drivers/net/wireless/mac80211_hwsim.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
   4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
   6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
   7  * Copyright (C) 2018 - 2022 Intel Corporation
   8  */
   9
  10 /*
  11  * TODO:
  12  * - Add TSF sync and fix IBSS beacon transmission by adding
  13  *   competition for "air time" at TBTT
  14  * - RX filtering based on filter configuration (data->rx_filter)
  15  */
  16
  17 #include <linux/list.h>
  18 #include <linux/slab.h>
  19 #include <linux/spinlock.h>
  20 #include <net/dst.h>
  21 #include <net/xfrm.h>
  22 #include <net/mac80211.h>
  23 #include <net/ieee80211_radiotap.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/rtnetlink.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/platform_device.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/module.h>
  30 #include <linux/ktime.h>
  31 #include <net/genetlink.h>
  32 #include <net/net_namespace.h>
  33 #include <net/netns/generic.h>
  34 #include <linux/rhashtable.h>
  35 #include <linux/nospec.h>
  36 #include <linux/virtio.h>
  37 #include <linux/virtio_ids.h>
  38 #include <linux/virtio_config.h>
  39 #include "mac80211_hwsim.h"
  40
  41 #define WARN_QUEUE 100
  42 #define MAX_QUEUE 200
  43
  44 MODULE_AUTHOR("Jouni Malinen");
  45 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
  46 MODULE_LICENSE("GPL");
  47
  48 static int radios = 2;
  49 module_param(radios, int, 0444);
  50 MODULE_PARM_DESC(radios, "Number of simulated radios");
  51
  52 static int channels = 1;
  53 module_param(channels, int, 0444);
  54 MODULE_PARM_DESC(channels, "Number of concurrent channels");
  55
  56 static bool paged_rx = false;
  57 module_param(paged_rx, bool, 0644);
  58 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
  59
  60 static bool rctbl = false;
  61 module_param(rctbl, bool, 0444);
  62 MODULE_PARM_DESC(rctbl, "Handle rate control table");
  63
  64 static bool support_p2p_device = true;
  65 module_param(support_p2p_device, bool, 0444);
  66 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
  67
  68 static bool mlo;
  69 module_param(mlo, bool, 0444);
  70 MODULE_PARM_DESC(mlo, "Support MLO");
  71
  72 /**
  73  * enum hwsim_regtest - the type of regulatory tests we offer
  74  *
  75  * These are the different values you can use for the regtest
  76  * module parameter. This is useful to help test world roaming
  77  * and the driver regulatory_hint() call and combinations of these.
  78  * If you want to do specific alpha2 regulatory domain tests simply
  79  * use the userspace regulatory request as that will be respected as
  80  * well without the need of this module parameter. This is designed
  81  * only for testing the driver regulatory request, world roaming
  82  * and all possible combinations.
  83  *
  84  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
  85  *      this is the default value.
  86  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
  87  *      hint, only one driver regulatory hint will be sent as such the
  88  *      secondary radios are expected to follow.
  89  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
  90  *      request with all radios reporting the same regulatory domain.
  91  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
  92  *      different regulatory domains requests. Expected behaviour is for
  93  *      an intersection to occur but each device will still use their
  94  *      respective regulatory requested domains. Subsequent radios will
  95  *      use the resulting intersection.
  96  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
  97  *      this by using a custom beacon-capable regulatory domain for the first
  98  *      radio. All other device world roam.
  99  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
 100  *      domain requests. All radios will adhere to this custom world regulatory
 101  *      domain.
 102  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
 103  *      domain requests. The first radio will adhere to the first custom world
 104  *      regulatory domain, the second one to the second custom world regulatory
 105  *      domain. All other devices will world roam.
 106  * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
 107  *      settings, only the first radio will send a regulatory domain request
 108  *      and use strict settings. The rest of the radios are expected to follow.
 109  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
 110  *      settings. All radios will adhere to this.
 111  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
 112  *      domain settings, combined with secondary driver regulatory domain
 113  *      settings. The first radio will get a strict regulatory domain setting
 114  *      using the first driver regulatory request and the second radio will use
 115  *      non-strict settings using the second driver regulatory request. All
 116  *      other devices should follow the intersection created between the
 117  *      first two.
 118  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
 119  *      at least 6 radios for a complete test. We will test in this order:
 120  *      1 - driver custom world regulatory domain
 121  *      2 - second custom world regulatory domain
 122  *      3 - first driver regulatory domain request
 123  *      4 - second driver regulatory domain request
 124  *      5 - strict regulatory domain settings using the third driver regulatory
 125  *          domain request
 126  *      6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
 127  *                 regulatory requests.
 128  */
 129 enum hwsim_regtest {
 130         HWSIM_REGTEST_DISABLED = 0,
 131         HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
 132         HWSIM_REGTEST_DRIVER_REG_ALL = 2,
 133         HWSIM_REGTEST_DIFF_COUNTRY = 3,
 134         HWSIM_REGTEST_WORLD_ROAM = 4,
 135         HWSIM_REGTEST_CUSTOM_WORLD = 5,
 136         HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
 137         HWSIM_REGTEST_STRICT_FOLLOW = 7,
 138         HWSIM_REGTEST_STRICT_ALL = 8,
 139         HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
 140         HWSIM_REGTEST_ALL = 10,
 141 };
 142
 143 /* Set to one of the HWSIM_REGTEST_* values above */
 144 static int regtest = HWSIM_REGTEST_DISABLED;
 145 module_param(regtest, int, 0444);
 146 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
 147
 148 static const char *hwsim_alpha2s[] = {
 149         "FI",
 150         "AL",
 151         "US",
 152         "DE",
 153         "JP",
 154         "AL",
 155 };
 156
 157 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
 158         .n_reg_rules = 5,
 159         .alpha2 =  "99",
 160         .reg_rules = {
 161                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 162                 REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
 163                 REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
 164                 REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
 165                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 166         }
 167 };
 168
 169 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
 170         .n_reg_rules = 3,
 171         .alpha2 =  "99",
 172         .reg_rules = {
 173                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 174                 REG_RULE(5725-10, 5850+10, 40, 0, 30,
 175                          NL80211_RRF_NO_IR),
 176                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 177         }
 178 };
 179
 180 static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
 181         .n_reg_rules = 6,
 182         .alpha2 =  "99",
 183         .reg_rules = {
 184                 REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 185                 REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 186                 REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
 187                 REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
 188                 REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
 189                 REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
 190         }
 191 };
 192
 193 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
 194         &hwsim_world_regdom_custom_01,
 195         &hwsim_world_regdom_custom_02,
 196         &hwsim_world_regdom_custom_03,
 197 };
 198
 199 struct hwsim_vif_priv {
 200         u32 magic;
 201         u8 bssid[ETH_ALEN];
 202         bool assoc;
 203         bool bcn_en;
 204         u16 aid;
 205 };
 206
 207 #define HWSIM_VIF_MAGIC 0x69537748
 208
 209 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
 210 {
 211         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 212         WARN(vp->magic != HWSIM_VIF_MAGIC,
 213              "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
 214              vif, vp->magic, vif->addr, vif->type, vif->p2p);
 215 }
 216
 217 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
 218 {
 219         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 220         vp->magic = HWSIM_VIF_MAGIC;
 221 }
 222
 223 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
 224 {
 225         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 226         vp->magic = 0;
 227 }
 228
 229 struct hwsim_sta_priv {
 230         u32 magic;
 231         unsigned int last_link;
 232         u16 active_links_rx;
 233 };
 234
 235 #define HWSIM_STA_MAGIC 0x6d537749
 236
 237 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
 238 {
 239         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 240         WARN_ON(sp->magic != HWSIM_STA_MAGIC);
 241 }
 242
 243 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
 244 {
 245         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 246         sp->magic = HWSIM_STA_MAGIC;
 247 }
 248
 249 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
 250 {
 251         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 252         sp->magic = 0;
 253 }
 254
 255 struct hwsim_chanctx_priv {
 256         u32 magic;
 257 };
 258
 259 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
 260
 261 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
 262 {
 263         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 264         WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
 265 }
 266
 267 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
 268 {
 269         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 270         cp->magic = HWSIM_CHANCTX_MAGIC;
 271 }
 272
 273 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
 274 {
 275         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 276         cp->magic = 0;
 277 }
 278
 279 static unsigned int hwsim_net_id;
 280
 281 static DEFINE_IDA(hwsim_netgroup_ida);
 282
 283 struct hwsim_net {
 284         int netgroup;
 285         u32 wmediumd;
 286 };
 287
 288 static inline int hwsim_net_get_netgroup(struct net *net)
 289 {
 290         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 291
 292         return hwsim_net->netgroup;
 293 }
 294
 295 static inline int hwsim_net_set_netgroup(struct net *net)
 296 {
 297         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 298
 299         hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
 300         return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
 301 }
 302
 303 static inline u32 hwsim_net_get_wmediumd(struct net *net)
 304 {
 305         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 306
 307         return hwsim_net->wmediumd;
 308 }
 309
 310 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
 311 {
 312         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 313
 314         hwsim_net->wmediumd = portid;
 315 }
 316
 317 static struct class *hwsim_class;
 318
 319 static struct net_device *hwsim_mon; /* global monitor netdev */
 320
 321 #define CHAN2G(_freq)  { \
 322         .band = NL80211_BAND_2GHZ, \
 323         .center_freq = (_freq), \
 324         .hw_value = (_freq), \
 325 }
 326
 327 #define CHAN5G(_freq) { \
 328         .band = NL80211_BAND_5GHZ, \
 329         .center_freq = (_freq), \
 330         .hw_value = (_freq), \
 331 }
 332
 333 #define CHAN6G(_freq) { \
 334         .band = NL80211_BAND_6GHZ, \
 335         .center_freq = (_freq), \
 336         .hw_value = (_freq), \
 337 }
 338
 339 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
 340         CHAN2G(2412), /* Channel 1 */
 341         CHAN2G(2417), /* Channel 2 */
 342         CHAN2G(2422), /* Channel 3 */
 343         CHAN2G(2427), /* Channel 4 */
 344         CHAN2G(2432), /* Channel 5 */
 345         CHAN2G(2437), /* Channel 6 */
 346         CHAN2G(2442), /* Channel 7 */
 347         CHAN2G(2447), /* Channel 8 */
 348         CHAN2G(2452), /* Channel 9 */
 349         CHAN2G(2457), /* Channel 10 */
 350         CHAN2G(2462), /* Channel 11 */
 351         CHAN2G(2467), /* Channel 12 */
 352         CHAN2G(2472), /* Channel 13 */
 353         CHAN2G(2484), /* Channel 14 */
 354 };
 355
 356 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
 357         CHAN5G(5180), /* Channel 36 */
 358         CHAN5G(5200), /* Channel 40 */
 359         CHAN5G(5220), /* Channel 44 */
 360         CHAN5G(5240), /* Channel 48 */
 361
 362         CHAN5G(5260), /* Channel 52 */
 363         CHAN5G(5280), /* Channel 56 */
 364         CHAN5G(5300), /* Channel 60 */
 365         CHAN5G(5320), /* Channel 64 */
 366
 367         CHAN5G(5500), /* Channel 100 */
 368         CHAN5G(5520), /* Channel 104 */
 369         CHAN5G(5540), /* Channel 108 */
 370         CHAN5G(5560), /* Channel 112 */
 371         CHAN5G(5580), /* Channel 116 */
 372         CHAN5G(5600), /* Channel 120 */
 373         CHAN5G(5620), /* Channel 124 */
 374         CHAN5G(5640), /* Channel 128 */
 375         CHAN5G(5660), /* Channel 132 */
 376         CHAN5G(5680), /* Channel 136 */
 377         CHAN5G(5700), /* Channel 140 */
 378
 379         CHAN5G(5745), /* Channel 149 */
 380         CHAN5G(5765), /* Channel 153 */
 381         CHAN5G(5785), /* Channel 157 */
 382         CHAN5G(5805), /* Channel 161 */
 383         CHAN5G(5825), /* Channel 165 */
 384         CHAN5G(5845), /* Channel 169 */
 385
 386         CHAN5G(5855), /* Channel 171 */
 387         CHAN5G(5860), /* Channel 172 */
 388         CHAN5G(5865), /* Channel 173 */
 389         CHAN5G(5870), /* Channel 174 */
 390
 391         CHAN5G(5875), /* Channel 175 */
 392         CHAN5G(5880), /* Channel 176 */
 393         CHAN5G(5885), /* Channel 177 */
 394         CHAN5G(5890), /* Channel 178 */
 395         CHAN5G(5895), /* Channel 179 */
 396         CHAN5G(5900), /* Channel 180 */
 397         CHAN5G(5905), /* Channel 181 */
 398
 399         CHAN5G(5910), /* Channel 182 */
 400         CHAN5G(5915), /* Channel 183 */
 401         CHAN5G(5920), /* Channel 184 */
 402         CHAN5G(5925), /* Channel 185 */
 403 };
 404
 405 static const struct ieee80211_channel hwsim_channels_6ghz[] = {
 406         CHAN6G(5955), /* Channel 1 */
 407         CHAN6G(5975), /* Channel 5 */
 408         CHAN6G(5995), /* Channel 9 */
 409         CHAN6G(6015), /* Channel 13 */
 410         CHAN6G(6035), /* Channel 17 */
 411         CHAN6G(6055), /* Channel 21 */
 412         CHAN6G(6075), /* Channel 25 */
 413         CHAN6G(6095), /* Channel 29 */
 414         CHAN6G(6115), /* Channel 33 */
 415         CHAN6G(6135), /* Channel 37 */
 416         CHAN6G(6155), /* Channel 41 */
 417         CHAN6G(6175), /* Channel 45 */
 418         CHAN6G(6195), /* Channel 49 */
 419         CHAN6G(6215), /* Channel 53 */
 420         CHAN6G(6235), /* Channel 57 */
 421         CHAN6G(6255), /* Channel 61 */
 422         CHAN6G(6275), /* Channel 65 */
 423         CHAN6G(6295), /* Channel 69 */
 424         CHAN6G(6315), /* Channel 73 */
 425         CHAN6G(6335), /* Channel 77 */
 426         CHAN6G(6355), /* Channel 81 */
 427         CHAN6G(6375), /* Channel 85 */
 428         CHAN6G(6395), /* Channel 89 */
 429         CHAN6G(6415), /* Channel 93 */
 430         CHAN6G(6435), /* Channel 97 */
 431         CHAN6G(6455), /* Channel 181 */
 432         CHAN6G(6475), /* Channel 105 */
 433         CHAN6G(6495), /* Channel 109 */
 434         CHAN6G(6515), /* Channel 113 */
 435         CHAN6G(6535), /* Channel 117 */
 436         CHAN6G(6555), /* Channel 121 */
 437         CHAN6G(6575), /* Channel 125 */
 438         CHAN6G(6595), /* Channel 129 */
 439         CHAN6G(6615), /* Channel 133 */
 440         CHAN6G(6635), /* Channel 137 */
 441         CHAN6G(6655), /* Channel 141 */
 442         CHAN6G(6675), /* Channel 145 */
 443         CHAN6G(6695), /* Channel 149 */
 444         CHAN6G(6715), /* Channel 153 */
 445         CHAN6G(6735), /* Channel 157 */
 446         CHAN6G(6755), /* Channel 161 */
 447         CHAN6G(6775), /* Channel 165 */
 448         CHAN6G(6795), /* Channel 169 */
 449         CHAN6G(6815), /* Channel 173 */
 450         CHAN6G(6835), /* Channel 177 */
 451         CHAN6G(6855), /* Channel 181 */
 452         CHAN6G(6875), /* Channel 185 */
 453         CHAN6G(6895), /* Channel 189 */
 454         CHAN6G(6915), /* Channel 193 */
 455         CHAN6G(6935), /* Channel 197 */
 456         CHAN6G(6955), /* Channel 201 */
 457         CHAN6G(6975), /* Channel 205 */
 458         CHAN6G(6995), /* Channel 209 */
 459         CHAN6G(7015), /* Channel 213 */
 460         CHAN6G(7035), /* Channel 217 */
 461         CHAN6G(7055), /* Channel 221 */
 462         CHAN6G(7075), /* Channel 225 */
 463         CHAN6G(7095), /* Channel 229 */
 464         CHAN6G(7115), /* Channel 233 */
 465 };
 466
 467 #define NUM_S1G_CHANS_US 51
 468 static struct ieee80211_channel hwsim_channels_s1g[NUM_S1G_CHANS_US];
 469
 470 static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
 471         .s1g = true,
 472         .cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
 473                  0,
 474                  0,
 475                  S1G_CAP3_MAX_MPDU_LEN,
 476                  0,
 477                  S1G_CAP5_AMPDU,
 478                  0,
 479                  S1G_CAP7_DUP_1MHZ,
 480                  S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
 481                  0},
 482         .nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
 483         /* RX Highest Supported Long GI Data Rate 0:7 */
 484                      0,
 485         /* RX Highest Supported Long GI Data Rate 0:7 */
 486         /* TX S1G MCS Map 0:6 */
 487                      0xfa,
 488         /* TX S1G MCS Map :7 */
 489         /* TX Highest Supported Long GI Data Rate 0:6 */
 490                      0x80,
 491         /* TX Highest Supported Long GI Data Rate 7:8 */
 492         /* Rx Single spatial stream and S1G-MCS Map for 1MHz */
 493         /* Tx Single spatial stream and S1G-MCS Map for 1MHz */
 494                      0 },
 495 };
 496
 497 static void hwsim_init_s1g_channels(struct ieee80211_channel *chans)
 498 {
 499         int ch, freq;
 500
 501         for (ch = 0; ch < NUM_S1G_CHANS_US; ch++) {
 502                 freq = 902000 + (ch + 1) * 500;
 503                 chans[ch].band = NL80211_BAND_S1GHZ;
 504                 chans[ch].center_freq = KHZ_TO_MHZ(freq);
 505                 chans[ch].freq_offset = freq % 1000;
 506                 chans[ch].hw_value = ch + 1;
 507         }
 508 }
 509
 510 static const struct ieee80211_rate hwsim_rates[] = {
 511         { .bitrate = 10 },
 512         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 513         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 514         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 515         { .bitrate = 60 },
 516         { .bitrate = 90 },
 517         { .bitrate = 120 },
 518         { .bitrate = 180 },
 519         { .bitrate = 240 },
 520         { .bitrate = 360 },
 521         { .bitrate = 480 },
 522         { .bitrate = 540 }
 523 };
 524
 525 #define DEFAULT_RX_RSSI -50
 526
 527 static const u32 hwsim_ciphers[] = {
 528         WLAN_CIPHER_SUITE_WEP40,
 529         WLAN_CIPHER_SUITE_WEP104,
 530         WLAN_CIPHER_SUITE_TKIP,
 531         WLAN_CIPHER_SUITE_CCMP,
 532         WLAN_CIPHER_SUITE_CCMP_256,
 533         WLAN_CIPHER_SUITE_GCMP,
 534         WLAN_CIPHER_SUITE_GCMP_256,
 535         WLAN_CIPHER_SUITE_AES_CMAC,
 536         WLAN_CIPHER_SUITE_BIP_CMAC_256,
 537         WLAN_CIPHER_SUITE_BIP_GMAC_128,
 538         WLAN_CIPHER_SUITE_BIP_GMAC_256,
 539 };
 540
 541 #define OUI_QCA 0x001374
 542 #define QCA_NL80211_SUBCMD_TEST 1
 543 enum qca_nl80211_vendor_subcmds {
 544         QCA_WLAN_VENDOR_ATTR_TEST = 8,
 545         QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
 546 };
 547
 548 static const struct nla_policy
 549 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
 550         [QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
 551 };
 552
 553 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
 554                                           struct wireless_dev *wdev,
 555                                           const void *data, int data_len)
 556 {
 557         struct sk_buff *skb;
 558         struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 559         int err;
 560         u32 val;
 561
 562         err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
 563                                    data_len, hwsim_vendor_test_policy, NULL);
 564         if (err)
 565                 return err;
 566         if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
 567                 return -EINVAL;
 568         val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
 569         wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
 570
 571         /* Send a vendor event as a test. Note that this would not normally be
 572          * done within a command handler, but rather, based on some other
 573          * trigger. For simplicity, this command is used to trigger the event
 574          * here.
 575          *
 576          * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
 577          */
 578         skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
 579         if (skb) {
 580                 /* skb_put() or nla_put() will fill up data within
 581                  * NL80211_ATTR_VENDOR_DATA.
 582                  */
 583
 584                 /* Add vendor data */
 585                 nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
 586
 587                 /* Send the event - this will call nla_nest_end() */
 588                 cfg80211_vendor_event(skb, GFP_KERNEL);
 589         }
 590
 591         /* Send a response to the command */
 592         skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
 593         if (!skb)
 594                 return -ENOMEM;
 595
 596         /* skb_put() or nla_put() will fill up data within
 597          * NL80211_ATTR_VENDOR_DATA
 598          */
 599         nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
 600
 601         return cfg80211_vendor_cmd_reply(skb);
 602 }
 603
 604 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
 605         {
 606                 .info = { .vendor_id = OUI_QCA,
 607                           .subcmd = QCA_NL80211_SUBCMD_TEST },
 608                 .flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
 609                 .doit = mac80211_hwsim_vendor_cmd_test,
 610                 .policy = hwsim_vendor_test_policy,
 611                 .maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
 612         }
 613 };
 614
 615 /* Advertise support vendor specific events */
 616 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
 617         { .vendor_id = OUI_QCA, .subcmd = 1 },
 618 };
 619
 620 static DEFINE_SPINLOCK(hwsim_radio_lock);
 621 static LIST_HEAD(hwsim_radios);
 622 static struct rhashtable hwsim_radios_rht;
 623 static int hwsim_radio_idx;
 624 static int hwsim_radios_generation = 1;
 625
 626 static struct platform_driver mac80211_hwsim_driver = {
 627         .driver = {
 628                 .name = "mac80211_hwsim",
 629         },
 630 };
 631
 632 struct mac80211_hwsim_link_data {
 633         u32 link_id;
 634         u64 beacon_int  /* beacon interval in us */;
 635         struct hrtimer beacon_timer;
 636 };
 637
 638 struct mac80211_hwsim_data {
 639         struct list_head list;
 640         struct rhash_head rht;
 641         struct ieee80211_hw *hw;
 642         struct device *dev;
 643         struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 644         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
 645         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
 646         struct ieee80211_channel channels_6ghz[ARRAY_SIZE(hwsim_channels_6ghz)];
 647         struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
 648         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 649         struct ieee80211_iface_combination if_combination;
 650         struct ieee80211_iface_limit if_limits[3];
 651         int n_if_limits;
 652
 653         u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
 654
 655         struct mac_address addresses[2];
 656         int channels, idx;
 657         bool use_chanctx;
 658         bool destroy_on_close;
 659         u32 portid;
 660         char alpha2[2];
 661         const struct ieee80211_regdomain *regd;
 662
 663         struct ieee80211_channel *tmp_chan;
 664         struct ieee80211_channel *roc_chan;
 665         u32 roc_duration;
 666         struct delayed_work roc_start;
 667         struct delayed_work roc_done;
 668         struct delayed_work hw_scan;
 669         struct cfg80211_scan_request *hw_scan_request;
 670         struct ieee80211_vif *hw_scan_vif;
 671         int scan_chan_idx;
 672         u8 scan_addr[ETH_ALEN];
 673         struct {
 674                 struct ieee80211_channel *channel;
 675                 unsigned long next_start, start, end;
 676         } survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
 677                       ARRAY_SIZE(hwsim_channels_5ghz) +
 678                       ARRAY_SIZE(hwsim_channels_6ghz)];
 679
 680         struct ieee80211_channel *channel;
 681         enum nl80211_chan_width bw;
 682         unsigned int rx_filter;
 683         bool started, idle, scanning;
 684         struct mutex mutex;
 685         enum ps_mode {
 686                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
 687         } ps;
 688         bool ps_poll_pending;
 689         struct dentry *debugfs;
 690
 691         atomic_t pending_cookie;
 692         struct sk_buff_head pending;    /* packets pending */
 693         /*
 694          * Only radios in the same group can communicate together (the
 695          * channel has to match too). Each bit represents a group. A
 696          * radio can be in more than one group.
 697          */
 698         u64 group;
 699
 700         /* group shared by radios created in the same netns */
 701         int netgroup;
 702         /* wmediumd portid responsible for netgroup of this radio */
 703         u32 wmediumd;
 704
 705         /* difference between this hw's clock and the real clock, in usecs */
 706         s64 tsf_offset;
 707         s64 bcn_delta;
 708         /* absolute beacon transmission time. Used to cover up "tx" delay. */
 709         u64 abs_bcn_ts;
 710
 711         /* Stats */
 712         u64 tx_pkts;
 713         u64 rx_pkts;
 714         u64 tx_bytes;
 715         u64 rx_bytes;
 716         u64 tx_dropped;
 717         u64 tx_failed;
 718
 719         /* RSSI in rx status of the receiver */
 720         int rx_rssi;
 721
 722         struct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];
 723 };
 724
 725 static const struct rhashtable_params hwsim_rht_params = {
 726         .nelem_hint = 2,
 727         .automatic_shrinking = true,
 728         .key_len = ETH_ALEN,
 729         .key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
 730         .head_offset = offsetof(struct mac80211_hwsim_data, rht),
 731 };
 732
 733 struct hwsim_radiotap_hdr {
 734         struct ieee80211_radiotap_header hdr;
 735         __le64 rt_tsft;
 736         u8 rt_flags;
 737         u8 rt_rate;
 738         __le16 rt_channel;
 739         __le16 rt_chbitmask;
 740 } __packed;
 741
 742 struct hwsim_radiotap_ack_hdr {
 743         struct ieee80211_radiotap_header hdr;
 744         u8 rt_flags;
 745         u8 pad;
 746         __le16 rt_channel;
 747         __le16 rt_chbitmask;
 748 } __packed;
 749
 750 /* MAC80211_HWSIM netlink family */
 751 static struct genl_family hwsim_genl_family;
 752
 753 enum hwsim_multicast_groups {
 754         HWSIM_MCGRP_CONFIG,
 755 };
 756
 757 static const struct genl_multicast_group hwsim_mcgrps[] = {
 758         [HWSIM_MCGRP_CONFIG] = { .name = "config", },
 759 };
 760
 761 /* MAC80211_HWSIM netlink policy */
 762
 763 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
 764         [HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
 765         [HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
 766         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
 767                                .len = IEEE80211_MAX_DATA_LEN },
 768         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
 769         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
 770         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
 771         [HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
 772                                  .len = IEEE80211_TX_MAX_RATES *
 773                                         sizeof(struct hwsim_tx_rate)},
 774         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
 775         [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
 776         [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
 777         [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 778         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
 779         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 780         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
 781         [HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
 782         [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
 783         [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
 784         [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
 785         [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 786         [HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
 787         [HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 788         [HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
 789         [HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
 790         [HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 791 };
 792
 793 #if IS_REACHABLE(CONFIG_VIRTIO)
 794
 795 /* MAC80211_HWSIM virtio queues */
 796 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
 797 static bool hwsim_virtio_enabled;
 798 static DEFINE_SPINLOCK(hwsim_virtio_lock);
 799
 800 static void hwsim_virtio_rx_work(struct work_struct *work);
 801 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
 802
 803 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 804                            struct sk_buff *skb)
 805 {
 806         struct scatterlist sg[1];
 807         unsigned long flags;
 808         int err;
 809
 810         spin_lock_irqsave(&hwsim_virtio_lock, flags);
 811         if (!hwsim_virtio_enabled) {
 812                 err = -ENODEV;
 813                 goto out_free;
 814         }
 815
 816         sg_init_one(sg, skb->head, skb_end_offset(skb));
 817         err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
 818                                    GFP_ATOMIC);
 819         if (err)
 820                 goto out_free;
 821         virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
 822         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 823         return 0;
 824
 825 out_free:
 826         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 827         nlmsg_free(skb);
 828         return err;
 829 }
 830 #else
 831 /* cause a linker error if this ends up being needed */
 832 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 833                            struct sk_buff *skb);
 834 #define hwsim_virtio_enabled false
 835 #endif
 836
 837 static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
 838 {
 839         switch (bw) {
 840         case NL80211_CHAN_WIDTH_20_NOHT:
 841         case NL80211_CHAN_WIDTH_20:
 842                 return 20;
 843         case NL80211_CHAN_WIDTH_40:
 844                 return 40;
 845         case NL80211_CHAN_WIDTH_80:
 846                 return 80;
 847         case NL80211_CHAN_WIDTH_80P80:
 848         case NL80211_CHAN_WIDTH_160:
 849                 return 160;
 850         case NL80211_CHAN_WIDTH_320:
 851                 return 320;
 852         case NL80211_CHAN_WIDTH_5:
 853                 return 5;
 854         case NL80211_CHAN_WIDTH_10:
 855                 return 10;
 856         case NL80211_CHAN_WIDTH_1:
 857                 return 1;
 858         case NL80211_CHAN_WIDTH_2:
 859                 return 2;
 860         case NL80211_CHAN_WIDTH_4:
 861                 return 4;
 862         case NL80211_CHAN_WIDTH_8:
 863                 return 8;
 864         case NL80211_CHAN_WIDTH_16:
 865                 return 16;
 866         }
 867
 868         return INT_MAX;
 869 }
 870
 871 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 872                                     struct sk_buff *skb,
 873                                     struct ieee80211_channel *chan);
 874
 875 /* sysfs attributes */
 876 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
 877 {
 878         struct mac80211_hwsim_data *data = dat;
 879         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 880         struct sk_buff *skb;
 881         struct ieee80211_pspoll *pspoll;
 882
 883         if (!vp->assoc)
 884                 return;
 885
 886         wiphy_dbg(data->hw->wiphy,
 887                   "%s: send PS-Poll to %pM for aid %d\n",
 888                   __func__, vp->bssid, vp->aid);
 889
 890         skb = dev_alloc_skb(sizeof(*pspoll));
 891         if (!skb)
 892                 return;
 893         pspoll = skb_put(skb, sizeof(*pspoll));
 894         pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
 895                                             IEEE80211_STYPE_PSPOLL |
 896                                             IEEE80211_FCTL_PM);
 897         pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
 898         memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
 899         memcpy(pspoll->ta, mac, ETH_ALEN);
 900
 901         rcu_read_lock();
 902         mac80211_hwsim_tx_frame(data->hw, skb,
 903                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
 904         rcu_read_unlock();
 905 }
 906
 907 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
 908                                 struct ieee80211_vif *vif, int ps)
 909 {
 910         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 911         struct sk_buff *skb;
 912         struct ieee80211_hdr *hdr;
 913
 914         if (!vp->assoc)
 915                 return;
 916
 917         wiphy_dbg(data->hw->wiphy,
 918                   "%s: send data::nullfunc to %pM ps=%d\n",
 919                   __func__, vp->bssid, ps);
 920
 921         skb = dev_alloc_skb(sizeof(*hdr));
 922         if (!skb)
 923                 return;
 924         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
 925         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
 926                                          IEEE80211_STYPE_NULLFUNC |
 927                                          IEEE80211_FCTL_TODS |
 928                                          (ps ? IEEE80211_FCTL_PM : 0));
 929         hdr->duration_id = cpu_to_le16(0);
 930         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
 931         memcpy(hdr->addr2, mac, ETH_ALEN);
 932         memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
 933
 934         rcu_read_lock();
 935         mac80211_hwsim_tx_frame(data->hw, skb,
 936                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
 937         rcu_read_unlock();
 938 }
 939
 940
 941 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
 942                                    struct ieee80211_vif *vif)
 943 {
 944         struct mac80211_hwsim_data *data = dat;
 945         hwsim_send_nullfunc(data, mac, vif, 1);
 946 }
 947
 948 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
 949                                       struct ieee80211_vif *vif)
 950 {
 951         struct mac80211_hwsim_data *data = dat;
 952         hwsim_send_nullfunc(data, mac, vif, 0);
 953 }
 954
 955 static int hwsim_fops_ps_read(void *dat, u64 *val)
 956 {
 957         struct mac80211_hwsim_data *data = dat;
 958         *val = data->ps;
 959         return 0;
 960 }
 961
 962 static int hwsim_fops_ps_write(void *dat, u64 val)
 963 {
 964         struct mac80211_hwsim_data *data = dat;
 965         enum ps_mode old_ps;
 966
 967         if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
 968             val != PS_MANUAL_POLL)
 969                 return -EINVAL;
 970
 971         if (val == PS_MANUAL_POLL) {
 972                 if (data->ps != PS_ENABLED)
 973                         return -EINVAL;
 974                 local_bh_disable();
 975                 ieee80211_iterate_active_interfaces_atomic(
 976                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 977                         hwsim_send_ps_poll, data);
 978                 local_bh_enable();
 979                 return 0;
 980         }
 981         old_ps = data->ps;
 982         data->ps = val;
 983
 984         local_bh_disable();
 985         if (old_ps == PS_DISABLED && val != PS_DISABLED) {
 986                 ieee80211_iterate_active_interfaces_atomic(
 987                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 988                         hwsim_send_nullfunc_ps, data);
 989         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
 990                 ieee80211_iterate_active_interfaces_atomic(
 991                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 992                         hwsim_send_nullfunc_no_ps, data);
 993         }
 994         local_bh_enable();
 995
 996         return 0;
 997 }
 998
 999 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1000                          "%llu\n");
1001
1002 static int hwsim_write_simulate_radar(void *dat, u64 val)
1003 {
1004         struct mac80211_hwsim_data *data = dat;
1005
1006         ieee80211_radar_detected(data->hw);
1007
1008         return 0;
1009 }
1010
1011 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1012                          hwsim_write_simulate_radar, "%llu\n");
1013
1014 static int hwsim_fops_group_read(void *dat, u64 *val)
1015 {
1016         struct mac80211_hwsim_data *data = dat;
1017         *val = data->group;
1018         return 0;
1019 }
1020
1021 static int hwsim_fops_group_write(void *dat, u64 val)
1022 {
1023         struct mac80211_hwsim_data *data = dat;
1024         data->group = val;
1025         return 0;
1026 }
1027
1028 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1029                          hwsim_fops_group_read, hwsim_fops_group_write,
1030                          "%llx\n");
1031
1032 static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1033 {
1034         struct mac80211_hwsim_data *data = dat;
1035         *val = data->rx_rssi;
1036         return 0;
1037 }
1038
1039 static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1040 {
1041         struct mac80211_hwsim_data *data = dat;
1042         int rssi = (int)val;
1043
1044         if (rssi >= 0 || rssi < -100)
1045                 return -EINVAL;
1046
1047         data->rx_rssi = rssi;
1048         return 0;
1049 }
1050
1051 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1052                          hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1053                          "%lld\n");
1054
1055 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1056                                         struct net_device *dev)
1057 {
1058         /* TODO: allow packet injection */
1059         dev_kfree_skb(skb);
1060         return NETDEV_TX_OK;
1061 }
1062
1063 static inline u64 mac80211_hwsim_get_tsf_raw(void)
1064 {
1065         return ktime_to_us(ktime_get_real());
1066 }
1067
1068 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1069 {
1070         u64 now = mac80211_hwsim_get_tsf_raw();
1071         return cpu_to_le64(now + data->tsf_offset);
1072 }
1073
1074 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1075                                   struct ieee80211_vif *vif)
1076 {
1077         struct mac80211_hwsim_data *data = hw->priv;
1078         return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
1079 }
1080
1081 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1082                 struct ieee80211_vif *vif, u64 tsf)
1083 {
1084         struct mac80211_hwsim_data *data = hw->priv;
1085         u64 now = mac80211_hwsim_get_tsf(hw, vif);
1086         /* MLD not supported here */
1087         u32 bcn_int = data->link_data[0].beacon_int;
1088         u64 delta = abs(tsf - now);
1089
1090         /* adjust after beaconing with new timestamp at old TBTT */
1091         if (tsf > now) {
1092                 data->tsf_offset += delta;
1093                 data->bcn_delta = do_div(delta, bcn_int);
1094         } else {
1095                 data->tsf_offset -= delta;
1096                 data->bcn_delta = -(s64)do_div(delta, bcn_int);
1097         }
1098 }
1099
1100 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1101                                       struct sk_buff *tx_skb,
1102                                       struct ieee80211_channel *chan)
1103 {
1104         struct mac80211_hwsim_data *data = hw->priv;
1105         struct sk_buff *skb;
1106         struct hwsim_radiotap_hdr *hdr;
1107         u16 flags, bitrate;
1108         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1109         struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
1110
1111         if (!txrate)
1112                 bitrate = 0;
1113         else
1114                 bitrate = txrate->bitrate;
1115
1116         if (!netif_running(hwsim_mon))
1117                 return;
1118
1119         skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1120         if (skb == NULL)
1121                 return;
1122
1123         hdr = skb_push(skb, sizeof(*hdr));
1124         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1125         hdr->hdr.it_pad = 0;
1126         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1127         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1128                                           (1 << IEEE80211_RADIOTAP_RATE) |
1129                                           (1 << IEEE80211_RADIOTAP_TSFT) |
1130                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1131         hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1132         hdr->rt_flags = 0;
1133         hdr->rt_rate = bitrate / 5;
1134         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1135         flags = IEEE80211_CHAN_2GHZ;
1136         if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1137                 flags |= IEEE80211_CHAN_OFDM;
1138         else
1139                 flags |= IEEE80211_CHAN_CCK;
1140         hdr->rt_chbitmask = cpu_to_le16(flags);
1141
1142         skb->dev = hwsim_mon;
1143         skb_reset_mac_header(skb);
1144         skb->ip_summed = CHECKSUM_UNNECESSARY;
1145         skb->pkt_type = PACKET_OTHERHOST;
1146         skb->protocol = htons(ETH_P_802_2);
1147         memset(skb->cb, 0, sizeof(skb->cb));
1148         netif_rx(skb);
1149 }
1150
1151
1152 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
1153                                        const u8 *addr)
1154 {
1155         struct sk_buff *skb;
1156         struct hwsim_radiotap_ack_hdr *hdr;
1157         u16 flags;
1158         struct ieee80211_hdr *hdr11;
1159
1160         if (!netif_running(hwsim_mon))
1161                 return;
1162
1163         skb = dev_alloc_skb(100);
1164         if (skb == NULL)
1165                 return;
1166
1167         hdr = skb_put(skb, sizeof(*hdr));
1168         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1169         hdr->hdr.it_pad = 0;
1170         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1171         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1172                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1173         hdr->rt_flags = 0;
1174         hdr->pad = 0;
1175         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1176         flags = IEEE80211_CHAN_2GHZ;
1177         hdr->rt_chbitmask = cpu_to_le16(flags);
1178
1179         hdr11 = skb_put(skb, 10);
1180         hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1181                                            IEEE80211_STYPE_ACK);
1182         hdr11->duration_id = cpu_to_le16(0);
1183         memcpy(hdr11->addr1, addr, ETH_ALEN);
1184
1185         skb->dev = hwsim_mon;
1186         skb_reset_mac_header(skb);
1187         skb->ip_summed = CHECKSUM_UNNECESSARY;
1188         skb->pkt_type = PACKET_OTHERHOST;
1189         skb->protocol = htons(ETH_P_802_2);
1190         memset(skb->cb, 0, sizeof(skb->cb));
1191         netif_rx(skb);
1192 }
1193
1194 struct mac80211_hwsim_addr_match_data {
1195         u8 addr[ETH_ALEN];
1196         bool ret;
1197 };
1198
1199 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1200                                      struct ieee80211_vif *vif)
1201 {
1202         int i;
1203         struct mac80211_hwsim_addr_match_data *md = data;
1204
1205         if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1206                 md->ret = true;
1207                 return;
1208         }
1209
1210         /* Match the link address */
1211         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1212                 struct ieee80211_bss_conf *conf;
1213
1214                 conf = rcu_dereference(vif->link_conf[i]);
1215                 if (!conf)
1216                         continue;
1217
1218                 if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1219                         md->ret = true;
1220                         return;
1221                 }
1222         }
1223 }
1224
1225 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1226                                       const u8 *addr)
1227 {
1228         struct mac80211_hwsim_addr_match_data md = {
1229                 .ret = false,
1230         };
1231
1232         if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1233                 return true;
1234
1235         memcpy(md.addr, addr, ETH_ALEN);
1236
1237         ieee80211_iterate_active_interfaces_atomic(data->hw,
1238                                                    IEEE80211_IFACE_ITER_NORMAL,
1239                                                    mac80211_hwsim_addr_iter,
1240                                                    &md);
1241
1242         return md.ret;
1243 }
1244
1245 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1246                            struct sk_buff *skb)
1247 {
1248         switch (data->ps) {
1249         case PS_DISABLED:
1250                 return true;
1251         case PS_ENABLED:
1252                 return false;
1253         case PS_AUTO_POLL:
1254                 /* TODO: accept (some) Beacons by default and other frames only
1255                  * if pending PS-Poll has been sent */
1256                 return true;
1257         case PS_MANUAL_POLL:
1258                 /* Allow unicast frames to own address if there is a pending
1259                  * PS-Poll */
1260                 if (data->ps_poll_pending &&
1261                     mac80211_hwsim_addr_match(data, skb->data + 4)) {
1262                         data->ps_poll_pending = false;
1263                         return true;
1264                 }
1265                 return false;
1266         }
1267
1268         return true;
1269 }
1270
1271 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1272                                   struct sk_buff *skb, int portid)
1273 {
1274         struct net *net;
1275         bool found = false;
1276         int res = -ENOENT;
1277
1278         rcu_read_lock();
1279         for_each_net_rcu(net) {
1280                 if (data->netgroup == hwsim_net_get_netgroup(net)) {
1281                         res = genlmsg_unicast(net, skb, portid);
1282                         found = true;
1283                         break;
1284                 }
1285         }
1286         rcu_read_unlock();
1287
1288         if (!found)
1289                 nlmsg_free(skb);
1290
1291         return res;
1292 }
1293
1294 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1295                                          const u8 *addr, bool add)
1296 {
1297         struct mac80211_hwsim_data *data = hw->priv;
1298         u32 _portid = READ_ONCE(data->wmediumd);
1299         struct sk_buff *skb;
1300         void *msg_head;
1301
1302         WARN_ON(!is_valid_ether_addr(addr));
1303
1304         if (!_portid && !hwsim_virtio_enabled)
1305                 return;
1306
1307         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1308         if (!skb)
1309                 return;
1310
1311         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1312                                add ? HWSIM_CMD_ADD_MAC_ADDR :
1313                                      HWSIM_CMD_DEL_MAC_ADDR);
1314         if (!msg_head) {
1315                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1316                 goto nla_put_failure;
1317         }
1318
1319         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1320                     ETH_ALEN, data->addresses[1].addr))
1321                 goto nla_put_failure;
1322
1323         if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1324                 goto nla_put_failure;
1325
1326         genlmsg_end(skb, msg_head);
1327
1328         if (hwsim_virtio_enabled)
1329                 hwsim_tx_virtio(data, skb);
1330         else
1331                 hwsim_unicast_netgroup(data, skb, _portid);
1332         return;
1333 nla_put_failure:
1334         nlmsg_free(skb);
1335 }
1336
1337 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1338 {
1339         u16 result = 0;
1340
1341         if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1342                 result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1343         if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1344                 result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1345         if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1346                 result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1347         if (rate->flags & IEEE80211_TX_RC_MCS)
1348                 result |= MAC80211_HWSIM_TX_RC_MCS;
1349         if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1350                 result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1351         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1352                 result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1353         if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1354                 result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1355         if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1356                 result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1357         if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1358                 result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1359         if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1360                 result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1361         if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1362                 result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1363
1364         return result;
1365 }
1366
1367 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1368                                        struct sk_buff *my_skb,
1369                                        int dst_portid,
1370                                        struct ieee80211_channel *channel)
1371 {
1372         struct sk_buff *skb;
1373         struct mac80211_hwsim_data *data = hw->priv;
1374         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1375         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1376         void *msg_head;
1377         unsigned int hwsim_flags = 0;
1378         int i;
1379         struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1380         struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1381         uintptr_t cookie;
1382
1383         if (data->ps != PS_DISABLED)
1384                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1385         /* If the queue contains MAX_QUEUE skb's drop some */
1386         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1387                 /* Dropping until WARN_QUEUE level */
1388                 while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1389                         ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1390                         data->tx_dropped++;
1391                 }
1392         }
1393
1394         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1395         if (skb == NULL)
1396                 goto nla_put_failure;
1397
1398         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1399                                HWSIM_CMD_FRAME);
1400         if (msg_head == NULL) {
1401                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1402                 goto nla_put_failure;
1403         }
1404
1405         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1406                     ETH_ALEN, data->addresses[1].addr))
1407                 goto nla_put_failure;
1408
1409         /* We get the skb->data */
1410         if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1411                 goto nla_put_failure;
1412
1413         /* We get the flags for this transmission, and we translate them to
1414            wmediumd flags  */
1415
1416         if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1417                 hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1418
1419         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1420                 hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1421
1422         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1423                 goto nla_put_failure;
1424
1425         if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1426                 goto nla_put_failure;
1427
1428         /* We get the tx control (rate and retries) info*/
1429
1430         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1431                 tx_attempts[i].idx = info->status.rates[i].idx;
1432                 tx_attempts_flags[i].idx = info->status.rates[i].idx;
1433                 tx_attempts[i].count = info->status.rates[i].count;
1434                 tx_attempts_flags[i].flags =
1435                                 trans_tx_rate_flags_ieee2hwsim(
1436                                                 &info->status.rates[i]);
1437         }
1438
1439         if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1440                     sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1441                     tx_attempts))
1442                 goto nla_put_failure;
1443
1444         if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1445                     sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1446                     tx_attempts_flags))
1447                 goto nla_put_failure;
1448
1449         /* We create a cookie to identify this skb */
1450         cookie = atomic_inc_return(&data->pending_cookie);
1451         info->rate_driver_data[0] = (void *)cookie;
1452         if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1453                 goto nla_put_failure;
1454
1455         genlmsg_end(skb, msg_head);
1456
1457         if (hwsim_virtio_enabled) {
1458                 if (hwsim_tx_virtio(data, skb))
1459                         goto err_free_txskb;
1460         } else {
1461                 if (hwsim_unicast_netgroup(data, skb, dst_portid))
1462                         goto err_free_txskb;
1463         }
1464
1465         /* Enqueue the packet */
1466         skb_queue_tail(&data->pending, my_skb);
1467         data->tx_pkts++;
1468         data->tx_bytes += my_skb->len;
1469         return;
1470
1471 nla_put_failure:
1472         nlmsg_free(skb);
1473 err_free_txskb:
1474         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1475         ieee80211_free_txskb(hw, my_skb);
1476         data->tx_failed++;
1477 }
1478
1479 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1480                                struct ieee80211_channel *c2)
1481 {
1482         if (!c1 || !c2)
1483                 return false;
1484
1485         return c1->center_freq == c2->center_freq;
1486 }
1487
1488 struct tx_iter_data {
1489         struct ieee80211_channel *channel;
1490         bool receive;
1491 };
1492
1493 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1494                                    struct ieee80211_vif *vif)
1495 {
1496         struct tx_iter_data *data = _data;
1497         int i;
1498
1499         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1500                 struct ieee80211_bss_conf *conf;
1501                 struct ieee80211_chanctx_conf *chanctx;
1502
1503                 conf = rcu_dereference(vif->link_conf[i]);
1504                 if (!conf)
1505                         continue;
1506
1507                 chanctx = rcu_dereference(conf->chanctx_conf);
1508                 if (!chanctx)
1509                         continue;
1510
1511                 if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1512                         continue;
1513
1514                 data->receive = true;
1515                 return;
1516         }
1517 }
1518
1519 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1520 {
1521         /*
1522          * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1523          * e.g. like this:
1524          * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1525          * (but you should use a valid OUI, not that)
1526          *
1527          * If anyone wants to 'donate' a radiotap OUI/subns code
1528          * please send a patch removing this #ifdef and changing
1529          * the values accordingly.
1530          */
1531 #ifdef HWSIM_RADIOTAP_OUI
1532         struct ieee80211_vendor_radiotap *rtap;
1533
1534         /*
1535          * Note that this code requires the headroom in the SKB
1536          * that was allocated earlier.
1537          */
1538         rtap = skb_push(skb, sizeof(*rtap) + 8 + 4);
1539         rtap->oui[0] = HWSIM_RADIOTAP_OUI[0];
1540         rtap->oui[1] = HWSIM_RADIOTAP_OUI[1];
1541         rtap->oui[2] = HWSIM_RADIOTAP_OUI[2];
1542         rtap->subns = 127;
1543
1544         /*
1545          * Radiotap vendor namespaces can (and should) also be
1546          * split into fields by using the standard radiotap
1547          * presence bitmap mechanism. Use just BIT(0) here for
1548          * the presence bitmap.
1549          */
1550         rtap->present = BIT(0);
1551         /* We have 8 bytes of (dummy) data */
1552         rtap->len = 8;
1553         /* For testing, also require it to be aligned */
1554         rtap->align = 8;
1555         /* And also test that padding works, 4 bytes */
1556         rtap->pad = 4;
1557         /* push the data */
1558         memcpy(rtap->data, "ABCDEFGH", 8);
1559         /* make sure to clear padding, mac80211 doesn't */
1560         memset(rtap->data + 8, 0, 4);
1561
1562         IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
1563 #endif
1564 }
1565
1566 static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1567                               struct ieee80211_rx_status *rx_status,
1568                               struct sk_buff *skb)
1569 {
1570         struct ieee80211_hdr *hdr = (void *)skb->data;
1571
1572         if (!ieee80211_has_morefrags(hdr->frame_control) &&
1573             !is_multicast_ether_addr(hdr->addr1) &&
1574             (ieee80211_is_mgmt(hdr->frame_control) ||
1575              ieee80211_is_data(hdr->frame_control))) {
1576                 struct ieee80211_sta *sta;
1577                 unsigned int link_id;
1578
1579                 rcu_read_lock();
1580                 sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1581                                                        hdr->addr1, &link_id);
1582                 if (sta) {
1583                         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1584
1585                         if (ieee80211_has_pm(hdr->frame_control))
1586                                 sp->active_links_rx &= ~BIT(link_id);
1587                         else
1588                                 sp->active_links_rx |= BIT(link_id);
1589                 }
1590                 rcu_read_unlock();
1591         }
1592
1593         memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1594
1595         mac80211_hwsim_add_vendor_rtap(skb);
1596
1597         data->rx_pkts++;
1598         data->rx_bytes += skb->len;
1599         ieee80211_rx_irqsafe(data->hw, skb);
1600 }
1601
1602 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1603                                           struct sk_buff *skb,
1604                                           struct ieee80211_channel *chan)
1605 {
1606         struct mac80211_hwsim_data *data = hw->priv, *data2;
1607         bool ack = false;
1608         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1609         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1610         struct ieee80211_rx_status rx_status;
1611         u64 now;
1612
1613         memset(&rx_status, 0, sizeof(rx_status));
1614         rx_status.flag |= RX_FLAG_MACTIME_START;
1615         rx_status.freq = chan->center_freq;
1616         rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1617         rx_status.band = chan->band;
1618         if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1619                 rx_status.rate_idx =
1620                         ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1621                 rx_status.nss =
1622                         ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1623                 rx_status.encoding = RX_ENC_VHT;
1624         } else {
1625                 rx_status.rate_idx = info->control.rates[0].idx;
1626                 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1627                         rx_status.encoding = RX_ENC_HT;
1628         }
1629         if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1630                 rx_status.bw = RATE_INFO_BW_40;
1631         else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1632                 rx_status.bw = RATE_INFO_BW_80;
1633         else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1634                 rx_status.bw = RATE_INFO_BW_160;
1635         else
1636                 rx_status.bw = RATE_INFO_BW_20;
1637         if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1638                 rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1639         /* TODO: simulate optional packet loss */
1640         rx_status.signal = data->rx_rssi;
1641         if (info->control.vif)
1642                 rx_status.signal += info->control.vif->bss_conf.txpower;
1643
1644         if (data->ps != PS_DISABLED)
1645                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1646
1647         /* release the skb's source info */
1648         skb_orphan(skb);
1649         skb_dst_drop(skb);
1650         skb->mark = 0;
1651         skb_ext_reset(skb);
1652         nf_reset_ct(skb);
1653
1654         /*
1655          * Get absolute mactime here so all HWs RX at the "same time", and
1656          * absolute TX time for beacon mactime so the timestamp matches.
1657          * Giving beacons a different mactime than non-beacons looks messy, but
1658          * it helps the Toffset be exact and a ~10us mactime discrepancy
1659          * probably doesn't really matter.
1660          */
1661         if (ieee80211_is_beacon(hdr->frame_control) ||
1662             ieee80211_is_probe_resp(hdr->frame_control)) {
1663                 rx_status.boottime_ns = ktime_get_boottime_ns();
1664                 now = data->abs_bcn_ts;
1665         } else {
1666                 now = mac80211_hwsim_get_tsf_raw();
1667         }
1668
1669         /* Copy skb to all enabled radios that are on the current frequency */
1670         spin_lock(&hwsim_radio_lock);
1671         list_for_each_entry(data2, &hwsim_radios, list) {
1672                 struct sk_buff *nskb;
1673                 struct tx_iter_data tx_iter_data = {
1674                         .receive = false,
1675                         .channel = chan,
1676                 };
1677
1678                 if (data == data2)
1679                         continue;
1680
1681                 if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1682                     !hwsim_ps_rx_ok(data2, skb))
1683                         continue;
1684
1685                 if (!(data->group & data2->group))
1686                         continue;
1687
1688                 if (data->netgroup != data2->netgroup)
1689                         continue;
1690
1691                 if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1692                     !hwsim_chans_compat(chan, data2->channel)) {
1693                         ieee80211_iterate_active_interfaces_atomic(
1694                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1695                                 mac80211_hwsim_tx_iter, &tx_iter_data);
1696                         if (!tx_iter_data.receive)
1697                                 continue;
1698                 }
1699
1700                 /*
1701                  * reserve some space for our vendor and the normal
1702                  * radiotap header, since we're copying anyway
1703                  */
1704                 if (skb->len < PAGE_SIZE && paged_rx) {
1705                         struct page *page = alloc_page(GFP_ATOMIC);
1706
1707                         if (!page)
1708                                 continue;
1709
1710                         nskb = dev_alloc_skb(128);
1711                         if (!nskb) {
1712                                 __free_page(page);
1713                                 continue;
1714                         }
1715
1716                         memcpy(page_address(page), skb->data, skb->len);
1717                         skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1718                 } else {
1719                         nskb = skb_copy(skb, GFP_ATOMIC);
1720                         if (!nskb)
1721                                 continue;
1722                 }
1723
1724                 if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1725                         ack = true;
1726
1727                 rx_status.mactime = now + data2->tsf_offset;
1728
1729                 mac80211_hwsim_rx(data2, &rx_status, nskb);
1730         }
1731         spin_unlock(&hwsim_radio_lock);
1732
1733         return ack;
1734 }
1735
1736 static struct ieee80211_bss_conf *
1737 mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
1738                               struct ieee80211_vif *vif,
1739                               struct ieee80211_sta *sta,
1740                               struct ieee80211_hdr *hdr,
1741                               struct ieee80211_link_sta **link_sta)
1742 {
1743         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1744         int i;
1745
1746         if (!vif->valid_links)
1747                 return &vif->bss_conf;
1748
1749         WARN_ON(is_multicast_ether_addr(hdr->addr1));
1750
1751         if (WARN_ON_ONCE(!sta->valid_links))
1752                 return &vif->bss_conf;
1753
1754         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1755                 struct ieee80211_bss_conf *bss_conf;
1756                 unsigned int link_id;
1757
1758                 /* round-robin the available link IDs */
1759                 link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
1760
1761                 if (!(vif->active_links & BIT(link_id)))
1762                         continue;
1763
1764                 if (!(sp->active_links_rx & BIT(link_id)))
1765                         continue;
1766
1767                 *link_sta = rcu_dereference(sta->link[link_id]);
1768                 if (!*link_sta)
1769                         continue;
1770
1771                 bss_conf = rcu_dereference(vif->link_conf[link_id]);
1772                 if (WARN_ON_ONCE(!bss_conf))
1773                         continue;
1774
1775                 /* can happen while switching links */
1776                 if (!rcu_access_pointer(bss_conf->chanctx_conf))
1777                         continue;
1778
1779                 sp->last_link = link_id;
1780                 return bss_conf;
1781         }
1782
1783         return NULL;
1784 }
1785
1786 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1787                               struct ieee80211_tx_control *control,
1788                               struct sk_buff *skb)
1789 {
1790         struct mac80211_hwsim_data *data = hw->priv;
1791         struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1792         struct ieee80211_hdr *hdr = (void *)skb->data;
1793         struct ieee80211_chanctx_conf *chanctx_conf;
1794         struct ieee80211_channel *channel;
1795         bool ack;
1796         enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1797         u32 _portid, i;
1798
1799         if (WARN_ON(skb->len < 10)) {
1800                 /* Should not happen; just a sanity check for addr1 use */
1801                 ieee80211_free_txskb(hw, skb);
1802                 return;
1803         }
1804
1805         if (!data->use_chanctx) {
1806                 channel = data->channel;
1807                 confbw = data->bw;
1808         } else if (txi->hw_queue == 4) {
1809                 channel = data->tmp_chan;
1810         } else {
1811                 u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
1812                                        IEEE80211_TX_CTRL_MLO_LINK);
1813                 struct ieee80211_vif *vif = txi->control.vif;
1814                 struct ieee80211_link_sta *link_sta = NULL;
1815                 struct ieee80211_sta *sta = control->sta;
1816                 struct ieee80211_bss_conf *bss_conf;
1817
1818                 if (link != IEEE80211_LINK_UNSPECIFIED) {
1819                         bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
1820                         if (sta)
1821                                 link_sta = rcu_dereference(sta->link[link]);
1822                 } else {
1823                         bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
1824                                                                  hdr, &link_sta);
1825                 }
1826
1827                 if (WARN_ON(!bss_conf)) {
1828                         ieee80211_free_txskb(hw, skb);
1829                         return;
1830                 }
1831
1832                 if (sta && sta->mlo) {
1833                         if (WARN_ON(!link_sta)) {
1834                                 ieee80211_free_txskb(hw, skb);
1835                                 return;
1836                         }
1837                         /* address translation to link addresses on TX */
1838                         ether_addr_copy(hdr->addr1, link_sta->addr);
1839                         ether_addr_copy(hdr->addr2, bss_conf->addr);
1840                         /* translate A3 only if it's the BSSID */
1841                         if (!ieee80211_has_tods(hdr->frame_control) &&
1842                             !ieee80211_has_fromds(hdr->frame_control)) {
1843                                 if (ether_addr_equal(hdr->addr3, sta->addr))
1844                                         ether_addr_copy(hdr->addr3, link_sta->addr);
1845                                 else if (ether_addr_equal(hdr->addr3, vif->addr))
1846                                         ether_addr_copy(hdr->addr3, bss_conf->addr);
1847                         }
1848                         /* no need to look at A4, if present it's SA */
1849                 }
1850
1851                 chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
1852                 if (chanctx_conf) {
1853                         channel = chanctx_conf->def.chan;
1854                         confbw = chanctx_conf->def.width;
1855                 } else {
1856                         channel = NULL;
1857                 }
1858         }
1859
1860         if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
1861                 ieee80211_free_txskb(hw, skb);
1862                 return;
1863         }
1864
1865         if (data->idle && !data->tmp_chan) {
1866                 wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
1867                 ieee80211_free_txskb(hw, skb);
1868                 return;
1869         }
1870
1871         if (txi->control.vif)
1872                 hwsim_check_magic(txi->control.vif);
1873         if (control->sta)
1874                 hwsim_check_sta_magic(control->sta);
1875
1876         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1877                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
1878                                        txi->control.rates,
1879                                        ARRAY_SIZE(txi->control.rates));
1880
1881         for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
1882                 u16 rflags = txi->control.rates[i].flags;
1883                 /* initialize to data->bw for 5/10 MHz handling */
1884                 enum nl80211_chan_width bw = data->bw;
1885
1886                 if (txi->control.rates[i].idx == -1)
1887                         break;
1888
1889                 if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1890                         bw = NL80211_CHAN_WIDTH_40;
1891                 else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1892                         bw = NL80211_CHAN_WIDTH_80;
1893                 else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1894                         bw = NL80211_CHAN_WIDTH_160;
1895
1896                 if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
1897                         return;
1898         }
1899
1900         if (skb->len >= 24 + 8 &&
1901             ieee80211_is_probe_resp(hdr->frame_control)) {
1902                 /* fake header transmission time */
1903                 struct ieee80211_mgmt *mgmt;
1904                 struct ieee80211_rate *txrate;
1905                 /* TODO: get MCS */
1906                 int bitrate = 100;
1907                 u64 ts;
1908
1909                 mgmt = (struct ieee80211_mgmt *)skb->data;
1910                 txrate = ieee80211_get_tx_rate(hw, txi);
1911                 if (txrate)
1912                         bitrate = txrate->bitrate;
1913                 ts = mac80211_hwsim_get_tsf_raw();
1914                 mgmt->u.probe_resp.timestamp =
1915                         cpu_to_le64(ts + data->tsf_offset +
1916                                     24 * 8 * 10 / bitrate);
1917         }
1918
1919         mac80211_hwsim_monitor_rx(hw, skb, channel);
1920
1921         /* wmediumd mode check */
1922         _portid = READ_ONCE(data->wmediumd);
1923
1924         if (_portid || hwsim_virtio_enabled)
1925                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
1926
1927         /* NO wmediumd detected, perfect medium simulation */
1928         data->tx_pkts++;
1929         data->tx_bytes += skb->len;
1930         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
1931
1932         if (ack && skb->len >= 16)
1933                 mac80211_hwsim_monitor_ack(channel, hdr->addr2);
1934
1935         ieee80211_tx_info_clear_status(txi);
1936
1937         /* frame was transmitted at most favorable rate at first attempt */
1938         txi->control.rates[0].count = 1;
1939         txi->control.rates[1].idx = -1;
1940
1941         if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
1942                 txi->flags |= IEEE80211_TX_STAT_ACK;
1943         ieee80211_tx_status_irqsafe(hw, skb);
1944 }
1945
1946
1947 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
1948 {
1949         struct mac80211_hwsim_data *data = hw->priv;
1950         wiphy_dbg(hw->wiphy, "%s\n", __func__);
1951         data->started = true;
1952         return 0;
1953 }
1954
1955
1956 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
1957 {
1958         struct mac80211_hwsim_data *data = hw->priv;
1959         int i;
1960
1961         data->started = false;
1962
1963         for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
1964                 hrtimer_cancel(&data->link_data[i].beacon_timer);
1965
1966         while (!skb_queue_empty(&data->pending))
1967                 ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1968
1969         wiphy_dbg(hw->wiphy, "%s\n", __func__);
1970 }
1971
1972
1973 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
1974                                         struct ieee80211_vif *vif)
1975 {
1976         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
1977                   __func__, ieee80211_vif_type_p2p(vif),
1978                   vif->addr);
1979         hwsim_set_magic(vif);
1980
1981         if (vif->type != NL80211_IFTYPE_MONITOR)
1982                 mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
1983
1984         vif->cab_queue = 0;
1985         vif->hw_queue[IEEE80211_AC_VO] = 0;
1986         vif->hw_queue[IEEE80211_AC_VI] = 1;
1987         vif->hw_queue[IEEE80211_AC_BE] = 2;
1988         vif->hw_queue[IEEE80211_AC_BK] = 3;
1989
1990         return 0;
1991 }
1992
1993
1994 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
1995                                            struct ieee80211_vif *vif,
1996                                            enum nl80211_iftype newtype,
1997                                            bool newp2p)
1998 {
1999         newtype = ieee80211_iftype_p2p(newtype, newp2p);
2000         wiphy_dbg(hw->wiphy,
2001                   "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2002                   __func__, ieee80211_vif_type_p2p(vif),
2003                     newtype, vif->addr);
2004         hwsim_check_magic(vif);
2005
2006         /*
2007          * interface may change from non-AP to AP in
2008          * which case this needs to be set up again
2009          */
2010         vif->cab_queue = 0;
2011
2012         return 0;
2013 }
2014
2015 static void mac80211_hwsim_remove_interface(
2016         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2017 {
2018         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2019                   __func__, ieee80211_vif_type_p2p(vif),
2020                   vif->addr);
2021         hwsim_check_magic(vif);
2022         hwsim_clear_magic(vif);
2023         if (vif->type != NL80211_IFTYPE_MONITOR)
2024                 mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2025 }
2026
2027 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2028                                     struct sk_buff *skb,
2029                                     struct ieee80211_channel *chan)
2030 {
2031         struct mac80211_hwsim_data *data = hw->priv;
2032         u32 _pid = READ_ONCE(data->wmediumd);
2033
2034         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2035                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2036                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2037                                        txi->control.rates,
2038                                        ARRAY_SIZE(txi->control.rates));
2039         }
2040
2041         mac80211_hwsim_monitor_rx(hw, skb, chan);
2042
2043         if (_pid || hwsim_virtio_enabled)
2044                 return mac80211_hwsim_tx_frame_nl(hw, skb, _pid, chan);
2045
2046         data->tx_pkts++;
2047         data->tx_bytes += skb->len;
2048         mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2049         dev_kfree_skb(skb);
2050 }
2051
2052 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2053                                      struct ieee80211_vif *vif)
2054 {
2055         struct mac80211_hwsim_link_data *link_data = arg;
2056         u32 link_id = link_data->link_id;
2057         struct ieee80211_bss_conf *link_conf;
2058         struct mac80211_hwsim_data *data =
2059                 container_of(link_data, struct mac80211_hwsim_data,
2060                              link_data[link_id]);
2061         struct ieee80211_hw *hw = data->hw;
2062         struct ieee80211_tx_info *info;
2063         struct ieee80211_rate *txrate;
2064         struct ieee80211_mgmt *mgmt;
2065         struct sk_buff *skb;
2066         /* TODO: get MCS */
2067         int bitrate = 100;
2068
2069         hwsim_check_magic(vif);
2070
2071         link_conf = rcu_dereference(vif->link_conf[link_id]);
2072         if (!link_conf)
2073                 return;
2074
2075         if (vif->type != NL80211_IFTYPE_AP &&
2076             vif->type != NL80211_IFTYPE_MESH_POINT &&
2077             vif->type != NL80211_IFTYPE_ADHOC &&
2078             vif->type != NL80211_IFTYPE_OCB)
2079                 return;
2080
2081         skb = ieee80211_beacon_get(hw, vif, link_data->link_id);
2082         if (skb == NULL)
2083                 return;
2084         info = IEEE80211_SKB_CB(skb);
2085         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2086                 ieee80211_get_tx_rates(vif, NULL, skb,
2087                                        info->control.rates,
2088                                        ARRAY_SIZE(info->control.rates));
2089
2090         txrate = ieee80211_get_tx_rate(hw, info);
2091         if (txrate)
2092                 bitrate = txrate->bitrate;
2093
2094         mgmt = (struct ieee80211_mgmt *) skb->data;
2095         /* fake header transmission time */
2096         data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
2097         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2098                 struct ieee80211_ext *ext = (void *) mgmt;
2099
2100                 ext->u.s1g_beacon.timestamp = cpu_to_le32(data->abs_bcn_ts +
2101                                                           data->tsf_offset +
2102                                                           10 * 8 * 10 /
2103                                                           bitrate);
2104         } else {
2105                 mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
2106                                                        data->tsf_offset +
2107                                                        24 * 8 * 10 /
2108                                                        bitrate);
2109         }
2110
2111         mac80211_hwsim_tx_frame(hw, skb,
2112                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2113
2114         while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2115                 mac80211_hwsim_tx_frame(hw, skb,
2116                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2117         }
2118
2119         if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif))
2120                 ieee80211_csa_finish(vif);
2121 }
2122
2123 static enum hrtimer_restart
2124 mac80211_hwsim_beacon(struct hrtimer *timer)
2125 {
2126         struct mac80211_hwsim_link_data *link_data =
2127                 container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2128         struct mac80211_hwsim_data *data =
2129                 container_of(link_data, struct mac80211_hwsim_data,
2130                              link_data[link_data->link_id]);
2131         struct ieee80211_hw *hw = data->hw;
2132         u64 bcn_int = link_data->beacon_int;
2133
2134         if (!data->started)
2135                 return HRTIMER_NORESTART;
2136
2137         ieee80211_iterate_active_interfaces_atomic(
2138                 hw, IEEE80211_IFACE_ITER_NORMAL,
2139                 mac80211_hwsim_beacon_tx, link_data);
2140
2141         /* beacon at new TBTT + beacon interval */
2142         if (data->bcn_delta) {
2143                 bcn_int -= data->bcn_delta;
2144                 data->bcn_delta = 0;
2145         }
2146         hrtimer_forward_now(&link_data->beacon_timer,
2147                             ns_to_ktime(bcn_int * NSEC_PER_USEC));
2148         return HRTIMER_RESTART;
2149 }
2150
2151 static const char * const hwsim_chanwidths[] = {
2152         [NL80211_CHAN_WIDTH_5] = "ht5",
2153         [NL80211_CHAN_WIDTH_10] = "ht10",
2154         [NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2155         [NL80211_CHAN_WIDTH_20] = "ht20",
2156         [NL80211_CHAN_WIDTH_40] = "ht40",
2157         [NL80211_CHAN_WIDTH_80] = "vht80",
2158         [NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2159         [NL80211_CHAN_WIDTH_160] = "vht160",
2160         [NL80211_CHAN_WIDTH_1] = "1MHz",
2161         [NL80211_CHAN_WIDTH_2] = "2MHz",
2162         [NL80211_CHAN_WIDTH_4] = "4MHz",
2163         [NL80211_CHAN_WIDTH_8] = "8MHz",
2164         [NL80211_CHAN_WIDTH_16] = "16MHz",
2165 };
2166
2167 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
2168 {
2169         struct mac80211_hwsim_data *data = hw->priv;
2170         struct ieee80211_conf *conf = &hw->conf;
2171         static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2172                 [IEEE80211_SMPS_AUTOMATIC] = "auto",
2173                 [IEEE80211_SMPS_OFF] = "off",
2174                 [IEEE80211_SMPS_STATIC] = "static",
2175                 [IEEE80211_SMPS_DYNAMIC] = "dynamic",
2176         };
2177         int idx;
2178
2179         if (conf->chandef.chan)
2180                 wiphy_dbg(hw->wiphy,
2181                           "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2182                           __func__,
2183                           conf->chandef.chan->center_freq,
2184                           conf->chandef.center_freq1,
2185                           conf->chandef.center_freq2,
2186                           hwsim_chanwidths[conf->chandef.width],
2187                           !!(conf->flags & IEEE80211_CONF_IDLE),
2188                           !!(conf->flags & IEEE80211_CONF_PS),
2189                           smps_modes[conf->smps_mode]);
2190         else
2191                 wiphy_dbg(hw->wiphy,
2192                           "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2193                           __func__,
2194                           !!(conf->flags & IEEE80211_CONF_IDLE),
2195                           !!(conf->flags & IEEE80211_CONF_PS),
2196                           smps_modes[conf->smps_mode]);
2197
2198         data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2199
2200         WARN_ON(conf->chandef.chan && data->use_chanctx);
2201
2202         mutex_lock(&data->mutex);
2203         if (data->scanning && conf->chandef.chan) {
2204                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2205                         if (data->survey_data[idx].channel == data->channel) {
2206                                 data->survey_data[idx].start =
2207                                         data->survey_data[idx].next_start;
2208                                 data->survey_data[idx].end = jiffies;
2209                                 break;
2210                         }
2211                 }
2212
2213                 data->channel = conf->chandef.chan;
2214                 data->bw = conf->chandef.width;
2215
2216                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2217                         if (data->survey_data[idx].channel &&
2218                             data->survey_data[idx].channel != data->channel)
2219                                 continue;
2220                         data->survey_data[idx].channel = data->channel;
2221                         data->survey_data[idx].next_start = jiffies;
2222                         break;
2223                 }
2224         } else {
2225                 data->channel = conf->chandef.chan;
2226                 data->bw = conf->chandef.width;
2227         }
2228         mutex_unlock(&data->mutex);
2229
2230         for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2231                 struct mac80211_hwsim_link_data *link_data =
2232                         &data->link_data[idx];
2233
2234                 if (!data->started || !link_data->beacon_int) {
2235                         hrtimer_cancel(&link_data->beacon_timer);
2236                 } else if (!hrtimer_is_queued(&link_data->beacon_timer)) {
2237                         u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2238                         u32 bcn_int = link_data->beacon_int;
2239                         u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2240
2241                         hrtimer_start(&link_data->beacon_timer,
2242                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2243                                       HRTIMER_MODE_REL_SOFT);
2244                 }
2245         }
2246
2247         return 0;
2248 }
2249
2250
2251 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2252                                             unsigned int changed_flags,
2253                                             unsigned int *total_flags,u64 multicast)
2254 {
2255         struct mac80211_hwsim_data *data = hw->priv;
2256
2257         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2258
2259         data->rx_filter = 0;
2260         if (*total_flags & FIF_ALLMULTI)
2261                 data->rx_filter |= FIF_ALLMULTI;
2262         if (*total_flags & FIF_MCAST_ACTION)
2263                 data->rx_filter |= FIF_MCAST_ACTION;
2264
2265         *total_flags = data->rx_filter;
2266 }
2267
2268 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2269                                        struct ieee80211_vif *vif)
2270 {
2271         unsigned int *count = data;
2272         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2273
2274         if (vp->bcn_en)
2275                 (*count)++;
2276 }
2277
2278 static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2279                                             struct ieee80211_vif *vif,
2280                                             u64 changed)
2281 {
2282         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2283
2284         hwsim_check_magic(vif);
2285
2286         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2287                   __func__, changed, vif->addr);
2288
2289         if (changed & BSS_CHANGED_ASSOC) {
2290                 wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2291                           vif->cfg.assoc, vif->cfg.aid);
2292                 vp->assoc = vif->cfg.assoc;
2293                 vp->aid = vif->cfg.aid;
2294         }
2295 }
2296
2297 static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2298                                              struct ieee80211_vif *vif,
2299                                              struct ieee80211_bss_conf *info,
2300                                              u64 changed)
2301 {
2302         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2303         struct mac80211_hwsim_data *data = hw->priv;
2304         unsigned int link_id = info->link_id;
2305         struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2306
2307         hwsim_check_magic(vif);
2308
2309         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2310                   __func__, (unsigned long long)changed, vif->addr, link_id);
2311
2312         if (changed & BSS_CHANGED_BSSID) {
2313                 wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2314                           __func__, info->bssid);
2315                 memcpy(vp->bssid, info->bssid, ETH_ALEN);
2316         }
2317
2318         if (changed & BSS_CHANGED_BEACON_ENABLED) {
2319                 wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2320                           info->enable_beacon, info->beacon_int);
2321                 vp->bcn_en = info->enable_beacon;
2322                 if (data->started &&
2323                     !hrtimer_is_queued(&link_data->beacon_timer) &&
2324                     info->enable_beacon) {
2325                         u64 tsf, until_tbtt;
2326                         u32 bcn_int;
2327                         link_data->beacon_int = info->beacon_int * 1024;
2328                         tsf = mac80211_hwsim_get_tsf(hw, vif);
2329                         bcn_int = link_data->beacon_int;
2330                         until_tbtt = bcn_int - do_div(tsf, bcn_int);
2331
2332                         hrtimer_start(&link_data->beacon_timer,
2333                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2334                                       HRTIMER_MODE_REL_SOFT);
2335                 } else if (!info->enable_beacon) {
2336                         unsigned int count = 0;
2337                         ieee80211_iterate_active_interfaces_atomic(
2338                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
2339                                 mac80211_hwsim_bcn_en_iter, &count);
2340                         wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2341                                   count);
2342                         if (count == 0) {
2343                                 hrtimer_cancel(&link_data->beacon_timer);
2344                                 link_data->beacon_int = 0;
2345                         }
2346                 }
2347         }
2348
2349         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2350                 wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2351                           info->use_cts_prot);
2352         }
2353
2354         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2355                 wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2356                           info->use_short_preamble);
2357         }
2358
2359         if (changed & BSS_CHANGED_ERP_SLOT) {
2360                 wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2361         }
2362
2363         if (changed & BSS_CHANGED_HT) {
2364                 wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2365                           info->ht_operation_mode);
2366         }
2367
2368         if (changed & BSS_CHANGED_BASIC_RATES) {
2369                 wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2370                           (unsigned long long) info->basic_rates);
2371         }
2372
2373         if (changed & BSS_CHANGED_TXPOWER)
2374                 wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2375 }
2376
2377 static void
2378 mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2379                              struct ieee80211_vif *vif,
2380                              struct ieee80211_sta *sta,
2381                              u32 changed)
2382 {
2383         struct mac80211_hwsim_data *data = hw->priv;
2384         u32 bw = U32_MAX;
2385         int link_id;
2386
2387         rcu_read_lock();
2388         for (link_id = 0;
2389              link_id < ARRAY_SIZE(vif->link_conf);
2390              link_id++) {
2391                 enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2392                 struct ieee80211_bss_conf *vif_conf;
2393                 struct ieee80211_link_sta *link_sta;
2394
2395                 link_sta = rcu_dereference(sta->link[link_id]);
2396
2397                 if (!link_sta)
2398                         continue;
2399
2400                 switch (link_sta->bandwidth) {
2401 #define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2402                 C(20);
2403                 C(40);
2404                 C(80);
2405                 C(160);
2406                 C(320);
2407 #undef C
2408                 }
2409
2410                 if (!data->use_chanctx) {
2411                         confbw = data->bw;
2412                 } else {
2413                         struct ieee80211_chanctx_conf *chanctx_conf;
2414
2415                         vif_conf = rcu_dereference(vif->link_conf[link_id]);
2416                         if (WARN_ON(!vif_conf))
2417                                 continue;
2418
2419                         chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2420
2421                         if (!WARN_ON(!chanctx_conf))
2422                                 confbw = chanctx_conf->def.width;
2423                 }
2424
2425                 WARN(bw > hwsim_get_chanwidth(confbw),
2426                      "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2427                      vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2428                      hwsim_get_chanwidth(data->bw), data->bw);
2429
2430
2431         }
2432         rcu_read_unlock();
2433
2434
2435 }
2436
2437 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2438                                   struct ieee80211_vif *vif,
2439                                   struct ieee80211_sta *sta)
2440 {
2441         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2442
2443         hwsim_check_magic(vif);
2444         hwsim_set_sta_magic(sta);
2445         mac80211_hwsim_sta_rc_update(hw, vif, sta, 0);
2446
2447         if (sta->valid_links) {
2448                 WARN(hweight16(sta->valid_links) > 1,
2449                      "expect to add STA with single link, have 0x%x\n",
2450                      sta->valid_links);
2451                 sp->active_links_rx = sta->valid_links;
2452         }
2453
2454         return 0;
2455 }
2456
2457 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2458                                      struct ieee80211_vif *vif,
2459                                      struct ieee80211_sta *sta)
2460 {
2461         hwsim_check_magic(vif);
2462         hwsim_clear_sta_magic(sta);
2463
2464         return 0;
2465 }
2466
2467 static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2468                                     struct ieee80211_vif *vif,
2469                                     struct ieee80211_sta *sta,
2470                                     enum ieee80211_sta_state old_state,
2471                                     enum ieee80211_sta_state new_state)
2472 {
2473         if (new_state == IEEE80211_STA_NOTEXIST)
2474                 return mac80211_hwsim_sta_remove(hw, vif, sta);
2475
2476         if (old_state == IEEE80211_STA_NOTEXIST)
2477                 return mac80211_hwsim_sta_add(hw, vif, sta);
2478
2479         /*
2480          * when client is authorized (AP station marked as such),
2481          * enable all links
2482          */
2483         if (vif->type == NL80211_IFTYPE_STATION &&
2484             new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2485                 ieee80211_set_active_links_async(vif, vif->valid_links);
2486
2487         return 0;
2488 }
2489
2490 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2491                                       struct ieee80211_vif *vif,
2492                                       enum sta_notify_cmd cmd,
2493                                       struct ieee80211_sta *sta)
2494 {
2495         hwsim_check_magic(vif);
2496
2497         switch (cmd) {
2498         case STA_NOTIFY_SLEEP:
2499         case STA_NOTIFY_AWAKE:
2500                 /* TODO: make good use of these flags */
2501                 break;
2502         default:
2503                 WARN(1, "Invalid sta notify: %d\n", cmd);
2504                 break;
2505         }
2506 }
2507
2508 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2509                                   struct ieee80211_sta *sta,
2510                                   bool set)
2511 {
2512         hwsim_check_sta_magic(sta);
2513         return 0;
2514 }
2515
2516 static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2517                                   struct ieee80211_vif *vif,
2518                                   unsigned int link_id, u16 queue,
2519                                   const struct ieee80211_tx_queue_params *params)
2520 {
2521         wiphy_dbg(hw->wiphy,
2522                   "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2523                   __func__, queue,
2524                   params->txop, params->cw_min,
2525                   params->cw_max, params->aifs);
2526         return 0;
2527 }
2528
2529 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2530                                      struct survey_info *survey)
2531 {
2532         struct mac80211_hwsim_data *hwsim = hw->priv;
2533
2534         if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2535                 return -ENOENT;
2536
2537         mutex_lock(&hwsim->mutex);
2538         survey->channel = hwsim->survey_data[idx].channel;
2539         if (!survey->channel) {
2540                 mutex_unlock(&hwsim->mutex);
2541                 return -ENOENT;
2542         }
2543
2544         /*
2545          * Magically conjured dummy values --- this is only ok for simulated hardware.
2546          *
2547          * A real driver which cannot determine real values noise MUST NOT
2548          * report any, especially not a magically conjured ones :-)
2549          */
2550         survey->filled = SURVEY_INFO_NOISE_DBM |
2551                          SURVEY_INFO_TIME |
2552                          SURVEY_INFO_TIME_BUSY;
2553         survey->noise = -92;
2554         survey->time =
2555                 jiffies_to_msecs(hwsim->survey_data[idx].end -
2556                                  hwsim->survey_data[idx].start);
2557         /* report 12.5% of channel time is used */
2558         survey->time_busy = survey->time/8;
2559         mutex_unlock(&hwsim->mutex);
2560
2561         return 0;
2562 }
2563
2564 #ifdef CONFIG_NL80211_TESTMODE
2565 /*
2566  * This section contains example code for using netlink
2567  * attributes with the testmode command in nl80211.
2568  */
2569
2570 /* These enums need to be kept in sync with userspace */
2571 enum hwsim_testmode_attr {
2572         __HWSIM_TM_ATTR_INVALID = 0,
2573         HWSIM_TM_ATTR_CMD       = 1,
2574         HWSIM_TM_ATTR_PS        = 2,
2575
2576         /* keep last */
2577         __HWSIM_TM_ATTR_AFTER_LAST,
2578         HWSIM_TM_ATTR_MAX       = __HWSIM_TM_ATTR_AFTER_LAST - 1
2579 };
2580
2581 enum hwsim_testmode_cmd {
2582         HWSIM_TM_CMD_SET_PS             = 0,
2583         HWSIM_TM_CMD_GET_PS             = 1,
2584         HWSIM_TM_CMD_STOP_QUEUES        = 2,
2585         HWSIM_TM_CMD_WAKE_QUEUES        = 3,
2586 };
2587
2588 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2589         [HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2590         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2591 };
2592
2593 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2594                                        struct ieee80211_vif *vif,
2595                                        void *data, int len)
2596 {
2597         struct mac80211_hwsim_data *hwsim = hw->priv;
2598         struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2599         struct sk_buff *skb;
2600         int err, ps;
2601
2602         err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2603                                    hwsim_testmode_policy, NULL);
2604         if (err)
2605                 return err;
2606
2607         if (!tb[HWSIM_TM_ATTR_CMD])
2608                 return -EINVAL;
2609
2610         switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2611         case HWSIM_TM_CMD_SET_PS:
2612                 if (!tb[HWSIM_TM_ATTR_PS])
2613                         return -EINVAL;
2614                 ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2615                 return hwsim_fops_ps_write(hwsim, ps);
2616         case HWSIM_TM_CMD_GET_PS:
2617                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2618                                                 nla_total_size(sizeof(u32)));
2619                 if (!skb)
2620                         return -ENOMEM;
2621                 if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2622                         goto nla_put_failure;
2623                 return cfg80211_testmode_reply(skb);
2624         case HWSIM_TM_CMD_STOP_QUEUES:
2625                 ieee80211_stop_queues(hw);
2626                 return 0;
2627         case HWSIM_TM_CMD_WAKE_QUEUES:
2628                 ieee80211_wake_queues(hw);
2629                 return 0;
2630         default:
2631                 return -EOPNOTSUPP;
2632         }
2633
2634  nla_put_failure:
2635         kfree_skb(skb);
2636         return -ENOBUFS;
2637 }
2638 #endif
2639
2640 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2641                                        struct ieee80211_vif *vif,
2642                                        struct ieee80211_ampdu_params *params)
2643 {
2644         struct ieee80211_sta *sta = params->sta;
2645         enum ieee80211_ampdu_mlme_action action = params->action;
2646         u16 tid = params->tid;
2647
2648         switch (action) {
2649         case IEEE80211_AMPDU_TX_START:
2650                 return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2651         case IEEE80211_AMPDU_TX_STOP_CONT:
2652         case IEEE80211_AMPDU_TX_STOP_FLUSH:
2653         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2654                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2655                 break;
2656         case IEEE80211_AMPDU_TX_OPERATIONAL:
2657                 break;
2658         case IEEE80211_AMPDU_RX_START:
2659         case IEEE80211_AMPDU_RX_STOP:
2660                 break;
2661         default:
2662                 return -EOPNOTSUPP;
2663         }
2664
2665         return 0;
2666 }
2667
2668 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2669                                  struct ieee80211_vif *vif,
2670                                  u32 queues, bool drop)
2671 {
2672         /* Not implemented, queues only on kernel side */
2673 }
2674
2675 static void hw_scan_work(struct work_struct *work)
2676 {
2677         struct mac80211_hwsim_data *hwsim =
2678                 container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2679         struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2680         int dwell, i;
2681
2682         mutex_lock(&hwsim->mutex);
2683         if (hwsim->scan_chan_idx >= req->n_channels) {
2684                 struct cfg80211_scan_info info = {
2685                         .aborted = false,
2686                 };
2687
2688                 wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2689                 ieee80211_scan_completed(hwsim->hw, &info);
2690                 hwsim->hw_scan_request = NULL;
2691                 hwsim->hw_scan_vif = NULL;
2692                 hwsim->tmp_chan = NULL;
2693                 mutex_unlock(&hwsim->mutex);
2694                 mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2695                                              false);
2696                 return;
2697         }
2698
2699         wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2700                   req->channels[hwsim->scan_chan_idx]->center_freq);
2701
2702         hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2703         if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2704                                       IEEE80211_CHAN_RADAR) ||
2705             !req->n_ssids) {
2706                 dwell = 120;
2707         } else {
2708                 dwell = 30;
2709                 /* send probes */
2710                 for (i = 0; i < req->n_ssids; i++) {
2711                         struct sk_buff *probe;
2712                         struct ieee80211_mgmt *mgmt;
2713
2714                         probe = ieee80211_probereq_get(hwsim->hw,
2715                                                        hwsim->scan_addr,
2716                                                        req->ssids[i].ssid,
2717                                                        req->ssids[i].ssid_len,
2718                                                        req->ie_len);
2719                         if (!probe)
2720                                 continue;
2721
2722                         mgmt = (struct ieee80211_mgmt *) probe->data;
2723                         memcpy(mgmt->da, req->bssid, ETH_ALEN);
2724                         memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2725
2726                         if (req->ie_len)
2727                                 skb_put_data(probe, req->ie, req->ie_len);
2728
2729                         rcu_read_lock();
2730                         if (!ieee80211_tx_prepare_skb(hwsim->hw,
2731                                                       hwsim->hw_scan_vif,
2732                                                       probe,
2733                                                       hwsim->tmp_chan->band,
2734                                                       NULL)) {
2735                                 rcu_read_unlock();
2736                                 kfree_skb(probe);
2737                                 continue;
2738                         }
2739
2740                         local_bh_disable();
2741                         mac80211_hwsim_tx_frame(hwsim->hw, probe,
2742                                                 hwsim->tmp_chan);
2743                         rcu_read_unlock();
2744                         local_bh_enable();
2745                 }
2746         }
2747         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2748                                      msecs_to_jiffies(dwell));
2749         hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2750         hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2751         hwsim->survey_data[hwsim->scan_chan_idx].end =
2752                 jiffies + msecs_to_jiffies(dwell);
2753         hwsim->scan_chan_idx++;
2754         mutex_unlock(&hwsim->mutex);
2755 }
2756
2757 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2758                                   struct ieee80211_vif *vif,
2759                                   struct ieee80211_scan_request *hw_req)
2760 {
2761         struct mac80211_hwsim_data *hwsim = hw->priv;
2762         struct cfg80211_scan_request *req = &hw_req->req;
2763
2764         mutex_lock(&hwsim->mutex);
2765         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2766                 mutex_unlock(&hwsim->mutex);
2767                 return -EBUSY;
2768         }
2769         hwsim->hw_scan_request = req;
2770         hwsim->hw_scan_vif = vif;
2771         hwsim->scan_chan_idx = 0;
2772         if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2773                 get_random_mask_addr(hwsim->scan_addr,
2774                                      hw_req->req.mac_addr,
2775                                      hw_req->req.mac_addr_mask);
2776         else
2777                 memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
2778         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2779         mutex_unlock(&hwsim->mutex);
2780
2781         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2782         wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
2783
2784         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
2785
2786         return 0;
2787 }
2788
2789 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
2790                                           struct ieee80211_vif *vif)
2791 {
2792         struct mac80211_hwsim_data *hwsim = hw->priv;
2793         struct cfg80211_scan_info info = {
2794                 .aborted = true,
2795         };
2796
2797         wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
2798
2799         cancel_delayed_work_sync(&hwsim->hw_scan);
2800
2801         mutex_lock(&hwsim->mutex);
2802         ieee80211_scan_completed(hwsim->hw, &info);
2803         hwsim->tmp_chan = NULL;
2804         hwsim->hw_scan_request = NULL;
2805         hwsim->hw_scan_vif = NULL;
2806         mutex_unlock(&hwsim->mutex);
2807 }
2808
2809 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
2810                                    struct ieee80211_vif *vif,
2811                                    const u8 *mac_addr)
2812 {
2813         struct mac80211_hwsim_data *hwsim = hw->priv;
2814
2815         mutex_lock(&hwsim->mutex);
2816
2817         if (hwsim->scanning) {
2818                 pr_debug("two hwsim sw_scans detected!\n");
2819                 goto out;
2820         }
2821
2822         pr_debug("hwsim sw_scan request, prepping stuff\n");
2823
2824         memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
2825         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2826         hwsim->scanning = true;
2827         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2828
2829 out:
2830         mutex_unlock(&hwsim->mutex);
2831 }
2832
2833 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
2834                                             struct ieee80211_vif *vif)
2835 {
2836         struct mac80211_hwsim_data *hwsim = hw->priv;
2837
2838         mutex_lock(&hwsim->mutex);
2839
2840         pr_debug("hwsim sw_scan_complete\n");
2841         hwsim->scanning = false;
2842         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
2843         eth_zero_addr(hwsim->scan_addr);
2844
2845         mutex_unlock(&hwsim->mutex);
2846 }
2847
2848 static void hw_roc_start(struct work_struct *work)
2849 {
2850         struct mac80211_hwsim_data *hwsim =
2851                 container_of(work, struct mac80211_hwsim_data, roc_start.work);
2852
2853         mutex_lock(&hwsim->mutex);
2854
2855         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
2856         hwsim->tmp_chan = hwsim->roc_chan;
2857         ieee80211_ready_on_channel(hwsim->hw);
2858
2859         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
2860                                      msecs_to_jiffies(hwsim->roc_duration));
2861
2862         mutex_unlock(&hwsim->mutex);
2863 }
2864
2865 static void hw_roc_done(struct work_struct *work)
2866 {
2867         struct mac80211_hwsim_data *hwsim =
2868                 container_of(work, struct mac80211_hwsim_data, roc_done.work);
2869
2870         mutex_lock(&hwsim->mutex);
2871         ieee80211_remain_on_channel_expired(hwsim->hw);
2872         hwsim->tmp_chan = NULL;
2873         mutex_unlock(&hwsim->mutex);
2874
2875         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
2876 }
2877
2878 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
2879                               struct ieee80211_vif *vif,
2880                               struct ieee80211_channel *chan,
2881                               int duration,
2882                               enum ieee80211_roc_type type)
2883 {
2884         struct mac80211_hwsim_data *hwsim = hw->priv;
2885
2886         mutex_lock(&hwsim->mutex);
2887         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2888                 mutex_unlock(&hwsim->mutex);
2889                 return -EBUSY;
2890         }
2891
2892         hwsim->roc_chan = chan;
2893         hwsim->roc_duration = duration;
2894         mutex_unlock(&hwsim->mutex);
2895
2896         wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
2897                   chan->center_freq, duration);
2898         ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
2899
2900         return 0;
2901 }
2902
2903 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
2904                                struct ieee80211_vif *vif)
2905 {
2906         struct mac80211_hwsim_data *hwsim = hw->priv;
2907
2908         cancel_delayed_work_sync(&hwsim->roc_start);
2909         cancel_delayed_work_sync(&hwsim->roc_done);
2910
2911         mutex_lock(&hwsim->mutex);
2912         hwsim->tmp_chan = NULL;
2913         mutex_unlock(&hwsim->mutex);
2914
2915         wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
2916
2917         return 0;
2918 }
2919
2920 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
2921                                       struct ieee80211_chanctx_conf *ctx)
2922 {
2923         hwsim_set_chanctx_magic(ctx);
2924         wiphy_dbg(hw->wiphy,
2925                   "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2926                   ctx->def.chan->center_freq, ctx->def.width,
2927                   ctx->def.center_freq1, ctx->def.center_freq2);
2928         return 0;
2929 }
2930
2931 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
2932                                           struct ieee80211_chanctx_conf *ctx)
2933 {
2934         wiphy_dbg(hw->wiphy,
2935                   "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2936                   ctx->def.chan->center_freq, ctx->def.width,
2937                   ctx->def.center_freq1, ctx->def.center_freq2);
2938         hwsim_check_chanctx_magic(ctx);
2939         hwsim_clear_chanctx_magic(ctx);
2940 }
2941
2942 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
2943                                           struct ieee80211_chanctx_conf *ctx,
2944                                           u32 changed)
2945 {
2946         hwsim_check_chanctx_magic(ctx);
2947         wiphy_dbg(hw->wiphy,
2948                   "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2949                   ctx->def.chan->center_freq, ctx->def.width,
2950                   ctx->def.center_freq1, ctx->def.center_freq2);
2951 }
2952
2953 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
2954                                              struct ieee80211_vif *vif,
2955                                              struct ieee80211_bss_conf *link_conf,
2956                                              struct ieee80211_chanctx_conf *ctx)
2957 {
2958         hwsim_check_magic(vif);
2959         hwsim_check_chanctx_magic(ctx);
2960
2961         /* if we activate a link while already associated wake it up */
2962         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
2963                 struct sk_buff *skb;
2964
2965                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
2966                 if (skb) {
2967                         local_bh_disable();
2968                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
2969                         local_bh_enable();
2970                 }
2971         }
2972
2973         return 0;
2974 }
2975
2976 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
2977                                                 struct ieee80211_vif *vif,
2978                                                 struct ieee80211_bss_conf *link_conf,
2979                                                 struct ieee80211_chanctx_conf *ctx)
2980 {
2981         hwsim_check_magic(vif);
2982         hwsim_check_chanctx_magic(ctx);
2983
2984         /* if we deactivate a link while associated suspend it first */
2985         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
2986                 struct sk_buff *skb;
2987
2988                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
2989                 if (skb) {
2990                         struct ieee80211_hdr *hdr = (void *)skb->data;
2991
2992                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
2993
2994                         local_bh_disable();
2995                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
2996                         local_bh_enable();
2997                 }
2998         }
2999 }
3000
3001 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3002         "tx_pkts_nic",
3003         "tx_bytes_nic",
3004         "rx_pkts_nic",
3005         "rx_bytes_nic",
3006         "d_tx_dropped",
3007         "d_tx_failed",
3008         "d_ps_mode",
3009         "d_group",
3010 };
3011
3012 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3013
3014 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3015                                           struct ieee80211_vif *vif,
3016                                           u32 sset, u8 *data)
3017 {
3018         if (sset == ETH_SS_STATS)
3019                 memcpy(data, *mac80211_hwsim_gstrings_stats,
3020                        sizeof(mac80211_hwsim_gstrings_stats));
3021 }
3022
3023 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3024                                             struct ieee80211_vif *vif, int sset)
3025 {
3026         if (sset == ETH_SS_STATS)
3027                 return MAC80211_HWSIM_SSTATS_LEN;
3028         return 0;
3029 }
3030
3031 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3032                                         struct ieee80211_vif *vif,
3033                                         struct ethtool_stats *stats, u64 *data)
3034 {
3035         struct mac80211_hwsim_data *ar = hw->priv;
3036         int i = 0;
3037
3038         data[i++] = ar->tx_pkts;
3039         data[i++] = ar->tx_bytes;
3040         data[i++] = ar->rx_pkts;
3041         data[i++] = ar->rx_bytes;
3042         data[i++] = ar->tx_dropped;
3043         data[i++] = ar->tx_failed;
3044         data[i++] = ar->ps;
3045         data[i++] = ar->group;
3046
3047         WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3048 }
3049
3050 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3051 {
3052         return 1;
3053 }
3054
3055 static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3056 {
3057         return -EOPNOTSUPP;
3058 }
3059
3060 static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3061                                            struct ieee80211_vif *vif,
3062                                            u16 old_links, u16 new_links,
3063                                            struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3064 {
3065         unsigned long rem = old_links & ~new_links;
3066         unsigned long add = new_links & ~old_links;
3067         int i;
3068
3069         if (!old_links)
3070                 rem |= BIT(0);
3071         if (!new_links)
3072                 add |= BIT(0);
3073
3074         for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS)
3075                 mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3076
3077         for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3078                 struct ieee80211_bss_conf *link_conf;
3079
3080                 link_conf = link_conf_dereference_protected(vif, i);
3081                 if (WARN_ON(!link_conf))
3082                         continue;
3083
3084                 mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3085         }
3086
3087         return 0;
3088 }
3089
3090 static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3091                                            struct ieee80211_vif *vif,
3092                                            struct ieee80211_sta *sta,
3093                                            u16 old_links, u16 new_links)
3094 {
3095         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3096
3097         hwsim_check_sta_magic(sta);
3098
3099         if (vif->type == NL80211_IFTYPE_STATION)
3100                 sp->active_links_rx = new_links;
3101
3102         return 0;
3103 }
3104
3105 #define HWSIM_COMMON_OPS                                        \
3106         .tx = mac80211_hwsim_tx,                                \
3107         .wake_tx_queue = ieee80211_handle_wake_tx_queue,        \
3108         .start = mac80211_hwsim_start,                          \
3109         .stop = mac80211_hwsim_stop,                            \
3110         .add_interface = mac80211_hwsim_add_interface,          \
3111         .change_interface = mac80211_hwsim_change_interface,    \
3112         .remove_interface = mac80211_hwsim_remove_interface,    \
3113         .config = mac80211_hwsim_config,                        \
3114         .configure_filter = mac80211_hwsim_configure_filter,    \
3115         .vif_cfg_changed = mac80211_hwsim_vif_info_changed,     \
3116         .link_info_changed = mac80211_hwsim_link_info_changed,  \
3117         .tx_last_beacon = mac80211_hwsim_tx_last_beacon,        \
3118         .sta_notify = mac80211_hwsim_sta_notify,                \
3119         .sta_rc_update = mac80211_hwsim_sta_rc_update,          \
3120         .conf_tx = mac80211_hwsim_conf_tx,                      \
3121         .get_survey = mac80211_hwsim_get_survey,                \
3122         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)      \
3123         .ampdu_action = mac80211_hwsim_ampdu_action,            \
3124         .flush = mac80211_hwsim_flush,                          \
3125         .get_et_sset_count = mac80211_hwsim_get_et_sset_count,  \
3126         .get_et_stats = mac80211_hwsim_get_et_stats,            \
3127         .get_et_strings = mac80211_hwsim_get_et_strings,
3128
3129 #define HWSIM_NON_MLO_OPS                                       \
3130         .sta_add = mac80211_hwsim_sta_add,                      \
3131         .sta_remove = mac80211_hwsim_sta_remove,                \
3132         .set_tim = mac80211_hwsim_set_tim,                      \
3133         .get_tsf = mac80211_hwsim_get_tsf,                      \
3134         .set_tsf = mac80211_hwsim_set_tsf,
3135
3136 static const struct ieee80211_ops mac80211_hwsim_ops = {
3137         HWSIM_COMMON_OPS
3138         HWSIM_NON_MLO_OPS
3139         .sw_scan_start = mac80211_hwsim_sw_scan,
3140         .sw_scan_complete = mac80211_hwsim_sw_scan_complete,
3141 };
3142
3143 #define HWSIM_CHANCTX_OPS                                       \
3144         .hw_scan = mac80211_hwsim_hw_scan,                      \
3145         .cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,        \
3146         .remain_on_channel = mac80211_hwsim_roc,                \
3147         .cancel_remain_on_channel = mac80211_hwsim_croc,        \
3148         .add_chanctx = mac80211_hwsim_add_chanctx,              \
3149         .remove_chanctx = mac80211_hwsim_remove_chanctx,        \
3150         .change_chanctx = mac80211_hwsim_change_chanctx,        \
3151         .assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
3152         .unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx,
3153
3154 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
3155         HWSIM_COMMON_OPS
3156         HWSIM_NON_MLO_OPS
3157         HWSIM_CHANCTX_OPS
3158 };
3159
3160 static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
3161         HWSIM_COMMON_OPS
3162         HWSIM_CHANCTX_OPS
3163         .set_rts_threshold = mac80211_hwsim_set_rts_threshold,
3164         .change_vif_links = mac80211_hwsim_change_vif_links,
3165         .change_sta_links = mac80211_hwsim_change_sta_links,
3166         .sta_state = mac80211_hwsim_sta_state,
3167 };
3168
3169 struct hwsim_new_radio_params {
3170         unsigned int channels;
3171         const char *reg_alpha2;
3172         const struct ieee80211_regdomain *regd;
3173         bool reg_strict;
3174         bool p2p_device;
3175         bool use_chanctx;
3176         bool destroy_on_close;
3177         const char *hwname;
3178         bool no_vif;
3179         const u8 *perm_addr;
3180         u32 iftypes;
3181         u32 *ciphers;
3182         u8 n_ciphers;
3183         bool mlo;
3184 };
3185
3186 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
3187                                    struct genl_info *info)
3188 {
3189         if (info)
3190                 genl_notify(&hwsim_genl_family, mcast_skb, info,
3191                             HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3192         else
3193                 genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
3194                                   HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3195 }
3196
3197 static int append_radio_msg(struct sk_buff *skb, int id,
3198                             struct hwsim_new_radio_params *param)
3199 {
3200         int ret;
3201
3202         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
3203         if (ret < 0)
3204                 return ret;
3205
3206         if (param->channels) {
3207                 ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
3208                 if (ret < 0)
3209                         return ret;
3210         }
3211
3212         if (param->reg_alpha2) {
3213                 ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
3214                               param->reg_alpha2);
3215                 if (ret < 0)
3216                         return ret;
3217         }
3218
3219         if (param->regd) {
3220                 int i;
3221
3222                 for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
3223                         if (hwsim_world_regdom_custom[i] != param->regd)
3224                                 continue;
3225
3226                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
3227                         if (ret < 0)
3228                                 return ret;
3229                         break;
3230                 }
3231         }
3232
3233         if (param->reg_strict) {
3234                 ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
3235                 if (ret < 0)
3236                         return ret;
3237         }
3238
3239         if (param->p2p_device) {
3240                 ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
3241                 if (ret < 0)
3242                         return ret;
3243         }
3244
3245         if (param->use_chanctx) {
3246                 ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
3247                 if (ret < 0)
3248                         return ret;
3249         }
3250
3251         if (param->hwname) {
3252                 ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
3253                               strlen(param->hwname), param->hwname);
3254                 if (ret < 0)
3255                         return ret;
3256         }
3257
3258         return 0;
3259 }
3260
3261 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
3262                                   struct hwsim_new_radio_params *param)
3263 {
3264         struct sk_buff *mcast_skb;
3265         void *data;
3266
3267         mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3268         if (!mcast_skb)
3269                 return;
3270
3271         data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
3272                            HWSIM_CMD_NEW_RADIO);
3273         if (!data)
3274                 goto out_err;
3275
3276         if (append_radio_msg(mcast_skb, id, param) < 0)
3277                 goto out_err;
3278
3279         genlmsg_end(mcast_skb, data);
3280
3281         hwsim_mcast_config_msg(mcast_skb, info);
3282         return;
3283
3284 out_err:
3285         nlmsg_free(mcast_skb);
3286 }
3287
3288 static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
3289         {
3290                 .types_mask = BIT(NL80211_IFTYPE_STATION),
3291                 .he_cap = {
3292                         .has_he = true,
3293                         .he_cap_elem = {
3294                                 .mac_cap_info[0] =
3295                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3296                                 .mac_cap_info[1] =
3297                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3298                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3299                                 .mac_cap_info[2] =
3300                                         IEEE80211_HE_MAC_CAP2_BSR |
3301                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3302                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3303                                 .mac_cap_info[3] =
3304                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3305                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3306                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3307                                 .phy_cap_info[1] =
3308                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3309                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3310                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3311                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3312                                 .phy_cap_info[2] =
3313                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3314                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3315                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3316                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3317                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3318
3319                                 /* Leave all the other PHY capability bytes
3320                                  * unset, as DCM, beam forming, RU and PPE
3321                                  * threshold information are not supported
3322                                  */
3323                         },
3324                         .he_mcs_nss_supp = {
3325                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3326                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3327                                 .rx_mcs_160 = cpu_to_le16(0xffff),
3328                                 .tx_mcs_160 = cpu_to_le16(0xffff),
3329                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
3330                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
3331                         },
3332                 },
3333                 .eht_cap = {
3334                         .has_eht = true,
3335                         .eht_cap_elem = {
3336                                 .mac_cap_info[0] =
3337                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3338                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3339                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3340                                 .phy_cap_info[0] =
3341                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3342                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3343                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3344                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3345                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
3346                                 .phy_cap_info[3] =
3347                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3348                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3349                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3350                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3351                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3352                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3353                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3354                                 .phy_cap_info[4] =
3355                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3356                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3357                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3358                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3359                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3360                                 .phy_cap_info[5] =
3361                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3362                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3363                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3364                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3365                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3366                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3367                                 .phy_cap_info[6] =
3368                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3369                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3370                                 .phy_cap_info[7] =
3371                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
3372                         },
3373
3374                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3375                          * Rx
3376                          */
3377                         .eht_mcs_nss_supp = {
3378                                 /*
3379                                  * Since B0, B1, B2 and B3 are not set in
3380                                  * the supported channel width set field in the
3381                                  * HE PHY capabilities information field the
3382                                  * device is a 20MHz only device on 2.4GHz band.
3383                                  */
3384                                 .only_20mhz = {
3385                                         .rx_tx_mcs7_max_nss = 0x88,
3386                                         .rx_tx_mcs9_max_nss = 0x88,
3387                                         .rx_tx_mcs11_max_nss = 0x88,
3388                                         .rx_tx_mcs13_max_nss = 0x88,
3389                                 },
3390                         },
3391                         /* PPE threshold information is not supported */
3392                 },
3393         },
3394         {
3395                 .types_mask = BIT(NL80211_IFTYPE_AP),
3396                 .he_cap = {
3397                         .has_he = true,
3398                         .he_cap_elem = {
3399                                 .mac_cap_info[0] =
3400                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3401                                 .mac_cap_info[1] =
3402                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3403                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3404                                 .mac_cap_info[2] =
3405                                         IEEE80211_HE_MAC_CAP2_BSR |
3406                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3407                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3408                                 .mac_cap_info[3] =
3409                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3410                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3411                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3412                                 .phy_cap_info[1] =
3413                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3414                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3415                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3416                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3417                                 .phy_cap_info[2] =
3418                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3419                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3420                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3421                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3422                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3423
3424                                 /* Leave all the other PHY capability bytes
3425                                  * unset, as DCM, beam forming, RU and PPE
3426                                  * threshold information are not supported
3427                                  */
3428                         },
3429                         .he_mcs_nss_supp = {
3430                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3431                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3432                                 .rx_mcs_160 = cpu_to_le16(0xffff),
3433                                 .tx_mcs_160 = cpu_to_le16(0xffff),
3434                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
3435                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
3436                         },
3437                 },
3438                 .eht_cap = {
3439                         .has_eht = true,
3440                         .eht_cap_elem = {
3441                                 .mac_cap_info[0] =
3442                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3443                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3444                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3445                                 .phy_cap_info[0] =
3446                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3447                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3448                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3449                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3450                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
3451                                 .phy_cap_info[3] =
3452                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3453                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3454                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3455                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3456                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3457                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3458                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3459                                 .phy_cap_info[4] =
3460                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3461                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3462                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3463                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3464                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3465                                 .phy_cap_info[5] =
3466                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3467                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3468                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3469                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3470                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3471                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3472                                 .phy_cap_info[6] =
3473                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3474                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3475                                 .phy_cap_info[7] =
3476                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
3477                         },
3478
3479                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3480                          * Rx
3481                          */
3482                         .eht_mcs_nss_supp = {
3483                                 /*
3484                                  * Since B0, B1, B2 and B3 are not set in
3485                                  * the supported channel width set field in the
3486                                  * HE PHY capabilities information field the
3487                                  * device is a 20MHz only device on 2.4GHz band.
3488                                  */
3489                                 .only_20mhz = {
3490                                         .rx_tx_mcs7_max_nss = 0x88,
3491                                         .rx_tx_mcs9_max_nss = 0x88,
3492                                         .rx_tx_mcs11_max_nss = 0x88,
3493                                         .rx_tx_mcs13_max_nss = 0x88,
3494                                 },
3495                         },
3496                         /* PPE threshold information is not supported */
3497                 },
3498         },
3499 #ifdef CONFIG_MAC80211_MESH
3500         {
3501                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
3502                 .he_cap = {
3503                         .has_he = true,
3504                         .he_cap_elem = {
3505                                 .mac_cap_info[0] =
3506                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3507                                 .mac_cap_info[1] =
3508                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3509                                 .mac_cap_info[2] =
3510                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3511                                 .mac_cap_info[3] =
3512                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3513                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3514                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3515                                 .phy_cap_info[1] =
3516                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3517                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3518                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3519                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3520                                 .phy_cap_info[2] = 0,
3521
3522                                 /* Leave all the other PHY capability bytes
3523                                  * unset, as DCM, beam forming, RU and PPE
3524                                  * threshold information are not supported
3525                                  */
3526                         },
3527                         .he_mcs_nss_supp = {
3528                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3529                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3530                                 .rx_mcs_160 = cpu_to_le16(0xffff),
3531                                 .tx_mcs_160 = cpu_to_le16(0xffff),
3532                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
3533                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
3534                         },
3535                 },
3536         },
3537 #endif
3538 };
3539
3540 static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
3541         {
3542                 /* TODO: should we support other types, e.g., P2P? */
3543                 .types_mask = BIT(NL80211_IFTYPE_STATION),
3544                 .he_cap = {
3545                         .has_he = true,
3546                         .he_cap_elem = {
3547                                 .mac_cap_info[0] =
3548                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3549                                 .mac_cap_info[1] =
3550                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3551                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3552                                 .mac_cap_info[2] =
3553                                         IEEE80211_HE_MAC_CAP2_BSR |
3554                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3555                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3556                                 .mac_cap_info[3] =
3557                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3558                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3559                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3560                                 .phy_cap_info[0] =
3561                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3562                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3563                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3564                                 .phy_cap_info[1] =
3565                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3566                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3567                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3568                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3569                                 .phy_cap_info[2] =
3570                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3571                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3572                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3573                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3574                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3575
3576                                 /* Leave all the other PHY capability bytes
3577                                  * unset, as DCM, beam forming, RU and PPE
3578                                  * threshold information are not supported
3579                                  */
3580                         },
3581                         .he_mcs_nss_supp = {
3582                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3583                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3584                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3585                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3586                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3587                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3588                         },
3589                 },
3590                 .eht_cap = {
3591                         .has_eht = true,
3592                         .eht_cap_elem = {
3593                                 .mac_cap_info[0] =
3594                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3595                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3596                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3597                                 .phy_cap_info[0] =
3598                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3599                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3600                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3601                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3602                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3603                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3604                                 .phy_cap_info[1] =
3605                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3606                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
3607                                 .phy_cap_info[2] =
3608                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3609                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
3610                                 .phy_cap_info[3] =
3611                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3612                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3613                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3614                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3615                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3616                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3617                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3618                                 .phy_cap_info[4] =
3619                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3620                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3621                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3622                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3623                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3624                                 .phy_cap_info[5] =
3625                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3626                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3627                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3628                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3629                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3630                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3631                                 .phy_cap_info[6] =
3632                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3633                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3634                                 .phy_cap_info[7] =
3635                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3636                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3637                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3638                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3639                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
3640                         },
3641
3642                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3643                          * Rx
3644                          */
3645                         .eht_mcs_nss_supp = {
3646                                 /*
3647                                  * As B1 and B2 are set in the supported
3648                                  * channel width set field in the HE PHY
3649                                  * capabilities information field include all
3650                                  * the following MCS/NSS.
3651                                  */
3652                                 .bw._80 = {
3653                                         .rx_tx_mcs9_max_nss = 0x88,
3654                                         .rx_tx_mcs11_max_nss = 0x88,
3655                                         .rx_tx_mcs13_max_nss = 0x88,
3656                                 },
3657                                 .bw._160 = {
3658                                         .rx_tx_mcs9_max_nss = 0x88,
3659                                         .rx_tx_mcs11_max_nss = 0x88,
3660                                         .rx_tx_mcs13_max_nss = 0x88,
3661                                 },
3662                         },
3663                         /* PPE threshold information is not supported */
3664                 },
3665         },
3666         {
3667                 .types_mask = BIT(NL80211_IFTYPE_AP),
3668                 .he_cap = {
3669                         .has_he = true,
3670                         .he_cap_elem = {
3671                                 .mac_cap_info[0] =
3672                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3673                                 .mac_cap_info[1] =
3674                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3675                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3676                                 .mac_cap_info[2] =
3677                                         IEEE80211_HE_MAC_CAP2_BSR |
3678                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3679                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3680                                 .mac_cap_info[3] =
3681                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3682                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3683                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3684                                 .phy_cap_info[0] =
3685                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3686                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3687                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3688                                 .phy_cap_info[1] =
3689                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3690                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3691                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3692                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3693                                 .phy_cap_info[2] =
3694                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3695                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3696                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3697                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3698                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3699
3700                                 /* Leave all the other PHY capability bytes
3701                                  * unset, as DCM, beam forming, RU and PPE
3702                                  * threshold information are not supported
3703                                  */
3704                         },
3705                         .he_mcs_nss_supp = {
3706                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3707                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3708                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3709                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3710                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3711                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3712                         },
3713                 },
3714                 .eht_cap = {
3715                         .has_eht = true,
3716                         .eht_cap_elem = {
3717                                 .mac_cap_info[0] =
3718                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3719                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3720                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3721                                 .phy_cap_info[0] =
3722                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3723                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3724                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3725                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3726                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3727                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3728                                 .phy_cap_info[1] =
3729                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3730                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
3731                                 .phy_cap_info[2] =
3732                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3733                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
3734                                 .phy_cap_info[3] =
3735                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3736                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3737                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3738                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3739                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3740                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3741                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3742                                 .phy_cap_info[4] =
3743                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3744                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3745                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3746                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3747                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3748                                 .phy_cap_info[5] =
3749                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3750                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3751                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3752                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3753                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3754                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3755                                 .phy_cap_info[6] =
3756                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3757                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3758                                 .phy_cap_info[7] =
3759                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3760                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3761                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3762                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3763                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
3764                         },
3765
3766                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3767                          * Rx
3768                          */
3769                         .eht_mcs_nss_supp = {
3770                                 /*
3771                                  * As B1 and B2 are set in the supported
3772                                  * channel width set field in the HE PHY
3773                                  * capabilities information field include all
3774                                  * the following MCS/NSS.
3775                                  */
3776                                 .bw._80 = {
3777                                         .rx_tx_mcs9_max_nss = 0x88,
3778                                         .rx_tx_mcs11_max_nss = 0x88,
3779                                         .rx_tx_mcs13_max_nss = 0x88,
3780                                 },
3781                                 .bw._160 = {
3782                                         .rx_tx_mcs9_max_nss = 0x88,
3783                                         .rx_tx_mcs11_max_nss = 0x88,
3784                                         .rx_tx_mcs13_max_nss = 0x88,
3785                                 },
3786                         },
3787                         /* PPE threshold information is not supported */
3788                 },
3789         },
3790 #ifdef CONFIG_MAC80211_MESH
3791         {
3792                 /* TODO: should we support other types, e.g., IBSS?*/
3793                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
3794                 .he_cap = {
3795                         .has_he = true,
3796                         .he_cap_elem = {
3797                                 .mac_cap_info[0] =
3798                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3799                                 .mac_cap_info[1] =
3800                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3801                                 .mac_cap_info[2] =
3802                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3803                                 .mac_cap_info[3] =
3804                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3805                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3806                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3807                                 .phy_cap_info[0] =
3808                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3809                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3810                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3811                                 .phy_cap_info[1] =
3812                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3813                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3814                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3815                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3816                                 .phy_cap_info[2] = 0,
3817
3818                                 /* Leave all the other PHY capability bytes
3819                                  * unset, as DCM, beam forming, RU and PPE
3820                                  * threshold information are not supported
3821                                  */
3822                         },
3823                         .he_mcs_nss_supp = {
3824                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3825                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3826                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3827                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3828                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3829                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3830                         },
3831                 },
3832         },
3833 #endif
3834 };
3835
3836 static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
3837         {
3838                 /* TODO: should we support other types, e.g., P2P? */
3839                 .types_mask = BIT(NL80211_IFTYPE_STATION),
3840                 .he_6ghz_capa = {
3841                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
3842                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
3843                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
3844                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
3845                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
3846                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
3847                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
3848                 },
3849                 .he_cap = {
3850                         .has_he = true,
3851                         .he_cap_elem = {
3852                                 .mac_cap_info[0] =
3853                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3854                                 .mac_cap_info[1] =
3855                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3856                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3857                                 .mac_cap_info[2] =
3858                                         IEEE80211_HE_MAC_CAP2_BSR |
3859                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3860                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3861                                 .mac_cap_info[3] =
3862                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3863                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3864                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3865                                 .phy_cap_info[0] =
3866                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3867                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3868                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3869                                 .phy_cap_info[1] =
3870                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3871                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3872                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3873                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3874                                 .phy_cap_info[2] =
3875                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3876                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3877                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3878                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3879                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3880
3881                                 /* Leave all the other PHY capability bytes
3882                                  * unset, as DCM, beam forming, RU and PPE
3883                                  * threshold information are not supported
3884                                  */
3885                         },
3886                         .he_mcs_nss_supp = {
3887                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3888                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3889                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3890                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3891                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3892                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3893                         },
3894                 },
3895                 .eht_cap = {
3896                         .has_eht = true,
3897                         .eht_cap_elem = {
3898                                 .mac_cap_info[0] =
3899                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3900                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3901                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3902                                 .phy_cap_info[0] =
3903                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
3904                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3905                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3906                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3907                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3908                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3909                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3910                                 .phy_cap_info[1] =
3911                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3912                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
3913                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
3914                                 .phy_cap_info[2] =
3915                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3916                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
3917                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
3918                                 .phy_cap_info[3] =
3919                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3920                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3921                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3922                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3923                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3924                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3925                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3926                                 .phy_cap_info[4] =
3927                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3928                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3929                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3930                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3931                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3932                                 .phy_cap_info[5] =
3933                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3934                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3935                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3936                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3937                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3938                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3939                                 .phy_cap_info[6] =
3940                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3941                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
3942                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
3943                                 .phy_cap_info[7] =
3944                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3945                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3946                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3947                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
3948                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3949                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
3950                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
3951                         },
3952
3953                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3954                          * Rx
3955                          */
3956                         .eht_mcs_nss_supp = {
3957                                 /*
3958                                  * As B1 and B2 are set in the supported
3959                                  * channel width set field in the HE PHY
3960                                  * capabilities information field and 320MHz in
3961                                  * 6GHz is supported include all the following
3962                                  * MCS/NSS.
3963                                  */
3964                                 .bw._80 = {
3965                                         .rx_tx_mcs9_max_nss = 0x88,
3966                                         .rx_tx_mcs11_max_nss = 0x88,
3967                                         .rx_tx_mcs13_max_nss = 0x88,
3968                                 },
3969                                 .bw._160 = {
3970                                         .rx_tx_mcs9_max_nss = 0x88,
3971                                         .rx_tx_mcs11_max_nss = 0x88,
3972                                         .rx_tx_mcs13_max_nss = 0x88,
3973                                 },
3974                                 .bw._320 = {
3975                                         .rx_tx_mcs9_max_nss = 0x88,
3976                                         .rx_tx_mcs11_max_nss = 0x88,
3977                                         .rx_tx_mcs13_max_nss = 0x88,
3978                                 },
3979                         },
3980                         /* PPE threshold information is not supported */
3981                 },
3982         },
3983         {
3984                 .types_mask = BIT(NL80211_IFTYPE_AP),
3985                 .he_6ghz_capa = {
3986                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
3987                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
3988                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
3989                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
3990                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
3991                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
3992                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
3993                 },
3994                 .he_cap = {
3995                         .has_he = true,
3996                         .he_cap_elem = {
3997                                 .mac_cap_info[0] =
3998                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3999                                 .mac_cap_info[1] =
4000                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4001                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4002                                 .mac_cap_info[2] =
4003                                         IEEE80211_HE_MAC_CAP2_BSR |
4004                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4005                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4006                                 .mac_cap_info[3] =
4007                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4008                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4009                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4010                                 .phy_cap_info[0] =
4011                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4012                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4013                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4014                                 .phy_cap_info[1] =
4015                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4016                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4017                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4018                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4019                                 .phy_cap_info[2] =
4020                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4021                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4022                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4023                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4024                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4025
4026                                 /* Leave all the other PHY capability bytes
4027                                  * unset, as DCM, beam forming, RU and PPE
4028                                  * threshold information are not supported
4029                                  */
4030                         },
4031                         .he_mcs_nss_supp = {
4032                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4033                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4034                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4035                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4036                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4037                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4038                         },
4039                 },
4040                 .eht_cap = {
4041                         .has_eht = true,
4042                         .eht_cap_elem = {
4043                                 .mac_cap_info[0] =
4044                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4045                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4046                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4047                                 .phy_cap_info[0] =
4048                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4049                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4050                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4051                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4052                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4053                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4054                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4055                                 .phy_cap_info[1] =
4056                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4057                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4058                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4059                                 .phy_cap_info[2] =
4060                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4061                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4062                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4063                                 .phy_cap_info[3] =
4064                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4065                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4066                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4067                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4068                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4069                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4070                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4071                                 .phy_cap_info[4] =
4072                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4073                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4074                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4075                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4076                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4077                                 .phy_cap_info[5] =
4078                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4079                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4080                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4081                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4082                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4083                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4084                                 .phy_cap_info[6] =
4085                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4086                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4087                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4088                                 .phy_cap_info[7] =
4089                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4090                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4091                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4092                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4093                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4094                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4095                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4096                         },
4097
4098                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4099                          * Rx
4100                          */
4101                         .eht_mcs_nss_supp = {
4102                                 /*
4103                                  * As B1 and B2 are set in the supported
4104                                  * channel width set field in the HE PHY
4105                                  * capabilities information field and 320MHz in
4106                                  * 6GHz is supported include all the following
4107                                  * MCS/NSS.
4108                                  */
4109                                 .bw._80 = {
4110                                         .rx_tx_mcs9_max_nss = 0x88,
4111                                         .rx_tx_mcs11_max_nss = 0x88,
4112                                         .rx_tx_mcs13_max_nss = 0x88,
4113                                 },
4114                                 .bw._160 = {
4115                                         .rx_tx_mcs9_max_nss = 0x88,
4116                                         .rx_tx_mcs11_max_nss = 0x88,
4117                                         .rx_tx_mcs13_max_nss = 0x88,
4118                                 },
4119                                 .bw._320 = {
4120                                         .rx_tx_mcs9_max_nss = 0x88,
4121                                         .rx_tx_mcs11_max_nss = 0x88,
4122                                         .rx_tx_mcs13_max_nss = 0x88,
4123                                 },
4124                         },
4125                         /* PPE threshold information is not supported */
4126                 },
4127         },
4128 #ifdef CONFIG_MAC80211_MESH
4129         {
4130                 /* TODO: should we support other types, e.g., IBSS?*/
4131                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4132                 .he_6ghz_capa = {
4133                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4134                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4135                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4136                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4137                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4138                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4139                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4140                 },
4141                 .he_cap = {
4142                         .has_he = true,
4143                         .he_cap_elem = {
4144                                 .mac_cap_info[0] =
4145                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4146                                 .mac_cap_info[1] =
4147                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4148                                 .mac_cap_info[2] =
4149                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4150                                 .mac_cap_info[3] =
4151                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4152                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4153                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4154                                 .phy_cap_info[0] =
4155                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4156                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4157                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4158                                 .phy_cap_info[1] =
4159                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4160                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4161                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4162                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4163                                 .phy_cap_info[2] = 0,
4164
4165                                 /* Leave all the other PHY capability bytes
4166                                  * unset, as DCM, beam forming, RU and PPE
4167                                  * threshold information are not supported
4168                                  */
4169                         },
4170                         .he_mcs_nss_supp = {
4171                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4172                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4173                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4174                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4175                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4176                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4177                         },
4178                 },
4179         },
4180 #endif
4181 };
4182
4183 static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
4184 {
4185         u16 n_iftype_data;
4186
4187         if (sband->band == NL80211_BAND_2GHZ) {
4188                 n_iftype_data = ARRAY_SIZE(sband_capa_2ghz);
4189                 sband->iftype_data =
4190                         (struct ieee80211_sband_iftype_data *)sband_capa_2ghz;
4191         } else if (sband->band == NL80211_BAND_5GHZ) {
4192                 n_iftype_data = ARRAY_SIZE(sband_capa_5ghz);
4193                 sband->iftype_data =
4194                         (struct ieee80211_sband_iftype_data *)sband_capa_5ghz;
4195         } else if (sband->band == NL80211_BAND_6GHZ) {
4196                 n_iftype_data = ARRAY_SIZE(sband_capa_6ghz);
4197                 sband->iftype_data =
4198                         (struct ieee80211_sband_iftype_data *)sband_capa_6ghz;
4199         } else {
4200                 return;
4201         }
4202
4203         sband->n_iftype_data = n_iftype_data;
4204 }
4205
4206 #ifdef CONFIG_MAC80211_MESH
4207 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
4208 #else
4209 #define HWSIM_MESH_BIT 0
4210 #endif
4211
4212 #define HWSIM_DEFAULT_IF_LIMIT \
4213         (BIT(NL80211_IFTYPE_STATION) | \
4214          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4215          BIT(NL80211_IFTYPE_AP) | \
4216          BIT(NL80211_IFTYPE_P2P_GO) | \
4217          HWSIM_MESH_BIT)
4218
4219 #define HWSIM_IFTYPE_SUPPORT_MASK \
4220         (BIT(NL80211_IFTYPE_STATION) | \
4221          BIT(NL80211_IFTYPE_AP) | \
4222          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4223          BIT(NL80211_IFTYPE_P2P_GO) | \
4224          BIT(NL80211_IFTYPE_ADHOC) | \
4225          BIT(NL80211_IFTYPE_MESH_POINT) | \
4226          BIT(NL80211_IFTYPE_OCB))
4227
4228 static int mac80211_hwsim_new_radio(struct genl_info *info,
4229                                     struct hwsim_new_radio_params *param)
4230 {
4231         int err;
4232         u8 addr[ETH_ALEN];
4233         struct mac80211_hwsim_data *data;
4234         struct ieee80211_hw *hw;
4235         enum nl80211_band band;
4236         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
4237         struct net *net;
4238         int idx, i;
4239         int n_limits = 0;
4240
4241         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
4242                 return -EINVAL;
4243
4244         spin_lock_bh(&hwsim_radio_lock);
4245         idx = hwsim_radio_idx++;
4246         spin_unlock_bh(&hwsim_radio_lock);
4247
4248         if (param->mlo)
4249                 ops = &mac80211_hwsim_mlo_ops;
4250         else if (param->use_chanctx)
4251                 ops = &mac80211_hwsim_mchan_ops;
4252         hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
4253         if (!hw) {
4254                 pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
4255                 err = -ENOMEM;
4256                 goto failed;
4257         }
4258
4259         /* ieee80211_alloc_hw_nm may have used a default name */
4260         param->hwname = wiphy_name(hw->wiphy);
4261
4262         if (info)
4263                 net = genl_info_net(info);
4264         else
4265                 net = &init_net;
4266         wiphy_net_set(hw->wiphy, net);
4267
4268         data = hw->priv;
4269         data->hw = hw;
4270
4271         data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
4272         if (IS_ERR(data->dev)) {
4273                 printk(KERN_DEBUG
4274                        "mac80211_hwsim: device_create failed (%ld)\n",
4275                        PTR_ERR(data->dev));
4276                 err = -ENOMEM;
4277                 goto failed_drvdata;
4278         }
4279         data->dev->driver = &mac80211_hwsim_driver.driver;
4280         err = device_bind_driver(data->dev);
4281         if (err != 0) {
4282                 pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
4283                        err);
4284                 goto failed_bind;
4285         }
4286
4287         skb_queue_head_init(&data->pending);
4288
4289         SET_IEEE80211_DEV(hw, data->dev);
4290         if (!param->perm_addr) {
4291                 eth_zero_addr(addr);
4292                 addr[0] = 0x02;
4293                 addr[3] = idx >> 8;
4294                 addr[4] = idx;
4295                 memcpy(data->addresses[0].addr, addr, ETH_ALEN);
4296                 /* Why need here second address ? */
4297                 memcpy(data->addresses[1].addr, addr, ETH_ALEN);
4298                 data->addresses[1].addr[0] |= 0x40;
4299                 hw->wiphy->n_addresses = 2;
4300                 hw->wiphy->addresses = data->addresses;
4301                 /* possible address clash is checked at hash table insertion */
4302         } else {
4303                 memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
4304                 /* compatibility with automatically generated mac addr */
4305                 memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
4306                 hw->wiphy->n_addresses = 2;
4307                 hw->wiphy->addresses = data->addresses;
4308         }
4309
4310         data->channels = param->channels;
4311         data->use_chanctx = param->use_chanctx;
4312         data->idx = idx;
4313         data->destroy_on_close = param->destroy_on_close;
4314         if (info)
4315                 data->portid = info->snd_portid;
4316
4317         /* setup interface limits, only on interface types we support */
4318         if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
4319                 data->if_limits[n_limits].max = 1;
4320                 data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
4321                 n_limits++;
4322         }
4323
4324         if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
4325                 data->if_limits[n_limits].max = 2048;
4326                 /*
4327                  * For this case, we may only support a subset of
4328                  * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
4329                  * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
4330                  */
4331                 data->if_limits[n_limits].types =
4332                                         HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
4333                 n_limits++;
4334         }
4335
4336         if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
4337                 data->if_limits[n_limits].max = 1;
4338                 data->if_limits[n_limits].types =
4339                                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
4340                 n_limits++;
4341         }
4342
4343         if (data->use_chanctx) {
4344                 hw->wiphy->max_scan_ssids = 255;
4345                 hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
4346                 hw->wiphy->max_remain_on_channel_duration = 1000;
4347                 data->if_combination.radar_detect_widths = 0;
4348                 data->if_combination.num_different_channels = data->channels;
4349         } else {
4350                 data->if_combination.num_different_channels = 1;
4351                 data->if_combination.radar_detect_widths =
4352                                         BIT(NL80211_CHAN_WIDTH_5) |
4353                                         BIT(NL80211_CHAN_WIDTH_10) |
4354                                         BIT(NL80211_CHAN_WIDTH_20_NOHT) |
4355                                         BIT(NL80211_CHAN_WIDTH_20) |
4356                                         BIT(NL80211_CHAN_WIDTH_40) |
4357                                         BIT(NL80211_CHAN_WIDTH_80) |
4358                                         BIT(NL80211_CHAN_WIDTH_160);
4359         }
4360
4361         if (!n_limits) {
4362                 err = -EINVAL;
4363                 goto failed_hw;
4364         }
4365
4366         data->if_combination.max_interfaces = 0;
4367         for (i = 0; i < n_limits; i++)
4368                 data->if_combination.max_interfaces +=
4369                         data->if_limits[i].max;
4370
4371         data->if_combination.n_limits = n_limits;
4372         data->if_combination.limits = data->if_limits;
4373
4374         /*
4375          * If we actually were asked to support combinations,
4376          * advertise them - if there's only a single thing like
4377          * only IBSS then don't advertise it as combinations.
4378          */
4379         if (data->if_combination.max_interfaces > 1) {
4380                 hw->wiphy->iface_combinations = &data->if_combination;
4381                 hw->wiphy->n_iface_combinations = 1;
4382         }
4383
4384         if (param->ciphers) {
4385                 memcpy(data->ciphers, param->ciphers,
4386                        param->n_ciphers * sizeof(u32));
4387                 hw->wiphy->cipher_suites = data->ciphers;
4388                 hw->wiphy->n_cipher_suites = param->n_ciphers;
4389         }
4390
4391         data->rx_rssi = DEFAULT_RX_RSSI;
4392
4393         INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
4394         INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
4395         INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
4396
4397         hw->queues = 5;
4398         hw->offchannel_tx_hw_queue = 4;
4399
4400         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
4401         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
4402         ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
4403         ieee80211_hw_set(hw, QUEUE_CONTROL);
4404         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
4405         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
4406         ieee80211_hw_set(hw, MFP_CAPABLE);
4407         ieee80211_hw_set(hw, SIGNAL_DBM);
4408         ieee80211_hw_set(hw, SUPPORTS_PS);
4409         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
4410         ieee80211_hw_set(hw, TDLS_WIDER_BW);
4411         ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
4412
4413         if (param->mlo) {
4414                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
4415                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
4416                 ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
4417                 ieee80211_hw_set(hw, CONNECTION_MONITOR);
4418                 ieee80211_hw_set(hw, AP_LINK_PS);
4419         } else {
4420                 ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
4421                 ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
4422                 if (rctbl)
4423                         ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
4424         }
4425
4426         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
4427         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
4428                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
4429                             WIPHY_FLAG_AP_UAPSD |
4430                             WIPHY_FLAG_SUPPORTS_5_10_MHZ |
4431                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
4432         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
4433                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
4434                                NL80211_FEATURE_STATIC_SMPS |
4435                                NL80211_FEATURE_DYNAMIC_SMPS |
4436                                NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
4437         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
4438         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
4439         wiphy_ext_feature_set(hw->wiphy,
4440                               NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
4441         wiphy_ext_feature_set(hw->wiphy,
4442                               NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
4443
4444         hw->wiphy->interface_modes = param->iftypes;
4445
4446         /* ask mac80211 to reserve space for magic */
4447         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
4448         hw->sta_data_size = sizeof(struct hwsim_sta_priv);
4449         hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
4450
4451         memcpy(data->channels_2ghz, hwsim_channels_2ghz,
4452                 sizeof(hwsim_channels_2ghz));
4453         memcpy(data->channels_5ghz, hwsim_channels_5ghz,
4454                 sizeof(hwsim_channels_5ghz));
4455         memcpy(data->channels_6ghz, hwsim_channels_6ghz,
4456                 sizeof(hwsim_channels_6ghz));
4457         memcpy(data->channels_s1g, hwsim_channels_s1g,
4458                sizeof(hwsim_channels_s1g));
4459         memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
4460
4461         for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
4462                 struct ieee80211_supported_band *sband = &data->bands[band];
4463
4464                 sband->band = band;
4465
4466                 switch (band) {
4467                 case NL80211_BAND_2GHZ:
4468                         sband->channels = data->channels_2ghz;
4469                         sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
4470                         sband->bitrates = data->rates;
4471                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
4472                         break;
4473                 case NL80211_BAND_5GHZ:
4474                         sband->channels = data->channels_5ghz;
4475                         sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
4476                         sband->bitrates = data->rates + 4;
4477                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
4478
4479                         sband->vht_cap.vht_supported = true;
4480                         sband->vht_cap.cap =
4481                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
4482                                 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
4483                                 IEEE80211_VHT_CAP_RXLDPC |
4484                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
4485                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
4486                                 IEEE80211_VHT_CAP_TXSTBC |
4487                                 IEEE80211_VHT_CAP_RXSTBC_4 |
4488                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
4489                         sband->vht_cap.vht_mcs.rx_mcs_map =
4490                                 cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
4491                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
4492                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
4493                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
4494                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
4495                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
4496                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
4497                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
4498                         sband->vht_cap.vht_mcs.tx_mcs_map =
4499                                 sband->vht_cap.vht_mcs.rx_mcs_map;
4500                         break;
4501                 case NL80211_BAND_6GHZ:
4502                         sband->channels = data->channels_6ghz;
4503                         sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
4504                         sband->bitrates = data->rates + 4;
4505                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
4506                         break;
4507                 case NL80211_BAND_S1GHZ:
4508                         memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
4509                                sizeof(sband->s1g_cap));
4510                         sband->channels = data->channels_s1g;
4511                         sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
4512                         break;
4513                 default:
4514                         continue;
4515                 }
4516
4517                 if (band != NL80211_BAND_6GHZ){
4518                         sband->ht_cap.ht_supported = true;
4519                         sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
4520                                             IEEE80211_HT_CAP_GRN_FLD |
4521                                             IEEE80211_HT_CAP_SGI_20 |
4522                                             IEEE80211_HT_CAP_SGI_40 |
4523                                             IEEE80211_HT_CAP_DSSSCCK40;
4524                         sband->ht_cap.ampdu_factor = 0x3;
4525                         sband->ht_cap.ampdu_density = 0x6;
4526                         memset(&sband->ht_cap.mcs, 0,
4527                                sizeof(sband->ht_cap.mcs));
4528                         sband->ht_cap.mcs.rx_mask[0] = 0xff;
4529                         sband->ht_cap.mcs.rx_mask[1] = 0xff;
4530                         sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
4531                 }
4532
4533                 mac80211_hwsim_sband_capab(sband);
4534
4535                 hw->wiphy->bands[band] = sband;
4536         }
4537
4538         /* By default all radios belong to the first group */
4539         data->group = 1;
4540         mutex_init(&data->mutex);
4541
4542         data->netgroup = hwsim_net_get_netgroup(net);
4543         data->wmediumd = hwsim_net_get_wmediumd(net);
4544
4545         /* Enable frame retransmissions for lossy channels */
4546         hw->max_rates = 4;
4547         hw->max_rate_tries = 11;
4548
4549         hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
4550         hw->wiphy->n_vendor_commands =
4551                 ARRAY_SIZE(mac80211_hwsim_vendor_commands);
4552         hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
4553         hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
4554
4555         if (param->reg_strict)
4556                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
4557         if (param->regd) {
4558                 data->regd = param->regd;
4559                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
4560                 wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
4561                 /* give the regulatory workqueue a chance to run */
4562                 schedule_timeout_interruptible(1);
4563         }
4564
4565         if (param->no_vif)
4566                 ieee80211_hw_set(hw, NO_AUTO_VIF);
4567
4568         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
4569
4570         for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
4571                 hrtimer_init(&data->link_data[i].beacon_timer, CLOCK_MONOTONIC,
4572                              HRTIMER_MODE_ABS_SOFT);
4573                 data->link_data[i].beacon_timer.function =
4574                         mac80211_hwsim_beacon;
4575                 data->link_data[i].link_id = i;
4576         }
4577
4578         err = ieee80211_register_hw(hw);
4579         if (err < 0) {
4580                 pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
4581                        err);
4582                 goto failed_hw;
4583         }
4584
4585         wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
4586
4587         if (param->reg_alpha2) {
4588                 data->alpha2[0] = param->reg_alpha2[0];
4589                 data->alpha2[1] = param->reg_alpha2[1];
4590                 regulatory_hint(hw->wiphy, param->reg_alpha2);
4591         }
4592
4593         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
4594         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
4595         debugfs_create_file("group", 0666, data->debugfs, data,
4596                             &hwsim_fops_group);
4597         debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
4598                             &hwsim_fops_rx_rssi);
4599         if (!data->use_chanctx)
4600                 debugfs_create_file("dfs_simulate_radar", 0222,
4601                                     data->debugfs,
4602                                     data, &hwsim_simulate_radar);
4603
4604         spin_lock_bh(&hwsim_radio_lock);
4605         err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
4606                                      hwsim_rht_params);
4607         if (err < 0) {
4608                 if (info) {
4609                         GENL_SET_ERR_MSG(info, "perm addr already present");
4610                         NL_SET_BAD_ATTR(info->extack,
4611                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
4612                 }
4613                 spin_unlock_bh(&hwsim_radio_lock);
4614                 goto failed_final_insert;
4615         }
4616
4617         list_add_tail(&data->list, &hwsim_radios);
4618         hwsim_radios_generation++;
4619         spin_unlock_bh(&hwsim_radio_lock);
4620
4621         hwsim_mcast_new_radio(idx, info, param);
4622
4623         return idx;
4624
4625 failed_final_insert:
4626         debugfs_remove_recursive(data->debugfs);
4627         ieee80211_unregister_hw(data->hw);
4628 failed_hw:
4629         device_release_driver(data->dev);
4630 failed_bind:
4631         device_unregister(data->dev);
4632 failed_drvdata:
4633         ieee80211_free_hw(hw);
4634 failed:
4635         return err;
4636 }
4637
4638 static void hwsim_mcast_del_radio(int id, const char *hwname,
4639                                   struct genl_info *info)
4640 {
4641         struct sk_buff *skb;
4642         void *data;
4643         int ret;
4644
4645         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4646         if (!skb)
4647                 return;
4648
4649         data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
4650                            HWSIM_CMD_DEL_RADIO);
4651         if (!data)
4652                 goto error;
4653
4654         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
4655         if (ret < 0)
4656                 goto error;
4657
4658         ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
4659                       hwname);
4660         if (ret < 0)
4661                 goto error;
4662
4663         genlmsg_end(skb, data);
4664
4665         hwsim_mcast_config_msg(skb, info);
4666
4667         return;
4668
4669 error:
4670         nlmsg_free(skb);
4671 }
4672
4673 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
4674                                      const char *hwname,
4675                                      struct genl_info *info)
4676 {
4677         hwsim_mcast_del_radio(data->idx, hwname, info);
4678         debugfs_remove_recursive(data->debugfs);
4679         ieee80211_unregister_hw(data->hw);
4680         device_release_driver(data->dev);
4681         device_unregister(data->dev);
4682         ieee80211_free_hw(data->hw);
4683 }
4684
4685 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
4686                                     struct mac80211_hwsim_data *data,
4687                                     u32 portid, u32 seq,
4688                                     struct netlink_callback *cb, int flags)
4689 {
4690         void *hdr;
4691         struct hwsim_new_radio_params param = { };
4692         int res = -EMSGSIZE;
4693
4694         hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
4695                           HWSIM_CMD_GET_RADIO);
4696         if (!hdr)
4697                 return -EMSGSIZE;
4698
4699         if (cb)
4700                 genl_dump_check_consistent(cb, hdr);
4701
4702         if (data->alpha2[0] && data->alpha2[1])
4703                 param.reg_alpha2 = data->alpha2;
4704
4705         param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
4706                                         REGULATORY_STRICT_REG);
4707         param.p2p_device = !!(data->hw->wiphy->interface_modes &
4708                                         BIT(NL80211_IFTYPE_P2P_DEVICE));
4709         param.use_chanctx = data->use_chanctx;
4710         param.regd = data->regd;
4711         param.channels = data->channels;
4712         param.hwname = wiphy_name(data->hw->wiphy);
4713
4714         res = append_radio_msg(skb, data->idx, &param);
4715         if (res < 0)
4716                 goto out_err;
4717
4718         genlmsg_end(skb, hdr);
4719         return 0;
4720
4721 out_err:
4722         genlmsg_cancel(skb, hdr);
4723         return res;
4724 }
4725
4726 static void mac80211_hwsim_free(void)
4727 {
4728         struct mac80211_hwsim_data *data;
4729
4730         spin_lock_bh(&hwsim_radio_lock);
4731         while ((data = list_first_entry_or_null(&hwsim_radios,
4732                                                 struct mac80211_hwsim_data,
4733                                                 list))) {
4734                 list_del(&data->list);
4735                 spin_unlock_bh(&hwsim_radio_lock);
4736                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
4737                                          NULL);
4738                 spin_lock_bh(&hwsim_radio_lock);
4739         }
4740         spin_unlock_bh(&hwsim_radio_lock);
4741         class_destroy(hwsim_class);
4742 }
4743
4744 static const struct net_device_ops hwsim_netdev_ops = {
4745         .ndo_start_xmit         = hwsim_mon_xmit,
4746         .ndo_set_mac_address    = eth_mac_addr,
4747         .ndo_validate_addr      = eth_validate_addr,
4748 };
4749
4750 static void hwsim_mon_setup(struct net_device *dev)
4751 {
4752         u8 addr[ETH_ALEN];
4753
4754         dev->netdev_ops = &hwsim_netdev_ops;
4755         dev->needs_free_netdev = true;
4756         ether_setup(dev);
4757         dev->priv_flags |= IFF_NO_QUEUE;
4758         dev->type = ARPHRD_IEEE80211_RADIOTAP;
4759         eth_zero_addr(addr);
4760         addr[0] = 0x12;
4761         eth_hw_addr_set(dev, addr);
4762 }
4763
4764 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
4765 {
4766         return rhashtable_lookup_fast(&hwsim_radios_rht,
4767                                       addr,
4768                                       hwsim_rht_params);
4769 }
4770
4771 static void hwsim_register_wmediumd(struct net *net, u32 portid)
4772 {
4773         struct mac80211_hwsim_data *data;
4774
4775         hwsim_net_set_wmediumd(net, portid);
4776
4777         spin_lock_bh(&hwsim_radio_lock);
4778         list_for_each_entry(data, &hwsim_radios, list) {
4779                 if (data->netgroup == hwsim_net_get_netgroup(net))
4780                         data->wmediumd = portid;
4781         }
4782         spin_unlock_bh(&hwsim_radio_lock);
4783 }
4784
4785 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
4786                                            struct genl_info *info)
4787 {
4788
4789         struct ieee80211_hdr *hdr;
4790         struct mac80211_hwsim_data *data2;
4791         struct ieee80211_tx_info *txi;
4792         struct hwsim_tx_rate *tx_attempts;
4793         u64 ret_skb_cookie;
4794         struct sk_buff *skb, *tmp;
4795         const u8 *src;
4796         unsigned int hwsim_flags;
4797         int i;
4798         unsigned long flags;
4799         bool found = false;
4800
4801         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
4802             !info->attrs[HWSIM_ATTR_FLAGS] ||
4803             !info->attrs[HWSIM_ATTR_COOKIE] ||
4804             !info->attrs[HWSIM_ATTR_SIGNAL] ||
4805             !info->attrs[HWSIM_ATTR_TX_INFO])
4806                 goto out;
4807
4808         src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
4809         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
4810         ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
4811
4812         data2 = get_hwsim_data_ref_from_addr(src);
4813         if (!data2)
4814                 goto out;
4815
4816         if (!hwsim_virtio_enabled) {
4817                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
4818                     data2->netgroup)
4819                         goto out;
4820
4821                 if (info->snd_portid != data2->wmediumd)
4822                         goto out;
4823         }
4824
4825         /* look for the skb matching the cookie passed back from user */
4826         spin_lock_irqsave(&data2->pending.lock, flags);
4827         skb_queue_walk_safe(&data2->pending, skb, tmp) {
4828                 uintptr_t skb_cookie;
4829
4830                 txi = IEEE80211_SKB_CB(skb);
4831                 skb_cookie = (uintptr_t)txi->rate_driver_data[0];
4832
4833                 if (skb_cookie == ret_skb_cookie) {
4834                         __skb_unlink(skb, &data2->pending);
4835                         found = true;
4836                         break;
4837                 }
4838         }
4839         spin_unlock_irqrestore(&data2->pending.lock, flags);
4840
4841         /* not found */
4842         if (!found)
4843                 goto out;
4844
4845         /* Tx info received because the frame was broadcasted on user space,
4846          so we get all the necessary info: tx attempts and skb control buff */
4847
4848         tx_attempts = (struct hwsim_tx_rate *)nla_data(
4849                        info->attrs[HWSIM_ATTR_TX_INFO]);
4850
4851         /* now send back TX status */
4852         txi = IEEE80211_SKB_CB(skb);
4853
4854         ieee80211_tx_info_clear_status(txi);
4855
4856         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
4857                 txi->status.rates[i].idx = tx_attempts[i].idx;
4858                 txi->status.rates[i].count = tx_attempts[i].count;
4859         }
4860
4861         txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
4862
4863         if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
4864            (hwsim_flags & HWSIM_TX_STAT_ACK)) {
4865                 if (skb->len >= 16) {
4866                         hdr = (struct ieee80211_hdr *) skb->data;
4867                         mac80211_hwsim_monitor_ack(data2->channel,
4868                                                    hdr->addr2);
4869                 }
4870                 txi->flags |= IEEE80211_TX_STAT_ACK;
4871         }
4872
4873         if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
4874                 txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
4875
4876         ieee80211_tx_status_irqsafe(data2->hw, skb);
4877         return 0;
4878 out:
4879         return -EINVAL;
4880
4881 }
4882
4883 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
4884                                           struct genl_info *info)
4885 {
4886         struct mac80211_hwsim_data *data2;
4887         struct ieee80211_rx_status rx_status;
4888         struct ieee80211_hdr *hdr;
4889         const u8 *dst;
4890         int frame_data_len;
4891         void *frame_data;
4892         struct sk_buff *skb = NULL;
4893         struct ieee80211_channel *channel = NULL;
4894
4895         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
4896             !info->attrs[HWSIM_ATTR_FRAME] ||
4897             !info->attrs[HWSIM_ATTR_RX_RATE] ||
4898             !info->attrs[HWSIM_ATTR_SIGNAL])
4899                 goto out;
4900
4901         dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
4902         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
4903         frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
4904
4905         /* Allocate new skb here */
4906         skb = alloc_skb(frame_data_len, GFP_KERNEL);
4907         if (skb == NULL)
4908                 goto err;
4909
4910         if (frame_data_len > IEEE80211_MAX_DATA_LEN)
4911                 goto err;
4912
4913         /* Copy the data */
4914         skb_put_data(skb, frame_data, frame_data_len);
4915
4916         data2 = get_hwsim_data_ref_from_addr(dst);
4917         if (!data2)
4918                 goto out;
4919
4920         if (data2->use_chanctx) {
4921                 if (data2->tmp_chan)
4922                         channel = data2->tmp_chan;
4923         } else {
4924                 channel = data2->channel;
4925         }
4926
4927         if (!hwsim_virtio_enabled) {
4928                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
4929                     data2->netgroup)
4930                         goto out;
4931
4932                 if (info->snd_portid != data2->wmediumd)
4933                         goto out;
4934         }
4935
4936         /* check if radio is configured properly */
4937
4938         if ((data2->idle && !data2->tmp_chan) || !data2->started)
4939                 goto out;
4940
4941         /* A frame is received from user space */
4942         memset(&rx_status, 0, sizeof(rx_status));
4943         if (info->attrs[HWSIM_ATTR_FREQ]) {
4944                 struct tx_iter_data iter_data = {};
4945
4946                 /* throw away off-channel packets, but allow both the temporary
4947                  * ("hw" scan/remain-on-channel), regular channels and links,
4948                  * since the internal datapath also allows this
4949                  */
4950                 rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
4951
4952                 iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
4953                                                           rx_status.freq);
4954                 if (!iter_data.channel)
4955                         goto out;
4956                 rx_status.band = iter_data.channel->band;
4957
4958                 mutex_lock(&data2->mutex);
4959                 if (!hwsim_chans_compat(iter_data.channel, channel)) {
4960                         ieee80211_iterate_active_interfaces_atomic(
4961                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
4962                                 mac80211_hwsim_tx_iter, &iter_data);
4963                         if (!iter_data.receive) {
4964                                 mutex_unlock(&data2->mutex);
4965                                 goto out;
4966                         }
4967                 }
4968                 mutex_unlock(&data2->mutex);
4969         } else if (!channel) {
4970                 goto out;
4971         } else {
4972                 rx_status.freq = channel->center_freq;
4973                 rx_status.band = channel->band;
4974         }
4975
4976         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
4977         if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
4978                 goto out;
4979         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
4980
4981         hdr = (void *)skb->data;
4982
4983         if (ieee80211_is_beacon(hdr->frame_control) ||
4984             ieee80211_is_probe_resp(hdr->frame_control))
4985                 rx_status.boottime_ns = ktime_get_boottime_ns();
4986
4987         mac80211_hwsim_rx(data2, &rx_status, skb);
4988
4989         return 0;
4990 err:
4991         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
4992 out:
4993         dev_kfree_skb(skb);
4994         return -EINVAL;
4995 }
4996
4997 static int hwsim_register_received_nl(struct sk_buff *skb_2,
4998                                       struct genl_info *info)
4999 {
5000         struct net *net = genl_info_net(info);
5001         struct mac80211_hwsim_data *data;
5002         int chans = 1;
5003
5004         spin_lock_bh(&hwsim_radio_lock);
5005         list_for_each_entry(data, &hwsim_radios, list)
5006                 chans = max(chans, data->channels);
5007         spin_unlock_bh(&hwsim_radio_lock);
5008
5009         /* In the future we should revise the userspace API and allow it
5010          * to set a flag that it does support multi-channel, then we can
5011          * let this pass conditionally on the flag.
5012          * For current userspace, prohibit it since it won't work right.
5013          */
5014         if (chans > 1)
5015                 return -EOPNOTSUPP;
5016
5017         if (hwsim_net_get_wmediumd(net))
5018                 return -EBUSY;
5019
5020         hwsim_register_wmediumd(net, info->snd_portid);
5021
5022         pr_debug("mac80211_hwsim: received a REGISTER, "
5023                "switching to wmediumd mode with pid %d\n", info->snd_portid);
5024
5025         return 0;
5026 }
5027
5028 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
5029 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
5030 {
5031         int i;
5032
5033         for (i = 0; i < n_ciphers; i++) {
5034                 int j;
5035                 int found = 0;
5036
5037                 for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
5038                         if (ciphers[i] == hwsim_ciphers[j]) {
5039                                 found = 1;
5040                                 break;
5041                         }
5042                 }
5043
5044                 if (!found)
5045                         return false;
5046         }
5047
5048         return true;
5049 }
5050
5051 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
5052 {
5053         struct hwsim_new_radio_params param = { 0 };
5054         const char *hwname = NULL;
5055         int ret;
5056
5057         param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
5058         param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
5059         param.channels = channels;
5060         param.destroy_on_close =
5061                 info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
5062
5063         if (info->attrs[HWSIM_ATTR_CHANNELS])
5064                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
5065
5066         if (param.channels < 1) {
5067                 GENL_SET_ERR_MSG(info, "must have at least one channel");
5068                 return -EINVAL;
5069         }
5070
5071         if (info->attrs[HWSIM_ATTR_NO_VIF])
5072                 param.no_vif = true;
5073
5074         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
5075                 param.use_chanctx = true;
5076         else
5077                 param.use_chanctx = (param.channels > 1);
5078
5079         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
5080                 param.reg_alpha2 =
5081                         nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
5082
5083         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
5084                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
5085
5086                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
5087                         return -EINVAL;
5088
5089                 idx = array_index_nospec(idx,
5090                                          ARRAY_SIZE(hwsim_world_regdom_custom));
5091                 param.regd = hwsim_world_regdom_custom[idx];
5092         }
5093
5094         if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
5095                 if (!is_valid_ether_addr(
5096                                 nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
5097                         GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
5098                         NL_SET_BAD_ATTR(info->extack,
5099                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
5100                         return -EINVAL;
5101                 }
5102
5103                 param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
5104         }
5105
5106         if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
5107                 param.iftypes =
5108                         nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
5109
5110                 if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
5111                         NL_SET_ERR_MSG_ATTR(info->extack,
5112                                             info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
5113                                             "cannot support more iftypes than kernel");
5114                         return -EINVAL;
5115                 }
5116         } else {
5117                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5118         }
5119
5120         /* ensure both flag and iftype support is honored */
5121         if (param.p2p_device ||
5122             param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5123                 param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5124                 param.p2p_device = true;
5125         }
5126
5127         if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
5128                 u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5129
5130                 param.ciphers =
5131                         nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5132
5133                 if (len % sizeof(u32)) {
5134                         NL_SET_ERR_MSG_ATTR(info->extack,
5135                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5136                                             "bad cipher list length");
5137                         return -EINVAL;
5138                 }
5139
5140                 param.n_ciphers = len / sizeof(u32);
5141
5142                 if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
5143                         NL_SET_ERR_MSG_ATTR(info->extack,
5144                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5145                                             "too many ciphers specified");
5146                         return -EINVAL;
5147                 }
5148
5149                 if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
5150                         NL_SET_ERR_MSG_ATTR(info->extack,
5151                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5152                                             "unsupported ciphers specified");
5153                         return -EINVAL;
5154                 }
5155         }
5156
5157         param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
5158
5159         if (param.mlo)
5160                 param.use_chanctx = true;
5161
5162         if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5163                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5164                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5165                                   GFP_KERNEL);
5166                 if (!hwname)
5167                         return -ENOMEM;
5168                 param.hwname = hwname;
5169         }
5170
5171         ret = mac80211_hwsim_new_radio(info, &param);
5172         kfree(hwname);
5173         return ret;
5174 }
5175
5176 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
5177 {
5178         struct mac80211_hwsim_data *data;
5179         s64 idx = -1;
5180         const char *hwname = NULL;
5181
5182         if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
5183                 idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
5184         } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5185                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5186                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5187                                   GFP_KERNEL);
5188                 if (!hwname)
5189                         return -ENOMEM;
5190         } else
5191                 return -EINVAL;
5192
5193         spin_lock_bh(&hwsim_radio_lock);
5194         list_for_each_entry(data, &hwsim_radios, list) {
5195                 if (idx >= 0) {
5196                         if (data->idx != idx)
5197                                 continue;
5198                 } else {
5199                         if (!hwname ||
5200                             strcmp(hwname, wiphy_name(data->hw->wiphy)))
5201                                 continue;
5202                 }
5203
5204                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
5205                         continue;
5206
5207                 list_del(&data->list);
5208                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
5209                                        hwsim_rht_params);
5210                 hwsim_radios_generation++;
5211                 spin_unlock_bh(&hwsim_radio_lock);
5212                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
5213                                          info);
5214                 kfree(hwname);
5215                 return 0;
5216         }
5217         spin_unlock_bh(&hwsim_radio_lock);
5218
5219         kfree(hwname);
5220         return -ENODEV;
5221 }
5222
5223 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
5224 {
5225         struct mac80211_hwsim_data *data;
5226         struct sk_buff *skb;
5227         int idx, res = -ENODEV;
5228
5229         if (!info->attrs[HWSIM_ATTR_RADIO_ID])
5230                 return -EINVAL;
5231         idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
5232
5233         spin_lock_bh(&hwsim_radio_lock);
5234         list_for_each_entry(data, &hwsim_radios, list) {
5235                 if (data->idx != idx)
5236                         continue;
5237
5238                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
5239                         continue;
5240
5241                 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5242                 if (!skb) {
5243                         res = -ENOMEM;
5244                         goto out_err;
5245                 }
5246
5247                 res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
5248                                                info->snd_seq, NULL, 0);
5249                 if (res < 0) {
5250                         nlmsg_free(skb);
5251                         goto out_err;
5252                 }
5253
5254                 res = genlmsg_reply(skb, info);
5255                 break;
5256         }
5257
5258 out_err:
5259         spin_unlock_bh(&hwsim_radio_lock);
5260
5261         return res;
5262 }
5263
5264 static int hwsim_dump_radio_nl(struct sk_buff *skb,
5265                                struct netlink_callback *cb)
5266 {
5267         int last_idx = cb->args[0] - 1;
5268         struct mac80211_hwsim_data *data = NULL;
5269         int res = 0;
5270         void *hdr;
5271
5272         spin_lock_bh(&hwsim_radio_lock);
5273         cb->seq = hwsim_radios_generation;
5274
5275         if (last_idx >= hwsim_radio_idx-1)
5276                 goto done;
5277
5278         list_for_each_entry(data, &hwsim_radios, list) {
5279                 if (data->idx <= last_idx)
5280                         continue;
5281
5282                 if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
5283                         continue;
5284
5285                 res = mac80211_hwsim_get_radio(skb, data,
5286                                                NETLINK_CB(cb->skb).portid,
5287                                                cb->nlh->nlmsg_seq, cb,
5288                                                NLM_F_MULTI);
5289                 if (res < 0)
5290                         break;
5291
5292                 last_idx = data->idx;
5293         }
5294
5295         cb->args[0] = last_idx + 1;
5296
5297         /* list changed, but no new element sent, set interrupted flag */
5298         if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
5299                 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
5300                                   cb->nlh->nlmsg_seq, &hwsim_genl_family,
5301                                   NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
5302                 if (hdr) {
5303                         genl_dump_check_consistent(cb, hdr);
5304                         genlmsg_end(skb, hdr);
5305                 } else {
5306                         res = -EMSGSIZE;
5307                 }
5308         }
5309
5310 done:
5311         spin_unlock_bh(&hwsim_radio_lock);
5312         return res ?: skb->len;
5313 }
5314
5315 /* Generic Netlink operations array */
5316 static const struct genl_small_ops hwsim_ops[] = {
5317         {
5318                 .cmd = HWSIM_CMD_REGISTER,
5319                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5320                 .doit = hwsim_register_received_nl,
5321                 .flags = GENL_UNS_ADMIN_PERM,
5322         },
5323         {
5324                 .cmd = HWSIM_CMD_FRAME,
5325                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5326                 .doit = hwsim_cloned_frame_received_nl,
5327         },
5328         {
5329                 .cmd = HWSIM_CMD_TX_INFO_FRAME,
5330                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5331                 .doit = hwsim_tx_info_frame_received_nl,
5332         },
5333         {
5334                 .cmd = HWSIM_CMD_NEW_RADIO,
5335                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5336                 .doit = hwsim_new_radio_nl,
5337                 .flags = GENL_UNS_ADMIN_PERM,
5338         },
5339         {
5340                 .cmd = HWSIM_CMD_DEL_RADIO,
5341                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5342                 .doit = hwsim_del_radio_nl,
5343                 .flags = GENL_UNS_ADMIN_PERM,
5344         },
5345         {
5346                 .cmd = HWSIM_CMD_GET_RADIO,
5347                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5348                 .doit = hwsim_get_radio_nl,
5349                 .dumpit = hwsim_dump_radio_nl,
5350         },
5351 };
5352
5353 static struct genl_family hwsim_genl_family __ro_after_init = {
5354         .name = "MAC80211_HWSIM",
5355         .version = 1,
5356         .maxattr = HWSIM_ATTR_MAX,
5357         .policy = hwsim_genl_policy,
5358         .netnsok = true,
5359         .module = THIS_MODULE,
5360         .small_ops = hwsim_ops,
5361         .n_small_ops = ARRAY_SIZE(hwsim_ops),
5362         .resv_start_op = HWSIM_CMD_DEL_MAC_ADDR + 1,
5363         .mcgrps = hwsim_mcgrps,
5364         .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
5365 };
5366
5367 static void remove_user_radios(u32 portid)
5368 {
5369         struct mac80211_hwsim_data *entry, *tmp;
5370         LIST_HEAD(list);
5371
5372         spin_lock_bh(&hwsim_radio_lock);
5373         list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
5374                 if (entry->destroy_on_close && entry->portid == portid) {
5375                         list_move(&entry->list, &list);
5376                         rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
5377                                                hwsim_rht_params);
5378                         hwsim_radios_generation++;
5379                 }
5380         }
5381         spin_unlock_bh(&hwsim_radio_lock);
5382
5383         list_for_each_entry_safe(entry, tmp, &list, list) {
5384                 list_del(&entry->list);
5385                 mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
5386                                          NULL);
5387         }
5388 }
5389
5390 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
5391                                          unsigned long state,
5392                                          void *_notify)
5393 {
5394         struct netlink_notify *notify = _notify;
5395
5396         if (state != NETLINK_URELEASE)
5397                 return NOTIFY_DONE;
5398
5399         remove_user_radios(notify->portid);
5400
5401         if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
5402                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
5403                        " socket, switching to perfect channel medium\n");
5404                 hwsim_register_wmediumd(notify->net, 0);
5405         }
5406         return NOTIFY_DONE;
5407
5408 }
5409
5410 static struct notifier_block hwsim_netlink_notifier = {
5411         .notifier_call = mac80211_hwsim_netlink_notify,
5412 };
5413
5414 static int __init hwsim_init_netlink(void)
5415 {
5416         int rc;
5417
5418         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
5419
5420         rc = genl_register_family(&hwsim_genl_family);
5421         if (rc)
5422                 goto failure;
5423
5424         rc = netlink_register_notifier(&hwsim_netlink_notifier);
5425         if (rc) {
5426                 genl_unregister_family(&hwsim_genl_family);
5427                 goto failure;
5428         }
5429
5430         return 0;
5431
5432 failure:
5433         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
5434         return -EINVAL;
5435 }
5436
5437 static __net_init int hwsim_init_net(struct net *net)
5438 {
5439         return hwsim_net_set_netgroup(net);
5440 }
5441
5442 static void __net_exit hwsim_exit_net(struct net *net)
5443 {
5444         struct mac80211_hwsim_data *data, *tmp;
5445         LIST_HEAD(list);
5446
5447         spin_lock_bh(&hwsim_radio_lock);
5448         list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
5449                 if (!net_eq(wiphy_net(data->hw->wiphy), net))
5450                         continue;
5451
5452                 /* Radios created in init_net are returned to init_net. */
5453                 if (data->netgroup == hwsim_net_get_netgroup(&init_net))
5454                         continue;
5455
5456                 list_move(&data->list, &list);
5457                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
5458                                        hwsim_rht_params);
5459                 hwsim_radios_generation++;
5460         }
5461         spin_unlock_bh(&hwsim_radio_lock);
5462
5463         list_for_each_entry_safe(data, tmp, &list, list) {
5464                 list_del(&data->list);
5465                 mac80211_hwsim_del_radio(data,
5466                                          wiphy_name(data->hw->wiphy),
5467                                          NULL);
5468         }
5469
5470         ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
5471 }
5472
5473 static struct pernet_operations hwsim_net_ops = {
5474         .init = hwsim_init_net,
5475         .exit = hwsim_exit_net,
5476         .id   = &hwsim_net_id,
5477         .size = sizeof(struct hwsim_net),
5478 };
5479
5480 static void hwsim_exit_netlink(void)
5481 {
5482         /* unregister the notifier */
5483         netlink_unregister_notifier(&hwsim_netlink_notifier);
5484         /* unregister the family */
5485         genl_unregister_family(&hwsim_genl_family);
5486 }
5487
5488 #if IS_REACHABLE(CONFIG_VIRTIO)
5489 static void hwsim_virtio_tx_done(struct virtqueue *vq)
5490 {
5491         unsigned int len;
5492         struct sk_buff *skb;
5493         unsigned long flags;
5494
5495         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5496         while ((skb = virtqueue_get_buf(vq, &len)))
5497                 nlmsg_free(skb);
5498         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5499 }
5500
5501 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
5502 {
5503         struct nlmsghdr *nlh;
5504         struct genlmsghdr *gnlh;
5505         struct nlattr *tb[HWSIM_ATTR_MAX + 1];
5506         struct genl_info info = {};
5507         int err;
5508
5509         nlh = nlmsg_hdr(skb);
5510         gnlh = nlmsg_data(nlh);
5511
5512         if (skb->len < nlh->nlmsg_len)
5513                 return -EINVAL;
5514
5515         err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
5516                             hwsim_genl_policy, NULL);
5517         if (err) {
5518                 pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
5519                 return err;
5520         }
5521
5522         info.attrs = tb;
5523
5524         switch (gnlh->cmd) {
5525         case HWSIM_CMD_FRAME:
5526                 hwsim_cloned_frame_received_nl(skb, &info);
5527                 break;
5528         case HWSIM_CMD_TX_INFO_FRAME:
5529                 hwsim_tx_info_frame_received_nl(skb, &info);
5530                 break;
5531         default:
5532                 pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
5533                 return -EPROTO;
5534         }
5535         return 0;
5536 }
5537
5538 static void hwsim_virtio_rx_work(struct work_struct *work)
5539 {
5540         struct virtqueue *vq;
5541         unsigned int len;
5542         struct sk_buff *skb;
5543         struct scatterlist sg[1];
5544         int err;
5545         unsigned long flags;
5546
5547         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5548         if (!hwsim_virtio_enabled)
5549                 goto out_unlock;
5550
5551         skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
5552         if (!skb)
5553                 goto out_unlock;
5554         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5555
5556         skb->data = skb->head;
5557         skb_reset_tail_pointer(skb);
5558         skb_put(skb, len);
5559         hwsim_virtio_handle_cmd(skb);
5560
5561         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5562         if (!hwsim_virtio_enabled) {
5563                 nlmsg_free(skb);
5564                 goto out_unlock;
5565         }
5566         vq = hwsim_vqs[HWSIM_VQ_RX];
5567         sg_init_one(sg, skb->head, skb_end_offset(skb));
5568         err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
5569         if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
5570                 nlmsg_free(skb);
5571         else
5572                 virtqueue_kick(vq);
5573         schedule_work(&hwsim_virtio_rx);
5574
5575 out_unlock:
5576         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5577 }
5578
5579 static void hwsim_virtio_rx_done(struct virtqueue *vq)
5580 {
5581         schedule_work(&hwsim_virtio_rx);
5582 }
5583
5584 static int init_vqs(struct virtio_device *vdev)
5585 {
5586         vq_callback_t *callbacks[HWSIM_NUM_VQS] = {
5587                 [HWSIM_VQ_TX] = hwsim_virtio_tx_done,
5588                 [HWSIM_VQ_RX] = hwsim_virtio_rx_done,
5589         };
5590         const char *names[HWSIM_NUM_VQS] = {
5591                 [HWSIM_VQ_TX] = "tx",
5592                 [HWSIM_VQ_RX] = "rx",
5593         };
5594
5595         return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
5596                                hwsim_vqs, callbacks, names, NULL);
5597 }
5598
5599 static int fill_vq(struct virtqueue *vq)
5600 {
5601         int i, err;
5602         struct sk_buff *skb;
5603         struct scatterlist sg[1];
5604
5605         for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
5606                 skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
5607                 if (!skb)
5608                         return -ENOMEM;
5609
5610                 sg_init_one(sg, skb->head, skb_end_offset(skb));
5611                 err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
5612                 if (err) {
5613                         nlmsg_free(skb);
5614                         return err;
5615                 }
5616         }
5617         virtqueue_kick(vq);
5618         return 0;
5619 }
5620
5621 static void remove_vqs(struct virtio_device *vdev)
5622 {
5623         int i;
5624
5625         virtio_reset_device(vdev);
5626
5627         for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
5628                 struct virtqueue *vq = hwsim_vqs[i];
5629                 struct sk_buff *skb;
5630
5631                 while ((skb = virtqueue_detach_unused_buf(vq)))
5632                         nlmsg_free(skb);
5633         }
5634
5635         vdev->config->del_vqs(vdev);
5636 }
5637
5638 static int hwsim_virtio_probe(struct virtio_device *vdev)
5639 {
5640         int err;
5641         unsigned long flags;
5642
5643         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5644         if (hwsim_virtio_enabled) {
5645                 spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5646                 return -EEXIST;
5647         }
5648         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5649
5650         err = init_vqs(vdev);
5651         if (err)
5652                 return err;
5653
5654         virtio_device_ready(vdev);
5655
5656         err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
5657         if (err)
5658                 goto out_remove;
5659
5660         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5661         hwsim_virtio_enabled = true;
5662         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5663
5664         schedule_work(&hwsim_virtio_rx);
5665         return 0;
5666
5667 out_remove:
5668         remove_vqs(vdev);
5669         return err;
5670 }
5671
5672 static void hwsim_virtio_remove(struct virtio_device *vdev)
5673 {
5674         hwsim_virtio_enabled = false;
5675
5676         cancel_work_sync(&hwsim_virtio_rx);
5677
5678         remove_vqs(vdev);
5679 }
5680
5681 /* MAC80211_HWSIM virtio device id table */
5682 static const struct virtio_device_id id_table[] = {
5683         { VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
5684         { 0 }
5685 };
5686 MODULE_DEVICE_TABLE(virtio, id_table);
5687
5688 static struct virtio_driver virtio_hwsim = {
5689         .driver.name = KBUILD_MODNAME,
5690         .driver.owner = THIS_MODULE,
5691         .id_table = id_table,
5692         .probe = hwsim_virtio_probe,
5693         .remove = hwsim_virtio_remove,
5694 };
5695
5696 static int hwsim_register_virtio_driver(void)
5697 {
5698         return register_virtio_driver(&virtio_hwsim);
5699 }
5700
5701 static void hwsim_unregister_virtio_driver(void)
5702 {
5703         unregister_virtio_driver(&virtio_hwsim);
5704 }
5705 #else
5706 static inline int hwsim_register_virtio_driver(void)
5707 {
5708         return 0;
5709 }
5710
5711 static inline void hwsim_unregister_virtio_driver(void)
5712 {
5713 }
5714 #endif
5715
5716 static int __init init_mac80211_hwsim(void)
5717 {
5718         int i, err;
5719
5720         if (radios < 0 || radios > 100)
5721                 return -EINVAL;
5722
5723         if (channels < 1)
5724                 return -EINVAL;
5725
5726         err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
5727         if (err)
5728                 return err;
5729
5730         err = register_pernet_device(&hwsim_net_ops);
5731         if (err)
5732                 goto out_free_rht;
5733
5734         err = platform_driver_register(&mac80211_hwsim_driver);
5735         if (err)
5736                 goto out_unregister_pernet;
5737
5738         err = hwsim_init_netlink();
5739         if (err)
5740                 goto out_unregister_driver;
5741
5742         err = hwsim_register_virtio_driver();
5743         if (err)
5744                 goto out_exit_netlink;
5745
5746         hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
5747         if (IS_ERR(hwsim_class)) {
5748                 err = PTR_ERR(hwsim_class);
5749                 goto out_exit_virtio;
5750         }
5751
5752         hwsim_init_s1g_channels(hwsim_channels_s1g);
5753
5754         for (i = 0; i < radios; i++) {
5755                 struct hwsim_new_radio_params param = { 0 };
5756
5757                 param.channels = channels;
5758
5759                 switch (regtest) {
5760                 case HWSIM_REGTEST_DIFF_COUNTRY:
5761                         if (i < ARRAY_SIZE(hwsim_alpha2s))
5762                                 param.reg_alpha2 = hwsim_alpha2s[i];
5763                         break;
5764                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
5765                         if (!i)
5766                                 param.reg_alpha2 = hwsim_alpha2s[0];
5767                         break;
5768                 case HWSIM_REGTEST_STRICT_ALL:
5769                         param.reg_strict = true;
5770                         fallthrough;
5771                 case HWSIM_REGTEST_DRIVER_REG_ALL:
5772                         param.reg_alpha2 = hwsim_alpha2s[0];
5773                         break;
5774                 case HWSIM_REGTEST_WORLD_ROAM:
5775                         if (i == 0)
5776                                 param.regd = &hwsim_world_regdom_custom_01;
5777                         break;
5778                 case HWSIM_REGTEST_CUSTOM_WORLD:
5779                         param.regd = &hwsim_world_regdom_custom_01;
5780                         break;
5781                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
5782                         if (i == 0)
5783                                 param.regd = &hwsim_world_regdom_custom_01;
5784                         else if (i == 1)
5785                                 param.regd = &hwsim_world_regdom_custom_02;
5786                         break;
5787                 case HWSIM_REGTEST_STRICT_FOLLOW:
5788                         if (i == 0) {
5789                                 param.reg_strict = true;
5790                                 param.reg_alpha2 = hwsim_alpha2s[0];
5791                         }
5792                         break;
5793                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
5794                         if (i == 0) {
5795                                 param.reg_strict = true;
5796                                 param.reg_alpha2 = hwsim_alpha2s[0];
5797                         } else if (i == 1) {
5798                                 param.reg_alpha2 = hwsim_alpha2s[1];
5799                         }
5800                         break;
5801                 case HWSIM_REGTEST_ALL:
5802                         switch (i) {
5803                         case 0:
5804                                 param.regd = &hwsim_world_regdom_custom_01;
5805                                 break;
5806                         case 1:
5807                                 param.regd = &hwsim_world_regdom_custom_02;
5808                                 break;
5809                         case 2:
5810                                 param.reg_alpha2 = hwsim_alpha2s[0];
5811                                 break;
5812                         case 3:
5813                                 param.reg_alpha2 = hwsim_alpha2s[1];
5814                                 break;
5815                         case 4:
5816                                 param.reg_strict = true;
5817                                 param.reg_alpha2 = hwsim_alpha2s[2];
5818                                 break;
5819                         }
5820                         break;
5821                 default:
5822                         break;
5823                 }
5824
5825                 param.p2p_device = support_p2p_device;
5826                 param.mlo = mlo;
5827                 param.use_chanctx = channels > 1 || mlo;
5828                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5829                 if (param.p2p_device)
5830                         param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5831
5832                 err = mac80211_hwsim_new_radio(NULL, &param);
5833                 if (err < 0)
5834                         goto out_free_radios;
5835         }
5836
5837         hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
5838                                  hwsim_mon_setup);
5839         if (hwsim_mon == NULL) {
5840                 err = -ENOMEM;
5841                 goto out_free_radios;
5842         }
5843
5844         rtnl_lock();
5845         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
5846         if (err < 0) {
5847                 rtnl_unlock();
5848                 goto out_free_mon;
5849         }
5850
5851         err = register_netdevice(hwsim_mon);
5852         if (err < 0) {
5853                 rtnl_unlock();
5854                 goto out_free_mon;
5855         }
5856         rtnl_unlock();
5857
5858         return 0;
5859
5860 out_free_mon:
5861         free_netdev(hwsim_mon);
5862 out_free_radios:
5863         mac80211_hwsim_free();
5864 out_exit_virtio:
5865         hwsim_unregister_virtio_driver();
5866 out_exit_netlink:
5867         hwsim_exit_netlink();
5868 out_unregister_driver:
5869         platform_driver_unregister(&mac80211_hwsim_driver);
5870 out_unregister_pernet:
5871         unregister_pernet_device(&hwsim_net_ops);
5872 out_free_rht:
5873         rhashtable_destroy(&hwsim_radios_rht);
5874         return err;
5875 }
5876 module_init(init_mac80211_hwsim);
5877
5878 static void __exit exit_mac80211_hwsim(void)
5879 {
5880         pr_debug("mac80211_hwsim: unregister radios\n");
5881
5882         hwsim_unregister_virtio_driver();
5883         hwsim_exit_netlink();
5884
5885         mac80211_hwsim_free();
5886
5887         rhashtable_destroy(&hwsim_radios_rht);
5888         unregister_netdev(hwsim_mon);
5889         platform_driver_unregister(&mac80211_hwsim_driver);
5890         unregister_pernet_device(&hwsim_net_ops);
5891 }
5892 module_exit(exit_mac80211_hwsim);