drivers/net/wireless/mac80211_hwsim.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
   4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
   6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
   7  * Copyright (C) 2018 - 2022 Intel Corporation
   8  */
   9
  10 /*
  11  * TODO:
  12  * - Add TSF sync and fix IBSS beacon transmission by adding
  13  *   competition for "air time" at TBTT
  14  * - RX filtering based on filter configuration (data->rx_filter)
  15  */
  16
  17 #include <linux/list.h>
  18 #include <linux/slab.h>
  19 #include <linux/spinlock.h>
  20 #include <net/dst.h>
  21 #include <net/xfrm.h>
  22 #include <net/mac80211.h>
  23 #include <net/ieee80211_radiotap.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/rtnetlink.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/platform_device.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/module.h>
  30 #include <linux/ktime.h>
  31 #include <net/genetlink.h>
  32 #include <net/net_namespace.h>
  33 #include <net/netns/generic.h>
  34 #include <linux/rhashtable.h>
  35 #include <linux/nospec.h>
  36 #include <linux/virtio.h>
  37 #include <linux/virtio_ids.h>
  38 #include <linux/virtio_config.h>
  39 #include "mac80211_hwsim.h"
  40
  41 #define WARN_QUEUE 100
  42 #define MAX_QUEUE 200
  43
  44 MODULE_AUTHOR("Jouni Malinen");
  45 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
  46 MODULE_LICENSE("GPL");
  47
  48 static int radios = 2;
  49 module_param(radios, int, 0444);
  50 MODULE_PARM_DESC(radios, "Number of simulated radios");
  51
  52 static int channels = 1;
  53 module_param(channels, int, 0444);
  54 MODULE_PARM_DESC(channels, "Number of concurrent channels");
  55
  56 static bool paged_rx = false;
  57 module_param(paged_rx, bool, 0644);
  58 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
  59
  60 static bool rctbl = false;
  61 module_param(rctbl, bool, 0444);
  62 MODULE_PARM_DESC(rctbl, "Handle rate control table");
  63
  64 static bool support_p2p_device = true;
  65 module_param(support_p2p_device, bool, 0444);
  66 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
  67
  68 static bool mlo;
  69 module_param(mlo, bool, 0444);
  70 MODULE_PARM_DESC(mlo, "Support MLO");
  71
  72 /**
  73  * enum hwsim_regtest - the type of regulatory tests we offer
  74  *
  75  * These are the different values you can use for the regtest
  76  * module parameter. This is useful to help test world roaming
  77  * and the driver regulatory_hint() call and combinations of these.
  78  * If you want to do specific alpha2 regulatory domain tests simply
  79  * use the userspace regulatory request as that will be respected as
  80  * well without the need of this module parameter. This is designed
  81  * only for testing the driver regulatory request, world roaming
  82  * and all possible combinations.
  83  *
  84  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
  85  *      this is the default value.
  86  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
  87  *      hint, only one driver regulatory hint will be sent as such the
  88  *      secondary radios are expected to follow.
  89  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
  90  *      request with all radios reporting the same regulatory domain.
  91  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
  92  *      different regulatory domains requests. Expected behaviour is for
  93  *      an intersection to occur but each device will still use their
  94  *      respective regulatory requested domains. Subsequent radios will
  95  *      use the resulting intersection.
  96  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
  97  *      this by using a custom beacon-capable regulatory domain for the first
  98  *      radio. All other device world roam.
  99  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
 100  *      domain requests. All radios will adhere to this custom world regulatory
 101  *      domain.
 102  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
 103  *      domain requests. The first radio will adhere to the first custom world
 104  *      regulatory domain, the second one to the second custom world regulatory
 105  *      domain. All other devices will world roam.
 106  * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
 107  *      settings, only the first radio will send a regulatory domain request
 108  *      and use strict settings. The rest of the radios are expected to follow.
 109  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
 110  *      settings. All radios will adhere to this.
 111  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
 112  *      domain settings, combined with secondary driver regulatory domain
 113  *      settings. The first radio will get a strict regulatory domain setting
 114  *      using the first driver regulatory request and the second radio will use
 115  *      non-strict settings using the second driver regulatory request. All
 116  *      other devices should follow the intersection created between the
 117  *      first two.
 118  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
 119  *      at least 6 radios for a complete test. We will test in this order:
 120  *      1 - driver custom world regulatory domain
 121  *      2 - second custom world regulatory domain
 122  *      3 - first driver regulatory domain request
 123  *      4 - second driver regulatory domain request
 124  *      5 - strict regulatory domain settings using the third driver regulatory
 125  *          domain request
 126  *      6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
 127  *                 regulatory requests.
 128  */
 129 enum hwsim_regtest {
 130         HWSIM_REGTEST_DISABLED = 0,
 131         HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
 132         HWSIM_REGTEST_DRIVER_REG_ALL = 2,
 133         HWSIM_REGTEST_DIFF_COUNTRY = 3,
 134         HWSIM_REGTEST_WORLD_ROAM = 4,
 135         HWSIM_REGTEST_CUSTOM_WORLD = 5,
 136         HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
 137         HWSIM_REGTEST_STRICT_FOLLOW = 7,
 138         HWSIM_REGTEST_STRICT_ALL = 8,
 139         HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
 140         HWSIM_REGTEST_ALL = 10,
 141 };
 142
 143 /* Set to one of the HWSIM_REGTEST_* values above */
 144 static int regtest = HWSIM_REGTEST_DISABLED;
 145 module_param(regtest, int, 0444);
 146 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
 147
 148 static const char *hwsim_alpha2s[] = {
 149         "FI",
 150         "AL",
 151         "US",
 152         "DE",
 153         "JP",
 154         "AL",
 155 };
 156
 157 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
 158         .n_reg_rules = 5,
 159         .alpha2 =  "99",
 160         .reg_rules = {
 161                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 162                 REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
 163                 REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
 164                 REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
 165                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 166         }
 167 };
 168
 169 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
 170         .n_reg_rules = 3,
 171         .alpha2 =  "99",
 172         .reg_rules = {
 173                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 174                 REG_RULE(5725-10, 5850+10, 40, 0, 30,
 175                          NL80211_RRF_NO_IR),
 176                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 177         }
 178 };
 179
 180 static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
 181         .n_reg_rules = 6,
 182         .alpha2 =  "99",
 183         .reg_rules = {
 184                 REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 185                 REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 186                 REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
 187                 REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
 188                 REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
 189                 REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
 190         }
 191 };
 192
 193 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
 194         &hwsim_world_regdom_custom_01,
 195         &hwsim_world_regdom_custom_02,
 196         &hwsim_world_regdom_custom_03,
 197 };
 198
 199 struct hwsim_vif_priv {
 200         u32 magic;
 201         u8 bssid[ETH_ALEN];
 202         bool assoc;
 203         bool bcn_en;
 204         u16 aid;
 205 };
 206
 207 #define HWSIM_VIF_MAGIC 0x69537748
 208
 209 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
 210 {
 211         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 212         WARN(vp->magic != HWSIM_VIF_MAGIC,
 213              "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
 214              vif, vp->magic, vif->addr, vif->type, vif->p2p);
 215 }
 216
 217 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
 218 {
 219         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 220         vp->magic = HWSIM_VIF_MAGIC;
 221 }
 222
 223 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
 224 {
 225         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 226         vp->magic = 0;
 227 }
 228
 229 struct hwsim_sta_priv {
 230         u32 magic;
 231         unsigned int last_link;
 232         u16 active_links_rx;
 233 };
 234
 235 #define HWSIM_STA_MAGIC 0x6d537749
 236
 237 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
 238 {
 239         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 240         WARN_ON(sp->magic != HWSIM_STA_MAGIC);
 241 }
 242
 243 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
 244 {
 245         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 246         sp->magic = HWSIM_STA_MAGIC;
 247 }
 248
 249 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
 250 {
 251         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 252         sp->magic = 0;
 253 }
 254
 255 struct hwsim_chanctx_priv {
 256         u32 magic;
 257 };
 258
 259 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
 260
 261 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
 262 {
 263         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 264         WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
 265 }
 266
 267 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
 268 {
 269         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 270         cp->magic = HWSIM_CHANCTX_MAGIC;
 271 }
 272
 273 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
 274 {
 275         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 276         cp->magic = 0;
 277 }
 278
 279 static unsigned int hwsim_net_id;
 280
 281 static DEFINE_IDA(hwsim_netgroup_ida);
 282
 283 struct hwsim_net {
 284         int netgroup;
 285         u32 wmediumd;
 286 };
 287
 288 static inline int hwsim_net_get_netgroup(struct net *net)
 289 {
 290         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 291
 292         return hwsim_net->netgroup;
 293 }
 294
 295 static inline int hwsim_net_set_netgroup(struct net *net)
 296 {
 297         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 298
 299         hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
 300         return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
 301 }
 302
 303 static inline u32 hwsim_net_get_wmediumd(struct net *net)
 304 {
 305         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 306
 307         return hwsim_net->wmediumd;
 308 }
 309
 310 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
 311 {
 312         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 313
 314         hwsim_net->wmediumd = portid;
 315 }
 316
 317 static struct class *hwsim_class;
 318
 319 static struct net_device *hwsim_mon; /* global monitor netdev */
 320
 321 #define CHAN2G(_freq)  { \
 322         .band = NL80211_BAND_2GHZ, \
 323         .center_freq = (_freq), \
 324         .hw_value = (_freq), \
 325 }
 326
 327 #define CHAN5G(_freq) { \
 328         .band = NL80211_BAND_5GHZ, \
 329         .center_freq = (_freq), \
 330         .hw_value = (_freq), \
 331 }
 332
 333 #define CHAN6G(_freq) { \
 334         .band = NL80211_BAND_6GHZ, \
 335         .center_freq = (_freq), \
 336         .hw_value = (_freq), \
 337 }
 338
 339 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
 340         CHAN2G(2412), /* Channel 1 */
 341         CHAN2G(2417), /* Channel 2 */
 342         CHAN2G(2422), /* Channel 3 */
 343         CHAN2G(2427), /* Channel 4 */
 344         CHAN2G(2432), /* Channel 5 */
 345         CHAN2G(2437), /* Channel 6 */
 346         CHAN2G(2442), /* Channel 7 */
 347         CHAN2G(2447), /* Channel 8 */
 348         CHAN2G(2452), /* Channel 9 */
 349         CHAN2G(2457), /* Channel 10 */
 350         CHAN2G(2462), /* Channel 11 */
 351         CHAN2G(2467), /* Channel 12 */
 352         CHAN2G(2472), /* Channel 13 */
 353         CHAN2G(2484), /* Channel 14 */
 354 };
 355
 356 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
 357         CHAN5G(5180), /* Channel 36 */
 358         CHAN5G(5200), /* Channel 40 */
 359         CHAN5G(5220), /* Channel 44 */
 360         CHAN5G(5240), /* Channel 48 */
 361
 362         CHAN5G(5260), /* Channel 52 */
 363         CHAN5G(5280), /* Channel 56 */
 364         CHAN5G(5300), /* Channel 60 */
 365         CHAN5G(5320), /* Channel 64 */
 366
 367         CHAN5G(5500), /* Channel 100 */
 368         CHAN5G(5520), /* Channel 104 */
 369         CHAN5G(5540), /* Channel 108 */
 370         CHAN5G(5560), /* Channel 112 */
 371         CHAN5G(5580), /* Channel 116 */
 372         CHAN5G(5600), /* Channel 120 */
 373         CHAN5G(5620), /* Channel 124 */
 374         CHAN5G(5640), /* Channel 128 */
 375         CHAN5G(5660), /* Channel 132 */
 376         CHAN5G(5680), /* Channel 136 */
 377         CHAN5G(5700), /* Channel 140 */
 378
 379         CHAN5G(5745), /* Channel 149 */
 380         CHAN5G(5765), /* Channel 153 */
 381         CHAN5G(5785), /* Channel 157 */
 382         CHAN5G(5805), /* Channel 161 */
 383         CHAN5G(5825), /* Channel 165 */
 384         CHAN5G(5845), /* Channel 169 */
 385
 386         CHAN5G(5855), /* Channel 171 */
 387         CHAN5G(5860), /* Channel 172 */
 388         CHAN5G(5865), /* Channel 173 */
 389         CHAN5G(5870), /* Channel 174 */
 390
 391         CHAN5G(5875), /* Channel 175 */
 392         CHAN5G(5880), /* Channel 176 */
 393         CHAN5G(5885), /* Channel 177 */
 394         CHAN5G(5890), /* Channel 178 */
 395         CHAN5G(5895), /* Channel 179 */
 396         CHAN5G(5900), /* Channel 180 */
 397         CHAN5G(5905), /* Channel 181 */
 398
 399         CHAN5G(5910), /* Channel 182 */
 400         CHAN5G(5915), /* Channel 183 */
 401         CHAN5G(5920), /* Channel 184 */
 402         CHAN5G(5925), /* Channel 185 */
 403 };
 404
 405 static const struct ieee80211_channel hwsim_channels_6ghz[] = {
 406         CHAN6G(5955), /* Channel 1 */
 407         CHAN6G(5975), /* Channel 5 */
 408         CHAN6G(5995), /* Channel 9 */
 409         CHAN6G(6015), /* Channel 13 */
 410         CHAN6G(6035), /* Channel 17 */
 411         CHAN6G(6055), /* Channel 21 */
 412         CHAN6G(6075), /* Channel 25 */
 413         CHAN6G(6095), /* Channel 29 */
 414         CHAN6G(6115), /* Channel 33 */
 415         CHAN6G(6135), /* Channel 37 */
 416         CHAN6G(6155), /* Channel 41 */
 417         CHAN6G(6175), /* Channel 45 */
 418         CHAN6G(6195), /* Channel 49 */
 419         CHAN6G(6215), /* Channel 53 */
 420         CHAN6G(6235), /* Channel 57 */
 421         CHAN6G(6255), /* Channel 61 */
 422         CHAN6G(6275), /* Channel 65 */
 423         CHAN6G(6295), /* Channel 69 */
 424         CHAN6G(6315), /* Channel 73 */
 425         CHAN6G(6335), /* Channel 77 */
 426         CHAN6G(6355), /* Channel 81 */
 427         CHAN6G(6375), /* Channel 85 */
 428         CHAN6G(6395), /* Channel 89 */
 429         CHAN6G(6415), /* Channel 93 */
 430         CHAN6G(6435), /* Channel 97 */
 431         CHAN6G(6455), /* Channel 181 */
 432         CHAN6G(6475), /* Channel 105 */
 433         CHAN6G(6495), /* Channel 109 */
 434         CHAN6G(6515), /* Channel 113 */
 435         CHAN6G(6535), /* Channel 117 */
 436         CHAN6G(6555), /* Channel 121 */
 437         CHAN6G(6575), /* Channel 125 */
 438         CHAN6G(6595), /* Channel 129 */
 439         CHAN6G(6615), /* Channel 133 */
 440         CHAN6G(6635), /* Channel 137 */
 441         CHAN6G(6655), /* Channel 141 */
 442         CHAN6G(6675), /* Channel 145 */
 443         CHAN6G(6695), /* Channel 149 */
 444         CHAN6G(6715), /* Channel 153 */
 445         CHAN6G(6735), /* Channel 157 */
 446         CHAN6G(6755), /* Channel 161 */
 447         CHAN6G(6775), /* Channel 165 */
 448         CHAN6G(6795), /* Channel 169 */
 449         CHAN6G(6815), /* Channel 173 */
 450         CHAN6G(6835), /* Channel 177 */
 451         CHAN6G(6855), /* Channel 181 */
 452         CHAN6G(6875), /* Channel 185 */
 453         CHAN6G(6895), /* Channel 189 */
 454         CHAN6G(6915), /* Channel 193 */
 455         CHAN6G(6935), /* Channel 197 */
 456         CHAN6G(6955), /* Channel 201 */
 457         CHAN6G(6975), /* Channel 205 */
 458         CHAN6G(6995), /* Channel 209 */
 459         CHAN6G(7015), /* Channel 213 */
 460         CHAN6G(7035), /* Channel 217 */
 461         CHAN6G(7055), /* Channel 221 */
 462         CHAN6G(7075), /* Channel 225 */
 463         CHAN6G(7095), /* Channel 229 */
 464         CHAN6G(7115), /* Channel 233 */
 465 };
 466
 467 #define NUM_S1G_CHANS_US 51
 468 static struct ieee80211_channel hwsim_channels_s1g[NUM_S1G_CHANS_US];
 469
 470 static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
 471         .s1g = true,
 472         .cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
 473                  0,
 474                  0,
 475                  S1G_CAP3_MAX_MPDU_LEN,
 476                  0,
 477                  S1G_CAP5_AMPDU,
 478                  0,
 479                  S1G_CAP7_DUP_1MHZ,
 480                  S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
 481                  0},
 482         .nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
 483         /* RX Highest Supported Long GI Data Rate 0:7 */
 484                      0,
 485         /* RX Highest Supported Long GI Data Rate 0:7 */
 486         /* TX S1G MCS Map 0:6 */
 487                      0xfa,
 488         /* TX S1G MCS Map :7 */
 489         /* TX Highest Supported Long GI Data Rate 0:6 */
 490                      0x80,
 491         /* TX Highest Supported Long GI Data Rate 7:8 */
 492         /* Rx Single spatial stream and S1G-MCS Map for 1MHz */
 493         /* Tx Single spatial stream and S1G-MCS Map for 1MHz */
 494                      0 },
 495 };
 496
 497 static void hwsim_init_s1g_channels(struct ieee80211_channel *chans)
 498 {
 499         int ch, freq;
 500
 501         for (ch = 0; ch < NUM_S1G_CHANS_US; ch++) {
 502                 freq = 902000 + (ch + 1) * 500;
 503                 chans[ch].band = NL80211_BAND_S1GHZ;
 504                 chans[ch].center_freq = KHZ_TO_MHZ(freq);
 505                 chans[ch].freq_offset = freq % 1000;
 506                 chans[ch].hw_value = ch + 1;
 507         }
 508 }
 509
 510 static const struct ieee80211_rate hwsim_rates[] = {
 511         { .bitrate = 10 },
 512         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 513         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 514         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 515         { .bitrate = 60 },
 516         { .bitrate = 90 },
 517         { .bitrate = 120 },
 518         { .bitrate = 180 },
 519         { .bitrate = 240 },
 520         { .bitrate = 360 },
 521         { .bitrate = 480 },
 522         { .bitrate = 540 }
 523 };
 524
 525 #define DEFAULT_RX_RSSI -50
 526
 527 static const u32 hwsim_ciphers[] = {
 528         WLAN_CIPHER_SUITE_WEP40,
 529         WLAN_CIPHER_SUITE_WEP104,
 530         WLAN_CIPHER_SUITE_TKIP,
 531         WLAN_CIPHER_SUITE_CCMP,
 532         WLAN_CIPHER_SUITE_CCMP_256,
 533         WLAN_CIPHER_SUITE_GCMP,
 534         WLAN_CIPHER_SUITE_GCMP_256,
 535         WLAN_CIPHER_SUITE_AES_CMAC,
 536         WLAN_CIPHER_SUITE_BIP_CMAC_256,
 537         WLAN_CIPHER_SUITE_BIP_GMAC_128,
 538         WLAN_CIPHER_SUITE_BIP_GMAC_256,
 539 };
 540
 541 #define OUI_QCA 0x001374
 542 #define QCA_NL80211_SUBCMD_TEST 1
 543 enum qca_nl80211_vendor_subcmds {
 544         QCA_WLAN_VENDOR_ATTR_TEST = 8,
 545         QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
 546 };
 547
 548 static const struct nla_policy
 549 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
 550         [QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
 551 };
 552
 553 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
 554                                           struct wireless_dev *wdev,
 555                                           const void *data, int data_len)
 556 {
 557         struct sk_buff *skb;
 558         struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 559         int err;
 560         u32 val;
 561
 562         err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
 563                                    data_len, hwsim_vendor_test_policy, NULL);
 564         if (err)
 565                 return err;
 566         if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
 567                 return -EINVAL;
 568         val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
 569         wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
 570
 571         /* Send a vendor event as a test. Note that this would not normally be
 572          * done within a command handler, but rather, based on some other
 573          * trigger. For simplicity, this command is used to trigger the event
 574          * here.
 575          *
 576          * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
 577          */
 578         skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
 579         if (skb) {
 580                 /* skb_put() or nla_put() will fill up data within
 581                  * NL80211_ATTR_VENDOR_DATA.
 582                  */
 583
 584                 /* Add vendor data */
 585                 nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
 586
 587                 /* Send the event - this will call nla_nest_end() */
 588                 cfg80211_vendor_event(skb, GFP_KERNEL);
 589         }
 590
 591         /* Send a response to the command */
 592         skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
 593         if (!skb)
 594                 return -ENOMEM;
 595
 596         /* skb_put() or nla_put() will fill up data within
 597          * NL80211_ATTR_VENDOR_DATA
 598          */
 599         nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
 600
 601         return cfg80211_vendor_cmd_reply(skb);
 602 }
 603
 604 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
 605         {
 606                 .info = { .vendor_id = OUI_QCA,
 607                           .subcmd = QCA_NL80211_SUBCMD_TEST },
 608                 .flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
 609                 .doit = mac80211_hwsim_vendor_cmd_test,
 610                 .policy = hwsim_vendor_test_policy,
 611                 .maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
 612         }
 613 };
 614
 615 /* Advertise support vendor specific events */
 616 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
 617         { .vendor_id = OUI_QCA, .subcmd = 1 },
 618 };
 619
 620 static DEFINE_SPINLOCK(hwsim_radio_lock);
 621 static LIST_HEAD(hwsim_radios);
 622 static struct rhashtable hwsim_radios_rht;
 623 static int hwsim_radio_idx;
 624 static int hwsim_radios_generation = 1;
 625
 626 static struct platform_driver mac80211_hwsim_driver = {
 627         .driver = {
 628                 .name = "mac80211_hwsim",
 629         },
 630 };
 631
 632 struct mac80211_hwsim_link_data {
 633         u32 link_id;
 634         u64 beacon_int  /* beacon interval in us */;
 635         struct hrtimer beacon_timer;
 636 };
 637
 638 struct mac80211_hwsim_data {
 639         struct list_head list;
 640         struct rhash_head rht;
 641         struct ieee80211_hw *hw;
 642         struct device *dev;
 643         struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 644         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
 645         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
 646         struct ieee80211_channel channels_6ghz[ARRAY_SIZE(hwsim_channels_6ghz)];
 647         struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
 648         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 649         struct ieee80211_iface_combination if_combination;
 650         struct ieee80211_iface_limit if_limits[3];
 651         int n_if_limits;
 652
 653         u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
 654
 655         struct mac_address addresses[2];
 656         int channels, idx;
 657         bool use_chanctx;
 658         bool destroy_on_close;
 659         u32 portid;
 660         char alpha2[2];
 661         const struct ieee80211_regdomain *regd;
 662
 663         struct ieee80211_channel *tmp_chan;
 664         struct ieee80211_channel *roc_chan;
 665         u32 roc_duration;
 666         struct delayed_work roc_start;
 667         struct delayed_work roc_done;
 668         struct delayed_work hw_scan;
 669         struct cfg80211_scan_request *hw_scan_request;
 670         struct ieee80211_vif *hw_scan_vif;
 671         int scan_chan_idx;
 672         u8 scan_addr[ETH_ALEN];
 673         struct {
 674                 struct ieee80211_channel *channel;
 675                 unsigned long next_start, start, end;
 676         } survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
 677                       ARRAY_SIZE(hwsim_channels_5ghz) +
 678                       ARRAY_SIZE(hwsim_channels_6ghz)];
 679
 680         struct ieee80211_channel *channel;
 681         enum nl80211_chan_width bw;
 682         unsigned int rx_filter;
 683         bool started, idle, scanning;
 684         struct mutex mutex;
 685         enum ps_mode {
 686                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
 687         } ps;
 688         bool ps_poll_pending;
 689         struct dentry *debugfs;
 690
 691         atomic_t pending_cookie;
 692         struct sk_buff_head pending;    /* packets pending */
 693         /*
 694          * Only radios in the same group can communicate together (the
 695          * channel has to match too). Each bit represents a group. A
 696          * radio can be in more than one group.
 697          */
 698         u64 group;
 699
 700         /* group shared by radios created in the same netns */
 701         int netgroup;
 702         /* wmediumd portid responsible for netgroup of this radio */
 703         u32 wmediumd;
 704
 705         /* difference between this hw's clock and the real clock, in usecs */
 706         s64 tsf_offset;
 707         s64 bcn_delta;
 708         /* absolute beacon transmission time. Used to cover up "tx" delay. */
 709         u64 abs_bcn_ts;
 710
 711         /* Stats */
 712         u64 tx_pkts;
 713         u64 rx_pkts;
 714         u64 tx_bytes;
 715         u64 rx_bytes;
 716         u64 tx_dropped;
 717         u64 tx_failed;
 718
 719         /* RSSI in rx status of the receiver */
 720         int rx_rssi;
 721
 722         struct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];
 723 };
 724
 725 static const struct rhashtable_params hwsim_rht_params = {
 726         .nelem_hint = 2,
 727         .automatic_shrinking = true,
 728         .key_len = ETH_ALEN,
 729         .key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
 730         .head_offset = offsetof(struct mac80211_hwsim_data, rht),
 731 };
 732
 733 struct hwsim_radiotap_hdr {
 734         struct ieee80211_radiotap_header hdr;
 735         __le64 rt_tsft;
 736         u8 rt_flags;
 737         u8 rt_rate;
 738         __le16 rt_channel;
 739         __le16 rt_chbitmask;
 740 } __packed;
 741
 742 struct hwsim_radiotap_ack_hdr {
 743         struct ieee80211_radiotap_header hdr;
 744         u8 rt_flags;
 745         u8 pad;
 746         __le16 rt_channel;
 747         __le16 rt_chbitmask;
 748 } __packed;
 749
 750 /* MAC80211_HWSIM netlink family */
 751 static struct genl_family hwsim_genl_family;
 752
 753 enum hwsim_multicast_groups {
 754         HWSIM_MCGRP_CONFIG,
 755 };
 756
 757 static const struct genl_multicast_group hwsim_mcgrps[] = {
 758         [HWSIM_MCGRP_CONFIG] = { .name = "config", },
 759 };
 760
 761 /* MAC80211_HWSIM netlink policy */
 762
 763 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
 764         [HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
 765         [HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
 766         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
 767                                .len = IEEE80211_MAX_DATA_LEN },
 768         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
 769         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
 770         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
 771         [HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
 772                                  .len = IEEE80211_TX_MAX_RATES *
 773                                         sizeof(struct hwsim_tx_rate)},
 774         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
 775         [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
 776         [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
 777         [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 778         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
 779         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 780         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
 781         [HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
 782         [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
 783         [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
 784         [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
 785         [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 786         [HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
 787         [HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 788         [HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
 789         [HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
 790         [HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 791 };
 792
 793 #if IS_REACHABLE(CONFIG_VIRTIO)
 794
 795 /* MAC80211_HWSIM virtio queues */
 796 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
 797 static bool hwsim_virtio_enabled;
 798 static DEFINE_SPINLOCK(hwsim_virtio_lock);
 799
 800 static void hwsim_virtio_rx_work(struct work_struct *work);
 801 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
 802
 803 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 804                            struct sk_buff *skb)
 805 {
 806         struct scatterlist sg[1];
 807         unsigned long flags;
 808         int err;
 809
 810         spin_lock_irqsave(&hwsim_virtio_lock, flags);
 811         if (!hwsim_virtio_enabled) {
 812                 err = -ENODEV;
 813                 goto out_free;
 814         }
 815
 816         sg_init_one(sg, skb->head, skb_end_offset(skb));
 817         err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
 818                                    GFP_ATOMIC);
 819         if (err)
 820                 goto out_free;
 821         virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
 822         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 823         return 0;
 824
 825 out_free:
 826         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 827         nlmsg_free(skb);
 828         return err;
 829 }
 830 #else
 831 /* cause a linker error if this ends up being needed */
 832 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 833                            struct sk_buff *skb);
 834 #define hwsim_virtio_enabled false
 835 #endif
 836
 837 static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
 838 {
 839         switch (bw) {
 840         case NL80211_CHAN_WIDTH_20_NOHT:
 841         case NL80211_CHAN_WIDTH_20:
 842                 return 20;
 843         case NL80211_CHAN_WIDTH_40:
 844                 return 40;
 845         case NL80211_CHAN_WIDTH_80:
 846                 return 80;
 847         case NL80211_CHAN_WIDTH_80P80:
 848         case NL80211_CHAN_WIDTH_160:
 849                 return 160;
 850         case NL80211_CHAN_WIDTH_320:
 851                 return 320;
 852         case NL80211_CHAN_WIDTH_5:
 853                 return 5;
 854         case NL80211_CHAN_WIDTH_10:
 855                 return 10;
 856         case NL80211_CHAN_WIDTH_1:
 857                 return 1;
 858         case NL80211_CHAN_WIDTH_2:
 859                 return 2;
 860         case NL80211_CHAN_WIDTH_4:
 861                 return 4;
 862         case NL80211_CHAN_WIDTH_8:
 863                 return 8;
 864         case NL80211_CHAN_WIDTH_16:
 865                 return 16;
 866         }
 867
 868         return INT_MAX;
 869 }
 870
 871 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 872                                     struct sk_buff *skb,
 873                                     struct ieee80211_channel *chan);
 874
 875 /* sysfs attributes */
 876 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
 877 {
 878         struct mac80211_hwsim_data *data = dat;
 879         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 880         struct sk_buff *skb;
 881         struct ieee80211_pspoll *pspoll;
 882
 883         if (!vp->assoc)
 884                 return;
 885
 886         wiphy_dbg(data->hw->wiphy,
 887                   "%s: send PS-Poll to %pM for aid %d\n",
 888                   __func__, vp->bssid, vp->aid);
 889
 890         skb = dev_alloc_skb(sizeof(*pspoll));
 891         if (!skb)
 892                 return;
 893         pspoll = skb_put(skb, sizeof(*pspoll));
 894         pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
 895                                             IEEE80211_STYPE_PSPOLL |
 896                                             IEEE80211_FCTL_PM);
 897         pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
 898         memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
 899         memcpy(pspoll->ta, mac, ETH_ALEN);
 900
 901         rcu_read_lock();
 902         mac80211_hwsim_tx_frame(data->hw, skb,
 903                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
 904         rcu_read_unlock();
 905 }
 906
 907 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
 908                                 struct ieee80211_vif *vif, int ps)
 909 {
 910         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 911         struct sk_buff *skb;
 912         struct ieee80211_hdr *hdr;
 913         struct ieee80211_tx_info *cb;
 914
 915         if (!vp->assoc)
 916                 return;
 917
 918         wiphy_dbg(data->hw->wiphy,
 919                   "%s: send data::nullfunc to %pM ps=%d\n",
 920                   __func__, vp->bssid, ps);
 921
 922         skb = dev_alloc_skb(sizeof(*hdr));
 923         if (!skb)
 924                 return;
 925         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
 926         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
 927                                          IEEE80211_STYPE_NULLFUNC |
 928                                          IEEE80211_FCTL_TODS |
 929                                          (ps ? IEEE80211_FCTL_PM : 0));
 930         hdr->duration_id = cpu_to_le16(0);
 931         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
 932         memcpy(hdr->addr2, mac, ETH_ALEN);
 933         memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
 934
 935         cb = IEEE80211_SKB_CB(skb);
 936         cb->control.rates[0].count = 1;
 937         cb->control.rates[1].idx = -1;
 938
 939         rcu_read_lock();
 940         mac80211_hwsim_tx_frame(data->hw, skb,
 941                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
 942         rcu_read_unlock();
 943 }
 944
 945
 946 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
 947                                    struct ieee80211_vif *vif)
 948 {
 949         struct mac80211_hwsim_data *data = dat;
 950         hwsim_send_nullfunc(data, mac, vif, 1);
 951 }
 952
 953 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
 954                                       struct ieee80211_vif *vif)
 955 {
 956         struct mac80211_hwsim_data *data = dat;
 957         hwsim_send_nullfunc(data, mac, vif, 0);
 958 }
 959
 960 static int hwsim_fops_ps_read(void *dat, u64 *val)
 961 {
 962         struct mac80211_hwsim_data *data = dat;
 963         *val = data->ps;
 964         return 0;
 965 }
 966
 967 static int hwsim_fops_ps_write(void *dat, u64 val)
 968 {
 969         struct mac80211_hwsim_data *data = dat;
 970         enum ps_mode old_ps;
 971
 972         if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
 973             val != PS_MANUAL_POLL)
 974                 return -EINVAL;
 975
 976         if (val == PS_MANUAL_POLL) {
 977                 if (data->ps != PS_ENABLED)
 978                         return -EINVAL;
 979                 local_bh_disable();
 980                 ieee80211_iterate_active_interfaces_atomic(
 981                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 982                         hwsim_send_ps_poll, data);
 983                 local_bh_enable();
 984                 return 0;
 985         }
 986         old_ps = data->ps;
 987         data->ps = val;
 988
 989         local_bh_disable();
 990         if (old_ps == PS_DISABLED && val != PS_DISABLED) {
 991                 ieee80211_iterate_active_interfaces_atomic(
 992                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 993                         hwsim_send_nullfunc_ps, data);
 994         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
 995                 ieee80211_iterate_active_interfaces_atomic(
 996                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
 997                         hwsim_send_nullfunc_no_ps, data);
 998         }
 999         local_bh_enable();
1000
1001         return 0;
1002 }
1003
1004 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1005                          "%llu\n");
1006
1007 static int hwsim_write_simulate_radar(void *dat, u64 val)
1008 {
1009         struct mac80211_hwsim_data *data = dat;
1010
1011         ieee80211_radar_detected(data->hw);
1012
1013         return 0;
1014 }
1015
1016 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1017                          hwsim_write_simulate_radar, "%llu\n");
1018
1019 static int hwsim_fops_group_read(void *dat, u64 *val)
1020 {
1021         struct mac80211_hwsim_data *data = dat;
1022         *val = data->group;
1023         return 0;
1024 }
1025
1026 static int hwsim_fops_group_write(void *dat, u64 val)
1027 {
1028         struct mac80211_hwsim_data *data = dat;
1029         data->group = val;
1030         return 0;
1031 }
1032
1033 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1034                          hwsim_fops_group_read, hwsim_fops_group_write,
1035                          "%llx\n");
1036
1037 static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1038 {
1039         struct mac80211_hwsim_data *data = dat;
1040         *val = data->rx_rssi;
1041         return 0;
1042 }
1043
1044 static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1045 {
1046         struct mac80211_hwsim_data *data = dat;
1047         int rssi = (int)val;
1048
1049         if (rssi >= 0 || rssi < -100)
1050                 return -EINVAL;
1051
1052         data->rx_rssi = rssi;
1053         return 0;
1054 }
1055
1056 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1057                          hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1058                          "%lld\n");
1059
1060 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1061                                         struct net_device *dev)
1062 {
1063         /* TODO: allow packet injection */
1064         dev_kfree_skb(skb);
1065         return NETDEV_TX_OK;
1066 }
1067
1068 static inline u64 mac80211_hwsim_get_tsf_raw(void)
1069 {
1070         return ktime_to_us(ktime_get_real());
1071 }
1072
1073 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1074 {
1075         u64 now = mac80211_hwsim_get_tsf_raw();
1076         return cpu_to_le64(now + data->tsf_offset);
1077 }
1078
1079 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1080                                   struct ieee80211_vif *vif)
1081 {
1082         struct mac80211_hwsim_data *data = hw->priv;
1083         return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
1084 }
1085
1086 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1087                 struct ieee80211_vif *vif, u64 tsf)
1088 {
1089         struct mac80211_hwsim_data *data = hw->priv;
1090         u64 now = mac80211_hwsim_get_tsf(hw, vif);
1091         /* MLD not supported here */
1092         u32 bcn_int = data->link_data[0].beacon_int;
1093         u64 delta = abs(tsf - now);
1094
1095         /* adjust after beaconing with new timestamp at old TBTT */
1096         if (tsf > now) {
1097                 data->tsf_offset += delta;
1098                 data->bcn_delta = do_div(delta, bcn_int);
1099         } else {
1100                 data->tsf_offset -= delta;
1101                 data->bcn_delta = -(s64)do_div(delta, bcn_int);
1102         }
1103 }
1104
1105 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1106                                       struct sk_buff *tx_skb,
1107                                       struct ieee80211_channel *chan)
1108 {
1109         struct mac80211_hwsim_data *data = hw->priv;
1110         struct sk_buff *skb;
1111         struct hwsim_radiotap_hdr *hdr;
1112         u16 flags, bitrate;
1113         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1114         struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
1115
1116         if (!txrate)
1117                 bitrate = 0;
1118         else
1119                 bitrate = txrate->bitrate;
1120
1121         if (!netif_running(hwsim_mon))
1122                 return;
1123
1124         skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1125         if (skb == NULL)
1126                 return;
1127
1128         hdr = skb_push(skb, sizeof(*hdr));
1129         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1130         hdr->hdr.it_pad = 0;
1131         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1132         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1133                                           (1 << IEEE80211_RADIOTAP_RATE) |
1134                                           (1 << IEEE80211_RADIOTAP_TSFT) |
1135                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1136         hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1137         hdr->rt_flags = 0;
1138         hdr->rt_rate = bitrate / 5;
1139         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1140         flags = IEEE80211_CHAN_2GHZ;
1141         if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1142                 flags |= IEEE80211_CHAN_OFDM;
1143         else
1144                 flags |= IEEE80211_CHAN_CCK;
1145         hdr->rt_chbitmask = cpu_to_le16(flags);
1146
1147         skb->dev = hwsim_mon;
1148         skb_reset_mac_header(skb);
1149         skb->ip_summed = CHECKSUM_UNNECESSARY;
1150         skb->pkt_type = PACKET_OTHERHOST;
1151         skb->protocol = htons(ETH_P_802_2);
1152         memset(skb->cb, 0, sizeof(skb->cb));
1153         netif_rx(skb);
1154 }
1155
1156
1157 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
1158                                        const u8 *addr)
1159 {
1160         struct sk_buff *skb;
1161         struct hwsim_radiotap_ack_hdr *hdr;
1162         u16 flags;
1163         struct ieee80211_hdr *hdr11;
1164
1165         if (!netif_running(hwsim_mon))
1166                 return;
1167
1168         skb = dev_alloc_skb(100);
1169         if (skb == NULL)
1170                 return;
1171
1172         hdr = skb_put(skb, sizeof(*hdr));
1173         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1174         hdr->hdr.it_pad = 0;
1175         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1176         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1177                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1178         hdr->rt_flags = 0;
1179         hdr->pad = 0;
1180         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1181         flags = IEEE80211_CHAN_2GHZ;
1182         hdr->rt_chbitmask = cpu_to_le16(flags);
1183
1184         hdr11 = skb_put(skb, 10);
1185         hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1186                                            IEEE80211_STYPE_ACK);
1187         hdr11->duration_id = cpu_to_le16(0);
1188         memcpy(hdr11->addr1, addr, ETH_ALEN);
1189
1190         skb->dev = hwsim_mon;
1191         skb_reset_mac_header(skb);
1192         skb->ip_summed = CHECKSUM_UNNECESSARY;
1193         skb->pkt_type = PACKET_OTHERHOST;
1194         skb->protocol = htons(ETH_P_802_2);
1195         memset(skb->cb, 0, sizeof(skb->cb));
1196         netif_rx(skb);
1197 }
1198
1199 struct mac80211_hwsim_addr_match_data {
1200         u8 addr[ETH_ALEN];
1201         bool ret;
1202 };
1203
1204 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1205                                      struct ieee80211_vif *vif)
1206 {
1207         int i;
1208         struct mac80211_hwsim_addr_match_data *md = data;
1209
1210         if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1211                 md->ret = true;
1212                 return;
1213         }
1214
1215         /* Match the link address */
1216         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1217                 struct ieee80211_bss_conf *conf;
1218
1219                 conf = rcu_dereference(vif->link_conf[i]);
1220                 if (!conf)
1221                         continue;
1222
1223                 if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1224                         md->ret = true;
1225                         return;
1226                 }
1227         }
1228 }
1229
1230 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1231                                       const u8 *addr)
1232 {
1233         struct mac80211_hwsim_addr_match_data md = {
1234                 .ret = false,
1235         };
1236
1237         if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1238                 return true;
1239
1240         memcpy(md.addr, addr, ETH_ALEN);
1241
1242         ieee80211_iterate_active_interfaces_atomic(data->hw,
1243                                                    IEEE80211_IFACE_ITER_NORMAL,
1244                                                    mac80211_hwsim_addr_iter,
1245                                                    &md);
1246
1247         return md.ret;
1248 }
1249
1250 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1251                            struct sk_buff *skb)
1252 {
1253         switch (data->ps) {
1254         case PS_DISABLED:
1255                 return true;
1256         case PS_ENABLED:
1257                 return false;
1258         case PS_AUTO_POLL:
1259                 /* TODO: accept (some) Beacons by default and other frames only
1260                  * if pending PS-Poll has been sent */
1261                 return true;
1262         case PS_MANUAL_POLL:
1263                 /* Allow unicast frames to own address if there is a pending
1264                  * PS-Poll */
1265                 if (data->ps_poll_pending &&
1266                     mac80211_hwsim_addr_match(data, skb->data + 4)) {
1267                         data->ps_poll_pending = false;
1268                         return true;
1269                 }
1270                 return false;
1271         }
1272
1273         return true;
1274 }
1275
1276 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1277                                   struct sk_buff *skb, int portid)
1278 {
1279         struct net *net;
1280         bool found = false;
1281         int res = -ENOENT;
1282
1283         rcu_read_lock();
1284         for_each_net_rcu(net) {
1285                 if (data->netgroup == hwsim_net_get_netgroup(net)) {
1286                         res = genlmsg_unicast(net, skb, portid);
1287                         found = true;
1288                         break;
1289                 }
1290         }
1291         rcu_read_unlock();
1292
1293         if (!found)
1294                 nlmsg_free(skb);
1295
1296         return res;
1297 }
1298
1299 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1300                                          const u8 *addr, bool add)
1301 {
1302         struct mac80211_hwsim_data *data = hw->priv;
1303         u32 _portid = READ_ONCE(data->wmediumd);
1304         struct sk_buff *skb;
1305         void *msg_head;
1306
1307         WARN_ON(!is_valid_ether_addr(addr));
1308
1309         if (!_portid && !hwsim_virtio_enabled)
1310                 return;
1311
1312         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1313         if (!skb)
1314                 return;
1315
1316         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1317                                add ? HWSIM_CMD_ADD_MAC_ADDR :
1318                                      HWSIM_CMD_DEL_MAC_ADDR);
1319         if (!msg_head) {
1320                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1321                 goto nla_put_failure;
1322         }
1323
1324         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1325                     ETH_ALEN, data->addresses[1].addr))
1326                 goto nla_put_failure;
1327
1328         if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1329                 goto nla_put_failure;
1330
1331         genlmsg_end(skb, msg_head);
1332
1333         if (hwsim_virtio_enabled)
1334                 hwsim_tx_virtio(data, skb);
1335         else
1336                 hwsim_unicast_netgroup(data, skb, _portid);
1337         return;
1338 nla_put_failure:
1339         nlmsg_free(skb);
1340 }
1341
1342 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1343 {
1344         u16 result = 0;
1345
1346         if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1347                 result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1348         if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1349                 result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1350         if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1351                 result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1352         if (rate->flags & IEEE80211_TX_RC_MCS)
1353                 result |= MAC80211_HWSIM_TX_RC_MCS;
1354         if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1355                 result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1356         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1357                 result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1358         if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1359                 result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1360         if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1361                 result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1362         if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1363                 result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1364         if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1365                 result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1366         if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1367                 result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1368
1369         return result;
1370 }
1371
1372 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1373                                        struct sk_buff *my_skb,
1374                                        int dst_portid,
1375                                        struct ieee80211_channel *channel)
1376 {
1377         struct sk_buff *skb;
1378         struct mac80211_hwsim_data *data = hw->priv;
1379         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1380         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1381         void *msg_head;
1382         unsigned int hwsim_flags = 0;
1383         int i;
1384         struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1385         struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1386         uintptr_t cookie;
1387
1388         if (data->ps != PS_DISABLED)
1389                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1390         /* If the queue contains MAX_QUEUE skb's drop some */
1391         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1392                 /* Dropping until WARN_QUEUE level */
1393                 while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1394                         ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1395                         data->tx_dropped++;
1396                 }
1397         }
1398
1399         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1400         if (skb == NULL)
1401                 goto nla_put_failure;
1402
1403         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1404                                HWSIM_CMD_FRAME);
1405         if (msg_head == NULL) {
1406                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1407                 goto nla_put_failure;
1408         }
1409
1410         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1411                     ETH_ALEN, data->addresses[1].addr))
1412                 goto nla_put_failure;
1413
1414         /* We get the skb->data */
1415         if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1416                 goto nla_put_failure;
1417
1418         /* We get the flags for this transmission, and we translate them to
1419            wmediumd flags  */
1420
1421         if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1422                 hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1423
1424         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1425                 hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1426
1427         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1428                 goto nla_put_failure;
1429
1430         if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1431                 goto nla_put_failure;
1432
1433         /* We get the tx control (rate and retries) info*/
1434
1435         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1436                 tx_attempts[i].idx = info->status.rates[i].idx;
1437                 tx_attempts_flags[i].idx = info->status.rates[i].idx;
1438                 tx_attempts[i].count = info->status.rates[i].count;
1439                 tx_attempts_flags[i].flags =
1440                                 trans_tx_rate_flags_ieee2hwsim(
1441                                                 &info->status.rates[i]);
1442         }
1443
1444         if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1445                     sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1446                     tx_attempts))
1447                 goto nla_put_failure;
1448
1449         if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1450                     sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1451                     tx_attempts_flags))
1452                 goto nla_put_failure;
1453
1454         /* We create a cookie to identify this skb */
1455         cookie = atomic_inc_return(&data->pending_cookie);
1456         info->rate_driver_data[0] = (void *)cookie;
1457         if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1458                 goto nla_put_failure;
1459
1460         genlmsg_end(skb, msg_head);
1461
1462         if (hwsim_virtio_enabled) {
1463                 if (hwsim_tx_virtio(data, skb))
1464                         goto err_free_txskb;
1465         } else {
1466                 if (hwsim_unicast_netgroup(data, skb, dst_portid))
1467                         goto err_free_txskb;
1468         }
1469
1470         /* Enqueue the packet */
1471         skb_queue_tail(&data->pending, my_skb);
1472         data->tx_pkts++;
1473         data->tx_bytes += my_skb->len;
1474         return;
1475
1476 nla_put_failure:
1477         nlmsg_free(skb);
1478 err_free_txskb:
1479         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1480         ieee80211_free_txskb(hw, my_skb);
1481         data->tx_failed++;
1482 }
1483
1484 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1485                                struct ieee80211_channel *c2)
1486 {
1487         if (!c1 || !c2)
1488                 return false;
1489
1490         return c1->center_freq == c2->center_freq;
1491 }
1492
1493 struct tx_iter_data {
1494         struct ieee80211_channel *channel;
1495         bool receive;
1496 };
1497
1498 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1499                                    struct ieee80211_vif *vif)
1500 {
1501         struct tx_iter_data *data = _data;
1502         int i;
1503
1504         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1505                 struct ieee80211_bss_conf *conf;
1506                 struct ieee80211_chanctx_conf *chanctx;
1507
1508                 conf = rcu_dereference(vif->link_conf[i]);
1509                 if (!conf)
1510                         continue;
1511
1512                 chanctx = rcu_dereference(conf->chanctx_conf);
1513                 if (!chanctx)
1514                         continue;
1515
1516                 if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1517                         continue;
1518
1519                 data->receive = true;
1520                 return;
1521         }
1522 }
1523
1524 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1525 {
1526         /*
1527          * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1528          * e.g. like this:
1529          * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1530          * (but you should use a valid OUI, not that)
1531          *
1532          * If anyone wants to 'donate' a radiotap OUI/subns code
1533          * please send a patch removing this #ifdef and changing
1534          * the values accordingly.
1535          */
1536 #ifdef HWSIM_RADIOTAP_OUI
1537         struct ieee80211_vendor_radiotap *rtap;
1538
1539         /*
1540          * Note that this code requires the headroom in the SKB
1541          * that was allocated earlier.
1542          */
1543         rtap = skb_push(skb, sizeof(*rtap) + 8 + 4);
1544         rtap->oui[0] = HWSIM_RADIOTAP_OUI[0];
1545         rtap->oui[1] = HWSIM_RADIOTAP_OUI[1];
1546         rtap->oui[2] = HWSIM_RADIOTAP_OUI[2];
1547         rtap->subns = 127;
1548
1549         /*
1550          * Radiotap vendor namespaces can (and should) also be
1551          * split into fields by using the standard radiotap
1552          * presence bitmap mechanism. Use just BIT(0) here for
1553          * the presence bitmap.
1554          */
1555         rtap->present = BIT(0);
1556         /* We have 8 bytes of (dummy) data */
1557         rtap->len = 8;
1558         /* For testing, also require it to be aligned */
1559         rtap->align = 8;
1560         /* And also test that padding works, 4 bytes */
1561         rtap->pad = 4;
1562         /* push the data */
1563         memcpy(rtap->data, "ABCDEFGH", 8);
1564         /* make sure to clear padding, mac80211 doesn't */
1565         memset(rtap->data + 8, 0, 4);
1566
1567         IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
1568 #endif
1569 }
1570
1571 static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1572                               struct ieee80211_rx_status *rx_status,
1573                               struct sk_buff *skb)
1574 {
1575         struct ieee80211_hdr *hdr = (void *)skb->data;
1576
1577         if (!ieee80211_has_morefrags(hdr->frame_control) &&
1578             !is_multicast_ether_addr(hdr->addr1) &&
1579             (ieee80211_is_mgmt(hdr->frame_control) ||
1580              ieee80211_is_data(hdr->frame_control))) {
1581                 struct ieee80211_sta *sta;
1582                 unsigned int link_id;
1583
1584                 rcu_read_lock();
1585                 sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1586                                                        hdr->addr1, &link_id);
1587                 if (sta) {
1588                         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1589
1590                         if (ieee80211_has_pm(hdr->frame_control))
1591                                 sp->active_links_rx &= ~BIT(link_id);
1592                         else
1593                                 sp->active_links_rx |= BIT(link_id);
1594                 }
1595                 rcu_read_unlock();
1596         }
1597
1598         memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1599
1600         mac80211_hwsim_add_vendor_rtap(skb);
1601
1602         data->rx_pkts++;
1603         data->rx_bytes += skb->len;
1604         ieee80211_rx_irqsafe(data->hw, skb);
1605 }
1606
1607 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1608                                           struct sk_buff *skb,
1609                                           struct ieee80211_channel *chan)
1610 {
1611         struct mac80211_hwsim_data *data = hw->priv, *data2;
1612         bool ack = false;
1613         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1614         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1615         struct ieee80211_rx_status rx_status;
1616         u64 now;
1617
1618         memset(&rx_status, 0, sizeof(rx_status));
1619         rx_status.flag |= RX_FLAG_MACTIME_START;
1620         rx_status.freq = chan->center_freq;
1621         rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1622         rx_status.band = chan->band;
1623         if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1624                 rx_status.rate_idx =
1625                         ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1626                 rx_status.nss =
1627                         ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1628                 rx_status.encoding = RX_ENC_VHT;
1629         } else {
1630                 rx_status.rate_idx = info->control.rates[0].idx;
1631                 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1632                         rx_status.encoding = RX_ENC_HT;
1633         }
1634         if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1635                 rx_status.bw = RATE_INFO_BW_40;
1636         else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1637                 rx_status.bw = RATE_INFO_BW_80;
1638         else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1639                 rx_status.bw = RATE_INFO_BW_160;
1640         else
1641                 rx_status.bw = RATE_INFO_BW_20;
1642         if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1643                 rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1644         /* TODO: simulate optional packet loss */
1645         rx_status.signal = data->rx_rssi;
1646         if (info->control.vif)
1647                 rx_status.signal += info->control.vif->bss_conf.txpower;
1648
1649         if (data->ps != PS_DISABLED)
1650                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1651
1652         /* release the skb's source info */
1653         skb_orphan(skb);
1654         skb_dst_drop(skb);
1655         skb->mark = 0;
1656         skb_ext_reset(skb);
1657         nf_reset_ct(skb);
1658
1659         /*
1660          * Get absolute mactime here so all HWs RX at the "same time", and
1661          * absolute TX time for beacon mactime so the timestamp matches.
1662          * Giving beacons a different mactime than non-beacons looks messy, but
1663          * it helps the Toffset be exact and a ~10us mactime discrepancy
1664          * probably doesn't really matter.
1665          */
1666         if (ieee80211_is_beacon(hdr->frame_control) ||
1667             ieee80211_is_probe_resp(hdr->frame_control)) {
1668                 rx_status.boottime_ns = ktime_get_boottime_ns();
1669                 now = data->abs_bcn_ts;
1670         } else {
1671                 now = mac80211_hwsim_get_tsf_raw();
1672         }
1673
1674         /* Copy skb to all enabled radios that are on the current frequency */
1675         spin_lock(&hwsim_radio_lock);
1676         list_for_each_entry(data2, &hwsim_radios, list) {
1677                 struct sk_buff *nskb;
1678                 struct tx_iter_data tx_iter_data = {
1679                         .receive = false,
1680                         .channel = chan,
1681                 };
1682
1683                 if (data == data2)
1684                         continue;
1685
1686                 if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1687                     !hwsim_ps_rx_ok(data2, skb))
1688                         continue;
1689
1690                 if (!(data->group & data2->group))
1691                         continue;
1692
1693                 if (data->netgroup != data2->netgroup)
1694                         continue;
1695
1696                 if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1697                     !hwsim_chans_compat(chan, data2->channel)) {
1698                         ieee80211_iterate_active_interfaces_atomic(
1699                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1700                                 mac80211_hwsim_tx_iter, &tx_iter_data);
1701                         if (!tx_iter_data.receive)
1702                                 continue;
1703                 }
1704
1705                 /*
1706                  * reserve some space for our vendor and the normal
1707                  * radiotap header, since we're copying anyway
1708                  */
1709                 if (skb->len < PAGE_SIZE && paged_rx) {
1710                         struct page *page = alloc_page(GFP_ATOMIC);
1711
1712                         if (!page)
1713                                 continue;
1714
1715                         nskb = dev_alloc_skb(128);
1716                         if (!nskb) {
1717                                 __free_page(page);
1718                                 continue;
1719                         }
1720
1721                         memcpy(page_address(page), skb->data, skb->len);
1722                         skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1723                 } else {
1724                         nskb = skb_copy(skb, GFP_ATOMIC);
1725                         if (!nskb)
1726                                 continue;
1727                 }
1728
1729                 if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1730                         ack = true;
1731
1732                 rx_status.mactime = now + data2->tsf_offset;
1733
1734                 mac80211_hwsim_rx(data2, &rx_status, nskb);
1735         }
1736         spin_unlock(&hwsim_radio_lock);
1737
1738         return ack;
1739 }
1740
1741 static struct ieee80211_bss_conf *
1742 mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
1743                               struct ieee80211_vif *vif,
1744                               struct ieee80211_sta *sta,
1745                               struct ieee80211_hdr *hdr,
1746                               struct ieee80211_link_sta **link_sta)
1747 {
1748         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1749         int i;
1750
1751         if (!vif->valid_links)
1752                 return &vif->bss_conf;
1753
1754         WARN_ON(is_multicast_ether_addr(hdr->addr1));
1755
1756         if (WARN_ON_ONCE(!sta->valid_links))
1757                 return &vif->bss_conf;
1758
1759         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1760                 struct ieee80211_bss_conf *bss_conf;
1761                 unsigned int link_id;
1762
1763                 /* round-robin the available link IDs */
1764                 link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
1765
1766                 if (!(vif->active_links & BIT(link_id)))
1767                         continue;
1768
1769                 if (!(sp->active_links_rx & BIT(link_id)))
1770                         continue;
1771
1772                 *link_sta = rcu_dereference(sta->link[link_id]);
1773                 if (!*link_sta)
1774                         continue;
1775
1776                 bss_conf = rcu_dereference(vif->link_conf[link_id]);
1777                 if (WARN_ON_ONCE(!bss_conf))
1778                         continue;
1779
1780                 /* can happen while switching links */
1781                 if (!rcu_access_pointer(bss_conf->chanctx_conf))
1782                         continue;
1783
1784                 sp->last_link = link_id;
1785                 return bss_conf;
1786         }
1787
1788         return NULL;
1789 }
1790
1791 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1792                               struct ieee80211_tx_control *control,
1793                               struct sk_buff *skb)
1794 {
1795         struct mac80211_hwsim_data *data = hw->priv;
1796         struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1797         struct ieee80211_hdr *hdr = (void *)skb->data;
1798         struct ieee80211_chanctx_conf *chanctx_conf;
1799         struct ieee80211_channel *channel;
1800         bool ack;
1801         enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1802         u32 _portid, i;
1803
1804         if (WARN_ON(skb->len < 10)) {
1805                 /* Should not happen; just a sanity check for addr1 use */
1806                 ieee80211_free_txskb(hw, skb);
1807                 return;
1808         }
1809
1810         if (!data->use_chanctx) {
1811                 channel = data->channel;
1812                 confbw = data->bw;
1813         } else if (txi->hw_queue == 4) {
1814                 channel = data->tmp_chan;
1815         } else {
1816                 u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
1817                                        IEEE80211_TX_CTRL_MLO_LINK);
1818                 struct ieee80211_vif *vif = txi->control.vif;
1819                 struct ieee80211_link_sta *link_sta = NULL;
1820                 struct ieee80211_sta *sta = control->sta;
1821                 struct ieee80211_bss_conf *bss_conf;
1822
1823                 if (link != IEEE80211_LINK_UNSPECIFIED) {
1824                         bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
1825                         if (sta)
1826                                 link_sta = rcu_dereference(sta->link[link]);
1827                 } else {
1828                         bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
1829                                                                  hdr, &link_sta);
1830                 }
1831
1832                 if (WARN_ON(!bss_conf)) {
1833                         ieee80211_free_txskb(hw, skb);
1834                         return;
1835                 }
1836
1837                 if (sta && sta->mlo) {
1838                         if (WARN_ON(!link_sta)) {
1839                                 ieee80211_free_txskb(hw, skb);
1840                                 return;
1841                         }
1842                         /* address translation to link addresses on TX */
1843                         ether_addr_copy(hdr->addr1, link_sta->addr);
1844                         ether_addr_copy(hdr->addr2, bss_conf->addr);
1845                         /* translate A3 only if it's the BSSID */
1846                         if (!ieee80211_has_tods(hdr->frame_control) &&
1847                             !ieee80211_has_fromds(hdr->frame_control)) {
1848                                 if (ether_addr_equal(hdr->addr3, sta->addr))
1849                                         ether_addr_copy(hdr->addr3, link_sta->addr);
1850                                 else if (ether_addr_equal(hdr->addr3, vif->addr))
1851                                         ether_addr_copy(hdr->addr3, bss_conf->addr);
1852                         }
1853                         /* no need to look at A4, if present it's SA */
1854                 }
1855
1856                 chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
1857                 if (chanctx_conf) {
1858                         channel = chanctx_conf->def.chan;
1859                         confbw = chanctx_conf->def.width;
1860                 } else {
1861                         channel = NULL;
1862                 }
1863         }
1864
1865         if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
1866                 ieee80211_free_txskb(hw, skb);
1867                 return;
1868         }
1869
1870         if (data->idle && !data->tmp_chan) {
1871                 wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
1872                 ieee80211_free_txskb(hw, skb);
1873                 return;
1874         }
1875
1876         if (txi->control.vif)
1877                 hwsim_check_magic(txi->control.vif);
1878         if (control->sta)
1879                 hwsim_check_sta_magic(control->sta);
1880
1881         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1882                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
1883                                        txi->control.rates,
1884                                        ARRAY_SIZE(txi->control.rates));
1885
1886         for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
1887                 u16 rflags = txi->control.rates[i].flags;
1888                 /* initialize to data->bw for 5/10 MHz handling */
1889                 enum nl80211_chan_width bw = data->bw;
1890
1891                 if (txi->control.rates[i].idx == -1)
1892                         break;
1893
1894                 if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1895                         bw = NL80211_CHAN_WIDTH_40;
1896                 else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1897                         bw = NL80211_CHAN_WIDTH_80;
1898                 else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1899                         bw = NL80211_CHAN_WIDTH_160;
1900
1901                 if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
1902                         return;
1903         }
1904
1905         if (skb->len >= 24 + 8 &&
1906             ieee80211_is_probe_resp(hdr->frame_control)) {
1907                 /* fake header transmission time */
1908                 struct ieee80211_mgmt *mgmt;
1909                 struct ieee80211_rate *txrate;
1910                 /* TODO: get MCS */
1911                 int bitrate = 100;
1912                 u64 ts;
1913
1914                 mgmt = (struct ieee80211_mgmt *)skb->data;
1915                 txrate = ieee80211_get_tx_rate(hw, txi);
1916                 if (txrate)
1917                         bitrate = txrate->bitrate;
1918                 ts = mac80211_hwsim_get_tsf_raw();
1919                 mgmt->u.probe_resp.timestamp =
1920                         cpu_to_le64(ts + data->tsf_offset +
1921                                     24 * 8 * 10 / bitrate);
1922         }
1923
1924         mac80211_hwsim_monitor_rx(hw, skb, channel);
1925
1926         /* wmediumd mode check */
1927         _portid = READ_ONCE(data->wmediumd);
1928
1929         if (_portid || hwsim_virtio_enabled)
1930                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
1931
1932         /* NO wmediumd detected, perfect medium simulation */
1933         data->tx_pkts++;
1934         data->tx_bytes += skb->len;
1935         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
1936
1937         if (ack && skb->len >= 16)
1938                 mac80211_hwsim_monitor_ack(channel, hdr->addr2);
1939
1940         ieee80211_tx_info_clear_status(txi);
1941
1942         /* frame was transmitted at most favorable rate at first attempt */
1943         txi->control.rates[0].count = 1;
1944         txi->control.rates[1].idx = -1;
1945
1946         if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
1947                 txi->flags |= IEEE80211_TX_STAT_ACK;
1948         ieee80211_tx_status_irqsafe(hw, skb);
1949 }
1950
1951
1952 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
1953 {
1954         struct mac80211_hwsim_data *data = hw->priv;
1955         wiphy_dbg(hw->wiphy, "%s\n", __func__);
1956         data->started = true;
1957         return 0;
1958 }
1959
1960
1961 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
1962 {
1963         struct mac80211_hwsim_data *data = hw->priv;
1964         int i;
1965
1966         data->started = false;
1967
1968         for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
1969                 hrtimer_cancel(&data->link_data[i].beacon_timer);
1970
1971         while (!skb_queue_empty(&data->pending))
1972                 ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1973
1974         wiphy_dbg(hw->wiphy, "%s\n", __func__);
1975 }
1976
1977
1978 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
1979                                         struct ieee80211_vif *vif)
1980 {
1981         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
1982                   __func__, ieee80211_vif_type_p2p(vif),
1983                   vif->addr);
1984         hwsim_set_magic(vif);
1985
1986         if (vif->type != NL80211_IFTYPE_MONITOR)
1987                 mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
1988
1989         vif->cab_queue = 0;
1990         vif->hw_queue[IEEE80211_AC_VO] = 0;
1991         vif->hw_queue[IEEE80211_AC_VI] = 1;
1992         vif->hw_queue[IEEE80211_AC_BE] = 2;
1993         vif->hw_queue[IEEE80211_AC_BK] = 3;
1994
1995         return 0;
1996 }
1997
1998
1999 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
2000                                            struct ieee80211_vif *vif,
2001                                            enum nl80211_iftype newtype,
2002                                            bool newp2p)
2003 {
2004         newtype = ieee80211_iftype_p2p(newtype, newp2p);
2005         wiphy_dbg(hw->wiphy,
2006                   "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2007                   __func__, ieee80211_vif_type_p2p(vif),
2008                     newtype, vif->addr);
2009         hwsim_check_magic(vif);
2010
2011         /*
2012          * interface may change from non-AP to AP in
2013          * which case this needs to be set up again
2014          */
2015         vif->cab_queue = 0;
2016
2017         return 0;
2018 }
2019
2020 static void mac80211_hwsim_remove_interface(
2021         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2022 {
2023         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2024                   __func__, ieee80211_vif_type_p2p(vif),
2025                   vif->addr);
2026         hwsim_check_magic(vif);
2027         hwsim_clear_magic(vif);
2028         if (vif->type != NL80211_IFTYPE_MONITOR)
2029                 mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2030 }
2031
2032 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2033                                     struct sk_buff *skb,
2034                                     struct ieee80211_channel *chan)
2035 {
2036         struct mac80211_hwsim_data *data = hw->priv;
2037         u32 _portid = READ_ONCE(data->wmediumd);
2038
2039         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2040                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2041                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2042                                        txi->control.rates,
2043                                        ARRAY_SIZE(txi->control.rates));
2044         }
2045
2046         mac80211_hwsim_monitor_rx(hw, skb, chan);
2047
2048         if (_portid || hwsim_virtio_enabled)
2049                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, chan);
2050
2051         data->tx_pkts++;
2052         data->tx_bytes += skb->len;
2053         mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2054         dev_kfree_skb(skb);
2055 }
2056
2057 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2058                                      struct ieee80211_vif *vif)
2059 {
2060         struct mac80211_hwsim_link_data *link_data = arg;
2061         u32 link_id = link_data->link_id;
2062         struct ieee80211_bss_conf *link_conf;
2063         struct mac80211_hwsim_data *data =
2064                 container_of(link_data, struct mac80211_hwsim_data,
2065                              link_data[link_id]);
2066         struct ieee80211_hw *hw = data->hw;
2067         struct ieee80211_tx_info *info;
2068         struct ieee80211_rate *txrate;
2069         struct ieee80211_mgmt *mgmt;
2070         struct sk_buff *skb;
2071         /* TODO: get MCS */
2072         int bitrate = 100;
2073
2074         hwsim_check_magic(vif);
2075
2076         link_conf = rcu_dereference(vif->link_conf[link_id]);
2077         if (!link_conf)
2078                 return;
2079
2080         if (vif->type != NL80211_IFTYPE_AP &&
2081             vif->type != NL80211_IFTYPE_MESH_POINT &&
2082             vif->type != NL80211_IFTYPE_ADHOC &&
2083             vif->type != NL80211_IFTYPE_OCB)
2084                 return;
2085
2086         skb = ieee80211_beacon_get(hw, vif, link_data->link_id);
2087         if (skb == NULL)
2088                 return;
2089         info = IEEE80211_SKB_CB(skb);
2090         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2091                 ieee80211_get_tx_rates(vif, NULL, skb,
2092                                        info->control.rates,
2093                                        ARRAY_SIZE(info->control.rates));
2094
2095         txrate = ieee80211_get_tx_rate(hw, info);
2096         if (txrate)
2097                 bitrate = txrate->bitrate;
2098
2099         mgmt = (struct ieee80211_mgmt *) skb->data;
2100         /* fake header transmission time */
2101         data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
2102         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2103                 struct ieee80211_ext *ext = (void *) mgmt;
2104
2105                 ext->u.s1g_beacon.timestamp = cpu_to_le32(data->abs_bcn_ts +
2106                                                           data->tsf_offset +
2107                                                           10 * 8 * 10 /
2108                                                           bitrate);
2109         } else {
2110                 mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
2111                                                        data->tsf_offset +
2112                                                        24 * 8 * 10 /
2113                                                        bitrate);
2114         }
2115
2116         mac80211_hwsim_tx_frame(hw, skb,
2117                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2118
2119         while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2120                 mac80211_hwsim_tx_frame(hw, skb,
2121                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2122         }
2123
2124         if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif))
2125                 ieee80211_csa_finish(vif);
2126 }
2127
2128 static enum hrtimer_restart
2129 mac80211_hwsim_beacon(struct hrtimer *timer)
2130 {
2131         struct mac80211_hwsim_link_data *link_data =
2132                 container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2133         struct mac80211_hwsim_data *data =
2134                 container_of(link_data, struct mac80211_hwsim_data,
2135                              link_data[link_data->link_id]);
2136         struct ieee80211_hw *hw = data->hw;
2137         u64 bcn_int = link_data->beacon_int;
2138
2139         if (!data->started)
2140                 return HRTIMER_NORESTART;
2141
2142         ieee80211_iterate_active_interfaces_atomic(
2143                 hw, IEEE80211_IFACE_ITER_NORMAL,
2144                 mac80211_hwsim_beacon_tx, link_data);
2145
2146         /* beacon at new TBTT + beacon interval */
2147         if (data->bcn_delta) {
2148                 bcn_int -= data->bcn_delta;
2149                 data->bcn_delta = 0;
2150         }
2151         hrtimer_forward_now(&link_data->beacon_timer,
2152                             ns_to_ktime(bcn_int * NSEC_PER_USEC));
2153         return HRTIMER_RESTART;
2154 }
2155
2156 static const char * const hwsim_chanwidths[] = {
2157         [NL80211_CHAN_WIDTH_5] = "ht5",
2158         [NL80211_CHAN_WIDTH_10] = "ht10",
2159         [NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2160         [NL80211_CHAN_WIDTH_20] = "ht20",
2161         [NL80211_CHAN_WIDTH_40] = "ht40",
2162         [NL80211_CHAN_WIDTH_80] = "vht80",
2163         [NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2164         [NL80211_CHAN_WIDTH_160] = "vht160",
2165         [NL80211_CHAN_WIDTH_1] = "1MHz",
2166         [NL80211_CHAN_WIDTH_2] = "2MHz",
2167         [NL80211_CHAN_WIDTH_4] = "4MHz",
2168         [NL80211_CHAN_WIDTH_8] = "8MHz",
2169         [NL80211_CHAN_WIDTH_16] = "16MHz",
2170 };
2171
2172 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
2173 {
2174         struct mac80211_hwsim_data *data = hw->priv;
2175         struct ieee80211_conf *conf = &hw->conf;
2176         static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2177                 [IEEE80211_SMPS_AUTOMATIC] = "auto",
2178                 [IEEE80211_SMPS_OFF] = "off",
2179                 [IEEE80211_SMPS_STATIC] = "static",
2180                 [IEEE80211_SMPS_DYNAMIC] = "dynamic",
2181         };
2182         int idx;
2183
2184         if (conf->chandef.chan)
2185                 wiphy_dbg(hw->wiphy,
2186                           "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2187                           __func__,
2188                           conf->chandef.chan->center_freq,
2189                           conf->chandef.center_freq1,
2190                           conf->chandef.center_freq2,
2191                           hwsim_chanwidths[conf->chandef.width],
2192                           !!(conf->flags & IEEE80211_CONF_IDLE),
2193                           !!(conf->flags & IEEE80211_CONF_PS),
2194                           smps_modes[conf->smps_mode]);
2195         else
2196                 wiphy_dbg(hw->wiphy,
2197                           "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2198                           __func__,
2199                           !!(conf->flags & IEEE80211_CONF_IDLE),
2200                           !!(conf->flags & IEEE80211_CONF_PS),
2201                           smps_modes[conf->smps_mode]);
2202
2203         data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2204
2205         WARN_ON(conf->chandef.chan && data->use_chanctx);
2206
2207         mutex_lock(&data->mutex);
2208         if (data->scanning && conf->chandef.chan) {
2209                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2210                         if (data->survey_data[idx].channel == data->channel) {
2211                                 data->survey_data[idx].start =
2212                                         data->survey_data[idx].next_start;
2213                                 data->survey_data[idx].end = jiffies;
2214                                 break;
2215                         }
2216                 }
2217
2218                 data->channel = conf->chandef.chan;
2219                 data->bw = conf->chandef.width;
2220
2221                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2222                         if (data->survey_data[idx].channel &&
2223                             data->survey_data[idx].channel != data->channel)
2224                                 continue;
2225                         data->survey_data[idx].channel = data->channel;
2226                         data->survey_data[idx].next_start = jiffies;
2227                         break;
2228                 }
2229         } else {
2230                 data->channel = conf->chandef.chan;
2231                 data->bw = conf->chandef.width;
2232         }
2233         mutex_unlock(&data->mutex);
2234
2235         for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2236                 struct mac80211_hwsim_link_data *link_data =
2237                         &data->link_data[idx];
2238
2239                 if (!data->started || !link_data->beacon_int) {
2240                         hrtimer_cancel(&link_data->beacon_timer);
2241                 } else if (!hrtimer_is_queued(&link_data->beacon_timer)) {
2242                         u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2243                         u32 bcn_int = link_data->beacon_int;
2244                         u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2245
2246                         hrtimer_start(&link_data->beacon_timer,
2247                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2248                                       HRTIMER_MODE_REL_SOFT);
2249                 }
2250         }
2251
2252         return 0;
2253 }
2254
2255
2256 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2257                                             unsigned int changed_flags,
2258                                             unsigned int *total_flags,u64 multicast)
2259 {
2260         struct mac80211_hwsim_data *data = hw->priv;
2261
2262         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2263
2264         data->rx_filter = 0;
2265         if (*total_flags & FIF_ALLMULTI)
2266                 data->rx_filter |= FIF_ALLMULTI;
2267         if (*total_flags & FIF_MCAST_ACTION)
2268                 data->rx_filter |= FIF_MCAST_ACTION;
2269
2270         *total_flags = data->rx_filter;
2271 }
2272
2273 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2274                                        struct ieee80211_vif *vif)
2275 {
2276         unsigned int *count = data;
2277         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2278
2279         if (vp->bcn_en)
2280                 (*count)++;
2281 }
2282
2283 static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2284                                             struct ieee80211_vif *vif,
2285                                             u64 changed)
2286 {
2287         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2288
2289         hwsim_check_magic(vif);
2290
2291         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2292                   __func__, changed, vif->addr);
2293
2294         if (changed & BSS_CHANGED_ASSOC) {
2295                 wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2296                           vif->cfg.assoc, vif->cfg.aid);
2297                 vp->assoc = vif->cfg.assoc;
2298                 vp->aid = vif->cfg.aid;
2299         }
2300 }
2301
2302 static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2303                                              struct ieee80211_vif *vif,
2304                                              struct ieee80211_bss_conf *info,
2305                                              u64 changed)
2306 {
2307         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2308         struct mac80211_hwsim_data *data = hw->priv;
2309         unsigned int link_id = info->link_id;
2310         struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2311
2312         hwsim_check_magic(vif);
2313
2314         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2315                   __func__, (unsigned long long)changed, vif->addr, link_id);
2316
2317         if (changed & BSS_CHANGED_BSSID) {
2318                 wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2319                           __func__, info->bssid);
2320                 memcpy(vp->bssid, info->bssid, ETH_ALEN);
2321         }
2322
2323         if (changed & BSS_CHANGED_BEACON_ENABLED) {
2324                 wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2325                           info->enable_beacon, info->beacon_int);
2326                 vp->bcn_en = info->enable_beacon;
2327                 if (data->started &&
2328                     !hrtimer_is_queued(&link_data->beacon_timer) &&
2329                     info->enable_beacon) {
2330                         u64 tsf, until_tbtt;
2331                         u32 bcn_int;
2332                         link_data->beacon_int = info->beacon_int * 1024;
2333                         tsf = mac80211_hwsim_get_tsf(hw, vif);
2334                         bcn_int = link_data->beacon_int;
2335                         until_tbtt = bcn_int - do_div(tsf, bcn_int);
2336
2337                         hrtimer_start(&link_data->beacon_timer,
2338                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2339                                       HRTIMER_MODE_REL_SOFT);
2340                 } else if (!info->enable_beacon) {
2341                         unsigned int count = 0;
2342                         ieee80211_iterate_active_interfaces_atomic(
2343                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
2344                                 mac80211_hwsim_bcn_en_iter, &count);
2345                         wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2346                                   count);
2347                         if (count == 0) {
2348                                 hrtimer_cancel(&link_data->beacon_timer);
2349                                 link_data->beacon_int = 0;
2350                         }
2351                 }
2352         }
2353
2354         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2355                 wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2356                           info->use_cts_prot);
2357         }
2358
2359         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2360                 wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2361                           info->use_short_preamble);
2362         }
2363
2364         if (changed & BSS_CHANGED_ERP_SLOT) {
2365                 wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2366         }
2367
2368         if (changed & BSS_CHANGED_HT) {
2369                 wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2370                           info->ht_operation_mode);
2371         }
2372
2373         if (changed & BSS_CHANGED_BASIC_RATES) {
2374                 wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2375                           (unsigned long long) info->basic_rates);
2376         }
2377
2378         if (changed & BSS_CHANGED_TXPOWER)
2379                 wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2380 }
2381
2382 static void
2383 mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2384                              struct ieee80211_vif *vif,
2385                              struct ieee80211_sta *sta,
2386                              u32 changed)
2387 {
2388         struct mac80211_hwsim_data *data = hw->priv;
2389         u32 bw = U32_MAX;
2390         int link_id;
2391
2392         rcu_read_lock();
2393         for (link_id = 0;
2394              link_id < ARRAY_SIZE(vif->link_conf);
2395              link_id++) {
2396                 enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2397                 struct ieee80211_bss_conf *vif_conf;
2398                 struct ieee80211_link_sta *link_sta;
2399
2400                 link_sta = rcu_dereference(sta->link[link_id]);
2401
2402                 if (!link_sta)
2403                         continue;
2404
2405                 switch (link_sta->bandwidth) {
2406 #define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2407                 C(20);
2408                 C(40);
2409                 C(80);
2410                 C(160);
2411                 C(320);
2412 #undef C
2413                 }
2414
2415                 if (!data->use_chanctx) {
2416                         confbw = data->bw;
2417                 } else {
2418                         struct ieee80211_chanctx_conf *chanctx_conf;
2419
2420                         vif_conf = rcu_dereference(vif->link_conf[link_id]);
2421                         if (WARN_ON(!vif_conf))
2422                                 continue;
2423
2424                         chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2425
2426                         if (!WARN_ON(!chanctx_conf))
2427                                 confbw = chanctx_conf->def.width;
2428                 }
2429
2430                 WARN(bw > hwsim_get_chanwidth(confbw),
2431                      "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2432                      vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2433                      hwsim_get_chanwidth(data->bw), data->bw);
2434
2435
2436         }
2437         rcu_read_unlock();
2438
2439
2440 }
2441
2442 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2443                                   struct ieee80211_vif *vif,
2444                                   struct ieee80211_sta *sta)
2445 {
2446         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2447
2448         hwsim_check_magic(vif);
2449         hwsim_set_sta_magic(sta);
2450         mac80211_hwsim_sta_rc_update(hw, vif, sta, 0);
2451
2452         if (sta->valid_links) {
2453                 WARN(hweight16(sta->valid_links) > 1,
2454                      "expect to add STA with single link, have 0x%x\n",
2455                      sta->valid_links);
2456                 sp->active_links_rx = sta->valid_links;
2457         }
2458
2459         return 0;
2460 }
2461
2462 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2463                                      struct ieee80211_vif *vif,
2464                                      struct ieee80211_sta *sta)
2465 {
2466         hwsim_check_magic(vif);
2467         hwsim_clear_sta_magic(sta);
2468
2469         return 0;
2470 }
2471
2472 static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2473                                     struct ieee80211_vif *vif,
2474                                     struct ieee80211_sta *sta,
2475                                     enum ieee80211_sta_state old_state,
2476                                     enum ieee80211_sta_state new_state)
2477 {
2478         if (new_state == IEEE80211_STA_NOTEXIST)
2479                 return mac80211_hwsim_sta_remove(hw, vif, sta);
2480
2481         if (old_state == IEEE80211_STA_NOTEXIST)
2482                 return mac80211_hwsim_sta_add(hw, vif, sta);
2483
2484         /*
2485          * when client is authorized (AP station marked as such),
2486          * enable all links
2487          */
2488         if (vif->type == NL80211_IFTYPE_STATION &&
2489             new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2490                 ieee80211_set_active_links_async(vif, vif->valid_links);
2491
2492         return 0;
2493 }
2494
2495 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2496                                       struct ieee80211_vif *vif,
2497                                       enum sta_notify_cmd cmd,
2498                                       struct ieee80211_sta *sta)
2499 {
2500         hwsim_check_magic(vif);
2501
2502         switch (cmd) {
2503         case STA_NOTIFY_SLEEP:
2504         case STA_NOTIFY_AWAKE:
2505                 /* TODO: make good use of these flags */
2506                 break;
2507         default:
2508                 WARN(1, "Invalid sta notify: %d\n", cmd);
2509                 break;
2510         }
2511 }
2512
2513 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2514                                   struct ieee80211_sta *sta,
2515                                   bool set)
2516 {
2517         hwsim_check_sta_magic(sta);
2518         return 0;
2519 }
2520
2521 static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2522                                   struct ieee80211_vif *vif,
2523                                   unsigned int link_id, u16 queue,
2524                                   const struct ieee80211_tx_queue_params *params)
2525 {
2526         wiphy_dbg(hw->wiphy,
2527                   "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2528                   __func__, queue,
2529                   params->txop, params->cw_min,
2530                   params->cw_max, params->aifs);
2531         return 0;
2532 }
2533
2534 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2535                                      struct survey_info *survey)
2536 {
2537         struct mac80211_hwsim_data *hwsim = hw->priv;
2538
2539         if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2540                 return -ENOENT;
2541
2542         mutex_lock(&hwsim->mutex);
2543         survey->channel = hwsim->survey_data[idx].channel;
2544         if (!survey->channel) {
2545                 mutex_unlock(&hwsim->mutex);
2546                 return -ENOENT;
2547         }
2548
2549         /*
2550          * Magically conjured dummy values --- this is only ok for simulated hardware.
2551          *
2552          * A real driver which cannot determine real values noise MUST NOT
2553          * report any, especially not a magically conjured ones :-)
2554          */
2555         survey->filled = SURVEY_INFO_NOISE_DBM |
2556                          SURVEY_INFO_TIME |
2557                          SURVEY_INFO_TIME_BUSY;
2558         survey->noise = -92;
2559         survey->time =
2560                 jiffies_to_msecs(hwsim->survey_data[idx].end -
2561                                  hwsim->survey_data[idx].start);
2562         /* report 12.5% of channel time is used */
2563         survey->time_busy = survey->time/8;
2564         mutex_unlock(&hwsim->mutex);
2565
2566         return 0;
2567 }
2568
2569 #ifdef CONFIG_NL80211_TESTMODE
2570 /*
2571  * This section contains example code for using netlink
2572  * attributes with the testmode command in nl80211.
2573  */
2574
2575 /* These enums need to be kept in sync with userspace */
2576 enum hwsim_testmode_attr {
2577         __HWSIM_TM_ATTR_INVALID = 0,
2578         HWSIM_TM_ATTR_CMD       = 1,
2579         HWSIM_TM_ATTR_PS        = 2,
2580
2581         /* keep last */
2582         __HWSIM_TM_ATTR_AFTER_LAST,
2583         HWSIM_TM_ATTR_MAX       = __HWSIM_TM_ATTR_AFTER_LAST - 1
2584 };
2585
2586 enum hwsim_testmode_cmd {
2587         HWSIM_TM_CMD_SET_PS             = 0,
2588         HWSIM_TM_CMD_GET_PS             = 1,
2589         HWSIM_TM_CMD_STOP_QUEUES        = 2,
2590         HWSIM_TM_CMD_WAKE_QUEUES        = 3,
2591 };
2592
2593 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2594         [HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2595         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2596 };
2597
2598 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2599                                        struct ieee80211_vif *vif,
2600                                        void *data, int len)
2601 {
2602         struct mac80211_hwsim_data *hwsim = hw->priv;
2603         struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2604         struct sk_buff *skb;
2605         int err, ps;
2606
2607         err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2608                                    hwsim_testmode_policy, NULL);
2609         if (err)
2610                 return err;
2611
2612         if (!tb[HWSIM_TM_ATTR_CMD])
2613                 return -EINVAL;
2614
2615         switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2616         case HWSIM_TM_CMD_SET_PS:
2617                 if (!tb[HWSIM_TM_ATTR_PS])
2618                         return -EINVAL;
2619                 ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2620                 return hwsim_fops_ps_write(hwsim, ps);
2621         case HWSIM_TM_CMD_GET_PS:
2622                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2623                                                 nla_total_size(sizeof(u32)));
2624                 if (!skb)
2625                         return -ENOMEM;
2626                 if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2627                         goto nla_put_failure;
2628                 return cfg80211_testmode_reply(skb);
2629         case HWSIM_TM_CMD_STOP_QUEUES:
2630                 ieee80211_stop_queues(hw);
2631                 return 0;
2632         case HWSIM_TM_CMD_WAKE_QUEUES:
2633                 ieee80211_wake_queues(hw);
2634                 return 0;
2635         default:
2636                 return -EOPNOTSUPP;
2637         }
2638
2639  nla_put_failure:
2640         kfree_skb(skb);
2641         return -ENOBUFS;
2642 }
2643 #endif
2644
2645 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2646                                        struct ieee80211_vif *vif,
2647                                        struct ieee80211_ampdu_params *params)
2648 {
2649         struct ieee80211_sta *sta = params->sta;
2650         enum ieee80211_ampdu_mlme_action action = params->action;
2651         u16 tid = params->tid;
2652
2653         switch (action) {
2654         case IEEE80211_AMPDU_TX_START:
2655                 return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2656         case IEEE80211_AMPDU_TX_STOP_CONT:
2657         case IEEE80211_AMPDU_TX_STOP_FLUSH:
2658         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2659                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2660                 break;
2661         case IEEE80211_AMPDU_TX_OPERATIONAL:
2662                 break;
2663         case IEEE80211_AMPDU_RX_START:
2664         case IEEE80211_AMPDU_RX_STOP:
2665                 break;
2666         default:
2667                 return -EOPNOTSUPP;
2668         }
2669
2670         return 0;
2671 }
2672
2673 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2674                                  struct ieee80211_vif *vif,
2675                                  u32 queues, bool drop)
2676 {
2677         /* Not implemented, queues only on kernel side */
2678 }
2679
2680 static void hw_scan_work(struct work_struct *work)
2681 {
2682         struct mac80211_hwsim_data *hwsim =
2683                 container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2684         struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2685         int dwell, i;
2686
2687         mutex_lock(&hwsim->mutex);
2688         if (hwsim->scan_chan_idx >= req->n_channels) {
2689                 struct cfg80211_scan_info info = {
2690                         .aborted = false,
2691                 };
2692
2693                 wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2694                 ieee80211_scan_completed(hwsim->hw, &info);
2695                 hwsim->hw_scan_request = NULL;
2696                 hwsim->hw_scan_vif = NULL;
2697                 hwsim->tmp_chan = NULL;
2698                 mutex_unlock(&hwsim->mutex);
2699                 mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2700                                              false);
2701                 return;
2702         }
2703
2704         wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2705                   req->channels[hwsim->scan_chan_idx]->center_freq);
2706
2707         hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2708         if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2709                                       IEEE80211_CHAN_RADAR) ||
2710             !req->n_ssids) {
2711                 dwell = 120;
2712         } else {
2713                 dwell = 30;
2714                 /* send probes */
2715                 for (i = 0; i < req->n_ssids; i++) {
2716                         struct sk_buff *probe;
2717                         struct ieee80211_mgmt *mgmt;
2718
2719                         probe = ieee80211_probereq_get(hwsim->hw,
2720                                                        hwsim->scan_addr,
2721                                                        req->ssids[i].ssid,
2722                                                        req->ssids[i].ssid_len,
2723                                                        req->ie_len);
2724                         if (!probe)
2725                                 continue;
2726
2727                         mgmt = (struct ieee80211_mgmt *) probe->data;
2728                         memcpy(mgmt->da, req->bssid, ETH_ALEN);
2729                         memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2730
2731                         if (req->ie_len)
2732                                 skb_put_data(probe, req->ie, req->ie_len);
2733
2734                         rcu_read_lock();
2735                         if (!ieee80211_tx_prepare_skb(hwsim->hw,
2736                                                       hwsim->hw_scan_vif,
2737                                                       probe,
2738                                                       hwsim->tmp_chan->band,
2739                                                       NULL)) {
2740                                 rcu_read_unlock();
2741                                 kfree_skb(probe);
2742                                 continue;
2743                         }
2744
2745                         local_bh_disable();
2746                         mac80211_hwsim_tx_frame(hwsim->hw, probe,
2747                                                 hwsim->tmp_chan);
2748                         rcu_read_unlock();
2749                         local_bh_enable();
2750                 }
2751         }
2752         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2753                                      msecs_to_jiffies(dwell));
2754         hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2755         hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2756         hwsim->survey_data[hwsim->scan_chan_idx].end =
2757                 jiffies + msecs_to_jiffies(dwell);
2758         hwsim->scan_chan_idx++;
2759         mutex_unlock(&hwsim->mutex);
2760 }
2761
2762 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2763                                   struct ieee80211_vif *vif,
2764                                   struct ieee80211_scan_request *hw_req)
2765 {
2766         struct mac80211_hwsim_data *hwsim = hw->priv;
2767         struct cfg80211_scan_request *req = &hw_req->req;
2768
2769         mutex_lock(&hwsim->mutex);
2770         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2771                 mutex_unlock(&hwsim->mutex);
2772                 return -EBUSY;
2773         }
2774         hwsim->hw_scan_request = req;
2775         hwsim->hw_scan_vif = vif;
2776         hwsim->scan_chan_idx = 0;
2777         if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2778                 get_random_mask_addr(hwsim->scan_addr,
2779                                      hw_req->req.mac_addr,
2780                                      hw_req->req.mac_addr_mask);
2781         else
2782                 memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
2783         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2784         mutex_unlock(&hwsim->mutex);
2785
2786         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2787         wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
2788
2789         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
2790
2791         return 0;
2792 }
2793
2794 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
2795                                           struct ieee80211_vif *vif)
2796 {
2797         struct mac80211_hwsim_data *hwsim = hw->priv;
2798         struct cfg80211_scan_info info = {
2799                 .aborted = true,
2800         };
2801
2802         wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
2803
2804         cancel_delayed_work_sync(&hwsim->hw_scan);
2805
2806         mutex_lock(&hwsim->mutex);
2807         ieee80211_scan_completed(hwsim->hw, &info);
2808         hwsim->tmp_chan = NULL;
2809         hwsim->hw_scan_request = NULL;
2810         hwsim->hw_scan_vif = NULL;
2811         mutex_unlock(&hwsim->mutex);
2812 }
2813
2814 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
2815                                    struct ieee80211_vif *vif,
2816                                    const u8 *mac_addr)
2817 {
2818         struct mac80211_hwsim_data *hwsim = hw->priv;
2819
2820         mutex_lock(&hwsim->mutex);
2821
2822         if (hwsim->scanning) {
2823                 pr_debug("two hwsim sw_scans detected!\n");
2824                 goto out;
2825         }
2826
2827         pr_debug("hwsim sw_scan request, prepping stuff\n");
2828
2829         memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
2830         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2831         hwsim->scanning = true;
2832         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2833
2834 out:
2835         mutex_unlock(&hwsim->mutex);
2836 }
2837
2838 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
2839                                             struct ieee80211_vif *vif)
2840 {
2841         struct mac80211_hwsim_data *hwsim = hw->priv;
2842
2843         mutex_lock(&hwsim->mutex);
2844
2845         pr_debug("hwsim sw_scan_complete\n");
2846         hwsim->scanning = false;
2847         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
2848         eth_zero_addr(hwsim->scan_addr);
2849
2850         mutex_unlock(&hwsim->mutex);
2851 }
2852
2853 static void hw_roc_start(struct work_struct *work)
2854 {
2855         struct mac80211_hwsim_data *hwsim =
2856                 container_of(work, struct mac80211_hwsim_data, roc_start.work);
2857
2858         mutex_lock(&hwsim->mutex);
2859
2860         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
2861         hwsim->tmp_chan = hwsim->roc_chan;
2862         ieee80211_ready_on_channel(hwsim->hw);
2863
2864         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
2865                                      msecs_to_jiffies(hwsim->roc_duration));
2866
2867         mutex_unlock(&hwsim->mutex);
2868 }
2869
2870 static void hw_roc_done(struct work_struct *work)
2871 {
2872         struct mac80211_hwsim_data *hwsim =
2873                 container_of(work, struct mac80211_hwsim_data, roc_done.work);
2874
2875         mutex_lock(&hwsim->mutex);
2876         ieee80211_remain_on_channel_expired(hwsim->hw);
2877         hwsim->tmp_chan = NULL;
2878         mutex_unlock(&hwsim->mutex);
2879
2880         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
2881 }
2882
2883 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
2884                               struct ieee80211_vif *vif,
2885                               struct ieee80211_channel *chan,
2886                               int duration,
2887                               enum ieee80211_roc_type type)
2888 {
2889         struct mac80211_hwsim_data *hwsim = hw->priv;
2890
2891         mutex_lock(&hwsim->mutex);
2892         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2893                 mutex_unlock(&hwsim->mutex);
2894                 return -EBUSY;
2895         }
2896
2897         hwsim->roc_chan = chan;
2898         hwsim->roc_duration = duration;
2899         mutex_unlock(&hwsim->mutex);
2900
2901         wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
2902                   chan->center_freq, duration);
2903         ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
2904
2905         return 0;
2906 }
2907
2908 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
2909                                struct ieee80211_vif *vif)
2910 {
2911         struct mac80211_hwsim_data *hwsim = hw->priv;
2912
2913         cancel_delayed_work_sync(&hwsim->roc_start);
2914         cancel_delayed_work_sync(&hwsim->roc_done);
2915
2916         mutex_lock(&hwsim->mutex);
2917         hwsim->tmp_chan = NULL;
2918         mutex_unlock(&hwsim->mutex);
2919
2920         wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
2921
2922         return 0;
2923 }
2924
2925 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
2926                                       struct ieee80211_chanctx_conf *ctx)
2927 {
2928         hwsim_set_chanctx_magic(ctx);
2929         wiphy_dbg(hw->wiphy,
2930                   "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2931                   ctx->def.chan->center_freq, ctx->def.width,
2932                   ctx->def.center_freq1, ctx->def.center_freq2);
2933         return 0;
2934 }
2935
2936 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
2937                                           struct ieee80211_chanctx_conf *ctx)
2938 {
2939         wiphy_dbg(hw->wiphy,
2940                   "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2941                   ctx->def.chan->center_freq, ctx->def.width,
2942                   ctx->def.center_freq1, ctx->def.center_freq2);
2943         hwsim_check_chanctx_magic(ctx);
2944         hwsim_clear_chanctx_magic(ctx);
2945 }
2946
2947 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
2948                                           struct ieee80211_chanctx_conf *ctx,
2949                                           u32 changed)
2950 {
2951         hwsim_check_chanctx_magic(ctx);
2952         wiphy_dbg(hw->wiphy,
2953                   "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
2954                   ctx->def.chan->center_freq, ctx->def.width,
2955                   ctx->def.center_freq1, ctx->def.center_freq2);
2956 }
2957
2958 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
2959                                              struct ieee80211_vif *vif,
2960                                              struct ieee80211_bss_conf *link_conf,
2961                                              struct ieee80211_chanctx_conf *ctx)
2962 {
2963         hwsim_check_magic(vif);
2964         hwsim_check_chanctx_magic(ctx);
2965
2966         /* if we activate a link while already associated wake it up */
2967         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
2968                 struct sk_buff *skb;
2969
2970                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
2971                 if (skb) {
2972                         local_bh_disable();
2973                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
2974                         local_bh_enable();
2975                 }
2976         }
2977
2978         return 0;
2979 }
2980
2981 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
2982                                                 struct ieee80211_vif *vif,
2983                                                 struct ieee80211_bss_conf *link_conf,
2984                                                 struct ieee80211_chanctx_conf *ctx)
2985 {
2986         hwsim_check_magic(vif);
2987         hwsim_check_chanctx_magic(ctx);
2988
2989         /* if we deactivate a link while associated suspend it first */
2990         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
2991                 struct sk_buff *skb;
2992
2993                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
2994                 if (skb) {
2995                         struct ieee80211_hdr *hdr = (void *)skb->data;
2996
2997                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
2998
2999                         local_bh_disable();
3000                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3001                         local_bh_enable();
3002                 }
3003         }
3004 }
3005
3006 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3007         "tx_pkts_nic",
3008         "tx_bytes_nic",
3009         "rx_pkts_nic",
3010         "rx_bytes_nic",
3011         "d_tx_dropped",
3012         "d_tx_failed",
3013         "d_ps_mode",
3014         "d_group",
3015 };
3016
3017 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3018
3019 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3020                                           struct ieee80211_vif *vif,
3021                                           u32 sset, u8 *data)
3022 {
3023         if (sset == ETH_SS_STATS)
3024                 memcpy(data, *mac80211_hwsim_gstrings_stats,
3025                        sizeof(mac80211_hwsim_gstrings_stats));
3026 }
3027
3028 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3029                                             struct ieee80211_vif *vif, int sset)
3030 {
3031         if (sset == ETH_SS_STATS)
3032                 return MAC80211_HWSIM_SSTATS_LEN;
3033         return 0;
3034 }
3035
3036 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3037                                         struct ieee80211_vif *vif,
3038                                         struct ethtool_stats *stats, u64 *data)
3039 {
3040         struct mac80211_hwsim_data *ar = hw->priv;
3041         int i = 0;
3042
3043         data[i++] = ar->tx_pkts;
3044         data[i++] = ar->tx_bytes;
3045         data[i++] = ar->rx_pkts;
3046         data[i++] = ar->rx_bytes;
3047         data[i++] = ar->tx_dropped;
3048         data[i++] = ar->tx_failed;
3049         data[i++] = ar->ps;
3050         data[i++] = ar->group;
3051
3052         WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3053 }
3054
3055 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3056 {
3057         return 1;
3058 }
3059
3060 static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3061 {
3062         return -EOPNOTSUPP;
3063 }
3064
3065 static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3066                                            struct ieee80211_vif *vif,
3067                                            u16 old_links, u16 new_links,
3068                                            struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3069 {
3070         unsigned long rem = old_links & ~new_links;
3071         unsigned long add = new_links & ~old_links;
3072         int i;
3073
3074         if (!old_links)
3075                 rem |= BIT(0);
3076         if (!new_links)
3077                 add |= BIT(0);
3078
3079         for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS)
3080                 mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3081
3082         for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3083                 struct ieee80211_bss_conf *link_conf;
3084
3085                 link_conf = link_conf_dereference_protected(vif, i);
3086                 if (WARN_ON(!link_conf))
3087                         continue;
3088
3089                 mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3090         }
3091
3092         return 0;
3093 }
3094
3095 static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3096                                            struct ieee80211_vif *vif,
3097                                            struct ieee80211_sta *sta,
3098                                            u16 old_links, u16 new_links)
3099 {
3100         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3101
3102         hwsim_check_sta_magic(sta);
3103
3104         if (vif->type == NL80211_IFTYPE_STATION)
3105                 sp->active_links_rx = new_links;
3106
3107         return 0;
3108 }
3109
3110 #define HWSIM_COMMON_OPS                                        \
3111         .tx = mac80211_hwsim_tx,                                \
3112         .wake_tx_queue = ieee80211_handle_wake_tx_queue,        \
3113         .start = mac80211_hwsim_start,                          \
3114         .stop = mac80211_hwsim_stop,                            \
3115         .add_interface = mac80211_hwsim_add_interface,          \
3116         .change_interface = mac80211_hwsim_change_interface,    \
3117         .remove_interface = mac80211_hwsim_remove_interface,    \
3118         .config = mac80211_hwsim_config,                        \
3119         .configure_filter = mac80211_hwsim_configure_filter,    \
3120         .vif_cfg_changed = mac80211_hwsim_vif_info_changed,     \
3121         .link_info_changed = mac80211_hwsim_link_info_changed,  \
3122         .tx_last_beacon = mac80211_hwsim_tx_last_beacon,        \
3123         .sta_notify = mac80211_hwsim_sta_notify,                \
3124         .sta_rc_update = mac80211_hwsim_sta_rc_update,          \
3125         .conf_tx = mac80211_hwsim_conf_tx,                      \
3126         .get_survey = mac80211_hwsim_get_survey,                \
3127         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)      \
3128         .ampdu_action = mac80211_hwsim_ampdu_action,            \
3129         .flush = mac80211_hwsim_flush,                          \
3130         .get_et_sset_count = mac80211_hwsim_get_et_sset_count,  \
3131         .get_et_stats = mac80211_hwsim_get_et_stats,            \
3132         .get_et_strings = mac80211_hwsim_get_et_strings,
3133
3134 #define HWSIM_NON_MLO_OPS                                       \
3135         .sta_add = mac80211_hwsim_sta_add,                      \
3136         .sta_remove = mac80211_hwsim_sta_remove,                \
3137         .set_tim = mac80211_hwsim_set_tim,                      \
3138         .get_tsf = mac80211_hwsim_get_tsf,                      \
3139         .set_tsf = mac80211_hwsim_set_tsf,
3140
3141 static const struct ieee80211_ops mac80211_hwsim_ops = {
3142         HWSIM_COMMON_OPS
3143         HWSIM_NON_MLO_OPS
3144         .sw_scan_start = mac80211_hwsim_sw_scan,
3145         .sw_scan_complete = mac80211_hwsim_sw_scan_complete,
3146 };
3147
3148 #define HWSIM_CHANCTX_OPS                                       \
3149         .hw_scan = mac80211_hwsim_hw_scan,                      \
3150         .cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,        \
3151         .remain_on_channel = mac80211_hwsim_roc,                \
3152         .cancel_remain_on_channel = mac80211_hwsim_croc,        \
3153         .add_chanctx = mac80211_hwsim_add_chanctx,              \
3154         .remove_chanctx = mac80211_hwsim_remove_chanctx,        \
3155         .change_chanctx = mac80211_hwsim_change_chanctx,        \
3156         .assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
3157         .unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx,
3158
3159 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
3160         HWSIM_COMMON_OPS
3161         HWSIM_NON_MLO_OPS
3162         HWSIM_CHANCTX_OPS
3163 };
3164
3165 static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
3166         HWSIM_COMMON_OPS
3167         HWSIM_CHANCTX_OPS
3168         .set_rts_threshold = mac80211_hwsim_set_rts_threshold,
3169         .change_vif_links = mac80211_hwsim_change_vif_links,
3170         .change_sta_links = mac80211_hwsim_change_sta_links,
3171         .sta_state = mac80211_hwsim_sta_state,
3172 };
3173
3174 struct hwsim_new_radio_params {
3175         unsigned int channels;
3176         const char *reg_alpha2;
3177         const struct ieee80211_regdomain *regd;
3178         bool reg_strict;
3179         bool p2p_device;
3180         bool use_chanctx;
3181         bool destroy_on_close;
3182         const char *hwname;
3183         bool no_vif;
3184         const u8 *perm_addr;
3185         u32 iftypes;
3186         u32 *ciphers;
3187         u8 n_ciphers;
3188         bool mlo;
3189 };
3190
3191 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
3192                                    struct genl_info *info)
3193 {
3194         if (info)
3195                 genl_notify(&hwsim_genl_family, mcast_skb, info,
3196                             HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3197         else
3198                 genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
3199                                   HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3200 }
3201
3202 static int append_radio_msg(struct sk_buff *skb, int id,
3203                             struct hwsim_new_radio_params *param)
3204 {
3205         int ret;
3206
3207         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
3208         if (ret < 0)
3209                 return ret;
3210
3211         if (param->channels) {
3212                 ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
3213                 if (ret < 0)
3214                         return ret;
3215         }
3216
3217         if (param->reg_alpha2) {
3218                 ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
3219                               param->reg_alpha2);
3220                 if (ret < 0)
3221                         return ret;
3222         }
3223
3224         if (param->regd) {
3225                 int i;
3226
3227                 for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
3228                         if (hwsim_world_regdom_custom[i] != param->regd)
3229                                 continue;
3230
3231                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
3232                         if (ret < 0)
3233                                 return ret;
3234                         break;
3235                 }
3236         }
3237
3238         if (param->reg_strict) {
3239                 ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
3240                 if (ret < 0)
3241                         return ret;
3242         }
3243
3244         if (param->p2p_device) {
3245                 ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
3246                 if (ret < 0)
3247                         return ret;
3248         }
3249
3250         if (param->use_chanctx) {
3251                 ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
3252                 if (ret < 0)
3253                         return ret;
3254         }
3255
3256         if (param->hwname) {
3257                 ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
3258                               strlen(param->hwname), param->hwname);
3259                 if (ret < 0)
3260                         return ret;
3261         }
3262
3263         return 0;
3264 }
3265
3266 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
3267                                   struct hwsim_new_radio_params *param)
3268 {
3269         struct sk_buff *mcast_skb;
3270         void *data;
3271
3272         mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3273         if (!mcast_skb)
3274                 return;
3275
3276         data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
3277                            HWSIM_CMD_NEW_RADIO);
3278         if (!data)
3279                 goto out_err;
3280
3281         if (append_radio_msg(mcast_skb, id, param) < 0)
3282                 goto out_err;
3283
3284         genlmsg_end(mcast_skb, data);
3285
3286         hwsim_mcast_config_msg(mcast_skb, info);
3287         return;
3288
3289 out_err:
3290         nlmsg_free(mcast_skb);
3291 }
3292
3293 static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
3294         {
3295                 .types_mask = BIT(NL80211_IFTYPE_STATION),
3296                 .he_cap = {
3297                         .has_he = true,
3298                         .he_cap_elem = {
3299                                 .mac_cap_info[0] =
3300                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3301                                 .mac_cap_info[1] =
3302                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3303                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3304                                 .mac_cap_info[2] =
3305                                         IEEE80211_HE_MAC_CAP2_BSR |
3306                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3307                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3308                                 .mac_cap_info[3] =
3309                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3310                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3311                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3312                                 .phy_cap_info[1] =
3313                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3314                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3315                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3316                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3317                                 .phy_cap_info[2] =
3318                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3319                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3320                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3321                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3322                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3323
3324                                 /* Leave all the other PHY capability bytes
3325                                  * unset, as DCM, beam forming, RU and PPE
3326                                  * threshold information are not supported
3327                                  */
3328                         },
3329                         .he_mcs_nss_supp = {
3330                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3331                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3332                                 .rx_mcs_160 = cpu_to_le16(0xffff),
3333                                 .tx_mcs_160 = cpu_to_le16(0xffff),
3334                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
3335                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
3336                         },
3337                 },
3338                 .eht_cap = {
3339                         .has_eht = true,
3340                         .eht_cap_elem = {
3341                                 .mac_cap_info[0] =
3342                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3343                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3344                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3345                                 .phy_cap_info[0] =
3346                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3347                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3348                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3349                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3350                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
3351                                 .phy_cap_info[3] =
3352                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3353                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3354                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3355                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3356                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3357                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3358                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3359                                 .phy_cap_info[4] =
3360                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3361                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3362                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3363                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3364                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3365                                 .phy_cap_info[5] =
3366                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3367                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3368                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3369                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3370                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3371                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3372                                 .phy_cap_info[6] =
3373                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3374                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3375                                 .phy_cap_info[7] =
3376                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
3377                         },
3378
3379                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3380                          * Rx
3381                          */
3382                         .eht_mcs_nss_supp = {
3383                                 /*
3384                                  * Since B0, B1, B2 and B3 are not set in
3385                                  * the supported channel width set field in the
3386                                  * HE PHY capabilities information field the
3387                                  * device is a 20MHz only device on 2.4GHz band.
3388                                  */
3389                                 .only_20mhz = {
3390                                         .rx_tx_mcs7_max_nss = 0x88,
3391                                         .rx_tx_mcs9_max_nss = 0x88,
3392                                         .rx_tx_mcs11_max_nss = 0x88,
3393                                         .rx_tx_mcs13_max_nss = 0x88,
3394                                 },
3395                         },
3396                         /* PPE threshold information is not supported */
3397                 },
3398         },
3399         {
3400                 .types_mask = BIT(NL80211_IFTYPE_AP),
3401                 .he_cap = {
3402                         .has_he = true,
3403                         .he_cap_elem = {
3404                                 .mac_cap_info[0] =
3405                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3406                                 .mac_cap_info[1] =
3407                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3408                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3409                                 .mac_cap_info[2] =
3410                                         IEEE80211_HE_MAC_CAP2_BSR |
3411                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3412                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3413                                 .mac_cap_info[3] =
3414                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3415                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3416                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3417                                 .phy_cap_info[1] =
3418                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3419                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3420                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3421                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3422                                 .phy_cap_info[2] =
3423                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3424                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3425                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3426                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3427                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3428
3429                                 /* Leave all the other PHY capability bytes
3430                                  * unset, as DCM, beam forming, RU and PPE
3431                                  * threshold information are not supported
3432                                  */
3433                         },
3434                         .he_mcs_nss_supp = {
3435                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3436                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3437                                 .rx_mcs_160 = cpu_to_le16(0xffff),
3438                                 .tx_mcs_160 = cpu_to_le16(0xffff),
3439                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
3440                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
3441                         },
3442                 },
3443                 .eht_cap = {
3444                         .has_eht = true,
3445                         .eht_cap_elem = {
3446                                 .mac_cap_info[0] =
3447                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3448                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3449                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3450                                 .phy_cap_info[0] =
3451                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3452                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3453                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3454                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3455                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
3456                                 .phy_cap_info[3] =
3457                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3458                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3459                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3460                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3461                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3462                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3463                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3464                                 .phy_cap_info[4] =
3465                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3466                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3467                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3468                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3469                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3470                                 .phy_cap_info[5] =
3471                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3472                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3473                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3474                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3475                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3476                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3477                                 .phy_cap_info[6] =
3478                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3479                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3480                                 .phy_cap_info[7] =
3481                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
3482                         },
3483
3484                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3485                          * Rx
3486                          */
3487                         .eht_mcs_nss_supp = {
3488                                 /*
3489                                  * Since B0, B1, B2 and B3 are not set in
3490                                  * the supported channel width set field in the
3491                                  * HE PHY capabilities information field the
3492                                  * device is a 20MHz only device on 2.4GHz band.
3493                                  */
3494                                 .only_20mhz = {
3495                                         .rx_tx_mcs7_max_nss = 0x88,
3496                                         .rx_tx_mcs9_max_nss = 0x88,
3497                                         .rx_tx_mcs11_max_nss = 0x88,
3498                                         .rx_tx_mcs13_max_nss = 0x88,
3499                                 },
3500                         },
3501                         /* PPE threshold information is not supported */
3502                 },
3503         },
3504 #ifdef CONFIG_MAC80211_MESH
3505         {
3506                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
3507                 .he_cap = {
3508                         .has_he = true,
3509                         .he_cap_elem = {
3510                                 .mac_cap_info[0] =
3511                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3512                                 .mac_cap_info[1] =
3513                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3514                                 .mac_cap_info[2] =
3515                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3516                                 .mac_cap_info[3] =
3517                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3518                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3519                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3520                                 .phy_cap_info[1] =
3521                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3522                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3523                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3524                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3525                                 .phy_cap_info[2] = 0,
3526
3527                                 /* Leave all the other PHY capability bytes
3528                                  * unset, as DCM, beam forming, RU and PPE
3529                                  * threshold information are not supported
3530                                  */
3531                         },
3532                         .he_mcs_nss_supp = {
3533                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3534                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3535                                 .rx_mcs_160 = cpu_to_le16(0xffff),
3536                                 .tx_mcs_160 = cpu_to_le16(0xffff),
3537                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
3538                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
3539                         },
3540                 },
3541         },
3542 #endif
3543 };
3544
3545 static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
3546         {
3547                 /* TODO: should we support other types, e.g., P2P? */
3548                 .types_mask = BIT(NL80211_IFTYPE_STATION),
3549                 .he_cap = {
3550                         .has_he = true,
3551                         .he_cap_elem = {
3552                                 .mac_cap_info[0] =
3553                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3554                                 .mac_cap_info[1] =
3555                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3556                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3557                                 .mac_cap_info[2] =
3558                                         IEEE80211_HE_MAC_CAP2_BSR |
3559                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3560                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3561                                 .mac_cap_info[3] =
3562                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3563                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3564                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3565                                 .phy_cap_info[0] =
3566                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3567                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3568                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3569                                 .phy_cap_info[1] =
3570                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3571                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3572                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3573                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3574                                 .phy_cap_info[2] =
3575                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3576                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3577                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3578                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3579                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3580
3581                                 /* Leave all the other PHY capability bytes
3582                                  * unset, as DCM, beam forming, RU and PPE
3583                                  * threshold information are not supported
3584                                  */
3585                         },
3586                         .he_mcs_nss_supp = {
3587                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3588                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3589                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3590                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3591                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3592                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3593                         },
3594                 },
3595                 .eht_cap = {
3596                         .has_eht = true,
3597                         .eht_cap_elem = {
3598                                 .mac_cap_info[0] =
3599                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3600                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3601                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3602                                 .phy_cap_info[0] =
3603                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3604                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3605                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3606                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3607                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3608                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3609                                 .phy_cap_info[1] =
3610                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3611                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
3612                                 .phy_cap_info[2] =
3613                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3614                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
3615                                 .phy_cap_info[3] =
3616                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3617                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3618                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3619                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3620                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3621                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3622                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3623                                 .phy_cap_info[4] =
3624                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3625                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3626                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3627                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3628                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3629                                 .phy_cap_info[5] =
3630                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3631                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3632                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3633                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3634                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3635                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3636                                 .phy_cap_info[6] =
3637                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3638                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3639                                 .phy_cap_info[7] =
3640                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3641                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3642                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3643                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3644                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
3645                         },
3646
3647                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3648                          * Rx
3649                          */
3650                         .eht_mcs_nss_supp = {
3651                                 /*
3652                                  * As B1 and B2 are set in the supported
3653                                  * channel width set field in the HE PHY
3654                                  * capabilities information field include all
3655                                  * the following MCS/NSS.
3656                                  */
3657                                 .bw._80 = {
3658                                         .rx_tx_mcs9_max_nss = 0x88,
3659                                         .rx_tx_mcs11_max_nss = 0x88,
3660                                         .rx_tx_mcs13_max_nss = 0x88,
3661                                 },
3662                                 .bw._160 = {
3663                                         .rx_tx_mcs9_max_nss = 0x88,
3664                                         .rx_tx_mcs11_max_nss = 0x88,
3665                                         .rx_tx_mcs13_max_nss = 0x88,
3666                                 },
3667                         },
3668                         /* PPE threshold information is not supported */
3669                 },
3670         },
3671         {
3672                 .types_mask = BIT(NL80211_IFTYPE_AP),
3673                 .he_cap = {
3674                         .has_he = true,
3675                         .he_cap_elem = {
3676                                 .mac_cap_info[0] =
3677                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3678                                 .mac_cap_info[1] =
3679                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3680                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3681                                 .mac_cap_info[2] =
3682                                         IEEE80211_HE_MAC_CAP2_BSR |
3683                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3684                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3685                                 .mac_cap_info[3] =
3686                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3687                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3688                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3689                                 .phy_cap_info[0] =
3690                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3691                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3692                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3693                                 .phy_cap_info[1] =
3694                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3695                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3696                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3697                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3698                                 .phy_cap_info[2] =
3699                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3700                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3701                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3702                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3703                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3704
3705                                 /* Leave all the other PHY capability bytes
3706                                  * unset, as DCM, beam forming, RU and PPE
3707                                  * threshold information are not supported
3708                                  */
3709                         },
3710                         .he_mcs_nss_supp = {
3711                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3712                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3713                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3714                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3715                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3716                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3717                         },
3718                 },
3719                 .eht_cap = {
3720                         .has_eht = true,
3721                         .eht_cap_elem = {
3722                                 .mac_cap_info[0] =
3723                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3724                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3725                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3726                                 .phy_cap_info[0] =
3727                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3728                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3729                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3730                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3731                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3732                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3733                                 .phy_cap_info[1] =
3734                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3735                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
3736                                 .phy_cap_info[2] =
3737                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3738                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
3739                                 .phy_cap_info[3] =
3740                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3741                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3742                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3743                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3744                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3745                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3746                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3747                                 .phy_cap_info[4] =
3748                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3749                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3750                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3751                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3752                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3753                                 .phy_cap_info[5] =
3754                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3755                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3756                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3757                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3758                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3759                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3760                                 .phy_cap_info[6] =
3761                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3762                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
3763                                 .phy_cap_info[7] =
3764                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3765                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3766                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3767                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3768                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
3769                         },
3770
3771                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3772                          * Rx
3773                          */
3774                         .eht_mcs_nss_supp = {
3775                                 /*
3776                                  * As B1 and B2 are set in the supported
3777                                  * channel width set field in the HE PHY
3778                                  * capabilities information field include all
3779                                  * the following MCS/NSS.
3780                                  */
3781                                 .bw._80 = {
3782                                         .rx_tx_mcs9_max_nss = 0x88,
3783                                         .rx_tx_mcs11_max_nss = 0x88,
3784                                         .rx_tx_mcs13_max_nss = 0x88,
3785                                 },
3786                                 .bw._160 = {
3787                                         .rx_tx_mcs9_max_nss = 0x88,
3788                                         .rx_tx_mcs11_max_nss = 0x88,
3789                                         .rx_tx_mcs13_max_nss = 0x88,
3790                                 },
3791                         },
3792                         /* PPE threshold information is not supported */
3793                 },
3794         },
3795 #ifdef CONFIG_MAC80211_MESH
3796         {
3797                 /* TODO: should we support other types, e.g., IBSS?*/
3798                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
3799                 .he_cap = {
3800                         .has_he = true,
3801                         .he_cap_elem = {
3802                                 .mac_cap_info[0] =
3803                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3804                                 .mac_cap_info[1] =
3805                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3806                                 .mac_cap_info[2] =
3807                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3808                                 .mac_cap_info[3] =
3809                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3810                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3811                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3812                                 .phy_cap_info[0] =
3813                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3814                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3815                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3816                                 .phy_cap_info[1] =
3817                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3818                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3819                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3820                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3821                                 .phy_cap_info[2] = 0,
3822
3823                                 /* Leave all the other PHY capability bytes
3824                                  * unset, as DCM, beam forming, RU and PPE
3825                                  * threshold information are not supported
3826                                  */
3827                         },
3828                         .he_mcs_nss_supp = {
3829                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3830                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3831                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3832                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3833                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3834                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3835                         },
3836                 },
3837         },
3838 #endif
3839 };
3840
3841 static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
3842         {
3843                 /* TODO: should we support other types, e.g., P2P? */
3844                 .types_mask = BIT(NL80211_IFTYPE_STATION),
3845                 .he_6ghz_capa = {
3846                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
3847                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
3848                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
3849                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
3850                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
3851                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
3852                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
3853                 },
3854                 .he_cap = {
3855                         .has_he = true,
3856                         .he_cap_elem = {
3857                                 .mac_cap_info[0] =
3858                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
3859                                 .mac_cap_info[1] =
3860                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
3861                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
3862                                 .mac_cap_info[2] =
3863                                         IEEE80211_HE_MAC_CAP2_BSR |
3864                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
3865                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
3866                                 .mac_cap_info[3] =
3867                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
3868                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
3869                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
3870                                 .phy_cap_info[0] =
3871                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3872                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
3873                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
3874                                 .phy_cap_info[1] =
3875                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
3876                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
3877                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
3878                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
3879                                 .phy_cap_info[2] =
3880                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
3881                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
3882                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
3883                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
3884                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
3885
3886                                 /* Leave all the other PHY capability bytes
3887                                  * unset, as DCM, beam forming, RU and PPE
3888                                  * threshold information are not supported
3889                                  */
3890                         },
3891                         .he_mcs_nss_supp = {
3892                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
3893                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
3894                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
3895                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
3896                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
3897                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
3898                         },
3899                 },
3900                 .eht_cap = {
3901                         .has_eht = true,
3902                         .eht_cap_elem = {
3903                                 .mac_cap_info[0] =
3904                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
3905                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
3906                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
3907                                 .phy_cap_info[0] =
3908                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
3909                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
3910                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
3911                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
3912                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
3913                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
3914                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
3915                                 .phy_cap_info[1] =
3916                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
3917                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
3918                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
3919                                 .phy_cap_info[2] =
3920                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
3921                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
3922                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
3923                                 .phy_cap_info[3] =
3924                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
3925                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
3926                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
3927                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
3928                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
3929                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
3930                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
3931                                 .phy_cap_info[4] =
3932                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
3933                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
3934                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
3935                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
3936                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
3937                                 .phy_cap_info[5] =
3938                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
3939                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
3940                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
3941                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
3942                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
3943                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
3944                                 .phy_cap_info[6] =
3945                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
3946                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
3947                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
3948                                 .phy_cap_info[7] =
3949                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
3950                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
3951                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
3952                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
3953                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
3954                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
3955                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
3956                         },
3957
3958                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
3959                          * Rx
3960                          */
3961                         .eht_mcs_nss_supp = {
3962                                 /*
3963                                  * As B1 and B2 are set in the supported
3964                                  * channel width set field in the HE PHY
3965                                  * capabilities information field and 320MHz in
3966                                  * 6GHz is supported include all the following
3967                                  * MCS/NSS.
3968                                  */
3969                                 .bw._80 = {
3970                                         .rx_tx_mcs9_max_nss = 0x88,
3971                                         .rx_tx_mcs11_max_nss = 0x88,
3972                                         .rx_tx_mcs13_max_nss = 0x88,
3973                                 },
3974                                 .bw._160 = {
3975                                         .rx_tx_mcs9_max_nss = 0x88,
3976                                         .rx_tx_mcs11_max_nss = 0x88,
3977                                         .rx_tx_mcs13_max_nss = 0x88,
3978                                 },
3979                                 .bw._320 = {
3980                                         .rx_tx_mcs9_max_nss = 0x88,
3981                                         .rx_tx_mcs11_max_nss = 0x88,
3982                                         .rx_tx_mcs13_max_nss = 0x88,
3983                                 },
3984                         },
3985                         /* PPE threshold information is not supported */
3986                 },
3987         },
3988         {
3989                 .types_mask = BIT(NL80211_IFTYPE_AP),
3990                 .he_6ghz_capa = {
3991                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
3992                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
3993                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
3994                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
3995                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
3996                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
3997                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
3998                 },
3999                 .he_cap = {
4000                         .has_he = true,
4001                         .he_cap_elem = {
4002                                 .mac_cap_info[0] =
4003                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4004                                 .mac_cap_info[1] =
4005                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4006                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4007                                 .mac_cap_info[2] =
4008                                         IEEE80211_HE_MAC_CAP2_BSR |
4009                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4010                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4011                                 .mac_cap_info[3] =
4012                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4013                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4014                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4015                                 .phy_cap_info[0] =
4016                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4017                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4018                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4019                                 .phy_cap_info[1] =
4020                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4021                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4022                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4023                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4024                                 .phy_cap_info[2] =
4025                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4026                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4027                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4028                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4029                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4030
4031                                 /* Leave all the other PHY capability bytes
4032                                  * unset, as DCM, beam forming, RU and PPE
4033                                  * threshold information are not supported
4034                                  */
4035                         },
4036                         .he_mcs_nss_supp = {
4037                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4038                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4039                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4040                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4041                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4042                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4043                         },
4044                 },
4045                 .eht_cap = {
4046                         .has_eht = true,
4047                         .eht_cap_elem = {
4048                                 .mac_cap_info[0] =
4049                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4050                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4051                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4052                                 .phy_cap_info[0] =
4053                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4054                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4055                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4056                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4057                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4058                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4059                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4060                                 .phy_cap_info[1] =
4061                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4062                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4063                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4064                                 .phy_cap_info[2] =
4065                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4066                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4067                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4068                                 .phy_cap_info[3] =
4069                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4070                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4071                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4072                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4073                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4074                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4075                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4076                                 .phy_cap_info[4] =
4077                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4078                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4079                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4080                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4081                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4082                                 .phy_cap_info[5] =
4083                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4084                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4085                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4086                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4087                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4088                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4089                                 .phy_cap_info[6] =
4090                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4091                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4092                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4093                                 .phy_cap_info[7] =
4094                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4095                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4096                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4097                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4098                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4099                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4100                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4101                         },
4102
4103                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4104                          * Rx
4105                          */
4106                         .eht_mcs_nss_supp = {
4107                                 /*
4108                                  * As B1 and B2 are set in the supported
4109                                  * channel width set field in the HE PHY
4110                                  * capabilities information field and 320MHz in
4111                                  * 6GHz is supported include all the following
4112                                  * MCS/NSS.
4113                                  */
4114                                 .bw._80 = {
4115                                         .rx_tx_mcs9_max_nss = 0x88,
4116                                         .rx_tx_mcs11_max_nss = 0x88,
4117                                         .rx_tx_mcs13_max_nss = 0x88,
4118                                 },
4119                                 .bw._160 = {
4120                                         .rx_tx_mcs9_max_nss = 0x88,
4121                                         .rx_tx_mcs11_max_nss = 0x88,
4122                                         .rx_tx_mcs13_max_nss = 0x88,
4123                                 },
4124                                 .bw._320 = {
4125                                         .rx_tx_mcs9_max_nss = 0x88,
4126                                         .rx_tx_mcs11_max_nss = 0x88,
4127                                         .rx_tx_mcs13_max_nss = 0x88,
4128                                 },
4129                         },
4130                         /* PPE threshold information is not supported */
4131                 },
4132         },
4133 #ifdef CONFIG_MAC80211_MESH
4134         {
4135                 /* TODO: should we support other types, e.g., IBSS?*/
4136                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4137                 .he_6ghz_capa = {
4138                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4139                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4140                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4141                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4142                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4143                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4144                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4145                 },
4146                 .he_cap = {
4147                         .has_he = true,
4148                         .he_cap_elem = {
4149                                 .mac_cap_info[0] =
4150                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4151                                 .mac_cap_info[1] =
4152                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4153                                 .mac_cap_info[2] =
4154                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4155                                 .mac_cap_info[3] =
4156                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4157                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4158                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4159                                 .phy_cap_info[0] =
4160                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4161                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4162                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4163                                 .phy_cap_info[1] =
4164                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4165                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4166                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4167                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4168                                 .phy_cap_info[2] = 0,
4169
4170                                 /* Leave all the other PHY capability bytes
4171                                  * unset, as DCM, beam forming, RU and PPE
4172                                  * threshold information are not supported
4173                                  */
4174                         },
4175                         .he_mcs_nss_supp = {
4176                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4177                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4178                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4179                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4180                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4181                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4182                         },
4183                 },
4184         },
4185 #endif
4186 };
4187
4188 static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
4189 {
4190         u16 n_iftype_data;
4191
4192         if (sband->band == NL80211_BAND_2GHZ) {
4193                 n_iftype_data = ARRAY_SIZE(sband_capa_2ghz);
4194                 sband->iftype_data =
4195                         (struct ieee80211_sband_iftype_data *)sband_capa_2ghz;
4196         } else if (sband->band == NL80211_BAND_5GHZ) {
4197                 n_iftype_data = ARRAY_SIZE(sband_capa_5ghz);
4198                 sband->iftype_data =
4199                         (struct ieee80211_sband_iftype_data *)sband_capa_5ghz;
4200         } else if (sband->band == NL80211_BAND_6GHZ) {
4201                 n_iftype_data = ARRAY_SIZE(sband_capa_6ghz);
4202                 sband->iftype_data =
4203                         (struct ieee80211_sband_iftype_data *)sband_capa_6ghz;
4204         } else {
4205                 return;
4206         }
4207
4208         sband->n_iftype_data = n_iftype_data;
4209 }
4210
4211 #ifdef CONFIG_MAC80211_MESH
4212 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
4213 #else
4214 #define HWSIM_MESH_BIT 0
4215 #endif
4216
4217 #define HWSIM_DEFAULT_IF_LIMIT \
4218         (BIT(NL80211_IFTYPE_STATION) | \
4219          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4220          BIT(NL80211_IFTYPE_AP) | \
4221          BIT(NL80211_IFTYPE_P2P_GO) | \
4222          HWSIM_MESH_BIT)
4223
4224 #define HWSIM_IFTYPE_SUPPORT_MASK \
4225         (BIT(NL80211_IFTYPE_STATION) | \
4226          BIT(NL80211_IFTYPE_AP) | \
4227          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4228          BIT(NL80211_IFTYPE_P2P_GO) | \
4229          BIT(NL80211_IFTYPE_ADHOC) | \
4230          BIT(NL80211_IFTYPE_MESH_POINT) | \
4231          BIT(NL80211_IFTYPE_OCB))
4232
4233 static int mac80211_hwsim_new_radio(struct genl_info *info,
4234                                     struct hwsim_new_radio_params *param)
4235 {
4236         int err;
4237         u8 addr[ETH_ALEN];
4238         struct mac80211_hwsim_data *data;
4239         struct ieee80211_hw *hw;
4240         enum nl80211_band band;
4241         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
4242         struct net *net;
4243         int idx, i;
4244         int n_limits = 0;
4245
4246         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
4247                 return -EINVAL;
4248
4249         spin_lock_bh(&hwsim_radio_lock);
4250         idx = hwsim_radio_idx++;
4251         spin_unlock_bh(&hwsim_radio_lock);
4252
4253         if (param->mlo)
4254                 ops = &mac80211_hwsim_mlo_ops;
4255         else if (param->use_chanctx)
4256                 ops = &mac80211_hwsim_mchan_ops;
4257         hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
4258         if (!hw) {
4259                 pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
4260                 err = -ENOMEM;
4261                 goto failed;
4262         }
4263
4264         /* ieee80211_alloc_hw_nm may have used a default name */
4265         param->hwname = wiphy_name(hw->wiphy);
4266
4267         if (info)
4268                 net = genl_info_net(info);
4269         else
4270                 net = &init_net;
4271         wiphy_net_set(hw->wiphy, net);
4272
4273         data = hw->priv;
4274         data->hw = hw;
4275
4276         data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
4277         if (IS_ERR(data->dev)) {
4278                 printk(KERN_DEBUG
4279                        "mac80211_hwsim: device_create failed (%ld)\n",
4280                        PTR_ERR(data->dev));
4281                 err = -ENOMEM;
4282                 goto failed_drvdata;
4283         }
4284         data->dev->driver = &mac80211_hwsim_driver.driver;
4285         err = device_bind_driver(data->dev);
4286         if (err != 0) {
4287                 pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
4288                        err);
4289                 goto failed_bind;
4290         }
4291
4292         skb_queue_head_init(&data->pending);
4293
4294         SET_IEEE80211_DEV(hw, data->dev);
4295         if (!param->perm_addr) {
4296                 eth_zero_addr(addr);
4297                 addr[0] = 0x02;
4298                 addr[3] = idx >> 8;
4299                 addr[4] = idx;
4300                 memcpy(data->addresses[0].addr, addr, ETH_ALEN);
4301                 /* Why need here second address ? */
4302                 memcpy(data->addresses[1].addr, addr, ETH_ALEN);
4303                 data->addresses[1].addr[0] |= 0x40;
4304                 hw->wiphy->n_addresses = 2;
4305                 hw->wiphy->addresses = data->addresses;
4306                 /* possible address clash is checked at hash table insertion */
4307         } else {
4308                 memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
4309                 /* compatibility with automatically generated mac addr */
4310                 memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
4311                 hw->wiphy->n_addresses = 2;
4312                 hw->wiphy->addresses = data->addresses;
4313         }
4314
4315         data->channels = param->channels;
4316         data->use_chanctx = param->use_chanctx;
4317         data->idx = idx;
4318         data->destroy_on_close = param->destroy_on_close;
4319         if (info)
4320                 data->portid = info->snd_portid;
4321
4322         /* setup interface limits, only on interface types we support */
4323         if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
4324                 data->if_limits[n_limits].max = 1;
4325                 data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
4326                 n_limits++;
4327         }
4328
4329         if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
4330                 data->if_limits[n_limits].max = 2048;
4331                 /*
4332                  * For this case, we may only support a subset of
4333                  * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
4334                  * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
4335                  */
4336                 data->if_limits[n_limits].types =
4337                                         HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
4338                 n_limits++;
4339         }
4340
4341         if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
4342                 data->if_limits[n_limits].max = 1;
4343                 data->if_limits[n_limits].types =
4344                                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
4345                 n_limits++;
4346         }
4347
4348         if (data->use_chanctx) {
4349                 hw->wiphy->max_scan_ssids = 255;
4350                 hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
4351                 hw->wiphy->max_remain_on_channel_duration = 1000;
4352                 data->if_combination.radar_detect_widths = 0;
4353                 data->if_combination.num_different_channels = data->channels;
4354         } else {
4355                 data->if_combination.num_different_channels = 1;
4356                 data->if_combination.radar_detect_widths =
4357                                         BIT(NL80211_CHAN_WIDTH_5) |
4358                                         BIT(NL80211_CHAN_WIDTH_10) |
4359                                         BIT(NL80211_CHAN_WIDTH_20_NOHT) |
4360                                         BIT(NL80211_CHAN_WIDTH_20) |
4361                                         BIT(NL80211_CHAN_WIDTH_40) |
4362                                         BIT(NL80211_CHAN_WIDTH_80) |
4363                                         BIT(NL80211_CHAN_WIDTH_160);
4364         }
4365
4366         if (!n_limits) {
4367                 err = -EINVAL;
4368                 goto failed_hw;
4369         }
4370
4371         data->if_combination.max_interfaces = 0;
4372         for (i = 0; i < n_limits; i++)
4373                 data->if_combination.max_interfaces +=
4374                         data->if_limits[i].max;
4375
4376         data->if_combination.n_limits = n_limits;
4377         data->if_combination.limits = data->if_limits;
4378
4379         /*
4380          * If we actually were asked to support combinations,
4381          * advertise them - if there's only a single thing like
4382          * only IBSS then don't advertise it as combinations.
4383          */
4384         if (data->if_combination.max_interfaces > 1) {
4385                 hw->wiphy->iface_combinations = &data->if_combination;
4386                 hw->wiphy->n_iface_combinations = 1;
4387         }
4388
4389         if (param->ciphers) {
4390                 memcpy(data->ciphers, param->ciphers,
4391                        param->n_ciphers * sizeof(u32));
4392                 hw->wiphy->cipher_suites = data->ciphers;
4393                 hw->wiphy->n_cipher_suites = param->n_ciphers;
4394         }
4395
4396         data->rx_rssi = DEFAULT_RX_RSSI;
4397
4398         INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
4399         INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
4400         INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
4401
4402         hw->queues = 5;
4403         hw->offchannel_tx_hw_queue = 4;
4404
4405         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
4406         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
4407         ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
4408         ieee80211_hw_set(hw, QUEUE_CONTROL);
4409         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
4410         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
4411         ieee80211_hw_set(hw, MFP_CAPABLE);
4412         ieee80211_hw_set(hw, SIGNAL_DBM);
4413         ieee80211_hw_set(hw, SUPPORTS_PS);
4414         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
4415         ieee80211_hw_set(hw, TDLS_WIDER_BW);
4416         ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
4417
4418         if (param->mlo) {
4419                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
4420                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
4421                 ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
4422                 ieee80211_hw_set(hw, CONNECTION_MONITOR);
4423                 ieee80211_hw_set(hw, AP_LINK_PS);
4424         } else {
4425                 ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
4426                 ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
4427                 if (rctbl)
4428                         ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
4429         }
4430
4431         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
4432         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
4433                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
4434                             WIPHY_FLAG_AP_UAPSD |
4435                             WIPHY_FLAG_SUPPORTS_5_10_MHZ |
4436                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
4437         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
4438                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
4439                                NL80211_FEATURE_STATIC_SMPS |
4440                                NL80211_FEATURE_DYNAMIC_SMPS |
4441                                NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
4442         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
4443         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
4444         wiphy_ext_feature_set(hw->wiphy,
4445                               NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
4446         wiphy_ext_feature_set(hw->wiphy,
4447                               NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
4448
4449         hw->wiphy->interface_modes = param->iftypes;
4450
4451         /* ask mac80211 to reserve space for magic */
4452         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
4453         hw->sta_data_size = sizeof(struct hwsim_sta_priv);
4454         hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
4455
4456         memcpy(data->channels_2ghz, hwsim_channels_2ghz,
4457                 sizeof(hwsim_channels_2ghz));
4458         memcpy(data->channels_5ghz, hwsim_channels_5ghz,
4459                 sizeof(hwsim_channels_5ghz));
4460         memcpy(data->channels_6ghz, hwsim_channels_6ghz,
4461                 sizeof(hwsim_channels_6ghz));
4462         memcpy(data->channels_s1g, hwsim_channels_s1g,
4463                sizeof(hwsim_channels_s1g));
4464         memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
4465
4466         for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
4467                 struct ieee80211_supported_band *sband = &data->bands[band];
4468
4469                 sband->band = band;
4470
4471                 switch (band) {
4472                 case NL80211_BAND_2GHZ:
4473                         sband->channels = data->channels_2ghz;
4474                         sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
4475                         sband->bitrates = data->rates;
4476                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
4477                         break;
4478                 case NL80211_BAND_5GHZ:
4479                         sband->channels = data->channels_5ghz;
4480                         sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
4481                         sband->bitrates = data->rates + 4;
4482                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
4483
4484                         sband->vht_cap.vht_supported = true;
4485                         sband->vht_cap.cap =
4486                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
4487                                 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
4488                                 IEEE80211_VHT_CAP_RXLDPC |
4489                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
4490                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
4491                                 IEEE80211_VHT_CAP_TXSTBC |
4492                                 IEEE80211_VHT_CAP_RXSTBC_4 |
4493                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
4494                         sband->vht_cap.vht_mcs.rx_mcs_map =
4495                                 cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
4496                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
4497                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
4498                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
4499                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
4500                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
4501                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
4502                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
4503                         sband->vht_cap.vht_mcs.tx_mcs_map =
4504                                 sband->vht_cap.vht_mcs.rx_mcs_map;
4505                         break;
4506                 case NL80211_BAND_6GHZ:
4507                         sband->channels = data->channels_6ghz;
4508                         sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
4509                         sband->bitrates = data->rates + 4;
4510                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
4511                         break;
4512                 case NL80211_BAND_S1GHZ:
4513                         memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
4514                                sizeof(sband->s1g_cap));
4515                         sband->channels = data->channels_s1g;
4516                         sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
4517                         break;
4518                 default:
4519                         continue;
4520                 }
4521
4522                 if (band != NL80211_BAND_6GHZ){
4523                         sband->ht_cap.ht_supported = true;
4524                         sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
4525                                             IEEE80211_HT_CAP_GRN_FLD |
4526                                             IEEE80211_HT_CAP_SGI_20 |
4527                                             IEEE80211_HT_CAP_SGI_40 |
4528                                             IEEE80211_HT_CAP_DSSSCCK40;
4529                         sband->ht_cap.ampdu_factor = 0x3;
4530                         sband->ht_cap.ampdu_density = 0x6;
4531                         memset(&sband->ht_cap.mcs, 0,
4532                                sizeof(sband->ht_cap.mcs));
4533                         sband->ht_cap.mcs.rx_mask[0] = 0xff;
4534                         sband->ht_cap.mcs.rx_mask[1] = 0xff;
4535                         sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
4536                 }
4537
4538                 mac80211_hwsim_sband_capab(sband);
4539
4540                 hw->wiphy->bands[band] = sband;
4541         }
4542
4543         /* By default all radios belong to the first group */
4544         data->group = 1;
4545         mutex_init(&data->mutex);
4546
4547         data->netgroup = hwsim_net_get_netgroup(net);
4548         data->wmediumd = hwsim_net_get_wmediumd(net);
4549
4550         /* Enable frame retransmissions for lossy channels */
4551         hw->max_rates = 4;
4552         hw->max_rate_tries = 11;
4553
4554         hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
4555         hw->wiphy->n_vendor_commands =
4556                 ARRAY_SIZE(mac80211_hwsim_vendor_commands);
4557         hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
4558         hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
4559
4560         if (param->reg_strict)
4561                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
4562         if (param->regd) {
4563                 data->regd = param->regd;
4564                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
4565                 wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
4566                 /* give the regulatory workqueue a chance to run */
4567                 schedule_timeout_interruptible(1);
4568         }
4569
4570         if (param->no_vif)
4571                 ieee80211_hw_set(hw, NO_AUTO_VIF);
4572
4573         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
4574
4575         for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
4576                 hrtimer_init(&data->link_data[i].beacon_timer, CLOCK_MONOTONIC,
4577                              HRTIMER_MODE_ABS_SOFT);
4578                 data->link_data[i].beacon_timer.function =
4579                         mac80211_hwsim_beacon;
4580                 data->link_data[i].link_id = i;
4581         }
4582
4583         err = ieee80211_register_hw(hw);
4584         if (err < 0) {
4585                 pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
4586                        err);
4587                 goto failed_hw;
4588         }
4589
4590         wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
4591
4592         if (param->reg_alpha2) {
4593                 data->alpha2[0] = param->reg_alpha2[0];
4594                 data->alpha2[1] = param->reg_alpha2[1];
4595                 regulatory_hint(hw->wiphy, param->reg_alpha2);
4596         }
4597
4598         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
4599         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
4600         debugfs_create_file("group", 0666, data->debugfs, data,
4601                             &hwsim_fops_group);
4602         debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
4603                             &hwsim_fops_rx_rssi);
4604         if (!data->use_chanctx)
4605                 debugfs_create_file("dfs_simulate_radar", 0222,
4606                                     data->debugfs,
4607                                     data, &hwsim_simulate_radar);
4608
4609         spin_lock_bh(&hwsim_radio_lock);
4610         err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
4611                                      hwsim_rht_params);
4612         if (err < 0) {
4613                 if (info) {
4614                         GENL_SET_ERR_MSG(info, "perm addr already present");
4615                         NL_SET_BAD_ATTR(info->extack,
4616                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
4617                 }
4618                 spin_unlock_bh(&hwsim_radio_lock);
4619                 goto failed_final_insert;
4620         }
4621
4622         list_add_tail(&data->list, &hwsim_radios);
4623         hwsim_radios_generation++;
4624         spin_unlock_bh(&hwsim_radio_lock);
4625
4626         hwsim_mcast_new_radio(idx, info, param);
4627
4628         return idx;
4629
4630 failed_final_insert:
4631         debugfs_remove_recursive(data->debugfs);
4632         ieee80211_unregister_hw(data->hw);
4633 failed_hw:
4634         device_release_driver(data->dev);
4635 failed_bind:
4636         device_unregister(data->dev);
4637 failed_drvdata:
4638         ieee80211_free_hw(hw);
4639 failed:
4640         return err;
4641 }
4642
4643 static void hwsim_mcast_del_radio(int id, const char *hwname,
4644                                   struct genl_info *info)
4645 {
4646         struct sk_buff *skb;
4647         void *data;
4648         int ret;
4649
4650         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4651         if (!skb)
4652                 return;
4653
4654         data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
4655                            HWSIM_CMD_DEL_RADIO);
4656         if (!data)
4657                 goto error;
4658
4659         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
4660         if (ret < 0)
4661                 goto error;
4662
4663         ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
4664                       hwname);
4665         if (ret < 0)
4666                 goto error;
4667
4668         genlmsg_end(skb, data);
4669
4670         hwsim_mcast_config_msg(skb, info);
4671
4672         return;
4673
4674 error:
4675         nlmsg_free(skb);
4676 }
4677
4678 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
4679                                      const char *hwname,
4680                                      struct genl_info *info)
4681 {
4682         hwsim_mcast_del_radio(data->idx, hwname, info);
4683         debugfs_remove_recursive(data->debugfs);
4684         ieee80211_unregister_hw(data->hw);
4685         device_release_driver(data->dev);
4686         device_unregister(data->dev);
4687         ieee80211_free_hw(data->hw);
4688 }
4689
4690 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
4691                                     struct mac80211_hwsim_data *data,
4692                                     u32 portid, u32 seq,
4693                                     struct netlink_callback *cb, int flags)
4694 {
4695         void *hdr;
4696         struct hwsim_new_radio_params param = { };
4697         int res = -EMSGSIZE;
4698
4699         hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
4700                           HWSIM_CMD_GET_RADIO);
4701         if (!hdr)
4702                 return -EMSGSIZE;
4703
4704         if (cb)
4705                 genl_dump_check_consistent(cb, hdr);
4706
4707         if (data->alpha2[0] && data->alpha2[1])
4708                 param.reg_alpha2 = data->alpha2;
4709
4710         param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
4711                                         REGULATORY_STRICT_REG);
4712         param.p2p_device = !!(data->hw->wiphy->interface_modes &
4713                                         BIT(NL80211_IFTYPE_P2P_DEVICE));
4714         param.use_chanctx = data->use_chanctx;
4715         param.regd = data->regd;
4716         param.channels = data->channels;
4717         param.hwname = wiphy_name(data->hw->wiphy);
4718
4719         res = append_radio_msg(skb, data->idx, &param);
4720         if (res < 0)
4721                 goto out_err;
4722
4723         genlmsg_end(skb, hdr);
4724         return 0;
4725
4726 out_err:
4727         genlmsg_cancel(skb, hdr);
4728         return res;
4729 }
4730
4731 static void mac80211_hwsim_free(void)
4732 {
4733         struct mac80211_hwsim_data *data;
4734
4735         spin_lock_bh(&hwsim_radio_lock);
4736         while ((data = list_first_entry_or_null(&hwsim_radios,
4737                                                 struct mac80211_hwsim_data,
4738                                                 list))) {
4739                 list_del(&data->list);
4740                 spin_unlock_bh(&hwsim_radio_lock);
4741                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
4742                                          NULL);
4743                 spin_lock_bh(&hwsim_radio_lock);
4744         }
4745         spin_unlock_bh(&hwsim_radio_lock);
4746         class_destroy(hwsim_class);
4747 }
4748
4749 static const struct net_device_ops hwsim_netdev_ops = {
4750         .ndo_start_xmit         = hwsim_mon_xmit,
4751         .ndo_set_mac_address    = eth_mac_addr,
4752         .ndo_validate_addr      = eth_validate_addr,
4753 };
4754
4755 static void hwsim_mon_setup(struct net_device *dev)
4756 {
4757         u8 addr[ETH_ALEN];
4758
4759         dev->netdev_ops = &hwsim_netdev_ops;
4760         dev->needs_free_netdev = true;
4761         ether_setup(dev);
4762         dev->priv_flags |= IFF_NO_QUEUE;
4763         dev->type = ARPHRD_IEEE80211_RADIOTAP;
4764         eth_zero_addr(addr);
4765         addr[0] = 0x12;
4766         eth_hw_addr_set(dev, addr);
4767 }
4768
4769 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
4770 {
4771         return rhashtable_lookup_fast(&hwsim_radios_rht,
4772                                       addr,
4773                                       hwsim_rht_params);
4774 }
4775
4776 static void hwsim_register_wmediumd(struct net *net, u32 portid)
4777 {
4778         struct mac80211_hwsim_data *data;
4779
4780         hwsim_net_set_wmediumd(net, portid);
4781
4782         spin_lock_bh(&hwsim_radio_lock);
4783         list_for_each_entry(data, &hwsim_radios, list) {
4784                 if (data->netgroup == hwsim_net_get_netgroup(net))
4785                         data->wmediumd = portid;
4786         }
4787         spin_unlock_bh(&hwsim_radio_lock);
4788 }
4789
4790 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
4791                                            struct genl_info *info)
4792 {
4793
4794         struct ieee80211_hdr *hdr;
4795         struct mac80211_hwsim_data *data2;
4796         struct ieee80211_tx_info *txi;
4797         struct hwsim_tx_rate *tx_attempts;
4798         u64 ret_skb_cookie;
4799         struct sk_buff *skb, *tmp;
4800         const u8 *src;
4801         unsigned int hwsim_flags;
4802         int i;
4803         unsigned long flags;
4804         bool found = false;
4805
4806         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
4807             !info->attrs[HWSIM_ATTR_FLAGS] ||
4808             !info->attrs[HWSIM_ATTR_COOKIE] ||
4809             !info->attrs[HWSIM_ATTR_SIGNAL] ||
4810             !info->attrs[HWSIM_ATTR_TX_INFO])
4811                 goto out;
4812
4813         src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
4814         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
4815         ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
4816
4817         data2 = get_hwsim_data_ref_from_addr(src);
4818         if (!data2)
4819                 goto out;
4820
4821         if (!hwsim_virtio_enabled) {
4822                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
4823                     data2->netgroup)
4824                         goto out;
4825
4826                 if (info->snd_portid != data2->wmediumd)
4827                         goto out;
4828         }
4829
4830         /* look for the skb matching the cookie passed back from user */
4831         spin_lock_irqsave(&data2->pending.lock, flags);
4832         skb_queue_walk_safe(&data2->pending, skb, tmp) {
4833                 uintptr_t skb_cookie;
4834
4835                 txi = IEEE80211_SKB_CB(skb);
4836                 skb_cookie = (uintptr_t)txi->rate_driver_data[0];
4837
4838                 if (skb_cookie == ret_skb_cookie) {
4839                         __skb_unlink(skb, &data2->pending);
4840                         found = true;
4841                         break;
4842                 }
4843         }
4844         spin_unlock_irqrestore(&data2->pending.lock, flags);
4845
4846         /* not found */
4847         if (!found)
4848                 goto out;
4849
4850         /* Tx info received because the frame was broadcasted on user space,
4851          so we get all the necessary info: tx attempts and skb control buff */
4852
4853         tx_attempts = (struct hwsim_tx_rate *)nla_data(
4854                        info->attrs[HWSIM_ATTR_TX_INFO]);
4855
4856         /* now send back TX status */
4857         txi = IEEE80211_SKB_CB(skb);
4858
4859         ieee80211_tx_info_clear_status(txi);
4860
4861         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
4862                 txi->status.rates[i].idx = tx_attempts[i].idx;
4863                 txi->status.rates[i].count = tx_attempts[i].count;
4864         }
4865
4866         txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
4867
4868         if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
4869            (hwsim_flags & HWSIM_TX_STAT_ACK)) {
4870                 if (skb->len >= 16) {
4871                         hdr = (struct ieee80211_hdr *) skb->data;
4872                         mac80211_hwsim_monitor_ack(data2->channel,
4873                                                    hdr->addr2);
4874                 }
4875                 txi->flags |= IEEE80211_TX_STAT_ACK;
4876         }
4877
4878         if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
4879                 txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
4880
4881         ieee80211_tx_status_irqsafe(data2->hw, skb);
4882         return 0;
4883 out:
4884         return -EINVAL;
4885
4886 }
4887
4888 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
4889                                           struct genl_info *info)
4890 {
4891         struct mac80211_hwsim_data *data2;
4892         struct ieee80211_rx_status rx_status;
4893         struct ieee80211_hdr *hdr;
4894         const u8 *dst;
4895         int frame_data_len;
4896         void *frame_data;
4897         struct sk_buff *skb = NULL;
4898         struct ieee80211_channel *channel = NULL;
4899
4900         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
4901             !info->attrs[HWSIM_ATTR_FRAME] ||
4902             !info->attrs[HWSIM_ATTR_RX_RATE] ||
4903             !info->attrs[HWSIM_ATTR_SIGNAL])
4904                 goto out;
4905
4906         dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
4907         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
4908         frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
4909
4910         /* Allocate new skb here */
4911         skb = alloc_skb(frame_data_len, GFP_KERNEL);
4912         if (skb == NULL)
4913                 goto err;
4914
4915         if (frame_data_len > IEEE80211_MAX_DATA_LEN)
4916                 goto err;
4917
4918         /* Copy the data */
4919         skb_put_data(skb, frame_data, frame_data_len);
4920
4921         data2 = get_hwsim_data_ref_from_addr(dst);
4922         if (!data2)
4923                 goto out;
4924
4925         if (data2->use_chanctx) {
4926                 if (data2->tmp_chan)
4927                         channel = data2->tmp_chan;
4928         } else {
4929                 channel = data2->channel;
4930         }
4931
4932         if (!hwsim_virtio_enabled) {
4933                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
4934                     data2->netgroup)
4935                         goto out;
4936
4937                 if (info->snd_portid != data2->wmediumd)
4938                         goto out;
4939         }
4940
4941         /* check if radio is configured properly */
4942
4943         if ((data2->idle && !data2->tmp_chan) || !data2->started)
4944                 goto out;
4945
4946         /* A frame is received from user space */
4947         memset(&rx_status, 0, sizeof(rx_status));
4948         if (info->attrs[HWSIM_ATTR_FREQ]) {
4949                 struct tx_iter_data iter_data = {};
4950
4951                 /* throw away off-channel packets, but allow both the temporary
4952                  * ("hw" scan/remain-on-channel), regular channels and links,
4953                  * since the internal datapath also allows this
4954                  */
4955                 rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
4956
4957                 iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
4958                                                           rx_status.freq);
4959                 if (!iter_data.channel)
4960                         goto out;
4961                 rx_status.band = iter_data.channel->band;
4962
4963                 mutex_lock(&data2->mutex);
4964                 if (!hwsim_chans_compat(iter_data.channel, channel)) {
4965                         ieee80211_iterate_active_interfaces_atomic(
4966                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
4967                                 mac80211_hwsim_tx_iter, &iter_data);
4968                         if (!iter_data.receive) {
4969                                 mutex_unlock(&data2->mutex);
4970                                 goto out;
4971                         }
4972                 }
4973                 mutex_unlock(&data2->mutex);
4974         } else if (!channel) {
4975                 goto out;
4976         } else {
4977                 rx_status.freq = channel->center_freq;
4978                 rx_status.band = channel->band;
4979         }
4980
4981         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
4982         if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
4983                 goto out;
4984         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
4985
4986         hdr = (void *)skb->data;
4987
4988         if (ieee80211_is_beacon(hdr->frame_control) ||
4989             ieee80211_is_probe_resp(hdr->frame_control))
4990                 rx_status.boottime_ns = ktime_get_boottime_ns();
4991
4992         mac80211_hwsim_rx(data2, &rx_status, skb);
4993
4994         return 0;
4995 err:
4996         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
4997 out:
4998         dev_kfree_skb(skb);
4999         return -EINVAL;
5000 }
5001
5002 static int hwsim_register_received_nl(struct sk_buff *skb_2,
5003                                       struct genl_info *info)
5004 {
5005         struct net *net = genl_info_net(info);
5006         struct mac80211_hwsim_data *data;
5007         int chans = 1;
5008
5009         spin_lock_bh(&hwsim_radio_lock);
5010         list_for_each_entry(data, &hwsim_radios, list)
5011                 chans = max(chans, data->channels);
5012         spin_unlock_bh(&hwsim_radio_lock);
5013
5014         /* In the future we should revise the userspace API and allow it
5015          * to set a flag that it does support multi-channel, then we can
5016          * let this pass conditionally on the flag.
5017          * For current userspace, prohibit it since it won't work right.
5018          */
5019         if (chans > 1)
5020                 return -EOPNOTSUPP;
5021
5022         if (hwsim_net_get_wmediumd(net))
5023                 return -EBUSY;
5024
5025         hwsim_register_wmediumd(net, info->snd_portid);
5026
5027         pr_debug("mac80211_hwsim: received a REGISTER, "
5028                "switching to wmediumd mode with pid %d\n", info->snd_portid);
5029
5030         return 0;
5031 }
5032
5033 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
5034 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
5035 {
5036         int i;
5037
5038         for (i = 0; i < n_ciphers; i++) {
5039                 int j;
5040                 int found = 0;
5041
5042                 for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
5043                         if (ciphers[i] == hwsim_ciphers[j]) {
5044                                 found = 1;
5045                                 break;
5046                         }
5047                 }
5048
5049                 if (!found)
5050                         return false;
5051         }
5052
5053         return true;
5054 }
5055
5056 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
5057 {
5058         struct hwsim_new_radio_params param = { 0 };
5059         const char *hwname = NULL;
5060         int ret;
5061
5062         param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
5063         param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
5064         param.channels = channels;
5065         param.destroy_on_close =
5066                 info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
5067
5068         if (info->attrs[HWSIM_ATTR_CHANNELS])
5069                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
5070
5071         if (param.channels < 1) {
5072                 GENL_SET_ERR_MSG(info, "must have at least one channel");
5073                 return -EINVAL;
5074         }
5075
5076         if (info->attrs[HWSIM_ATTR_NO_VIF])
5077                 param.no_vif = true;
5078
5079         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
5080                 param.use_chanctx = true;
5081         else
5082                 param.use_chanctx = (param.channels > 1);
5083
5084         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
5085                 param.reg_alpha2 =
5086                         nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
5087
5088         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
5089                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
5090
5091                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
5092                         return -EINVAL;
5093
5094                 idx = array_index_nospec(idx,
5095                                          ARRAY_SIZE(hwsim_world_regdom_custom));
5096                 param.regd = hwsim_world_regdom_custom[idx];
5097         }
5098
5099         if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
5100                 if (!is_valid_ether_addr(
5101                                 nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
5102                         GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
5103                         NL_SET_BAD_ATTR(info->extack,
5104                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
5105                         return -EINVAL;
5106                 }
5107
5108                 param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
5109         }
5110
5111         if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
5112                 param.iftypes =
5113                         nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
5114
5115                 if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
5116                         NL_SET_ERR_MSG_ATTR(info->extack,
5117                                             info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
5118                                             "cannot support more iftypes than kernel");
5119                         return -EINVAL;
5120                 }
5121         } else {
5122                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5123         }
5124
5125         /* ensure both flag and iftype support is honored */
5126         if (param.p2p_device ||
5127             param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5128                 param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5129                 param.p2p_device = true;
5130         }
5131
5132         if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
5133                 u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5134
5135                 param.ciphers =
5136                         nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5137
5138                 if (len % sizeof(u32)) {
5139                         NL_SET_ERR_MSG_ATTR(info->extack,
5140                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5141                                             "bad cipher list length");
5142                         return -EINVAL;
5143                 }
5144
5145                 param.n_ciphers = len / sizeof(u32);
5146
5147                 if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
5148                         NL_SET_ERR_MSG_ATTR(info->extack,
5149                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5150                                             "too many ciphers specified");
5151                         return -EINVAL;
5152                 }
5153
5154                 if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
5155                         NL_SET_ERR_MSG_ATTR(info->extack,
5156                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5157                                             "unsupported ciphers specified");
5158                         return -EINVAL;
5159                 }
5160         }
5161
5162         param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
5163
5164         if (param.mlo)
5165                 param.use_chanctx = true;
5166
5167         if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5168                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5169                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5170                                   GFP_KERNEL);
5171                 if (!hwname)
5172                         return -ENOMEM;
5173                 param.hwname = hwname;
5174         }
5175
5176         ret = mac80211_hwsim_new_radio(info, &param);
5177         kfree(hwname);
5178         return ret;
5179 }
5180
5181 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
5182 {
5183         struct mac80211_hwsim_data *data;
5184         s64 idx = -1;
5185         const char *hwname = NULL;
5186
5187         if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
5188                 idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
5189         } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5190                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5191                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5192                                   GFP_KERNEL);
5193                 if (!hwname)
5194                         return -ENOMEM;
5195         } else
5196                 return -EINVAL;
5197
5198         spin_lock_bh(&hwsim_radio_lock);
5199         list_for_each_entry(data, &hwsim_radios, list) {
5200                 if (idx >= 0) {
5201                         if (data->idx != idx)
5202                                 continue;
5203                 } else {
5204                         if (!hwname ||
5205                             strcmp(hwname, wiphy_name(data->hw->wiphy)))
5206                                 continue;
5207                 }
5208
5209                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
5210                         continue;
5211
5212                 list_del(&data->list);
5213                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
5214                                        hwsim_rht_params);
5215                 hwsim_radios_generation++;
5216                 spin_unlock_bh(&hwsim_radio_lock);
5217                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
5218                                          info);
5219                 kfree(hwname);
5220                 return 0;
5221         }
5222         spin_unlock_bh(&hwsim_radio_lock);
5223
5224         kfree(hwname);
5225         return -ENODEV;
5226 }
5227
5228 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
5229 {
5230         struct mac80211_hwsim_data *data;
5231         struct sk_buff *skb;
5232         int idx, res = -ENODEV;
5233
5234         if (!info->attrs[HWSIM_ATTR_RADIO_ID])
5235                 return -EINVAL;
5236         idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
5237
5238         spin_lock_bh(&hwsim_radio_lock);
5239         list_for_each_entry(data, &hwsim_radios, list) {
5240                 if (data->idx != idx)
5241                         continue;
5242
5243                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
5244                         continue;
5245
5246                 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5247                 if (!skb) {
5248                         res = -ENOMEM;
5249                         goto out_err;
5250                 }
5251
5252                 res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
5253                                                info->snd_seq, NULL, 0);
5254                 if (res < 0) {
5255                         nlmsg_free(skb);
5256                         goto out_err;
5257                 }
5258
5259                 res = genlmsg_reply(skb, info);
5260                 break;
5261         }
5262
5263 out_err:
5264         spin_unlock_bh(&hwsim_radio_lock);
5265
5266         return res;
5267 }
5268
5269 static int hwsim_dump_radio_nl(struct sk_buff *skb,
5270                                struct netlink_callback *cb)
5271 {
5272         int last_idx = cb->args[0] - 1;
5273         struct mac80211_hwsim_data *data = NULL;
5274         int res = 0;
5275         void *hdr;
5276
5277         spin_lock_bh(&hwsim_radio_lock);
5278         cb->seq = hwsim_radios_generation;
5279
5280         if (last_idx >= hwsim_radio_idx-1)
5281                 goto done;
5282
5283         list_for_each_entry(data, &hwsim_radios, list) {
5284                 if (data->idx <= last_idx)
5285                         continue;
5286
5287                 if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
5288                         continue;
5289
5290                 res = mac80211_hwsim_get_radio(skb, data,
5291                                                NETLINK_CB(cb->skb).portid,
5292                                                cb->nlh->nlmsg_seq, cb,
5293                                                NLM_F_MULTI);
5294                 if (res < 0)
5295                         break;
5296
5297                 last_idx = data->idx;
5298         }
5299
5300         cb->args[0] = last_idx + 1;
5301
5302         /* list changed, but no new element sent, set interrupted flag */
5303         if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
5304                 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
5305                                   cb->nlh->nlmsg_seq, &hwsim_genl_family,
5306                                   NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
5307                 if (hdr) {
5308                         genl_dump_check_consistent(cb, hdr);
5309                         genlmsg_end(skb, hdr);
5310                 } else {
5311                         res = -EMSGSIZE;
5312                 }
5313         }
5314
5315 done:
5316         spin_unlock_bh(&hwsim_radio_lock);
5317         return res ?: skb->len;
5318 }
5319
5320 /* Generic Netlink operations array */
5321 static const struct genl_small_ops hwsim_ops[] = {
5322         {
5323                 .cmd = HWSIM_CMD_REGISTER,
5324                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5325                 .doit = hwsim_register_received_nl,
5326                 .flags = GENL_UNS_ADMIN_PERM,
5327         },
5328         {
5329                 .cmd = HWSIM_CMD_FRAME,
5330                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5331                 .doit = hwsim_cloned_frame_received_nl,
5332         },
5333         {
5334                 .cmd = HWSIM_CMD_TX_INFO_FRAME,
5335                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5336                 .doit = hwsim_tx_info_frame_received_nl,
5337         },
5338         {
5339                 .cmd = HWSIM_CMD_NEW_RADIO,
5340                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5341                 .doit = hwsim_new_radio_nl,
5342                 .flags = GENL_UNS_ADMIN_PERM,
5343         },
5344         {
5345                 .cmd = HWSIM_CMD_DEL_RADIO,
5346                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5347                 .doit = hwsim_del_radio_nl,
5348                 .flags = GENL_UNS_ADMIN_PERM,
5349         },
5350         {
5351                 .cmd = HWSIM_CMD_GET_RADIO,
5352                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
5353                 .doit = hwsim_get_radio_nl,
5354                 .dumpit = hwsim_dump_radio_nl,
5355         },
5356 };
5357
5358 static struct genl_family hwsim_genl_family __ro_after_init = {
5359         .name = "MAC80211_HWSIM",
5360         .version = 1,
5361         .maxattr = HWSIM_ATTR_MAX,
5362         .policy = hwsim_genl_policy,
5363         .netnsok = true,
5364         .module = THIS_MODULE,
5365         .small_ops = hwsim_ops,
5366         .n_small_ops = ARRAY_SIZE(hwsim_ops),
5367         .resv_start_op = HWSIM_CMD_DEL_MAC_ADDR + 1,
5368         .mcgrps = hwsim_mcgrps,
5369         .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
5370 };
5371
5372 static void remove_user_radios(u32 portid)
5373 {
5374         struct mac80211_hwsim_data *entry, *tmp;
5375         LIST_HEAD(list);
5376
5377         spin_lock_bh(&hwsim_radio_lock);
5378         list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
5379                 if (entry->destroy_on_close && entry->portid == portid) {
5380                         list_move(&entry->list, &list);
5381                         rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
5382                                                hwsim_rht_params);
5383                         hwsim_radios_generation++;
5384                 }
5385         }
5386         spin_unlock_bh(&hwsim_radio_lock);
5387
5388         list_for_each_entry_safe(entry, tmp, &list, list) {
5389                 list_del(&entry->list);
5390                 mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
5391                                          NULL);
5392         }
5393 }
5394
5395 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
5396                                          unsigned long state,
5397                                          void *_notify)
5398 {
5399         struct netlink_notify *notify = _notify;
5400
5401         if (state != NETLINK_URELEASE)
5402                 return NOTIFY_DONE;
5403
5404         remove_user_radios(notify->portid);
5405
5406         if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
5407                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
5408                        " socket, switching to perfect channel medium\n");
5409                 hwsim_register_wmediumd(notify->net, 0);
5410         }
5411         return NOTIFY_DONE;
5412
5413 }
5414
5415 static struct notifier_block hwsim_netlink_notifier = {
5416         .notifier_call = mac80211_hwsim_netlink_notify,
5417 };
5418
5419 static int __init hwsim_init_netlink(void)
5420 {
5421         int rc;
5422
5423         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
5424
5425         rc = genl_register_family(&hwsim_genl_family);
5426         if (rc)
5427                 goto failure;
5428
5429         rc = netlink_register_notifier(&hwsim_netlink_notifier);
5430         if (rc) {
5431                 genl_unregister_family(&hwsim_genl_family);
5432                 goto failure;
5433         }
5434
5435         return 0;
5436
5437 failure:
5438         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
5439         return -EINVAL;
5440 }
5441
5442 static __net_init int hwsim_init_net(struct net *net)
5443 {
5444         return hwsim_net_set_netgroup(net);
5445 }
5446
5447 static void __net_exit hwsim_exit_net(struct net *net)
5448 {
5449         struct mac80211_hwsim_data *data, *tmp;
5450         LIST_HEAD(list);
5451
5452         spin_lock_bh(&hwsim_radio_lock);
5453         list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
5454                 if (!net_eq(wiphy_net(data->hw->wiphy), net))
5455                         continue;
5456
5457                 /* Radios created in init_net are returned to init_net. */
5458                 if (data->netgroup == hwsim_net_get_netgroup(&init_net))
5459                         continue;
5460
5461                 list_move(&data->list, &list);
5462                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
5463                                        hwsim_rht_params);
5464                 hwsim_radios_generation++;
5465         }
5466         spin_unlock_bh(&hwsim_radio_lock);
5467
5468         list_for_each_entry_safe(data, tmp, &list, list) {
5469                 list_del(&data->list);
5470                 mac80211_hwsim_del_radio(data,
5471                                          wiphy_name(data->hw->wiphy),
5472                                          NULL);
5473         }
5474
5475         ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
5476 }
5477
5478 static struct pernet_operations hwsim_net_ops = {
5479         .init = hwsim_init_net,
5480         .exit = hwsim_exit_net,
5481         .id   = &hwsim_net_id,
5482         .size = sizeof(struct hwsim_net),
5483 };
5484
5485 static void hwsim_exit_netlink(void)
5486 {
5487         /* unregister the notifier */
5488         netlink_unregister_notifier(&hwsim_netlink_notifier);
5489         /* unregister the family */
5490         genl_unregister_family(&hwsim_genl_family);
5491 }
5492
5493 #if IS_REACHABLE(CONFIG_VIRTIO)
5494 static void hwsim_virtio_tx_done(struct virtqueue *vq)
5495 {
5496         unsigned int len;
5497         struct sk_buff *skb;
5498         unsigned long flags;
5499
5500         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5501         while ((skb = virtqueue_get_buf(vq, &len)))
5502                 nlmsg_free(skb);
5503         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5504 }
5505
5506 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
5507 {
5508         struct nlmsghdr *nlh;
5509         struct genlmsghdr *gnlh;
5510         struct nlattr *tb[HWSIM_ATTR_MAX + 1];
5511         struct genl_info info = {};
5512         int err;
5513
5514         nlh = nlmsg_hdr(skb);
5515         gnlh = nlmsg_data(nlh);
5516
5517         if (skb->len < nlh->nlmsg_len)
5518                 return -EINVAL;
5519
5520         err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
5521                             hwsim_genl_policy, NULL);
5522         if (err) {
5523                 pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
5524                 return err;
5525         }
5526
5527         info.attrs = tb;
5528
5529         switch (gnlh->cmd) {
5530         case HWSIM_CMD_FRAME:
5531                 hwsim_cloned_frame_received_nl(skb, &info);
5532                 break;
5533         case HWSIM_CMD_TX_INFO_FRAME:
5534                 hwsim_tx_info_frame_received_nl(skb, &info);
5535                 break;
5536         default:
5537                 pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
5538                 return -EPROTO;
5539         }
5540         return 0;
5541 }
5542
5543 static void hwsim_virtio_rx_work(struct work_struct *work)
5544 {
5545         struct virtqueue *vq;
5546         unsigned int len;
5547         struct sk_buff *skb;
5548         struct scatterlist sg[1];
5549         int err;
5550         unsigned long flags;
5551
5552         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5553         if (!hwsim_virtio_enabled)
5554                 goto out_unlock;
5555
5556         skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
5557         if (!skb)
5558                 goto out_unlock;
5559         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5560
5561         skb->data = skb->head;
5562         skb_reset_tail_pointer(skb);
5563         skb_put(skb, len);
5564         hwsim_virtio_handle_cmd(skb);
5565
5566         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5567         if (!hwsim_virtio_enabled) {
5568                 nlmsg_free(skb);
5569                 goto out_unlock;
5570         }
5571         vq = hwsim_vqs[HWSIM_VQ_RX];
5572         sg_init_one(sg, skb->head, skb_end_offset(skb));
5573         err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
5574         if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
5575                 nlmsg_free(skb);
5576         else
5577                 virtqueue_kick(vq);
5578         schedule_work(&hwsim_virtio_rx);
5579
5580 out_unlock:
5581         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5582 }
5583
5584 static void hwsim_virtio_rx_done(struct virtqueue *vq)
5585 {
5586         schedule_work(&hwsim_virtio_rx);
5587 }
5588
5589 static int init_vqs(struct virtio_device *vdev)
5590 {
5591         vq_callback_t *callbacks[HWSIM_NUM_VQS] = {
5592                 [HWSIM_VQ_TX] = hwsim_virtio_tx_done,
5593                 [HWSIM_VQ_RX] = hwsim_virtio_rx_done,
5594         };
5595         const char *names[HWSIM_NUM_VQS] = {
5596                 [HWSIM_VQ_TX] = "tx",
5597                 [HWSIM_VQ_RX] = "rx",
5598         };
5599
5600         return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
5601                                hwsim_vqs, callbacks, names, NULL);
5602 }
5603
5604 static int fill_vq(struct virtqueue *vq)
5605 {
5606         int i, err;
5607         struct sk_buff *skb;
5608         struct scatterlist sg[1];
5609
5610         for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
5611                 skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
5612                 if (!skb)
5613                         return -ENOMEM;
5614
5615                 sg_init_one(sg, skb->head, skb_end_offset(skb));
5616                 err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
5617                 if (err) {
5618                         nlmsg_free(skb);
5619                         return err;
5620                 }
5621         }
5622         virtqueue_kick(vq);
5623         return 0;
5624 }
5625
5626 static void remove_vqs(struct virtio_device *vdev)
5627 {
5628         int i;
5629
5630         virtio_reset_device(vdev);
5631
5632         for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
5633                 struct virtqueue *vq = hwsim_vqs[i];
5634                 struct sk_buff *skb;
5635
5636                 while ((skb = virtqueue_detach_unused_buf(vq)))
5637                         nlmsg_free(skb);
5638         }
5639
5640         vdev->config->del_vqs(vdev);
5641 }
5642
5643 static int hwsim_virtio_probe(struct virtio_device *vdev)
5644 {
5645         int err;
5646         unsigned long flags;
5647
5648         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5649         if (hwsim_virtio_enabled) {
5650                 spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5651                 return -EEXIST;
5652         }
5653         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5654
5655         err = init_vqs(vdev);
5656         if (err)
5657                 return err;
5658
5659         virtio_device_ready(vdev);
5660
5661         err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
5662         if (err)
5663                 goto out_remove;
5664
5665         spin_lock_irqsave(&hwsim_virtio_lock, flags);
5666         hwsim_virtio_enabled = true;
5667         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
5668
5669         schedule_work(&hwsim_virtio_rx);
5670         return 0;
5671
5672 out_remove:
5673         remove_vqs(vdev);
5674         return err;
5675 }
5676
5677 static void hwsim_virtio_remove(struct virtio_device *vdev)
5678 {
5679         hwsim_virtio_enabled = false;
5680
5681         cancel_work_sync(&hwsim_virtio_rx);
5682
5683         remove_vqs(vdev);
5684 }
5685
5686 /* MAC80211_HWSIM virtio device id table */
5687 static const struct virtio_device_id id_table[] = {
5688         { VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
5689         { 0 }
5690 };
5691 MODULE_DEVICE_TABLE(virtio, id_table);
5692
5693 static struct virtio_driver virtio_hwsim = {
5694         .driver.name = KBUILD_MODNAME,
5695         .driver.owner = THIS_MODULE,
5696         .id_table = id_table,
5697         .probe = hwsim_virtio_probe,
5698         .remove = hwsim_virtio_remove,
5699 };
5700
5701 static int hwsim_register_virtio_driver(void)
5702 {
5703         return register_virtio_driver(&virtio_hwsim);
5704 }
5705
5706 static void hwsim_unregister_virtio_driver(void)
5707 {
5708         unregister_virtio_driver(&virtio_hwsim);
5709 }
5710 #else
5711 static inline int hwsim_register_virtio_driver(void)
5712 {
5713         return 0;
5714 }
5715
5716 static inline void hwsim_unregister_virtio_driver(void)
5717 {
5718 }
5719 #endif
5720
5721 static int __init init_mac80211_hwsim(void)
5722 {
5723         int i, err;
5724
5725         if (radios < 0 || radios > 100)
5726                 return -EINVAL;
5727
5728         if (channels < 1)
5729                 return -EINVAL;
5730
5731         err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
5732         if (err)
5733                 return err;
5734
5735         err = register_pernet_device(&hwsim_net_ops);
5736         if (err)
5737                 goto out_free_rht;
5738
5739         err = platform_driver_register(&mac80211_hwsim_driver);
5740         if (err)
5741                 goto out_unregister_pernet;
5742
5743         err = hwsim_init_netlink();
5744         if (err)
5745                 goto out_unregister_driver;
5746
5747         err = hwsim_register_virtio_driver();
5748         if (err)
5749                 goto out_exit_netlink;
5750
5751         hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
5752         if (IS_ERR(hwsim_class)) {
5753                 err = PTR_ERR(hwsim_class);
5754                 goto out_exit_virtio;
5755         }
5756
5757         hwsim_init_s1g_channels(hwsim_channels_s1g);
5758
5759         for (i = 0; i < radios; i++) {
5760                 struct hwsim_new_radio_params param = { 0 };
5761
5762                 param.channels = channels;
5763
5764                 switch (regtest) {
5765                 case HWSIM_REGTEST_DIFF_COUNTRY:
5766                         if (i < ARRAY_SIZE(hwsim_alpha2s))
5767                                 param.reg_alpha2 = hwsim_alpha2s[i];
5768                         break;
5769                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
5770                         if (!i)
5771                                 param.reg_alpha2 = hwsim_alpha2s[0];
5772                         break;
5773                 case HWSIM_REGTEST_STRICT_ALL:
5774                         param.reg_strict = true;
5775                         fallthrough;
5776                 case HWSIM_REGTEST_DRIVER_REG_ALL:
5777                         param.reg_alpha2 = hwsim_alpha2s[0];
5778                         break;
5779                 case HWSIM_REGTEST_WORLD_ROAM:
5780                         if (i == 0)
5781                                 param.regd = &hwsim_world_regdom_custom_01;
5782                         break;
5783                 case HWSIM_REGTEST_CUSTOM_WORLD:
5784                         param.regd = &hwsim_world_regdom_custom_01;
5785                         break;
5786                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
5787                         if (i == 0)
5788                                 param.regd = &hwsim_world_regdom_custom_01;
5789                         else if (i == 1)
5790                                 param.regd = &hwsim_world_regdom_custom_02;
5791                         break;
5792                 case HWSIM_REGTEST_STRICT_FOLLOW:
5793                         if (i == 0) {
5794                                 param.reg_strict = true;
5795                                 param.reg_alpha2 = hwsim_alpha2s[0];
5796                         }
5797                         break;
5798                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
5799                         if (i == 0) {
5800                                 param.reg_strict = true;
5801                                 param.reg_alpha2 = hwsim_alpha2s[0];
5802                         } else if (i == 1) {
5803                                 param.reg_alpha2 = hwsim_alpha2s[1];
5804                         }
5805                         break;
5806                 case HWSIM_REGTEST_ALL:
5807                         switch (i) {
5808                         case 0:
5809                                 param.regd = &hwsim_world_regdom_custom_01;
5810                                 break;
5811                         case 1:
5812                                 param.regd = &hwsim_world_regdom_custom_02;
5813                                 break;
5814                         case 2:
5815                                 param.reg_alpha2 = hwsim_alpha2s[0];
5816                                 break;
5817                         case 3:
5818                                 param.reg_alpha2 = hwsim_alpha2s[1];
5819                                 break;
5820                         case 4:
5821                                 param.reg_strict = true;
5822                                 param.reg_alpha2 = hwsim_alpha2s[2];
5823                                 break;
5824                         }
5825                         break;
5826                 default:
5827                         break;
5828                 }
5829
5830                 param.p2p_device = support_p2p_device;
5831                 param.mlo = mlo;
5832                 param.use_chanctx = channels > 1 || mlo;
5833                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5834                 if (param.p2p_device)
5835                         param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5836
5837                 err = mac80211_hwsim_new_radio(NULL, &param);
5838                 if (err < 0)
5839                         goto out_free_radios;
5840         }
5841
5842         hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
5843                                  hwsim_mon_setup);
5844         if (hwsim_mon == NULL) {
5845                 err = -ENOMEM;
5846                 goto out_free_radios;
5847         }
5848
5849         rtnl_lock();
5850         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
5851         if (err < 0) {
5852                 rtnl_unlock();
5853                 goto out_free_mon;
5854         }
5855
5856         err = register_netdevice(hwsim_mon);
5857         if (err < 0) {
5858                 rtnl_unlock();
5859                 goto out_free_mon;
5860         }
5861         rtnl_unlock();
5862
5863         return 0;
5864
5865 out_free_mon:
5866         free_netdev(hwsim_mon);
5867 out_free_radios:
5868         mac80211_hwsim_free();
5869 out_exit_virtio:
5870         hwsim_unregister_virtio_driver();
5871 out_exit_netlink:
5872         hwsim_exit_netlink();
5873 out_unregister_driver:
5874         platform_driver_unregister(&mac80211_hwsim_driver);
5875 out_unregister_pernet:
5876         unregister_pernet_device(&hwsim_net_ops);
5877 out_free_rht:
5878         rhashtable_destroy(&hwsim_radios_rht);
5879         return err;
5880 }
5881 module_init(init_mac80211_hwsim);
5882
5883 static void __exit exit_mac80211_hwsim(void)
5884 {
5885         pr_debug("mac80211_hwsim: unregister radios\n");
5886
5887         hwsim_unregister_virtio_driver();
5888         hwsim_exit_netlink();
5889
5890         mac80211_hwsim_free();
5891
5892         rhashtable_destroy(&hwsim_radios_rht);
5893         unregister_netdev(hwsim_mon);
5894         platform_driver_unregister(&mac80211_hwsim_driver);
5895         unregister_pernet_device(&hwsim_net_ops);
5896 }
5897 module_exit(exit_mac80211_hwsim);