drivers/net/wireless/virtual/mac80211_hwsim.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
   4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
   6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
   7  * Copyright (C) 2018 - 2024 Intel Corporation
   8  */
   9
  10 /*
  11  * TODO:
  12  * - Add TSF sync and fix IBSS beacon transmission by adding
  13  *   competition for "air time" at TBTT
  14  * - RX filtering based on filter configuration (data->rx_filter)
  15  */
  16
  17 #include <linux/list.h>
  18 #include <linux/slab.h>
  19 #include <linux/spinlock.h>
  20 #include <net/dst.h>
  21 #include <net/xfrm.h>
  22 #include <net/mac80211.h>
  23 #include <net/ieee80211_radiotap.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/rtnetlink.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/platform_device.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/module.h>
  30 #include <linux/ktime.h>
  31 #include <net/genetlink.h>
  32 #include <net/net_namespace.h>
  33 #include <net/netns/generic.h>
  34 #include <linux/rhashtable.h>
  35 #include <linux/nospec.h>
  36 #include <linux/virtio.h>
  37 #include <linux/virtio_ids.h>
  38 #include <linux/virtio_config.h>
  39 #include "mac80211_hwsim.h"
  40
  41 #define WARN_QUEUE 100
  42 #define MAX_QUEUE 200
  43
  44 MODULE_AUTHOR("Jouni Malinen");
  45 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
  46 MODULE_LICENSE("GPL");
  47
  48 static int radios = 2;
  49 module_param(radios, int, 0444);
  50 MODULE_PARM_DESC(radios, "Number of simulated radios");
  51
  52 static int channels = 1;
  53 module_param(channels, int, 0444);
  54 MODULE_PARM_DESC(channels, "Number of concurrent channels");
  55
  56 static bool paged_rx = false;
  57 module_param(paged_rx, bool, 0644);
  58 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
  59
  60 static bool rctbl = false;
  61 module_param(rctbl, bool, 0444);
  62 MODULE_PARM_DESC(rctbl, "Handle rate control table");
  63
  64 static bool support_p2p_device = true;
  65 module_param(support_p2p_device, bool, 0444);
  66 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
  67
  68 static bool mlo;
  69 module_param(mlo, bool, 0444);
  70 MODULE_PARM_DESC(mlo, "Support MLO");
  71
  72 /**
  73  * enum hwsim_regtest - the type of regulatory tests we offer
  74  *
  75  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
  76  *      this is the default value.
  77  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
  78  *      hint, only one driver regulatory hint will be sent as such the
  79  *      secondary radios are expected to follow.
  80  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
  81  *      request with all radios reporting the same regulatory domain.
  82  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
  83  *      different regulatory domains requests. Expected behaviour is for
  84  *      an intersection to occur but each device will still use their
  85  *      respective regulatory requested domains. Subsequent radios will
  86  *      use the resulting intersection.
  87  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
  88  *      this by using a custom beacon-capable regulatory domain for the first
  89  *      radio. All other device world roam.
  90  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
  91  *      domain requests. All radios will adhere to this custom world regulatory
  92  *      domain.
  93  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
  94  *      domain requests. The first radio will adhere to the first custom world
  95  *      regulatory domain, the second one to the second custom world regulatory
  96  *      domain. All other devices will world roam.
  97  * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
  98  *      settings, only the first radio will send a regulatory domain request
  99  *      and use strict settings. The rest of the radios are expected to follow.
 100  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
 101  *      settings. All radios will adhere to this.
 102  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
 103  *      domain settings, combined with secondary driver regulatory domain
 104  *      settings. The first radio will get a strict regulatory domain setting
 105  *      using the first driver regulatory request and the second radio will use
 106  *      non-strict settings using the second driver regulatory request. All
 107  *      other devices should follow the intersection created between the
 108  *      first two.
 109  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
 110  *      at least 6 radios for a complete test. We will test in this order:
 111  *      1 - driver custom world regulatory domain
 112  *      2 - second custom world regulatory domain
 113  *      3 - first driver regulatory domain request
 114  *      4 - second driver regulatory domain request
 115  *      5 - strict regulatory domain settings using the third driver regulatory
 116  *          domain request
 117  *      6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
 118  *                 regulatory requests.
 119  *
 120  * These are the different values you can use for the regtest
 121  * module parameter. This is useful to help test world roaming
 122  * and the driver regulatory_hint() call and combinations of these.
 123  * If you want to do specific alpha2 regulatory domain tests simply
 124  * use the userspace regulatory request as that will be respected as
 125  * well without the need of this module parameter. This is designed
 126  * only for testing the driver regulatory request, world roaming
 127  * and all possible combinations.
 128  */
 129 enum hwsim_regtest {
 130         HWSIM_REGTEST_DISABLED = 0,
 131         HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
 132         HWSIM_REGTEST_DRIVER_REG_ALL = 2,
 133         HWSIM_REGTEST_DIFF_COUNTRY = 3,
 134         HWSIM_REGTEST_WORLD_ROAM = 4,
 135         HWSIM_REGTEST_CUSTOM_WORLD = 5,
 136         HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
 137         HWSIM_REGTEST_STRICT_FOLLOW = 7,
 138         HWSIM_REGTEST_STRICT_ALL = 8,
 139         HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
 140         HWSIM_REGTEST_ALL = 10,
 141 };
 142
 143 /* Set to one of the HWSIM_REGTEST_* values above */
 144 static int regtest = HWSIM_REGTEST_DISABLED;
 145 module_param(regtest, int, 0444);
 146 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
 147
 148 static const char *hwsim_alpha2s[] = {
 149         "FI",
 150         "AL",
 151         "US",
 152         "DE",
 153         "JP",
 154         "AL",
 155 };
 156
 157 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
 158         .n_reg_rules = 5,
 159         .alpha2 =  "99",
 160         .reg_rules = {
 161                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 162                 REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
 163                 REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
 164                 REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
 165                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 166         }
 167 };
 168
 169 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
 170         .n_reg_rules = 3,
 171         .alpha2 =  "99",
 172         .reg_rules = {
 173                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 174                 REG_RULE(5725-10, 5850+10, 40, 0, 30,
 175                          NL80211_RRF_NO_IR),
 176                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 177         }
 178 };
 179
 180 static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
 181         .n_reg_rules = 6,
 182         .alpha2 =  "99",
 183         .reg_rules = {
 184                 REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 185                 REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 186                 REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
 187                 REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
 188                 REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
 189                 REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
 190         }
 191 };
 192
 193 static const struct ieee80211_regdomain hwsim_world_regdom_custom_04 = {
 194         .n_reg_rules = 6,
 195         .alpha2 =  "99",
 196         .reg_rules = {
 197                 REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 198                 REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 199                 REG_RULE(5150 - 10, 5240 + 10, 80, 0, 30, NL80211_RRF_AUTO_BW),
 200                 REG_RULE(5260 - 10, 5320 + 10, 80, 0, 30,
 201                          NL80211_RRF_DFS_CONCURRENT | NL80211_RRF_DFS |
 202                          NL80211_RRF_AUTO_BW),
 203                 REG_RULE(5500 - 10, 5720 + 10, 160, 0, 30,
 204                          NL80211_RRF_DFS_CONCURRENT | NL80211_RRF_DFS),
 205                 REG_RULE(5745 - 10, 5825 + 10, 80, 0, 30, 0),
 206                 REG_RULE(5855 - 10, 5925 + 10, 80, 0, 33, 0),
 207         }
 208 };
 209
 210 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
 211         &hwsim_world_regdom_custom_01,
 212         &hwsim_world_regdom_custom_02,
 213         &hwsim_world_regdom_custom_03,
 214         &hwsim_world_regdom_custom_04,
 215 };
 216
 217 struct hwsim_vif_priv {
 218         u32 magic;
 219         u32 skip_beacons[IEEE80211_MLD_MAX_NUM_LINKS];
 220         u8 bssid[ETH_ALEN];
 221         bool assoc;
 222         bool bcn_en;
 223         u16 aid;
 224 };
 225
 226 #define HWSIM_VIF_MAGIC 0x69537748
 227
 228 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
 229 {
 230         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 231         WARN(vp->magic != HWSIM_VIF_MAGIC,
 232              "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
 233              vif, vp->magic, vif->addr, vif->type, vif->p2p);
 234 }
 235
 236 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
 237 {
 238         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 239         vp->magic = HWSIM_VIF_MAGIC;
 240 }
 241
 242 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
 243 {
 244         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 245         vp->magic = 0;
 246 }
 247
 248 struct hwsim_sta_priv {
 249         u32 magic;
 250         unsigned int last_link;
 251         u16 active_links_rx;
 252 };
 253
 254 #define HWSIM_STA_MAGIC 0x6d537749
 255
 256 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
 257 {
 258         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 259         WARN_ON(sp->magic != HWSIM_STA_MAGIC);
 260 }
 261
 262 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
 263 {
 264         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 265         sp->magic = HWSIM_STA_MAGIC;
 266 }
 267
 268 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
 269 {
 270         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 271         sp->magic = 0;
 272 }
 273
 274 struct hwsim_chanctx_priv {
 275         u32 magic;
 276 };
 277
 278 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
 279
 280 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
 281 {
 282         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 283         WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
 284 }
 285
 286 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
 287 {
 288         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 289         cp->magic = HWSIM_CHANCTX_MAGIC;
 290 }
 291
 292 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
 293 {
 294         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 295         cp->magic = 0;
 296 }
 297
 298 static unsigned int hwsim_net_id;
 299
 300 static DEFINE_IDA(hwsim_netgroup_ida);
 301
 302 struct hwsim_net {
 303         int netgroup;
 304         u32 wmediumd;
 305 };
 306
 307 static inline int hwsim_net_get_netgroup(struct net *net)
 308 {
 309         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 310
 311         return hwsim_net->netgroup;
 312 }
 313
 314 static inline int hwsim_net_set_netgroup(struct net *net)
 315 {
 316         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 317
 318         hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
 319         return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
 320 }
 321
 322 static inline u32 hwsim_net_get_wmediumd(struct net *net)
 323 {
 324         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 325
 326         return hwsim_net->wmediumd;
 327 }
 328
 329 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
 330 {
 331         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 332
 333         hwsim_net->wmediumd = portid;
 334 }
 335
 336 static struct class *hwsim_class;
 337
 338 static struct net_device *hwsim_mon; /* global monitor netdev */
 339
 340 #define CHAN2G(_freq)  { \
 341         .band = NL80211_BAND_2GHZ, \
 342         .center_freq = (_freq), \
 343         .hw_value = (_freq), \
 344 }
 345
 346 #define CHAN5G(_freq) { \
 347         .band = NL80211_BAND_5GHZ, \
 348         .center_freq = (_freq), \
 349         .hw_value = (_freq), \
 350 }
 351
 352 #define CHAN6G(_freq) { \
 353         .band = NL80211_BAND_6GHZ, \
 354         .center_freq = (_freq), \
 355         .hw_value = (_freq), \
 356 }
 357
 358 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
 359         CHAN2G(2412), /* Channel 1 */
 360         CHAN2G(2417), /* Channel 2 */
 361         CHAN2G(2422), /* Channel 3 */
 362         CHAN2G(2427), /* Channel 4 */
 363         CHAN2G(2432), /* Channel 5 */
 364         CHAN2G(2437), /* Channel 6 */
 365         CHAN2G(2442), /* Channel 7 */
 366         CHAN2G(2447), /* Channel 8 */
 367         CHAN2G(2452), /* Channel 9 */
 368         CHAN2G(2457), /* Channel 10 */
 369         CHAN2G(2462), /* Channel 11 */
 370         CHAN2G(2467), /* Channel 12 */
 371         CHAN2G(2472), /* Channel 13 */
 372         CHAN2G(2484), /* Channel 14 */
 373 };
 374
 375 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
 376         CHAN5G(5180), /* Channel 36 */
 377         CHAN5G(5200), /* Channel 40 */
 378         CHAN5G(5220), /* Channel 44 */
 379         CHAN5G(5240), /* Channel 48 */
 380
 381         CHAN5G(5260), /* Channel 52 */
 382         CHAN5G(5280), /* Channel 56 */
 383         CHAN5G(5300), /* Channel 60 */
 384         CHAN5G(5320), /* Channel 64 */
 385
 386         CHAN5G(5500), /* Channel 100 */
 387         CHAN5G(5520), /* Channel 104 */
 388         CHAN5G(5540), /* Channel 108 */
 389         CHAN5G(5560), /* Channel 112 */
 390         CHAN5G(5580), /* Channel 116 */
 391         CHAN5G(5600), /* Channel 120 */
 392         CHAN5G(5620), /* Channel 124 */
 393         CHAN5G(5640), /* Channel 128 */
 394         CHAN5G(5660), /* Channel 132 */
 395         CHAN5G(5680), /* Channel 136 */
 396         CHAN5G(5700), /* Channel 140 */
 397
 398         CHAN5G(5745), /* Channel 149 */
 399         CHAN5G(5765), /* Channel 153 */
 400         CHAN5G(5785), /* Channel 157 */
 401         CHAN5G(5805), /* Channel 161 */
 402         CHAN5G(5825), /* Channel 165 */
 403         CHAN5G(5845), /* Channel 169 */
 404
 405         CHAN5G(5855), /* Channel 171 */
 406         CHAN5G(5860), /* Channel 172 */
 407         CHAN5G(5865), /* Channel 173 */
 408         CHAN5G(5870), /* Channel 174 */
 409
 410         CHAN5G(5875), /* Channel 175 */
 411         CHAN5G(5880), /* Channel 176 */
 412         CHAN5G(5885), /* Channel 177 */
 413         CHAN5G(5890), /* Channel 178 */
 414         CHAN5G(5895), /* Channel 179 */
 415         CHAN5G(5900), /* Channel 180 */
 416         CHAN5G(5905), /* Channel 181 */
 417
 418         CHAN5G(5910), /* Channel 182 */
 419         CHAN5G(5915), /* Channel 183 */
 420         CHAN5G(5920), /* Channel 184 */
 421         CHAN5G(5925), /* Channel 185 */
 422 };
 423
 424 static const struct ieee80211_channel hwsim_channels_6ghz[] = {
 425         CHAN6G(5955), /* Channel 1 */
 426         CHAN6G(5975), /* Channel 5 */
 427         CHAN6G(5995), /* Channel 9 */
 428         CHAN6G(6015), /* Channel 13 */
 429         CHAN6G(6035), /* Channel 17 */
 430         CHAN6G(6055), /* Channel 21 */
 431         CHAN6G(6075), /* Channel 25 */
 432         CHAN6G(6095), /* Channel 29 */
 433         CHAN6G(6115), /* Channel 33 */
 434         CHAN6G(6135), /* Channel 37 */
 435         CHAN6G(6155), /* Channel 41 */
 436         CHAN6G(6175), /* Channel 45 */
 437         CHAN6G(6195), /* Channel 49 */
 438         CHAN6G(6215), /* Channel 53 */
 439         CHAN6G(6235), /* Channel 57 */
 440         CHAN6G(6255), /* Channel 61 */
 441         CHAN6G(6275), /* Channel 65 */
 442         CHAN6G(6295), /* Channel 69 */
 443         CHAN6G(6315), /* Channel 73 */
 444         CHAN6G(6335), /* Channel 77 */
 445         CHAN6G(6355), /* Channel 81 */
 446         CHAN6G(6375), /* Channel 85 */
 447         CHAN6G(6395), /* Channel 89 */
 448         CHAN6G(6415), /* Channel 93 */
 449         CHAN6G(6435), /* Channel 97 */
 450         CHAN6G(6455), /* Channel 181 */
 451         CHAN6G(6475), /* Channel 105 */
 452         CHAN6G(6495), /* Channel 109 */
 453         CHAN6G(6515), /* Channel 113 */
 454         CHAN6G(6535), /* Channel 117 */
 455         CHAN6G(6555), /* Channel 121 */
 456         CHAN6G(6575), /* Channel 125 */
 457         CHAN6G(6595), /* Channel 129 */
 458         CHAN6G(6615), /* Channel 133 */
 459         CHAN6G(6635), /* Channel 137 */
 460         CHAN6G(6655), /* Channel 141 */
 461         CHAN6G(6675), /* Channel 145 */
 462         CHAN6G(6695), /* Channel 149 */
 463         CHAN6G(6715), /* Channel 153 */
 464         CHAN6G(6735), /* Channel 157 */
 465         CHAN6G(6755), /* Channel 161 */
 466         CHAN6G(6775), /* Channel 165 */
 467         CHAN6G(6795), /* Channel 169 */
 468         CHAN6G(6815), /* Channel 173 */
 469         CHAN6G(6835), /* Channel 177 */
 470         CHAN6G(6855), /* Channel 181 */
 471         CHAN6G(6875), /* Channel 185 */
 472         CHAN6G(6895), /* Channel 189 */
 473         CHAN6G(6915), /* Channel 193 */
 474         CHAN6G(6935), /* Channel 197 */
 475         CHAN6G(6955), /* Channel 201 */
 476         CHAN6G(6975), /* Channel 205 */
 477         CHAN6G(6995), /* Channel 209 */
 478         CHAN6G(7015), /* Channel 213 */
 479         CHAN6G(7035), /* Channel 217 */
 480         CHAN6G(7055), /* Channel 221 */
 481         CHAN6G(7075), /* Channel 225 */
 482         CHAN6G(7095), /* Channel 229 */
 483         CHAN6G(7115), /* Channel 233 */
 484 };
 485
 486 #define NUM_S1G_CHANS_US 51
 487 static struct ieee80211_channel hwsim_channels_s1g[NUM_S1G_CHANS_US];
 488
 489 static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
 490         .s1g = true,
 491         .cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
 492                  0,
 493                  0,
 494                  S1G_CAP3_MAX_MPDU_LEN,
 495                  0,
 496                  S1G_CAP5_AMPDU,
 497                  0,
 498                  S1G_CAP7_DUP_1MHZ,
 499                  S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
 500                  0},
 501         .nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
 502         /* RX Highest Supported Long GI Data Rate 0:7 */
 503                      0,
 504         /* RX Highest Supported Long GI Data Rate 0:7 */
 505         /* TX S1G MCS Map 0:6 */
 506                      0xfa,
 507         /* TX S1G MCS Map :7 */
 508         /* TX Highest Supported Long GI Data Rate 0:6 */
 509                      0x80,
 510         /* TX Highest Supported Long GI Data Rate 7:8 */
 511         /* Rx Single spatial stream and S1G-MCS Map for 1MHz */
 512         /* Tx Single spatial stream and S1G-MCS Map for 1MHz */
 513                      0 },
 514 };
 515
 516 static void hwsim_init_s1g_channels(struct ieee80211_channel *chans)
 517 {
 518         int ch, freq;
 519
 520         for (ch = 0; ch < NUM_S1G_CHANS_US; ch++) {
 521                 freq = 902000 + (ch + 1) * 500;
 522                 chans[ch].band = NL80211_BAND_S1GHZ;
 523                 chans[ch].center_freq = KHZ_TO_MHZ(freq);
 524                 chans[ch].freq_offset = freq % 1000;
 525                 chans[ch].hw_value = ch + 1;
 526         }
 527 }
 528
 529 static const struct ieee80211_rate hwsim_rates[] = {
 530         { .bitrate = 10 },
 531         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 532         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 533         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 534         { .bitrate = 60 },
 535         { .bitrate = 90 },
 536         { .bitrate = 120 },
 537         { .bitrate = 180 },
 538         { .bitrate = 240 },
 539         { .bitrate = 360 },
 540         { .bitrate = 480 },
 541         { .bitrate = 540 }
 542 };
 543
 544 #define DEFAULT_RX_RSSI -50
 545
 546 static const u32 hwsim_ciphers[] = {
 547         WLAN_CIPHER_SUITE_WEP40,
 548         WLAN_CIPHER_SUITE_WEP104,
 549         WLAN_CIPHER_SUITE_TKIP,
 550         WLAN_CIPHER_SUITE_CCMP,
 551         WLAN_CIPHER_SUITE_CCMP_256,
 552         WLAN_CIPHER_SUITE_GCMP,
 553         WLAN_CIPHER_SUITE_GCMP_256,
 554         WLAN_CIPHER_SUITE_AES_CMAC,
 555         WLAN_CIPHER_SUITE_BIP_CMAC_256,
 556         WLAN_CIPHER_SUITE_BIP_GMAC_128,
 557         WLAN_CIPHER_SUITE_BIP_GMAC_256,
 558 };
 559
 560 #define OUI_QCA 0x001374
 561 #define QCA_NL80211_SUBCMD_TEST 1
 562 enum qca_nl80211_vendor_subcmds {
 563         QCA_WLAN_VENDOR_ATTR_TEST = 8,
 564         QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
 565 };
 566
 567 static const struct nla_policy
 568 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
 569         [QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
 570 };
 571
 572 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
 573                                           struct wireless_dev *wdev,
 574                                           const void *data, int data_len)
 575 {
 576         struct sk_buff *skb;
 577         struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 578         int err;
 579         u32 val;
 580
 581         err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
 582                                    data_len, hwsim_vendor_test_policy, NULL);
 583         if (err)
 584                 return err;
 585         if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
 586                 return -EINVAL;
 587         val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
 588         wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
 589
 590         /* Send a vendor event as a test. Note that this would not normally be
 591          * done within a command handler, but rather, based on some other
 592          * trigger. For simplicity, this command is used to trigger the event
 593          * here.
 594          *
 595          * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
 596          */
 597         skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
 598         if (skb) {
 599                 /* skb_put() or nla_put() will fill up data within
 600                  * NL80211_ATTR_VENDOR_DATA.
 601                  */
 602
 603                 /* Add vendor data */
 604                 nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
 605
 606                 /* Send the event - this will call nla_nest_end() */
 607                 cfg80211_vendor_event(skb, GFP_KERNEL);
 608         }
 609
 610         /* Send a response to the command */
 611         skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
 612         if (!skb)
 613                 return -ENOMEM;
 614
 615         /* skb_put() or nla_put() will fill up data within
 616          * NL80211_ATTR_VENDOR_DATA
 617          */
 618         nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
 619
 620         return cfg80211_vendor_cmd_reply(skb);
 621 }
 622
 623 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
 624         {
 625                 .info = { .vendor_id = OUI_QCA,
 626                           .subcmd = QCA_NL80211_SUBCMD_TEST },
 627                 .flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
 628                 .doit = mac80211_hwsim_vendor_cmd_test,
 629                 .policy = hwsim_vendor_test_policy,
 630                 .maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
 631         }
 632 };
 633
 634 /* Advertise support vendor specific events */
 635 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
 636         { .vendor_id = OUI_QCA, .subcmd = 1 },
 637 };
 638
 639 static DEFINE_SPINLOCK(hwsim_radio_lock);
 640 static LIST_HEAD(hwsim_radios);
 641 static struct rhashtable hwsim_radios_rht;
 642 static int hwsim_radio_idx;
 643 static int hwsim_radios_generation = 1;
 644
 645 static struct platform_driver mac80211_hwsim_driver = {
 646         .driver = {
 647                 .name = "mac80211_hwsim",
 648         },
 649 };
 650
 651 struct mac80211_hwsim_link_data {
 652         u32 link_id;
 653         u64 beacon_int  /* beacon interval in us */;
 654         struct hrtimer beacon_timer;
 655 };
 656
 657 struct mac80211_hwsim_data {
 658         struct list_head list;
 659         struct rhash_head rht;
 660         struct ieee80211_hw *hw;
 661         struct device *dev;
 662         struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 663         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
 664         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
 665         struct ieee80211_channel channels_6ghz[ARRAY_SIZE(hwsim_channels_6ghz)];
 666         struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
 667         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 668         struct ieee80211_iface_combination if_combination;
 669         struct ieee80211_iface_limit if_limits[3];
 670         int n_if_limits;
 671
 672         u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
 673
 674         struct mac_address addresses[2];
 675         int channels, idx;
 676         bool use_chanctx;
 677         bool destroy_on_close;
 678         u32 portid;
 679         char alpha2[2];
 680         const struct ieee80211_regdomain *regd;
 681
 682         struct ieee80211_channel *tmp_chan;
 683         struct ieee80211_channel *roc_chan;
 684         u32 roc_duration;
 685         struct delayed_work roc_start;
 686         struct delayed_work roc_done;
 687         struct delayed_work hw_scan;
 688         struct cfg80211_scan_request *hw_scan_request;
 689         struct ieee80211_vif *hw_scan_vif;
 690         int scan_chan_idx;
 691         u8 scan_addr[ETH_ALEN];
 692         struct {
 693                 struct ieee80211_channel *channel;
 694                 unsigned long next_start, start, end;
 695         } survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
 696                       ARRAY_SIZE(hwsim_channels_5ghz) +
 697                       ARRAY_SIZE(hwsim_channels_6ghz)];
 698
 699         struct ieee80211_channel *channel;
 700         enum nl80211_chan_width bw;
 701         unsigned int rx_filter;
 702         bool started, idle, scanning;
 703         struct mutex mutex;
 704         enum ps_mode {
 705                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
 706         } ps;
 707         bool ps_poll_pending;
 708         struct dentry *debugfs;
 709
 710         atomic_t pending_cookie;
 711         struct sk_buff_head pending;    /* packets pending */
 712         /*
 713          * Only radios in the same group can communicate together (the
 714          * channel has to match too). Each bit represents a group. A
 715          * radio can be in more than one group.
 716          */
 717         u64 group;
 718
 719         /* group shared by radios created in the same netns */
 720         int netgroup;
 721         /* wmediumd portid responsible for netgroup of this radio */
 722         u32 wmediumd;
 723
 724         /* difference between this hw's clock and the real clock, in usecs */
 725         s64 tsf_offset;
 726         s64 bcn_delta;
 727         /* absolute beacon transmission time. Used to cover up "tx" delay. */
 728         u64 abs_bcn_ts;
 729
 730         /* Stats */
 731         u64 tx_pkts;
 732         u64 rx_pkts;
 733         u64 tx_bytes;
 734         u64 rx_bytes;
 735         u64 tx_dropped;
 736         u64 tx_failed;
 737
 738         /* RSSI in rx status of the receiver */
 739         int rx_rssi;
 740
 741         /* only used when pmsr capability is supplied */
 742         struct cfg80211_pmsr_capabilities pmsr_capa;
 743         struct cfg80211_pmsr_request *pmsr_request;
 744         struct wireless_dev *pmsr_request_wdev;
 745
 746         struct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];
 747 };
 748
 749 static const struct rhashtable_params hwsim_rht_params = {
 750         .nelem_hint = 2,
 751         .automatic_shrinking = true,
 752         .key_len = ETH_ALEN,
 753         .key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
 754         .head_offset = offsetof(struct mac80211_hwsim_data, rht),
 755 };
 756
 757 struct hwsim_radiotap_hdr {
 758         struct ieee80211_radiotap_header hdr;
 759         __le64 rt_tsft;
 760         u8 rt_flags;
 761         u8 rt_rate;
 762         __le16 rt_channel;
 763         __le16 rt_chbitmask;
 764 } __packed;
 765
 766 struct hwsim_radiotap_ack_hdr {
 767         struct ieee80211_radiotap_header hdr;
 768         u8 rt_flags;
 769         u8 pad;
 770         __le16 rt_channel;
 771         __le16 rt_chbitmask;
 772 } __packed;
 773
 774 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
 775 {
 776         return rhashtable_lookup_fast(&hwsim_radios_rht, addr, hwsim_rht_params);
 777 }
 778
 779 /* MAC80211_HWSIM netlink family */
 780 static struct genl_family hwsim_genl_family;
 781
 782 enum hwsim_multicast_groups {
 783         HWSIM_MCGRP_CONFIG,
 784 };
 785
 786 static const struct genl_multicast_group hwsim_mcgrps[] = {
 787         [HWSIM_MCGRP_CONFIG] = { .name = "config", },
 788 };
 789
 790 /* MAC80211_HWSIM netlink policy */
 791
 792 static const struct nla_policy
 793 hwsim_rate_info_policy[HWSIM_RATE_INFO_ATTR_MAX + 1] = {
 794         [HWSIM_RATE_INFO_ATTR_FLAGS] = { .type = NLA_U8 },
 795         [HWSIM_RATE_INFO_ATTR_MCS] = { .type = NLA_U8 },
 796         [HWSIM_RATE_INFO_ATTR_LEGACY] = { .type = NLA_U16 },
 797         [HWSIM_RATE_INFO_ATTR_NSS] = { .type = NLA_U8 },
 798         [HWSIM_RATE_INFO_ATTR_BW] = { .type = NLA_U8 },
 799         [HWSIM_RATE_INFO_ATTR_HE_GI] = { .type = NLA_U8 },
 800         [HWSIM_RATE_INFO_ATTR_HE_DCM] = { .type = NLA_U8 },
 801         [HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC] = { .type = NLA_U8 },
 802         [HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH] = { .type = NLA_U8 },
 803         [HWSIM_RATE_INFO_ATTR_EHT_GI] = { .type = NLA_U8 },
 804         [HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC] = { .type = NLA_U8 },
 805 };
 806
 807 static const struct nla_policy
 808 hwsim_ftm_result_policy[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1] = {
 809         [NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON] = { .type = NLA_U32 },
 810         [NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX] = { .type = NLA_U16 },
 811         [NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS] = { .type = NLA_U32 },
 812         [NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES] = { .type = NLA_U32 },
 813         [NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME] = { .type = NLA_U8 },
 814         [NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP] = { .type = NLA_U8 },
 815         [NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION] = { .type = NLA_U8 },
 816         [NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
 817         [NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG] = { .type = NLA_U32 },
 818         [NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD] = { .type = NLA_U32 },
 819         [NL80211_PMSR_FTM_RESP_ATTR_TX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 820         [NL80211_PMSR_FTM_RESP_ATTR_RX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 821         [NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG] = { .type = NLA_U64 },
 822         [NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE] = { .type = NLA_U64 },
 823         [NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD] = { .type = NLA_U64 },
 824         [NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG] = { .type = NLA_U64 },
 825         [NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE] = { .type = NLA_U64 },
 826         [NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD] = { .type = NLA_U64 },
 827         [NL80211_PMSR_FTM_RESP_ATTR_LCI] = { .type = NLA_STRING },
 828         [NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_STRING },
 829 };
 830
 831 static const struct nla_policy
 832 hwsim_pmsr_resp_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 833         [NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_result_policy),
 834 };
 835
 836 static const struct nla_policy
 837 hwsim_pmsr_resp_policy[NL80211_PMSR_RESP_ATTR_MAX + 1] = {
 838         [NL80211_PMSR_RESP_ATTR_STATUS] = { .type = NLA_U32 },
 839         [NL80211_PMSR_RESP_ATTR_HOST_TIME] = { .type = NLA_U64 },
 840         [NL80211_PMSR_RESP_ATTR_AP_TSF] = { .type = NLA_U64 },
 841         [NL80211_PMSR_RESP_ATTR_FINAL] = { .type = NLA_FLAG },
 842         [NL80211_PMSR_RESP_ATTR_DATA] = NLA_POLICY_NESTED(hwsim_pmsr_resp_type_policy),
 843 };
 844
 845 static const struct nla_policy
 846 hwsim_pmsr_peer_result_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 847         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 848         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_REJECT },
 849         [NL80211_PMSR_PEER_ATTR_REQ] = { .type = NLA_REJECT },
 850         [NL80211_PMSR_PEER_ATTR_RESP] = NLA_POLICY_NESTED(hwsim_pmsr_resp_policy),
 851 };
 852
 853 static const struct nla_policy
 854 hwsim_pmsr_peers_result_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 855         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 856         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 857         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 858         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 859         [NL80211_PMSR_ATTR_PEERS] = NLA_POLICY_NESTED_ARRAY(hwsim_pmsr_peer_result_policy),
 860 };
 861
 862 static const struct nla_policy
 863 hwsim_ftm_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
 864         [NL80211_PMSR_FTM_CAPA_ATTR_ASAP] = { .type = NLA_FLAG },
 865         [NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP] = { .type = NLA_FLAG },
 866         [NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI] = { .type = NLA_FLAG },
 867         [NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC] = { .type = NLA_FLAG },
 868         [NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES] = { .type = NLA_U32 },
 869         [NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS] = { .type = NLA_U32 },
 870         [NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT] = NLA_POLICY_MAX(NLA_U8, 15),
 871         [NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST] = NLA_POLICY_MAX(NLA_U8, 31),
 872         [NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 873         [NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 874 };
 875
 876 static const struct nla_policy
 877 hwsim_pmsr_capa_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 878         [NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_capa_policy),
 879 };
 880
 881 static const struct nla_policy
 882 hwsim_pmsr_capa_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 883         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_U32 },
 884         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_FLAG },
 885         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_FLAG },
 886         [NL80211_PMSR_ATTR_TYPE_CAPA] = NLA_POLICY_NESTED(hwsim_pmsr_capa_type_policy),
 887         [NL80211_PMSR_ATTR_PEERS] = { .type = NLA_REJECT }, // only for request.
 888 };
 889
 890 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
 891         [HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
 892         [HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
 893         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
 894                                .len = IEEE80211_MAX_DATA_LEN },
 895         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
 896         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
 897         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
 898         [HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
 899                                  .len = IEEE80211_TX_MAX_RATES *
 900                                         sizeof(struct hwsim_tx_rate)},
 901         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
 902         [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
 903         [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
 904         [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 905         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
 906         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 907         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
 908         [HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
 909         [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
 910         [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
 911         [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
 912         [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 913         [HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
 914         [HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 915         [HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
 916         [HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
 917         [HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 918         [HWSIM_ATTR_PMSR_SUPPORT] = NLA_POLICY_NESTED(hwsim_pmsr_capa_policy),
 919         [HWSIM_ATTR_PMSR_RESULT] = NLA_POLICY_NESTED(hwsim_pmsr_peers_result_policy),
 920 };
 921
 922 #if IS_REACHABLE(CONFIG_VIRTIO)
 923
 924 /* MAC80211_HWSIM virtio queues */
 925 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
 926 static bool hwsim_virtio_enabled;
 927 static DEFINE_SPINLOCK(hwsim_virtio_lock);
 928
 929 static void hwsim_virtio_rx_work(struct work_struct *work);
 930 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
 931
 932 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 933                            struct sk_buff *skb)
 934 {
 935         struct scatterlist sg[1];
 936         unsigned long flags;
 937         int err;
 938
 939         spin_lock_irqsave(&hwsim_virtio_lock, flags);
 940         if (!hwsim_virtio_enabled) {
 941                 err = -ENODEV;
 942                 goto out_free;
 943         }
 944
 945         sg_init_one(sg, skb->head, skb_end_offset(skb));
 946         err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
 947                                    GFP_ATOMIC);
 948         if (err)
 949                 goto out_free;
 950         virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
 951         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 952         return 0;
 953
 954 out_free:
 955         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 956         nlmsg_free(skb);
 957         return err;
 958 }
 959 #else
 960 /* cause a linker error if this ends up being needed */
 961 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 962                            struct sk_buff *skb);
 963 #define hwsim_virtio_enabled false
 964 #endif
 965
 966 static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
 967 {
 968         switch (bw) {
 969         case NL80211_CHAN_WIDTH_20_NOHT:
 970         case NL80211_CHAN_WIDTH_20:
 971                 return 20;
 972         case NL80211_CHAN_WIDTH_40:
 973                 return 40;
 974         case NL80211_CHAN_WIDTH_80:
 975                 return 80;
 976         case NL80211_CHAN_WIDTH_80P80:
 977         case NL80211_CHAN_WIDTH_160:
 978                 return 160;
 979         case NL80211_CHAN_WIDTH_320:
 980                 return 320;
 981         case NL80211_CHAN_WIDTH_5:
 982                 return 5;
 983         case NL80211_CHAN_WIDTH_10:
 984                 return 10;
 985         case NL80211_CHAN_WIDTH_1:
 986                 return 1;
 987         case NL80211_CHAN_WIDTH_2:
 988                 return 2;
 989         case NL80211_CHAN_WIDTH_4:
 990                 return 4;
 991         case NL80211_CHAN_WIDTH_8:
 992                 return 8;
 993         case NL80211_CHAN_WIDTH_16:
 994                 return 16;
 995         }
 996
 997         return INT_MAX;
 998 }
 999
1000 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
1001                                     struct sk_buff *skb,
1002                                     struct ieee80211_channel *chan);
1003
1004 /* sysfs attributes */
1005 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
1006 {
1007         struct mac80211_hwsim_data *data = dat;
1008         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1009         struct sk_buff *skb;
1010         struct ieee80211_pspoll *pspoll;
1011
1012         if (!vp->assoc)
1013                 return;
1014
1015         wiphy_dbg(data->hw->wiphy,
1016                   "%s: send PS-Poll to %pM for aid %d\n",
1017                   __func__, vp->bssid, vp->aid);
1018
1019         skb = dev_alloc_skb(sizeof(*pspoll));
1020         if (!skb)
1021                 return;
1022         pspoll = skb_put(skb, sizeof(*pspoll));
1023         pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1024                                             IEEE80211_STYPE_PSPOLL |
1025                                             IEEE80211_FCTL_PM);
1026         pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
1027         memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
1028         memcpy(pspoll->ta, mac, ETH_ALEN);
1029
1030         rcu_read_lock();
1031         mac80211_hwsim_tx_frame(data->hw, skb,
1032                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1033         rcu_read_unlock();
1034 }
1035
1036 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
1037                                 struct ieee80211_vif *vif, int ps)
1038 {
1039         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1040         struct sk_buff *skb;
1041         struct ieee80211_hdr *hdr;
1042         struct ieee80211_tx_info *cb;
1043
1044         if (!vp->assoc)
1045                 return;
1046
1047         wiphy_dbg(data->hw->wiphy,
1048                   "%s: send data::nullfunc to %pM ps=%d\n",
1049                   __func__, vp->bssid, ps);
1050
1051         skb = dev_alloc_skb(sizeof(*hdr));
1052         if (!skb)
1053                 return;
1054         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
1055         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
1056                                          IEEE80211_STYPE_NULLFUNC |
1057                                          IEEE80211_FCTL_TODS |
1058                                          (ps ? IEEE80211_FCTL_PM : 0));
1059         hdr->duration_id = cpu_to_le16(0);
1060         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
1061         memcpy(hdr->addr2, mac, ETH_ALEN);
1062         memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
1063
1064         cb = IEEE80211_SKB_CB(skb);
1065         cb->control.rates[0].count = 1;
1066         cb->control.rates[1].idx = -1;
1067
1068         rcu_read_lock();
1069         mac80211_hwsim_tx_frame(data->hw, skb,
1070                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1071         rcu_read_unlock();
1072 }
1073
1074
1075 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
1076                                    struct ieee80211_vif *vif)
1077 {
1078         struct mac80211_hwsim_data *data = dat;
1079         hwsim_send_nullfunc(data, mac, vif, 1);
1080 }
1081
1082 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
1083                                       struct ieee80211_vif *vif)
1084 {
1085         struct mac80211_hwsim_data *data = dat;
1086         hwsim_send_nullfunc(data, mac, vif, 0);
1087 }
1088
1089 static int hwsim_fops_ps_read(void *dat, u64 *val)
1090 {
1091         struct mac80211_hwsim_data *data = dat;
1092         *val = data->ps;
1093         return 0;
1094 }
1095
1096 static int hwsim_fops_ps_write(void *dat, u64 val)
1097 {
1098         struct mac80211_hwsim_data *data = dat;
1099         enum ps_mode old_ps;
1100
1101         if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
1102             val != PS_MANUAL_POLL)
1103                 return -EINVAL;
1104
1105         if (val == PS_MANUAL_POLL) {
1106                 if (data->ps != PS_ENABLED)
1107                         return -EINVAL;
1108                 local_bh_disable();
1109                 ieee80211_iterate_active_interfaces_atomic(
1110                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1111                         hwsim_send_ps_poll, data);
1112                 local_bh_enable();
1113                 return 0;
1114         }
1115         old_ps = data->ps;
1116         data->ps = val;
1117
1118         local_bh_disable();
1119         if (old_ps == PS_DISABLED && val != PS_DISABLED) {
1120                 ieee80211_iterate_active_interfaces_atomic(
1121                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1122                         hwsim_send_nullfunc_ps, data);
1123         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
1124                 ieee80211_iterate_active_interfaces_atomic(
1125                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1126                         hwsim_send_nullfunc_no_ps, data);
1127         }
1128         local_bh_enable();
1129
1130         return 0;
1131 }
1132
1133 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1134                          "%llu\n");
1135
1136 static int hwsim_write_simulate_radar(void *dat, u64 val)
1137 {
1138         struct mac80211_hwsim_data *data = dat;
1139
1140         ieee80211_radar_detected(data->hw);
1141
1142         return 0;
1143 }
1144
1145 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1146                          hwsim_write_simulate_radar, "%llu\n");
1147
1148 static int hwsim_fops_group_read(void *dat, u64 *val)
1149 {
1150         struct mac80211_hwsim_data *data = dat;
1151         *val = data->group;
1152         return 0;
1153 }
1154
1155 static int hwsim_fops_group_write(void *dat, u64 val)
1156 {
1157         struct mac80211_hwsim_data *data = dat;
1158         data->group = val;
1159         return 0;
1160 }
1161
1162 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1163                          hwsim_fops_group_read, hwsim_fops_group_write,
1164                          "%llx\n");
1165
1166 static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1167 {
1168         struct mac80211_hwsim_data *data = dat;
1169         *val = data->rx_rssi;
1170         return 0;
1171 }
1172
1173 static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1174 {
1175         struct mac80211_hwsim_data *data = dat;
1176         int rssi = (int)val;
1177
1178         if (rssi >= 0 || rssi < -100)
1179                 return -EINVAL;
1180
1181         data->rx_rssi = rssi;
1182         return 0;
1183 }
1184
1185 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1186                          hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1187                          "%lld\n");
1188
1189 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1190                                         struct net_device *dev)
1191 {
1192         /* TODO: allow packet injection */
1193         dev_kfree_skb(skb);
1194         return NETDEV_TX_OK;
1195 }
1196
1197 static inline u64 mac80211_hwsim_get_tsf_raw(void)
1198 {
1199         return ktime_to_us(ktime_get_real());
1200 }
1201
1202 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1203 {
1204         u64 now = mac80211_hwsim_get_tsf_raw();
1205         return cpu_to_le64(now + data->tsf_offset);
1206 }
1207
1208 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1209                                   struct ieee80211_vif *vif)
1210 {
1211         struct mac80211_hwsim_data *data = hw->priv;
1212         return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
1213 }
1214
1215 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1216                 struct ieee80211_vif *vif, u64 tsf)
1217 {
1218         struct mac80211_hwsim_data *data = hw->priv;
1219         u64 now = mac80211_hwsim_get_tsf(hw, vif);
1220         /* MLD not supported here */
1221         u32 bcn_int = data->link_data[0].beacon_int;
1222         u64 delta = abs(tsf - now);
1223
1224         /* adjust after beaconing with new timestamp at old TBTT */
1225         if (tsf > now) {
1226                 data->tsf_offset += delta;
1227                 data->bcn_delta = do_div(delta, bcn_int);
1228         } else {
1229                 data->tsf_offset -= delta;
1230                 data->bcn_delta = -(s64)do_div(delta, bcn_int);
1231         }
1232 }
1233
1234 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1235                                       struct sk_buff *tx_skb,
1236                                       struct ieee80211_channel *chan)
1237 {
1238         struct mac80211_hwsim_data *data = hw->priv;
1239         struct sk_buff *skb;
1240         struct hwsim_radiotap_hdr *hdr;
1241         u16 flags, bitrate;
1242         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1243         struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
1244
1245         if (!txrate)
1246                 bitrate = 0;
1247         else
1248                 bitrate = txrate->bitrate;
1249
1250         if (!netif_running(hwsim_mon))
1251                 return;
1252
1253         skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1254         if (skb == NULL)
1255                 return;
1256
1257         hdr = skb_push(skb, sizeof(*hdr));
1258         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1259         hdr->hdr.it_pad = 0;
1260         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1261         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1262                                           (1 << IEEE80211_RADIOTAP_RATE) |
1263                                           (1 << IEEE80211_RADIOTAP_TSFT) |
1264                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1265         hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1266         hdr->rt_flags = 0;
1267         hdr->rt_rate = bitrate / 5;
1268         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1269         flags = IEEE80211_CHAN_2GHZ;
1270         if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1271                 flags |= IEEE80211_CHAN_OFDM;
1272         else
1273                 flags |= IEEE80211_CHAN_CCK;
1274         hdr->rt_chbitmask = cpu_to_le16(flags);
1275
1276         skb->dev = hwsim_mon;
1277         skb_reset_mac_header(skb);
1278         skb->ip_summed = CHECKSUM_UNNECESSARY;
1279         skb->pkt_type = PACKET_OTHERHOST;
1280         skb->protocol = htons(ETH_P_802_2);
1281         memset(skb->cb, 0, sizeof(skb->cb));
1282         netif_rx(skb);
1283 }
1284
1285
1286 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
1287                                        const u8 *addr)
1288 {
1289         struct sk_buff *skb;
1290         struct hwsim_radiotap_ack_hdr *hdr;
1291         u16 flags;
1292         struct ieee80211_hdr *hdr11;
1293
1294         if (!netif_running(hwsim_mon))
1295                 return;
1296
1297         skb = dev_alloc_skb(100);
1298         if (skb == NULL)
1299                 return;
1300
1301         hdr = skb_put(skb, sizeof(*hdr));
1302         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1303         hdr->hdr.it_pad = 0;
1304         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1305         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1306                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1307         hdr->rt_flags = 0;
1308         hdr->pad = 0;
1309         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1310         flags = IEEE80211_CHAN_2GHZ;
1311         hdr->rt_chbitmask = cpu_to_le16(flags);
1312
1313         hdr11 = skb_put(skb, 10);
1314         hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1315                                            IEEE80211_STYPE_ACK);
1316         hdr11->duration_id = cpu_to_le16(0);
1317         memcpy(hdr11->addr1, addr, ETH_ALEN);
1318
1319         skb->dev = hwsim_mon;
1320         skb_reset_mac_header(skb);
1321         skb->ip_summed = CHECKSUM_UNNECESSARY;
1322         skb->pkt_type = PACKET_OTHERHOST;
1323         skb->protocol = htons(ETH_P_802_2);
1324         memset(skb->cb, 0, sizeof(skb->cb));
1325         netif_rx(skb);
1326 }
1327
1328 struct mac80211_hwsim_addr_match_data {
1329         u8 addr[ETH_ALEN];
1330         bool ret;
1331 };
1332
1333 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1334                                      struct ieee80211_vif *vif)
1335 {
1336         int i;
1337         struct mac80211_hwsim_addr_match_data *md = data;
1338
1339         if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1340                 md->ret = true;
1341                 return;
1342         }
1343
1344         /* Match the link address */
1345         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1346                 struct ieee80211_bss_conf *conf;
1347
1348                 conf = rcu_dereference(vif->link_conf[i]);
1349                 if (!conf)
1350                         continue;
1351
1352                 if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1353                         md->ret = true;
1354                         return;
1355                 }
1356         }
1357 }
1358
1359 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1360                                       const u8 *addr)
1361 {
1362         struct mac80211_hwsim_addr_match_data md = {
1363                 .ret = false,
1364         };
1365
1366         if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1367                 return true;
1368
1369         memcpy(md.addr, addr, ETH_ALEN);
1370
1371         ieee80211_iterate_active_interfaces_atomic(data->hw,
1372                                                    IEEE80211_IFACE_ITER_NORMAL,
1373                                                    mac80211_hwsim_addr_iter,
1374                                                    &md);
1375
1376         return md.ret;
1377 }
1378
1379 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1380                            struct sk_buff *skb)
1381 {
1382         switch (data->ps) {
1383         case PS_DISABLED:
1384                 return true;
1385         case PS_ENABLED:
1386                 return false;
1387         case PS_AUTO_POLL:
1388                 /* TODO: accept (some) Beacons by default and other frames only
1389                  * if pending PS-Poll has been sent */
1390                 return true;
1391         case PS_MANUAL_POLL:
1392                 /* Allow unicast frames to own address if there is a pending
1393                  * PS-Poll */
1394                 if (data->ps_poll_pending &&
1395                     mac80211_hwsim_addr_match(data, skb->data + 4)) {
1396                         data->ps_poll_pending = false;
1397                         return true;
1398                 }
1399                 return false;
1400         }
1401
1402         return true;
1403 }
1404
1405 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1406                                   struct sk_buff *skb, int portid)
1407 {
1408         struct net *net;
1409         bool found = false;
1410         int res = -ENOENT;
1411
1412         rcu_read_lock();
1413         for_each_net_rcu(net) {
1414                 if (data->netgroup == hwsim_net_get_netgroup(net)) {
1415                         res = genlmsg_unicast(net, skb, portid);
1416                         found = true;
1417                         break;
1418                 }
1419         }
1420         rcu_read_unlock();
1421
1422         if (!found)
1423                 nlmsg_free(skb);
1424
1425         return res;
1426 }
1427
1428 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1429                                          const u8 *addr, bool add)
1430 {
1431         struct mac80211_hwsim_data *data = hw->priv;
1432         u32 _portid = READ_ONCE(data->wmediumd);
1433         struct sk_buff *skb;
1434         void *msg_head;
1435
1436         WARN_ON(!is_valid_ether_addr(addr));
1437
1438         if (!_portid && !hwsim_virtio_enabled)
1439                 return;
1440
1441         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1442         if (!skb)
1443                 return;
1444
1445         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1446                                add ? HWSIM_CMD_ADD_MAC_ADDR :
1447                                      HWSIM_CMD_DEL_MAC_ADDR);
1448         if (!msg_head) {
1449                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1450                 goto nla_put_failure;
1451         }
1452
1453         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1454                     ETH_ALEN, data->addresses[1].addr))
1455                 goto nla_put_failure;
1456
1457         if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1458                 goto nla_put_failure;
1459
1460         genlmsg_end(skb, msg_head);
1461
1462         if (hwsim_virtio_enabled)
1463                 hwsim_tx_virtio(data, skb);
1464         else
1465                 hwsim_unicast_netgroup(data, skb, _portid);
1466         return;
1467 nla_put_failure:
1468         nlmsg_free(skb);
1469 }
1470
1471 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1472 {
1473         u16 result = 0;
1474
1475         if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1476                 result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1477         if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1478                 result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1479         if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1480                 result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1481         if (rate->flags & IEEE80211_TX_RC_MCS)
1482                 result |= MAC80211_HWSIM_TX_RC_MCS;
1483         if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1484                 result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1485         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1486                 result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1487         if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1488                 result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1489         if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1490                 result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1491         if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1492                 result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1493         if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1494                 result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1495         if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1496                 result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1497
1498         return result;
1499 }
1500
1501 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1502                                        struct sk_buff *my_skb,
1503                                        int dst_portid,
1504                                        struct ieee80211_channel *channel)
1505 {
1506         struct sk_buff *skb;
1507         struct mac80211_hwsim_data *data = hw->priv;
1508         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1509         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1510         void *msg_head;
1511         unsigned int hwsim_flags = 0;
1512         int i;
1513         struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1514         struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1515         uintptr_t cookie;
1516
1517         if (data->ps != PS_DISABLED)
1518                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1519         /* If the queue contains MAX_QUEUE skb's drop some */
1520         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1521                 /* Dropping until WARN_QUEUE level */
1522                 while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1523                         ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1524                         data->tx_dropped++;
1525                 }
1526         }
1527
1528         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1529         if (skb == NULL)
1530                 goto nla_put_failure;
1531
1532         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1533                                HWSIM_CMD_FRAME);
1534         if (msg_head == NULL) {
1535                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1536                 goto nla_put_failure;
1537         }
1538
1539         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1540                     ETH_ALEN, data->addresses[1].addr))
1541                 goto nla_put_failure;
1542
1543         /* We get the skb->data */
1544         if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1545                 goto nla_put_failure;
1546
1547         /* We get the flags for this transmission, and we translate them to
1548            wmediumd flags  */
1549
1550         if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1551                 hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1552
1553         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1554                 hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1555
1556         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1557                 goto nla_put_failure;
1558
1559         if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1560                 goto nla_put_failure;
1561
1562         /* We get the tx control (rate and retries) info*/
1563
1564         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1565                 tx_attempts[i].idx = info->status.rates[i].idx;
1566                 tx_attempts_flags[i].idx = info->status.rates[i].idx;
1567                 tx_attempts[i].count = info->status.rates[i].count;
1568                 tx_attempts_flags[i].flags =
1569                                 trans_tx_rate_flags_ieee2hwsim(
1570                                                 &info->status.rates[i]);
1571         }
1572
1573         if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1574                     sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1575                     tx_attempts))
1576                 goto nla_put_failure;
1577
1578         if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1579                     sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1580                     tx_attempts_flags))
1581                 goto nla_put_failure;
1582
1583         /* We create a cookie to identify this skb */
1584         cookie = atomic_inc_return(&data->pending_cookie);
1585         info->rate_driver_data[0] = (void *)cookie;
1586         if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1587                 goto nla_put_failure;
1588
1589         genlmsg_end(skb, msg_head);
1590
1591         if (hwsim_virtio_enabled) {
1592                 if (hwsim_tx_virtio(data, skb))
1593                         goto err_free_txskb;
1594         } else {
1595                 if (hwsim_unicast_netgroup(data, skb, dst_portid))
1596                         goto err_free_txskb;
1597         }
1598
1599         /* Enqueue the packet */
1600         skb_queue_tail(&data->pending, my_skb);
1601         data->tx_pkts++;
1602         data->tx_bytes += my_skb->len;
1603         return;
1604
1605 nla_put_failure:
1606         nlmsg_free(skb);
1607 err_free_txskb:
1608         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1609         ieee80211_free_txskb(hw, my_skb);
1610         data->tx_failed++;
1611 }
1612
1613 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1614                                struct ieee80211_channel *c2)
1615 {
1616         if (!c1 || !c2)
1617                 return false;
1618
1619         return c1->center_freq == c2->center_freq;
1620 }
1621
1622 struct tx_iter_data {
1623         struct ieee80211_channel *channel;
1624         bool receive;
1625 };
1626
1627 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1628                                    struct ieee80211_vif *vif)
1629 {
1630         struct tx_iter_data *data = _data;
1631         int i;
1632
1633         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1634                 struct ieee80211_bss_conf *conf;
1635                 struct ieee80211_chanctx_conf *chanctx;
1636
1637                 conf = rcu_dereference(vif->link_conf[i]);
1638                 if (!conf)
1639                         continue;
1640
1641                 chanctx = rcu_dereference(conf->chanctx_conf);
1642                 if (!chanctx)
1643                         continue;
1644
1645                 if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1646                         continue;
1647
1648                 data->receive = true;
1649                 return;
1650         }
1651 }
1652
1653 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1654 {
1655         /*
1656          * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1657          * e.g. like this:
1658          * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1659          * (but you should use a valid OUI, not that)
1660          *
1661          * If anyone wants to 'donate' a radiotap OUI/subns code
1662          * please send a patch removing this #ifdef and changing
1663          * the values accordingly.
1664          */
1665 #ifdef HWSIM_RADIOTAP_OUI
1666         struct ieee80211_radiotap_vendor_tlv *rtap;
1667         static const char vendor_data[8] = "ABCDEFGH";
1668
1669         // Make sure no padding is needed
1670         BUILD_BUG_ON(sizeof(vendor_data) % 4);
1671         /* this is last radiotap info before the mac header, so
1672          * skb_reset_mac_header for mac8022 to know the end of
1673          * the radiotap TLV/beginning of the 802.11 header
1674          */
1675         skb_reset_mac_header(skb);
1676
1677         /*
1678          * Note that this code requires the headroom in the SKB
1679          * that was allocated earlier.
1680          */
1681         rtap = skb_push(skb, sizeof(*rtap) + sizeof(vendor_data));
1682
1683         rtap->len = cpu_to_le16(sizeof(*rtap) -
1684                                 sizeof(struct ieee80211_radiotap_tlv) +
1685                                 sizeof(vendor_data));
1686         rtap->type = cpu_to_le16(IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
1687
1688         rtap->content.oui[0] = HWSIM_RADIOTAP_OUI[0];
1689         rtap->content.oui[1] = HWSIM_RADIOTAP_OUI[1];
1690         rtap->content.oui[2] = HWSIM_RADIOTAP_OUI[2];
1691         rtap->content.oui_subtype = 127;
1692         /* clear reserved field */
1693         rtap->content.reserved = 0;
1694         rtap->content.vendor_type = 0;
1695         memcpy(rtap->content.data, vendor_data, sizeof(vendor_data));
1696
1697         IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
1698 #endif
1699 }
1700
1701 static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1702                               struct ieee80211_rx_status *rx_status,
1703                               struct sk_buff *skb)
1704 {
1705         struct ieee80211_hdr *hdr = (void *)skb->data;
1706
1707         if (!ieee80211_has_morefrags(hdr->frame_control) &&
1708             !is_multicast_ether_addr(hdr->addr1) &&
1709             (ieee80211_is_mgmt(hdr->frame_control) ||
1710              ieee80211_is_data(hdr->frame_control))) {
1711                 struct ieee80211_sta *sta;
1712                 unsigned int link_id;
1713
1714                 rcu_read_lock();
1715                 sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1716                                                        hdr->addr1, &link_id);
1717                 if (sta) {
1718                         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1719
1720                         if (ieee80211_has_pm(hdr->frame_control))
1721                                 sp->active_links_rx &= ~BIT(link_id);
1722                         else
1723                                 sp->active_links_rx |= BIT(link_id);
1724
1725                         rx_status->link_valid = true;
1726                         rx_status->link_id = link_id;
1727                 }
1728                 rcu_read_unlock();
1729         }
1730
1731         memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1732
1733         mac80211_hwsim_add_vendor_rtap(skb);
1734
1735         data->rx_pkts++;
1736         data->rx_bytes += skb->len;
1737         ieee80211_rx_irqsafe(data->hw, skb);
1738 }
1739
1740 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1741                                           struct sk_buff *skb,
1742                                           struct ieee80211_channel *chan)
1743 {
1744         struct mac80211_hwsim_data *data = hw->priv, *data2;
1745         bool ack = false;
1746         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1747         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1748         struct ieee80211_rx_status rx_status;
1749         u64 now;
1750
1751         memset(&rx_status, 0, sizeof(rx_status));
1752         rx_status.flag |= RX_FLAG_MACTIME_START;
1753         rx_status.freq = chan->center_freq;
1754         rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1755         rx_status.band = chan->band;
1756         if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1757                 rx_status.rate_idx =
1758                         ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1759                 rx_status.nss =
1760                         ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1761                 rx_status.encoding = RX_ENC_VHT;
1762         } else {
1763                 rx_status.rate_idx = info->control.rates[0].idx;
1764                 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1765                         rx_status.encoding = RX_ENC_HT;
1766         }
1767         if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1768                 rx_status.bw = RATE_INFO_BW_40;
1769         else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1770                 rx_status.bw = RATE_INFO_BW_80;
1771         else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1772                 rx_status.bw = RATE_INFO_BW_160;
1773         else
1774                 rx_status.bw = RATE_INFO_BW_20;
1775         if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1776                 rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1777         /* TODO: simulate optional packet loss */
1778         rx_status.signal = data->rx_rssi;
1779         if (info->control.vif)
1780                 rx_status.signal += info->control.vif->bss_conf.txpower;
1781
1782         if (data->ps != PS_DISABLED)
1783                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1784
1785         /* release the skb's source info */
1786         skb_orphan(skb);
1787         skb_dst_drop(skb);
1788         skb->mark = 0;
1789         skb_ext_reset(skb);
1790         nf_reset_ct(skb);
1791
1792         /*
1793          * Get absolute mactime here so all HWs RX at the "same time", and
1794          * absolute TX time for beacon mactime so the timestamp matches.
1795          * Giving beacons a different mactime than non-beacons looks messy, but
1796          * it helps the Toffset be exact and a ~10us mactime discrepancy
1797          * probably doesn't really matter.
1798          */
1799         if (ieee80211_is_beacon(hdr->frame_control) ||
1800             ieee80211_is_probe_resp(hdr->frame_control)) {
1801                 rx_status.boottime_ns = ktime_get_boottime_ns();
1802                 now = data->abs_bcn_ts;
1803         } else {
1804                 now = mac80211_hwsim_get_tsf_raw();
1805         }
1806
1807         /* Copy skb to all enabled radios that are on the current frequency */
1808         spin_lock(&hwsim_radio_lock);
1809         list_for_each_entry(data2, &hwsim_radios, list) {
1810                 struct sk_buff *nskb;
1811                 struct tx_iter_data tx_iter_data = {
1812                         .receive = false,
1813                         .channel = chan,
1814                 };
1815
1816                 if (data == data2)
1817                         continue;
1818
1819                 if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1820                     !hwsim_ps_rx_ok(data2, skb))
1821                         continue;
1822
1823                 if (!(data->group & data2->group))
1824                         continue;
1825
1826                 if (data->netgroup != data2->netgroup)
1827                         continue;
1828
1829                 if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1830                     !hwsim_chans_compat(chan, data2->channel)) {
1831                         ieee80211_iterate_active_interfaces_atomic(
1832                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1833                                 mac80211_hwsim_tx_iter, &tx_iter_data);
1834                         if (!tx_iter_data.receive)
1835                                 continue;
1836                 }
1837
1838                 /*
1839                  * reserve some space for our vendor and the normal
1840                  * radiotap header, since we're copying anyway
1841                  */
1842                 if (skb->len < PAGE_SIZE && paged_rx) {
1843                         struct page *page = alloc_page(GFP_ATOMIC);
1844
1845                         if (!page)
1846                                 continue;
1847
1848                         nskb = dev_alloc_skb(128);
1849                         if (!nskb) {
1850                                 __free_page(page);
1851                                 continue;
1852                         }
1853
1854                         memcpy(page_address(page), skb->data, skb->len);
1855                         skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1856                 } else {
1857                         nskb = skb_copy(skb, GFP_ATOMIC);
1858                         if (!nskb)
1859                                 continue;
1860                 }
1861
1862                 if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1863                         ack = true;
1864
1865                 rx_status.mactime = now + data2->tsf_offset;
1866
1867                 mac80211_hwsim_rx(data2, &rx_status, nskb);
1868         }
1869         spin_unlock(&hwsim_radio_lock);
1870
1871         return ack;
1872 }
1873
1874 static struct ieee80211_bss_conf *
1875 mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
1876                               struct ieee80211_vif *vif,
1877                               struct ieee80211_sta *sta,
1878                               struct ieee80211_hdr *hdr,
1879                               struct ieee80211_link_sta **link_sta)
1880 {
1881         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1882         int i;
1883
1884         if (!ieee80211_vif_is_mld(vif))
1885                 return &vif->bss_conf;
1886
1887         WARN_ON(is_multicast_ether_addr(hdr->addr1));
1888
1889         if (WARN_ON_ONCE(!sta || !sta->valid_links))
1890                 return &vif->bss_conf;
1891
1892         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1893                 struct ieee80211_bss_conf *bss_conf;
1894                 unsigned int link_id;
1895
1896                 /* round-robin the available link IDs */
1897                 link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
1898
1899                 if (!(vif->active_links & BIT(link_id)))
1900                         continue;
1901
1902                 if (!(sp->active_links_rx & BIT(link_id)))
1903                         continue;
1904
1905                 *link_sta = rcu_dereference(sta->link[link_id]);
1906                 if (!*link_sta)
1907                         continue;
1908
1909                 bss_conf = rcu_dereference(vif->link_conf[link_id]);
1910                 if (WARN_ON_ONCE(!bss_conf))
1911                         continue;
1912
1913                 /* can happen while switching links */
1914                 if (!rcu_access_pointer(bss_conf->chanctx_conf))
1915                         continue;
1916
1917                 sp->last_link = link_id;
1918                 return bss_conf;
1919         }
1920
1921         return NULL;
1922 }
1923
1924 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1925                               struct ieee80211_tx_control *control,
1926                               struct sk_buff *skb)
1927 {
1928         struct mac80211_hwsim_data *data = hw->priv;
1929         struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1930         struct ieee80211_hdr *hdr = (void *)skb->data;
1931         struct ieee80211_chanctx_conf *chanctx_conf;
1932         struct ieee80211_channel *channel;
1933         bool ack;
1934         enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1935         u32 _portid, i;
1936
1937         if (WARN_ON(skb->len < 10)) {
1938                 /* Should not happen; just a sanity check for addr1 use */
1939                 ieee80211_free_txskb(hw, skb);
1940                 return;
1941         }
1942
1943         if (!data->use_chanctx) {
1944                 channel = data->channel;
1945                 confbw = data->bw;
1946         } else if (txi->hw_queue == 4) {
1947                 channel = data->tmp_chan;
1948         } else {
1949                 u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
1950                                        IEEE80211_TX_CTRL_MLO_LINK);
1951                 struct ieee80211_vif *vif = txi->control.vif;
1952                 struct ieee80211_link_sta *link_sta = NULL;
1953                 struct ieee80211_sta *sta = control->sta;
1954                 struct ieee80211_bss_conf *bss_conf;
1955
1956                 if (link != IEEE80211_LINK_UNSPECIFIED) {
1957                         bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
1958                         if (sta)
1959                                 link_sta = rcu_dereference(sta->link[link]);
1960                 } else {
1961                         bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
1962                                                                  hdr, &link_sta);
1963                 }
1964
1965                 if (unlikely(!bss_conf)) {
1966                         /* if it's an MLO STA, it might have deactivated all
1967                          * links temporarily - but we don't handle real PS in
1968                          * this code yet, so just drop the frame in that case
1969                          */
1970                         WARN(link != IEEE80211_LINK_UNSPECIFIED || !sta || !sta->mlo,
1971                              "link:%d, sta:%pM, sta->mlo:%d\n",
1972                              link, sta ? sta->addr : NULL, sta ? sta->mlo : -1);
1973                         ieee80211_free_txskb(hw, skb);
1974                         return;
1975                 }
1976
1977                 if (sta && sta->mlo) {
1978                         if (WARN_ON(!link_sta)) {
1979                                 ieee80211_free_txskb(hw, skb);
1980                                 return;
1981                         }
1982                         /* address translation to link addresses on TX */
1983                         ether_addr_copy(hdr->addr1, link_sta->addr);
1984                         ether_addr_copy(hdr->addr2, bss_conf->addr);
1985                         /* translate A3 only if it's the BSSID */
1986                         if (!ieee80211_has_tods(hdr->frame_control) &&
1987                             !ieee80211_has_fromds(hdr->frame_control)) {
1988                                 if (ether_addr_equal(hdr->addr3, sta->addr))
1989                                         ether_addr_copy(hdr->addr3, link_sta->addr);
1990                                 else if (ether_addr_equal(hdr->addr3, vif->addr))
1991                                         ether_addr_copy(hdr->addr3, bss_conf->addr);
1992                         }
1993                         /* no need to look at A4, if present it's SA */
1994                 }
1995
1996                 chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
1997                 if (chanctx_conf) {
1998                         channel = chanctx_conf->def.chan;
1999                         confbw = chanctx_conf->def.width;
2000                 } else {
2001                         channel = NULL;
2002                 }
2003         }
2004
2005         if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
2006                 ieee80211_free_txskb(hw, skb);
2007                 return;
2008         }
2009
2010         if (data->idle && !data->tmp_chan) {
2011                 wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
2012                 ieee80211_free_txskb(hw, skb);
2013                 return;
2014         }
2015
2016         if (txi->control.vif)
2017                 hwsim_check_magic(txi->control.vif);
2018         if (control->sta)
2019                 hwsim_check_sta_magic(control->sta);
2020
2021         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2022                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
2023                                        txi->control.rates,
2024                                        ARRAY_SIZE(txi->control.rates));
2025
2026         for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
2027                 u16 rflags = txi->control.rates[i].flags;
2028                 /* initialize to data->bw for 5/10 MHz handling */
2029                 enum nl80211_chan_width bw = data->bw;
2030
2031                 if (txi->control.rates[i].idx == -1)
2032                         break;
2033
2034                 if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
2035                         bw = NL80211_CHAN_WIDTH_40;
2036                 else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
2037                         bw = NL80211_CHAN_WIDTH_80;
2038                 else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
2039                         bw = NL80211_CHAN_WIDTH_160;
2040
2041                 if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
2042                         return;
2043         }
2044
2045         if (skb->len >= 24 + 8 &&
2046             ieee80211_is_probe_resp(hdr->frame_control)) {
2047                 /* fake header transmission time */
2048                 struct ieee80211_mgmt *mgmt;
2049                 struct ieee80211_rate *txrate;
2050                 /* TODO: get MCS */
2051                 int bitrate = 100;
2052                 u64 ts;
2053
2054                 mgmt = (struct ieee80211_mgmt *)skb->data;
2055                 txrate = ieee80211_get_tx_rate(hw, txi);
2056                 if (txrate)
2057                         bitrate = txrate->bitrate;
2058                 ts = mac80211_hwsim_get_tsf_raw();
2059                 mgmt->u.probe_resp.timestamp =
2060                         cpu_to_le64(ts + data->tsf_offset +
2061                                     24 * 8 * 10 / bitrate);
2062         }
2063
2064         mac80211_hwsim_monitor_rx(hw, skb, channel);
2065
2066         /* wmediumd mode check */
2067         _portid = READ_ONCE(data->wmediumd);
2068
2069         if (_portid || hwsim_virtio_enabled)
2070                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
2071
2072         /* NO wmediumd detected, perfect medium simulation */
2073         data->tx_pkts++;
2074         data->tx_bytes += skb->len;
2075         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
2076
2077         if (ack && skb->len >= 16)
2078                 mac80211_hwsim_monitor_ack(channel, hdr->addr2);
2079
2080         ieee80211_tx_info_clear_status(txi);
2081
2082         /* frame was transmitted at most favorable rate at first attempt */
2083         txi->control.rates[0].count = 1;
2084         txi->control.rates[1].idx = -1;
2085
2086         if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
2087                 txi->flags |= IEEE80211_TX_STAT_ACK;
2088         ieee80211_tx_status_irqsafe(hw, skb);
2089 }
2090
2091
2092 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
2093 {
2094         struct mac80211_hwsim_data *data = hw->priv;
2095         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2096         data->started = true;
2097         return 0;
2098 }
2099
2100
2101 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
2102 {
2103         struct mac80211_hwsim_data *data = hw->priv;
2104         int i;
2105
2106         data->started = false;
2107
2108         for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
2109                 hrtimer_cancel(&data->link_data[i].beacon_timer);
2110
2111         while (!skb_queue_empty(&data->pending))
2112                 ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
2113
2114         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2115 }
2116
2117
2118 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
2119                                         struct ieee80211_vif *vif)
2120 {
2121         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2122                   __func__, ieee80211_vif_type_p2p(vif),
2123                   vif->addr);
2124         hwsim_set_magic(vif);
2125
2126         if (vif->type != NL80211_IFTYPE_MONITOR)
2127                 mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
2128
2129         vif->cab_queue = 0;
2130         vif->hw_queue[IEEE80211_AC_VO] = 0;
2131         vif->hw_queue[IEEE80211_AC_VI] = 1;
2132         vif->hw_queue[IEEE80211_AC_BE] = 2;
2133         vif->hw_queue[IEEE80211_AC_BK] = 3;
2134
2135         return 0;
2136 }
2137
2138 #ifdef CONFIG_MAC80211_DEBUGFS
2139 static void
2140 mac80211_hwsim_link_add_debugfs(struct ieee80211_hw *hw,
2141                                 struct ieee80211_vif *vif,
2142                                 struct ieee80211_bss_conf *link_conf,
2143                                 struct dentry *dir)
2144 {
2145         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2146
2147         debugfs_create_u32("skip_beacons", 0600, dir,
2148                            &vp->skip_beacons[link_conf->link_id]);
2149 }
2150 #endif
2151
2152 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
2153                                            struct ieee80211_vif *vif,
2154                                            enum nl80211_iftype newtype,
2155                                            bool newp2p)
2156 {
2157         newtype = ieee80211_iftype_p2p(newtype, newp2p);
2158         wiphy_dbg(hw->wiphy,
2159                   "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2160                   __func__, ieee80211_vif_type_p2p(vif),
2161                     newtype, vif->addr);
2162         hwsim_check_magic(vif);
2163
2164         /*
2165          * interface may change from non-AP to AP in
2166          * which case this needs to be set up again
2167          */
2168         vif->cab_queue = 0;
2169
2170         return 0;
2171 }
2172
2173 static void mac80211_hwsim_remove_interface(
2174         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2175 {
2176         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2177                   __func__, ieee80211_vif_type_p2p(vif),
2178                   vif->addr);
2179         hwsim_check_magic(vif);
2180         hwsim_clear_magic(vif);
2181         if (vif->type != NL80211_IFTYPE_MONITOR)
2182                 mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2183 }
2184
2185 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2186                                     struct sk_buff *skb,
2187                                     struct ieee80211_channel *chan)
2188 {
2189         struct mac80211_hwsim_data *data = hw->priv;
2190         u32 _portid = READ_ONCE(data->wmediumd);
2191
2192         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2193                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2194                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2195                                        txi->control.rates,
2196                                        ARRAY_SIZE(txi->control.rates));
2197         }
2198
2199         mac80211_hwsim_monitor_rx(hw, skb, chan);
2200
2201         if (_portid || hwsim_virtio_enabled)
2202                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, chan);
2203
2204         data->tx_pkts++;
2205         data->tx_bytes += skb->len;
2206         mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2207         dev_kfree_skb(skb);
2208 }
2209
2210 static void __mac80211_hwsim_beacon_tx(struct ieee80211_bss_conf *link_conf,
2211                                        struct mac80211_hwsim_data *data,
2212                                        struct ieee80211_hw *hw,
2213                                        struct ieee80211_vif *vif,
2214                                        struct sk_buff *skb)
2215 {
2216         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2217         struct ieee80211_tx_info *info;
2218         struct ieee80211_rate *txrate;
2219         struct ieee80211_mgmt *mgmt;
2220         /* TODO: get MCS */
2221         int bitrate = 100;
2222
2223         if (vp->skip_beacons[link_conf->link_id]) {
2224                 vp->skip_beacons[link_conf->link_id]--;
2225                 dev_kfree_skb(skb);
2226                 return;
2227         }
2228
2229         info = IEEE80211_SKB_CB(skb);
2230         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2231                 ieee80211_get_tx_rates(vif, NULL, skb,
2232                                        info->control.rates,
2233                                        ARRAY_SIZE(info->control.rates));
2234
2235         txrate = ieee80211_get_tx_rate(hw, info);
2236         if (txrate)
2237                 bitrate = txrate->bitrate;
2238
2239         mgmt = (struct ieee80211_mgmt *) skb->data;
2240         /* fake header transmission time */
2241         data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
2242         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2243                 struct ieee80211_ext *ext = (void *) mgmt;
2244
2245                 ext->u.s1g_beacon.timestamp = cpu_to_le32(data->abs_bcn_ts +
2246                                                           data->tsf_offset +
2247                                                           10 * 8 * 10 /
2248                                                           bitrate);
2249         } else {
2250                 mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
2251                                                        data->tsf_offset +
2252                                                        24 * 8 * 10 /
2253                                                        bitrate);
2254         }
2255
2256         mac80211_hwsim_tx_frame(hw, skb,
2257                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2258 }
2259
2260 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2261                                      struct ieee80211_vif *vif)
2262 {
2263         struct mac80211_hwsim_link_data *link_data = arg;
2264         u32 link_id = link_data->link_id;
2265         struct ieee80211_bss_conf *link_conf;
2266         struct mac80211_hwsim_data *data =
2267                 container_of(link_data, struct mac80211_hwsim_data,
2268                              link_data[link_id]);
2269         struct ieee80211_hw *hw = data->hw;
2270         struct sk_buff *skb;
2271
2272         hwsim_check_magic(vif);
2273
2274         link_conf = rcu_dereference(vif->link_conf[link_id]);
2275         if (!link_conf)
2276                 return;
2277
2278         if (vif->type != NL80211_IFTYPE_AP &&
2279             vif->type != NL80211_IFTYPE_MESH_POINT &&
2280             vif->type != NL80211_IFTYPE_ADHOC &&
2281             vif->type != NL80211_IFTYPE_OCB)
2282                 return;
2283
2284         if (vif->mbssid_tx_vif && vif->mbssid_tx_vif != vif)
2285                 return;
2286
2287         if (vif->bss_conf.ema_ap) {
2288                 struct ieee80211_ema_beacons *ema;
2289                 u8 i = 0;
2290
2291                 ema = ieee80211_beacon_get_template_ema_list(hw, vif, link_id);
2292                 if (!ema || !ema->cnt)
2293                         return;
2294
2295                 for (i = 0; i < ema->cnt; i++) {
2296                         __mac80211_hwsim_beacon_tx(link_conf, data, hw, vif,
2297                                                    ema->bcn[i].skb);
2298                         ema->bcn[i].skb = NULL; /* Already freed */
2299                 }
2300                 ieee80211_beacon_free_ema_list(ema);
2301         } else {
2302                 skb = ieee80211_beacon_get(hw, vif, link_id);
2303                 if (!skb)
2304                         return;
2305
2306                 __mac80211_hwsim_beacon_tx(link_conf, data, hw, vif, skb);
2307         }
2308
2309         while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2310                 mac80211_hwsim_tx_frame(hw, skb,
2311                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2312         }
2313
2314         if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif, link_id))
2315                 ieee80211_csa_finish(vif, link_id);
2316
2317         if (link_conf->color_change_active &&
2318             ieee80211_beacon_cntdwn_is_complete(vif, link_id))
2319                 ieee80211_color_change_finish(vif, link_id);
2320 }
2321
2322 static enum hrtimer_restart
2323 mac80211_hwsim_beacon(struct hrtimer *timer)
2324 {
2325         struct mac80211_hwsim_link_data *link_data =
2326                 container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2327         struct mac80211_hwsim_data *data =
2328                 container_of(link_data, struct mac80211_hwsim_data,
2329                              link_data[link_data->link_id]);
2330         struct ieee80211_hw *hw = data->hw;
2331         u64 bcn_int = link_data->beacon_int;
2332
2333         if (!data->started)
2334                 return HRTIMER_NORESTART;
2335
2336         ieee80211_iterate_active_interfaces_atomic(
2337                 hw, IEEE80211_IFACE_ITER_NORMAL,
2338                 mac80211_hwsim_beacon_tx, link_data);
2339
2340         /* beacon at new TBTT + beacon interval */
2341         if (data->bcn_delta) {
2342                 bcn_int -= data->bcn_delta;
2343                 data->bcn_delta = 0;
2344         }
2345         hrtimer_forward_now(&link_data->beacon_timer,
2346                             ns_to_ktime(bcn_int * NSEC_PER_USEC));
2347         return HRTIMER_RESTART;
2348 }
2349
2350 static const char * const hwsim_chanwidths[] = {
2351         [NL80211_CHAN_WIDTH_5] = "ht5",
2352         [NL80211_CHAN_WIDTH_10] = "ht10",
2353         [NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2354         [NL80211_CHAN_WIDTH_20] = "ht20",
2355         [NL80211_CHAN_WIDTH_40] = "ht40",
2356         [NL80211_CHAN_WIDTH_80] = "vht80",
2357         [NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2358         [NL80211_CHAN_WIDTH_160] = "vht160",
2359         [NL80211_CHAN_WIDTH_1] = "1MHz",
2360         [NL80211_CHAN_WIDTH_2] = "2MHz",
2361         [NL80211_CHAN_WIDTH_4] = "4MHz",
2362         [NL80211_CHAN_WIDTH_8] = "8MHz",
2363         [NL80211_CHAN_WIDTH_16] = "16MHz",
2364 };
2365
2366 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
2367 {
2368         struct mac80211_hwsim_data *data = hw->priv;
2369         struct ieee80211_conf *conf = &hw->conf;
2370         static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2371                 [IEEE80211_SMPS_AUTOMATIC] = "auto",
2372                 [IEEE80211_SMPS_OFF] = "off",
2373                 [IEEE80211_SMPS_STATIC] = "static",
2374                 [IEEE80211_SMPS_DYNAMIC] = "dynamic",
2375         };
2376         int idx;
2377
2378         if (conf->chandef.chan)
2379                 wiphy_dbg(hw->wiphy,
2380                           "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2381                           __func__,
2382                           conf->chandef.chan->center_freq,
2383                           conf->chandef.center_freq1,
2384                           conf->chandef.center_freq2,
2385                           hwsim_chanwidths[conf->chandef.width],
2386                           !!(conf->flags & IEEE80211_CONF_IDLE),
2387                           !!(conf->flags & IEEE80211_CONF_PS),
2388                           smps_modes[conf->smps_mode]);
2389         else
2390                 wiphy_dbg(hw->wiphy,
2391                           "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2392                           __func__,
2393                           !!(conf->flags & IEEE80211_CONF_IDLE),
2394                           !!(conf->flags & IEEE80211_CONF_PS),
2395                           smps_modes[conf->smps_mode]);
2396
2397         data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2398
2399         WARN_ON(conf->chandef.chan && data->use_chanctx);
2400
2401         mutex_lock(&data->mutex);
2402         if (data->scanning && conf->chandef.chan) {
2403                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2404                         if (data->survey_data[idx].channel == data->channel) {
2405                                 data->survey_data[idx].start =
2406                                         data->survey_data[idx].next_start;
2407                                 data->survey_data[idx].end = jiffies;
2408                                 break;
2409                         }
2410                 }
2411
2412                 data->channel = conf->chandef.chan;
2413                 data->bw = conf->chandef.width;
2414
2415                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2416                         if (data->survey_data[idx].channel &&
2417                             data->survey_data[idx].channel != data->channel)
2418                                 continue;
2419                         data->survey_data[idx].channel = data->channel;
2420                         data->survey_data[idx].next_start = jiffies;
2421                         break;
2422                 }
2423         } else {
2424                 data->channel = conf->chandef.chan;
2425                 data->bw = conf->chandef.width;
2426         }
2427         mutex_unlock(&data->mutex);
2428
2429         for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2430                 struct mac80211_hwsim_link_data *link_data =
2431                         &data->link_data[idx];
2432
2433                 if (!data->started || !link_data->beacon_int) {
2434                         hrtimer_cancel(&link_data->beacon_timer);
2435                 } else if (!hrtimer_is_queued(&link_data->beacon_timer)) {
2436                         u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2437                         u32 bcn_int = link_data->beacon_int;
2438                         u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2439
2440                         hrtimer_start(&link_data->beacon_timer,
2441                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2442                                       HRTIMER_MODE_REL_SOFT);
2443                 }
2444         }
2445
2446         return 0;
2447 }
2448
2449
2450 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2451                                             unsigned int changed_flags,
2452                                             unsigned int *total_flags,u64 multicast)
2453 {
2454         struct mac80211_hwsim_data *data = hw->priv;
2455
2456         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2457
2458         data->rx_filter = 0;
2459         if (*total_flags & FIF_ALLMULTI)
2460                 data->rx_filter |= FIF_ALLMULTI;
2461         if (*total_flags & FIF_MCAST_ACTION)
2462                 data->rx_filter |= FIF_MCAST_ACTION;
2463
2464         *total_flags = data->rx_filter;
2465 }
2466
2467 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2468                                        struct ieee80211_vif *vif)
2469 {
2470         unsigned int *count = data;
2471         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2472
2473         if (vp->bcn_en)
2474                 (*count)++;
2475 }
2476
2477 static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2478                                             struct ieee80211_vif *vif,
2479                                             u64 changed)
2480 {
2481         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2482
2483         hwsim_check_magic(vif);
2484
2485         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2486                   __func__, changed, vif->addr);
2487
2488         if (changed & BSS_CHANGED_ASSOC) {
2489                 wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2490                           vif->cfg.assoc, vif->cfg.aid);
2491                 vp->assoc = vif->cfg.assoc;
2492                 vp->aid = vif->cfg.aid;
2493         }
2494
2495         if (vif->type == NL80211_IFTYPE_STATION &&
2496             changed & (BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)) {
2497                 u16 usable_links = ieee80211_vif_usable_links(vif);
2498
2499                 if (vif->active_links != usable_links)
2500                         ieee80211_set_active_links_async(vif, usable_links);
2501         }
2502 }
2503
2504 static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2505                                              struct ieee80211_vif *vif,
2506                                              struct ieee80211_bss_conf *info,
2507                                              u64 changed)
2508 {
2509         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2510         struct mac80211_hwsim_data *data = hw->priv;
2511         unsigned int link_id = info->link_id;
2512         struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2513
2514         hwsim_check_magic(vif);
2515
2516         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2517                   __func__, (unsigned long long)changed, vif->addr, link_id);
2518
2519         if (changed & BSS_CHANGED_BSSID) {
2520                 wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2521                           __func__, info->bssid);
2522                 memcpy(vp->bssid, info->bssid, ETH_ALEN);
2523         }
2524
2525         if (changed & BSS_CHANGED_BEACON_ENABLED) {
2526                 wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2527                           info->enable_beacon, info->beacon_int);
2528                 vp->bcn_en = info->enable_beacon;
2529                 if (data->started &&
2530                     !hrtimer_is_queued(&link_data->beacon_timer) &&
2531                     info->enable_beacon) {
2532                         u64 tsf, until_tbtt;
2533                         u32 bcn_int;
2534                         link_data->beacon_int = info->beacon_int * 1024;
2535                         tsf = mac80211_hwsim_get_tsf(hw, vif);
2536                         bcn_int = link_data->beacon_int;
2537                         until_tbtt = bcn_int - do_div(tsf, bcn_int);
2538
2539                         hrtimer_start(&link_data->beacon_timer,
2540                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2541                                       HRTIMER_MODE_REL_SOFT);
2542                 } else if (!info->enable_beacon) {
2543                         unsigned int count = 0;
2544                         ieee80211_iterate_active_interfaces_atomic(
2545                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
2546                                 mac80211_hwsim_bcn_en_iter, &count);
2547                         wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2548                                   count);
2549                         if (count == 0) {
2550                                 hrtimer_cancel(&link_data->beacon_timer);
2551                                 link_data->beacon_int = 0;
2552                         }
2553                 }
2554         }
2555
2556         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2557                 wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2558                           info->use_cts_prot);
2559         }
2560
2561         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2562                 wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2563                           info->use_short_preamble);
2564         }
2565
2566         if (changed & BSS_CHANGED_ERP_SLOT) {
2567                 wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2568         }
2569
2570         if (changed & BSS_CHANGED_HT) {
2571                 wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2572                           info->ht_operation_mode);
2573         }
2574
2575         if (changed & BSS_CHANGED_BASIC_RATES) {
2576                 wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2577                           (unsigned long long) info->basic_rates);
2578         }
2579
2580         if (changed & BSS_CHANGED_TXPOWER)
2581                 wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2582 }
2583
2584 static void
2585 mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2586                              struct ieee80211_vif *vif,
2587                              struct ieee80211_sta *sta,
2588                              u32 changed)
2589 {
2590         struct mac80211_hwsim_data *data = hw->priv;
2591         u32 bw = U32_MAX;
2592         int link_id;
2593
2594         rcu_read_lock();
2595         for (link_id = 0;
2596              link_id < ARRAY_SIZE(vif->link_conf);
2597              link_id++) {
2598                 enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2599                 struct ieee80211_bss_conf *vif_conf;
2600                 struct ieee80211_link_sta *link_sta;
2601
2602                 link_sta = rcu_dereference(sta->link[link_id]);
2603
2604                 if (!link_sta)
2605                         continue;
2606
2607                 switch (link_sta->bandwidth) {
2608 #define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2609                 C(20);
2610                 C(40);
2611                 C(80);
2612                 C(160);
2613                 C(320);
2614 #undef C
2615                 }
2616
2617                 if (!data->use_chanctx) {
2618                         confbw = data->bw;
2619                 } else {
2620                         struct ieee80211_chanctx_conf *chanctx_conf;
2621
2622                         vif_conf = rcu_dereference(vif->link_conf[link_id]);
2623                         if (WARN_ON(!vif_conf))
2624                                 continue;
2625
2626                         chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2627
2628                         if (!WARN_ON(!chanctx_conf))
2629                                 confbw = chanctx_conf->def.width;
2630                 }
2631
2632                 WARN(bw > hwsim_get_chanwidth(confbw),
2633                      "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2634                      vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2635                      hwsim_get_chanwidth(data->bw), data->bw);
2636
2637
2638         }
2639         rcu_read_unlock();
2640
2641
2642 }
2643
2644 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2645                                   struct ieee80211_vif *vif,
2646                                   struct ieee80211_sta *sta)
2647 {
2648         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2649
2650         hwsim_check_magic(vif);
2651         hwsim_set_sta_magic(sta);
2652         mac80211_hwsim_sta_rc_update(hw, vif, sta, 0);
2653
2654         if (sta->valid_links) {
2655                 WARN(hweight16(sta->valid_links) > 1,
2656                      "expect to add STA with single link, have 0x%x\n",
2657                      sta->valid_links);
2658                 sp->active_links_rx = sta->valid_links;
2659         }
2660
2661         return 0;
2662 }
2663
2664 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2665                                      struct ieee80211_vif *vif,
2666                                      struct ieee80211_sta *sta)
2667 {
2668         hwsim_check_magic(vif);
2669         hwsim_clear_sta_magic(sta);
2670
2671         return 0;
2672 }
2673
2674 static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2675                                     struct ieee80211_vif *vif,
2676                                     struct ieee80211_sta *sta,
2677                                     enum ieee80211_sta_state old_state,
2678                                     enum ieee80211_sta_state new_state)
2679 {
2680         if (new_state == IEEE80211_STA_NOTEXIST)
2681                 return mac80211_hwsim_sta_remove(hw, vif, sta);
2682
2683         if (old_state == IEEE80211_STA_NOTEXIST)
2684                 return mac80211_hwsim_sta_add(hw, vif, sta);
2685
2686         /*
2687          * in an MLO connection, when client is authorized
2688          * (AP station marked as such), enable all links
2689          */
2690         if (ieee80211_vif_is_mld(vif) &&
2691             vif->type == NL80211_IFTYPE_STATION &&
2692             new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2693                 ieee80211_set_active_links_async(vif,
2694                                                  ieee80211_vif_usable_links(vif));
2695
2696         return 0;
2697 }
2698
2699 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2700                                       struct ieee80211_vif *vif,
2701                                       enum sta_notify_cmd cmd,
2702                                       struct ieee80211_sta *sta)
2703 {
2704         hwsim_check_magic(vif);
2705
2706         switch (cmd) {
2707         case STA_NOTIFY_SLEEP:
2708         case STA_NOTIFY_AWAKE:
2709                 /* TODO: make good use of these flags */
2710                 break;
2711         default:
2712                 WARN(1, "Invalid sta notify: %d\n", cmd);
2713                 break;
2714         }
2715 }
2716
2717 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2718                                   struct ieee80211_sta *sta,
2719                                   bool set)
2720 {
2721         hwsim_check_sta_magic(sta);
2722         return 0;
2723 }
2724
2725 static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2726                                   struct ieee80211_vif *vif,
2727                                   unsigned int link_id, u16 queue,
2728                                   const struct ieee80211_tx_queue_params *params)
2729 {
2730         wiphy_dbg(hw->wiphy,
2731                   "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2732                   __func__, queue,
2733                   params->txop, params->cw_min,
2734                   params->cw_max, params->aifs);
2735         return 0;
2736 }
2737
2738 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2739                                      struct survey_info *survey)
2740 {
2741         struct mac80211_hwsim_data *hwsim = hw->priv;
2742
2743         if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2744                 return -ENOENT;
2745
2746         mutex_lock(&hwsim->mutex);
2747         survey->channel = hwsim->survey_data[idx].channel;
2748         if (!survey->channel) {
2749                 mutex_unlock(&hwsim->mutex);
2750                 return -ENOENT;
2751         }
2752
2753         /*
2754          * Magically conjured dummy values --- this is only ok for simulated hardware.
2755          *
2756          * A real driver which cannot determine real values noise MUST NOT
2757          * report any, especially not a magically conjured ones :-)
2758          */
2759         survey->filled = SURVEY_INFO_NOISE_DBM |
2760                          SURVEY_INFO_TIME |
2761                          SURVEY_INFO_TIME_BUSY;
2762         survey->noise = -92;
2763         survey->time =
2764                 jiffies_to_msecs(hwsim->survey_data[idx].end -
2765                                  hwsim->survey_data[idx].start);
2766         /* report 12.5% of channel time is used */
2767         survey->time_busy = survey->time/8;
2768         mutex_unlock(&hwsim->mutex);
2769
2770         return 0;
2771 }
2772
2773 static enum ieee80211_neg_ttlm_res
2774 mac80211_hwsim_can_neg_ttlm(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2775                             struct ieee80211_neg_ttlm *neg_ttlm)
2776 {
2777         u32 i;
2778
2779         /* For testing purposes, accept if all TIDs are mapped to the same links
2780          * set, otherwise reject.
2781          */
2782         for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) {
2783                 if (neg_ttlm->downlink[i] != neg_ttlm->uplink[i] ||
2784                     neg_ttlm->downlink[i] != neg_ttlm->downlink[0])
2785                         return NEG_TTLM_RES_REJECT;
2786         }
2787
2788         return NEG_TTLM_RES_ACCEPT;
2789 }
2790
2791 #ifdef CONFIG_NL80211_TESTMODE
2792 /*
2793  * This section contains example code for using netlink
2794  * attributes with the testmode command in nl80211.
2795  */
2796
2797 /* These enums need to be kept in sync with userspace */
2798 enum hwsim_testmode_attr {
2799         __HWSIM_TM_ATTR_INVALID = 0,
2800         HWSIM_TM_ATTR_CMD       = 1,
2801         HWSIM_TM_ATTR_PS        = 2,
2802
2803         /* keep last */
2804         __HWSIM_TM_ATTR_AFTER_LAST,
2805         HWSIM_TM_ATTR_MAX       = __HWSIM_TM_ATTR_AFTER_LAST - 1
2806 };
2807
2808 enum hwsim_testmode_cmd {
2809         HWSIM_TM_CMD_SET_PS             = 0,
2810         HWSIM_TM_CMD_GET_PS             = 1,
2811         HWSIM_TM_CMD_STOP_QUEUES        = 2,
2812         HWSIM_TM_CMD_WAKE_QUEUES        = 3,
2813 };
2814
2815 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2816         [HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2817         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2818 };
2819
2820 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2821                                        struct ieee80211_vif *vif,
2822                                        void *data, int len)
2823 {
2824         struct mac80211_hwsim_data *hwsim = hw->priv;
2825         struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2826         struct sk_buff *skb;
2827         int err, ps;
2828
2829         err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2830                                    hwsim_testmode_policy, NULL);
2831         if (err)
2832                 return err;
2833
2834         if (!tb[HWSIM_TM_ATTR_CMD])
2835                 return -EINVAL;
2836
2837         switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2838         case HWSIM_TM_CMD_SET_PS:
2839                 if (!tb[HWSIM_TM_ATTR_PS])
2840                         return -EINVAL;
2841                 ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2842                 return hwsim_fops_ps_write(hwsim, ps);
2843         case HWSIM_TM_CMD_GET_PS:
2844                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2845                                                 nla_total_size(sizeof(u32)));
2846                 if (!skb)
2847                         return -ENOMEM;
2848                 if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2849                         goto nla_put_failure;
2850                 return cfg80211_testmode_reply(skb);
2851         case HWSIM_TM_CMD_STOP_QUEUES:
2852                 ieee80211_stop_queues(hw);
2853                 return 0;
2854         case HWSIM_TM_CMD_WAKE_QUEUES:
2855                 ieee80211_wake_queues(hw);
2856                 return 0;
2857         default:
2858                 return -EOPNOTSUPP;
2859         }
2860
2861  nla_put_failure:
2862         kfree_skb(skb);
2863         return -ENOBUFS;
2864 }
2865 #endif
2866
2867 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2868                                        struct ieee80211_vif *vif,
2869                                        struct ieee80211_ampdu_params *params)
2870 {
2871         struct ieee80211_sta *sta = params->sta;
2872         enum ieee80211_ampdu_mlme_action action = params->action;
2873         u16 tid = params->tid;
2874
2875         switch (action) {
2876         case IEEE80211_AMPDU_TX_START:
2877                 return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2878         case IEEE80211_AMPDU_TX_STOP_CONT:
2879         case IEEE80211_AMPDU_TX_STOP_FLUSH:
2880         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2881                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2882                 break;
2883         case IEEE80211_AMPDU_TX_OPERATIONAL:
2884                 break;
2885         case IEEE80211_AMPDU_RX_START:
2886         case IEEE80211_AMPDU_RX_STOP:
2887                 break;
2888         default:
2889                 return -EOPNOTSUPP;
2890         }
2891
2892         return 0;
2893 }
2894
2895 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2896                                  struct ieee80211_vif *vif,
2897                                  u32 queues, bool drop)
2898 {
2899         /* Not implemented, queues only on kernel side */
2900 }
2901
2902 static void hw_scan_work(struct work_struct *work)
2903 {
2904         struct mac80211_hwsim_data *hwsim =
2905                 container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2906         struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2907         int dwell, i;
2908
2909         mutex_lock(&hwsim->mutex);
2910         if (hwsim->scan_chan_idx >= req->n_channels) {
2911                 struct cfg80211_scan_info info = {
2912                         .aborted = false,
2913                 };
2914
2915                 wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2916                 ieee80211_scan_completed(hwsim->hw, &info);
2917                 hwsim->hw_scan_request = NULL;
2918                 hwsim->hw_scan_vif = NULL;
2919                 hwsim->tmp_chan = NULL;
2920                 mutex_unlock(&hwsim->mutex);
2921                 mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2922                                              false);
2923                 return;
2924         }
2925
2926         wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2927                   req->channels[hwsim->scan_chan_idx]->center_freq);
2928
2929         hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2930         if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2931                                       IEEE80211_CHAN_RADAR) ||
2932             !req->n_ssids) {
2933                 dwell = 120;
2934         } else {
2935                 dwell = 30;
2936                 /* send probes */
2937                 for (i = 0; i < req->n_ssids; i++) {
2938                         struct sk_buff *probe;
2939                         struct ieee80211_mgmt *mgmt;
2940
2941                         probe = ieee80211_probereq_get(hwsim->hw,
2942                                                        hwsim->scan_addr,
2943                                                        req->ssids[i].ssid,
2944                                                        req->ssids[i].ssid_len,
2945                                                        req->ie_len);
2946                         if (!probe)
2947                                 continue;
2948
2949                         mgmt = (struct ieee80211_mgmt *) probe->data;
2950                         memcpy(mgmt->da, req->bssid, ETH_ALEN);
2951                         memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2952
2953                         if (req->ie_len)
2954                                 skb_put_data(probe, req->ie, req->ie_len);
2955
2956                         rcu_read_lock();
2957                         if (!ieee80211_tx_prepare_skb(hwsim->hw,
2958                                                       hwsim->hw_scan_vif,
2959                                                       probe,
2960                                                       hwsim->tmp_chan->band,
2961                                                       NULL)) {
2962                                 rcu_read_unlock();
2963                                 kfree_skb(probe);
2964                                 continue;
2965                         }
2966
2967                         local_bh_disable();
2968                         mac80211_hwsim_tx_frame(hwsim->hw, probe,
2969                                                 hwsim->tmp_chan);
2970                         rcu_read_unlock();
2971                         local_bh_enable();
2972                 }
2973         }
2974         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2975                                      msecs_to_jiffies(dwell));
2976         hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2977         hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2978         hwsim->survey_data[hwsim->scan_chan_idx].end =
2979                 jiffies + msecs_to_jiffies(dwell);
2980         hwsim->scan_chan_idx++;
2981         mutex_unlock(&hwsim->mutex);
2982 }
2983
2984 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2985                                   struct ieee80211_vif *vif,
2986                                   struct ieee80211_scan_request *hw_req)
2987 {
2988         struct mac80211_hwsim_data *hwsim = hw->priv;
2989         struct cfg80211_scan_request *req = &hw_req->req;
2990
2991         mutex_lock(&hwsim->mutex);
2992         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2993                 mutex_unlock(&hwsim->mutex);
2994                 return -EBUSY;
2995         }
2996         hwsim->hw_scan_request = req;
2997         hwsim->hw_scan_vif = vif;
2998         hwsim->scan_chan_idx = 0;
2999         if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
3000                 get_random_mask_addr(hwsim->scan_addr,
3001                                      hw_req->req.mac_addr,
3002                                      hw_req->req.mac_addr_mask);
3003         else
3004                 memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
3005         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
3006         mutex_unlock(&hwsim->mutex);
3007
3008         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
3009         wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
3010
3011         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
3012
3013         return 0;
3014 }
3015
3016 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
3017                                           struct ieee80211_vif *vif)
3018 {
3019         struct mac80211_hwsim_data *hwsim = hw->priv;
3020         struct cfg80211_scan_info info = {
3021                 .aborted = true,
3022         };
3023
3024         wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
3025
3026         cancel_delayed_work_sync(&hwsim->hw_scan);
3027
3028         mutex_lock(&hwsim->mutex);
3029         ieee80211_scan_completed(hwsim->hw, &info);
3030         hwsim->tmp_chan = NULL;
3031         hwsim->hw_scan_request = NULL;
3032         hwsim->hw_scan_vif = NULL;
3033         mutex_unlock(&hwsim->mutex);
3034 }
3035
3036 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
3037                                    struct ieee80211_vif *vif,
3038                                    const u8 *mac_addr)
3039 {
3040         struct mac80211_hwsim_data *hwsim = hw->priv;
3041
3042         mutex_lock(&hwsim->mutex);
3043
3044         if (hwsim->scanning) {
3045                 pr_debug("two hwsim sw_scans detected!\n");
3046                 goto out;
3047         }
3048
3049         pr_debug("hwsim sw_scan request, prepping stuff\n");
3050
3051         memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
3052         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
3053         hwsim->scanning = true;
3054         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
3055
3056 out:
3057         mutex_unlock(&hwsim->mutex);
3058 }
3059
3060 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
3061                                             struct ieee80211_vif *vif)
3062 {
3063         struct mac80211_hwsim_data *hwsim = hw->priv;
3064
3065         mutex_lock(&hwsim->mutex);
3066
3067         pr_debug("hwsim sw_scan_complete\n");
3068         hwsim->scanning = false;
3069         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
3070         eth_zero_addr(hwsim->scan_addr);
3071
3072         mutex_unlock(&hwsim->mutex);
3073 }
3074
3075 static void hw_roc_start(struct work_struct *work)
3076 {
3077         struct mac80211_hwsim_data *hwsim =
3078                 container_of(work, struct mac80211_hwsim_data, roc_start.work);
3079
3080         mutex_lock(&hwsim->mutex);
3081
3082         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
3083         hwsim->tmp_chan = hwsim->roc_chan;
3084         ieee80211_ready_on_channel(hwsim->hw);
3085
3086         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
3087                                      msecs_to_jiffies(hwsim->roc_duration));
3088
3089         mutex_unlock(&hwsim->mutex);
3090 }
3091
3092 static void hw_roc_done(struct work_struct *work)
3093 {
3094         struct mac80211_hwsim_data *hwsim =
3095                 container_of(work, struct mac80211_hwsim_data, roc_done.work);
3096
3097         mutex_lock(&hwsim->mutex);
3098         ieee80211_remain_on_channel_expired(hwsim->hw);
3099         hwsim->tmp_chan = NULL;
3100         mutex_unlock(&hwsim->mutex);
3101
3102         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
3103 }
3104
3105 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
3106                               struct ieee80211_vif *vif,
3107                               struct ieee80211_channel *chan,
3108                               int duration,
3109                               enum ieee80211_roc_type type)
3110 {
3111         struct mac80211_hwsim_data *hwsim = hw->priv;
3112
3113         mutex_lock(&hwsim->mutex);
3114         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
3115                 mutex_unlock(&hwsim->mutex);
3116                 return -EBUSY;
3117         }
3118
3119         hwsim->roc_chan = chan;
3120         hwsim->roc_duration = duration;
3121         mutex_unlock(&hwsim->mutex);
3122
3123         wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
3124                   chan->center_freq, duration);
3125         ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
3126
3127         return 0;
3128 }
3129
3130 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
3131                                struct ieee80211_vif *vif)
3132 {
3133         struct mac80211_hwsim_data *hwsim = hw->priv;
3134
3135         cancel_delayed_work_sync(&hwsim->roc_start);
3136         cancel_delayed_work_sync(&hwsim->roc_done);
3137
3138         mutex_lock(&hwsim->mutex);
3139         hwsim->tmp_chan = NULL;
3140         mutex_unlock(&hwsim->mutex);
3141
3142         wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
3143
3144         return 0;
3145 }
3146
3147 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
3148                                       struct ieee80211_chanctx_conf *ctx)
3149 {
3150         hwsim_set_chanctx_magic(ctx);
3151         wiphy_dbg(hw->wiphy,
3152                   "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3153                   ctx->def.chan->center_freq, ctx->def.width,
3154                   ctx->def.center_freq1, ctx->def.center_freq2);
3155         return 0;
3156 }
3157
3158 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
3159                                           struct ieee80211_chanctx_conf *ctx)
3160 {
3161         wiphy_dbg(hw->wiphy,
3162                   "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3163                   ctx->def.chan->center_freq, ctx->def.width,
3164                   ctx->def.center_freq1, ctx->def.center_freq2);
3165         hwsim_check_chanctx_magic(ctx);
3166         hwsim_clear_chanctx_magic(ctx);
3167 }
3168
3169 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
3170                                           struct ieee80211_chanctx_conf *ctx,
3171                                           u32 changed)
3172 {
3173         hwsim_check_chanctx_magic(ctx);
3174         wiphy_dbg(hw->wiphy,
3175                   "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3176                   ctx->def.chan->center_freq, ctx->def.width,
3177                   ctx->def.center_freq1, ctx->def.center_freq2);
3178 }
3179
3180 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
3181                                              struct ieee80211_vif *vif,
3182                                              struct ieee80211_bss_conf *link_conf,
3183                                              struct ieee80211_chanctx_conf *ctx)
3184 {
3185         hwsim_check_magic(vif);
3186         hwsim_check_chanctx_magic(ctx);
3187
3188         /* if we activate a link while already associated wake it up */
3189         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3190                 struct sk_buff *skb;
3191
3192                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3193                 if (skb) {
3194                         local_bh_disable();
3195                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3196                         local_bh_enable();
3197                 }
3198         }
3199
3200         return 0;
3201 }
3202
3203 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
3204                                                 struct ieee80211_vif *vif,
3205                                                 struct ieee80211_bss_conf *link_conf,
3206                                                 struct ieee80211_chanctx_conf *ctx)
3207 {
3208         hwsim_check_magic(vif);
3209         hwsim_check_chanctx_magic(ctx);
3210
3211         /* if we deactivate a link while associated suspend it first */
3212         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3213                 struct sk_buff *skb;
3214
3215                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3216                 if (skb) {
3217                         struct ieee80211_hdr *hdr = (void *)skb->data;
3218
3219                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
3220
3221                         local_bh_disable();
3222                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3223                         local_bh_enable();
3224                 }
3225         }
3226 }
3227
3228 static int mac80211_hwsim_switch_vif_chanctx(struct ieee80211_hw *hw,
3229                                              struct ieee80211_vif_chanctx_switch *vifs,
3230                                              int n_vifs,
3231                                              enum ieee80211_chanctx_switch_mode mode)
3232 {
3233         int i;
3234
3235         if (n_vifs <= 0)
3236                 return -EINVAL;
3237
3238         wiphy_dbg(hw->wiphy,
3239                   "switch vif channel context mode: %u\n", mode);
3240
3241         for (i = 0; i < n_vifs; i++) {
3242                 hwsim_check_chanctx_magic(vifs[i].old_ctx);
3243                 wiphy_dbg(hw->wiphy,
3244                           "switch vif channel context: %d MHz/width: %d/cfreqs:%d/%d MHz -> %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3245                           vifs[i].old_ctx->def.chan->center_freq,
3246                           vifs[i].old_ctx->def.width,
3247                           vifs[i].old_ctx->def.center_freq1,
3248                           vifs[i].old_ctx->def.center_freq2,
3249                           vifs[i].new_ctx->def.chan->center_freq,
3250                           vifs[i].new_ctx->def.width,
3251                           vifs[i].new_ctx->def.center_freq1,
3252                           vifs[i].new_ctx->def.center_freq2);
3253
3254                 switch (mode) {
3255                 case CHANCTX_SWMODE_REASSIGN_VIF:
3256                         hwsim_check_chanctx_magic(vifs[i].new_ctx);
3257                         break;
3258                 case CHANCTX_SWMODE_SWAP_CONTEXTS:
3259                         hwsim_set_chanctx_magic(vifs[i].new_ctx);
3260                         hwsim_clear_chanctx_magic(vifs[i].old_ctx);
3261                         break;
3262                 default:
3263                         WARN_ON("Invalid mode");
3264                 }
3265         }
3266         return 0;
3267 }
3268
3269 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3270         "tx_pkts_nic",
3271         "tx_bytes_nic",
3272         "rx_pkts_nic",
3273         "rx_bytes_nic",
3274         "d_tx_dropped",
3275         "d_tx_failed",
3276         "d_ps_mode",
3277         "d_group",
3278 };
3279
3280 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3281
3282 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3283                                           struct ieee80211_vif *vif,
3284                                           u32 sset, u8 *data)
3285 {
3286         if (sset == ETH_SS_STATS)
3287                 memcpy(data, mac80211_hwsim_gstrings_stats,
3288                        sizeof(mac80211_hwsim_gstrings_stats));
3289 }
3290
3291 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3292                                             struct ieee80211_vif *vif, int sset)
3293 {
3294         if (sset == ETH_SS_STATS)
3295                 return MAC80211_HWSIM_SSTATS_LEN;
3296         return 0;
3297 }
3298
3299 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3300                                         struct ieee80211_vif *vif,
3301                                         struct ethtool_stats *stats, u64 *data)
3302 {
3303         struct mac80211_hwsim_data *ar = hw->priv;
3304         int i = 0;
3305
3306         data[i++] = ar->tx_pkts;
3307         data[i++] = ar->tx_bytes;
3308         data[i++] = ar->rx_pkts;
3309         data[i++] = ar->rx_bytes;
3310         data[i++] = ar->tx_dropped;
3311         data[i++] = ar->tx_failed;
3312         data[i++] = ar->ps;
3313         data[i++] = ar->group;
3314
3315         WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3316 }
3317
3318 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3319 {
3320         return 1;
3321 }
3322
3323 static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3324 {
3325         return -EOPNOTSUPP;
3326 }
3327
3328 static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3329                                            struct ieee80211_vif *vif,
3330                                            u16 old_links, u16 new_links,
3331                                            struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3332 {
3333         unsigned long rem = old_links & ~new_links;
3334         unsigned long add = new_links & ~old_links;
3335         int i;
3336
3337         if (!old_links)
3338                 rem |= BIT(0);
3339         if (!new_links)
3340                 add |= BIT(0);
3341
3342         for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS)
3343                 mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3344
3345         for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3346                 struct ieee80211_bss_conf *link_conf;
3347
3348                 link_conf = link_conf_dereference_protected(vif, i);
3349                 if (WARN_ON(!link_conf))
3350                         continue;
3351
3352                 mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3353         }
3354
3355         return 0;
3356 }
3357
3358 static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3359                                            struct ieee80211_vif *vif,
3360                                            struct ieee80211_sta *sta,
3361                                            u16 old_links, u16 new_links)
3362 {
3363         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3364
3365         hwsim_check_sta_magic(sta);
3366
3367         if (vif->type == NL80211_IFTYPE_STATION)
3368                 sp->active_links_rx = new_links;
3369
3370         return 0;
3371 }
3372
3373 static int mac80211_hwsim_send_pmsr_ftm_request_peer(struct sk_buff *msg,
3374                                                      struct cfg80211_pmsr_ftm_request_peer *request)
3375 {
3376         struct nlattr *ftm;
3377
3378         if (!request->requested)
3379                 return -EINVAL;
3380
3381         ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
3382         if (!ftm)
3383                 return -ENOBUFS;
3384
3385         if (nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE, request->preamble))
3386                 return -ENOBUFS;
3387
3388         if (nla_put_u16(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD, request->burst_period))
3389                 return -ENOBUFS;
3390
3391         if (request->asap && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_ASAP))
3392                 return -ENOBUFS;
3393
3394         if (request->request_lci && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI))
3395                 return -ENOBUFS;
3396
3397         if (request->request_civicloc &&
3398             nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC))
3399                 return -ENOBUFS;
3400
3401         if (request->trigger_based && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED))
3402                 return -ENOBUFS;
3403
3404         if (request->non_trigger_based &&
3405             nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED))
3406                 return -ENOBUFS;
3407
3408         if (request->lmr_feedback && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK))
3409                 return -ENOBUFS;
3410
3411         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP, request->num_bursts_exp))
3412                 return -ENOBUFS;
3413
3414         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3415                 return -ENOBUFS;
3416
3417         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST, request->ftms_per_burst))
3418                 return -ENOBUFS;
3419
3420         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES, request->ftmr_retries))
3421                 return -ENOBUFS;
3422
3423         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3424                 return -ENOBUFS;
3425
3426         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, request->bss_color))
3427                 return -ENOBUFS;
3428
3429         nla_nest_end(msg, ftm);
3430
3431         return 0;
3432 }
3433
3434 static int mac80211_hwsim_send_pmsr_request_peer(struct sk_buff *msg,
3435                                                  struct cfg80211_pmsr_request_peer *request)
3436 {
3437         struct nlattr *peer, *chandef, *req, *data;
3438         int err;
3439
3440         peer = nla_nest_start(msg, NL80211_PMSR_ATTR_PEERS);
3441         if (!peer)
3442                 return -ENOBUFS;
3443
3444         if (nla_put(msg, NL80211_PMSR_PEER_ATTR_ADDR, ETH_ALEN,
3445                     request->addr))
3446                 return -ENOBUFS;
3447
3448         chandef = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_CHAN);
3449         if (!chandef)
3450                 return -ENOBUFS;
3451
3452         err = nl80211_send_chandef(msg, &request->chandef);
3453         if (err)
3454                 return err;
3455
3456         nla_nest_end(msg, chandef);
3457
3458         req = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_REQ);
3459         if (!req)
3460                 return -ENOBUFS;
3461
3462         if (request->report_ap_tsf && nla_put_flag(msg, NL80211_PMSR_REQ_ATTR_GET_AP_TSF))
3463                 return -ENOBUFS;
3464
3465         data = nla_nest_start(msg, NL80211_PMSR_REQ_ATTR_DATA);
3466         if (!data)
3467                 return -ENOBUFS;
3468
3469         err = mac80211_hwsim_send_pmsr_ftm_request_peer(msg, &request->ftm);
3470         if (err)
3471                 return err;
3472
3473         nla_nest_end(msg, data);
3474         nla_nest_end(msg, req);
3475         nla_nest_end(msg, peer);
3476
3477         return 0;
3478 }
3479
3480 static int mac80211_hwsim_send_pmsr_request(struct sk_buff *msg,
3481                                             struct cfg80211_pmsr_request *request)
3482 {
3483         struct nlattr *pmsr;
3484         int err;
3485
3486         pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
3487         if (!pmsr)
3488                 return -ENOBUFS;
3489
3490         if (nla_put_u32(msg, NL80211_ATTR_TIMEOUT, request->timeout))
3491                 return -ENOBUFS;
3492
3493         if (!is_zero_ether_addr(request->mac_addr)) {
3494                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, request->mac_addr))
3495                         return -ENOBUFS;
3496                 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, request->mac_addr_mask))
3497                         return -ENOBUFS;
3498         }
3499
3500         for (int i = 0; i < request->n_peers; i++) {
3501                 err = mac80211_hwsim_send_pmsr_request_peer(msg, &request->peers[i]);
3502                 if (err)
3503                         return err;
3504         }
3505
3506         nla_nest_end(msg, pmsr);
3507
3508         return 0;
3509 }
3510
3511 static int mac80211_hwsim_start_pmsr(struct ieee80211_hw *hw,
3512                                      struct ieee80211_vif *vif,
3513                                      struct cfg80211_pmsr_request *request)
3514 {
3515         struct mac80211_hwsim_data *data;
3516         struct sk_buff *skb = NULL;
3517         struct nlattr *pmsr;
3518         void *msg_head;
3519         u32 _portid;
3520         int err = 0;
3521
3522         data = hw->priv;
3523         _portid = READ_ONCE(data->wmediumd);
3524         if (!_portid && !hwsim_virtio_enabled)
3525                 return -EOPNOTSUPP;
3526
3527         mutex_lock(&data->mutex);
3528
3529         if (data->pmsr_request) {
3530                 err = -EBUSY;
3531                 goto out_free;
3532         }
3533
3534         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3535
3536         if (!skb) {
3537                 err = -ENOMEM;
3538                 goto out_free;
3539         }
3540
3541         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_START_PMSR);
3542
3543         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
3544                     ETH_ALEN, data->addresses[1].addr)) {
3545                 err = -ENOMEM;
3546                 goto out_free;
3547         }
3548
3549         pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3550         if (!pmsr) {
3551                 err = -ENOMEM;
3552                 goto out_free;
3553         }
3554
3555         err = mac80211_hwsim_send_pmsr_request(skb, request);
3556         if (err)
3557                 goto out_free;
3558
3559         nla_nest_end(skb, pmsr);
3560
3561         genlmsg_end(skb, msg_head);
3562         if (hwsim_virtio_enabled)
3563                 hwsim_tx_virtio(data, skb);
3564         else
3565                 hwsim_unicast_netgroup(data, skb, _portid);
3566
3567         data->pmsr_request = request;
3568         data->pmsr_request_wdev = ieee80211_vif_to_wdev(vif);
3569
3570 out_free:
3571         if (err && skb)
3572                 nlmsg_free(skb);
3573
3574         mutex_unlock(&data->mutex);
3575         return err;
3576 }
3577
3578 static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
3579                                       struct ieee80211_vif *vif,
3580                                       struct cfg80211_pmsr_request *request)
3581 {
3582         struct mac80211_hwsim_data *data;
3583         struct sk_buff *skb = NULL;
3584         struct nlattr *pmsr;
3585         void *msg_head;
3586         u32 _portid;
3587         int err = 0;
3588
3589         data = hw->priv;
3590         _portid = READ_ONCE(data->wmediumd);
3591         if (!_portid && !hwsim_virtio_enabled)
3592                 return;
3593
3594         mutex_lock(&data->mutex);
3595
3596         if (data->pmsr_request != request) {
3597                 err = -EINVAL;
3598                 goto out;
3599         }
3600
3601         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3602         if (!skb) {
3603                 err = -ENOMEM;
3604                 goto out;
3605         }
3606
3607         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_ABORT_PMSR);
3608
3609         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER, ETH_ALEN, data->addresses[1].addr))
3610                 goto out;
3611
3612         pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3613         if (!pmsr) {
3614                 err = -ENOMEM;
3615                 goto out;
3616         }
3617
3618         err = mac80211_hwsim_send_pmsr_request(skb, request);
3619         if (err)
3620                 goto out;
3621
3622         err = nla_nest_end(skb, pmsr);
3623         if (err)
3624                 goto out;
3625
3626         genlmsg_end(skb, msg_head);
3627         if (hwsim_virtio_enabled)
3628                 hwsim_tx_virtio(data, skb);
3629         else
3630                 hwsim_unicast_netgroup(data, skb, _portid);
3631
3632 out:
3633         if (err && skb)
3634                 nlmsg_free(skb);
3635
3636         mutex_unlock(&data->mutex);
3637 }
3638
3639 static int mac80211_hwsim_parse_rate_info(struct nlattr *rateattr,
3640                                           struct rate_info *rate_info,
3641                                           struct genl_info *info)
3642 {
3643         struct nlattr *tb[HWSIM_RATE_INFO_ATTR_MAX + 1];
3644         int ret;
3645
3646         ret = nla_parse_nested(tb, HWSIM_RATE_INFO_ATTR_MAX,
3647                                rateattr, hwsim_rate_info_policy, info->extack);
3648         if (ret)
3649                 return ret;
3650
3651         if (tb[HWSIM_RATE_INFO_ATTR_FLAGS])
3652                 rate_info->flags = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_FLAGS]);
3653
3654         if (tb[HWSIM_RATE_INFO_ATTR_MCS])
3655                 rate_info->mcs = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_MCS]);
3656
3657         if (tb[HWSIM_RATE_INFO_ATTR_LEGACY])
3658                 rate_info->legacy = nla_get_u16(tb[HWSIM_RATE_INFO_ATTR_LEGACY]);
3659
3660         if (tb[HWSIM_RATE_INFO_ATTR_NSS])
3661                 rate_info->nss = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_NSS]);
3662
3663         if (tb[HWSIM_RATE_INFO_ATTR_BW])
3664                 rate_info->bw = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_BW]);
3665
3666         if (tb[HWSIM_RATE_INFO_ATTR_HE_GI])
3667                 rate_info->he_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_GI]);
3668
3669         if (tb[HWSIM_RATE_INFO_ATTR_HE_DCM])
3670                 rate_info->he_dcm = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_DCM]);
3671
3672         if (tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC])
3673                 rate_info->he_ru_alloc =
3674                         nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC]);
3675
3676         if (tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH])
3677                 rate_info->n_bonded_ch = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH]);
3678
3679         if (tb[HWSIM_RATE_INFO_ATTR_EHT_GI])
3680                 rate_info->eht_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_GI]);
3681
3682         if (tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC])
3683                 rate_info->eht_ru_alloc = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC]);
3684
3685         return 0;
3686 }
3687
3688 static int mac80211_hwsim_parse_ftm_result(struct nlattr *ftm,
3689                                            struct cfg80211_pmsr_ftm_result *result,
3690                                            struct genl_info *info)
3691 {
3692         struct nlattr *tb[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1];
3693         int ret;
3694
3695         ret = nla_parse_nested(tb, NL80211_PMSR_FTM_RESP_ATTR_MAX,
3696                                ftm, hwsim_ftm_result_policy, info->extack);
3697         if (ret)
3698                 return ret;
3699
3700         if (tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON])
3701                 result->failure_reason = nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON]);
3702
3703         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX])
3704                 result->burst_index = nla_get_u16(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX]);
3705
3706         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]) {
3707                 result->num_ftmr_attempts_valid = 1;
3708                 result->num_ftmr_attempts =
3709                         nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]);
3710         }
3711
3712         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]) {
3713                 result->num_ftmr_successes_valid = 1;
3714                 result->num_ftmr_successes =
3715                         nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]);
3716         }
3717
3718         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME])
3719                 result->busy_retry_time =
3720                         nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME]);
3721
3722         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP])
3723                 result->num_bursts_exp = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP]);
3724
3725         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION])
3726                 result->burst_duration = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION]);
3727
3728         if (tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST])
3729                 result->ftms_per_burst = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST]);
3730
3731         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]) {
3732                 result->rssi_avg_valid = 1;
3733                 result->rssi_avg = nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]);
3734         }
3735         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]) {
3736                 result->rssi_spread_valid = 1;
3737                 result->rssi_spread =
3738                         nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]);
3739         }
3740
3741         if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE]) {
3742                 result->tx_rate_valid = 1;
3743                 ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE],
3744                                                      &result->tx_rate, info);
3745                 if (ret)
3746                         return ret;
3747         }
3748
3749         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE]) {
3750                 result->rx_rate_valid = 1;
3751                 ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE],
3752                                                      &result->rx_rate, info);
3753                 if (ret)
3754                         return ret;
3755         }
3756
3757         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]) {
3758                 result->rtt_avg_valid = 1;
3759                 result->rtt_avg =
3760                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]);
3761         }
3762         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]) {
3763                 result->rtt_variance_valid = 1;
3764                 result->rtt_variance =
3765                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]);
3766         }
3767         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]) {
3768                 result->rtt_spread_valid = 1;
3769                 result->rtt_spread =
3770                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]);
3771         }
3772         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]) {
3773                 result->dist_avg_valid = 1;
3774                 result->dist_avg =
3775                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]);
3776         }
3777         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]) {
3778                 result->dist_variance_valid = 1;
3779                 result->dist_variance =
3780                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]);
3781         }
3782         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]) {
3783                 result->dist_spread_valid = 1;
3784                 result->dist_spread =
3785                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]);
3786         }
3787
3788         if (tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]) {
3789                 result->lci = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3790                 result->lci_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3791         }
3792
3793         if (tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]) {
3794                 result->civicloc = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3795                 result->civicloc_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3796         }
3797
3798         return 0;
3799 }
3800
3801 static int mac80211_hwsim_parse_pmsr_resp(struct nlattr *resp,
3802                                           struct cfg80211_pmsr_result *result,
3803                                           struct genl_info *info)
3804 {
3805         struct nlattr *tb[NL80211_PMSR_RESP_ATTR_MAX + 1];
3806         struct nlattr *pmsr;
3807         int rem;
3808         int ret;
3809
3810         ret = nla_parse_nested(tb, NL80211_PMSR_RESP_ATTR_MAX, resp, hwsim_pmsr_resp_policy,
3811                                info->extack);
3812         if (ret)
3813                 return ret;
3814
3815         if (tb[NL80211_PMSR_RESP_ATTR_STATUS])
3816                 result->status = nla_get_u32(tb[NL80211_PMSR_RESP_ATTR_STATUS]);
3817
3818         if (tb[NL80211_PMSR_RESP_ATTR_HOST_TIME])
3819                 result->host_time = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_HOST_TIME]);
3820
3821         if (tb[NL80211_PMSR_RESP_ATTR_AP_TSF]) {
3822                 result->ap_tsf_valid = 1;
3823                 result->ap_tsf = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_AP_TSF]);
3824         }
3825
3826         result->final = !!tb[NL80211_PMSR_RESP_ATTR_FINAL];
3827
3828         if (!tb[NL80211_PMSR_RESP_ATTR_DATA])
3829                 return 0;
3830
3831         nla_for_each_nested(pmsr, tb[NL80211_PMSR_RESP_ATTR_DATA], rem) {
3832                 switch (nla_type(pmsr)) {
3833                 case NL80211_PMSR_TYPE_FTM:
3834                         result->type = NL80211_PMSR_TYPE_FTM;
3835                         ret = mac80211_hwsim_parse_ftm_result(pmsr, &result->ftm, info);
3836                         if (ret)
3837                                 return ret;
3838                         break;
3839                 default:
3840                         NL_SET_ERR_MSG_ATTR(info->extack, pmsr, "Unknown pmsr resp type");
3841                         return -EINVAL;
3842                 }
3843         }
3844
3845         return 0;
3846 }
3847
3848 static int mac80211_hwsim_parse_pmsr_result(struct nlattr *peer,
3849                                             struct cfg80211_pmsr_result *result,
3850                                             struct genl_info *info)
3851 {
3852         struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];
3853         int ret;
3854
3855         if (!peer)
3856                 return -EINVAL;
3857
3858         ret = nla_parse_nested(tb, NL80211_PMSR_PEER_ATTR_MAX, peer,
3859                                hwsim_pmsr_peer_result_policy, info->extack);
3860         if (ret)
3861                 return ret;
3862
3863         if (tb[NL80211_PMSR_PEER_ATTR_ADDR])
3864                 memcpy(result->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]),
3865                        ETH_ALEN);
3866
3867         if (tb[NL80211_PMSR_PEER_ATTR_RESP]) {
3868                 ret = mac80211_hwsim_parse_pmsr_resp(tb[NL80211_PMSR_PEER_ATTR_RESP], result, info);
3869                 if (ret)
3870                         return ret;
3871         }
3872
3873         return 0;
3874 };
3875
3876 static int hwsim_pmsr_report_nl(struct sk_buff *msg, struct genl_info *info)
3877 {
3878         struct mac80211_hwsim_data *data;
3879         struct nlattr *peers, *peer;
3880         struct nlattr *reqattr;
3881         const u8 *src;
3882         int err;
3883         int rem;
3884
3885         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER])
3886                 return -EINVAL;
3887
3888         src = nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
3889         data = get_hwsim_data_ref_from_addr(src);
3890         if (!data)
3891                 return -EINVAL;
3892
3893         mutex_lock(&data->mutex);
3894         if (!data->pmsr_request) {
3895                 err = -EINVAL;
3896                 goto out;
3897         }
3898
3899         reqattr = info->attrs[HWSIM_ATTR_PMSR_RESULT];
3900         if (!reqattr) {
3901                 err = -EINVAL;
3902                 goto out;
3903         }
3904
3905         peers = nla_find_nested(reqattr, NL80211_PMSR_ATTR_PEERS);
3906         if (!peers) {
3907                 err = -EINVAL;
3908                 goto out;
3909         }
3910
3911         nla_for_each_nested(peer, peers, rem) {
3912                 struct cfg80211_pmsr_result result = {};
3913
3914                 err = mac80211_hwsim_parse_pmsr_result(peer, &result, info);
3915                 if (err)
3916                         goto out;
3917
3918                 cfg80211_pmsr_report(data->pmsr_request_wdev,
3919                                      data->pmsr_request, &result, GFP_KERNEL);
3920         }
3921
3922         cfg80211_pmsr_complete(data->pmsr_request_wdev, data->pmsr_request, GFP_KERNEL);
3923
3924         err = 0;
3925 out:
3926         data->pmsr_request = NULL;
3927         data->pmsr_request_wdev = NULL;
3928
3929         mutex_unlock(&data->mutex);
3930         return err;
3931 }
3932
3933 #ifdef CONFIG_MAC80211_DEBUGFS
3934 #define HWSIM_DEBUGFS_OPS                                       \
3935         .link_add_debugfs = mac80211_hwsim_link_add_debugfs,
3936 #else
3937 #define HWSIM_DEBUGFS_OPS
3938 #endif
3939
3940 #define HWSIM_COMMON_OPS                                        \
3941         .tx = mac80211_hwsim_tx,                                \
3942         .wake_tx_queue = ieee80211_handle_wake_tx_queue,        \
3943         .start = mac80211_hwsim_start,                          \
3944         .stop = mac80211_hwsim_stop,                            \
3945         .add_interface = mac80211_hwsim_add_interface,          \
3946         .change_interface = mac80211_hwsim_change_interface,    \
3947         .remove_interface = mac80211_hwsim_remove_interface,    \
3948         .config = mac80211_hwsim_config,                        \
3949         .configure_filter = mac80211_hwsim_configure_filter,    \
3950         .vif_cfg_changed = mac80211_hwsim_vif_info_changed,     \
3951         .link_info_changed = mac80211_hwsim_link_info_changed,  \
3952         .tx_last_beacon = mac80211_hwsim_tx_last_beacon,        \
3953         .sta_notify = mac80211_hwsim_sta_notify,                \
3954         .sta_rc_update = mac80211_hwsim_sta_rc_update,          \
3955         .conf_tx = mac80211_hwsim_conf_tx,                      \
3956         .get_survey = mac80211_hwsim_get_survey,                \
3957         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)      \
3958         .ampdu_action = mac80211_hwsim_ampdu_action,            \
3959         .flush = mac80211_hwsim_flush,                          \
3960         .get_et_sset_count = mac80211_hwsim_get_et_sset_count,  \
3961         .get_et_stats = mac80211_hwsim_get_et_stats,            \
3962         .get_et_strings = mac80211_hwsim_get_et_strings,        \
3963         .start_pmsr = mac80211_hwsim_start_pmsr,                \
3964         .abort_pmsr = mac80211_hwsim_abort_pmsr,                \
3965         HWSIM_DEBUGFS_OPS
3966
3967 #define HWSIM_NON_MLO_OPS                                       \
3968         .sta_add = mac80211_hwsim_sta_add,                      \
3969         .sta_remove = mac80211_hwsim_sta_remove,                \
3970         .set_tim = mac80211_hwsim_set_tim,                      \
3971         .get_tsf = mac80211_hwsim_get_tsf,                      \
3972         .set_tsf = mac80211_hwsim_set_tsf,
3973
3974 static const struct ieee80211_ops mac80211_hwsim_ops = {
3975         HWSIM_COMMON_OPS
3976         HWSIM_NON_MLO_OPS
3977         .sw_scan_start = mac80211_hwsim_sw_scan,
3978         .sw_scan_complete = mac80211_hwsim_sw_scan_complete,
3979         .add_chanctx = ieee80211_emulate_add_chanctx,
3980         .remove_chanctx = ieee80211_emulate_remove_chanctx,
3981         .change_chanctx = ieee80211_emulate_change_chanctx,
3982         .switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx,
3983 };
3984
3985 #define HWSIM_CHANCTX_OPS                                       \
3986         .hw_scan = mac80211_hwsim_hw_scan,                      \
3987         .cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,        \
3988         .remain_on_channel = mac80211_hwsim_roc,                \
3989         .cancel_remain_on_channel = mac80211_hwsim_croc,        \
3990         .add_chanctx = mac80211_hwsim_add_chanctx,              \
3991         .remove_chanctx = mac80211_hwsim_remove_chanctx,        \
3992         .change_chanctx = mac80211_hwsim_change_chanctx,        \
3993         .assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
3994         .unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx, \
3995         .switch_vif_chanctx = mac80211_hwsim_switch_vif_chanctx,
3996
3997 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
3998         HWSIM_COMMON_OPS
3999         HWSIM_NON_MLO_OPS
4000         HWSIM_CHANCTX_OPS
4001 };
4002
4003 static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
4004         HWSIM_COMMON_OPS
4005         HWSIM_CHANCTX_OPS
4006         .set_rts_threshold = mac80211_hwsim_set_rts_threshold,
4007         .change_vif_links = mac80211_hwsim_change_vif_links,
4008         .change_sta_links = mac80211_hwsim_change_sta_links,
4009         .sta_state = mac80211_hwsim_sta_state,
4010         .can_neg_ttlm = mac80211_hwsim_can_neg_ttlm,
4011 };
4012
4013 struct hwsim_new_radio_params {
4014         unsigned int channels;
4015         const char *reg_alpha2;
4016         const struct ieee80211_regdomain *regd;
4017         bool reg_strict;
4018         bool p2p_device;
4019         bool use_chanctx;
4020         bool destroy_on_close;
4021         const char *hwname;
4022         bool no_vif;
4023         const u8 *perm_addr;
4024         u32 iftypes;
4025         u32 *ciphers;
4026         u8 n_ciphers;
4027         bool mlo;
4028         const struct cfg80211_pmsr_capabilities *pmsr_capa;
4029 };
4030
4031 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
4032                                    struct genl_info *info)
4033 {
4034         if (info)
4035                 genl_notify(&hwsim_genl_family, mcast_skb, info,
4036                             HWSIM_MCGRP_CONFIG, GFP_KERNEL);
4037         else
4038                 genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
4039                                   HWSIM_MCGRP_CONFIG, GFP_KERNEL);
4040 }
4041
4042 static int append_radio_msg(struct sk_buff *skb, int id,
4043                             struct hwsim_new_radio_params *param)
4044 {
4045         int ret;
4046
4047         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
4048         if (ret < 0)
4049                 return ret;
4050
4051         if (param->channels) {
4052                 ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
4053                 if (ret < 0)
4054                         return ret;
4055         }
4056
4057         if (param->reg_alpha2) {
4058                 ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
4059                               param->reg_alpha2);
4060                 if (ret < 0)
4061                         return ret;
4062         }
4063
4064         if (param->regd) {
4065                 int i;
4066
4067                 for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
4068                         if (hwsim_world_regdom_custom[i] != param->regd)
4069                                 continue;
4070
4071                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
4072                         if (ret < 0)
4073                                 return ret;
4074                         break;
4075                 }
4076         }
4077
4078         if (param->reg_strict) {
4079                 ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
4080                 if (ret < 0)
4081                         return ret;
4082         }
4083
4084         if (param->p2p_device) {
4085                 ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
4086                 if (ret < 0)
4087                         return ret;
4088         }
4089
4090         if (param->use_chanctx) {
4091                 ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
4092                 if (ret < 0)
4093                         return ret;
4094         }
4095
4096         if (param->hwname) {
4097                 ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
4098                               strlen(param->hwname), param->hwname);
4099                 if (ret < 0)
4100                         return ret;
4101         }
4102
4103         return 0;
4104 }
4105
4106 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
4107                                   struct hwsim_new_radio_params *param)
4108 {
4109         struct sk_buff *mcast_skb;
4110         void *data;
4111
4112         mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4113         if (!mcast_skb)
4114                 return;
4115
4116         data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
4117                            HWSIM_CMD_NEW_RADIO);
4118         if (!data)
4119                 goto out_err;
4120
4121         if (append_radio_msg(mcast_skb, id, param) < 0)
4122                 goto out_err;
4123
4124         genlmsg_end(mcast_skb, data);
4125
4126         hwsim_mcast_config_msg(mcast_skb, info);
4127         return;
4128
4129 out_err:
4130         nlmsg_free(mcast_skb);
4131 }
4132
4133 static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
4134         {
4135                 .types_mask = BIT(NL80211_IFTYPE_STATION) |
4136                               BIT(NL80211_IFTYPE_P2P_CLIENT),
4137                 .he_cap = {
4138                         .has_he = true,
4139                         .he_cap_elem = {
4140                                 .mac_cap_info[0] =
4141                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4142                                 .mac_cap_info[1] =
4143                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4144                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4145                                 .mac_cap_info[2] =
4146                                         IEEE80211_HE_MAC_CAP2_BSR |
4147                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4148                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4149                                 .mac_cap_info[3] =
4150                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4151                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4152                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4153                                 .phy_cap_info[0] =
4154                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4155                                 .phy_cap_info[1] =
4156                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4157                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4158                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4159                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4160                                 .phy_cap_info[2] =
4161                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4162                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4163                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4164                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4165                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4166
4167                                 /* Leave all the other PHY capability bytes
4168                                  * unset, as DCM, beam forming, RU and PPE
4169                                  * threshold information are not supported
4170                                  */
4171                         },
4172                         .he_mcs_nss_supp = {
4173                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4174                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4175                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4176                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4177                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4178                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4179                         },
4180                 },
4181                 .eht_cap = {
4182                         .has_eht = true,
4183                         .eht_cap_elem = {
4184                                 .mac_cap_info[0] =
4185                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4186                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4187                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4188                                 .phy_cap_info[0] =
4189                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4190                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4191                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4192                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4193                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4194                                 .phy_cap_info[3] =
4195                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4196                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4197                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4198                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4199                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4200                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4201                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4202                                 .phy_cap_info[4] =
4203                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4204                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4205                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4206                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4207                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4208                                 .phy_cap_info[5] =
4209                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4210                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4211                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4212                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4213                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4214                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4215                                 .phy_cap_info[6] =
4216                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4217                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4218                                 .phy_cap_info[7] =
4219                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4220                         },
4221
4222                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4223                          * Rx
4224                          */
4225                         .eht_mcs_nss_supp = {
4226                                 /*
4227                                  * Since B0, B1, B2 and B3 are not set in
4228                                  * the supported channel width set field in the
4229                                  * HE PHY capabilities information field the
4230                                  * device is a 20MHz only device on 2.4GHz band.
4231                                  */
4232                                 .only_20mhz = {
4233                                         .rx_tx_mcs7_max_nss = 0x88,
4234                                         .rx_tx_mcs9_max_nss = 0x88,
4235                                         .rx_tx_mcs11_max_nss = 0x88,
4236                                         .rx_tx_mcs13_max_nss = 0x88,
4237                                 },
4238                         },
4239                         /* PPE threshold information is not supported */
4240                 },
4241         },
4242         {
4243                 .types_mask = BIT(NL80211_IFTYPE_AP) |
4244                               BIT(NL80211_IFTYPE_P2P_GO),
4245                 .he_cap = {
4246                         .has_he = true,
4247                         .he_cap_elem = {
4248                                 .mac_cap_info[0] =
4249                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4250                                 .mac_cap_info[1] =
4251                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4252                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4253                                 .mac_cap_info[2] =
4254                                         IEEE80211_HE_MAC_CAP2_BSR |
4255                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4256                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4257                                 .mac_cap_info[3] =
4258                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4259                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4260                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4261                                 .phy_cap_info[0] =
4262                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4263                                 .phy_cap_info[1] =
4264                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4265                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4266                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4267                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4268                                 .phy_cap_info[2] =
4269                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4270                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4271                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4272                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4273                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4274
4275                                 /* Leave all the other PHY capability bytes
4276                                  * unset, as DCM, beam forming, RU and PPE
4277                                  * threshold information are not supported
4278                                  */
4279                         },
4280                         .he_mcs_nss_supp = {
4281                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4282                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4283                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4284                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4285                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4286                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4287                         },
4288                 },
4289                 .eht_cap = {
4290                         .has_eht = true,
4291                         .eht_cap_elem = {
4292                                 .mac_cap_info[0] =
4293                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4294                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4295                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4296                                 .phy_cap_info[0] =
4297                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4298                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4299                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4300                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4301                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4302                                 .phy_cap_info[3] =
4303                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4304                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4305                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4306                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4307                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4308                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4309                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4310                                 .phy_cap_info[4] =
4311                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4312                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4313                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4314                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4315                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4316                                 .phy_cap_info[5] =
4317                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4318                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4319                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4320                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4321                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4322                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4323                                 .phy_cap_info[6] =
4324                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4325                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4326                                 .phy_cap_info[7] =
4327                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4328                         },
4329
4330                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4331                          * Rx
4332                          */
4333                         .eht_mcs_nss_supp = {
4334                                 /*
4335                                  * Since B0, B1, B2 and B3 are not set in
4336                                  * the supported channel width set field in the
4337                                  * HE PHY capabilities information field the
4338                                  * device is a 20MHz only device on 2.4GHz band.
4339                                  */
4340                                 .only_20mhz = {
4341                                         .rx_tx_mcs7_max_nss = 0x88,
4342                                         .rx_tx_mcs9_max_nss = 0x88,
4343                                         .rx_tx_mcs11_max_nss = 0x88,
4344                                         .rx_tx_mcs13_max_nss = 0x88,
4345                                 },
4346                         },
4347                         /* PPE threshold information is not supported */
4348                 },
4349         },
4350 #ifdef CONFIG_MAC80211_MESH
4351         {
4352                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4353                 .he_cap = {
4354                         .has_he = true,
4355                         .he_cap_elem = {
4356                                 .mac_cap_info[0] =
4357                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4358                                 .mac_cap_info[1] =
4359                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4360                                 .mac_cap_info[2] =
4361                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4362                                 .mac_cap_info[3] =
4363                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4364                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4365                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4366                                 .phy_cap_info[0] =
4367                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4368                                 .phy_cap_info[1] =
4369                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4370                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4371                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4372                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4373                                 .phy_cap_info[2] = 0,
4374
4375                                 /* Leave all the other PHY capability bytes
4376                                  * unset, as DCM, beam forming, RU and PPE
4377                                  * threshold information are not supported
4378                                  */
4379                         },
4380                         .he_mcs_nss_supp = {
4381                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4382                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4383                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4384                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4385                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4386                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4387                         },
4388                 },
4389         },
4390 #endif
4391 };
4392
4393 static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
4394         {
4395                 .types_mask = BIT(NL80211_IFTYPE_STATION) |
4396                               BIT(NL80211_IFTYPE_P2P_CLIENT),
4397                 .he_cap = {
4398                         .has_he = true,
4399                         .he_cap_elem = {
4400                                 .mac_cap_info[0] =
4401                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4402                                 .mac_cap_info[1] =
4403                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4404                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4405                                 .mac_cap_info[2] =
4406                                         IEEE80211_HE_MAC_CAP2_BSR |
4407                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4408                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4409                                 .mac_cap_info[3] =
4410                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4411                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4412                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4413                                 .phy_cap_info[0] =
4414                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4415                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4416                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4417                                 .phy_cap_info[1] =
4418                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4419                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4420                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4421                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4422                                 .phy_cap_info[2] =
4423                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4424                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4425                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4426                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4427                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4428
4429                                 /* Leave all the other PHY capability bytes
4430                                  * unset, as DCM, beam forming, RU and PPE
4431                                  * threshold information are not supported
4432                                  */
4433                         },
4434                         .he_mcs_nss_supp = {
4435                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4436                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4437                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4438                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4439                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4440                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4441                         },
4442                 },
4443                 .eht_cap = {
4444                         .has_eht = true,
4445                         .eht_cap_elem = {
4446                                 .mac_cap_info[0] =
4447                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4448                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4449                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4450                                 .phy_cap_info[0] =
4451                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4452                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4453                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4454                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4455                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4456                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4457                                 .phy_cap_info[1] =
4458                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4459                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4460                                 .phy_cap_info[2] =
4461                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4462                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4463                                 .phy_cap_info[3] =
4464                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4465                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4466                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4467                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4468                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4469                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4470                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4471                                 .phy_cap_info[4] =
4472                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4473                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4474                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4475                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4476                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4477                                 .phy_cap_info[5] =
4478                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4479                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4480                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4481                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4482                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4483                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4484                                 .phy_cap_info[6] =
4485                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4486                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4487                                 .phy_cap_info[7] =
4488                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4489                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4490                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4491                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4492                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4493                         },
4494
4495                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4496                          * Rx
4497                          */
4498                         .eht_mcs_nss_supp = {
4499                                 /*
4500                                  * As B1 and B2 are set in the supported
4501                                  * channel width set field in the HE PHY
4502                                  * capabilities information field include all
4503                                  * the following MCS/NSS.
4504                                  */
4505                                 .bw._80 = {
4506                                         .rx_tx_mcs9_max_nss = 0x88,
4507                                         .rx_tx_mcs11_max_nss = 0x88,
4508                                         .rx_tx_mcs13_max_nss = 0x88,
4509                                 },
4510                                 .bw._160 = {
4511                                         .rx_tx_mcs9_max_nss = 0x88,
4512                                         .rx_tx_mcs11_max_nss = 0x88,
4513                                         .rx_tx_mcs13_max_nss = 0x88,
4514                                 },
4515                         },
4516                         /* PPE threshold information is not supported */
4517                 },
4518         },
4519         {
4520                 .types_mask = BIT(NL80211_IFTYPE_AP) |
4521                               BIT(NL80211_IFTYPE_P2P_GO),
4522                 .he_cap = {
4523                         .has_he = true,
4524                         .he_cap_elem = {
4525                                 .mac_cap_info[0] =
4526                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4527                                 .mac_cap_info[1] =
4528                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4529                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4530                                 .mac_cap_info[2] =
4531                                         IEEE80211_HE_MAC_CAP2_BSR |
4532                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4533                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4534                                 .mac_cap_info[3] =
4535                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4536                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4537                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4538                                 .phy_cap_info[0] =
4539                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4540                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4541                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4542                                 .phy_cap_info[1] =
4543                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4544                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4545                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4546                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4547                                 .phy_cap_info[2] =
4548                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4549                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4550                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4551                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4552                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4553
4554                                 /* Leave all the other PHY capability bytes
4555                                  * unset, as DCM, beam forming, RU and PPE
4556                                  * threshold information are not supported
4557                                  */
4558                         },
4559                         .he_mcs_nss_supp = {
4560                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4561                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4562                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4563                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4564                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4565                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4566                         },
4567                 },
4568                 .eht_cap = {
4569                         .has_eht = true,
4570                         .eht_cap_elem = {
4571                                 .mac_cap_info[0] =
4572                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4573                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4574                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4575                                 .phy_cap_info[0] =
4576                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4577                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4578                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4579                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4580                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4581                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4582                                 .phy_cap_info[1] =
4583                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4584                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4585                                 .phy_cap_info[2] =
4586                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4587                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4588                                 .phy_cap_info[3] =
4589                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4590                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4591                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4592                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4593                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4594                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4595                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4596                                 .phy_cap_info[4] =
4597                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4598                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4599                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4600                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4601                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4602                                 .phy_cap_info[5] =
4603                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4604                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4605                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4606                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4607                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4608                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4609                                 .phy_cap_info[6] =
4610                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4611                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4612                                 .phy_cap_info[7] =
4613                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4614                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4615                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4616                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4617                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4618                         },
4619
4620                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4621                          * Rx
4622                          */
4623                         .eht_mcs_nss_supp = {
4624                                 /*
4625                                  * As B1 and B2 are set in the supported
4626                                  * channel width set field in the HE PHY
4627                                  * capabilities information field include all
4628                                  * the following MCS/NSS.
4629                                  */
4630                                 .bw._80 = {
4631                                         .rx_tx_mcs9_max_nss = 0x88,
4632                                         .rx_tx_mcs11_max_nss = 0x88,
4633                                         .rx_tx_mcs13_max_nss = 0x88,
4634                                 },
4635                                 .bw._160 = {
4636                                         .rx_tx_mcs9_max_nss = 0x88,
4637                                         .rx_tx_mcs11_max_nss = 0x88,
4638                                         .rx_tx_mcs13_max_nss = 0x88,
4639                                 },
4640                         },
4641                         /* PPE threshold information is not supported */
4642                 },
4643         },
4644 #ifdef CONFIG_MAC80211_MESH
4645         {
4646                 /* TODO: should we support other types, e.g., IBSS?*/
4647                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4648                 .he_cap = {
4649                         .has_he = true,
4650                         .he_cap_elem = {
4651                                 .mac_cap_info[0] =
4652                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4653                                 .mac_cap_info[1] =
4654                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4655                                 .mac_cap_info[2] =
4656                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4657                                 .mac_cap_info[3] =
4658                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4659                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4660                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4661                                 .phy_cap_info[0] =
4662                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4663                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4664                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4665                                 .phy_cap_info[1] =
4666                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4667                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4668                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4669                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4670                                 .phy_cap_info[2] = 0,
4671
4672                                 /* Leave all the other PHY capability bytes
4673                                  * unset, as DCM, beam forming, RU and PPE
4674                                  * threshold information are not supported
4675                                  */
4676                         },
4677                         .he_mcs_nss_supp = {
4678                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4679                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4680                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4681                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4682                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4683                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4684                         },
4685                 },
4686         },
4687 #endif
4688 };
4689
4690 static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
4691         {
4692                 .types_mask = BIT(NL80211_IFTYPE_STATION) |
4693                               BIT(NL80211_IFTYPE_P2P_CLIENT),
4694                 .he_6ghz_capa = {
4695                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4696                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4697                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4698                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4699                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4700                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4701                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4702                 },
4703                 .he_cap = {
4704                         .has_he = true,
4705                         .he_cap_elem = {
4706                                 .mac_cap_info[0] =
4707                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4708                                 .mac_cap_info[1] =
4709                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4710                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4711                                 .mac_cap_info[2] =
4712                                         IEEE80211_HE_MAC_CAP2_BSR |
4713                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4714                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4715                                 .mac_cap_info[3] =
4716                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4717                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4718                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4719                                 .phy_cap_info[0] =
4720                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4721                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4722                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4723                                 .phy_cap_info[1] =
4724                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4725                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4726                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4727                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4728                                 .phy_cap_info[2] =
4729                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4730                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4731                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4732                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4733                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4734
4735                                 /* Leave all the other PHY capability bytes
4736                                  * unset, as DCM, beam forming, RU and PPE
4737                                  * threshold information are not supported
4738                                  */
4739                         },
4740                         .he_mcs_nss_supp = {
4741                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4742                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4743                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4744                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4745                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4746                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4747                         },
4748                 },
4749                 .eht_cap = {
4750                         .has_eht = true,
4751                         .eht_cap_elem = {
4752                                 .mac_cap_info[0] =
4753                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4754                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4755                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4756                                 .phy_cap_info[0] =
4757                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4758                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4759                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4760                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4761                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4762                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4763                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4764                                 .phy_cap_info[1] =
4765                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4766                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4767                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4768                                 .phy_cap_info[2] =
4769                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4770                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4771                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4772                                 .phy_cap_info[3] =
4773                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4774                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4775                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4776                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4777                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4778                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4779                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4780                                 .phy_cap_info[4] =
4781                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4782                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4783                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4784                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4785                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4786                                 .phy_cap_info[5] =
4787                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4788                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4789                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4790                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4791                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4792                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4793                                 .phy_cap_info[6] =
4794                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4795                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4796                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4797                                 .phy_cap_info[7] =
4798                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4799                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4800                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4801                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4802                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4803                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4804                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4805                         },
4806
4807                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4808                          * Rx
4809                          */
4810                         .eht_mcs_nss_supp = {
4811                                 /*
4812                                  * As B1 and B2 are set in the supported
4813                                  * channel width set field in the HE PHY
4814                                  * capabilities information field and 320MHz in
4815                                  * 6GHz is supported include all the following
4816                                  * MCS/NSS.
4817                                  */
4818                                 .bw._80 = {
4819                                         .rx_tx_mcs9_max_nss = 0x88,
4820                                         .rx_tx_mcs11_max_nss = 0x88,
4821                                         .rx_tx_mcs13_max_nss = 0x88,
4822                                 },
4823                                 .bw._160 = {
4824                                         .rx_tx_mcs9_max_nss = 0x88,
4825                                         .rx_tx_mcs11_max_nss = 0x88,
4826                                         .rx_tx_mcs13_max_nss = 0x88,
4827                                 },
4828                                 .bw._320 = {
4829                                         .rx_tx_mcs9_max_nss = 0x88,
4830                                         .rx_tx_mcs11_max_nss = 0x88,
4831                                         .rx_tx_mcs13_max_nss = 0x88,
4832                                 },
4833                         },
4834                         /* PPE threshold information is not supported */
4835                 },
4836         },
4837         {
4838                 .types_mask = BIT(NL80211_IFTYPE_AP) |
4839                               BIT(NL80211_IFTYPE_P2P_GO),
4840                 .he_6ghz_capa = {
4841                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4842                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4843                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4844                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4845                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4846                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4847                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4848                 },
4849                 .he_cap = {
4850                         .has_he = true,
4851                         .he_cap_elem = {
4852                                 .mac_cap_info[0] =
4853                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4854                                 .mac_cap_info[1] =
4855                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4856                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4857                                 .mac_cap_info[2] =
4858                                         IEEE80211_HE_MAC_CAP2_BSR |
4859                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4860                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4861                                 .mac_cap_info[3] =
4862                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4863                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4864                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4865                                 .phy_cap_info[0] =
4866                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4867                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4868                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4869                                 .phy_cap_info[1] =
4870                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4871                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4872                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4873                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4874                                 .phy_cap_info[2] =
4875                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4876                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4877                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4878                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4879                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4880
4881                                 /* Leave all the other PHY capability bytes
4882                                  * unset, as DCM, beam forming, RU and PPE
4883                                  * threshold information are not supported
4884                                  */
4885                         },
4886                         .he_mcs_nss_supp = {
4887                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4888                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4889                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4890                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4891                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4892                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4893                         },
4894                 },
4895                 .eht_cap = {
4896                         .has_eht = true,
4897                         .eht_cap_elem = {
4898                                 .mac_cap_info[0] =
4899                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4900                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4901                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4902                                 .phy_cap_info[0] =
4903                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4904                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4905                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4906                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4907                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4908                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4909                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4910                                 .phy_cap_info[1] =
4911                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4912                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4913                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4914                                 .phy_cap_info[2] =
4915                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4916                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4917                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4918                                 .phy_cap_info[3] =
4919                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4920                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4921                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4922                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4923                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4924                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4925                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4926                                 .phy_cap_info[4] =
4927                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4928                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4929                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4930                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4931                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4932                                 .phy_cap_info[5] =
4933                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4934                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4935                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4936                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4937                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4938                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4939                                 .phy_cap_info[6] =
4940                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4941                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4942                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4943                                 .phy_cap_info[7] =
4944                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4945                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4946                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4947                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4948                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4949                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4950                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4951                         },
4952
4953                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4954                          * Rx
4955                          */
4956                         .eht_mcs_nss_supp = {
4957                                 /*
4958                                  * As B1 and B2 are set in the supported
4959                                  * channel width set field in the HE PHY
4960                                  * capabilities information field and 320MHz in
4961                                  * 6GHz is supported include all the following
4962                                  * MCS/NSS.
4963                                  */
4964                                 .bw._80 = {
4965                                         .rx_tx_mcs9_max_nss = 0x88,
4966                                         .rx_tx_mcs11_max_nss = 0x88,
4967                                         .rx_tx_mcs13_max_nss = 0x88,
4968                                 },
4969                                 .bw._160 = {
4970                                         .rx_tx_mcs9_max_nss = 0x88,
4971                                         .rx_tx_mcs11_max_nss = 0x88,
4972                                         .rx_tx_mcs13_max_nss = 0x88,
4973                                 },
4974                                 .bw._320 = {
4975                                         .rx_tx_mcs9_max_nss = 0x88,
4976                                         .rx_tx_mcs11_max_nss = 0x88,
4977                                         .rx_tx_mcs13_max_nss = 0x88,
4978                                 },
4979                         },
4980                         /* PPE threshold information is not supported */
4981                 },
4982         },
4983 #ifdef CONFIG_MAC80211_MESH
4984         {
4985                 /* TODO: should we support other types, e.g., IBSS?*/
4986                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4987                 .he_6ghz_capa = {
4988                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4989                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4990                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4991                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4992                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4993                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4994                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4995                 },
4996                 .he_cap = {
4997                         .has_he = true,
4998                         .he_cap_elem = {
4999                                 .mac_cap_info[0] =
5000                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
5001                                 .mac_cap_info[1] =
5002                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5003                                 .mac_cap_info[2] =
5004                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
5005                                 .mac_cap_info[3] =
5006                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5007                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5008                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5009                                 .phy_cap_info[0] =
5010                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5011                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5012                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5013                                 .phy_cap_info[1] =
5014                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5015                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5016                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5017                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5018                                 .phy_cap_info[2] = 0,
5019
5020                                 /* Leave all the other PHY capability bytes
5021                                  * unset, as DCM, beam forming, RU and PPE
5022                                  * threshold information are not supported
5023                                  */
5024                         },
5025                         .he_mcs_nss_supp = {
5026                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
5027                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
5028                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
5029                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
5030                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
5031                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
5032                         },
5033                 },
5034         },
5035 #endif
5036 };
5037
5038 static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
5039 {
5040         switch (sband->band) {
5041         case NL80211_BAND_2GHZ:
5042                 ieee80211_set_sband_iftype_data(sband, sband_capa_2ghz);
5043                 break;
5044         case NL80211_BAND_5GHZ:
5045                 ieee80211_set_sband_iftype_data(sband, sband_capa_5ghz);
5046                 break;
5047         case NL80211_BAND_6GHZ:
5048                 ieee80211_set_sband_iftype_data(sband, sband_capa_6ghz);
5049                 break;
5050         default:
5051                 break;
5052         }
5053 }
5054
5055 #ifdef CONFIG_MAC80211_MESH
5056 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
5057 #else
5058 #define HWSIM_MESH_BIT 0
5059 #endif
5060
5061 #define HWSIM_DEFAULT_IF_LIMIT \
5062         (BIT(NL80211_IFTYPE_STATION) | \
5063          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
5064          BIT(NL80211_IFTYPE_AP) | \
5065          BIT(NL80211_IFTYPE_P2P_GO) | \
5066          HWSIM_MESH_BIT)
5067
5068 #define HWSIM_IFTYPE_SUPPORT_MASK \
5069         (BIT(NL80211_IFTYPE_STATION) | \
5070          BIT(NL80211_IFTYPE_AP) | \
5071          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
5072          BIT(NL80211_IFTYPE_P2P_GO) | \
5073          BIT(NL80211_IFTYPE_ADHOC) | \
5074          BIT(NL80211_IFTYPE_MESH_POINT) | \
5075          BIT(NL80211_IFTYPE_OCB))
5076
5077 static const u8 iftypes_ext_capa_ap[] = {
5078          [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
5079          [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
5080          [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF |
5081                WLAN_EXT_CAPA8_MAX_MSDU_IN_AMSDU_LSB,
5082          [8] = WLAN_EXT_CAPA9_MAX_MSDU_IN_AMSDU_MSB,
5083          [9] = WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT,
5084 };
5085
5086 #define MAC80211_HWSIM_MLD_CAPA_OPS                             \
5087         FIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP, \
5088                          IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP_SAME) | \
5089         FIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS, \
5090                          IEEE80211_MLD_MAX_NUM_LINKS - 1)
5091
5092 static const struct wiphy_iftype_ext_capab mac80211_hwsim_iftypes_ext_capa[] = {
5093         {
5094                 .iftype = NL80211_IFTYPE_AP,
5095                 .extended_capabilities = iftypes_ext_capa_ap,
5096                 .extended_capabilities_mask = iftypes_ext_capa_ap,
5097                 .extended_capabilities_len = sizeof(iftypes_ext_capa_ap),
5098                 .eml_capabilities = IEEE80211_EML_CAP_EMLSR_SUPP |
5099                                     IEEE80211_EML_CAP_EMLMR_SUPPORT,
5100                 .mld_capa_and_ops = MAC80211_HWSIM_MLD_CAPA_OPS,
5101         },
5102 };
5103
5104 static int mac80211_hwsim_new_radio(struct genl_info *info,
5105                                     struct hwsim_new_radio_params *param)
5106 {
5107         int err;
5108         u8 addr[ETH_ALEN];
5109         struct mac80211_hwsim_data *data;
5110         struct ieee80211_hw *hw;
5111         enum nl80211_band band;
5112         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
5113         struct net *net;
5114         int idx, i;
5115         int n_limits = 0;
5116
5117         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
5118                 return -EINVAL;
5119
5120         spin_lock_bh(&hwsim_radio_lock);
5121         idx = hwsim_radio_idx++;
5122         spin_unlock_bh(&hwsim_radio_lock);
5123
5124         if (param->mlo)
5125                 ops = &mac80211_hwsim_mlo_ops;
5126         else if (param->use_chanctx)
5127                 ops = &mac80211_hwsim_mchan_ops;
5128         hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
5129         if (!hw) {
5130                 pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
5131                 err = -ENOMEM;
5132                 goto failed;
5133         }
5134
5135         /* ieee80211_alloc_hw_nm may have used a default name */
5136         param->hwname = wiphy_name(hw->wiphy);
5137
5138         if (info)
5139                 net = genl_info_net(info);
5140         else
5141                 net = &init_net;
5142         wiphy_net_set(hw->wiphy, net);
5143
5144         data = hw->priv;
5145         data->hw = hw;
5146
5147         data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
5148         if (IS_ERR(data->dev)) {
5149                 printk(KERN_DEBUG
5150                        "mac80211_hwsim: device_create failed (%ld)\n",
5151                        PTR_ERR(data->dev));
5152                 err = -ENOMEM;
5153                 goto failed_drvdata;
5154         }
5155         data->dev->driver = &mac80211_hwsim_driver.driver;
5156         err = device_bind_driver(data->dev);
5157         if (err != 0) {
5158                 pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
5159                        err);
5160                 goto failed_bind;
5161         }
5162
5163         skb_queue_head_init(&data->pending);
5164
5165         SET_IEEE80211_DEV(hw, data->dev);
5166         if (!param->perm_addr) {
5167                 eth_zero_addr(addr);
5168                 addr[0] = 0x02;
5169                 addr[3] = idx >> 8;
5170                 addr[4] = idx;
5171                 memcpy(data->addresses[0].addr, addr, ETH_ALEN);
5172                 /* Why need here second address ? */
5173                 memcpy(data->addresses[1].addr, addr, ETH_ALEN);
5174                 data->addresses[1].addr[0] |= 0x40;
5175                 hw->wiphy->n_addresses = 2;
5176                 hw->wiphy->addresses = data->addresses;
5177                 /* possible address clash is checked at hash table insertion */
5178         } else {
5179                 memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
5180                 /* compatibility with automatically generated mac addr */
5181                 memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
5182                 hw->wiphy->n_addresses = 2;
5183                 hw->wiphy->addresses = data->addresses;
5184         }
5185
5186         data->channels = param->channels;
5187         data->use_chanctx = param->use_chanctx;
5188         data->idx = idx;
5189         data->destroy_on_close = param->destroy_on_close;
5190         if (info)
5191                 data->portid = info->snd_portid;
5192
5193         /* setup interface limits, only on interface types we support */
5194         if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
5195                 data->if_limits[n_limits].max = 1;
5196                 data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
5197                 n_limits++;
5198         }
5199
5200         if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
5201                 data->if_limits[n_limits].max = 2048;
5202                 /*
5203                  * For this case, we may only support a subset of
5204                  * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
5205                  * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
5206                  */
5207                 data->if_limits[n_limits].types =
5208                                         HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
5209                 n_limits++;
5210         }
5211
5212         if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5213                 data->if_limits[n_limits].max = 1;
5214                 data->if_limits[n_limits].types =
5215                                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
5216                 n_limits++;
5217         }
5218
5219         if (data->use_chanctx) {
5220                 hw->wiphy->max_scan_ssids = 255;
5221                 hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
5222                 hw->wiphy->max_remain_on_channel_duration = 1000;
5223                 data->if_combination.radar_detect_widths = 0;
5224                 data->if_combination.num_different_channels = data->channels;
5225         } else {
5226                 data->if_combination.num_different_channels = 1;
5227                 data->if_combination.radar_detect_widths =
5228                                         BIT(NL80211_CHAN_WIDTH_5) |
5229                                         BIT(NL80211_CHAN_WIDTH_10) |
5230                                         BIT(NL80211_CHAN_WIDTH_20_NOHT) |
5231                                         BIT(NL80211_CHAN_WIDTH_20) |
5232                                         BIT(NL80211_CHAN_WIDTH_40) |
5233                                         BIT(NL80211_CHAN_WIDTH_80) |
5234                                         BIT(NL80211_CHAN_WIDTH_160);
5235         }
5236
5237         if (!n_limits) {
5238                 err = -EINVAL;
5239                 goto failed_hw;
5240         }
5241
5242         data->if_combination.max_interfaces = 0;
5243         for (i = 0; i < n_limits; i++)
5244                 data->if_combination.max_interfaces +=
5245                         data->if_limits[i].max;
5246
5247         data->if_combination.n_limits = n_limits;
5248         data->if_combination.limits = data->if_limits;
5249
5250         /*
5251          * If we actually were asked to support combinations,
5252          * advertise them - if there's only a single thing like
5253          * only IBSS then don't advertise it as combinations.
5254          */
5255         if (data->if_combination.max_interfaces > 1) {
5256                 hw->wiphy->iface_combinations = &data->if_combination;
5257                 hw->wiphy->n_iface_combinations = 1;
5258         }
5259
5260         if (param->ciphers) {
5261                 memcpy(data->ciphers, param->ciphers,
5262                        param->n_ciphers * sizeof(u32));
5263                 hw->wiphy->cipher_suites = data->ciphers;
5264                 hw->wiphy->n_cipher_suites = param->n_ciphers;
5265         }
5266
5267         hw->wiphy->mbssid_max_interfaces = 8;
5268         hw->wiphy->ema_max_profile_periodicity = 3;
5269
5270         data->rx_rssi = DEFAULT_RX_RSSI;
5271
5272         INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
5273         INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
5274         INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
5275
5276         hw->queues = 5;
5277         hw->offchannel_tx_hw_queue = 4;
5278
5279         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
5280         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
5281         ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
5282         ieee80211_hw_set(hw, QUEUE_CONTROL);
5283         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
5284         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
5285         ieee80211_hw_set(hw, MFP_CAPABLE);
5286         ieee80211_hw_set(hw, SIGNAL_DBM);
5287         ieee80211_hw_set(hw, SUPPORTS_PS);
5288         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
5289         ieee80211_hw_set(hw, TDLS_WIDER_BW);
5290         ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
5291
5292         if (param->mlo) {
5293                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
5294                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
5295                 ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
5296                 ieee80211_hw_set(hw, CONNECTION_MONITOR);
5297                 ieee80211_hw_set(hw, AP_LINK_PS);
5298
5299                 hw->wiphy->iftype_ext_capab = mac80211_hwsim_iftypes_ext_capa;
5300                 hw->wiphy->num_iftype_ext_capab =
5301                         ARRAY_SIZE(mac80211_hwsim_iftypes_ext_capa);
5302         } else {
5303                 ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
5304                 ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
5305                 if (rctbl)
5306                         ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
5307         }
5308
5309         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
5310         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
5311                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
5312                             WIPHY_FLAG_AP_UAPSD |
5313                             WIPHY_FLAG_SUPPORTS_5_10_MHZ |
5314                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
5315         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
5316                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
5317                                NL80211_FEATURE_STATIC_SMPS |
5318                                NL80211_FEATURE_DYNAMIC_SMPS |
5319                                NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
5320         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
5321         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
5322         wiphy_ext_feature_set(hw->wiphy,
5323                               NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
5324         wiphy_ext_feature_set(hw->wiphy,
5325                               NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
5326         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
5327
5328         wiphy_ext_feature_set(hw->wiphy,
5329                               NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT);
5330         wiphy_ext_feature_set(hw->wiphy,
5331                               NL80211_EXT_FEATURE_BSS_COLOR);
5332
5333         hw->wiphy->interface_modes = param->iftypes;
5334
5335         /* ask mac80211 to reserve space for magic */
5336         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
5337         hw->sta_data_size = sizeof(struct hwsim_sta_priv);
5338         hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
5339
5340         memcpy(data->channels_2ghz, hwsim_channels_2ghz,
5341                 sizeof(hwsim_channels_2ghz));
5342         memcpy(data->channels_5ghz, hwsim_channels_5ghz,
5343                 sizeof(hwsim_channels_5ghz));
5344         memcpy(data->channels_6ghz, hwsim_channels_6ghz,
5345                 sizeof(hwsim_channels_6ghz));
5346         memcpy(data->channels_s1g, hwsim_channels_s1g,
5347                sizeof(hwsim_channels_s1g));
5348         memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
5349
5350         for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
5351                 struct ieee80211_supported_band *sband = &data->bands[band];
5352
5353                 sband->band = band;
5354
5355                 switch (band) {
5356                 case NL80211_BAND_2GHZ:
5357                         sband->channels = data->channels_2ghz;
5358                         sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
5359                         sband->bitrates = data->rates;
5360                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
5361                         break;
5362                 case NL80211_BAND_5GHZ:
5363                         sband->channels = data->channels_5ghz;
5364                         sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
5365                         sband->bitrates = data->rates + 4;
5366                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5367
5368                         sband->vht_cap.vht_supported = true;
5369                         sband->vht_cap.cap =
5370                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
5371                                 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
5372                                 IEEE80211_VHT_CAP_RXLDPC |
5373                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
5374                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
5375                                 IEEE80211_VHT_CAP_TXSTBC |
5376                                 IEEE80211_VHT_CAP_RXSTBC_4 |
5377                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
5378                         sband->vht_cap.vht_mcs.rx_mcs_map =
5379                                 cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
5380                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
5381                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
5382                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
5383                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
5384                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
5385                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
5386                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
5387                         sband->vht_cap.vht_mcs.tx_mcs_map =
5388                                 sband->vht_cap.vht_mcs.rx_mcs_map;
5389                         break;
5390                 case NL80211_BAND_6GHZ:
5391                         sband->channels = data->channels_6ghz;
5392                         sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
5393                         sband->bitrates = data->rates + 4;
5394                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5395                         break;
5396                 case NL80211_BAND_S1GHZ:
5397                         memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
5398                                sizeof(sband->s1g_cap));
5399                         sband->channels = data->channels_s1g;
5400                         sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
5401                         break;
5402                 default:
5403                         continue;
5404                 }
5405
5406                 if (band != NL80211_BAND_6GHZ){
5407                         sband->ht_cap.ht_supported = true;
5408                         sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
5409                                             IEEE80211_HT_CAP_GRN_FLD |
5410                                             IEEE80211_HT_CAP_SGI_20 |
5411                                             IEEE80211_HT_CAP_SGI_40 |
5412                                             IEEE80211_HT_CAP_DSSSCCK40;
5413                         sband->ht_cap.ampdu_factor = 0x3;
5414                         sband->ht_cap.ampdu_density = 0x6;
5415                         memset(&sband->ht_cap.mcs, 0,
5416                                sizeof(sband->ht_cap.mcs));
5417                         sband->ht_cap.mcs.rx_mask[0] = 0xff;
5418                         sband->ht_cap.mcs.rx_mask[1] = 0xff;
5419                         sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5420                 }
5421
5422                 mac80211_hwsim_sband_capab(sband);
5423
5424                 hw->wiphy->bands[band] = sband;
5425         }
5426
5427         /* By default all radios belong to the first group */
5428         data->group = 1;
5429         mutex_init(&data->mutex);
5430
5431         data->netgroup = hwsim_net_get_netgroup(net);
5432         data->wmediumd = hwsim_net_get_wmediumd(net);
5433
5434         /* Enable frame retransmissions for lossy channels */
5435         hw->max_rates = 4;
5436         hw->max_rate_tries = 11;
5437
5438         hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
5439         hw->wiphy->n_vendor_commands =
5440                 ARRAY_SIZE(mac80211_hwsim_vendor_commands);
5441         hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
5442         hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
5443
5444         if (param->reg_strict)
5445                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
5446         if (param->regd) {
5447                 data->regd = param->regd;
5448                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
5449                 wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
5450                 /* give the regulatory workqueue a chance to run */
5451                 schedule_timeout_interruptible(1);
5452         }
5453
5454         wiphy_ext_feature_set(hw->wiphy,
5455                               NL80211_EXT_FEATURE_DFS_CONCURRENT);
5456
5457         if (param->no_vif)
5458                 ieee80211_hw_set(hw, NO_AUTO_VIF);
5459
5460         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5461
5462         for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
5463                 hrtimer_init(&data->link_data[i].beacon_timer, CLOCK_MONOTONIC,
5464                              HRTIMER_MODE_ABS_SOFT);
5465                 data->link_data[i].beacon_timer.function =
5466                         mac80211_hwsim_beacon;
5467                 data->link_data[i].link_id = i;
5468         }
5469
5470         err = ieee80211_register_hw(hw);
5471         if (err < 0) {
5472                 pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
5473                        err);
5474                 goto failed_hw;
5475         }
5476
5477         wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
5478
5479         if (param->reg_alpha2) {
5480                 data->alpha2[0] = param->reg_alpha2[0];
5481                 data->alpha2[1] = param->reg_alpha2[1];
5482                 regulatory_hint(hw->wiphy, param->reg_alpha2);
5483         }
5484
5485         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
5486         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
5487         debugfs_create_file("group", 0666, data->debugfs, data,
5488                             &hwsim_fops_group);
5489         debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
5490                             &hwsim_fops_rx_rssi);
5491         if (!data->use_chanctx)
5492                 debugfs_create_file("dfs_simulate_radar", 0222,
5493                                     data->debugfs,
5494                                     data, &hwsim_simulate_radar);
5495
5496         if (param->pmsr_capa) {
5497                 data->pmsr_capa = *param->pmsr_capa;
5498                 hw->wiphy->pmsr_capa = &data->pmsr_capa;
5499         }
5500
5501         spin_lock_bh(&hwsim_radio_lock);
5502         err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
5503                                      hwsim_rht_params);
5504         if (err < 0) {
5505                 if (info) {
5506                         GENL_SET_ERR_MSG(info, "perm addr already present");
5507                         NL_SET_BAD_ATTR(info->extack,
5508                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
5509                 }
5510                 spin_unlock_bh(&hwsim_radio_lock);
5511                 goto failed_final_insert;
5512         }
5513
5514         list_add_tail(&data->list, &hwsim_radios);
5515         hwsim_radios_generation++;
5516         spin_unlock_bh(&hwsim_radio_lock);
5517
5518         hwsim_mcast_new_radio(idx, info, param);
5519
5520         return idx;
5521
5522 failed_final_insert:
5523         debugfs_remove_recursive(data->debugfs);
5524         ieee80211_unregister_hw(data->hw);
5525 failed_hw:
5526         device_release_driver(data->dev);
5527 failed_bind:
5528         device_unregister(data->dev);
5529 failed_drvdata:
5530         ieee80211_free_hw(hw);
5531 failed:
5532         return err;
5533 }
5534
5535 static void hwsim_mcast_del_radio(int id, const char *hwname,
5536                                   struct genl_info *info)
5537 {
5538         struct sk_buff *skb;
5539         void *data;
5540         int ret;
5541
5542         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
5543         if (!skb)
5544                 return;
5545
5546         data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
5547                            HWSIM_CMD_DEL_RADIO);
5548         if (!data)
5549                 goto error;
5550
5551         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
5552         if (ret < 0)
5553                 goto error;
5554
5555         ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
5556                       hwname);
5557         if (ret < 0)
5558                 goto error;
5559
5560         genlmsg_end(skb, data);
5561
5562         hwsim_mcast_config_msg(skb, info);
5563
5564         return;
5565
5566 error:
5567         nlmsg_free(skb);
5568 }
5569
5570 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
5571                                      const char *hwname,
5572                                      struct genl_info *info)
5573 {
5574         hwsim_mcast_del_radio(data->idx, hwname, info);
5575         debugfs_remove_recursive(data->debugfs);
5576         ieee80211_unregister_hw(data->hw);
5577         device_release_driver(data->dev);
5578         device_unregister(data->dev);
5579         ieee80211_free_hw(data->hw);
5580 }
5581
5582 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
5583                                     struct mac80211_hwsim_data *data,
5584                                     u32 portid, u32 seq,
5585                                     struct netlink_callback *cb, int flags)
5586 {
5587         void *hdr;
5588         struct hwsim_new_radio_params param = { };
5589         int res = -EMSGSIZE;
5590
5591         hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
5592                           HWSIM_CMD_GET_RADIO);
5593         if (!hdr)
5594                 return -EMSGSIZE;
5595
5596         if (cb)
5597                 genl_dump_check_consistent(cb, hdr);
5598
5599         if (data->alpha2[0] && data->alpha2[1])
5600                 param.reg_alpha2 = data->alpha2;
5601
5602         param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
5603                                         REGULATORY_STRICT_REG);
5604         param.p2p_device = !!(data->hw->wiphy->interface_modes &
5605                                         BIT(NL80211_IFTYPE_P2P_DEVICE));
5606         param.use_chanctx = data->use_chanctx;
5607         param.regd = data->regd;
5608         param.channels = data->channels;
5609         param.hwname = wiphy_name(data->hw->wiphy);
5610         param.pmsr_capa = &data->pmsr_capa;
5611
5612         res = append_radio_msg(skb, data->idx, &param);
5613         if (res < 0)
5614                 goto out_err;
5615
5616         genlmsg_end(skb, hdr);
5617         return 0;
5618
5619 out_err:
5620         genlmsg_cancel(skb, hdr);
5621         return res;
5622 }
5623
5624 static void mac80211_hwsim_free(void)
5625 {
5626         struct mac80211_hwsim_data *data;
5627
5628         spin_lock_bh(&hwsim_radio_lock);
5629         while ((data = list_first_entry_or_null(&hwsim_radios,
5630                                                 struct mac80211_hwsim_data,
5631                                                 list))) {
5632                 list_del(&data->list);
5633                 spin_unlock_bh(&hwsim_radio_lock);
5634                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
5635                                          NULL);
5636                 spin_lock_bh(&hwsim_radio_lock);
5637         }
5638         spin_unlock_bh(&hwsim_radio_lock);
5639         class_destroy(hwsim_class);
5640 }
5641
5642 static const struct net_device_ops hwsim_netdev_ops = {
5643         .ndo_start_xmit         = hwsim_mon_xmit,
5644         .ndo_set_mac_address    = eth_mac_addr,
5645         .ndo_validate_addr      = eth_validate_addr,
5646 };
5647
5648 static void hwsim_mon_setup(struct net_device *dev)
5649 {
5650         u8 addr[ETH_ALEN];
5651
5652         dev->netdev_ops = &hwsim_netdev_ops;
5653         dev->needs_free_netdev = true;
5654         ether_setup(dev);
5655         dev->priv_flags |= IFF_NO_QUEUE;
5656         dev->type = ARPHRD_IEEE80211_RADIOTAP;
5657         eth_zero_addr(addr);
5658         addr[0] = 0x12;
5659         eth_hw_addr_set(dev, addr);
5660 }
5661
5662 static void hwsim_register_wmediumd(struct net *net, u32 portid)
5663 {
5664         struct mac80211_hwsim_data *data;
5665
5666         hwsim_net_set_wmediumd(net, portid);
5667
5668         spin_lock_bh(&hwsim_radio_lock);
5669         list_for_each_entry(data, &hwsim_radios, list) {
5670                 if (data->netgroup == hwsim_net_get_netgroup(net))
5671                         data->wmediumd = portid;
5672         }
5673         spin_unlock_bh(&hwsim_radio_lock);
5674 }
5675
5676 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
5677                                            struct genl_info *info)
5678 {
5679
5680         struct ieee80211_hdr *hdr;
5681         struct mac80211_hwsim_data *data2;
5682         struct ieee80211_tx_info *txi;
5683         struct hwsim_tx_rate *tx_attempts;
5684         u64 ret_skb_cookie;
5685         struct sk_buff *skb, *tmp;
5686         const u8 *src;
5687         unsigned int hwsim_flags;
5688         int i;
5689         unsigned long flags;
5690         bool found = false;
5691
5692         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
5693             !info->attrs[HWSIM_ATTR_FLAGS] ||
5694             !info->attrs[HWSIM_ATTR_COOKIE] ||
5695             !info->attrs[HWSIM_ATTR_SIGNAL] ||
5696             !info->attrs[HWSIM_ATTR_TX_INFO])
5697                 goto out;
5698
5699         src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
5700         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
5701         ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
5702
5703         data2 = get_hwsim_data_ref_from_addr(src);
5704         if (!data2)
5705                 goto out;
5706
5707         if (!hwsim_virtio_enabled) {
5708                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
5709                     data2->netgroup)
5710                         goto out;
5711
5712                 if (info->snd_portid != data2->wmediumd)
5713                         goto out;
5714         }
5715
5716         /* look for the skb matching the cookie passed back from user */
5717         spin_lock_irqsave(&data2->pending.lock, flags);
5718         skb_queue_walk_safe(&data2->pending, skb, tmp) {
5719                 uintptr_t skb_cookie;
5720
5721                 txi = IEEE80211_SKB_CB(skb);
5722                 skb_cookie = (uintptr_t)txi->rate_driver_data[0];
5723
5724                 if (skb_cookie == ret_skb_cookie) {
5725                         __skb_unlink(skb, &data2->pending);
5726                         found = true;
5727                         break;
5728                 }
5729         }
5730         spin_unlock_irqrestore(&data2->pending.lock, flags);
5731
5732         /* not found */
5733         if (!found)
5734                 goto out;
5735
5736         /* Tx info received because the frame was broadcasted on user space,
5737          so we get all the necessary info: tx attempts and skb control buff */
5738
5739         tx_attempts = (struct hwsim_tx_rate *)nla_data(
5740                        info->attrs[HWSIM_ATTR_TX_INFO]);
5741
5742         /* now send back TX status */
5743         txi = IEEE80211_SKB_CB(skb);
5744
5745         ieee80211_tx_info_clear_status(txi);
5746
5747         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
5748                 txi->status.rates[i].idx = tx_attempts[i].idx;
5749                 txi->status.rates[i].count = tx_attempts[i].count;
5750         }
5751
5752         txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
5753
5754         if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
5755            (hwsim_flags & HWSIM_TX_STAT_ACK)) {
5756                 if (skb->len >= 16) {
5757                         hdr = (struct ieee80211_hdr *) skb->data;
5758                         mac80211_hwsim_monitor_ack(data2->channel,
5759                                                    hdr->addr2);
5760                 }
5761                 txi->flags |= IEEE80211_TX_STAT_ACK;
5762         }
5763
5764         if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
5765                 txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
5766
5767         ieee80211_tx_status_irqsafe(data2->hw, skb);
5768         return 0;
5769 out:
5770         return -EINVAL;
5771
5772 }
5773
5774 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
5775                                           struct genl_info *info)
5776 {
5777         struct mac80211_hwsim_data *data2;
5778         struct ieee80211_rx_status rx_status;
5779         struct ieee80211_hdr *hdr;
5780         const u8 *dst;
5781         int frame_data_len;
5782         void *frame_data;
5783         struct sk_buff *skb = NULL;
5784         struct ieee80211_channel *channel = NULL;
5785
5786         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
5787             !info->attrs[HWSIM_ATTR_FRAME] ||
5788             !info->attrs[HWSIM_ATTR_RX_RATE] ||
5789             !info->attrs[HWSIM_ATTR_SIGNAL])
5790                 goto out;
5791
5792         dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
5793         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
5794         frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
5795
5796         if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
5797             frame_data_len > IEEE80211_MAX_DATA_LEN)
5798                 goto err;
5799
5800         /* Allocate new skb here */
5801         skb = alloc_skb(frame_data_len, GFP_KERNEL);
5802         if (skb == NULL)
5803                 goto err;
5804
5805         /* Copy the data */
5806         skb_put_data(skb, frame_data, frame_data_len);
5807
5808         data2 = get_hwsim_data_ref_from_addr(dst);
5809         if (!data2)
5810                 goto out;
5811
5812         if (data2->use_chanctx) {
5813                 if (data2->tmp_chan)
5814                         channel = data2->tmp_chan;
5815         } else {
5816                 channel = data2->channel;
5817         }
5818
5819         if (!hwsim_virtio_enabled) {
5820                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
5821                     data2->netgroup)
5822                         goto out;
5823
5824                 if (info->snd_portid != data2->wmediumd)
5825                         goto out;
5826         }
5827
5828         /* check if radio is configured properly */
5829
5830         if ((data2->idle && !data2->tmp_chan) || !data2->started)
5831                 goto out;
5832
5833         /* A frame is received from user space */
5834         memset(&rx_status, 0, sizeof(rx_status));
5835         if (info->attrs[HWSIM_ATTR_FREQ]) {
5836                 struct tx_iter_data iter_data = {};
5837
5838                 /* throw away off-channel packets, but allow both the temporary
5839                  * ("hw" scan/remain-on-channel), regular channels and links,
5840                  * since the internal datapath also allows this
5841                  */
5842                 rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
5843
5844                 iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
5845                                                           rx_status.freq);
5846                 if (!iter_data.channel)
5847                         goto out;
5848                 rx_status.band = iter_data.channel->band;
5849
5850                 mutex_lock(&data2->mutex);
5851                 if (!hwsim_chans_compat(iter_data.channel, channel)) {
5852                         ieee80211_iterate_active_interfaces_atomic(
5853                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
5854                                 mac80211_hwsim_tx_iter, &iter_data);
5855                         if (!iter_data.receive) {
5856                                 mutex_unlock(&data2->mutex);
5857                                 goto out;
5858                         }
5859                 }
5860                 mutex_unlock(&data2->mutex);
5861         } else if (!channel) {
5862                 goto out;
5863         } else {
5864                 rx_status.freq = channel->center_freq;
5865                 rx_status.band = channel->band;
5866         }
5867
5868         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
5869         if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
5870                 goto out;
5871         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
5872
5873         hdr = (void *)skb->data;
5874
5875         if (ieee80211_is_beacon(hdr->frame_control) ||
5876             ieee80211_is_probe_resp(hdr->frame_control))
5877                 rx_status.boottime_ns = ktime_get_boottime_ns();
5878
5879         mac80211_hwsim_rx(data2, &rx_status, skb);
5880
5881         return 0;
5882 err:
5883         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
5884 out:
5885         dev_kfree_skb(skb);
5886         return -EINVAL;
5887 }
5888
5889 static int hwsim_register_received_nl(struct sk_buff *skb_2,
5890                                       struct genl_info *info)
5891 {
5892         struct net *net = genl_info_net(info);
5893         struct mac80211_hwsim_data *data;
5894         int chans = 1;
5895
5896         spin_lock_bh(&hwsim_radio_lock);
5897         list_for_each_entry(data, &hwsim_radios, list)
5898                 chans = max(chans, data->channels);
5899         spin_unlock_bh(&hwsim_radio_lock);
5900
5901         /* In the future we should revise the userspace API and allow it
5902          * to set a flag that it does support multi-channel, then we can
5903          * let this pass conditionally on the flag.
5904          * For current userspace, prohibit it since it won't work right.
5905          */
5906         if (chans > 1)
5907                 return -EOPNOTSUPP;
5908
5909         if (hwsim_net_get_wmediumd(net))
5910                 return -EBUSY;
5911
5912         hwsim_register_wmediumd(net, info->snd_portid);
5913
5914         pr_debug("mac80211_hwsim: received a REGISTER, "
5915                "switching to wmediumd mode with pid %d\n", info->snd_portid);
5916
5917         return 0;
5918 }
5919
5920 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
5921 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
5922 {
5923         int i;
5924
5925         for (i = 0; i < n_ciphers; i++) {
5926                 int j;
5927                 int found = 0;
5928
5929                 for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
5930                         if (ciphers[i] == hwsim_ciphers[j]) {
5931                                 found = 1;
5932                                 break;
5933                         }
5934                 }
5935
5936                 if (!found)
5937                         return false;
5938         }
5939
5940         return true;
5941 }
5942
5943 static int parse_ftm_capa(const struct nlattr *ftm_capa, struct cfg80211_pmsr_capabilities *out,
5944                           struct genl_info *info)
5945 {
5946         struct nlattr *tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
5947         int ret;
5948
5949         ret = nla_parse_nested(tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX, ftm_capa, hwsim_ftm_capa_policy,
5950                                NULL);
5951         if (ret) {
5952                 NL_SET_ERR_MSG_ATTR(info->extack, ftm_capa, "malformed FTM capability");
5953                 return -EINVAL;
5954         }
5955
5956         out->ftm.supported = 1;
5957         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES])
5958                 out->ftm.preambles = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]);
5959         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS])
5960                 out->ftm.bandwidths = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]);
5961         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT])
5962                 out->ftm.max_bursts_exponent =
5963                         nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT]);
5964         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST])
5965                 out->ftm.max_ftms_per_burst =
5966                         nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST]);
5967         out->ftm.asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_ASAP];
5968         out->ftm.non_asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP];
5969         out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI];
5970         out->ftm.request_civicloc = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC];
5971         out->ftm.trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED];
5972         out->ftm.non_trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED];
5973
5974         return 0;
5975 }
5976
5977 static int parse_pmsr_capa(const struct nlattr *pmsr_capa, struct cfg80211_pmsr_capabilities *out,
5978                            struct genl_info *info)
5979 {
5980         struct nlattr *tb[NL80211_PMSR_ATTR_MAX + 1];
5981         struct nlattr *nla;
5982         int size;
5983         int ret;
5984
5985         ret = nla_parse_nested(tb, NL80211_PMSR_ATTR_MAX, pmsr_capa, hwsim_pmsr_capa_policy, NULL);
5986         if (ret) {
5987                 NL_SET_ERR_MSG_ATTR(info->extack, pmsr_capa, "malformed PMSR capability");
5988                 return -EINVAL;
5989         }
5990
5991         if (tb[NL80211_PMSR_ATTR_MAX_PEERS])
5992                 out->max_peers = nla_get_u32(tb[NL80211_PMSR_ATTR_MAX_PEERS]);
5993         out->report_ap_tsf = !!tb[NL80211_PMSR_ATTR_REPORT_AP_TSF];
5994         out->randomize_mac_addr = !!tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR];
5995
5996         if (!tb[NL80211_PMSR_ATTR_TYPE_CAPA]) {
5997                 NL_SET_ERR_MSG_ATTR(info->extack, tb[NL80211_PMSR_ATTR_TYPE_CAPA],
5998                                     "malformed PMSR type");
5999                 return -EINVAL;
6000         }
6001
6002         nla_for_each_nested(nla, tb[NL80211_PMSR_ATTR_TYPE_CAPA], size) {
6003                 switch (nla_type(nla)) {
6004                 case NL80211_PMSR_TYPE_FTM:
6005                         parse_ftm_capa(nla, out, info);
6006                         break;
6007                 default:
6008                         NL_SET_ERR_MSG_ATTR(info->extack, nla, "unsupported measurement type");
6009                         return -EINVAL;
6010                 }
6011         }
6012
6013         return 0;
6014 }
6015
6016 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
6017 {
6018         struct hwsim_new_radio_params param = { 0 };
6019         const char *hwname = NULL;
6020         int ret;
6021
6022         param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
6023         param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
6024         param.channels = channels;
6025         param.destroy_on_close =
6026                 info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
6027
6028         if (info->attrs[HWSIM_ATTR_CHANNELS])
6029                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
6030
6031         if (param.channels < 1) {
6032                 GENL_SET_ERR_MSG(info, "must have at least one channel");
6033                 return -EINVAL;
6034         }
6035
6036         if (info->attrs[HWSIM_ATTR_NO_VIF])
6037                 param.no_vif = true;
6038
6039         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
6040                 param.use_chanctx = true;
6041         else
6042                 param.use_chanctx = (param.channels > 1);
6043
6044         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
6045                 param.reg_alpha2 =
6046                         nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
6047
6048         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
6049                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
6050
6051                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
6052                         return -EINVAL;
6053
6054                 idx = array_index_nospec(idx,
6055                                          ARRAY_SIZE(hwsim_world_regdom_custom));
6056                 param.regd = hwsim_world_regdom_custom[idx];
6057         }
6058
6059         if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
6060                 if (!is_valid_ether_addr(
6061                                 nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
6062                         GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
6063                         NL_SET_BAD_ATTR(info->extack,
6064                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
6065                         return -EINVAL;
6066                 }
6067
6068                 param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
6069         }
6070
6071         if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
6072                 param.iftypes =
6073                         nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
6074
6075                 if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
6076                         NL_SET_ERR_MSG_ATTR(info->extack,
6077                                             info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
6078                                             "cannot support more iftypes than kernel");
6079                         return -EINVAL;
6080                 }
6081         } else {
6082                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
6083         }
6084
6085         /* ensure both flag and iftype support is honored */
6086         if (param.p2p_device ||
6087             param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
6088                 param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
6089                 param.p2p_device = true;
6090         }
6091
6092         if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
6093                 u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
6094
6095                 param.ciphers =
6096                         nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
6097
6098                 if (len % sizeof(u32)) {
6099                         NL_SET_ERR_MSG_ATTR(info->extack,
6100                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
6101                                             "bad cipher list length");
6102                         return -EINVAL;
6103                 }
6104
6105                 param.n_ciphers = len / sizeof(u32);
6106
6107                 if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
6108                         NL_SET_ERR_MSG_ATTR(info->extack,
6109                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
6110                                             "too many ciphers specified");
6111                         return -EINVAL;
6112                 }
6113
6114                 if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
6115                         NL_SET_ERR_MSG_ATTR(info->extack,
6116                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
6117                                             "unsupported ciphers specified");
6118                         return -EINVAL;
6119                 }
6120         }
6121
6122         param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
6123
6124         if (param.mlo)
6125                 param.use_chanctx = true;
6126
6127         if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
6128                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6129                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6130                                   GFP_KERNEL);
6131                 if (!hwname)
6132                         return -ENOMEM;
6133                 param.hwname = hwname;
6134         }
6135
6136         if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
6137                 struct cfg80211_pmsr_capabilities *pmsr_capa;
6138
6139                 pmsr_capa = kmalloc(sizeof(*pmsr_capa), GFP_KERNEL);
6140                 if (!pmsr_capa) {
6141                         ret = -ENOMEM;
6142                         goto out_free;
6143                 }
6144                 param.pmsr_capa = pmsr_capa;
6145
6146                 ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info);
6147                 if (ret)
6148                         goto out_free;
6149         }
6150
6151         ret = mac80211_hwsim_new_radio(info, &param);
6152
6153 out_free:
6154         kfree(hwname);
6155         kfree(param.pmsr_capa);
6156         return ret;
6157 }
6158
6159 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
6160 {
6161         struct mac80211_hwsim_data *data;
6162         s64 idx = -1;
6163         const char *hwname = NULL;
6164
6165         if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
6166                 idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
6167         } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
6168                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6169                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6170                                   GFP_KERNEL);
6171                 if (!hwname)
6172                         return -ENOMEM;
6173         } else
6174                 return -EINVAL;
6175
6176         spin_lock_bh(&hwsim_radio_lock);
6177         list_for_each_entry(data, &hwsim_radios, list) {
6178                 if (idx >= 0) {
6179                         if (data->idx != idx)
6180                                 continue;
6181                 } else {
6182                         if (!hwname ||
6183                             strcmp(hwname, wiphy_name(data->hw->wiphy)))
6184                                 continue;
6185                 }
6186
6187                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6188                         continue;
6189
6190                 list_del(&data->list);
6191                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6192                                        hwsim_rht_params);
6193                 hwsim_radios_generation++;
6194                 spin_unlock_bh(&hwsim_radio_lock);
6195                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
6196                                          info);
6197                 kfree(hwname);
6198                 return 0;
6199         }
6200         spin_unlock_bh(&hwsim_radio_lock);
6201
6202         kfree(hwname);
6203         return -ENODEV;
6204 }
6205
6206 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
6207 {
6208         struct mac80211_hwsim_data *data;
6209         struct sk_buff *skb;
6210         int idx, res = -ENODEV;
6211
6212         if (!info->attrs[HWSIM_ATTR_RADIO_ID])
6213                 return -EINVAL;
6214         idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
6215
6216         spin_lock_bh(&hwsim_radio_lock);
6217         list_for_each_entry(data, &hwsim_radios, list) {
6218                 if (data->idx != idx)
6219                         continue;
6220
6221                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6222                         continue;
6223
6224                 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6225                 if (!skb) {
6226                         res = -ENOMEM;
6227                         goto out_err;
6228                 }
6229
6230                 res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
6231                                                info->snd_seq, NULL, 0);
6232                 if (res < 0) {
6233                         nlmsg_free(skb);
6234                         goto out_err;
6235                 }
6236
6237                 res = genlmsg_reply(skb, info);
6238                 break;
6239         }
6240
6241 out_err:
6242         spin_unlock_bh(&hwsim_radio_lock);
6243
6244         return res;
6245 }
6246
6247 static int hwsim_dump_radio_nl(struct sk_buff *skb,
6248                                struct netlink_callback *cb)
6249 {
6250         int last_idx = cb->args[0] - 1;
6251         struct mac80211_hwsim_data *data = NULL;
6252         int res = 0;
6253         void *hdr;
6254
6255         spin_lock_bh(&hwsim_radio_lock);
6256         cb->seq = hwsim_radios_generation;
6257
6258         if (last_idx >= hwsim_radio_idx-1)
6259                 goto done;
6260
6261         list_for_each_entry(data, &hwsim_radios, list) {
6262                 if (data->idx <= last_idx)
6263                         continue;
6264
6265                 if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
6266                         continue;
6267
6268                 res = mac80211_hwsim_get_radio(skb, data,
6269                                                NETLINK_CB(cb->skb).portid,
6270                                                cb->nlh->nlmsg_seq, cb,
6271                                                NLM_F_MULTI);
6272                 if (res < 0)
6273                         break;
6274
6275                 last_idx = data->idx;
6276         }
6277
6278         cb->args[0] = last_idx + 1;
6279
6280         /* list changed, but no new element sent, set interrupted flag */
6281         if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
6282                 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
6283                                   cb->nlh->nlmsg_seq, &hwsim_genl_family,
6284                                   NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
6285                 if (hdr) {
6286                         genl_dump_check_consistent(cb, hdr);
6287                         genlmsg_end(skb, hdr);
6288                 } else {
6289                         res = -EMSGSIZE;
6290                 }
6291         }
6292
6293 done:
6294         spin_unlock_bh(&hwsim_radio_lock);
6295         return res ?: skb->len;
6296 }
6297
6298 /* Generic Netlink operations array */
6299 static const struct genl_small_ops hwsim_ops[] = {
6300         {
6301                 .cmd = HWSIM_CMD_REGISTER,
6302                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6303                 .doit = hwsim_register_received_nl,
6304                 .flags = GENL_UNS_ADMIN_PERM,
6305         },
6306         {
6307                 .cmd = HWSIM_CMD_FRAME,
6308                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6309                 .doit = hwsim_cloned_frame_received_nl,
6310         },
6311         {
6312                 .cmd = HWSIM_CMD_TX_INFO_FRAME,
6313                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6314                 .doit = hwsim_tx_info_frame_received_nl,
6315         },
6316         {
6317                 .cmd = HWSIM_CMD_NEW_RADIO,
6318                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6319                 .doit = hwsim_new_radio_nl,
6320                 .flags = GENL_UNS_ADMIN_PERM,
6321         },
6322         {
6323                 .cmd = HWSIM_CMD_DEL_RADIO,
6324                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6325                 .doit = hwsim_del_radio_nl,
6326                 .flags = GENL_UNS_ADMIN_PERM,
6327         },
6328         {
6329                 .cmd = HWSIM_CMD_GET_RADIO,
6330                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6331                 .doit = hwsim_get_radio_nl,
6332                 .dumpit = hwsim_dump_radio_nl,
6333         },
6334         {
6335                 .cmd = HWSIM_CMD_REPORT_PMSR,
6336                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6337                 .doit = hwsim_pmsr_report_nl,
6338         },
6339 };
6340
6341 static struct genl_family hwsim_genl_family __ro_after_init = {
6342         .name = "MAC80211_HWSIM",
6343         .version = 1,
6344         .maxattr = HWSIM_ATTR_MAX,
6345         .policy = hwsim_genl_policy,
6346         .netnsok = true,
6347         .module = THIS_MODULE,
6348         .small_ops = hwsim_ops,
6349         .n_small_ops = ARRAY_SIZE(hwsim_ops),
6350         .resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
6351         .mcgrps = hwsim_mcgrps,
6352         .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
6353 };
6354
6355 static void remove_user_radios(u32 portid)
6356 {
6357         struct mac80211_hwsim_data *entry, *tmp;
6358         LIST_HEAD(list);
6359
6360         spin_lock_bh(&hwsim_radio_lock);
6361         list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
6362                 if (entry->destroy_on_close && entry->portid == portid) {
6363                         list_move(&entry->list, &list);
6364                         rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
6365                                                hwsim_rht_params);
6366                         hwsim_radios_generation++;
6367                 }
6368         }
6369         spin_unlock_bh(&hwsim_radio_lock);
6370
6371         list_for_each_entry_safe(entry, tmp, &list, list) {
6372                 list_del(&entry->list);
6373                 mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
6374                                          NULL);
6375         }
6376 }
6377
6378 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
6379                                          unsigned long state,
6380                                          void *_notify)
6381 {
6382         struct netlink_notify *notify = _notify;
6383
6384         if (state != NETLINK_URELEASE)
6385                 return NOTIFY_DONE;
6386
6387         remove_user_radios(notify->portid);
6388
6389         if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
6390                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
6391                        " socket, switching to perfect channel medium\n");
6392                 hwsim_register_wmediumd(notify->net, 0);
6393         }
6394         return NOTIFY_DONE;
6395
6396 }
6397
6398 static struct notifier_block hwsim_netlink_notifier = {
6399         .notifier_call = mac80211_hwsim_netlink_notify,
6400 };
6401
6402 static int __init hwsim_init_netlink(void)
6403 {
6404         int rc;
6405
6406         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
6407
6408         rc = genl_register_family(&hwsim_genl_family);
6409         if (rc)
6410                 goto failure;
6411
6412         rc = netlink_register_notifier(&hwsim_netlink_notifier);
6413         if (rc) {
6414                 genl_unregister_family(&hwsim_genl_family);
6415                 goto failure;
6416         }
6417
6418         return 0;
6419
6420 failure:
6421         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
6422         return -EINVAL;
6423 }
6424
6425 static __net_init int hwsim_init_net(struct net *net)
6426 {
6427         return hwsim_net_set_netgroup(net);
6428 }
6429
6430 static void __net_exit hwsim_exit_net(struct net *net)
6431 {
6432         struct mac80211_hwsim_data *data, *tmp;
6433         LIST_HEAD(list);
6434
6435         spin_lock_bh(&hwsim_radio_lock);
6436         list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
6437                 if (!net_eq(wiphy_net(data->hw->wiphy), net))
6438                         continue;
6439
6440                 /* Radios created in init_net are returned to init_net. */
6441                 if (data->netgroup == hwsim_net_get_netgroup(&init_net))
6442                         continue;
6443
6444                 list_move(&data->list, &list);
6445                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6446                                        hwsim_rht_params);
6447                 hwsim_radios_generation++;
6448         }
6449         spin_unlock_bh(&hwsim_radio_lock);
6450
6451         list_for_each_entry_safe(data, tmp, &list, list) {
6452                 list_del(&data->list);
6453                 mac80211_hwsim_del_radio(data,
6454                                          wiphy_name(data->hw->wiphy),
6455                                          NULL);
6456         }
6457
6458         ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
6459 }
6460
6461 static struct pernet_operations hwsim_net_ops = {
6462         .init = hwsim_init_net,
6463         .exit = hwsim_exit_net,
6464         .id   = &hwsim_net_id,
6465         .size = sizeof(struct hwsim_net),
6466 };
6467
6468 static void hwsim_exit_netlink(void)
6469 {
6470         /* unregister the notifier */
6471         netlink_unregister_notifier(&hwsim_netlink_notifier);
6472         /* unregister the family */
6473         genl_unregister_family(&hwsim_genl_family);
6474 }
6475
6476 #if IS_REACHABLE(CONFIG_VIRTIO)
6477 static void hwsim_virtio_tx_done(struct virtqueue *vq)
6478 {
6479         unsigned int len;
6480         struct sk_buff *skb;
6481         unsigned long flags;
6482
6483         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6484         while ((skb = virtqueue_get_buf(vq, &len)))
6485                 dev_kfree_skb_irq(skb);
6486         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6487 }
6488
6489 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
6490 {
6491         struct nlmsghdr *nlh;
6492         struct genlmsghdr *gnlh;
6493         struct nlattr *tb[HWSIM_ATTR_MAX + 1];
6494         struct genl_info info = {};
6495         int err;
6496
6497         nlh = nlmsg_hdr(skb);
6498         gnlh = nlmsg_data(nlh);
6499
6500         if (skb->len < nlh->nlmsg_len)
6501                 return -EINVAL;
6502
6503         err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
6504                             hwsim_genl_policy, NULL);
6505         if (err) {
6506                 pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
6507                 return err;
6508         }
6509
6510         info.attrs = tb;
6511
6512         switch (gnlh->cmd) {
6513         case HWSIM_CMD_FRAME:
6514                 hwsim_cloned_frame_received_nl(skb, &info);
6515                 break;
6516         case HWSIM_CMD_TX_INFO_FRAME:
6517                 hwsim_tx_info_frame_received_nl(skb, &info);
6518                 break;
6519         case HWSIM_CMD_REPORT_PMSR:
6520                 hwsim_pmsr_report_nl(skb, &info);
6521                 break;
6522         default:
6523                 pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
6524                 return -EPROTO;
6525         }
6526         return 0;
6527 }
6528
6529 static void hwsim_virtio_rx_work(struct work_struct *work)
6530 {
6531         struct virtqueue *vq;
6532         unsigned int len;
6533         struct sk_buff *skb;
6534         struct scatterlist sg[1];
6535         int err;
6536         unsigned long flags;
6537
6538         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6539         if (!hwsim_virtio_enabled)
6540                 goto out_unlock;
6541
6542         skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
6543         if (!skb)
6544                 goto out_unlock;
6545         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6546
6547         skb->data = skb->head;
6548         skb_reset_tail_pointer(skb);
6549         skb_put(skb, len);
6550         hwsim_virtio_handle_cmd(skb);
6551
6552         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6553         if (!hwsim_virtio_enabled) {
6554                 dev_kfree_skb_irq(skb);
6555                 goto out_unlock;
6556         }
6557         vq = hwsim_vqs[HWSIM_VQ_RX];
6558         sg_init_one(sg, skb->head, skb_end_offset(skb));
6559         err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
6560         if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
6561                 dev_kfree_skb_irq(skb);
6562         else
6563                 virtqueue_kick(vq);
6564         schedule_work(&hwsim_virtio_rx);
6565
6566 out_unlock:
6567         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6568 }
6569
6570 static void hwsim_virtio_rx_done(struct virtqueue *vq)
6571 {
6572         schedule_work(&hwsim_virtio_rx);
6573 }
6574
6575 static int init_vqs(struct virtio_device *vdev)
6576 {
6577         vq_callback_t *callbacks[HWSIM_NUM_VQS] = {
6578                 [HWSIM_VQ_TX] = hwsim_virtio_tx_done,
6579                 [HWSIM_VQ_RX] = hwsim_virtio_rx_done,
6580         };
6581         const char *names[HWSIM_NUM_VQS] = {
6582                 [HWSIM_VQ_TX] = "tx",
6583                 [HWSIM_VQ_RX] = "rx",
6584         };
6585
6586         return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
6587                                hwsim_vqs, callbacks, names, NULL);
6588 }
6589
6590 static int fill_vq(struct virtqueue *vq)
6591 {
6592         int i, err;
6593         struct sk_buff *skb;
6594         struct scatterlist sg[1];
6595
6596         for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
6597                 skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
6598                 if (!skb)
6599                         return -ENOMEM;
6600
6601                 sg_init_one(sg, skb->head, skb_end_offset(skb));
6602                 err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
6603                 if (err) {
6604                         nlmsg_free(skb);
6605                         return err;
6606                 }
6607         }
6608         virtqueue_kick(vq);
6609         return 0;
6610 }
6611
6612 static void remove_vqs(struct virtio_device *vdev)
6613 {
6614         int i;
6615
6616         virtio_reset_device(vdev);
6617
6618         for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
6619                 struct virtqueue *vq = hwsim_vqs[i];
6620                 struct sk_buff *skb;
6621
6622                 while ((skb = virtqueue_detach_unused_buf(vq)))
6623                         nlmsg_free(skb);
6624         }
6625
6626         vdev->config->del_vqs(vdev);
6627 }
6628
6629 static int hwsim_virtio_probe(struct virtio_device *vdev)
6630 {
6631         int err;
6632         unsigned long flags;
6633
6634         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6635         if (hwsim_virtio_enabled) {
6636                 spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6637                 return -EEXIST;
6638         }
6639         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6640
6641         err = init_vqs(vdev);
6642         if (err)
6643                 return err;
6644
6645         virtio_device_ready(vdev);
6646
6647         err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
6648         if (err)
6649                 goto out_remove;
6650
6651         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6652         hwsim_virtio_enabled = true;
6653         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6654
6655         schedule_work(&hwsim_virtio_rx);
6656         return 0;
6657
6658 out_remove:
6659         remove_vqs(vdev);
6660         return err;
6661 }
6662
6663 static void hwsim_virtio_remove(struct virtio_device *vdev)
6664 {
6665         hwsim_virtio_enabled = false;
6666
6667         cancel_work_sync(&hwsim_virtio_rx);
6668
6669         remove_vqs(vdev);
6670 }
6671
6672 /* MAC80211_HWSIM virtio device id table */
6673 static const struct virtio_device_id id_table[] = {
6674         { VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
6675         { 0 }
6676 };
6677 MODULE_DEVICE_TABLE(virtio, id_table);
6678
6679 static struct virtio_driver virtio_hwsim = {
6680         .driver.name = KBUILD_MODNAME,
6681         .id_table = id_table,
6682         .probe = hwsim_virtio_probe,
6683         .remove = hwsim_virtio_remove,
6684 };
6685
6686 static int hwsim_register_virtio_driver(void)
6687 {
6688         return register_virtio_driver(&virtio_hwsim);
6689 }
6690
6691 static void hwsim_unregister_virtio_driver(void)
6692 {
6693         unregister_virtio_driver(&virtio_hwsim);
6694 }
6695 #else
6696 static inline int hwsim_register_virtio_driver(void)
6697 {
6698         return 0;
6699 }
6700
6701 static inline void hwsim_unregister_virtio_driver(void)
6702 {
6703 }
6704 #endif
6705
6706 static int __init init_mac80211_hwsim(void)
6707 {
6708         int i, err;
6709
6710         if (radios < 0 || radios > 100)
6711                 return -EINVAL;
6712
6713         if (channels < 1)
6714                 return -EINVAL;
6715
6716         err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
6717         if (err)
6718                 return err;
6719
6720         err = register_pernet_device(&hwsim_net_ops);
6721         if (err)
6722                 goto out_free_rht;
6723
6724         err = platform_driver_register(&mac80211_hwsim_driver);
6725         if (err)
6726                 goto out_unregister_pernet;
6727
6728         err = hwsim_init_netlink();
6729         if (err)
6730                 goto out_unregister_driver;
6731
6732         err = hwsim_register_virtio_driver();
6733         if (err)
6734                 goto out_exit_netlink;
6735
6736         hwsim_class = class_create("mac80211_hwsim");
6737         if (IS_ERR(hwsim_class)) {
6738                 err = PTR_ERR(hwsim_class);
6739                 goto out_exit_virtio;
6740         }
6741
6742         hwsim_init_s1g_channels(hwsim_channels_s1g);
6743
6744         for (i = 0; i < radios; i++) {
6745                 struct hwsim_new_radio_params param = { 0 };
6746
6747                 param.channels = channels;
6748
6749                 switch (regtest) {
6750                 case HWSIM_REGTEST_DIFF_COUNTRY:
6751                         if (i < ARRAY_SIZE(hwsim_alpha2s))
6752                                 param.reg_alpha2 = hwsim_alpha2s[i];
6753                         break;
6754                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
6755                         if (!i)
6756                                 param.reg_alpha2 = hwsim_alpha2s[0];
6757                         break;
6758                 case HWSIM_REGTEST_STRICT_ALL:
6759                         param.reg_strict = true;
6760                         fallthrough;
6761                 case HWSIM_REGTEST_DRIVER_REG_ALL:
6762                         param.reg_alpha2 = hwsim_alpha2s[0];
6763                         break;
6764                 case HWSIM_REGTEST_WORLD_ROAM:
6765                         if (i == 0)
6766                                 param.regd = &hwsim_world_regdom_custom_01;
6767                         break;
6768                 case HWSIM_REGTEST_CUSTOM_WORLD:
6769                         param.regd = &hwsim_world_regdom_custom_03;
6770                         break;
6771                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
6772                         if (i == 0)
6773                                 param.regd = &hwsim_world_regdom_custom_03;
6774                         else if (i == 1)
6775                                 param.regd = &hwsim_world_regdom_custom_02;
6776                         break;
6777                 case HWSIM_REGTEST_STRICT_FOLLOW:
6778                         if (i == 0) {
6779                                 param.reg_strict = true;
6780                                 param.reg_alpha2 = hwsim_alpha2s[0];
6781                         }
6782                         break;
6783                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
6784                         if (i == 0) {
6785                                 param.reg_strict = true;
6786                                 param.reg_alpha2 = hwsim_alpha2s[0];
6787                         } else if (i == 1) {
6788                                 param.reg_alpha2 = hwsim_alpha2s[1];
6789                         }
6790                         break;
6791                 case HWSIM_REGTEST_ALL:
6792                         switch (i) {
6793                         case 0:
6794                                 param.regd = &hwsim_world_regdom_custom_01;
6795                                 break;
6796                         case 1:
6797                                 param.regd = &hwsim_world_regdom_custom_02;
6798                                 break;
6799                         case 2:
6800                                 param.reg_alpha2 = hwsim_alpha2s[0];
6801                                 break;
6802                         case 3:
6803                                 param.reg_alpha2 = hwsim_alpha2s[1];
6804                                 break;
6805                         case 4:
6806                                 param.reg_strict = true;
6807                                 param.reg_alpha2 = hwsim_alpha2s[2];
6808                                 break;
6809                         }
6810                         break;
6811                 default:
6812                         break;
6813                 }
6814
6815                 param.p2p_device = support_p2p_device;
6816                 param.mlo = mlo;
6817                 param.use_chanctx = channels > 1 || mlo;
6818                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
6819                 if (param.p2p_device)
6820                         param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
6821
6822                 err = mac80211_hwsim_new_radio(NULL, &param);
6823                 if (err < 0)
6824                         goto out_free_radios;
6825         }
6826
6827         hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
6828                                  hwsim_mon_setup);
6829         if (hwsim_mon == NULL) {
6830                 err = -ENOMEM;
6831                 goto out_free_radios;
6832         }
6833
6834         rtnl_lock();
6835         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
6836         if (err < 0) {
6837                 rtnl_unlock();
6838                 goto out_free_mon;
6839         }
6840
6841         err = register_netdevice(hwsim_mon);
6842         if (err < 0) {
6843                 rtnl_unlock();
6844                 goto out_free_mon;
6845         }
6846         rtnl_unlock();
6847
6848         return 0;
6849
6850 out_free_mon:
6851         free_netdev(hwsim_mon);
6852 out_free_radios:
6853         mac80211_hwsim_free();
6854 out_exit_virtio:
6855         hwsim_unregister_virtio_driver();
6856 out_exit_netlink:
6857         hwsim_exit_netlink();
6858 out_unregister_driver:
6859         platform_driver_unregister(&mac80211_hwsim_driver);
6860 out_unregister_pernet:
6861         unregister_pernet_device(&hwsim_net_ops);
6862 out_free_rht:
6863         rhashtable_destroy(&hwsim_radios_rht);
6864         return err;
6865 }
6866 module_init(init_mac80211_hwsim);
6867
6868 static void __exit exit_mac80211_hwsim(void)
6869 {
6870         pr_debug("mac80211_hwsim: unregister radios\n");
6871
6872         hwsim_unregister_virtio_driver();
6873         hwsim_exit_netlink();
6874
6875         mac80211_hwsim_free();
6876
6877         rhashtable_destroy(&hwsim_radios_rht);
6878         unregister_netdev(hwsim_mon);
6879         platform_driver_unregister(&mac80211_hwsim_driver);
6880         unregister_pernet_device(&hwsim_net_ops);
6881 }
6882 module_exit(exit_mac80211_hwsim);