4870                         },
4871                         /* PPE threshold information is not supported */
4872                 },
4873         },
4874 #ifdef CONFIG_MAC80211_MESH
4875         {
4876                 /* TODO: should we support other types, e.g., IBSS?*/
4877                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4878                 .he_6ghz_capa = {
4879                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4880                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4881                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4882                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4883                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4884                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4885                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4886                 },
4887                 .he_cap = {
4888                         .has_he = true,
4889                         .he_cap_elem = {
4890                                 .mac_cap_info[0] =
4891                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4892                                 .mac_cap_info[1] =
4893                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4894                                 .mac_cap_info[2] =
4895                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4896                                 .mac_cap_info[3] =
4897                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4898                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4899                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4900                                 .phy_cap_info[0] =
4901                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4902                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4903                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4904                                 .phy_cap_info[1] =
4905                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4906                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4907                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4908                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4909                                 .phy_cap_info[2] = 0,
4910
4911                                 /* Leave all the other PHY capability bytes
4912                                  * unset, as DCM, beam forming, RU and PPE
4913                                  * threshold information are not supported
4914                                  */
4915                         },
4916                         .he_mcs_nss_supp = {
4917                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4918                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4919                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4920                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4921                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4922                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4923                         },
4924                 },
4925         },
4926 #endif
4927 };
4928
4929 static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
4930 {
4931         switch (sband->band) {
4932         case NL80211_BAND_2GHZ:
4933                 ieee80211_set_sband_iftype_data(sband, sband_capa_2ghz);
4934                 break;
4935         case NL80211_BAND_5GHZ:
4936                 ieee80211_set_sband_iftype_data(sband, sband_capa_5ghz);
4937                 break;
4938         case NL80211_BAND_6GHZ:
4939                 ieee80211_set_sband_iftype_data(sband, sband_capa_6ghz);
4940                 break;
4941         default:
4942                 break;
4943         }
4944 }
4945
4946 #ifdef CONFIG_MAC80211_MESH
4947 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
4948 #else
4949 #define HWSIM_MESH_BIT 0
4950 #endif
4951
4952 #define HWSIM_DEFAULT_IF_LIMIT \
4953         (BIT(NL80211_IFTYPE_STATION) | \
4954          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4955          BIT(NL80211_IFTYPE_AP) | \
4956          BIT(NL80211_IFTYPE_P2P_GO) | \
4957          HWSIM_MESH_BIT)
4958
4959 #define HWSIM_IFTYPE_SUPPORT_MASK \
4960         (BIT(NL80211_IFTYPE_STATION) | \
4961          BIT(NL80211_IFTYPE_AP) | \
4962          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4963          BIT(NL80211_IFTYPE_P2P_GO) | \
4964          BIT(NL80211_IFTYPE_ADHOC) | \
4965          BIT(NL80211_IFTYPE_MESH_POINT) | \
4966          BIT(NL80211_IFTYPE_OCB))
4967
4968 static int mac80211_hwsim_new_radio(struct genl_info *info,
4969                                     struct hwsim_new_radio_params *param)
4970 {
4971         int err;
4972         u8 addr[ETH_ALEN];
4973         struct mac80211_hwsim_data *data;
4974         struct ieee80211_hw *hw;
4975         enum nl80211_band band;
4976         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
4977         struct net *net;
4978         int idx, i;
4979         int n_limits = 0;
4980
4981         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
4982                 return -EINVAL;
4983
4984         spin_lock_bh(&hwsim_radio_lock);
4985         idx = hwsim_radio_idx++;
4986         spin_unlock_bh(&hwsim_radio_lock);
4987
4988         if (param->mlo)
4989                 ops = &mac80211_hwsim_mlo_ops;
4990         else if (param->use_chanctx)
4991                 ops = &mac80211_hwsim_mchan_ops;
4992         hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
4993         if (!hw) {
4994                 pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
4995                 err = -ENOMEM;
4996                 goto failed;
4997         }
4998
4999         /* ieee80211_alloc_hw_nm may have used a default name */
5000         param->hwname = wiphy_name(hw->wiphy);
5001
5002         if (info)
5003                 net = genl_info_net(info);
5004         else
5005                 net = &init_net;
5006         wiphy_net_set(hw->wiphy, net);
5007
5008         data = hw->priv;
5009         data->hw = hw;
5010
5011         data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
5012         if (IS_ERR(data->dev)) {
5013                 printk(KERN_DEBUG
5014                        "mac80211_hwsim: device_create failed (%ld)\n",
5015                        PTR_ERR(data->dev));
5016                 err = -ENOMEM;
5017                 goto failed_drvdata;
5018         }
5019         data->dev->driver = &mac80211_hwsim_driver.driver;
5020         err = device_bind_driver(data->dev);
5021         if (err != 0) {
5022                 pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
5023                        err);
5024                 goto failed_bind;
5025         }
5026
5027         skb_queue_head_init(&data->pending);
5028
5029         SET_IEEE80211_DEV(hw, data->dev);
5030         if (!param->perm_addr) {
5031                 eth_zero_addr(addr);
5032                 addr[0] = 0x02;
5033                 addr[3] = idx >> 8;
5034                 addr[4] = idx;
5035                 memcpy(data->addresses[0].addr, addr, ETH_ALEN);
5036                 /* Why need here second address ? */
5037                 memcpy(data->addresses[1].addr, addr, ETH_ALEN);
5038                 data->addresses[1].addr[0] |= 0x40;
5039                 hw->wiphy->n_addresses = 2;
5040                 hw->wiphy->addresses = data->addresses;
5041                 /* possible address clash is checked at hash table insertion */
5042         } else {
5043                 memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
5044                 /* compatibility with automatically generated mac addr */
5045                 memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
5046                 hw->wiphy->n_addresses = 2;
5047                 hw->wiphy->addresses = data->addresses;
5048         }
5049
5050         data->channels = param->channels;
5051         data->use_chanctx = param->use_chanctx;
5052         data->idx = idx;
5053         data->destroy_on_close = param->destroy_on_close;
5054         if (info)
5055                 data->portid = info->snd_portid;
5056
5057         /* setup interface limits, only on interface types we support */
5058         if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
5059                 data->if_limits[n_limits].max = 1;
5060                 data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
5061                 n_limits++;
5062         }
5063
5064         if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
5065                 data->if_limits[n_limits].max = 2048;
5066                 /*
5067                  * For this case, we may only support a subset of
5068                  * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
5069                  * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
5070                  */
5071                 data->if_limits[n_limits].types =
5072                                         HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
5073                 n_limits++;
5074         }
5075
5076         if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5077                 data->if_limits[n_limits].max = 1;
5078                 data->if_limits[n_limits].types =
5079                                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
5080                 n_limits++;
5081         }
5082
5083         if (data->use_chanctx) {
5084                 hw->wiphy->max_scan_ssids = 255;
5085                 hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
5086                 hw->wiphy->max_remain_on_channel_duration = 1000;
5087                 data->if_combination.radar_detect_widths = 0;
5088                 data->if_combination.num_different_channels = data->channels;
5089         } else {
5090                 data->if_combination.num_different_channels = 1;
5091                 data->if_combination.radar_detect_widths =
5092                                         BIT(NL80211_CHAN_WIDTH_5) |
5093                                         BIT(NL80211_CHAN_WIDTH_10) |
5094                                         BIT(NL80211_CHAN_WIDTH_20_NOHT) |
5095                                         BIT(NL80211_CHAN_WIDTH_20) |
5096                                         BIT(NL80211_CHAN_WIDTH_40) |
5097                                         BIT(NL80211_CHAN_WIDTH_80) |
5098                                         BIT(NL80211_CHAN_WIDTH_160);
5099         }
5100
5101         if (!n_limits) {
5102                 err = -EINVAL;
5103                 goto failed_hw;
5104         }
5105
5106         data->if_combination.max_interfaces = 0;
5107         for (i = 0; i < n_limits; i++)
5108                 data->if_combination.max_interfaces +=
5109                         data->if_limits[i].max;
5110
5111         data->if_combination.n_limits = n_limits;
5112         data->if_combination.limits = data->if_limits;
5113
5114         /*
5115          * If we actually were asked to support combinations,
5116          * advertise them - if there's only a single thing like
5117          * only IBSS then don't advertise it as combinations.
5118          */
5119         if (data->if_combination.max_interfaces > 1) {
5120                 hw->wiphy->iface_combinations = &data->if_combination;
5121                 hw->wiphy->n_iface_combinations = 1;
5122         }
5123
5124         if (param->ciphers) {
5125                 memcpy(data->ciphers, param->ciphers,
5126                        param->n_ciphers * sizeof(u32));
5127                 hw->wiphy->cipher_suites = data->ciphers;
5128                 hw->wiphy->n_cipher_suites = param->n_ciphers;
5129         }
5130
5131         hw->wiphy->mbssid_max_interfaces = 8;
5132         hw->wiphy->ema_max_profile_periodicity = 3;
5133
5134         data->rx_rssi = DEFAULT_RX_RSSI;
5135
5136         INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
5137         INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
5138         INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
5139
5140         hw->queues = 5;
5141         hw->offchannel_tx_hw_queue = 4;
5142
5143         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
5144         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
5145         ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
5146         ieee80211_hw_set(hw, QUEUE_CONTROL);
5147         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
5148         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
5149         ieee80211_hw_set(hw, MFP_CAPABLE);
5150         ieee80211_hw_set(hw, SIGNAL_DBM);
5151         ieee80211_hw_set(hw, SUPPORTS_PS);
5152         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
5153         ieee80211_hw_set(hw, TDLS_WIDER_BW);
5154         ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
5155
5156         if (param->mlo) {
5157                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
5158                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
5159                 ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
5160                 ieee80211_hw_set(hw, CONNECTION_MONITOR);
5161                 ieee80211_hw_set(hw, AP_LINK_PS);
5162         } else {
5163                 ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
5164                 ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
5165                 if (rctbl)
5166                         ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
5167         }
5168
5169         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
5170         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
5171                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
5172                             WIPHY_FLAG_AP_UAPSD |
5173                             WIPHY_FLAG_SUPPORTS_5_10_MHZ |
5174                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
5175         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
5176                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
5177                                NL80211_FEATURE_STATIC_SMPS |
5178                                NL80211_FEATURE_DYNAMIC_SMPS |
5179                                NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
5180         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
5181         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
5182         wiphy_ext_feature_set(hw->wiphy,
5183                               NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
5184         wiphy_ext_feature_set(hw->wiphy,
5185                               NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
5186         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
5187
5188         wiphy_ext_feature_set(hw->wiphy,
5189                               NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT);
5190
5191         hw->wiphy->interface_modes = param->iftypes;
5192
5193         /* ask mac80211 to reserve space for magic */
5194         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
5195         hw->sta_data_size = sizeof(struct hwsim_sta_priv);
5196         hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
5197
5198         memcpy(data->channels_2ghz, hwsim_channels_2ghz,
5199                 sizeof(hwsim_channels_2ghz));
5200         memcpy(data->channels_5ghz, hwsim_channels_5ghz,
5201                 sizeof(hwsim_channels_5ghz));
5202         memcpy(data->channels_6ghz, hwsim_channels_6ghz,
5203                 sizeof(hwsim_channels_6ghz));
5204         memcpy(data->channels_s1g, hwsim_channels_s1g,
5205                sizeof(hwsim_channels_s1g));
5206         memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
5207
5208         for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
5209                 struct ieee80211_supported_band *sband = &data->bands[band];
5210
5211                 sband->band = band;
5212
5213                 switch (band) {
5214                 case NL80211_BAND_2GHZ:
5215                         sband->channels = data->channels_2ghz;
5216                         sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
5217                         sband->bitrates = data->rates;
5218                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
5219                         break;
5220                 case NL80211_BAND_5GHZ:
5221                         sband->channels = data->channels_5ghz;
5222                         sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
5223                         sband->bitrates = data->rates + 4;
5224                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5225
5226                         sband->vht_cap.vht_supported = true;
5227                         sband->vht_cap.cap =
5228                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
5229                                 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
5230                                 IEEE80211_VHT_CAP_RXLDPC |
5231                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
5232                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
5233                                 IEEE80211_VHT_CAP_TXSTBC |
5234                                 IEEE80211_VHT_CAP_RXSTBC_4 |
5235                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
5236                         sband->vht_cap.vht_mcs.rx_mcs_map =
5237                                 cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
5238                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
5239                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
5240                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
5241                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
5242                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
5243                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
5244                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
5245                         sband->vht_cap.vht_mcs.tx_mcs_map =
5246                                 sband->vht_cap.vht_mcs.rx_mcs_map;
5247                         break;
5248                 case NL80211_BAND_6GHZ:
5249                         sband->channels = data->channels_6ghz;
5250                         sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
5251                         sband->bitrates = data->rates + 4;
5252                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5253                         break;
5254                 case NL80211_BAND_S1GHZ:
5255                         memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
5256                                sizeof(sband->s1g_cap));
5257                         sband->channels = data->channels_s1g;
5258                         sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
5259                         break;
5260                 default:
5261                         continue;
5262                 }
5263
5264                 if (band != NL80211_BAND_6GHZ){
5265                         sband->ht_cap.ht_supported = true;
5266                         sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
5267                                             IEEE80211_HT_CAP_GRN_FLD |
5268                                             IEEE80211_HT_CAP_SGI_20 |
5269                                             IEEE80211_HT_CAP_SGI_40 |
5270                                             IEEE80211_HT_CAP_DSSSCCK40;
5271                         sband->ht_cap.ampdu_factor = 0x3;
5272                         sband->ht_cap.ampdu_density = 0x6;
5273                         memset(&sband->ht_cap.mcs, 0,
5274                                sizeof(sband->ht_cap.mcs));
5275                         sband->ht_cap.mcs.rx_mask[0] = 0xff;
5276                         sband->ht_cap.mcs.rx_mask[1] = 0xff;
5277                         sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5278                 }
5279
5280                 mac80211_hwsim_sband_capab(sband);
5281
5282                 hw->wiphy->bands[band] = sband;
5283         }
5284
5285         /* By default all radios belong to the first group */
5286         data->group = 1;
5287         mutex_init(&data->mutex);
5288
5289         data->netgroup = hwsim_net_get_netgroup(net);
5290         data->wmediumd = hwsim_net_get_wmediumd(net);
5291
5292         /* Enable frame retransmissions for lossy channels */
5293         hw->max_rates = 4;
5294         hw->max_rate_tries = 11;
5295
5296         hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
5297         hw->wiphy->n_vendor_commands =
5298                 ARRAY_SIZE(mac80211_hwsim_vendor_commands);
5299         hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
5300         hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
5301
5302         if (param->reg_strict)
5303                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
5304         if (param->regd) {
5305                 data->regd = param->regd;
5306                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
5307                 wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
5308                 /* give the regulatory workqueue a chance to run */
5309                 schedule_timeout_interruptible(1);
5310         }
5311
5312         /* TODO: Add param */
5313         wiphy_ext_feature_set(hw->wiphy,
5314                               NL80211_EXT_FEATURE_DFS_CONCURRENT);
5315
5316         if (param->no_vif)
5317                 ieee80211_hw_set(hw, NO_AUTO_VIF);
5318
5319         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5320
5321         for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
5322                 hrtimer_init(&data->link_data[i].beacon_timer, CLOCK_MONOTONIC,
5323                              HRTIMER_MODE_ABS_SOFT);
5324                 data->link_data[i].beacon_timer.function =
5325                         mac80211_hwsim_beacon;
5326                 data->link_data[i].link_id = i;
5327         }
5328
5329         err = ieee80211_register_hw(hw);
5330         if (err < 0) {
5331                 pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
5332                        err);
5333                 goto failed_hw;
5334         }
5335
5336         wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
5337
5338         if (param->reg_alpha2) {
5339                 data->alpha2[0] = param->reg_alpha2[0];
5340                 data->alpha2[1] = param->reg_alpha2[1];
5341                 regulatory_hint(hw->wiphy, param->reg_alpha2);
5342         }
5343
5344         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
5345         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
5346         debugfs_create_file("group", 0666, data->debugfs, data,
5347                             &hwsim_fops_group);
5348         debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
5349                             &hwsim_fops_rx_rssi);
5350         if (!data->use_chanctx)
5351                 debugfs_create_file("dfs_simulate_radar", 0222,
5352                                     data->debugfs,
5353                                     data, &hwsim_simulate_radar);
5354
5355         if (param->pmsr_capa) {
5356                 data->pmsr_capa = *param->pmsr_capa;
5357                 hw->wiphy->pmsr_capa = &data->pmsr_capa;
5358         }
5359
5360         spin_lock_bh(&hwsim_radio_lock);
5361         err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
5362                                      hwsim_rht_params);
5363         if (err < 0) {
5364                 if (info) {
5365                         GENL_SET_ERR_MSG(info, "perm addr already present");
5366                         NL_SET_BAD_ATTR(info->extack,
5367                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
5368                 }
5369                 spin_unlock_bh(&hwsim_radio_lock);
5370                 goto failed_final_insert;
5371         }
5372
5373         list_add_tail(&data->list, &hwsim_radios);
5374         hwsim_radios_generation++;
5375         spin_unlock_bh(&hwsim_radio_lock);
5376
5377         hwsim_mcast_new_radio(idx, info, param);
5378
5379         return idx;
5380
5381 failed_final_insert:
5382         debugfs_remove_recursive(data->debugfs);
5383         ieee80211_unregister_hw(data->hw);
5384 failed_hw:
5385         device_release_driver(data->dev);
5386 failed_bind:
5387         device_unregister(data->dev);
5388 failed_drvdata:
5389         ieee80211_free_hw(hw);
5390 failed:
5391         return err;
5392 }
5393
5394 static void hwsim_mcast_del_radio(int id, const char *hwname,
5395                                   struct genl_info *info)
5396 {
5397         struct sk_buff *skb;
5398         void *data;
5399         int ret;
5400
5401         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
5402         if (!skb)
5403                 return;
5404
5405         data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
5406                            HWSIM_CMD_DEL_RADIO);
5407         if (!data)
5408                 goto error;
5409
5410         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
5411         if (ret < 0)
5412                 goto error;
5413
5414         ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
5415                       hwname);
5416         if (ret < 0)
5417                 goto error;
5418
5419         genlmsg_end(skb, data);
5420
5421         hwsim_mcast_config_msg(skb, info);
5422
5423         return;
5424
5425 error:
5426         nlmsg_free(skb);
5427 }
5428
5429 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
5430                                      const char *hwname,
5431                                      struct genl_info *info)
5432 {
5433         hwsim_mcast_del_radio(data->idx, hwname, info);
5434         debugfs_remove_recursive(data->debugfs);
5435         ieee80211_unregister_hw(data->hw);
5436         device_release_driver(data->dev);
5437         device_unregister(data->dev);
5438         ieee80211_free_hw(data->hw);
5439 }
5440
5441 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
5442                                     struct mac80211_hwsim_data *data,
5443                                     u32 portid, u32 seq,
5444                                     struct netlink_callback *cb, int flags)
5445 {
5446         void *hdr;
5447         struct hwsim_new_radio_params param = { };
5448         int res = -EMSGSIZE;
5449
5450         hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
5451                           HWSIM_CMD_GET_RADIO);
5452         if (!hdr)
5453                 return -EMSGSIZE;
5454
5455         if (cb)
5456                 genl_dump_check_consistent(cb, hdr);
5457
5458         if (data->alpha2[0] && data->alpha2[1])
5459                 param.reg_alpha2 = data->alpha2;
5460
5461         param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
5462                                         REGULATORY_STRICT_REG);
5463         param.p2p_device = !!(data->hw->wiphy->interface_modes &
5464                                         BIT(NL80211_IFTYPE_P2P_DEVICE));
5465         param.use_chanctx = data->use_chanctx;
5466         param.regd = data->regd;
5467         param.channels = data->channels;
5468         param.hwname = wiphy_name(data->hw->wiphy);
5469         param.pmsr_capa = &data->pmsr_capa;
5470
5471         res = append_radio_msg(skb, data->idx, &param);
5472         if (res < 0)
5473                 goto out_err;
5474
5475         genlmsg_end(skb, hdr);
5476         return 0;
5477
5478 out_err:
5479         genlmsg_cancel(skb, hdr);
5480         return res;
5481 }
5482
5483 static void mac80211_hwsim_free(void)
5484 {
5485         struct mac80211_hwsim_data *data;
5486
5487         spin_lock_bh(&hwsim_radio_lock);
5488         while ((data = list_first_entry_or_null(&hwsim_radios,
5489                                                 struct mac80211_hwsim_data,
5490                                                 list))) {
5491                 list_del(&data->list);
5492                 spin_unlock_bh(&hwsim_radio_lock);
5493                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
5494                                          NULL);
5495                 spin_lock_bh(&hwsim_radio_lock);
5496         }
5497         spin_unlock_bh(&hwsim_radio_lock);
5498         class_destroy(hwsim_class);
5499 }
5500
5501 static const struct net_device_ops hwsim_netdev_ops = {
5502         .ndo_start_xmit         = hwsim_mon_xmit,
5503         .ndo_set_mac_address    = eth_mac_addr,
5504         .ndo_validate_addr      = eth_validate_addr,
5505 };
5506
5507 static void hwsim_mon_setup(struct net_device *dev)
5508 {
5509         u8 addr[ETH_ALEN];
5510
5511         dev->netdev_ops = &hwsim_netdev_ops;
5512         dev->needs_free_netdev = true;
5513         ether_setup(dev);
5514         dev->priv_flags |= IFF_NO_QUEUE;
5515         dev->type = ARPHRD_IEEE80211_RADIOTAP;
5516         eth_zero_addr(addr);
5517         addr[0] = 0x12;
5518         eth_hw_addr_set(dev, addr);
5519 }
5520
5521 static void hwsim_register_wmediumd(struct net *net, u32 portid)
5522 {
5523         struct mac80211_hwsim_data *data;
5524
5525         hwsim_net_set_wmediumd(net, portid);
5526
5527         spin_lock_bh(&hwsim_radio_lock);
5528         list_for_each_entry(data, &hwsim_radios, list) {
5529                 if (data->netgroup == hwsim_net_get_netgroup(net))
5530                         data->wmediumd = portid;
5531         }
5532         spin_unlock_bh(&hwsim_radio_lock);
5533 }
5534
5535 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
5536                                            struct genl_info *info)
5537 {
5538
5539         struct ieee80211_hdr *hdr;
5540         struct mac80211_hwsim_data *data2;
5541         struct ieee80211_tx_info *txi;
5542         struct hwsim_tx_rate *tx_attempts;
5543         u64 ret_skb_cookie;
5544         struct sk_buff *skb, *tmp;
5545         const u8 *src;
5546         unsigned int hwsim_flags;
5547         int i;
5548         unsigned long flags;
5549         bool found = false;
5550
5551         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
5552             !info->attrs[HWSIM_ATTR_FLAGS] ||
5553             !info->attrs[HWSIM_ATTR_COOKIE] ||
5554             !info->attrs[HWSIM_ATTR_SIGNAL] ||
5555             !info->attrs[HWSIM_ATTR_TX_INFO])
5556                 goto out;
5557
5558         src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
5559         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
5560         ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
5561
5562         data2 = get_hwsim_data_ref_from_addr(src);
5563         if (!data2)
5564                 goto out;
5565
5566         if (!hwsim_virtio_enabled) {
5567                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
5568                     data2->netgroup)
5569                         goto out;
5570
5571                 if (info->snd_portid != data2->wmediumd)
5572                         goto out;
5573         }
5574
5575         /* look for the skb matching the cookie passed back from user */
5576         spin_lock_irqsave(&data2->pending.lock, flags);
5577         skb_queue_walk_safe(&data2->pending, skb, tmp) {
5578                 uintptr_t skb_cookie;
5579
5580                 txi = IEEE80211_SKB_CB(skb);
5581                 skb_cookie = (uintptr_t)txi->rate_driver_data[0];
5582
5583                 if (skb_cookie == ret_skb_cookie) {
5584                         __skb_unlink(skb, &data2->pending);
5585                         found = true;
5586                         break;
5587                 }
5588         }
5589         spin_unlock_irqrestore(&data2->pending.lock, flags);
5590
5591         /* not found */
5592         if (!found)
5593                 goto out;
5594
5595         /* Tx info received because the frame was broadcasted on user space,
5596          so we get all the necessary info: tx attempts and skb control buff */
5597
5598         tx_attempts = (struct hwsim_tx_rate *)nla_data(
5599                        info->attrs[HWSIM_ATTR_TX_INFO]);
5600
5601         /* now send back TX status */
5602         txi = IEEE80211_SKB_CB(skb);
5603
5604         ieee80211_tx_info_clear_status(txi);
5605
5606         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
5607                 txi->status.rates[i].idx = tx_attempts[i].idx;
5608                 txi->status.rates[i].count = tx_attempts[i].count;
5609         }
5610
5611         txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
5612
5613         if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
5614            (hwsim_flags & HWSIM_TX_STAT_ACK)) {
5615                 if (skb->len >= 16) {
5616                         hdr = (struct ieee80211_hdr *) skb->data;
5617                         mac80211_hwsim_monitor_ack(data2->channel,
5618                                                    hdr->addr2);
5619                 }
5620                 txi->flags |= IEEE80211_TX_STAT_ACK;
5621         }
5622
5623         if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
5624                 txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
5625
5626         ieee80211_tx_status_irqsafe(data2->hw, skb);
5627         return 0;
5628 out:
5629         return -EINVAL;
5630
5631 }
5632
5633 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
5634                                           struct genl_info *info)
5635 {
5636         struct mac80211_hwsim_data *data2;
5637         struct ieee80211_rx_status rx_status;
5638         struct ieee80211_hdr *hdr;
5639         const u8 *dst;
5640         int frame_data_len;
5641         void *frame_data;
5642         struct sk_buff *skb = NULL;
5643         struct ieee80211_channel *channel = NULL;
5644
5645         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
5646             !info->attrs[HWSIM_ATTR_FRAME] ||
5647             !info->attrs[HWSIM_ATTR_RX_RATE] ||
5648             !info->attrs[HWSIM_ATTR_SIGNAL])
5649                 goto out;
5650
5651         dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
5652         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
5653         frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
5654
5655         if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
5656             frame_data_len > IEEE80211_MAX_DATA_LEN)
5657                 goto err;
5658
5659         /* Allocate new skb here */
5660         skb = alloc_skb(frame_data_len, GFP_KERNEL);
5661         if (skb == NULL)
5662                 goto err;
5663
5664         /* Copy the data */
5665         skb_put_data(skb, frame_data, frame_data_len);
5666
5667         data2 = get_hwsim_data_ref_from_addr(dst);
5668         if (!data2)
5669                 goto out;
5670
5671         if (data2->use_chanctx) {
5672                 if (data2->tmp_chan)
5673                         channel = data2->tmp_chan;
5674         } else {
5675                 channel = data2->channel;
5676         }
5677
5678         if (!hwsim_virtio_enabled) {
5679                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
5680                     data2->netgroup)
5681                         goto out;
5682
5683                 if (info->snd_portid != data2->wmediumd)
5684                         goto out;
5685         }
5686
5687         /* check if radio is configured properly */
5688
5689         if ((data2->idle && !data2->tmp_chan) || !data2->started)
5690                 goto out;
5691
5692         /* A frame is received from user space */
5693         memset(&rx_status, 0, sizeof(rx_status));
5694         if (info->attrs[HWSIM_ATTR_FREQ]) {
5695                 struct tx_iter_data iter_data = {};
5696
5697                 /* throw away off-channel packets, but allow both the temporary
5698                  * ("hw" scan/remain-on-channel), regular channels and links,
5699                  * since the internal datapath also allows this
5700                  */
5701                 rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
5702
5703                 iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
5704                                                           rx_status.freq);
5705                 if (!iter_data.channel)
5706                         goto out;
5707                 rx_status.band = iter_data.channel->band;
5708
5709                 mutex_lock(&data2->mutex);
5710                 if (!hwsim_chans_compat(iter_data.channel, channel)) {
5711                         ieee80211_iterate_active_interfaces_atomic(
5712                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
5713                                 mac80211_hwsim_tx_iter, &iter_data);
5714                         if (!iter_data.receive) {
5715                                 mutex_unlock(&data2->mutex);
5716                                 goto out;
5717                         }
5718                 }
5719                 mutex_unlock(&data2->mutex);
5720         } else if (!channel) {
5721                 goto out;
5722         } else {
5723                 rx_status.freq = channel->center_freq;
5724                 rx_status.band = channel->band;
5725         }
5726
5727         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
5728         if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
5729                 goto out;
5730         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
5731
5732         hdr = (void *)skb->data;
5733
5734         if (ieee80211_is_beacon(hdr->frame_control) ||
5735             ieee80211_is_probe_resp(hdr->frame_control))
5736                 rx_status.boottime_ns = ktime_get_boottime_ns();
5737
5738         mac80211_hwsim_rx(data2, &rx_status, skb);
5739
5740         return 0;
5741 err:
5742         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
5743 out:
5744         dev_kfree_skb(skb);
5745         return -EINVAL;
5746 }
5747
5748 static int hwsim_register_received_nl(struct sk_buff *skb_2,
5749                                       struct genl_info *info)
5750 {
5751         struct net *net = genl_info_net(info);
5752         struct mac80211_hwsim_data *data;
5753         int chans = 1;
5754
5755         spin_lock_bh(&hwsim_radio_lock);
5756         list_for_each_entry(data, &hwsim_radios, list)
5757                 chans = max(chans, data->channels);
5758         spin_unlock_bh(&hwsim_radio_lock);
5759
5760         /* In the future we should revise the userspace API and allow it
5761          * to set a flag that it does support multi-channel, then we can
5762          * let this pass conditionally on the flag.
5763          * For current userspace, prohibit it since it won't work right.
5764          */
5765         if (chans > 1)
5766                 return -EOPNOTSUPP;
5767
5768         if (hwsim_net_get_wmediumd(net))
5769                 return -EBUSY;
5770
5771         hwsim_register_wmediumd(net, info->snd_portid);
5772
5773         pr_debug("mac80211_hwsim: received a REGISTER, "
5774                "switching to wmediumd mode with pid %d\n", info->snd_portid);
5775
5776         return 0;
5777 }
5778
5779 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
5780 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
5781 {
5782         int i;
5783
5784         for (i = 0; i < n_ciphers; i++) {
5785                 int j;
5786                 int found = 0;
5787
5788                 for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
5789                         if (ciphers[i] == hwsim_ciphers[j]) {
5790                                 found = 1;
5791                                 break;
5792                         }
5793                 }
5794
5795                 if (!found)
5796                         return false;
5797         }
5798
5799         return true;
5800 }
5801
5802 static int parse_ftm_capa(const struct nlattr *ftm_capa, struct cfg80211_pmsr_capabilities *out,
5803                           struct genl_info *info)
5804 {
5805         struct nlattr *tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
5806         int ret;
5807
5808         ret = nla_parse_nested(tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX, ftm_capa, hwsim_ftm_capa_policy,
5809                                NULL);
5810         if (ret) {
5811                 NL_SET_ERR_MSG_ATTR(info->extack, ftm_capa, "malformed FTM capability");
5812                 return -EINVAL;
5813         }
5814
5815         out->ftm.supported = 1;
5816         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES])
5817                 out->ftm.preambles = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]);
5818         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS])
5819                 out->ftm.bandwidths = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]);
5820         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT])
5821                 out->ftm.max_bursts_exponent =
5822                         nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT]);
5823         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST])
5824                 out->ftm.max_ftms_per_burst =
5825                         nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST]);
5826         out->ftm.asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_ASAP];
5827         out->ftm.non_asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP];
5828         out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI];
5829         out->ftm.request_civicloc = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC];
5830         out->ftm.trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED];
5831         out->ftm.non_trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED];
5832
5833         return 0;
5834 }
5835
5836 static int parse_pmsr_capa(const struct nlattr *pmsr_capa, struct cfg80211_pmsr_capabilities *out,
5837                            struct genl_info *info)
5838 {
5839         struct nlattr *tb[NL80211_PMSR_ATTR_MAX + 1];
5840         struct nlattr *nla;
5841         int size;
5842         int ret;
5843
5844         ret = nla_parse_nested(tb, NL80211_PMSR_ATTR_MAX, pmsr_capa, hwsim_pmsr_capa_policy, NULL);
5845         if (ret) {
5846                 NL_SET_ERR_MSG_ATTR(info->extack, pmsr_capa, "malformed PMSR capability");
5847                 return -EINVAL;
5848         }
5849
5850         if (tb[NL80211_PMSR_ATTR_MAX_PEERS])
5851                 out->max_peers = nla_get_u32(tb[NL80211_PMSR_ATTR_MAX_PEERS]);
5852         out->report_ap_tsf = !!tb[NL80211_PMSR_ATTR_REPORT_AP_TSF];
5853         out->randomize_mac_addr = !!tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR];
5854
5855         if (!tb[NL80211_PMSR_ATTR_TYPE_CAPA]) {
5856                 NL_SET_ERR_MSG_ATTR(info->extack, tb[NL80211_PMSR_ATTR_TYPE_CAPA],
5857                                     "malformed PMSR type");
5858                 return -EINVAL;
5859         }
5860
5861         nla_for_each_nested(nla, tb[NL80211_PMSR_ATTR_TYPE_CAPA], size) {
5862                 switch (nla_type(nla)) {
5863                 case NL80211_PMSR_TYPE_FTM:
5864                         parse_ftm_capa(nla, out, info);
5865                         break;
5866                 default:
5867                         NL_SET_ERR_MSG_ATTR(info->extack, nla, "unsupported measurement type");
5868                         return -EINVAL;
5869                 }
5870         }
5871
5872         return 0;
5873 }
5874
5875 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
5876 {
5877         struct hwsim_new_radio_params param = { 0 };
5878         const char *hwname = NULL;
5879         int ret;
5880
5881         param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
5882         param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
5883         param.channels = channels;
5884         param.destroy_on_close =
5885                 info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
5886
5887         if (info->attrs[HWSIM_ATTR_CHANNELS])
5888                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
5889
5890         if (param.channels < 1) {
5891                 GENL_SET_ERR_MSG(info, "must have at least one channel");
5892                 return -EINVAL;
5893         }
5894
5895         if (info->attrs[HWSIM_ATTR_NO_VIF])
5896                 param.no_vif = true;
5897
5898         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
5899                 param.use_chanctx = true;
5900         else
5901                 param.use_chanctx = (param.channels > 1);
5902
5903         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
5904                 param.reg_alpha2 =
5905                         nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
5906
5907         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
5908                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
5909
5910                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
5911                         return -EINVAL;
5912
5913                 idx = array_index_nospec(idx,
5914                                          ARRAY_SIZE(hwsim_world_regdom_custom));
5915                 param.regd = hwsim_world_regdom_custom[idx];
5916         }
5917
5918         if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
5919                 if (!is_valid_ether_addr(
5920                                 nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
5921                         GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
5922                         NL_SET_BAD_ATTR(info->extack,
5923                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
5924                         return -EINVAL;
5925                 }
5926
5927                 param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
5928         }
5929
5930         if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
5931                 param.iftypes =
5932                         nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
5933
5934                 if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
5935                         NL_SET_ERR_MSG_ATTR(info->extack,
5936                                             info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
5937                                             "cannot support more iftypes than kernel");
5938                         return -EINVAL;
5939                 }
5940         } else {
5941                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5942         }
5943
5944         /* ensure both flag and iftype support is honored */
5945         if (param.p2p_device ||
5946             param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5947                 param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5948                 param.p2p_device = true;
5949         }
5950
5951         if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
5952                 u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5953
5954                 param.ciphers =
5955                         nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5956
5957                 if (len % sizeof(u32)) {
5958                         NL_SET_ERR_MSG_ATTR(info->extack,
5959                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5960                                             "bad cipher list length");
5961                         return -EINVAL;
5962                 }
5963
5964                 param.n_ciphers = len / sizeof(u32);
5965
5966                 if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
5967                         NL_SET_ERR_MSG_ATTR(info->extack,
5968                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5969                                             "too many ciphers specified");
5970                         return -EINVAL;
5971                 }
5972
5973                 if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
5974                         NL_SET_ERR_MSG_ATTR(info->extack,
5975                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5976                                             "unsupported ciphers specified");
5977                         return -EINVAL;
5978                 }
5979         }
5980
5981         param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
5982
5983         if (param.mlo)
5984                 param.use_chanctx = true;
5985
5986         if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5987                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5988                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5989                                   GFP_KERNEL);
5990                 if (!hwname)
5991                         return -ENOMEM;
5992                 param.hwname = hwname;
5993         }
5994
5995         if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
5996                 struct cfg80211_pmsr_capabilities *pmsr_capa;
5997
5998                 pmsr_capa = kmalloc(sizeof(*pmsr_capa), GFP_KERNEL);
5999                 if (!pmsr_capa) {
6000                         ret = -ENOMEM;
6001                         goto out_free;
6002                 }
6003                 param.pmsr_capa = pmsr_capa;
6004
6005                 ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info);
6006                 if (ret)
6007                         goto out_free;
6008         }
6009
6010         ret = mac80211_hwsim_new_radio(info, &param);
6011
6012 out_free:
6013         kfree(hwname);
6014         kfree(param.pmsr_capa);
6015         return ret;
6016 }
6017
6018 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
6019 {
6020         struct mac80211_hwsim_data *data;
6021         s64 idx = -1;
6022         const char *hwname = NULL;
6023
6024         if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
6025                 idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
6026         } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
6027                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6028                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6029                                   GFP_KERNEL);
6030                 if (!hwname)
6031                         return -ENOMEM;
6032         } else
6033                 return -EINVAL;
6034
6035         spin_lock_bh(&hwsim_radio_lock);
6036         list_for_each_entry(data, &hwsim_radios, list) {
6037                 if (idx >= 0) {
6038                         if (data->idx != idx)
6039                                 continue;
6040                 } else {
6041                         if (!hwname ||
6042                             strcmp(hwname, wiphy_name(data->hw->wiphy)))
6043                                 continue;
6044                 }
6045
6046                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6047                         continue;
6048
6049                 list_del(&data->list);
6050                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6051                                        hwsim_rht_params);
6052                 hwsim_radios_generation++;
6053                 spin_unlock_bh(&hwsim_radio_lock);
6054                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
6055                                          info);
6056                 kfree(hwname);
6057                 return 0;
6058         }
6059         spin_unlock_bh(&hwsim_radio_lock);
6060
6061         kfree(hwname);
6062         return -ENODEV;
6063 }
6064
6065 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
6066 {
6067         struct mac80211_hwsim_data *data;
6068         struct sk_buff *skb;
6069         int idx, res = -ENODEV;
6070
6071         if (!info->attrs[HWSIM_ATTR_RADIO_ID])
6072                 return -EINVAL;
6073         idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
6074
6075         spin_lock_bh(&hwsim_radio_lock);
6076         list_for_each_entry(data, &hwsim_radios, list) {
6077                 if (data->idx != idx)
6078                         continue;
6079
6080                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6081                         continue;
6082
6083                 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6084                 if (!skb) {
6085                         res = -ENOMEM;
6086                         goto out_err;
6087                 }
6088
6089                 res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
6090                                                info->snd_seq, NULL, 0);
6091                 if (res < 0) {
6092                         nlmsg_free(skb);
6093                         goto out_err;
6094                 }
6095
6096                 res = genlmsg_reply(skb, info);
6097                 break;
6098         }
6099
6100 out_err:
6101         spin_unlock_bh(&hwsim_radio_lock);
6102
6103         return res;
6104 }
6105
6106 static int hwsim_dump_radio_nl(struct sk_buff *skb,
6107                                struct netlink_callback *cb)
6108 {
6109         int last_idx = cb->args[0] - 1;
6110         struct mac80211_hwsim_data *data = NULL;
6111         int res = 0;
6112         void *hdr;
6113
6114         spin_lock_bh(&hwsim_radio_lock);
6115         cb->seq = hwsim_radios_generation;
6116
6117         if (last_idx >= hwsim_radio_idx-1)
6118                 goto done;
6119
6120         list_for_each_entry(data, &hwsim_radios, list) {
6121                 if (data->idx <= last_idx)
6122                         continue;
6123
6124                 if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
6125                         continue;
6126
6127                 res = mac80211_hwsim_get_radio(skb, data,
6128                                                NETLINK_CB(cb->skb).portid,
6129                                                cb->nlh->nlmsg_seq, cb,
6130                                                NLM_F_MULTI);
6131                 if (res < 0)
6132                         break;
6133
6134                 last_idx = data->idx;
6135         }
6136
6137         cb->args[0] = last_idx + 1;
6138
6139         /* list changed, but no new element sent, set interrupted flag */
6140         if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
6141                 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
6142                                   cb->nlh->nlmsg_seq, &hwsim_genl_family,
6143                                   NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
6144                 if (hdr) {
6145                         genl_dump_check_consistent(cb, hdr);
6146                         genlmsg_end(skb, hdr);
6147                 } else {
6148                         res = -EMSGSIZE;
6149                 }
6150         }
6151
6152 done:
6153         spin_unlock_bh(&hwsim_radio_lock);
6154         return res ?: skb->len;
6155 }
6156
6157 /* Generic Netlink operations array */
6158 static const struct genl_small_ops hwsim_ops[] = {
6159         {
6160                 .cmd = HWSIM_CMD_REGISTER,
6161                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6162                 .doit = hwsim_register_received_nl,
6163                 .flags = GENL_UNS_ADMIN_PERM,
6164         },
6165         {
6166                 .cmd = HWSIM_CMD_FRAME,
6167                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6168                 .doit = hwsim_cloned_frame_received_nl,
6169         },
6170         {
6171                 .cmd = HWSIM_CMD_TX_INFO_FRAME,
6172                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6173                 .doit = hwsim_tx_info_frame_received_nl,
6174         },
6175         {
6176                 .cmd = HWSIM_CMD_NEW_RADIO,
6177                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6178                 .doit = hwsim_new_radio_nl,
6179                 .flags = GENL_UNS_ADMIN_PERM,
6180         },
6181         {
6182                 .cmd = HWSIM_CMD_DEL_RADIO,
6183                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6184                 .doit = hwsim_del_radio_nl,
6185                 .flags = GENL_UNS_ADMIN_PERM,
6186         },
6187         {
6188                 .cmd = HWSIM_CMD_GET_RADIO,
6189                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6190                 .doit = hwsim_get_radio_nl,
6191                 .dumpit = hwsim_dump_radio_nl,
6192         },
6193         {
6194                 .cmd = HWSIM_CMD_REPORT_PMSR,
6195                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6196                 .doit = hwsim_pmsr_report_nl,
6197         },
6198 };
6199
6200 static struct genl_family hwsim_genl_family __ro_after_init = {
6201         .name = "MAC80211_HWSIM",
6202         .version = 1,
6203         .maxattr = HWSIM_ATTR_MAX,
6204         .policy = hwsim_genl_policy,
6205         .netnsok = true,
6206         .module = THIS_MODULE,
6207         .small_ops = hwsim_ops,
6208         .n_small_ops = ARRAY_SIZE(hwsim_ops),
6209         .resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
6210         .mcgrps = hwsim_mcgrps,
6211         .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
6212 };
6213
6214 static void remove_user_radios(u32 portid)
6215 {
6216         struct mac80211_hwsim_data *entry, *tmp;
6217         LIST_HEAD(list);
6218
6219         spin_lock_bh(&hwsim_radio_lock);
6220         list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
6221                 if (entry->destroy_on_close && entry->portid == portid) {
6222                         list_move(&entry->list, &list);
6223                         rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
6224                                                hwsim_rht_params);
6225                         hwsim_radios_generation++;
6226                 }
6227         }
6228         spin_unlock_bh(&hwsim_radio_lock);
6229
6230         list_for_each_entry_safe(entry, tmp, &list, list) {
6231                 list_del(&entry->list);
6232                 mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
6233                                          NULL);
6234         }
6235 }
6236
6237 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
6238                                          unsigned long state,
6239                                          void *_notify)
6240 {
6241         struct netlink_notify *notify = _notify;
6242
6243         if (state != NETLINK_URELEASE)
6244                 return NOTIFY_DONE;
6245
6246         remove_user_radios(notify->portid);
6247
6248         if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
6249                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
6250                        " socket, switching to perfect channel medium\n");
6251                 hwsim_register_wmediumd(notify->net, 0);
6252         }
6253         return NOTIFY_DONE;
6254
6255 }
6256
6257 static struct notifier_block hwsim_netlink_notifier = {
6258         .notifier_call = mac80211_hwsim_netlink_notify,
6259 };
6260
6261 static int __init hwsim_init_netlink(void)
6262 {
6263         int rc;
6264
6265         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
6266
6267         rc = genl_register_family(&hwsim_genl_family);
6268         if (rc)
6269                 goto failure;
6270
6271         rc = netlink_register_notifier(&hwsim_netlink_notifier);
6272         if (rc) {
6273                 genl_unregister_family(&hwsim_genl_family);
6274                 goto failure;
6275         }
6276
6277         return 0;
6278
6279 failure:
6280         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
6281         return -EINVAL;
6282 }
6283
6284 static __net_init int hwsim_init_net(struct net *net)
6285 {
6286         return hwsim_net_set_netgroup(net);
6287 }
6288
6289 static void __net_exit hwsim_exit_net(struct net *net)
6290 {
6291         struct mac80211_hwsim_data *data, *tmp;
6292         LIST_HEAD(list);
6293
6294         spin_lock_bh(&hwsim_radio_lock);
6295         list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
6296                 if (!net_eq(wiphy_net(data->hw->wiphy), net))
6297                         continue;
6298
6299                 /* Radios created in init_net are returned to init_net. */
6300                 if (data->netgroup == hwsim_net_get_netgroup(&init_net))
6301                         continue;
6302
6303                 list_move(&data->list, &list);
6304                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6305                                        hwsim_rht_params);
6306                 hwsim_radios_generation++;
6307         }
6308         spin_unlock_bh(&hwsim_radio_lock);
6309
6310         list_for_each_entry_safe(data, tmp, &list, list) {
6311                 list_del(&data->list);
6312                 mac80211_hwsim_del_radio(data,
6313                                          wiphy_name(data->hw->wiphy),
6314                                          NULL);
6315         }
6316
6317         ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
6318 }
6319
6320 static struct pernet_operations hwsim_net_ops = {
6321         .init = hwsim_init_net,
6322         .exit = hwsim_exit_net,
6323         .id   = &hwsim_net_id,
6324         .size = sizeof(struct hwsim_net),
6325 };
6326
6327 static void hwsim_exit_netlink(void)
6328 {
6329         /* unregister the notifier */
6330         netlink_unregister_notifier(&hwsim_netlink_notifier);
6331         /* unregister the family */
6332         genl_unregister_family(&hwsim_genl_family);
6333 }
6334
6335 #if IS_REACHABLE(CONFIG_VIRTIO)
6336 static void hwsim_virtio_tx_done(struct virtqueue *vq)
6337 {
6338         unsigned int len;
6339         struct sk_buff *skb;
6340         unsigned long flags;
6341
6342         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6343         while ((skb = virtqueue_get_buf(vq, &len)))
6344                 dev_kfree_skb_irq(skb);
6345         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6346 }
6347
6348 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
6349 {
6350         struct nlmsghdr *nlh;
6351         struct genlmsghdr *gnlh;
6352         struct nlattr *tb[HWSIM_ATTR_MAX + 1];
6353         struct genl_info info = {};
6354         int err;
6355
6356         nlh = nlmsg_hdr(skb);
6357         gnlh = nlmsg_data(nlh);
6358
6359         if (skb->len < nlh->nlmsg_len)
6360                 return -EINVAL;
6361
6362         err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
6363                             hwsim_genl_policy, NULL);
6364         if (err) {
6365                 pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
6366                 return err;
6367         }
6368
6369         info.attrs = tb;
6370
6371         switch (gnlh->cmd) {
6372         case HWSIM_CMD_FRAME:
6373                 hwsim_cloned_frame_received_nl(skb, &info);
6374                 break;
6375         case HWSIM_CMD_TX_INFO_FRAME:
6376                 hwsim_tx_info_frame_received_nl(skb, &info);
6377                 break;
6378         case HWSIM_CMD_REPORT_PMSR:
6379                 hwsim_pmsr_report_nl(skb, &info);
6380                 break;
6381         default:
6382                 pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
6383                 return -EPROTO;
6384         }
6385         return 0;
6386 }
6387
6388 static void hwsim_virtio_rx_work(struct work_struct *work)
6389 {
6390         struct virtqueue *vq;
6391         unsigned int len;
6392         struct sk_buff *skb;
6393         struct scatterlist sg[1];
6394         int err;
6395         unsigned long flags;
6396
6397         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6398         if (!hwsim_virtio_enabled)
6399                 goto out_unlock;
6400
6401         skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
6402         if (!skb)
6403                 goto out_unlock;
6404         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6405
6406         skb->data = skb->head;
6407         skb_reset_tail_pointer(skb);
6408         skb_put(skb, len);
6409         hwsim_virtio_handle_cmd(skb);
6410
6411         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6412         if (!hwsim_virtio_enabled) {
6413                 dev_kfree_skb_irq(skb);
6414                 goto out_unlock;
6415         }
6416         vq = hwsim_vqs[HWSIM_VQ_RX];
6417         sg_init_one(sg, skb->head, skb_end_offset(skb));
6418         err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
6419         if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
6420                 dev_kfree_skb_irq(skb);
6421         else
6422                 virtqueue_kick(vq);
6423         schedule_work(&hwsim_virtio_rx);
6424
6425 out_unlock:
6426         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6427 }
6428
6429 static void hwsim_virtio_rx_done(struct virtqueue *vq)
6430 {
6431         schedule_work(&hwsim_virtio_rx);
6432 }
6433
6434 static int init_vqs(struct virtio_device *vdev)
6435 {
6436         vq_callback_t *callbacks[HWSIM_NUM_VQS] = {
6437                 [HWSIM_VQ_TX] = hwsim_virtio_tx_done,
6438                 [HWSIM_VQ_RX] = hwsim_virtio_rx_done,
6439         };
6440         const char *names[HWSIM_NUM_VQS] = {
6441                 [HWSIM_VQ_TX] = "tx",
6442                 [HWSIM_VQ_RX] = "rx",
6443         };
6444
6445         return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
6446                                hwsim_vqs, callbacks, names, NULL);
6447 }
6448
6449 static int fill_vq(struct virtqueue *vq)
6450 {
6451         int i, err;
6452         struct sk_buff *skb;
6453         struct scatterlist sg[1];
6454
6455         for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
6456                 skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
6457                 if (!skb)
6458                         return -ENOMEM;
6459
6460                 sg_init_one(sg, skb->head, skb_end_offset(skb));
6461                 err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
6462                 if (err) {
6463                         nlmsg_free(skb);
6464                         return err;
6465                 }
6466         }
6467         virtqueue_kick(vq);
6468         return 0;
6469 }
6470
6471 static void remove_vqs(struct virtio_device *vdev)
6472 {
6473         int i;
6474
6475         virtio_reset_device(vdev);
6476
6477         for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
6478                 struct virtqueue *vq = hwsim_vqs[i];
6479                 struct sk_buff *skb;
6480
6481                 while ((skb = virtqueue_detach_unused_buf(vq)))
6482                         nlmsg_free(skb);
6483         }
6484
6485         vdev->config->del_vqs(vdev);
6486 }
6487
6488 static int hwsim_virtio_probe(struct virtio_device *vdev)
6489 {
6490         int err;
6491         unsigned long flags;
6492
6493         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6494         if (hwsim_virtio_enabled) {
6495                 spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6496                 return -EEXIST;
6497         }
6498         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6499
6500         err = init_vqs(vdev);
6501         if (err)
6502                 return err;
6503
6504         virtio_device_ready(vdev);
6505
6506         err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
6507         if (err)
6508                 goto out_remove;
6509
6510         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6511         hwsim_virtio_enabled = true;
6512         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6513
6514         schedule_work(&hwsim_virtio_rx);
6515         return 0;
6516
6517 out_remove:
6518         remove_vqs(vdev);
6519         return err;
6520 }
6521
6522 static void hwsim_virtio_remove(struct virtio_device *vdev)
6523 {
6524         hwsim_virtio_enabled = false;
6525
6526         cancel_work_sync(&hwsim_virtio_rx);
6527
6528         remove_vqs(vdev);
6529 }
6530
6531 /* MAC80211_HWSIM virtio device id table */
6532 static const struct virtio_device_id id_table[] = {
6533         { VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
6534         { 0 }
6535 };
6536 MODULE_DEVICE_TABLE(virtio, id_table);
6537
6538 static struct virtio_driver virtio_hwsim = {
6539         .driver.name = KBUILD_MODNAME,
6540         .driver.owner = THIS_MODULE,
6541         .id_table = id_table,
6542         .probe = hwsim_virtio_probe,
6543         .remove = hwsim_virtio_remove,
6544 };
6545
6546 static int hwsim_register_virtio_driver(void)
6547 {
6548         return register_virtio_driver(&virtio_hwsim);
6549 }
6550
6551 static void hwsim_unregister_virtio_driver(void)
6552 {
6553         unregister_virtio_driver(&virtio_hwsim);
6554 }
6555 #else
6556 static inline int hwsim_register_virtio_driver(void)
6557 {
6558         return 0;
6559 }
6560
6561 static inline void hwsim_unregister_virtio_driver(void)
6562 {
6563 }
6564 #endif
6565
6566 static int __init init_mac80211_hwsim(void)
6567 {
6568         int i, err;
6569
6570         if (radios < 0 || radios > 100)
6571                 return -EINVAL;
6572
6573         if (channels < 1)
6574                 return -EINVAL;
6575
6576         err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
6577         if (err)
6578                 return err;
6579
6580         err = register_pernet_device(&hwsim_net_ops);
6581         if (err)
6582                 goto out_free_rht;
6583
6584         err = platform_driver_register(&mac80211_hwsim_driver);
6585         if (err)
6586                 goto out_unregister_pernet;
6587
6588         err = hwsim_init_netlink();
6589         if (err)
6590                 goto out_unregister_driver;
6591
6592         err = hwsim_register_virtio_driver();
6593         if (err)
6594                 goto out_exit_netlink;
6595
6596         hwsim_class = class_create("mac80211_hwsim");
6597         if (IS_ERR(hwsim_class)) {
6598                 err = PTR_ERR(hwsim_class);
6599                 goto out_exit_virtio;
6600         }
6601
6602         hwsim_init_s1g_channels(hwsim_channels_s1g);
6603
6604         for (i = 0; i < radios; i++) {
6605                 struct hwsim_new_radio_params param = { 0 };
6606
6607                 param.channels = channels;
6608
6609                 switch (regtest) {
6610                 case HWSIM_REGTEST_DIFF_COUNTRY:
6611                         if (i < ARRAY_SIZE(hwsim_alpha2s))
6612                                 param.reg_alpha2 = hwsim_alpha2s[i];
6613                         break;
6614                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
6615                         if (!i)
6616                                 param.reg_alpha2 = hwsim_alpha2s[0];
6617                         break;
6618                 case HWSIM_REGTEST_STRICT_ALL:
6619                         param.reg_strict = true;
6620                         fallthrough;
6621                 case HWSIM_REGTEST_DRIVER_REG_ALL:
6622                         param.reg_alpha2 = hwsim_alpha2s[0];
6623                         break;
6624                 case HWSIM_REGTEST_WORLD_ROAM:
6625                         if (i == 0)
6626                                 param.regd = &hwsim_world_regdom_custom_01;
6627                         break;
6628                 case HWSIM_REGTEST_CUSTOM_WORLD:
6629                         param.regd = &hwsim_world_regdom_custom_01;
6630                         break;
6631                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
6632                         if (i == 0)
6633                                 param.regd = &hwsim_world_regdom_custom_01;
6634                         else if (i == 1)
6635                                 param.regd = &hwsim_world_regdom_custom_02;
6636                         break;
6637                 case HWSIM_REGTEST_STRICT_FOLLOW:
6638                         if (i == 0) {
6639                                 param.reg_strict = true;
6640                                 param.reg_alpha2 = hwsim_alpha2s[0];
6641                         }
6642                         break;
6643                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
6644                         if (i == 0) {
6645                                 param.reg_strict = true;
6646                                 param.reg_alpha2 = hwsim_alpha2s[0];
6647                         } else if (i == 1) {
6648                                 param.reg_alpha2 = hwsim_alpha2s[1];
6649                         }
6650                         break;
6651                 case HWSIM_REGTEST_ALL:
6652                         switch (i) {
6653                         case 0:
6654                                 param.regd = &hwsim_world_regdom_custom_01;
6655                                 break;
6656                         case 1:
6657                                 param.regd = &hwsim_world_regdom_custom_02;
6658                                 break;
6659                         case 2:
6660                                 param.reg_alpha2 = hwsim_alpha2s[0];
6661                                 break;
6662                         case 3:
6663                                 param.reg_alpha2 = hwsim_alpha2s[1];
6664                                 break;
6665                         case 4:
6666                                 param.reg_strict = true;
6667                                 param.reg_alpha2 = hwsim_alpha2s[2];
6668                                 break;
6669                         }
6670                         break;
6671                 default:
6672                         break;
6673                 }
6674
6675                 param.p2p_device = support_p2p_device;
6676                 param.mlo = mlo;
6677                 param.use_chanctx = channels > 1 || mlo;
6678                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
6679                 if (param.p2p_device)
6680                         param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
6681
6682                 err = mac80211_hwsim_new_radio(NULL, &param);
6683                 if (err < 0)
6684                         goto out_free_radios;
6685         }
6686
6687         hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
6688                                  hwsim_mon_setup);
6689         if (hwsim_mon == NULL) {
6690                 err = -ENOMEM;
6691                 goto out_free_radios;
6692         }
6693
6694         rtnl_lock();
6695         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
6696         if (err < 0) {
6697                 rtnl_unlock();
6698                 goto out_free_mon;
6699         }
6700
6701         err = register_netdevice(hwsim_mon);
6702         if (err < 0) {
6703                 rtnl_unlock();
6704                 goto out_free_mon;
6705         }
6706         rtnl_unlock();
6707
6708         return 0;
6709
6710 out_free_mon:
6711         free_netdev(hwsim_mon);
6712 out_free_radios:
6713         mac80211_hwsim_free();
6714 out_exit_virtio:
6715         hwsim_unregister_virtio_driver();
6716 out_exit_netlink:
6717         hwsim_exit_netlink();
6718 out_unregister_driver:
6719         platform_driver_unregister(&mac80211_hwsim_driver);
6720 out_unregister_pernet:
6721         unregister_pernet_device(&hwsim_net_ops);
6722 out_free_rht:
6723         rhashtable_destroy(&hwsim_radios_rht);
6724         return err;
6725 }
6726 module_init(init_mac80211_hwsim);
6727
6728 static void __exit exit_mac80211_hwsim(void)
6729 {
6730         pr_debug("mac80211_hwsim: unregister radios\n");
6731
6732         hwsim_unregister_virtio_driver();
6733         hwsim_exit_netlink();
6734
6735         mac80211_hwsim_free();
6736
6737         rhashtable_destroy(&hwsim_radios_rht);
6738         unregister_netdev(hwsim_mon);
6739         platform_driver_unregister(&mac80211_hwsim_driver);
6740         unregister_pernet_device(&hwsim_net_ops);
6741 }
6742 module_exit(exit_mac80211_hwsim);