File Index
Files and directories
Sign in
FILE

mac80211_hwsim.c

File preview with syntax highlighting.

linux-6.19.14/drivers/net/wireless/virtual/mac80211_hwsim.c C
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
   4 * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   5 * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
   6 * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
   7 * Copyright (C) 2018 - 2025 Intel Corporation
   8 */
   9
  10/*
  11 * TODO:
  12 * - Add TSF sync and fix IBSS beacon transmission by adding
  13 *   competition for "air time" at TBTT
  14 * - RX filtering based on filter configuration (data->rx_filter)
  15 */
  16
  17#include <linux/list.h>
  18#include <linux/slab.h>
  19#include <linux/spinlock.h>
  20#include <net/dst.h>
  21#include <net/xfrm.h>
  22#include <net/mac80211.h>
  23#include <net/ieee80211_radiotap.h>
  24#include <linux/if_arp.h>
  25#include <linux/rtnetlink.h>
  26#include <linux/etherdevice.h>
  27#include <linux/platform_device.h>
  28#include <linux/debugfs.h>
  29#include <linux/module.h>
  30#include <linux/ktime.h>
  31#include <net/genetlink.h>
  32#include <net/net_namespace.h>
  33#include <net/netns/generic.h>
  34#include <linux/rhashtable.h>
  35#include <linux/nospec.h>
  36#include <linux/virtio.h>
  37#include <linux/virtio_ids.h>
  38#include <linux/virtio_config.h>
  39#include "mac80211_hwsim.h"
  40
  41#define WARN_QUEUE 100
  42#define MAX_QUEUE 200
  43
  44MODULE_AUTHOR("Jouni Malinen");
  45MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
  46MODULE_LICENSE("GPL");
  47
  48static int radios = 2;
  49module_param(radios, int, 0444);
  50MODULE_PARM_DESC(radios, "Number of simulated radios");
  51
  52static int channels = 1;
  53module_param(channels, int, 0444);
  54MODULE_PARM_DESC(channels, "Number of concurrent channels");
  55
  56static bool paged_rx = false;
  57module_param(paged_rx, bool, 0644);
  58MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
  59
  60static bool rctbl = false;
  61module_param(rctbl, bool, 0444);
  62MODULE_PARM_DESC(rctbl, "Handle rate control table");
  63
  64static bool support_p2p_device = true;
  65module_param(support_p2p_device, bool, 0444);
  66MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
  67
  68static bool mlo;
  69module_param(mlo, bool, 0444);
  70MODULE_PARM_DESC(mlo, "Support MLO");
  71
  72static bool multi_radio;
  73module_param(multi_radio, bool, 0444);
  74MODULE_PARM_DESC(multi_radio, "Support Multiple Radios per wiphy");
  75
  76/**
  77 * enum hwsim_regtest - the type of regulatory tests we offer
  78 *
  79 * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
  80 * 	this is the default value.
  81 * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
  82 *	hint, only one driver regulatory hint will be sent as such the
  83 * 	secondary radios are expected to follow.
  84 * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
  85 * 	request with all radios reporting the same regulatory domain.
  86 * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
  87 * 	different regulatory domains requests. Expected behaviour is for
  88 * 	an intersection to occur but each device will still use their
  89 * 	respective regulatory requested domains. Subsequent radios will
  90 * 	use the resulting intersection.
  91 * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
  92 *	this by using a custom beacon-capable regulatory domain for the first
  93 *	radio. All other device world roam.
  94 * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
  95 * 	domain requests. All radios will adhere to this custom world regulatory
  96 * 	domain.
  97 * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
  98 * 	domain requests. The first radio will adhere to the first custom world
  99 * 	regulatory domain, the second one to the second custom world regulatory
 100 * 	domain. All other devices will world roam.
 101 * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
 102 *	settings, only the first radio will send a regulatory domain request
 103 *	and use strict settings. The rest of the radios are expected to follow.
 104 * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
 105 *	settings. All radios will adhere to this.
 106 * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
 107 *	domain settings, combined with secondary driver regulatory domain
 108 *	settings. The first radio will get a strict regulatory domain setting
 109 *	using the first driver regulatory request and the second radio will use
 110 *	non-strict settings using the second driver regulatory request. All
 111 *	other devices should follow the intersection created between the
 112 *	first two.
 113 * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
 114 * 	at least 6 radios for a complete test. We will test in this order:
 115 * 	1 - driver custom world regulatory domain
 116 * 	2 - second custom world regulatory domain
 117 * 	3 - first driver regulatory domain request
 118 * 	4 - second driver regulatory domain request
 119 * 	5 - strict regulatory domain settings using the third driver regulatory
 120 * 	    domain request
 121 * 	6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
 122 * 	           regulatory requests.
 123 *
 124 * These are the different values you can use for the regtest
 125 * module parameter. This is useful to help test world roaming
 126 * and the driver regulatory_hint() call and combinations of these.
 127 * If you want to do specific alpha2 regulatory domain tests simply
 128 * use the userspace regulatory request as that will be respected as
 129 * well without the need of this module parameter. This is designed
 130 * only for testing the driver regulatory request, world roaming
 131 * and all possible combinations.
 132 */
 133enum hwsim_regtest {
 134	HWSIM_REGTEST_DISABLED = 0,
 135	HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
 136	HWSIM_REGTEST_DRIVER_REG_ALL = 2,
 137	HWSIM_REGTEST_DIFF_COUNTRY = 3,
 138	HWSIM_REGTEST_WORLD_ROAM = 4,
 139	HWSIM_REGTEST_CUSTOM_WORLD = 5,
 140	HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
 141	HWSIM_REGTEST_STRICT_FOLLOW = 7,
 142	HWSIM_REGTEST_STRICT_ALL = 8,
 143	HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
 144	HWSIM_REGTEST_ALL = 10,
 145};
 146
 147/* Set to one of the HWSIM_REGTEST_* values above */
 148static int regtest = HWSIM_REGTEST_DISABLED;
 149module_param(regtest, int, 0444);
 150MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
 151
 152static const char *hwsim_alpha2s[] = {
 153	"FI",
 154	"AL",
 155	"US",
 156	"DE",
 157	"JP",
 158	"AL",
 159};
 160
 161static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
 162	.n_reg_rules = 5,
 163	.alpha2 =  "99",
 164	.reg_rules = {
 165		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 166		REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
 167		REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
 168		REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
 169		REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 170	}
 171};
 172
 173static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
 174	.n_reg_rules = 3,
 175	.alpha2 =  "99",
 176	.reg_rules = {
 177		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 178		REG_RULE(5725-10, 5850+10, 40, 0, 30,
 179			 NL80211_RRF_NO_IR),
 180		REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 181	}
 182};
 183
 184static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
 185	.n_reg_rules = 6,
 186	.alpha2 =  "99",
 187	.reg_rules = {
 188		REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 189		REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 190		REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
 191		REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
 192		REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
 193		REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
 194	}
 195};
 196
 197static const struct ieee80211_regdomain hwsim_world_regdom_custom_04 = {
 198	.n_reg_rules = 6,
 199	.alpha2 =  "99",
 200	.reg_rules = {
 201		REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 202		REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 203		REG_RULE(5150 - 10, 5240 + 10, 80, 0, 30, NL80211_RRF_AUTO_BW),
 204		REG_RULE(5260 - 10, 5320 + 10, 80, 0, 30,
 205			 NL80211_RRF_DFS_CONCURRENT | NL80211_RRF_DFS |
 206			 NL80211_RRF_AUTO_BW),
 207		REG_RULE(5500 - 10, 5720 + 10, 160, 0, 30,
 208			 NL80211_RRF_DFS_CONCURRENT | NL80211_RRF_DFS),
 209		REG_RULE(5745 - 10, 5825 + 10, 80, 0, 30, 0),
 210		REG_RULE(5855 - 10, 5925 + 10, 80, 0, 33, 0),
 211	}
 212};
 213
 214static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
 215	&hwsim_world_regdom_custom_01,
 216	&hwsim_world_regdom_custom_02,
 217	&hwsim_world_regdom_custom_03,
 218	&hwsim_world_regdom_custom_04,
 219};
 220
 221struct hwsim_vif_priv {
 222	u32 magic;
 223	u32 skip_beacons[IEEE80211_MLD_MAX_NUM_LINKS];
 224	u8 bssid[ETH_ALEN];
 225	bool assoc;
 226	bool bcn_en;
 227	u16 aid;
 228};
 229
 230#define HWSIM_VIF_MAGIC	0x69537748
 231
 232static inline void hwsim_check_magic(struct ieee80211_vif *vif)
 233{
 234	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 235	WARN(vp->magic != HWSIM_VIF_MAGIC,
 236	     "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
 237	     vif, vp->magic, vif->addr, vif->type, vif->p2p);
 238}
 239
 240static inline void hwsim_set_magic(struct ieee80211_vif *vif)
 241{
 242	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 243	vp->magic = HWSIM_VIF_MAGIC;
 244}
 245
 246static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
 247{
 248	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 249	vp->magic = 0;
 250}
 251
 252struct hwsim_sta_priv {
 253	u32 magic;
 254	unsigned int last_link;
 255	u16 active_links_rx;
 256};
 257
 258#define HWSIM_STA_MAGIC	0x6d537749
 259
 260static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
 261{
 262	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 263	WARN_ON(sp->magic != HWSIM_STA_MAGIC);
 264}
 265
 266static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
 267{
 268	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 269	sp->magic = HWSIM_STA_MAGIC;
 270}
 271
 272static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
 273{
 274	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 275	sp->magic = 0;
 276}
 277
 278struct hwsim_chanctx_priv {
 279	u32 magic;
 280};
 281
 282#define HWSIM_CHANCTX_MAGIC 0x6d53774a
 283
 284static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
 285{
 286	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 287	WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
 288}
 289
 290static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
 291{
 292	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 293	cp->magic = HWSIM_CHANCTX_MAGIC;
 294}
 295
 296static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
 297{
 298	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 299	cp->magic = 0;
 300}
 301
 302static unsigned int hwsim_net_id;
 303
 304static DEFINE_IDA(hwsim_netgroup_ida);
 305
 306struct hwsim_net {
 307	int netgroup;
 308	u32 wmediumd;
 309};
 310
 311static inline int hwsim_net_get_netgroup(struct net *net)
 312{
 313	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 314
 315	return hwsim_net->netgroup;
 316}
 317
 318static inline int hwsim_net_set_netgroup(struct net *net)
 319{
 320	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 321
 322	hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
 323	return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
 324}
 325
 326static inline u32 hwsim_net_get_wmediumd(struct net *net)
 327{
 328	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 329
 330	return hwsim_net->wmediumd;
 331}
 332
 333static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
 334{
 335	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 336
 337	hwsim_net->wmediumd = portid;
 338}
 339
 340static struct class *hwsim_class;
 341
 342static struct net_device *hwsim_mon; /* global monitor netdev */
 343
 344#define CHAN2G(_freq)  { \
 345	.band = NL80211_BAND_2GHZ, \
 346	.center_freq = (_freq), \
 347	.hw_value = (_freq), \
 348}
 349
 350#define CHAN5G(_freq) { \
 351	.band = NL80211_BAND_5GHZ, \
 352	.center_freq = (_freq), \
 353	.hw_value = (_freq), \
 354}
 355
 356#define CHAN6G(_freq) { \
 357	.band = NL80211_BAND_6GHZ, \
 358	.center_freq = (_freq), \
 359	.hw_value = (_freq), \
 360}
 361
 362static const struct ieee80211_channel hwsim_channels_2ghz[] = {
 363	CHAN2G(2412), /* Channel 1 */
 364	CHAN2G(2417), /* Channel 2 */
 365	CHAN2G(2422), /* Channel 3 */
 366	CHAN2G(2427), /* Channel 4 */
 367	CHAN2G(2432), /* Channel 5 */
 368	CHAN2G(2437), /* Channel 6 */
 369	CHAN2G(2442), /* Channel 7 */
 370	CHAN2G(2447), /* Channel 8 */
 371	CHAN2G(2452), /* Channel 9 */
 372	CHAN2G(2457), /* Channel 10 */
 373	CHAN2G(2462), /* Channel 11 */
 374	CHAN2G(2467), /* Channel 12 */
 375	CHAN2G(2472), /* Channel 13 */
 376	CHAN2G(2484), /* Channel 14 */
 377};
 378
 379static const struct ieee80211_channel hwsim_channels_5ghz[] = {
 380	CHAN5G(5180), /* Channel 36 */
 381	CHAN5G(5200), /* Channel 40 */
 382	CHAN5G(5220), /* Channel 44 */
 383	CHAN5G(5240), /* Channel 48 */
 384
 385	CHAN5G(5260), /* Channel 52 */
 386	CHAN5G(5280), /* Channel 56 */
 387	CHAN5G(5300), /* Channel 60 */
 388	CHAN5G(5320), /* Channel 64 */
 389
 390	CHAN5G(5500), /* Channel 100 */
 391	CHAN5G(5520), /* Channel 104 */
 392	CHAN5G(5540), /* Channel 108 */
 393	CHAN5G(5560), /* Channel 112 */
 394	CHAN5G(5580), /* Channel 116 */
 395	CHAN5G(5600), /* Channel 120 */
 396	CHAN5G(5620), /* Channel 124 */
 397	CHAN5G(5640), /* Channel 128 */
 398	CHAN5G(5660), /* Channel 132 */
 399	CHAN5G(5680), /* Channel 136 */
 400	CHAN5G(5700), /* Channel 140 */
 401
 402	CHAN5G(5745), /* Channel 149 */
 403	CHAN5G(5765), /* Channel 153 */
 404	CHAN5G(5785), /* Channel 157 */
 405	CHAN5G(5805), /* Channel 161 */
 406	CHAN5G(5825), /* Channel 165 */
 407	CHAN5G(5845), /* Channel 169 */
 408
 409	CHAN5G(5855), /* Channel 171 */
 410	CHAN5G(5860), /* Channel 172 */
 411	CHAN5G(5865), /* Channel 173 */
 412	CHAN5G(5870), /* Channel 174 */
 413
 414	CHAN5G(5875), /* Channel 175 */
 415	CHAN5G(5880), /* Channel 176 */
 416	CHAN5G(5885), /* Channel 177 */
 417	CHAN5G(5890), /* Channel 178 */
 418	CHAN5G(5895), /* Channel 179 */
 419	CHAN5G(5900), /* Channel 180 */
 420	CHAN5G(5905), /* Channel 181 */
 421
 422	CHAN5G(5910), /* Channel 182 */
 423	CHAN5G(5915), /* Channel 183 */
 424	CHAN5G(5920), /* Channel 184 */
 425	CHAN5G(5925), /* Channel 185 */
 426};
 427
 428static const struct ieee80211_channel hwsim_channels_6ghz[] = {
 429	CHAN6G(5955), /* Channel 1 */
 430	CHAN6G(5975), /* Channel 5 */
 431	CHAN6G(5995), /* Channel 9 */
 432	CHAN6G(6015), /* Channel 13 */
 433	CHAN6G(6035), /* Channel 17 */
 434	CHAN6G(6055), /* Channel 21 */
 435	CHAN6G(6075), /* Channel 25 */
 436	CHAN6G(6095), /* Channel 29 */
 437	CHAN6G(6115), /* Channel 33 */
 438	CHAN6G(6135), /* Channel 37 */
 439	CHAN6G(6155), /* Channel 41 */
 440	CHAN6G(6175), /* Channel 45 */
 441	CHAN6G(6195), /* Channel 49 */
 442	CHAN6G(6215), /* Channel 53 */
 443	CHAN6G(6235), /* Channel 57 */
 444	CHAN6G(6255), /* Channel 61 */
 445	CHAN6G(6275), /* Channel 65 */
 446	CHAN6G(6295), /* Channel 69 */
 447	CHAN6G(6315), /* Channel 73 */
 448	CHAN6G(6335), /* Channel 77 */
 449	CHAN6G(6355), /* Channel 81 */
 450	CHAN6G(6375), /* Channel 85 */
 451	CHAN6G(6395), /* Channel 89 */
 452	CHAN6G(6415), /* Channel 93 */
 453	CHAN6G(6435), /* Channel 97 */
 454	CHAN6G(6455), /* Channel 181 */
 455	CHAN6G(6475), /* Channel 105 */
 456	CHAN6G(6495), /* Channel 109 */
 457	CHAN6G(6515), /* Channel 113 */
 458	CHAN6G(6535), /* Channel 117 */
 459	CHAN6G(6555), /* Channel 121 */
 460	CHAN6G(6575), /* Channel 125 */
 461	CHAN6G(6595), /* Channel 129 */
 462	CHAN6G(6615), /* Channel 133 */
 463	CHAN6G(6635), /* Channel 137 */
 464	CHAN6G(6655), /* Channel 141 */
 465	CHAN6G(6675), /* Channel 145 */
 466	CHAN6G(6695), /* Channel 149 */
 467	CHAN6G(6715), /* Channel 153 */
 468	CHAN6G(6735), /* Channel 157 */
 469	CHAN6G(6755), /* Channel 161 */
 470	CHAN6G(6775), /* Channel 165 */
 471	CHAN6G(6795), /* Channel 169 */
 472	CHAN6G(6815), /* Channel 173 */
 473	CHAN6G(6835), /* Channel 177 */
 474	CHAN6G(6855), /* Channel 181 */
 475	CHAN6G(6875), /* Channel 185 */
 476	CHAN6G(6895), /* Channel 189 */
 477	CHAN6G(6915), /* Channel 193 */
 478	CHAN6G(6935), /* Channel 197 */
 479	CHAN6G(6955), /* Channel 201 */
 480	CHAN6G(6975), /* Channel 205 */
 481	CHAN6G(6995), /* Channel 209 */
 482	CHAN6G(7015), /* Channel 213 */
 483	CHAN6G(7035), /* Channel 217 */
 484	CHAN6G(7055), /* Channel 221 */
 485	CHAN6G(7075), /* Channel 225 */
 486	CHAN6G(7095), /* Channel 229 */
 487	CHAN6G(7115), /* Channel 233 */
 488};
 489
 490#define NUM_S1G_CHANS_US 51
 491static struct ieee80211_channel hwsim_channels_s1g[NUM_S1G_CHANS_US];
 492
 493static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
 494	.s1g = true,
 495	.cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
 496		 0,
 497		 0,
 498		 S1G_CAP3_MAX_MPDU_LEN,
 499		 0,
 500		 S1G_CAP5_AMPDU,
 501		 0,
 502		 S1G_CAP7_DUP_1MHZ,
 503		 S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
 504		 0},
 505	.nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
 506	/* RX Highest Supported Long GI Data Rate 0:7 */
 507		     0,
 508	/* RX Highest Supported Long GI Data Rate 0:7 */
 509	/* TX S1G MCS Map 0:6 */
 510		     0xfa,
 511	/* TX S1G MCS Map :7 */
 512	/* TX Highest Supported Long GI Data Rate 0:6 */
 513		     0x80,
 514	/* TX Highest Supported Long GI Data Rate 7:8 */
 515	/* Rx Single spatial stream and S1G-MCS Map for 1MHz */
 516	/* Tx Single spatial stream and S1G-MCS Map for 1MHz */
 517		     0 },
 518};
 519
 520static void hwsim_init_s1g_channels(struct ieee80211_channel *chans)
 521{
 522	int ch, freq;
 523
 524	for (ch = 0; ch < NUM_S1G_CHANS_US; ch++) {
 525		freq = 902000 + (ch + 1) * 500;
 526		chans[ch].band = NL80211_BAND_S1GHZ;
 527		chans[ch].center_freq = KHZ_TO_MHZ(freq);
 528		chans[ch].freq_offset = freq % 1000;
 529		chans[ch].hw_value = ch + 1;
 530	}
 531}
 532
 533static const struct ieee80211_rate hwsim_rates[] = {
 534	{ .bitrate = 10 },
 535	{ .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 536	{ .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 537	{ .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 538	{ .bitrate = 60 },
 539	{ .bitrate = 90 },
 540	{ .bitrate = 120 },
 541	{ .bitrate = 180 },
 542	{ .bitrate = 240 },
 543	{ .bitrate = 360 },
 544	{ .bitrate = 480 },
 545	{ .bitrate = 540 }
 546};
 547
 548#define DEFAULT_RX_RSSI -50
 549
 550static const u32 hwsim_ciphers[] = {
 551	WLAN_CIPHER_SUITE_WEP40,
 552	WLAN_CIPHER_SUITE_WEP104,
 553	WLAN_CIPHER_SUITE_TKIP,
 554	WLAN_CIPHER_SUITE_CCMP,
 555	WLAN_CIPHER_SUITE_CCMP_256,
 556	WLAN_CIPHER_SUITE_GCMP,
 557	WLAN_CIPHER_SUITE_GCMP_256,
 558	WLAN_CIPHER_SUITE_AES_CMAC,
 559	WLAN_CIPHER_SUITE_BIP_CMAC_256,
 560	WLAN_CIPHER_SUITE_BIP_GMAC_128,
 561	WLAN_CIPHER_SUITE_BIP_GMAC_256,
 562};
 563
 564#define OUI_QCA 0x001374
 565#define QCA_NL80211_SUBCMD_TEST 1
 566enum qca_nl80211_vendor_subcmds {
 567	QCA_WLAN_VENDOR_ATTR_TEST = 8,
 568	QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
 569};
 570
 571static const struct nla_policy
 572hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
 573	[QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
 574};
 575
 576static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
 577					  struct wireless_dev *wdev,
 578					  const void *data, int data_len)
 579{
 580	struct sk_buff *skb;
 581	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 582	int err;
 583	u32 val;
 584
 585	err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
 586				   data_len, hwsim_vendor_test_policy, NULL);
 587	if (err)
 588		return err;
 589	if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
 590		return -EINVAL;
 591	val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
 592	wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
 593
 594	/* Send a vendor event as a test. Note that this would not normally be
 595	 * done within a command handler, but rather, based on some other
 596	 * trigger. For simplicity, this command is used to trigger the event
 597	 * here.
 598	 *
 599	 * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
 600	 */
 601	skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
 602	if (skb) {
 603		/* skb_put() or nla_put() will fill up data within
 604		 * NL80211_ATTR_VENDOR_DATA.
 605		 */
 606
 607		/* Add vendor data */
 608		nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
 609
 610		/* Send the event - this will call nla_nest_end() */
 611		cfg80211_vendor_event(skb, GFP_KERNEL);
 612	}
 613
 614	/* Send a response to the command */
 615	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
 616	if (!skb)
 617		return -ENOMEM;
 618
 619	/* skb_put() or nla_put() will fill up data within
 620	 * NL80211_ATTR_VENDOR_DATA
 621	 */
 622	nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
 623
 624	return cfg80211_vendor_cmd_reply(skb);
 625}
 626
 627static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
 628	{
 629		.info = { .vendor_id = OUI_QCA,
 630			  .subcmd = QCA_NL80211_SUBCMD_TEST },
 631		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
 632		.doit = mac80211_hwsim_vendor_cmd_test,
 633		.policy = hwsim_vendor_test_policy,
 634		.maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
 635	}
 636};
 637
 638/* Advertise support vendor specific events */
 639static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
 640	{ .vendor_id = OUI_QCA, .subcmd = 1 },
 641};
 642
 643static DEFINE_SPINLOCK(hwsim_radio_lock);
 644static LIST_HEAD(hwsim_radios);
 645static struct rhashtable hwsim_radios_rht;
 646static int hwsim_radio_idx;
 647static int hwsim_radios_generation = 1;
 648static u8 hwsim_nan_cluster_id[ETH_ALEN];
 649
 650static struct platform_driver mac80211_hwsim_driver = {
 651	.driver = {
 652		.name = "mac80211_hwsim",
 653	},
 654};
 655
 656struct mac80211_hwsim_link_data {
 657	u32 link_id;
 658	u64 beacon_int	/* beacon interval in us */;
 659	struct hrtimer beacon_timer;
 660};
 661
 662struct mac80211_hwsim_data {
 663	struct list_head list;
 664	struct rhash_head rht;
 665	struct ieee80211_hw *hw;
 666	struct device *dev;
 667	struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 668	struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
 669	struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
 670	struct ieee80211_channel channels_6ghz[ARRAY_SIZE(hwsim_channels_6ghz)];
 671	struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
 672	struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 673	struct ieee80211_iface_combination if_combination;
 674	struct ieee80211_iface_limit if_limits[4];
 675	int n_if_limits;
 676
 677	struct ieee80211_iface_combination if_combination_radio;
 678	struct wiphy_radio_freq_range radio_range[NUM_NL80211_BANDS];
 679	struct wiphy_radio radio[NUM_NL80211_BANDS];
 680
 681	u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
 682
 683	struct mac_address addresses[3];
 684	int channels, idx;
 685	bool use_chanctx;
 686	bool destroy_on_close;
 687	u32 portid;
 688	char alpha2[2];
 689	const struct ieee80211_regdomain *regd;
 690
 691	struct ieee80211_channel *tmp_chan;
 692	struct ieee80211_channel *roc_chan;
 693	u32 roc_duration;
 694	struct delayed_work roc_start;
 695	struct delayed_work roc_done;
 696	struct delayed_work hw_scan;
 697	struct cfg80211_scan_request *hw_scan_request;
 698	struct ieee80211_vif *hw_scan_vif;
 699	int scan_chan_idx;
 700	u8 scan_addr[ETH_ALEN];
 701	struct {
 702		struct ieee80211_channel *channel;
 703		unsigned long next_start, start, end;
 704	} survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
 705		      ARRAY_SIZE(hwsim_channels_5ghz) +
 706		      ARRAY_SIZE(hwsim_channels_6ghz)];
 707
 708	struct ieee80211_channel *channel;
 709	enum nl80211_chan_width bw;
 710	unsigned int rx_filter;
 711	bool started, idle, scanning;
 712	struct mutex mutex;
 713	enum ps_mode {
 714		PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
 715	} ps;
 716	bool ps_poll_pending;
 717	struct dentry *debugfs;
 718
 719	atomic_t pending_cookie;
 720	struct sk_buff_head pending;	/* packets pending */
 721	/*
 722	 * Only radios in the same group can communicate together (the
 723	 * channel has to match too). Each bit represents a group. A
 724	 * radio can be in more than one group.
 725	 */
 726	u64 group;
 727
 728	/* group shared by radios created in the same netns */
 729	int netgroup;
 730	/* wmediumd portid responsible for netgroup of this radio */
 731	u32 wmediumd;
 732
 733	/* difference between this hw's clock and the real clock, in usecs */
 734	s64 tsf_offset;
 735	s64 bcn_delta;
 736	/* absolute beacon transmission time. Used to cover up "tx" delay. */
 737	u64 abs_bcn_ts;
 738
 739	/* Stats */
 740	u64 tx_pkts;
 741	u64 rx_pkts;
 742	u64 tx_bytes;
 743	u64 rx_bytes;
 744	u64 tx_dropped;
 745	u64 tx_failed;
 746
 747	/* RSSI in rx status of the receiver */
 748	int rx_rssi;
 749
 750	/* only used when pmsr capability is supplied */
 751	struct cfg80211_pmsr_capabilities pmsr_capa;
 752	struct cfg80211_pmsr_request *pmsr_request;
 753	struct wireless_dev *pmsr_request_wdev;
 754
 755	struct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];
 756
 757	struct ieee80211_vif *nan_device_vif;
 758	u8 nan_bands;
 759
 760	enum nl80211_band nan_curr_dw_band;
 761	struct hrtimer nan_timer;
 762	bool notify_dw;
 763	struct ieee80211_vif *nan_vif;
 764};
 765
 766static const struct rhashtable_params hwsim_rht_params = {
 767	.nelem_hint = 2,
 768	.automatic_shrinking = true,
 769	.key_len = ETH_ALEN,
 770	.key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
 771	.head_offset = offsetof(struct mac80211_hwsim_data, rht),
 772};
 773
 774struct hwsim_radiotap_hdr {
 775	struct ieee80211_radiotap_header_fixed hdr;
 776	__le64 rt_tsft;
 777	u8 rt_flags;
 778	u8 rt_rate;
 779	__le16 rt_channel;
 780	__le16 rt_chbitmask;
 781} __packed;
 782
 783struct hwsim_radiotap_ack_hdr {
 784	struct ieee80211_radiotap_header_fixed hdr;
 785	u8 rt_flags;
 786	u8 pad;
 787	__le16 rt_channel;
 788	__le16 rt_chbitmask;
 789} __packed;
 790
 791static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
 792{
 793	return rhashtable_lookup_fast(&hwsim_radios_rht, addr, hwsim_rht_params);
 794}
 795
 796/* MAC80211_HWSIM netlink family */
 797static struct genl_family hwsim_genl_family;
 798
 799enum hwsim_multicast_groups {
 800	HWSIM_MCGRP_CONFIG,
 801};
 802
 803static const struct genl_multicast_group hwsim_mcgrps[] = {
 804	[HWSIM_MCGRP_CONFIG] = { .name = "config", },
 805};
 806
 807/* MAC80211_HWSIM netlink policy */
 808
 809static const struct nla_policy
 810hwsim_rate_info_policy[HWSIM_RATE_INFO_ATTR_MAX + 1] = {
 811	[HWSIM_RATE_INFO_ATTR_FLAGS] = { .type = NLA_U8 },
 812	[HWSIM_RATE_INFO_ATTR_MCS] = { .type = NLA_U8 },
 813	[HWSIM_RATE_INFO_ATTR_LEGACY] = { .type = NLA_U16 },
 814	[HWSIM_RATE_INFO_ATTR_NSS] = { .type = NLA_U8 },
 815	[HWSIM_RATE_INFO_ATTR_BW] = { .type = NLA_U8 },
 816	[HWSIM_RATE_INFO_ATTR_HE_GI] = { .type = NLA_U8 },
 817	[HWSIM_RATE_INFO_ATTR_HE_DCM] = { .type = NLA_U8 },
 818	[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC] = { .type = NLA_U8 },
 819	[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH] = { .type = NLA_U8 },
 820	[HWSIM_RATE_INFO_ATTR_EHT_GI] = { .type = NLA_U8 },
 821	[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC] = { .type = NLA_U8 },
 822};
 823
 824static const struct nla_policy
 825hwsim_ftm_result_policy[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1] = {
 826	[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON] = { .type = NLA_U32 },
 827	[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX] = { .type = NLA_U16 },
 828	[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS] = { .type = NLA_U32 },
 829	[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES] = { .type = NLA_U32 },
 830	[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME] = { .type = NLA_U8 },
 831	[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP] = { .type = NLA_U8 },
 832	[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION] = { .type = NLA_U8 },
 833	[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
 834	[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG] = { .type = NLA_U32 },
 835	[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD] = { .type = NLA_U32 },
 836	[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 837	[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 838	[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG] = { .type = NLA_U64 },
 839	[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE] = { .type = NLA_U64 },
 840	[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD] = { .type = NLA_U64 },
 841	[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG] = { .type = NLA_U64 },
 842	[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE] = { .type = NLA_U64 },
 843	[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD] = { .type = NLA_U64 },
 844	[NL80211_PMSR_FTM_RESP_ATTR_LCI] = { .type = NLA_STRING },
 845	[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_STRING },
 846};
 847
 848static const struct nla_policy
 849hwsim_pmsr_resp_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 850	[NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_result_policy),
 851};
 852
 853static const struct nla_policy
 854hwsim_pmsr_resp_policy[NL80211_PMSR_RESP_ATTR_MAX + 1] = {
 855	[NL80211_PMSR_RESP_ATTR_STATUS] = { .type = NLA_U32 },
 856	[NL80211_PMSR_RESP_ATTR_HOST_TIME] = { .type = NLA_U64 },
 857	[NL80211_PMSR_RESP_ATTR_AP_TSF] = { .type = NLA_U64 },
 858	[NL80211_PMSR_RESP_ATTR_FINAL] = { .type = NLA_FLAG },
 859	[NL80211_PMSR_RESP_ATTR_DATA] = NLA_POLICY_NESTED(hwsim_pmsr_resp_type_policy),
 860};
 861
 862static const struct nla_policy
 863hwsim_pmsr_peer_result_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 864	[NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 865	[NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_REJECT },
 866	[NL80211_PMSR_PEER_ATTR_REQ] = { .type = NLA_REJECT },
 867	[NL80211_PMSR_PEER_ATTR_RESP] = NLA_POLICY_NESTED(hwsim_pmsr_resp_policy),
 868};
 869
 870static const struct nla_policy
 871hwsim_pmsr_peers_result_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 872	[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 873	[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 874	[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 875	[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 876	[NL80211_PMSR_ATTR_PEERS] = NLA_POLICY_NESTED_ARRAY(hwsim_pmsr_peer_result_policy),
 877};
 878
 879static const struct nla_policy
 880hwsim_ftm_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
 881	[NL80211_PMSR_FTM_CAPA_ATTR_ASAP] = { .type = NLA_FLAG },
 882	[NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP] = { .type = NLA_FLAG },
 883	[NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI] = { .type = NLA_FLAG },
 884	[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC] = { .type = NLA_FLAG },
 885	[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES] = { .type = NLA_U32 },
 886	[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS] = { .type = NLA_U32 },
 887	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT] = NLA_POLICY_MAX(NLA_U8, 15),
 888	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST] = NLA_POLICY_MAX(NLA_U8, 31),
 889	[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 890	[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 891};
 892
 893static const struct nla_policy
 894hwsim_pmsr_capa_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 895	[NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_capa_policy),
 896};
 897
 898static const struct nla_policy
 899hwsim_pmsr_capa_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 900	[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_U32 },
 901	[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_FLAG },
 902	[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_FLAG },
 903	[NL80211_PMSR_ATTR_TYPE_CAPA] = NLA_POLICY_NESTED(hwsim_pmsr_capa_type_policy),
 904	[NL80211_PMSR_ATTR_PEERS] = { .type = NLA_REJECT }, // only for request.
 905};
 906
 907static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
 908	[HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
 909	[HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
 910	[HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
 911			       .len = IEEE80211_MAX_DATA_LEN },
 912	[HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
 913	[HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
 914	[HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
 915	[HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
 916				 .len = IEEE80211_TX_MAX_RATES *
 917					sizeof(struct hwsim_tx_rate)},
 918	[HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
 919	[HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
 920	[HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
 921	[HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 922	[HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
 923	[HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 924	[HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
 925	[HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
 926	[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
 927	[HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
 928	[HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
 929	[HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 930	[HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
 931	[HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 932	[HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
 933	[HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
 934	[HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 935	[HWSIM_ATTR_PMSR_SUPPORT] = NLA_POLICY_NESTED(hwsim_pmsr_capa_policy),
 936	[HWSIM_ATTR_PMSR_RESULT] = NLA_POLICY_NESTED(hwsim_pmsr_peers_result_policy),
 937	[HWSIM_ATTR_MULTI_RADIO] = { .type = NLA_FLAG },
 938	[HWSIM_ATTR_SUPPORT_NAN_DEVICE] = { .type = NLA_FLAG },
 939};
 940
 941#if IS_REACHABLE(CONFIG_VIRTIO)
 942
 943/* MAC80211_HWSIM virtio queues */
 944static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
 945static bool hwsim_virtio_enabled;
 946static DEFINE_SPINLOCK(hwsim_virtio_lock);
 947
 948static void hwsim_virtio_rx_work(struct work_struct *work);
 949static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
 950
 951static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 952			   struct sk_buff *skb)
 953{
 954	struct scatterlist sg[1];
 955	unsigned long flags;
 956	int err;
 957
 958	spin_lock_irqsave(&hwsim_virtio_lock, flags);
 959	if (!hwsim_virtio_enabled) {
 960		err = -ENODEV;
 961		goto out_free;
 962	}
 963
 964	sg_init_one(sg, skb->head, skb_end_offset(skb));
 965	err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
 966				   GFP_ATOMIC);
 967	if (err)
 968		goto out_free;
 969	virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
 970	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 971	return 0;
 972
 973out_free:
 974	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 975	nlmsg_free(skb);
 976	return err;
 977}
 978#else
 979/* cause a linker error if this ends up being needed */
 980extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 981			   struct sk_buff *skb);
 982#define hwsim_virtio_enabled false
 983#endif
 984
 985static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
 986{
 987	switch (bw) {
 988	case NL80211_CHAN_WIDTH_20_NOHT:
 989	case NL80211_CHAN_WIDTH_20:
 990		return 20;
 991	case NL80211_CHAN_WIDTH_40:
 992		return 40;
 993	case NL80211_CHAN_WIDTH_80:
 994		return 80;
 995	case NL80211_CHAN_WIDTH_80P80:
 996	case NL80211_CHAN_WIDTH_160:
 997		return 160;
 998	case NL80211_CHAN_WIDTH_320:
 999		return 320;
1000	case NL80211_CHAN_WIDTH_5:
1001		return 5;
1002	case NL80211_CHAN_WIDTH_10:
1003		return 10;
1004	case NL80211_CHAN_WIDTH_1:
1005		return 1;
1006	case NL80211_CHAN_WIDTH_2:
1007		return 2;
1008	case NL80211_CHAN_WIDTH_4:
1009		return 4;
1010	case NL80211_CHAN_WIDTH_8:
1011		return 8;
1012	case NL80211_CHAN_WIDTH_16:
1013		return 16;
1014	}
1015
1016	return INT_MAX;
1017}
1018
1019static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
1020				    struct sk_buff *skb,
1021				    struct ieee80211_channel *chan);
1022
1023/* sysfs attributes */
1024static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
1025{
1026	struct mac80211_hwsim_data *data = dat;
1027	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1028	struct sk_buff *skb;
1029	struct ieee80211_pspoll *pspoll;
1030
1031	if (!vp->assoc)
1032		return;
1033
1034	wiphy_dbg(data->hw->wiphy,
1035		  "%s: send PS-Poll to %pM for aid %d\n",
1036		  __func__, vp->bssid, vp->aid);
1037
1038	skb = dev_alloc_skb(sizeof(*pspoll));
1039	if (!skb)
1040		return;
1041	pspoll = skb_put(skb, sizeof(*pspoll));
1042	pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1043					    IEEE80211_STYPE_PSPOLL |
1044					    IEEE80211_FCTL_PM);
1045	pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
1046	memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
1047	memcpy(pspoll->ta, mac, ETH_ALEN);
1048
1049	rcu_read_lock();
1050	mac80211_hwsim_tx_frame(data->hw, skb,
1051				rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1052	rcu_read_unlock();
1053}
1054
1055static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
1056				struct ieee80211_vif *vif, int ps)
1057{
1058	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1059	struct sk_buff *skb;
1060	struct ieee80211_hdr *hdr;
1061	struct ieee80211_tx_info *cb;
1062
1063	if (!vp->assoc)
1064		return;
1065
1066	wiphy_dbg(data->hw->wiphy,
1067		  "%s: send data::nullfunc to %pM ps=%d\n",
1068		  __func__, vp->bssid, ps);
1069
1070	skb = dev_alloc_skb(sizeof(*hdr));
1071	if (!skb)
1072		return;
1073	hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
1074	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
1075					 IEEE80211_STYPE_NULLFUNC |
1076					 IEEE80211_FCTL_TODS |
1077					 (ps ? IEEE80211_FCTL_PM : 0));
1078	hdr->duration_id = cpu_to_le16(0);
1079	memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
1080	memcpy(hdr->addr2, mac, ETH_ALEN);
1081	memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
1082
1083	cb = IEEE80211_SKB_CB(skb);
1084	cb->control.rates[0].count = 1;
1085	cb->control.rates[1].idx = -1;
1086
1087	rcu_read_lock();
1088	mac80211_hwsim_tx_frame(data->hw, skb,
1089				rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1090	rcu_read_unlock();
1091}
1092
1093
1094static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
1095				   struct ieee80211_vif *vif)
1096{
1097	struct mac80211_hwsim_data *data = dat;
1098	hwsim_send_nullfunc(data, mac, vif, 1);
1099}
1100
1101static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
1102				      struct ieee80211_vif *vif)
1103{
1104	struct mac80211_hwsim_data *data = dat;
1105	hwsim_send_nullfunc(data, mac, vif, 0);
1106}
1107
1108static int hwsim_fops_ps_read(void *dat, u64 *val)
1109{
1110	struct mac80211_hwsim_data *data = dat;
1111	*val = data->ps;
1112	return 0;
1113}
1114
1115static int hwsim_fops_ps_write(void *dat, u64 val)
1116{
1117	struct mac80211_hwsim_data *data = dat;
1118	enum ps_mode old_ps;
1119
1120	if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
1121	    val != PS_MANUAL_POLL)
1122		return -EINVAL;
1123
1124	if (val == PS_MANUAL_POLL) {
1125		if (data->ps != PS_ENABLED)
1126			return -EINVAL;
1127		local_bh_disable();
1128		ieee80211_iterate_active_interfaces_atomic(
1129			data->hw, IEEE80211_IFACE_ITER_NORMAL,
1130			hwsim_send_ps_poll, data);
1131		local_bh_enable();
1132		return 0;
1133	}
1134	old_ps = data->ps;
1135	data->ps = val;
1136
1137	local_bh_disable();
1138	if (old_ps == PS_DISABLED && val != PS_DISABLED) {
1139		ieee80211_iterate_active_interfaces_atomic(
1140			data->hw, IEEE80211_IFACE_ITER_NORMAL,
1141			hwsim_send_nullfunc_ps, data);
1142	} else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
1143		ieee80211_iterate_active_interfaces_atomic(
1144			data->hw, IEEE80211_IFACE_ITER_NORMAL,
1145			hwsim_send_nullfunc_no_ps, data);
1146	}
1147	local_bh_enable();
1148
1149	return 0;
1150}
1151
1152DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1153			 "%llu\n");
1154
1155static int hwsim_write_simulate_radar(void *dat, u64 val)
1156{
1157	struct mac80211_hwsim_data *data = dat;
1158
1159	ieee80211_radar_detected(data->hw, NULL);
1160
1161	return 0;
1162}
1163
1164DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1165			 hwsim_write_simulate_radar, "%llu\n");
1166
1167static int hwsim_fops_group_read(void *dat, u64 *val)
1168{
1169	struct mac80211_hwsim_data *data = dat;
1170	*val = data->group;
1171	return 0;
1172}
1173
1174static int hwsim_fops_group_write(void *dat, u64 val)
1175{
1176	struct mac80211_hwsim_data *data = dat;
1177	data->group = val;
1178	return 0;
1179}
1180
1181DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1182			 hwsim_fops_group_read, hwsim_fops_group_write,
1183			 "%llx\n");
1184
1185static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1186{
1187	struct mac80211_hwsim_data *data = dat;
1188	*val = data->rx_rssi;
1189	return 0;
1190}
1191
1192static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1193{
1194	struct mac80211_hwsim_data *data = dat;
1195	int rssi = (int)val;
1196
1197	if (rssi >= 0 || rssi < -100)
1198		return -EINVAL;
1199
1200	data->rx_rssi = rssi;
1201	return 0;
1202}
1203
1204DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1205			 hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1206			 "%lld\n");
1207
1208static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1209					struct net_device *dev)
1210{
1211	/* TODO: allow packet injection */
1212	dev_kfree_skb(skb);
1213	return NETDEV_TX_OK;
1214}
1215
1216static inline u64 mac80211_hwsim_get_tsf_raw(void)
1217{
1218	return ktime_to_us(ktime_get_real());
1219}
1220
1221static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1222{
1223	u64 now = mac80211_hwsim_get_tsf_raw();
1224	return cpu_to_le64(now + data->tsf_offset);
1225}
1226
1227static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1228				  struct ieee80211_vif *vif)
1229{
1230	struct mac80211_hwsim_data *data = hw->priv;
1231	return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
1232}
1233
1234static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1235		struct ieee80211_vif *vif, u64 tsf)
1236{
1237	struct mac80211_hwsim_data *data = hw->priv;
1238	u64 now = mac80211_hwsim_get_tsf(hw, vif);
1239	/* MLD not supported here */
1240	u32 bcn_int = data->link_data[0].beacon_int;
1241	u64 delta = abs(tsf - now);
1242	struct ieee80211_bss_conf *conf;
1243
1244	conf = link_conf_dereference_protected(vif, data->link_data[0].link_id);
1245	if (conf && !conf->enable_beacon)
1246		return;
1247
1248	/* adjust after beaconing with new timestamp at old TBTT */
1249	if (tsf > now) {
1250		data->tsf_offset += delta;
1251		data->bcn_delta = do_div(delta, bcn_int);
1252	} else {
1253		data->tsf_offset -= delta;
1254		data->bcn_delta = -(s64)do_div(delta, bcn_int);
1255	}
1256}
1257
1258static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1259				      struct sk_buff *tx_skb,
1260				      struct ieee80211_channel *chan)
1261{
1262	struct mac80211_hwsim_data *data = hw->priv;
1263	struct sk_buff *skb;
1264	struct hwsim_radiotap_hdr *hdr;
1265	u16 flags, bitrate;
1266	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1267	struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
1268
1269	if (!txrate)
1270		bitrate = 0;
1271	else
1272		bitrate = txrate->bitrate;
1273
1274	if (!netif_running(hwsim_mon))
1275		return;
1276
1277	skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1278	if (skb == NULL)
1279		return;
1280
1281	hdr = skb_push(skb, sizeof(*hdr));
1282	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1283	hdr->hdr.it_pad = 0;
1284	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1285	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1286					  (1 << IEEE80211_RADIOTAP_RATE) |
1287					  (1 << IEEE80211_RADIOTAP_TSFT) |
1288					  (1 << IEEE80211_RADIOTAP_CHANNEL));
1289	hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1290	hdr->rt_flags = 0;
1291	hdr->rt_rate = bitrate / 5;
1292	hdr->rt_channel = cpu_to_le16(chan->center_freq);
1293	flags = IEEE80211_CHAN_2GHZ;
1294	if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1295		flags |= IEEE80211_CHAN_OFDM;
1296	else
1297		flags |= IEEE80211_CHAN_CCK;
1298	hdr->rt_chbitmask = cpu_to_le16(flags);
1299
1300	skb->dev = hwsim_mon;
1301	skb_reset_mac_header(skb);
1302	skb->ip_summed = CHECKSUM_UNNECESSARY;
1303	skb->pkt_type = PACKET_OTHERHOST;
1304	skb->protocol = htons(ETH_P_802_2);
1305	memset(skb->cb, 0, sizeof(skb->cb));
1306	netif_rx(skb);
1307}
1308
1309
1310static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
1311				       const u8 *addr)
1312{
1313	struct sk_buff *skb;
1314	struct hwsim_radiotap_ack_hdr *hdr;
1315	u16 flags;
1316	struct ieee80211_hdr *hdr11;
1317
1318	if (!netif_running(hwsim_mon))
1319		return;
1320
1321	skb = dev_alloc_skb(100);
1322	if (skb == NULL)
1323		return;
1324
1325	hdr = skb_put(skb, sizeof(*hdr));
1326	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1327	hdr->hdr.it_pad = 0;
1328	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1329	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1330					  (1 << IEEE80211_RADIOTAP_CHANNEL));
1331	hdr->rt_flags = 0;
1332	hdr->pad = 0;
1333	hdr->rt_channel = cpu_to_le16(chan->center_freq);
1334	flags = IEEE80211_CHAN_2GHZ;
1335	hdr->rt_chbitmask = cpu_to_le16(flags);
1336
1337	hdr11 = skb_put(skb, 10);
1338	hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1339					   IEEE80211_STYPE_ACK);
1340	hdr11->duration_id = cpu_to_le16(0);
1341	memcpy(hdr11->addr1, addr, ETH_ALEN);
1342
1343	skb->dev = hwsim_mon;
1344	skb_reset_mac_header(skb);
1345	skb->ip_summed = CHECKSUM_UNNECESSARY;
1346	skb->pkt_type = PACKET_OTHERHOST;
1347	skb->protocol = htons(ETH_P_802_2);
1348	memset(skb->cb, 0, sizeof(skb->cb));
1349	netif_rx(skb);
1350}
1351
1352struct mac80211_hwsim_addr_match_data {
1353	u8 addr[ETH_ALEN];
1354	bool ret;
1355};
1356
1357static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1358				     struct ieee80211_vif *vif)
1359{
1360	int i;
1361	struct mac80211_hwsim_addr_match_data *md = data;
1362
1363	if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1364		md->ret = true;
1365		return;
1366	}
1367
1368	/* Match the link address */
1369	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1370		struct ieee80211_bss_conf *conf;
1371
1372		conf = rcu_dereference(vif->link_conf[i]);
1373		if (!conf)
1374			continue;
1375
1376		if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1377			md->ret = true;
1378			return;
1379		}
1380	}
1381}
1382
1383static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1384				      const u8 *addr)
1385{
1386	struct mac80211_hwsim_addr_match_data md = {
1387		.ret = false,
1388	};
1389
1390	if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1391		return true;
1392
1393	memcpy(md.addr, addr, ETH_ALEN);
1394
1395	ieee80211_iterate_active_interfaces_atomic(data->hw,
1396						   IEEE80211_IFACE_ITER_NORMAL,
1397						   mac80211_hwsim_addr_iter,
1398						   &md);
1399
1400	return md.ret;
1401}
1402
1403static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1404			   struct sk_buff *skb)
1405{
1406	switch (data->ps) {
1407	case PS_DISABLED:
1408		return true;
1409	case PS_ENABLED:
1410		return false;
1411	case PS_AUTO_POLL:
1412		/* TODO: accept (some) Beacons by default and other frames only
1413		 * if pending PS-Poll has been sent */
1414		return true;
1415	case PS_MANUAL_POLL:
1416		/* Allow unicast frames to own address if there is a pending
1417		 * PS-Poll */
1418		if (data->ps_poll_pending &&
1419		    mac80211_hwsim_addr_match(data, skb->data + 4)) {
1420			data->ps_poll_pending = false;
1421			return true;
1422		}
1423		return false;
1424	}
1425
1426	return true;
1427}
1428
1429static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1430				  struct sk_buff *skb, int portid)
1431{
1432	struct net *net;
1433	bool found = false;
1434	int res = -ENOENT;
1435
1436	rcu_read_lock();
1437	for_each_net_rcu(net) {
1438		if (data->netgroup == hwsim_net_get_netgroup(net)) {
1439			res = genlmsg_unicast(net, skb, portid);
1440			found = true;
1441			break;
1442		}
1443	}
1444	rcu_read_unlock();
1445
1446	if (!found)
1447		nlmsg_free(skb);
1448
1449	return res;
1450}
1451
1452static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1453					 const u8 *addr, bool add)
1454{
1455	struct mac80211_hwsim_data *data = hw->priv;
1456	u32 _portid = READ_ONCE(data->wmediumd);
1457	struct sk_buff *skb;
1458	void *msg_head;
1459
1460	WARN_ON(!is_valid_ether_addr(addr));
1461
1462	if (!_portid && !hwsim_virtio_enabled)
1463		return;
1464
1465	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1466	if (!skb)
1467		return;
1468
1469	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1470			       add ? HWSIM_CMD_ADD_MAC_ADDR :
1471				     HWSIM_CMD_DEL_MAC_ADDR);
1472	if (!msg_head) {
1473		pr_debug("mac80211_hwsim: problem with msg_head\n");
1474		goto nla_put_failure;
1475	}
1476
1477	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1478		    ETH_ALEN, data->addresses[1].addr))
1479		goto nla_put_failure;
1480
1481	if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1482		goto nla_put_failure;
1483
1484	genlmsg_end(skb, msg_head);
1485
1486	if (hwsim_virtio_enabled)
1487		hwsim_tx_virtio(data, skb);
1488	else
1489		hwsim_unicast_netgroup(data, skb, _portid);
1490	return;
1491nla_put_failure:
1492	nlmsg_free(skb);
1493}
1494
1495static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1496{
1497	u16 result = 0;
1498
1499	if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1500		result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1501	if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1502		result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1503	if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1504		result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1505	if (rate->flags & IEEE80211_TX_RC_MCS)
1506		result |= MAC80211_HWSIM_TX_RC_MCS;
1507	if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1508		result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1509	if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1510		result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1511	if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1512		result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1513	if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1514		result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1515	if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1516		result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1517	if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1518		result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1519	if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1520		result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1521
1522	return result;
1523}
1524
1525static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1526				       struct sk_buff *my_skb,
1527				       int dst_portid,
1528				       struct ieee80211_channel *channel)
1529{
1530	struct sk_buff *skb;
1531	struct mac80211_hwsim_data *data = hw->priv;
1532	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1533	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1534	void *msg_head;
1535	unsigned int hwsim_flags = 0;
1536	int i;
1537	struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1538	struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1539	uintptr_t cookie;
1540
1541	if (data->ps != PS_DISABLED)
1542		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1543	/* If the queue contains MAX_QUEUE skb's drop some */
1544	if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1545		/* Dropping until WARN_QUEUE level */
1546		while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1547			ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1548			data->tx_dropped++;
1549		}
1550	}
1551
1552	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1553	if (skb == NULL)
1554		goto nla_put_failure;
1555
1556	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1557			       HWSIM_CMD_FRAME);
1558	if (msg_head == NULL) {
1559		pr_debug("mac80211_hwsim: problem with msg_head\n");
1560		goto nla_put_failure;
1561	}
1562
1563	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1564		    ETH_ALEN, data->addresses[1].addr))
1565		goto nla_put_failure;
1566
1567	/* We get the skb->data */
1568	if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1569		goto nla_put_failure;
1570
1571	/* We get the flags for this transmission, and we translate them to
1572	   wmediumd flags  */
1573
1574	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1575		hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1576
1577	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1578		hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1579
1580	if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1581		goto nla_put_failure;
1582
1583	if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1584		goto nla_put_failure;
1585
1586	/* We get the tx control (rate and retries) info*/
1587
1588	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1589		tx_attempts[i].idx = info->status.rates[i].idx;
1590		tx_attempts_flags[i].idx = info->status.rates[i].idx;
1591		tx_attempts[i].count = info->status.rates[i].count;
1592		tx_attempts_flags[i].flags =
1593				trans_tx_rate_flags_ieee2hwsim(
1594						&info->status.rates[i]);
1595	}
1596
1597	if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1598		    sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1599		    tx_attempts))
1600		goto nla_put_failure;
1601
1602	if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1603		    sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1604		    tx_attempts_flags))
1605		goto nla_put_failure;
1606
1607	/* We create a cookie to identify this skb */
1608	cookie = atomic_inc_return(&data->pending_cookie);
1609	info->rate_driver_data[0] = (void *)cookie;
1610	if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1611		goto nla_put_failure;
1612
1613	genlmsg_end(skb, msg_head);
1614
1615	if (hwsim_virtio_enabled) {
1616		if (hwsim_tx_virtio(data, skb))
1617			goto err_free_txskb;
1618	} else {
1619		if (hwsim_unicast_netgroup(data, skb, dst_portid))
1620			goto err_free_txskb;
1621	}
1622
1623	/* Enqueue the packet */
1624	skb_queue_tail(&data->pending, my_skb);
1625	data->tx_pkts++;
1626	data->tx_bytes += my_skb->len;
1627	return;
1628
1629nla_put_failure:
1630	nlmsg_free(skb);
1631err_free_txskb:
1632	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1633	ieee80211_free_txskb(hw, my_skb);
1634	data->tx_failed++;
1635}
1636
1637static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1638			       struct ieee80211_channel *c2)
1639{
1640	if (!c1 || !c2)
1641		return false;
1642
1643	return c1->center_freq == c2->center_freq;
1644}
1645
1646struct tx_iter_data {
1647	struct ieee80211_channel *channel;
1648	bool receive;
1649};
1650
1651static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1652				   struct ieee80211_vif *vif)
1653{
1654	struct tx_iter_data *data = _data;
1655	int i;
1656
1657	/* For NAN Device simulation purposes, assume that NAN is always
1658	 * on channel 6 or channel 149.
1659	 */
1660	if (vif->type == NL80211_IFTYPE_NAN) {
1661		data->receive = (data->channel &&
1662				 (data->channel->center_freq == 2437 ||
1663				  data->channel->center_freq == 5745));
1664		return;
1665	}
1666
1667	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1668		struct ieee80211_bss_conf *conf;
1669		struct ieee80211_chanctx_conf *chanctx;
1670
1671		conf = rcu_dereference(vif->link_conf[i]);
1672		if (!conf)
1673			continue;
1674
1675		chanctx = rcu_dereference(conf->chanctx_conf);
1676		if (!chanctx)
1677			continue;
1678
1679		if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1680			continue;
1681
1682		data->receive = true;
1683		return;
1684	}
1685}
1686
1687static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1688{
1689	/*
1690	 * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1691	 * e.g. like this:
1692	 * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1693	 * (but you should use a valid OUI, not that)
1694	 *
1695	 * If anyone wants to 'donate' a radiotap OUI/subns code
1696	 * please send a patch removing this #ifdef and changing
1697	 * the values accordingly.
1698	 */
1699#ifdef HWSIM_RADIOTAP_OUI
1700	struct ieee80211_radiotap_vendor_tlv *rtap;
1701	static const char vendor_data[8] = "ABCDEFGH";
1702
1703	// Make sure no padding is needed
1704	BUILD_BUG_ON(sizeof(vendor_data) % 4);
1705	/* this is last radiotap info before the mac header, so
1706	 * skb_reset_mac_header for mac8022 to know the end of
1707	 * the radiotap TLV/beginning of the 802.11 header
1708	 */
1709	skb_reset_mac_header(skb);
1710
1711	/*
1712	 * Note that this code requires the headroom in the SKB
1713	 * that was allocated earlier.
1714	 */
1715	rtap = skb_push(skb, sizeof(*rtap) + sizeof(vendor_data));
1716
1717	rtap->len = cpu_to_le16(sizeof(*rtap) -
1718				sizeof(struct ieee80211_radiotap_tlv) +
1719				sizeof(vendor_data));
1720	rtap->type = cpu_to_le16(IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
1721
1722	rtap->content.oui[0] = HWSIM_RADIOTAP_OUI[0];
1723	rtap->content.oui[1] = HWSIM_RADIOTAP_OUI[1];
1724	rtap->content.oui[2] = HWSIM_RADIOTAP_OUI[2];
1725	rtap->content.oui_subtype = 127;
1726	/* clear reserved field */
1727	rtap->content.reserved = 0;
1728	rtap->content.vendor_type = 0;
1729	memcpy(rtap->content.data, vendor_data, sizeof(vendor_data));
1730
1731	IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
1732#endif
1733}
1734
1735static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1736			      struct ieee80211_rx_status *rx_status,
1737			      struct sk_buff *skb)
1738{
1739	struct ieee80211_hdr *hdr = (void *)skb->data;
1740
1741	if (!ieee80211_has_morefrags(hdr->frame_control) &&
1742	    !is_multicast_ether_addr(hdr->addr1) &&
1743	    (ieee80211_is_mgmt(hdr->frame_control) ||
1744	     ieee80211_is_data(hdr->frame_control))) {
1745		struct ieee80211_sta *sta;
1746		unsigned int link_id;
1747
1748		rcu_read_lock();
1749		sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1750						       hdr->addr1, &link_id);
1751		if (sta) {
1752			struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1753
1754			if (ieee80211_has_pm(hdr->frame_control))
1755				sp->active_links_rx &= ~BIT(link_id);
1756			else
1757				sp->active_links_rx |= BIT(link_id);
1758
1759			rx_status->link_valid = true;
1760			rx_status->link_id = link_id;
1761		}
1762		rcu_read_unlock();
1763	}
1764
1765	memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1766
1767	mac80211_hwsim_add_vendor_rtap(skb);
1768
1769	data->rx_pkts++;
1770	data->rx_bytes += skb->len;
1771	ieee80211_rx_irqsafe(data->hw, skb);
1772}
1773
1774static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1775					  struct sk_buff *skb,
1776					  struct ieee80211_channel *chan)
1777{
1778	struct mac80211_hwsim_data *data = hw->priv, *data2;
1779	bool ack = false;
1780	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1781	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1782	struct ieee80211_rx_status rx_status;
1783	u64 now;
1784
1785	memset(&rx_status, 0, sizeof(rx_status));
1786	rx_status.flag |= RX_FLAG_MACTIME_START;
1787	rx_status.freq = chan->center_freq;
1788	rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1789	rx_status.band = chan->band;
1790	if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1791		rx_status.rate_idx =
1792			ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1793		rx_status.nss =
1794			ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1795		rx_status.encoding = RX_ENC_VHT;
1796	} else {
1797		rx_status.rate_idx = info->control.rates[0].idx;
1798		if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1799			rx_status.encoding = RX_ENC_HT;
1800	}
1801	if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1802		rx_status.bw = RATE_INFO_BW_40;
1803	else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1804		rx_status.bw = RATE_INFO_BW_80;
1805	else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1806		rx_status.bw = RATE_INFO_BW_160;
1807	else
1808		rx_status.bw = RATE_INFO_BW_20;
1809	if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1810		rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1811	/* TODO: simulate optional packet loss */
1812	rx_status.signal = data->rx_rssi;
1813	if (info->control.vif)
1814		rx_status.signal += info->control.vif->bss_conf.txpower;
1815
1816	if (data->ps != PS_DISABLED)
1817		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1818
1819	/* release the skb's source info */
1820	skb_orphan(skb);
1821	skb_dst_drop(skb);
1822	skb->mark = 0;
1823	skb_ext_reset(skb);
1824	nf_reset_ct(skb);
1825
1826	/*
1827	 * Get absolute mactime here so all HWs RX at the "same time", and
1828	 * absolute TX time for beacon mactime so the timestamp matches.
1829	 * Giving beacons a different mactime than non-beacons looks messy, but
1830	 * it helps the Toffset be exact and a ~10us mactime discrepancy
1831	 * probably doesn't really matter.
1832	 */
1833	if (ieee80211_is_beacon(hdr->frame_control) ||
1834	    ieee80211_is_probe_resp(hdr->frame_control)) {
1835		rx_status.boottime_ns = ktime_get_boottime_ns();
1836		now = data->abs_bcn_ts;
1837	} else {
1838		now = mac80211_hwsim_get_tsf_raw();
1839	}
1840
1841	/* Copy skb to all enabled radios that are on the current frequency */
1842	spin_lock(&hwsim_radio_lock);
1843	list_for_each_entry(data2, &hwsim_radios, list) {
1844		struct sk_buff *nskb;
1845		struct tx_iter_data tx_iter_data = {
1846			.receive = false,
1847			.channel = chan,
1848		};
1849
1850		if (data == data2)
1851			continue;
1852
1853		if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1854		    !hwsim_ps_rx_ok(data2, skb))
1855			continue;
1856
1857		if (!(data->group & data2->group))
1858			continue;
1859
1860		if (data->netgroup != data2->netgroup)
1861			continue;
1862
1863		if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1864		    !hwsim_chans_compat(chan, data2->channel)) {
1865			ieee80211_iterate_active_interfaces_atomic(
1866				data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1867				mac80211_hwsim_tx_iter, &tx_iter_data);
1868			if (!tx_iter_data.receive)
1869				continue;
1870		}
1871
1872		/*
1873		 * reserve some space for our vendor and the normal
1874		 * radiotap header, since we're copying anyway
1875		 */
1876		if (skb->len < PAGE_SIZE && paged_rx) {
1877			struct page *page = alloc_page(GFP_ATOMIC);
1878
1879			if (!page)
1880				continue;
1881
1882			nskb = dev_alloc_skb(128);
1883			if (!nskb) {
1884				__free_page(page);
1885				continue;
1886			}
1887
1888			memcpy(page_address(page), skb->data, skb->len);
1889			skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1890		} else {
1891			nskb = skb_copy(skb, GFP_ATOMIC);
1892			if (!nskb)
1893				continue;
1894		}
1895
1896		if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1897			ack = true;
1898
1899		rx_status.mactime = now + data2->tsf_offset;
1900
1901		mac80211_hwsim_rx(data2, &rx_status, nskb);
1902	}
1903	spin_unlock(&hwsim_radio_lock);
1904
1905	return ack;
1906}
1907
1908static struct ieee80211_bss_conf *
1909mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
1910			      struct ieee80211_vif *vif,
1911			      struct ieee80211_sta *sta,
1912			      struct ieee80211_hdr *hdr,
1913			      struct ieee80211_link_sta **link_sta)
1914{
1915	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1916	int i;
1917
1918	if (!ieee80211_vif_is_mld(vif))
1919		return &vif->bss_conf;
1920
1921	WARN_ON(is_multicast_ether_addr(hdr->addr1));
1922
1923	if (WARN_ON_ONCE(!sta || !sta->valid_links))
1924		return &vif->bss_conf;
1925
1926	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1927		struct ieee80211_bss_conf *bss_conf;
1928		unsigned int link_id;
1929
1930		/* round-robin the available link IDs */
1931		link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
1932
1933		if (!(vif->active_links & BIT(link_id)))
1934			continue;
1935
1936		if (!(sp->active_links_rx & BIT(link_id)))
1937			continue;
1938
1939		*link_sta = rcu_dereference(sta->link[link_id]);
1940		if (!*link_sta)
1941			continue;
1942
1943		bss_conf = rcu_dereference(vif->link_conf[link_id]);
1944		if (WARN_ON_ONCE(!bss_conf))
1945			continue;
1946
1947		/* can happen while switching links */
1948		if (!rcu_access_pointer(bss_conf->chanctx_conf))
1949			continue;
1950
1951		sp->last_link = link_id;
1952		return bss_conf;
1953	}
1954
1955	return NULL;
1956}
1957
1958static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1959			      struct ieee80211_tx_control *control,
1960			      struct sk_buff *skb)
1961{
1962	struct mac80211_hwsim_data *data = hw->priv;
1963	struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1964	struct ieee80211_hdr *hdr = (void *)skb->data;
1965	struct ieee80211_chanctx_conf *chanctx_conf;
1966	struct ieee80211_channel *channel;
1967	struct ieee80211_vif *vif = txi->control.vif;
1968	bool ack;
1969	enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1970	u32 _portid, i;
1971
1972	if (WARN_ON(skb->len < 10)) {
1973		/* Should not happen; just a sanity check for addr1 use */
1974		ieee80211_free_txskb(hw, skb);
1975		return;
1976	}
1977
1978	if (vif && vif->type == NL80211_IFTYPE_NAN && !data->tmp_chan) {
1979		/* For NAN Device simulation purposes, assume that NAN is always
1980		 * on channel 6 or channel 149, unless a ROC is in progress (for
1981		 * USD use cases).
1982		 */
1983		if (data->nan_curr_dw_band == NL80211_BAND_2GHZ)
1984			channel = ieee80211_get_channel(hw->wiphy, 2437);
1985		else if (data->nan_curr_dw_band == NL80211_BAND_5GHZ)
1986			channel = ieee80211_get_channel(hw->wiphy, 5745);
1987		else
1988			channel = NULL;
1989
1990		if (WARN_ON(!channel)) {
1991			ieee80211_free_txskb(hw, skb);
1992			return;
1993		}
1994	} else if (!data->use_chanctx) {
1995		channel = data->channel;
1996		confbw = data->bw;
1997	} else if (txi->hw_queue == 4) {
1998		channel = data->tmp_chan;
1999	} else {
2000		u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
2001				       IEEE80211_TX_CTRL_MLO_LINK);
2002		struct ieee80211_link_sta *link_sta = NULL;
2003		struct ieee80211_sta *sta = control->sta;
2004		struct ieee80211_bss_conf *bss_conf;
2005
2006		/* This can happen in case of monitor injection */
2007		if (!vif) {
2008			ieee80211_free_txskb(hw, skb);
2009			return;
2010		}
2011
2012		if (link != IEEE80211_LINK_UNSPECIFIED) {
2013			bss_conf = rcu_dereference(vif->link_conf[link]);
2014			if (sta)
2015				link_sta = rcu_dereference(sta->link[link]);
2016		} else {
2017			bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
2018								 hdr, &link_sta);
2019		}
2020
2021		if (unlikely(!bss_conf)) {
2022			/* if it's an MLO STA, it might have deactivated all
2023			 * links temporarily - but we don't handle real PS in
2024			 * this code yet, so just drop the frame in that case
2025			 */
2026			WARN(link != IEEE80211_LINK_UNSPECIFIED || !sta || !sta->mlo,
2027			     "link:%d, sta:%pM, sta->mlo:%d\n",
2028			     link, sta ? sta->addr : NULL, sta ? sta->mlo : -1);
2029			ieee80211_free_txskb(hw, skb);
2030			return;
2031		}
2032
2033		/* Do address translations only between shared links. It is
2034		 * possible that while an non-AP MLD station and an AP MLD
2035		 * station have shared links, the frame is intended to be sent
2036		 * on a link which is not shared (for example when sending a
2037		 * probe response).
2038		 */
2039		if (sta && sta->mlo && link_sta) {
2040			/* address translation to link addresses on TX */
2041			ether_addr_copy(hdr->addr1, link_sta->addr);
2042			ether_addr_copy(hdr->addr2, bss_conf->addr);
2043			/* translate A3 only if it's the BSSID */
2044			if (!ieee80211_has_tods(hdr->frame_control) &&
2045			    !ieee80211_has_fromds(hdr->frame_control)) {
2046				if (ether_addr_equal(hdr->addr3, sta->addr))
2047					ether_addr_copy(hdr->addr3, link_sta->addr);
2048				else if (ether_addr_equal(hdr->addr3, vif->addr))
2049					ether_addr_copy(hdr->addr3, bss_conf->addr);
2050			}
2051			/* no need to look at A4, if present it's SA */
2052		}
2053
2054		chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
2055		if (chanctx_conf) {
2056			channel = chanctx_conf->def.chan;
2057			confbw = chanctx_conf->def.width;
2058		} else {
2059			channel = NULL;
2060		}
2061	}
2062
2063	if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
2064		ieee80211_free_txskb(hw, skb);
2065		return;
2066	}
2067
2068	if (data->idle && !data->tmp_chan) {
2069		wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
2070		ieee80211_free_txskb(hw, skb);
2071		return;
2072	}
2073
2074	if (vif)
2075		hwsim_check_magic(vif);
2076	if (control->sta)
2077		hwsim_check_sta_magic(control->sta);
2078
2079	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2080		ieee80211_get_tx_rates(vif, control->sta, skb,
2081				       txi->control.rates,
2082				       ARRAY_SIZE(txi->control.rates));
2083
2084	for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
2085		u16 rflags = txi->control.rates[i].flags;
2086		/* initialize to data->bw for 5/10 MHz handling */
2087		enum nl80211_chan_width bw = data->bw;
2088
2089		if (txi->control.rates[i].idx == -1)
2090			break;
2091
2092		if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
2093			bw = NL80211_CHAN_WIDTH_40;
2094		else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
2095			bw = NL80211_CHAN_WIDTH_80;
2096		else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
2097			bw = NL80211_CHAN_WIDTH_160;
2098
2099		if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
2100			return;
2101	}
2102
2103	if (skb->len >= 24 + 8 &&
2104	    ieee80211_is_probe_resp(hdr->frame_control)) {
2105		/* fake header transmission time */
2106		struct ieee80211_mgmt *mgmt;
2107		struct ieee80211_rate *txrate;
2108		/* TODO: get MCS */
2109		int bitrate = 100;
2110		u64 ts;
2111
2112		mgmt = (struct ieee80211_mgmt *)skb->data;
2113		txrate = ieee80211_get_tx_rate(hw, txi);
2114		if (txrate)
2115			bitrate = txrate->bitrate;
2116		ts = mac80211_hwsim_get_tsf_raw();
2117		mgmt->u.probe_resp.timestamp =
2118			cpu_to_le64(ts + data->tsf_offset +
2119				    24 * 8 * 10 / bitrate);
2120	}
2121
2122	mac80211_hwsim_monitor_rx(hw, skb, channel);
2123
2124	/* wmediumd mode check */
2125	_portid = READ_ONCE(data->wmediumd);
2126
2127	if (_portid || hwsim_virtio_enabled)
2128		return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
2129
2130	/* NO wmediumd detected, perfect medium simulation */
2131	data->tx_pkts++;
2132	data->tx_bytes += skb->len;
2133	ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
2134
2135	if (ack && skb->len >= 16)
2136		mac80211_hwsim_monitor_ack(channel, hdr->addr2);
2137
2138	ieee80211_tx_info_clear_status(txi);
2139
2140	/* frame was transmitted at most favorable rate at first attempt */
2141	txi->control.rates[0].count = 1;
2142	txi->control.rates[1].idx = -1;
2143
2144	if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
2145		txi->flags |= IEEE80211_TX_STAT_ACK;
2146	ieee80211_tx_status_irqsafe(hw, skb);
2147}
2148
2149
2150static int mac80211_hwsim_start(struct ieee80211_hw *hw)
2151{
2152	struct mac80211_hwsim_data *data = hw->priv;
2153	wiphy_dbg(hw->wiphy, "%s\n", __func__);
2154	data->started = true;
2155	return 0;
2156}
2157
2158
2159static void mac80211_hwsim_stop(struct ieee80211_hw *hw, bool suspend)
2160{
2161	struct mac80211_hwsim_data *data = hw->priv;
2162	int i;
2163
2164	data->started = false;
2165
2166	for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
2167		hrtimer_cancel(&data->link_data[i].beacon_timer);
2168
2169	while (!skb_queue_empty(&data->pending))
2170		ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
2171
2172	wiphy_dbg(hw->wiphy, "%s\n", __func__);
2173}
2174
2175
2176static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
2177					struct ieee80211_vif *vif)
2178{
2179	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2180		  __func__, ieee80211_vif_type_p2p(vif),
2181		  vif->addr);
2182	hwsim_set_magic(vif);
2183
2184	if (vif->type != NL80211_IFTYPE_MONITOR)
2185		mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
2186
2187	vif->cab_queue = 0;
2188	vif->hw_queue[IEEE80211_AC_VO] = 0;
2189	vif->hw_queue[IEEE80211_AC_VI] = 1;
2190	vif->hw_queue[IEEE80211_AC_BE] = 2;
2191	vif->hw_queue[IEEE80211_AC_BK] = 3;
2192
2193	return 0;
2194}
2195
2196#ifdef CONFIG_MAC80211_DEBUGFS
2197static void
2198mac80211_hwsim_link_add_debugfs(struct ieee80211_hw *hw,
2199				struct ieee80211_vif *vif,
2200				struct ieee80211_bss_conf *link_conf,
2201				struct dentry *dir)
2202{
2203	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2204
2205	debugfs_create_u32("skip_beacons", 0600, dir,
2206			   &vp->skip_beacons[link_conf->link_id]);
2207}
2208#endif
2209
2210static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
2211					   struct ieee80211_vif *vif,
2212					   enum nl80211_iftype newtype,
2213					   bool newp2p)
2214{
2215	newtype = ieee80211_iftype_p2p(newtype, newp2p);
2216	wiphy_dbg(hw->wiphy,
2217		  "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2218		  __func__, ieee80211_vif_type_p2p(vif),
2219		    newtype, vif->addr);
2220	hwsim_check_magic(vif);
2221
2222	/*
2223	 * interface may change from non-AP to AP in
2224	 * which case this needs to be set up again
2225	 */
2226	vif->cab_queue = 0;
2227
2228	return 0;
2229}
2230
2231static void mac80211_hwsim_remove_interface(
2232	struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2233{
2234	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2235		  __func__, ieee80211_vif_type_p2p(vif),
2236		  vif->addr);
2237	hwsim_check_magic(vif);
2238	hwsim_clear_magic(vif);
2239	if (vif->type != NL80211_IFTYPE_MONITOR)
2240		mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2241}
2242
2243static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2244				    struct sk_buff *skb,
2245				    struct ieee80211_channel *chan)
2246{
2247	struct mac80211_hwsim_data *data = hw->priv;
2248	u32 _portid = READ_ONCE(data->wmediumd);
2249
2250	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2251		struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2252		ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2253				       txi->control.rates,
2254				       ARRAY_SIZE(txi->control.rates));
2255	}
2256
2257	mac80211_hwsim_monitor_rx(hw, skb, chan);
2258
2259	if (_portid || hwsim_virtio_enabled)
2260		return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, chan);
2261
2262	data->tx_pkts++;
2263	data->tx_bytes += skb->len;
2264	mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2265	dev_kfree_skb(skb);
2266}
2267
2268static void __mac80211_hwsim_beacon_tx(struct ieee80211_bss_conf *link_conf,
2269				       struct mac80211_hwsim_data *data,
2270				       struct ieee80211_hw *hw,
2271				       struct ieee80211_vif *vif,
2272				       struct sk_buff *skb)
2273{
2274	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2275	struct ieee80211_tx_info *info;
2276	struct ieee80211_rate *txrate;
2277	struct ieee80211_mgmt *mgmt;
2278	/* TODO: get MCS */
2279	int bitrate = 100;
2280
2281	if (vp->skip_beacons[link_conf->link_id]) {
2282		vp->skip_beacons[link_conf->link_id]--;
2283		dev_kfree_skb(skb);
2284		return;
2285	}
2286
2287	info = IEEE80211_SKB_CB(skb);
2288	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2289		ieee80211_get_tx_rates(vif, NULL, skb,
2290				       info->control.rates,
2291				       ARRAY_SIZE(info->control.rates));
2292
2293	txrate = ieee80211_get_tx_rate(hw, info);
2294	if (txrate)
2295		bitrate = txrate->bitrate;
2296
2297	mgmt = (struct ieee80211_mgmt *) skb->data;
2298	/* fake header transmission time */
2299	data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
2300	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2301		struct ieee80211_ext *ext = (void *) mgmt;
2302
2303		ext->u.s1g_beacon.timestamp = cpu_to_le32(data->abs_bcn_ts +
2304							  data->tsf_offset +
2305							  10 * 8 * 10 /
2306							  bitrate);
2307	} else {
2308		mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
2309						       data->tsf_offset +
2310						       24 * 8 * 10 /
2311						       bitrate);
2312	}
2313
2314	mac80211_hwsim_tx_frame(hw, skb,
2315			rcu_dereference(link_conf->chanctx_conf)->def.chan);
2316}
2317
2318static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2319				     struct ieee80211_vif *vif)
2320{
2321	struct mac80211_hwsim_link_data *link_data = arg;
2322	u32 link_id = link_data->link_id;
2323	struct ieee80211_bss_conf *link_conf, *tx_bss_conf;
2324	struct mac80211_hwsim_data *data =
2325		container_of(link_data, struct mac80211_hwsim_data,
2326			     link_data[link_id]);
2327	struct ieee80211_hw *hw = data->hw;
2328	struct sk_buff *skb;
2329
2330	hwsim_check_magic(vif);
2331
2332	link_conf = rcu_dereference(vif->link_conf[link_id]);
2333	if (!link_conf)
2334		return;
2335
2336	if (vif->type != NL80211_IFTYPE_AP &&
2337	    vif->type != NL80211_IFTYPE_MESH_POINT &&
2338	    vif->type != NL80211_IFTYPE_ADHOC &&
2339	    vif->type != NL80211_IFTYPE_OCB)
2340		return;
2341
2342	tx_bss_conf = rcu_access_pointer(link_conf->tx_bss_conf);
2343	if (tx_bss_conf && tx_bss_conf != link_conf)
2344		return;
2345
2346	if (link_conf->ema_ap) {
2347		struct ieee80211_ema_beacons *ema;
2348		u8 i = 0;
2349
2350		ema = ieee80211_beacon_get_template_ema_list(hw, vif, link_id);
2351		if (!ema || !ema->cnt)
2352			return;
2353
2354		for (i = 0; i < ema->cnt; i++) {
2355			__mac80211_hwsim_beacon_tx(link_conf, data, hw, vif,
2356						   ema->bcn[i].skb);
2357			ema->bcn[i].skb = NULL; /* Already freed */
2358		}
2359		ieee80211_beacon_free_ema_list(ema);
2360	} else {
2361		skb = ieee80211_beacon_get(hw, vif, link_id);
2362		if (!skb)
2363			return;
2364
2365		__mac80211_hwsim_beacon_tx(link_conf, data, hw, vif, skb);
2366	}
2367
2368	while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2369		mac80211_hwsim_tx_frame(hw, skb,
2370			rcu_dereference(link_conf->chanctx_conf)->def.chan);
2371	}
2372
2373	if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif, link_id))
2374		ieee80211_csa_finish(vif, link_id);
2375
2376	if (link_conf->color_change_active &&
2377	    ieee80211_beacon_cntdwn_is_complete(vif, link_id))
2378		ieee80211_color_change_finish(vif, link_id);
2379}
2380
2381static enum hrtimer_restart
2382mac80211_hwsim_beacon(struct hrtimer *timer)
2383{
2384	struct mac80211_hwsim_link_data *link_data =
2385		container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2386	struct mac80211_hwsim_data *data =
2387		container_of(link_data, struct mac80211_hwsim_data,
2388			     link_data[link_data->link_id]);
2389	struct ieee80211_hw *hw = data->hw;
2390	u64 bcn_int = link_data->beacon_int;
2391
2392	if (!data->started)
2393		return HRTIMER_NORESTART;
2394
2395	ieee80211_iterate_active_interfaces_atomic(
2396		hw, IEEE80211_IFACE_ITER_NORMAL,
2397		mac80211_hwsim_beacon_tx, link_data);
2398
2399	/* beacon at new TBTT + beacon interval */
2400	if (data->bcn_delta) {
2401		bcn_int -= data->bcn_delta;
2402		data->bcn_delta = 0;
2403	}
2404	hrtimer_forward_now(&link_data->beacon_timer,
2405			    ns_to_ktime(bcn_int * NSEC_PER_USEC));
2406	return HRTIMER_RESTART;
2407}
2408
2409static const char * const hwsim_chanwidths[] = {
2410	[NL80211_CHAN_WIDTH_5] = "ht5",
2411	[NL80211_CHAN_WIDTH_10] = "ht10",
2412	[NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2413	[NL80211_CHAN_WIDTH_20] = "ht20",
2414	[NL80211_CHAN_WIDTH_40] = "ht40",
2415	[NL80211_CHAN_WIDTH_80] = "vht80",
2416	[NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2417	[NL80211_CHAN_WIDTH_160] = "vht160",
2418	[NL80211_CHAN_WIDTH_1] = "1MHz",
2419	[NL80211_CHAN_WIDTH_2] = "2MHz",
2420	[NL80211_CHAN_WIDTH_4] = "4MHz",
2421	[NL80211_CHAN_WIDTH_8] = "8MHz",
2422	[NL80211_CHAN_WIDTH_16] = "16MHz",
2423	[NL80211_CHAN_WIDTH_320] = "eht320",
2424};
2425
2426static int mac80211_hwsim_config(struct ieee80211_hw *hw, int radio_idx,
2427				 u32 changed)
2428{
2429	struct mac80211_hwsim_data *data = hw->priv;
2430	struct ieee80211_conf *conf = &hw->conf;
2431	static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2432		[IEEE80211_SMPS_AUTOMATIC] = "auto",
2433		[IEEE80211_SMPS_OFF] = "off",
2434		[IEEE80211_SMPS_STATIC] = "static",
2435		[IEEE80211_SMPS_DYNAMIC] = "dynamic",
2436	};
2437	int idx;
2438
2439	if (conf->chandef.chan)
2440		wiphy_dbg(hw->wiphy,
2441			  "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2442			  __func__,
2443			  conf->chandef.chan->center_freq,
2444			  conf->chandef.center_freq1,
2445			  conf->chandef.center_freq2,
2446			  hwsim_chanwidths[conf->chandef.width],
2447			  !!(conf->flags & IEEE80211_CONF_IDLE),
2448			  !!(conf->flags & IEEE80211_CONF_PS),
2449			  smps_modes[conf->smps_mode]);
2450	else
2451		wiphy_dbg(hw->wiphy,
2452			  "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2453			  __func__,
2454			  !!(conf->flags & IEEE80211_CONF_IDLE),
2455			  !!(conf->flags & IEEE80211_CONF_PS),
2456			  smps_modes[conf->smps_mode]);
2457
2458	data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2459
2460	WARN_ON(conf->chandef.chan && data->use_chanctx);
2461
2462	mutex_lock(&data->mutex);
2463	if (data->scanning && conf->chandef.chan) {
2464		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2465			if (data->survey_data[idx].channel == data->channel) {
2466				data->survey_data[idx].start =
2467					data->survey_data[idx].next_start;
2468				data->survey_data[idx].end = jiffies;
2469				break;
2470			}
2471		}
2472
2473		data->channel = conf->chandef.chan;
2474		data->bw = conf->chandef.width;
2475
2476		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2477			if (data->survey_data[idx].channel &&
2478			    data->survey_data[idx].channel != data->channel)
2479				continue;
2480			data->survey_data[idx].channel = data->channel;
2481			data->survey_data[idx].next_start = jiffies;
2482			break;
2483		}
2484	} else {
2485		data->channel = conf->chandef.chan;
2486		data->bw = conf->chandef.width;
2487	}
2488	mutex_unlock(&data->mutex);
2489
2490	for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2491		struct mac80211_hwsim_link_data *link_data =
2492			&data->link_data[idx];
2493
2494		if (!data->started || !link_data->beacon_int) {
2495			hrtimer_cancel(&link_data->beacon_timer);
2496		} else if (!hrtimer_active(&link_data->beacon_timer)) {
2497			u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2498			u32 bcn_int = link_data->beacon_int;
2499			u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2500
2501			hrtimer_start(&link_data->beacon_timer,
2502				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2503				      HRTIMER_MODE_REL_SOFT);
2504		}
2505	}
2506
2507	return 0;
2508}
2509
2510
2511static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2512					    unsigned int changed_flags,
2513					    unsigned int *total_flags,u64 multicast)
2514{
2515	struct mac80211_hwsim_data *data = hw->priv;
2516
2517	wiphy_dbg(hw->wiphy, "%s\n", __func__);
2518
2519	data->rx_filter = 0;
2520	if (*total_flags & FIF_ALLMULTI)
2521		data->rx_filter |= FIF_ALLMULTI;
2522	if (*total_flags & FIF_MCAST_ACTION)
2523		data->rx_filter |= FIF_MCAST_ACTION;
2524
2525	*total_flags = data->rx_filter;
2526}
2527
2528static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2529				       struct ieee80211_vif *vif)
2530{
2531	unsigned int *count = data;
2532	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2533
2534	if (vp->bcn_en)
2535		(*count)++;
2536}
2537
2538static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2539					    struct ieee80211_vif *vif,
2540					    u64 changed)
2541{
2542	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2543
2544	hwsim_check_magic(vif);
2545
2546	wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2547		  __func__, changed, vif->addr);
2548
2549	if (changed & BSS_CHANGED_ASSOC) {
2550		wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2551			  vif->cfg.assoc, vif->cfg.aid);
2552		vp->assoc = vif->cfg.assoc;
2553		vp->aid = vif->cfg.aid;
2554	}
2555
2556	if (vif->type == NL80211_IFTYPE_STATION &&
2557	    changed & (BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)) {
2558		u16 usable_links = ieee80211_vif_usable_links(vif);
2559
2560		if (vif->active_links != usable_links)
2561			ieee80211_set_active_links_async(vif, usable_links);
2562	}
2563}
2564
2565static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2566					     struct ieee80211_vif *vif,
2567					     struct ieee80211_bss_conf *info,
2568					     u64 changed)
2569{
2570	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2571	struct mac80211_hwsim_data *data = hw->priv;
2572	unsigned int link_id = info->link_id;
2573	struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2574
2575	hwsim_check_magic(vif);
2576
2577	wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2578		  __func__, (unsigned long long)changed, vif->addr, link_id);
2579
2580	if (changed & BSS_CHANGED_BSSID) {
2581		wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2582			  __func__, info->bssid);
2583		memcpy(vp->bssid, info->bssid, ETH_ALEN);
2584	}
2585
2586	if (changed & BSS_CHANGED_BEACON_ENABLED) {
2587		wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2588			  info->enable_beacon, info->beacon_int);
2589		vp->bcn_en = info->enable_beacon;
2590		if (data->started &&
2591		    !hrtimer_active(&link_data->beacon_timer) &&
2592		    info->enable_beacon) {
2593			u64 tsf, until_tbtt;
2594			u32 bcn_int;
2595			link_data->beacon_int = info->beacon_int * 1024;
2596			tsf = mac80211_hwsim_get_tsf(hw, vif);
2597			bcn_int = link_data->beacon_int;
2598			until_tbtt = bcn_int - do_div(tsf, bcn_int);
2599
2600			hrtimer_start(&link_data->beacon_timer,
2601				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2602				      HRTIMER_MODE_REL_SOFT);
2603		} else if (!info->enable_beacon) {
2604			unsigned int count = 0;
2605			ieee80211_iterate_active_interfaces_atomic(
2606				data->hw, IEEE80211_IFACE_ITER_NORMAL,
2607				mac80211_hwsim_bcn_en_iter, &count);
2608			wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2609				  count);
2610			if (count == 0) {
2611				hrtimer_cancel(&link_data->beacon_timer);
2612				link_data->beacon_int = 0;
2613			}
2614		}
2615	}
2616
2617	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2618		wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2619			  info->use_cts_prot);
2620	}
2621
2622	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2623		wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2624			  info->use_short_preamble);
2625	}
2626
2627	if (changed & BSS_CHANGED_ERP_SLOT) {
2628		wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2629	}
2630
2631	if (changed & BSS_CHANGED_HT) {
2632		wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2633			  info->ht_operation_mode);
2634	}
2635
2636	if (changed & BSS_CHANGED_BASIC_RATES) {
2637		wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2638			  (unsigned long long) info->basic_rates);
2639	}
2640
2641	if (changed & BSS_CHANGED_TXPOWER)
2642		wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2643}
2644
2645static void
2646mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2647			     struct ieee80211_vif *vif,
2648			     struct ieee80211_link_sta *link_sta,
2649			     u32 changed)
2650{
2651	struct mac80211_hwsim_data *data = hw->priv;
2652	struct ieee80211_sta *sta = link_sta->sta;
2653	u32 bw = U32_MAX;
2654	int link_id;
2655
2656	rcu_read_lock();
2657	for (link_id = 0;
2658	     link_id < ARRAY_SIZE(vif->link_conf);
2659	     link_id++) {
2660		enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2661		struct ieee80211_bss_conf *vif_conf;
2662
2663		link_sta = rcu_dereference(sta->link[link_id]);
2664
2665		if (!link_sta)
2666			continue;
2667
2668		switch (link_sta->bandwidth) {
2669#define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2670		C(20);
2671		C(40);
2672		C(80);
2673		C(160);
2674		C(320);
2675#undef C
2676		}
2677
2678		if (!data->use_chanctx) {
2679			confbw = data->bw;
2680		} else {
2681			struct ieee80211_chanctx_conf *chanctx_conf;
2682
2683			vif_conf = rcu_dereference(vif->link_conf[link_id]);
2684			if (WARN_ON(!vif_conf))
2685				continue;
2686
2687			chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2688
2689			if (!WARN_ON(!chanctx_conf))
2690				confbw = chanctx_conf->def.width;
2691		}
2692
2693		WARN(bw > hwsim_get_chanwidth(confbw),
2694		     "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2695		     vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2696		     hwsim_get_chanwidth(data->bw), data->bw);
2697
2698
2699	}
2700	rcu_read_unlock();
2701
2702
2703}
2704
2705static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2706				  struct ieee80211_vif *vif,
2707				  struct ieee80211_sta *sta)
2708{
2709	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2710
2711	hwsim_check_magic(vif);
2712	hwsim_set_sta_magic(sta);
2713	mac80211_hwsim_sta_rc_update(hw, vif, &sta->deflink, 0);
2714
2715	if (sta->valid_links) {
2716		WARN(hweight16(sta->valid_links) > 1,
2717		     "expect to add STA with single link, have 0x%x\n",
2718		     sta->valid_links);
2719		sp->active_links_rx = sta->valid_links;
2720	}
2721
2722	return 0;
2723}
2724
2725static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2726				     struct ieee80211_vif *vif,
2727				     struct ieee80211_sta *sta)
2728{
2729	hwsim_check_magic(vif);
2730	hwsim_clear_sta_magic(sta);
2731
2732	return 0;
2733}
2734
2735static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2736				    struct ieee80211_vif *vif,
2737				    struct ieee80211_sta *sta,
2738				    enum ieee80211_sta_state old_state,
2739				    enum ieee80211_sta_state new_state)
2740{
2741	if (new_state == IEEE80211_STA_NOTEXIST)
2742		return mac80211_hwsim_sta_remove(hw, vif, sta);
2743
2744	if (old_state == IEEE80211_STA_NOTEXIST)
2745		return mac80211_hwsim_sta_add(hw, vif, sta);
2746
2747	/*
2748	 * in an MLO connection, when client is authorized
2749	 * (AP station marked as such), enable all links
2750	 */
2751	if (ieee80211_vif_is_mld(vif) &&
2752	    vif->type == NL80211_IFTYPE_STATION &&
2753	    new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2754		ieee80211_set_active_links_async(vif,
2755						 ieee80211_vif_usable_links(vif));
2756
2757	return 0;
2758}
2759
2760static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2761				      struct ieee80211_vif *vif,
2762				      enum sta_notify_cmd cmd,
2763				      struct ieee80211_sta *sta)
2764{
2765	hwsim_check_magic(vif);
2766
2767	switch (cmd) {
2768	case STA_NOTIFY_SLEEP:
2769	case STA_NOTIFY_AWAKE:
2770		/* TODO: make good use of these flags */
2771		break;
2772	default:
2773		WARN(1, "Invalid sta notify: %d\n", cmd);
2774		break;
2775	}
2776}
2777
2778static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2779				  struct ieee80211_sta *sta,
2780				  bool set)
2781{
2782	hwsim_check_sta_magic(sta);
2783	return 0;
2784}
2785
2786static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2787				  struct ieee80211_vif *vif,
2788				  unsigned int link_id, u16 queue,
2789				  const struct ieee80211_tx_queue_params *params)
2790{
2791	wiphy_dbg(hw->wiphy,
2792		  "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2793		  __func__, queue,
2794		  params->txop, params->cw_min,
2795		  params->cw_max, params->aifs);
2796	return 0;
2797}
2798
2799static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2800				     struct survey_info *survey)
2801{
2802	struct mac80211_hwsim_data *hwsim = hw->priv;
2803
2804	if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2805		return -ENOENT;
2806
2807	mutex_lock(&hwsim->mutex);
2808	survey->channel = hwsim->survey_data[idx].channel;
2809	if (!survey->channel) {
2810		mutex_unlock(&hwsim->mutex);
2811		return -ENOENT;
2812	}
2813
2814	/*
2815	 * Magically conjured dummy values --- this is only ok for simulated hardware.
2816	 *
2817	 * A real driver which cannot determine real values noise MUST NOT
2818	 * report any, especially not a magically conjured ones :-)
2819	 */
2820	survey->filled = SURVEY_INFO_NOISE_DBM |
2821			 SURVEY_INFO_TIME |
2822			 SURVEY_INFO_TIME_BUSY;
2823	survey->noise = -92;
2824	survey->time =
2825		jiffies_to_msecs(hwsim->survey_data[idx].end -
2826				 hwsim->survey_data[idx].start);
2827	/* report 12.5% of channel time is used */
2828	survey->time_busy = survey->time/8;
2829	mutex_unlock(&hwsim->mutex);
2830
2831	return 0;
2832}
2833
2834static enum ieee80211_neg_ttlm_res
2835mac80211_hwsim_can_neg_ttlm(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2836			    struct ieee80211_neg_ttlm *neg_ttlm)
2837{
2838	u32 i;
2839
2840	/* For testing purposes, accept if all TIDs are mapped to the same links
2841	 * set, otherwise reject.
2842	 */
2843	for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) {
2844		if (neg_ttlm->downlink[i] != neg_ttlm->uplink[i] ||
2845		    neg_ttlm->downlink[i] != neg_ttlm->downlink[0])
2846			return NEG_TTLM_RES_REJECT;
2847	}
2848
2849	return NEG_TTLM_RES_ACCEPT;
2850}
2851
2852#ifdef CONFIG_NL80211_TESTMODE
2853/*
2854 * This section contains example code for using netlink
2855 * attributes with the testmode command in nl80211.
2856 */
2857
2858/* These enums need to be kept in sync with userspace */
2859enum hwsim_testmode_attr {
2860	__HWSIM_TM_ATTR_INVALID	= 0,
2861	HWSIM_TM_ATTR_CMD	= 1,
2862	HWSIM_TM_ATTR_PS	= 2,
2863
2864	/* keep last */
2865	__HWSIM_TM_ATTR_AFTER_LAST,
2866	HWSIM_TM_ATTR_MAX	= __HWSIM_TM_ATTR_AFTER_LAST - 1
2867};
2868
2869enum hwsim_testmode_cmd {
2870	HWSIM_TM_CMD_SET_PS		= 0,
2871	HWSIM_TM_CMD_GET_PS		= 1,
2872	HWSIM_TM_CMD_STOP_QUEUES	= 2,
2873	HWSIM_TM_CMD_WAKE_QUEUES	= 3,
2874};
2875
2876static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2877	[HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2878	[HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2879};
2880
2881static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2882				       struct ieee80211_vif *vif,
2883				       void *data, int len)
2884{
2885	struct mac80211_hwsim_data *hwsim = hw->priv;
2886	struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2887	struct sk_buff *skb;
2888	int err, ps;
2889
2890	err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2891				   hwsim_testmode_policy, NULL);
2892	if (err)
2893		return err;
2894
2895	if (!tb[HWSIM_TM_ATTR_CMD])
2896		return -EINVAL;
2897
2898	switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2899	case HWSIM_TM_CMD_SET_PS:
2900		if (!tb[HWSIM_TM_ATTR_PS])
2901			return -EINVAL;
2902		ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2903		return hwsim_fops_ps_write(hwsim, ps);
2904	case HWSIM_TM_CMD_GET_PS:
2905		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2906						nla_total_size(sizeof(u32)));
2907		if (!skb)
2908			return -ENOMEM;
2909		if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2910			goto nla_put_failure;
2911		return cfg80211_testmode_reply(skb);
2912	case HWSIM_TM_CMD_STOP_QUEUES:
2913		ieee80211_stop_queues(hw);
2914		return 0;
2915	case HWSIM_TM_CMD_WAKE_QUEUES:
2916		ieee80211_wake_queues(hw);
2917		return 0;
2918	default:
2919		return -EOPNOTSUPP;
2920	}
2921
2922 nla_put_failure:
2923	kfree_skb(skb);
2924	return -ENOBUFS;
2925}
2926#endif
2927
2928static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2929				       struct ieee80211_vif *vif,
2930				       struct ieee80211_ampdu_params *params)
2931{
2932	struct ieee80211_sta *sta = params->sta;
2933	enum ieee80211_ampdu_mlme_action action = params->action;
2934	u16 tid = params->tid;
2935
2936	switch (action) {
2937	case IEEE80211_AMPDU_TX_START:
2938		return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2939	case IEEE80211_AMPDU_TX_STOP_CONT:
2940	case IEEE80211_AMPDU_TX_STOP_FLUSH:
2941	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2942		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2943		break;
2944	case IEEE80211_AMPDU_TX_OPERATIONAL:
2945		break;
2946	case IEEE80211_AMPDU_RX_START:
2947	case IEEE80211_AMPDU_RX_STOP:
2948		break;
2949	default:
2950		return -EOPNOTSUPP;
2951	}
2952
2953	return 0;
2954}
2955
2956static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2957				 struct ieee80211_vif *vif,
2958				 u32 queues, bool drop)
2959{
2960	/* Not implemented, queues only on kernel side */
2961}
2962
2963static void hw_scan_work(struct work_struct *work)
2964{
2965	struct mac80211_hwsim_data *hwsim =
2966		container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2967	struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2968	int dwell, i;
2969
2970	mutex_lock(&hwsim->mutex);
2971	if (hwsim->scan_chan_idx >= req->n_channels) {
2972		struct cfg80211_scan_info info = {
2973			.aborted = false,
2974		};
2975
2976		wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2977		ieee80211_scan_completed(hwsim->hw, &info);
2978		hwsim->hw_scan_request = NULL;
2979		hwsim->hw_scan_vif = NULL;
2980		hwsim->tmp_chan = NULL;
2981		mutex_unlock(&hwsim->mutex);
2982		mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2983					     false);
2984		return;
2985	}
2986
2987	wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2988		  req->channels[hwsim->scan_chan_idx]->center_freq);
2989
2990	hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2991	if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2992				      IEEE80211_CHAN_RADAR) ||
2993	    !req->n_ssids) {
2994		dwell = 120;
2995	} else {
2996		dwell = 30;
2997		/* send probes */
2998		for (i = 0; i < req->n_ssids; i++) {
2999			struct sk_buff *probe;
3000			struct ieee80211_mgmt *mgmt;
3001
3002			probe = ieee80211_probereq_get(hwsim->hw,
3003						       hwsim->scan_addr,
3004						       req->ssids[i].ssid,
3005						       req->ssids[i].ssid_len,
3006						       req->ie_len);
3007			if (!probe)
3008				continue;
3009
3010			mgmt = (struct ieee80211_mgmt *) probe->data;
3011			memcpy(mgmt->da, req->bssid, ETH_ALEN);
3012			memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
3013
3014			if (req->ie_len)
3015				skb_put_data(probe, req->ie, req->ie_len);
3016
3017			rcu_read_lock();
3018			if (!ieee80211_tx_prepare_skb(hwsim->hw,
3019						      hwsim->hw_scan_vif,
3020						      probe,
3021						      hwsim->tmp_chan->band,
3022						      NULL)) {
3023				rcu_read_unlock();
3024				continue;
3025			}
3026
3027			local_bh_disable();
3028			mac80211_hwsim_tx_frame(hwsim->hw, probe,
3029						hwsim->tmp_chan);
3030			rcu_read_unlock();
3031			local_bh_enable();
3032		}
3033	}
3034	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
3035				     msecs_to_jiffies(dwell));
3036	hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
3037	hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
3038	hwsim->survey_data[hwsim->scan_chan_idx].end =
3039		jiffies + msecs_to_jiffies(dwell);
3040	hwsim->scan_chan_idx++;
3041	mutex_unlock(&hwsim->mutex);
3042}
3043
3044static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
3045				  struct ieee80211_vif *vif,
3046				  struct ieee80211_scan_request *hw_req)
3047{
3048	struct mac80211_hwsim_data *hwsim = hw->priv;
3049	struct cfg80211_scan_request *req = &hw_req->req;
3050
3051	mutex_lock(&hwsim->mutex);
3052	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
3053		mutex_unlock(&hwsim->mutex);
3054		return -EBUSY;
3055	}
3056	hwsim->hw_scan_request = req;
3057	hwsim->hw_scan_vif = vif;
3058	hwsim->scan_chan_idx = 0;
3059	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
3060		get_random_mask_addr(hwsim->scan_addr,
3061				     hw_req->req.mac_addr,
3062				     hw_req->req.mac_addr_mask);
3063	else
3064		memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
3065	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
3066	mutex_unlock(&hwsim->mutex);
3067
3068	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
3069	wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
3070
3071	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
3072
3073	return 0;
3074}
3075
3076static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
3077					  struct ieee80211_vif *vif)
3078{
3079	struct mac80211_hwsim_data *hwsim = hw->priv;
3080	struct cfg80211_scan_info info = {
3081		.aborted = true,
3082	};
3083
3084	wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
3085
3086	cancel_delayed_work_sync(&hwsim->hw_scan);
3087
3088	mutex_lock(&hwsim->mutex);
3089	ieee80211_scan_completed(hwsim->hw, &info);
3090	hwsim->tmp_chan = NULL;
3091	hwsim->hw_scan_request = NULL;
3092	hwsim->hw_scan_vif = NULL;
3093	mutex_unlock(&hwsim->mutex);
3094}
3095
3096static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
3097				   struct ieee80211_vif *vif,
3098				   const u8 *mac_addr)
3099{
3100	struct mac80211_hwsim_data *hwsim = hw->priv;
3101
3102	mutex_lock(&hwsim->mutex);
3103
3104	if (hwsim->scanning) {
3105		pr_debug("two hwsim sw_scans detected!\n");
3106		goto out;
3107	}
3108
3109	pr_debug("hwsim sw_scan request, prepping stuff\n");
3110
3111	memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
3112	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
3113	hwsim->scanning = true;
3114	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
3115
3116out:
3117	mutex_unlock(&hwsim->mutex);
3118}
3119
3120static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
3121					    struct ieee80211_vif *vif)
3122{
3123	struct mac80211_hwsim_data *hwsim = hw->priv;
3124
3125	mutex_lock(&hwsim->mutex);
3126
3127	pr_debug("hwsim sw_scan_complete\n");
3128	hwsim->scanning = false;
3129	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
3130	eth_zero_addr(hwsim->scan_addr);
3131
3132	mutex_unlock(&hwsim->mutex);
3133}
3134
3135static void hw_roc_start(struct work_struct *work)
3136{
3137	struct mac80211_hwsim_data *hwsim =
3138		container_of(work, struct mac80211_hwsim_data, roc_start.work);
3139
3140	mutex_lock(&hwsim->mutex);
3141
3142	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
3143	hwsim->tmp_chan = hwsim->roc_chan;
3144	ieee80211_ready_on_channel(hwsim->hw);
3145
3146	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
3147				     msecs_to_jiffies(hwsim->roc_duration));
3148
3149	mutex_unlock(&hwsim->mutex);
3150}
3151
3152static void hw_roc_done(struct work_struct *work)
3153{
3154	struct mac80211_hwsim_data *hwsim =
3155		container_of(work, struct mac80211_hwsim_data, roc_done.work);
3156
3157	mutex_lock(&hwsim->mutex);
3158	ieee80211_remain_on_channel_expired(hwsim->hw);
3159	hwsim->tmp_chan = NULL;
3160	mutex_unlock(&hwsim->mutex);
3161
3162	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
3163}
3164
3165static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
3166			      struct ieee80211_vif *vif,
3167			      struct ieee80211_channel *chan,
3168			      int duration,
3169			      enum ieee80211_roc_type type)
3170{
3171	struct mac80211_hwsim_data *hwsim = hw->priv;
3172
3173	mutex_lock(&hwsim->mutex);
3174	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
3175		mutex_unlock(&hwsim->mutex);
3176		return -EBUSY;
3177	}
3178
3179	hwsim->roc_chan = chan;
3180	hwsim->roc_duration = duration;
3181	mutex_unlock(&hwsim->mutex);
3182
3183	wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
3184		  chan->center_freq, duration);
3185	ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
3186
3187	return 0;
3188}
3189
3190static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
3191			       struct ieee80211_vif *vif)
3192{
3193	struct mac80211_hwsim_data *hwsim = hw->priv;
3194
3195	cancel_delayed_work_sync(&hwsim->roc_start);
3196	cancel_delayed_work_sync(&hwsim->roc_done);
3197
3198	mutex_lock(&hwsim->mutex);
3199	hwsim->tmp_chan = NULL;
3200	mutex_unlock(&hwsim->mutex);
3201
3202	wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
3203
3204	return 0;
3205}
3206
3207static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
3208				      struct ieee80211_chanctx_conf *ctx)
3209{
3210	hwsim_set_chanctx_magic(ctx);
3211	wiphy_dbg(hw->wiphy,
3212		  "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3213		  ctx->def.chan->center_freq, ctx->def.width,
3214		  ctx->def.center_freq1, ctx->def.center_freq2);
3215	return 0;
3216}
3217
3218static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
3219					  struct ieee80211_chanctx_conf *ctx)
3220{
3221	wiphy_dbg(hw->wiphy,
3222		  "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3223		  ctx->def.chan->center_freq, ctx->def.width,
3224		  ctx->def.center_freq1, ctx->def.center_freq2);
3225	hwsim_check_chanctx_magic(ctx);
3226	hwsim_clear_chanctx_magic(ctx);
3227}
3228
3229static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
3230					  struct ieee80211_chanctx_conf *ctx,
3231					  u32 changed)
3232{
3233	hwsim_check_chanctx_magic(ctx);
3234	wiphy_dbg(hw->wiphy,
3235		  "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3236		  ctx->def.chan->center_freq, ctx->def.width,
3237		  ctx->def.center_freq1, ctx->def.center_freq2);
3238}
3239
3240static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
3241					     struct ieee80211_vif *vif,
3242					     struct ieee80211_bss_conf *link_conf,
3243					     struct ieee80211_chanctx_conf *ctx)
3244{
3245	hwsim_check_magic(vif);
3246	hwsim_check_chanctx_magic(ctx);
3247
3248	/* if we activate a link while already associated wake it up */
3249	if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3250		struct sk_buff *skb;
3251
3252		skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3253		if (skb) {
3254			local_bh_disable();
3255			mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3256			local_bh_enable();
3257		}
3258	}
3259
3260	return 0;
3261}
3262
3263static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
3264						struct ieee80211_vif *vif,
3265						struct ieee80211_bss_conf *link_conf,
3266						struct ieee80211_chanctx_conf *ctx)
3267{
3268	hwsim_check_magic(vif);
3269	hwsim_check_chanctx_magic(ctx);
3270
3271	/* if we deactivate a link while associated suspend it first */
3272	if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3273		struct sk_buff *skb;
3274
3275		skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3276		if (skb) {
3277			struct ieee80211_hdr *hdr = (void *)skb->data;
3278
3279			hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
3280
3281			local_bh_disable();
3282			mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3283			local_bh_enable();
3284		}
3285	}
3286}
3287
3288static int mac80211_hwsim_switch_vif_chanctx(struct ieee80211_hw *hw,
3289					     struct ieee80211_vif_chanctx_switch *vifs,
3290					     int n_vifs,
3291					     enum ieee80211_chanctx_switch_mode mode)
3292{
3293	int i;
3294
3295	if (n_vifs <= 0)
3296		return -EINVAL;
3297
3298	wiphy_dbg(hw->wiphy,
3299		  "switch vif channel context mode: %u\n", mode);
3300
3301	for (i = 0; i < n_vifs; i++) {
3302		hwsim_check_chanctx_magic(vifs[i].old_ctx);
3303		wiphy_dbg(hw->wiphy,
3304			  "switch vif channel context: %d MHz/width: %d/cfreqs:%d/%d MHz -> %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3305			  vifs[i].old_ctx->def.chan->center_freq,
3306			  vifs[i].old_ctx->def.width,
3307			  vifs[i].old_ctx->def.center_freq1,
3308			  vifs[i].old_ctx->def.center_freq2,
3309			  vifs[i].new_ctx->def.chan->center_freq,
3310			  vifs[i].new_ctx->def.width,
3311			  vifs[i].new_ctx->def.center_freq1,
3312			  vifs[i].new_ctx->def.center_freq2);
3313
3314		switch (mode) {
3315		case CHANCTX_SWMODE_REASSIGN_VIF:
3316			hwsim_check_chanctx_magic(vifs[i].new_ctx);
3317			break;
3318		case CHANCTX_SWMODE_SWAP_CONTEXTS:
3319			hwsim_set_chanctx_magic(vifs[i].new_ctx);
3320			hwsim_clear_chanctx_magic(vifs[i].old_ctx);
3321			break;
3322		default:
3323			WARN(1, "Invalid mode %d\n", mode);
3324		}
3325	}
3326	return 0;
3327}
3328
3329static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3330	"tx_pkts_nic",
3331	"tx_bytes_nic",
3332	"rx_pkts_nic",
3333	"rx_bytes_nic",
3334	"d_tx_dropped",
3335	"d_tx_failed",
3336	"d_ps_mode",
3337	"d_group",
3338};
3339
3340#define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3341
3342static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3343					  struct ieee80211_vif *vif,
3344					  u32 sset, u8 *data)
3345{
3346	if (sset == ETH_SS_STATS)
3347		memcpy(data, mac80211_hwsim_gstrings_stats,
3348		       sizeof(mac80211_hwsim_gstrings_stats));
3349}
3350
3351static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3352					    struct ieee80211_vif *vif, int sset)
3353{
3354	if (sset == ETH_SS_STATS)
3355		return MAC80211_HWSIM_SSTATS_LEN;
3356	return 0;
3357}
3358
3359static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3360					struct ieee80211_vif *vif,
3361					struct ethtool_stats *stats, u64 *data)
3362{
3363	struct mac80211_hwsim_data *ar = hw->priv;
3364	int i = 0;
3365
3366	data[i++] = ar->tx_pkts;
3367	data[i++] = ar->tx_bytes;
3368	data[i++] = ar->rx_pkts;
3369	data[i++] = ar->rx_bytes;
3370	data[i++] = ar->tx_dropped;
3371	data[i++] = ar->tx_failed;
3372	data[i++] = ar->ps;
3373	data[i++] = ar->group;
3374
3375	WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3376}
3377
3378static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3379{
3380	return 1;
3381}
3382
3383static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw,
3384					    int radio_idx, u32 value)
3385{
3386	return -EOPNOTSUPP;
3387}
3388
3389static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3390					   struct ieee80211_vif *vif,
3391					   u16 old_links, u16 new_links,
3392					   struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3393{
3394	unsigned long rem = old_links & ~new_links;
3395	unsigned long add = new_links & ~old_links;
3396	int i;
3397
3398	if (!old_links)
3399		rem |= BIT(0);
3400	if (!new_links)
3401		add |= BIT(0);
3402
3403	for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS)
3404		mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3405
3406	for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3407		struct ieee80211_bss_conf *link_conf;
3408
3409		link_conf = link_conf_dereference_protected(vif, i);
3410		if (WARN_ON(!link_conf))
3411			continue;
3412
3413		mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3414	}
3415
3416	return 0;
3417}
3418
3419static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3420					   struct ieee80211_vif *vif,
3421					   struct ieee80211_sta *sta,
3422					   u16 old_links, u16 new_links)
3423{
3424	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3425
3426	hwsim_check_sta_magic(sta);
3427
3428	if (vif->type == NL80211_IFTYPE_STATION)
3429		sp->active_links_rx = new_links;
3430
3431	return 0;
3432}
3433
3434static int mac80211_hwsim_send_pmsr_ftm_request_peer(struct sk_buff *msg,
3435						     struct cfg80211_pmsr_ftm_request_peer *request)
3436{
3437	struct nlattr *ftm;
3438
3439	if (!request->requested)
3440		return -EINVAL;
3441
3442	ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
3443	if (!ftm)
3444		return -ENOBUFS;
3445
3446	if (nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE, request->preamble))
3447		return -ENOBUFS;
3448
3449	if (nla_put_u16(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD, request->burst_period))
3450		return -ENOBUFS;
3451
3452	if (request->asap && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_ASAP))
3453		return -ENOBUFS;
3454
3455	if (request->request_lci && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI))
3456		return -ENOBUFS;
3457
3458	if (request->request_civicloc &&
3459	    nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC))
3460		return -ENOBUFS;
3461
3462	if (request->trigger_based && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED))
3463		return -ENOBUFS;
3464
3465	if (request->non_trigger_based &&
3466	    nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED))
3467		return -ENOBUFS;
3468
3469	if (request->lmr_feedback && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK))
3470		return -ENOBUFS;
3471
3472	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP, request->num_bursts_exp))
3473		return -ENOBUFS;
3474
3475	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3476		return -ENOBUFS;
3477
3478	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST, request->ftms_per_burst))
3479		return -ENOBUFS;
3480
3481	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES, request->ftmr_retries))
3482		return -ENOBUFS;
3483
3484	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3485		return -ENOBUFS;
3486
3487	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, request->bss_color))
3488		return -ENOBUFS;
3489
3490	nla_nest_end(msg, ftm);
3491
3492	return 0;
3493}
3494
3495static int mac80211_hwsim_send_pmsr_request_peer(struct sk_buff *msg,
3496						 struct cfg80211_pmsr_request_peer *request)
3497{
3498	struct nlattr *peer, *chandef, *req, *data;
3499	int err;
3500
3501	peer = nla_nest_start(msg, NL80211_PMSR_ATTR_PEERS);
3502	if (!peer)
3503		return -ENOBUFS;
3504
3505	if (nla_put(msg, NL80211_PMSR_PEER_ATTR_ADDR, ETH_ALEN,
3506		    request->addr))
3507		return -ENOBUFS;
3508
3509	chandef = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_CHAN);
3510	if (!chandef)
3511		return -ENOBUFS;
3512
3513	err = nl80211_send_chandef(msg, &request->chandef);
3514	if (err)
3515		return err;
3516
3517	nla_nest_end(msg, chandef);
3518
3519	req = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_REQ);
3520	if (!req)
3521		return -ENOBUFS;
3522
3523	if (request->report_ap_tsf && nla_put_flag(msg, NL80211_PMSR_REQ_ATTR_GET_AP_TSF))
3524		return -ENOBUFS;
3525
3526	data = nla_nest_start(msg, NL80211_PMSR_REQ_ATTR_DATA);
3527	if (!data)
3528		return -ENOBUFS;
3529
3530	err = mac80211_hwsim_send_pmsr_ftm_request_peer(msg, &request->ftm);
3531	if (err)
3532		return err;
3533
3534	nla_nest_end(msg, data);
3535	nla_nest_end(msg, req);
3536	nla_nest_end(msg, peer);
3537
3538	return 0;
3539}
3540
3541static int mac80211_hwsim_send_pmsr_request(struct sk_buff *msg,
3542					    struct cfg80211_pmsr_request *request)
3543{
3544	struct nlattr *pmsr;
3545	int err;
3546
3547	pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
3548	if (!pmsr)
3549		return -ENOBUFS;
3550
3551	if (nla_put_u32(msg, NL80211_ATTR_TIMEOUT, request->timeout))
3552		return -ENOBUFS;
3553
3554	if (!is_zero_ether_addr(request->mac_addr)) {
3555		if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, request->mac_addr))
3556			return -ENOBUFS;
3557		if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, request->mac_addr_mask))
3558			return -ENOBUFS;
3559	}
3560
3561	for (int i = 0; i < request->n_peers; i++) {
3562		err = mac80211_hwsim_send_pmsr_request_peer(msg, &request->peers[i]);
3563		if (err)
3564			return err;
3565	}
3566
3567	nla_nest_end(msg, pmsr);
3568
3569	return 0;
3570}
3571
3572static int mac80211_hwsim_start_pmsr(struct ieee80211_hw *hw,
3573				     struct ieee80211_vif *vif,
3574				     struct cfg80211_pmsr_request *request)
3575{
3576	struct mac80211_hwsim_data *data;
3577	struct sk_buff *skb = NULL;
3578	struct nlattr *pmsr;
3579	void *msg_head;
3580	u32 _portid;
3581	int err = 0;
3582
3583	data = hw->priv;
3584	_portid = READ_ONCE(data->wmediumd);
3585	if (!_portid && !hwsim_virtio_enabled)
3586		return -EOPNOTSUPP;
3587
3588	mutex_lock(&data->mutex);
3589
3590	if (data->pmsr_request) {
3591		err = -EBUSY;
3592		goto out_free;
3593	}
3594
3595	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3596
3597	if (!skb) {
3598		err = -ENOMEM;
3599		goto out_free;
3600	}
3601
3602	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_START_PMSR);
3603
3604	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
3605		    ETH_ALEN, data->addresses[1].addr)) {
3606		err = -ENOMEM;
3607		goto out_free;
3608	}
3609
3610	pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3611	if (!pmsr) {
3612		err = -ENOMEM;
3613		goto out_free;
3614	}
3615
3616	err = mac80211_hwsim_send_pmsr_request(skb, request);
3617	if (err)
3618		goto out_free;
3619
3620	nla_nest_end(skb, pmsr);
3621
3622	genlmsg_end(skb, msg_head);
3623	if (hwsim_virtio_enabled)
3624		hwsim_tx_virtio(data, skb);
3625	else
3626		hwsim_unicast_netgroup(data, skb, _portid);
3627
3628	data->pmsr_request = request;
3629	data->pmsr_request_wdev = ieee80211_vif_to_wdev(vif);
3630
3631out_free:
3632	if (err && skb)
3633		nlmsg_free(skb);
3634
3635	mutex_unlock(&data->mutex);
3636	return err;
3637}
3638
3639static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
3640				      struct ieee80211_vif *vif,
3641				      struct cfg80211_pmsr_request *request)
3642{
3643	struct mac80211_hwsim_data *data;
3644	struct sk_buff *skb = NULL;
3645	struct nlattr *pmsr;
3646	void *msg_head;
3647	u32 _portid;
3648	int err = 0;
3649
3650	data = hw->priv;
3651	_portid = READ_ONCE(data->wmediumd);
3652	if (!_portid && !hwsim_virtio_enabled)
3653		return;
3654
3655	mutex_lock(&data->mutex);
3656
3657	if (data->pmsr_request != request) {
3658		err = -EINVAL;
3659		goto out;
3660	}
3661
3662	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3663	if (!skb) {
3664		err = -ENOMEM;
3665		goto out;
3666	}
3667
3668	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_ABORT_PMSR);
3669
3670	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER, ETH_ALEN, data->addresses[1].addr))
3671		goto out;
3672
3673	pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3674	if (!pmsr) {
3675		err = -ENOMEM;
3676		goto out;
3677	}
3678
3679	err = mac80211_hwsim_send_pmsr_request(skb, request);
3680	if (err)
3681		goto out;
3682
3683	err = nla_nest_end(skb, pmsr);
3684	if (err)
3685		goto out;
3686
3687	genlmsg_end(skb, msg_head);
3688	if (hwsim_virtio_enabled)
3689		hwsim_tx_virtio(data, skb);
3690	else
3691		hwsim_unicast_netgroup(data, skb, _portid);
3692
3693out:
3694	if (err && skb)
3695		nlmsg_free(skb);
3696
3697	mutex_unlock(&data->mutex);
3698}
3699
3700static int mac80211_hwsim_parse_rate_info(struct nlattr *rateattr,
3701					  struct rate_info *rate_info,
3702					  struct genl_info *info)
3703{
3704	struct nlattr *tb[HWSIM_RATE_INFO_ATTR_MAX + 1];
3705	int ret;
3706
3707	ret = nla_parse_nested(tb, HWSIM_RATE_INFO_ATTR_MAX,
3708			       rateattr, hwsim_rate_info_policy, info->extack);
3709	if (ret)
3710		return ret;
3711
3712	if (tb[HWSIM_RATE_INFO_ATTR_FLAGS])
3713		rate_info->flags = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_FLAGS]);
3714
3715	if (tb[HWSIM_RATE_INFO_ATTR_MCS])
3716		rate_info->mcs = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_MCS]);
3717
3718	if (tb[HWSIM_RATE_INFO_ATTR_LEGACY])
3719		rate_info->legacy = nla_get_u16(tb[HWSIM_RATE_INFO_ATTR_LEGACY]);
3720
3721	if (tb[HWSIM_RATE_INFO_ATTR_NSS])
3722		rate_info->nss = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_NSS]);
3723
3724	if (tb[HWSIM_RATE_INFO_ATTR_BW])
3725		rate_info->bw = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_BW]);
3726
3727	if (tb[HWSIM_RATE_INFO_ATTR_HE_GI])
3728		rate_info->he_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_GI]);
3729
3730	if (tb[HWSIM_RATE_INFO_ATTR_HE_DCM])
3731		rate_info->he_dcm = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_DCM]);
3732
3733	if (tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC])
3734		rate_info->he_ru_alloc =
3735			nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC]);
3736
3737	if (tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH])
3738		rate_info->n_bonded_ch = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH]);
3739
3740	if (tb[HWSIM_RATE_INFO_ATTR_EHT_GI])
3741		rate_info->eht_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_GI]);
3742
3743	if (tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC])
3744		rate_info->eht_ru_alloc = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC]);
3745
3746	return 0;
3747}
3748
3749static int mac80211_hwsim_parse_ftm_result(struct nlattr *ftm,
3750					   struct cfg80211_pmsr_ftm_result *result,
3751					   struct genl_info *info)
3752{
3753	struct nlattr *tb[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1];
3754	int ret;
3755
3756	ret = nla_parse_nested(tb, NL80211_PMSR_FTM_RESP_ATTR_MAX,
3757			       ftm, hwsim_ftm_result_policy, info->extack);
3758	if (ret)
3759		return ret;
3760
3761	if (tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON])
3762		result->failure_reason = nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON]);
3763
3764	if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX])
3765		result->burst_index = nla_get_u16(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX]);
3766
3767	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]) {
3768		result->num_ftmr_attempts_valid = 1;
3769		result->num_ftmr_attempts =
3770			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]);
3771	}
3772
3773	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]) {
3774		result->num_ftmr_successes_valid = 1;
3775		result->num_ftmr_successes =
3776			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]);
3777	}
3778
3779	if (tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME])
3780		result->busy_retry_time =
3781			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME]);
3782
3783	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP])
3784		result->num_bursts_exp = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP]);
3785
3786	if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION])
3787		result->burst_duration = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION]);
3788
3789	if (tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST])
3790		result->ftms_per_burst = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST]);
3791
3792	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]) {
3793		result->rssi_avg_valid = 1;
3794		result->rssi_avg = nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]);
3795	}
3796	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]) {
3797		result->rssi_spread_valid = 1;
3798		result->rssi_spread =
3799			nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]);
3800	}
3801
3802	if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE]) {
3803		result->tx_rate_valid = 1;
3804		ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE],
3805						     &result->tx_rate, info);
3806		if (ret)
3807			return ret;
3808	}
3809
3810	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE]) {
3811		result->rx_rate_valid = 1;
3812		ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE],
3813						     &result->rx_rate, info);
3814		if (ret)
3815			return ret;
3816	}
3817
3818	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]) {
3819		result->rtt_avg_valid = 1;
3820		result->rtt_avg =
3821			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]);
3822	}
3823	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]) {
3824		result->rtt_variance_valid = 1;
3825		result->rtt_variance =
3826			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]);
3827	}
3828	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]) {
3829		result->rtt_spread_valid = 1;
3830		result->rtt_spread =
3831			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]);
3832	}
3833	if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]) {
3834		result->dist_avg_valid = 1;
3835		result->dist_avg =
3836			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]);
3837	}
3838	if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]) {
3839		result->dist_variance_valid = 1;
3840		result->dist_variance =
3841			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]);
3842	}
3843	if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]) {
3844		result->dist_spread_valid = 1;
3845		result->dist_spread =
3846			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]);
3847	}
3848
3849	if (tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]) {
3850		result->lci = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3851		result->lci_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3852	}
3853
3854	if (tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]) {
3855		result->civicloc = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3856		result->civicloc_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3857	}
3858
3859	return 0;
3860}
3861
3862static int mac80211_hwsim_parse_pmsr_resp(struct nlattr *resp,
3863					  struct cfg80211_pmsr_result *result,
3864					  struct genl_info *info)
3865{
3866	struct nlattr *tb[NL80211_PMSR_RESP_ATTR_MAX + 1];
3867	struct nlattr *pmsr;
3868	int rem;
3869	int ret;
3870
3871	ret = nla_parse_nested(tb, NL80211_PMSR_RESP_ATTR_MAX, resp, hwsim_pmsr_resp_policy,
3872			       info->extack);
3873	if (ret)
3874		return ret;
3875
3876	if (tb[NL80211_PMSR_RESP_ATTR_STATUS])
3877		result->status = nla_get_u32(tb[NL80211_PMSR_RESP_ATTR_STATUS]);
3878
3879	if (tb[NL80211_PMSR_RESP_ATTR_HOST_TIME])
3880		result->host_time = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_HOST_TIME]);
3881
3882	if (tb[NL80211_PMSR_RESP_ATTR_AP_TSF]) {
3883		result->ap_tsf_valid = 1;
3884		result->ap_tsf = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_AP_TSF]);
3885	}
3886
3887	result->final = !!tb[NL80211_PMSR_RESP_ATTR_FINAL];
3888
3889	if (!tb[NL80211_PMSR_RESP_ATTR_DATA])
3890		return 0;
3891
3892	nla_for_each_nested(pmsr, tb[NL80211_PMSR_RESP_ATTR_DATA], rem) {
3893		switch (nla_type(pmsr)) {
3894		case NL80211_PMSR_TYPE_FTM:
3895			result->type = NL80211_PMSR_TYPE_FTM;
3896			ret = mac80211_hwsim_parse_ftm_result(pmsr, &result->ftm, info);
3897			if (ret)
3898				return ret;
3899			break;
3900		default:
3901			NL_SET_ERR_MSG_ATTR(info->extack, pmsr, "Unknown pmsr resp type");
3902			return -EINVAL;
3903		}
3904	}
3905
3906	return 0;
3907}
3908
3909static int mac80211_hwsim_parse_pmsr_result(struct nlattr *peer,
3910					    struct cfg80211_pmsr_result *result,
3911					    struct genl_info *info)
3912{
3913	struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];
3914	int ret;
3915
3916	if (!peer)
3917		return -EINVAL;
3918
3919	ret = nla_parse_nested(tb, NL80211_PMSR_PEER_ATTR_MAX, peer,
3920			       hwsim_pmsr_peer_result_policy, info->extack);
3921	if (ret)
3922		return ret;
3923
3924	if (tb[NL80211_PMSR_PEER_ATTR_ADDR])
3925		memcpy(result->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]),
3926		       ETH_ALEN);
3927
3928	if (tb[NL80211_PMSR_PEER_ATTR_RESP]) {
3929		ret = mac80211_hwsim_parse_pmsr_resp(tb[NL80211_PMSR_PEER_ATTR_RESP], result, info);
3930		if (ret)
3931			return ret;
3932	}
3933
3934	return 0;
3935};
3936
3937static int hwsim_pmsr_report_nl(struct sk_buff *msg, struct genl_info *info)
3938{
3939	struct mac80211_hwsim_data *data;
3940	struct nlattr *peers, *peer;
3941	struct nlattr *reqattr;
3942	const u8 *src;
3943	int err;
3944	int rem;
3945
3946	if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER])
3947		return -EINVAL;
3948
3949	src = nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
3950	data = get_hwsim_data_ref_from_addr(src);
3951	if (!data)
3952		return -EINVAL;
3953
3954	mutex_lock(&data->mutex);
3955	if (!data->pmsr_request) {
3956		err = -EINVAL;
3957		goto out;
3958	}
3959
3960	reqattr = info->attrs[HWSIM_ATTR_PMSR_RESULT];
3961	if (!reqattr) {
3962		err = -EINVAL;
3963		goto out;
3964	}
3965
3966	peers = nla_find_nested(reqattr, NL80211_PMSR_ATTR_PEERS);
3967	if (!peers) {
3968		err = -EINVAL;
3969		goto out;
3970	}
3971
3972	nla_for_each_nested(peer, peers, rem) {
3973		struct cfg80211_pmsr_result result = {};
3974
3975		err = mac80211_hwsim_parse_pmsr_result(peer, &result, info);
3976		if (err)
3977			goto out;
3978
3979		cfg80211_pmsr_report(data->pmsr_request_wdev,
3980				     data->pmsr_request, &result, GFP_KERNEL);
3981	}
3982
3983	cfg80211_pmsr_complete(data->pmsr_request_wdev, data->pmsr_request, GFP_KERNEL);
3984
3985	err = 0;
3986out:
3987	data->pmsr_request = NULL;
3988	data->pmsr_request_wdev = NULL;
3989
3990	mutex_unlock(&data->mutex);
3991	return err;
3992}
3993
3994static enum hrtimer_restart
3995mac80211_hwsim_nan_dw_start(struct hrtimer *timer)
3996{
3997	struct mac80211_hwsim_data *data =
3998		container_of(timer, struct mac80211_hwsim_data,
3999			     nan_timer);
4000	struct ieee80211_hw *hw = data->hw;
4001	u64 orig_tsf = mac80211_hwsim_get_tsf(hw, NULL), tsf = orig_tsf;
4002	u32 dw_int = 512 * 1024;
4003	u64 until_dw;
4004
4005	if (!data->nan_device_vif)
4006		return HRTIMER_NORESTART;
4007
4008	if (data->nan_bands & BIT(NL80211_BAND_5GHZ)) {
4009		if (data->nan_curr_dw_band == NL80211_BAND_2GHZ) {
4010			dw_int = 128 * 1024;
4011			data->nan_curr_dw_band = NL80211_BAND_5GHZ;
4012		} else if (data->nan_curr_dw_band == NL80211_BAND_5GHZ) {
4013			data->nan_curr_dw_band = NL80211_BAND_2GHZ;
4014		}
4015	}
4016
4017	until_dw = dw_int - do_div(tsf, dw_int);
4018
4019	/* The timer might fire just before the actual DW, in which case
4020	 * update the timeout to the actual next DW
4021	 */
4022	if (until_dw < dw_int / 2)
4023		until_dw += dw_int;
4024
4025	/* The above do_div() call directly modifies the 'tsf' variable, thus,
4026	 * use a copy so that the print below would show the original TSF.
4027	 */
4028	wiphy_debug(hw->wiphy,
4029		    "%s: tsf=%llx, curr_dw_band=%u, next_dw=%llu\n",
4030		    __func__, orig_tsf, data->nan_curr_dw_band,
4031		    until_dw);
4032
4033	hrtimer_forward_now(&data->nan_timer,
4034			    ns_to_ktime(until_dw * NSEC_PER_USEC));
4035
4036	if (data->notify_dw) {
4037		struct ieee80211_channel *ch;
4038		struct wireless_dev *wdev =
4039			ieee80211_vif_to_wdev(data->nan_device_vif);
4040
4041		if (data->nan_curr_dw_band == NL80211_BAND_5GHZ)
4042			ch = ieee80211_get_channel(hw->wiphy, 5745);
4043		else
4044			ch = ieee80211_get_channel(hw->wiphy, 2437);
4045
4046		cfg80211_next_nan_dw_notif(wdev, ch, GFP_ATOMIC);
4047	}
4048
4049	return HRTIMER_RESTART;
4050}
4051
4052static int mac80211_hwsim_start_nan(struct ieee80211_hw *hw,
4053				    struct ieee80211_vif *vif,
4054				    struct cfg80211_nan_conf *conf)
4055{
4056	struct mac80211_hwsim_data *data = hw->priv;
4057	u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
4058	u32 dw_int = 512 * 1000;
4059	u64 until_dw = dw_int - do_div(tsf, dw_int);
4060	struct wireless_dev *wdev = ieee80211_vif_to_wdev(vif);
4061
4062	if (vif->type != NL80211_IFTYPE_NAN)
4063		return -EINVAL;
4064
4065	if (data->nan_device_vif)
4066		return -EALREADY;
4067
4068	/* set this before starting the timer, as preemption might occur */
4069	data->nan_device_vif = vif;
4070	data->nan_bands = conf->bands;
4071	data->nan_curr_dw_band = NL80211_BAND_2GHZ;
4072
4073	wiphy_debug(hw->wiphy, "nan_started, next_dw=%llu\n",
4074		    until_dw);
4075
4076	hrtimer_start(&data->nan_timer,
4077		      ns_to_ktime(until_dw * NSEC_PER_USEC),
4078		      HRTIMER_MODE_REL_SOFT);
4079
4080	if (conf->cluster_id && !is_zero_ether_addr(conf->cluster_id) &&
4081	    is_zero_ether_addr(hwsim_nan_cluster_id)) {
4082		memcpy(hwsim_nan_cluster_id, conf->cluster_id, ETH_ALEN);
4083	} else if (is_zero_ether_addr(hwsim_nan_cluster_id)) {
4084		hwsim_nan_cluster_id[0] = 0x50;
4085		hwsim_nan_cluster_id[1] = 0x6f;
4086		hwsim_nan_cluster_id[2] = 0x9a;
4087		hwsim_nan_cluster_id[3] = 0x01;
4088		hwsim_nan_cluster_id[4] = get_random_u8();
4089		hwsim_nan_cluster_id[5] = get_random_u8();
4090	}
4091
4092	data->notify_dw = conf->enable_dw_notification;
4093
4094	cfg80211_nan_cluster_joined(wdev, hwsim_nan_cluster_id, true,
4095				    GFP_KERNEL);
4096
4097	return 0;
4098}
4099
4100static int mac80211_hwsim_stop_nan(struct ieee80211_hw *hw,
4101				   struct ieee80211_vif *vif)
4102{
4103	struct mac80211_hwsim_data *data = hw->priv;
4104	struct mac80211_hwsim_data *data2;
4105	bool nan_cluster_running = false;
4106
4107	if (vif->type != NL80211_IFTYPE_NAN || !data->nan_device_vif ||
4108	    data->nan_device_vif != vif)
4109		return -EINVAL;
4110
4111	hrtimer_cancel(&data->nan_timer);
4112	data->nan_device_vif = NULL;
4113
4114	spin_lock_bh(&hwsim_radio_lock);
4115	list_for_each_entry(data2, &hwsim_radios, list) {
4116		if (data2->nan_device_vif) {
4117			nan_cluster_running = true;
4118			break;
4119		}
4120	}
4121	spin_unlock_bh(&hwsim_radio_lock);
4122
4123	if (!nan_cluster_running)
4124		memset(hwsim_nan_cluster_id, 0, ETH_ALEN);
4125
4126	return 0;
4127}
4128
4129static int mac80211_hwsim_change_nan_config(struct ieee80211_hw *hw,
4130					    struct ieee80211_vif *vif,
4131					    struct cfg80211_nan_conf *conf,
4132					    u32 changes)
4133{
4134	struct mac80211_hwsim_data *data = hw->priv;
4135
4136	if (vif->type != NL80211_IFTYPE_NAN)
4137		return -EINVAL;
4138
4139	if (!data->nan_device_vif)
4140		return -EINVAL;
4141
4142	wiphy_debug(hw->wiphy, "nan_config_changed: changes=0x%x\n", changes);
4143
4144	/* Handle only the changes we care about for simulation purposes */
4145	if (changes & CFG80211_NAN_CONF_CHANGED_BANDS) {
4146		data->nan_bands = conf->bands;
4147		data->nan_curr_dw_band = NL80211_BAND_2GHZ;
4148	}
4149
4150	if (changes & CFG80211_NAN_CONF_CHANGED_CONFIG)
4151		data->notify_dw = conf->enable_dw_notification;
4152
4153	return 0;
4154}
4155
4156#ifdef CONFIG_MAC80211_DEBUGFS
4157#define HWSIM_DEBUGFS_OPS					\
4158	.link_add_debugfs = mac80211_hwsim_link_add_debugfs,
4159#else
4160#define HWSIM_DEBUGFS_OPS
4161#endif
4162
4163#define HWSIM_COMMON_OPS					\
4164	.tx = mac80211_hwsim_tx,				\
4165	.wake_tx_queue = ieee80211_handle_wake_tx_queue,	\
4166	.start = mac80211_hwsim_start,				\
4167	.stop = mac80211_hwsim_stop,				\
4168	.add_interface = mac80211_hwsim_add_interface,		\
4169	.change_interface = mac80211_hwsim_change_interface,	\
4170	.remove_interface = mac80211_hwsim_remove_interface,	\
4171	.config = mac80211_hwsim_config,			\
4172	.configure_filter = mac80211_hwsim_configure_filter,	\
4173	.vif_cfg_changed = mac80211_hwsim_vif_info_changed,	\
4174	.link_info_changed = mac80211_hwsim_link_info_changed,  \
4175	.tx_last_beacon = mac80211_hwsim_tx_last_beacon,	\
4176	.sta_notify = mac80211_hwsim_sta_notify,		\
4177	.link_sta_rc_update = mac80211_hwsim_sta_rc_update,	\
4178	.conf_tx = mac80211_hwsim_conf_tx,			\
4179	.get_survey = mac80211_hwsim_get_survey,		\
4180	CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)	\
4181	.ampdu_action = mac80211_hwsim_ampdu_action,		\
4182	.flush = mac80211_hwsim_flush,				\
4183	.get_et_sset_count = mac80211_hwsim_get_et_sset_count,	\
4184	.get_et_stats = mac80211_hwsim_get_et_stats,		\
4185	.get_et_strings = mac80211_hwsim_get_et_strings,	\
4186	.start_pmsr = mac80211_hwsim_start_pmsr,		\
4187	.abort_pmsr = mac80211_hwsim_abort_pmsr,		\
4188	.start_nan = mac80211_hwsim_start_nan,                  \
4189	.stop_nan = mac80211_hwsim_stop_nan,                    \
4190	.nan_change_conf = mac80211_hwsim_change_nan_config,    \
4191	HWSIM_DEBUGFS_OPS
4192
4193#define HWSIM_NON_MLO_OPS					\
4194	.sta_add = mac80211_hwsim_sta_add,			\
4195	.sta_remove = mac80211_hwsim_sta_remove,		\
4196	.set_tim = mac80211_hwsim_set_tim,			\
4197	.get_tsf = mac80211_hwsim_get_tsf,			\
4198	.set_tsf = mac80211_hwsim_set_tsf,
4199
4200static const struct ieee80211_ops mac80211_hwsim_ops = {
4201	HWSIM_COMMON_OPS
4202	HWSIM_NON_MLO_OPS
4203	.sw_scan_start = mac80211_hwsim_sw_scan,
4204	.sw_scan_complete = mac80211_hwsim_sw_scan_complete,
4205	.add_chanctx = ieee80211_emulate_add_chanctx,
4206	.remove_chanctx = ieee80211_emulate_remove_chanctx,
4207	.change_chanctx = ieee80211_emulate_change_chanctx,
4208	.switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx,
4209};
4210
4211#define HWSIM_CHANCTX_OPS					\
4212	.hw_scan = mac80211_hwsim_hw_scan,			\
4213	.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,	\
4214	.remain_on_channel = mac80211_hwsim_roc,		\
4215	.cancel_remain_on_channel = mac80211_hwsim_croc,	\
4216	.add_chanctx = mac80211_hwsim_add_chanctx,		\
4217	.remove_chanctx = mac80211_hwsim_remove_chanctx,	\
4218	.change_chanctx = mac80211_hwsim_change_chanctx,	\
4219	.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
4220	.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx, \
4221	.switch_vif_chanctx = mac80211_hwsim_switch_vif_chanctx,
4222
4223static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
4224	HWSIM_COMMON_OPS
4225	HWSIM_NON_MLO_OPS
4226	HWSIM_CHANCTX_OPS
4227};
4228
4229static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
4230	HWSIM_COMMON_OPS
4231	HWSIM_CHANCTX_OPS
4232	.set_rts_threshold = mac80211_hwsim_set_rts_threshold,
4233	.change_vif_links = mac80211_hwsim_change_vif_links,
4234	.change_sta_links = mac80211_hwsim_change_sta_links,
4235	.sta_state = mac80211_hwsim_sta_state,
4236	.can_neg_ttlm = mac80211_hwsim_can_neg_ttlm,
4237};
4238
4239struct hwsim_new_radio_params {
4240	unsigned int channels;
4241	const char *reg_alpha2;
4242	const struct ieee80211_regdomain *regd;
4243	bool reg_strict;
4244	bool p2p_device;
4245	bool use_chanctx;
4246	bool multi_radio;
4247	bool destroy_on_close;
4248	const char *hwname;
4249	bool no_vif;
4250	const u8 *perm_addr;
4251	u32 iftypes;
4252	u32 *ciphers;
4253	u8 n_ciphers;
4254	bool mlo;
4255	const struct cfg80211_pmsr_capabilities *pmsr_capa;
4256	bool nan_device;
4257};
4258
4259static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
4260				   struct genl_info *info)
4261{
4262	if (info)
4263		genl_notify(&hwsim_genl_family, mcast_skb, info,
4264			    HWSIM_MCGRP_CONFIG, GFP_KERNEL);
4265	else
4266		genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
4267				  HWSIM_MCGRP_CONFIG, GFP_KERNEL);
4268}
4269
4270static int append_radio_msg(struct sk_buff *skb, int id,
4271			    struct hwsim_new_radio_params *param)
4272{
4273	int ret;
4274
4275	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
4276	if (ret < 0)
4277		return ret;
4278
4279	if (param->channels) {
4280		ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
4281		if (ret < 0)
4282			return ret;
4283	}
4284
4285	if (param->reg_alpha2) {
4286		ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
4287			      param->reg_alpha2);
4288		if (ret < 0)
4289			return ret;
4290	}
4291
4292	if (param->regd) {
4293		int i;
4294
4295		for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
4296			if (hwsim_world_regdom_custom[i] != param->regd)
4297				continue;
4298
4299			ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
4300			if (ret < 0)
4301				return ret;
4302			break;
4303		}
4304	}
4305
4306	if (param->reg_strict) {
4307		ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
4308		if (ret < 0)
4309			return ret;
4310	}
4311
4312	if (param->p2p_device) {
4313		ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
4314		if (ret < 0)
4315			return ret;
4316	}
4317
4318	if (param->use_chanctx) {
4319		ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
4320		if (ret < 0)
4321			return ret;
4322	}
4323
4324	if (param->multi_radio) {
4325		ret = nla_put_flag(skb, HWSIM_ATTR_MULTI_RADIO);
4326		if (ret < 0)
4327			return ret;
4328	}
4329
4330	if (param->hwname) {
4331		ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
4332			      strlen(param->hwname), param->hwname);
4333		if (ret < 0)
4334			return ret;
4335	}
4336
4337	if (param->nan_device) {
4338		ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_NAN_DEVICE);
4339		if (ret < 0)
4340			return ret;
4341	}
4342	return 0;
4343}
4344
4345static void hwsim_mcast_new_radio(int id, struct genl_info *info,
4346				  struct hwsim_new_radio_params *param)
4347{
4348	struct sk_buff *mcast_skb;
4349	void *data;
4350
4351	mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4352	if (!mcast_skb)
4353		return;
4354
4355	data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
4356			   HWSIM_CMD_NEW_RADIO);
4357	if (!data)
4358		goto out_err;
4359
4360	if (append_radio_msg(mcast_skb, id, param) < 0)
4361		goto out_err;
4362
4363	genlmsg_end(mcast_skb, data);
4364
4365	hwsim_mcast_config_msg(mcast_skb, info);
4366	return;
4367
4368out_err:
4369	nlmsg_free(mcast_skb);
4370}
4371
4372static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
4373	{
4374		.types_mask = BIT(NL80211_IFTYPE_STATION) |
4375			      BIT(NL80211_IFTYPE_P2P_CLIENT),
4376		.he_cap = {
4377			.has_he = true,
4378			.he_cap_elem = {
4379				.mac_cap_info[0] =
4380					IEEE80211_HE_MAC_CAP0_HTC_HE,
4381				.mac_cap_info[1] =
4382					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4383					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4384				.mac_cap_info[2] =
4385					IEEE80211_HE_MAC_CAP2_BSR |
4386					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4387					IEEE80211_HE_MAC_CAP2_ACK_EN,
4388				.mac_cap_info[3] =
4389					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4390					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4391				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4392				.phy_cap_info[0] =
4393					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4394				.phy_cap_info[1] =
4395					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4396					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4397					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4398					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4399				.phy_cap_info[2] =
4400					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4401					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4402					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4403					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4404					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4405
4406				/* Leave all the other PHY capability bytes
4407				 * unset, as DCM, beam forming, RU and PPE
4408				 * threshold information are not supported
4409				 */
4410			},
4411			.he_mcs_nss_supp = {
4412				.rx_mcs_80 = cpu_to_le16(0xfffa),
4413				.tx_mcs_80 = cpu_to_le16(0xfffa),
4414				.rx_mcs_160 = cpu_to_le16(0xffff),
4415				.tx_mcs_160 = cpu_to_le16(0xffff),
4416				.rx_mcs_80p80 = cpu_to_le16(0xffff),
4417				.tx_mcs_80p80 = cpu_to_le16(0xffff),
4418			},
4419		},
4420		.eht_cap = {
4421			.has_eht = true,
4422			.eht_cap_elem = {
4423				.mac_cap_info[0] =
4424					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4425					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4426					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4427				.phy_cap_info[0] =
4428					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4429					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4430					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4431					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4432					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4433				.phy_cap_info[3] =
4434					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4435					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4436					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4437					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4438					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4439					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4440					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4441				.phy_cap_info[4] =
4442					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4443					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4444					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4445					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4446					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4447				.phy_cap_info[5] =
4448					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4449					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4450					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4451					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4452					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4453					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4454				.phy_cap_info[6] =
4455					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4456					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4457				.phy_cap_info[7] =
4458					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4459			},
4460
4461			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4462			 * Rx
4463			 */
4464			.eht_mcs_nss_supp = {
4465				/*
4466				 * Since B0, B1, B2 and B3 are not set in
4467				 * the supported channel width set field in the
4468				 * HE PHY capabilities information field the
4469				 * device is a 20MHz only device on 2.4GHz band.
4470				 */
4471				.only_20mhz = {
4472					.rx_tx_mcs7_max_nss = 0x88,
4473					.rx_tx_mcs9_max_nss = 0x88,
4474					.rx_tx_mcs11_max_nss = 0x88,
4475					.rx_tx_mcs13_max_nss = 0x88,
4476				},
4477			},
4478			/* PPE threshold information is not supported */
4479		},
4480	},
4481	{
4482		.types_mask = BIT(NL80211_IFTYPE_AP) |
4483			      BIT(NL80211_IFTYPE_P2P_GO),
4484		.he_cap = {
4485			.has_he = true,
4486			.he_cap_elem = {
4487				.mac_cap_info[0] =
4488					IEEE80211_HE_MAC_CAP0_HTC_HE,
4489				.mac_cap_info[1] =
4490					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4491					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4492				.mac_cap_info[2] =
4493					IEEE80211_HE_MAC_CAP2_BSR |
4494					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4495					IEEE80211_HE_MAC_CAP2_ACK_EN,
4496				.mac_cap_info[3] =
4497					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4498					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4499				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4500				.phy_cap_info[0] =
4501					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4502				.phy_cap_info[1] =
4503					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4504					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4505					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4506					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4507				.phy_cap_info[2] =
4508					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4509					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4510					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4511					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4512					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4513
4514				/* Leave all the other PHY capability bytes
4515				 * unset, as DCM, beam forming, RU and PPE
4516				 * threshold information are not supported
4517				 */
4518			},
4519			.he_mcs_nss_supp = {
4520				.rx_mcs_80 = cpu_to_le16(0xfffa),
4521				.tx_mcs_80 = cpu_to_le16(0xfffa),
4522				.rx_mcs_160 = cpu_to_le16(0xffff),
4523				.tx_mcs_160 = cpu_to_le16(0xffff),
4524				.rx_mcs_80p80 = cpu_to_le16(0xffff),
4525				.tx_mcs_80p80 = cpu_to_le16(0xffff),
4526			},
4527		},
4528		.eht_cap = {
4529			.has_eht = true,
4530			.eht_cap_elem = {
4531				.mac_cap_info[0] =
4532					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4533					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4534					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4535				.phy_cap_info[0] =
4536					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4537					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4538					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4539					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4540					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4541				.phy_cap_info[3] =
4542					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4543					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4544					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4545					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4546					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4547					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4548					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4549				.phy_cap_info[4] =
4550					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4551					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4552					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4553					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4554					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4555				.phy_cap_info[5] =
4556					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4557					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4558					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4559					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4560					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4561					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4562				.phy_cap_info[6] =
4563					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4564					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4565				.phy_cap_info[7] =
4566					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4567			},
4568
4569			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4570			 * Rx
4571			 */
4572			.eht_mcs_nss_supp = {
4573				/*
4574				 * Since B0, B1, B2 and B3 are not set in
4575				 * the supported channel width set field in the
4576				 * HE PHY capabilities information field the
4577				 * device is a 20MHz only device on 2.4GHz band.
4578				 */
4579				.only_20mhz = {
4580					.rx_tx_mcs7_max_nss = 0x88,
4581					.rx_tx_mcs9_max_nss = 0x88,
4582					.rx_tx_mcs11_max_nss = 0x88,
4583					.rx_tx_mcs13_max_nss = 0x88,
4584				},
4585			},
4586			/* PPE threshold information is not supported */
4587		},
4588	},
4589#ifdef CONFIG_MAC80211_MESH
4590	{
4591		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4592		.he_cap = {
4593			.has_he = true,
4594			.he_cap_elem = {
4595				.mac_cap_info[0] =
4596					IEEE80211_HE_MAC_CAP0_HTC_HE,
4597				.mac_cap_info[1] =
4598					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4599				.mac_cap_info[2] =
4600					IEEE80211_HE_MAC_CAP2_ACK_EN,
4601				.mac_cap_info[3] =
4602					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4603					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4604				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4605				.phy_cap_info[0] =
4606					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4607				.phy_cap_info[1] =
4608					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4609					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4610					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4611					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4612				.phy_cap_info[2] = 0,
4613
4614				/* Leave all the other PHY capability bytes
4615				 * unset, as DCM, beam forming, RU and PPE
4616				 * threshold information are not supported
4617				 */
4618			},
4619			.he_mcs_nss_supp = {
4620				.rx_mcs_80 = cpu_to_le16(0xfffa),
4621				.tx_mcs_80 = cpu_to_le16(0xfffa),
4622				.rx_mcs_160 = cpu_to_le16(0xffff),
4623				.tx_mcs_160 = cpu_to_le16(0xffff),
4624				.rx_mcs_80p80 = cpu_to_le16(0xffff),
4625				.tx_mcs_80p80 = cpu_to_le16(0xffff),
4626			},
4627		},
4628	},
4629#endif
4630};
4631
4632static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
4633	{
4634		.types_mask = BIT(NL80211_IFTYPE_STATION) |
4635			      BIT(NL80211_IFTYPE_P2P_CLIENT),
4636		.he_cap = {
4637			.has_he = true,
4638			.he_cap_elem = {
4639				.mac_cap_info[0] =
4640					IEEE80211_HE_MAC_CAP0_HTC_HE,
4641				.mac_cap_info[1] =
4642					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4643					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4644				.mac_cap_info[2] =
4645					IEEE80211_HE_MAC_CAP2_BSR |
4646					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4647					IEEE80211_HE_MAC_CAP2_ACK_EN,
4648				.mac_cap_info[3] =
4649					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4650					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4651				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4652				.phy_cap_info[0] =
4653					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4654					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4655					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4656				.phy_cap_info[1] =
4657					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4658					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4659					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4660					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4661				.phy_cap_info[2] =
4662					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4663					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4664					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4665					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4666					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4667
4668				/* Leave all the other PHY capability bytes
4669				 * unset, as DCM, beam forming, RU and PPE
4670				 * threshold information are not supported
4671				 */
4672			},
4673			.he_mcs_nss_supp = {
4674				.rx_mcs_80 = cpu_to_le16(0xfffa),
4675				.tx_mcs_80 = cpu_to_le16(0xfffa),
4676				.rx_mcs_160 = cpu_to_le16(0xfffa),
4677				.tx_mcs_160 = cpu_to_le16(0xfffa),
4678				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4679				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4680			},
4681		},
4682		.eht_cap = {
4683			.has_eht = true,
4684			.eht_cap_elem = {
4685				.mac_cap_info[0] =
4686					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4687					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4688					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4689				.phy_cap_info[0] =
4690					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4691					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4692					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4693					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4694					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4695					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4696				.phy_cap_info[1] =
4697					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4698					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4699				.phy_cap_info[2] =
4700					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4701					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4702				.phy_cap_info[3] =
4703					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4704					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4705					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4706					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4707					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4708					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4709					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4710				.phy_cap_info[4] =
4711					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4712					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4713					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4714					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4715					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4716				.phy_cap_info[5] =
4717					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4718					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4719					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4720					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4721					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4722					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4723				.phy_cap_info[6] =
4724					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4725					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4726				.phy_cap_info[7] =
4727					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4728					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4729					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4730					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4731					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4732			},
4733
4734			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4735			 * Rx
4736			 */
4737			.eht_mcs_nss_supp = {
4738				/*
4739				 * As B1 and B2 are set in the supported
4740				 * channel width set field in the HE PHY
4741				 * capabilities information field include all
4742				 * the following MCS/NSS.
4743				 */
4744				.bw._80 = {
4745					.rx_tx_mcs9_max_nss = 0x88,
4746					.rx_tx_mcs11_max_nss = 0x88,
4747					.rx_tx_mcs13_max_nss = 0x88,
4748				},
4749				.bw._160 = {
4750					.rx_tx_mcs9_max_nss = 0x88,
4751					.rx_tx_mcs11_max_nss = 0x88,
4752					.rx_tx_mcs13_max_nss = 0x88,
4753				},
4754			},
4755			/* PPE threshold information is not supported */
4756		},
4757	},
4758	{
4759		.types_mask = BIT(NL80211_IFTYPE_AP) |
4760			      BIT(NL80211_IFTYPE_P2P_GO),
4761		.he_cap = {
4762			.has_he = true,
4763			.he_cap_elem = {
4764				.mac_cap_info[0] =
4765					IEEE80211_HE_MAC_CAP0_HTC_HE,
4766				.mac_cap_info[1] =
4767					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4768					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4769				.mac_cap_info[2] =
4770					IEEE80211_HE_MAC_CAP2_BSR |
4771					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4772					IEEE80211_HE_MAC_CAP2_ACK_EN,
4773				.mac_cap_info[3] =
4774					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4775					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4776				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4777				.phy_cap_info[0] =
4778					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4779					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4780					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4781				.phy_cap_info[1] =
4782					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4783					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4784					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4785					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4786				.phy_cap_info[2] =
4787					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4788					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4789					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4790					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4791					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4792
4793				/* Leave all the other PHY capability bytes
4794				 * unset, as DCM, beam forming, RU and PPE
4795				 * threshold information are not supported
4796				 */
4797			},
4798			.he_mcs_nss_supp = {
4799				.rx_mcs_80 = cpu_to_le16(0xfffa),
4800				.tx_mcs_80 = cpu_to_le16(0xfffa),
4801				.rx_mcs_160 = cpu_to_le16(0xfffa),
4802				.tx_mcs_160 = cpu_to_le16(0xfffa),
4803				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4804				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4805			},
4806		},
4807		.eht_cap = {
4808			.has_eht = true,
4809			.eht_cap_elem = {
4810				.mac_cap_info[0] =
4811					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4812					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4813					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4814				.phy_cap_info[0] =
4815					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4816					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4817					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4818					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4819					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4820					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4821				.phy_cap_info[1] =
4822					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4823					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4824				.phy_cap_info[2] =
4825					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4826					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4827				.phy_cap_info[3] =
4828					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4829					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4830					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4831					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4832					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4833					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4834					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4835				.phy_cap_info[4] =
4836					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4837					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4838					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4839					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4840					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4841				.phy_cap_info[5] =
4842					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4843					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4844					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4845					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4846					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4847					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4848				.phy_cap_info[6] =
4849					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4850					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4851				.phy_cap_info[7] =
4852					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4853					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4854					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4855					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4856					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4857			},
4858
4859			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4860			 * Rx
4861			 */
4862			.eht_mcs_nss_supp = {
4863				/*
4864				 * As B1 and B2 are set in the supported
4865				 * channel width set field in the HE PHY
4866				 * capabilities information field include all
4867				 * the following MCS/NSS.
4868				 */
4869				.bw._80 = {
4870					.rx_tx_mcs9_max_nss = 0x88,
4871					.rx_tx_mcs11_max_nss = 0x88,
4872					.rx_tx_mcs13_max_nss = 0x88,
4873				},
4874				.bw._160 = {
4875					.rx_tx_mcs9_max_nss = 0x88,
4876					.rx_tx_mcs11_max_nss = 0x88,
4877					.rx_tx_mcs13_max_nss = 0x88,
4878				},
4879			},
4880			/* PPE threshold information is not supported */
4881		},
4882	},
4883#ifdef CONFIG_MAC80211_MESH
4884	{
4885		/* TODO: should we support other types, e.g., IBSS?*/
4886		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4887		.he_cap = {
4888			.has_he = true,
4889			.he_cap_elem = {
4890				.mac_cap_info[0] =
4891					IEEE80211_HE_MAC_CAP0_HTC_HE,
4892				.mac_cap_info[1] =
4893					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4894				.mac_cap_info[2] =
4895					IEEE80211_HE_MAC_CAP2_ACK_EN,
4896				.mac_cap_info[3] =
4897					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4898					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4899				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4900				.phy_cap_info[0] =
4901					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4902					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4903					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4904				.phy_cap_info[1] =
4905					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4906					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4907					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4908					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4909				.phy_cap_info[2] = 0,
4910
4911				/* Leave all the other PHY capability bytes
4912				 * unset, as DCM, beam forming, RU and PPE
4913				 * threshold information are not supported
4914				 */
4915			},
4916			.he_mcs_nss_supp = {
4917				.rx_mcs_80 = cpu_to_le16(0xfffa),
4918				.tx_mcs_80 = cpu_to_le16(0xfffa),
4919				.rx_mcs_160 = cpu_to_le16(0xfffa),
4920				.tx_mcs_160 = cpu_to_le16(0xfffa),
4921				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4922				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4923			},
4924		},
4925	},
4926#endif
4927};
4928
4929static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
4930	{
4931		.types_mask = BIT(NL80211_IFTYPE_STATION) |
4932			      BIT(NL80211_IFTYPE_P2P_CLIENT),
4933		.he_6ghz_capa = {
4934			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4935					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4936					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4937					    IEEE80211_HE_6GHZ_CAP_SM_PS |
4938					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4939					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4940					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4941		},
4942		.he_cap = {
4943			.has_he = true,
4944			.he_cap_elem = {
4945				.mac_cap_info[0] =
4946					IEEE80211_HE_MAC_CAP0_HTC_HE,
4947				.mac_cap_info[1] =
4948					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4949					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4950				.mac_cap_info[2] =
4951					IEEE80211_HE_MAC_CAP2_BSR |
4952					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4953					IEEE80211_HE_MAC_CAP2_ACK_EN,
4954				.mac_cap_info[3] =
4955					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4956					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4957				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4958				.phy_cap_info[0] =
4959					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4960					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4961					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4962				.phy_cap_info[1] =
4963					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4964					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4965					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4966					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4967				.phy_cap_info[2] =
4968					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4969					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4970					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4971					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4972					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4973
4974				/* Leave all the other PHY capability bytes
4975				 * unset, as DCM, beam forming, RU and PPE
4976				 * threshold information are not supported
4977				 */
4978			},
4979			.he_mcs_nss_supp = {
4980				.rx_mcs_80 = cpu_to_le16(0xfffa),
4981				.tx_mcs_80 = cpu_to_le16(0xfffa),
4982				.rx_mcs_160 = cpu_to_le16(0xfffa),
4983				.tx_mcs_160 = cpu_to_le16(0xfffa),
4984				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4985				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4986			},
4987		},
4988		.eht_cap = {
4989			.has_eht = true,
4990			.eht_cap_elem = {
4991				.mac_cap_info[0] =
4992					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4993					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4994					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4995				.phy_cap_info[0] =
4996					IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4997					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4998					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4999					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
5000					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
5001					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
5002					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
5003				.phy_cap_info[1] =
5004					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
5005					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
5006					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
5007				.phy_cap_info[2] =
5008					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
5009					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
5010					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
5011				.phy_cap_info[3] =
5012					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
5013					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
5014					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
5015					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
5016					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
5017					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
5018					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
5019				.phy_cap_info[4] =
5020					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
5021					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
5022					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
5023					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
5024					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
5025				.phy_cap_info[5] =
5026					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
5027					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
5028					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
5029					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
5030					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
5031					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
5032				.phy_cap_info[6] =
5033					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
5034					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
5035					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
5036				.phy_cap_info[7] =
5037					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
5038					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
5039					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
5040					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
5041					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
5042					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
5043					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
5044			},
5045
5046			/* For all MCS and bandwidth, set 8 NSS for both Tx and
5047			 * Rx
5048			 */
5049			.eht_mcs_nss_supp = {
5050				/*
5051				 * As B1 and B2 are set in the supported
5052				 * channel width set field in the HE PHY
5053				 * capabilities information field and 320MHz in
5054				 * 6GHz is supported include all the following
5055				 * MCS/NSS.
5056				 */
5057				.bw._80 = {
5058					.rx_tx_mcs9_max_nss = 0x88,
5059					.rx_tx_mcs11_max_nss = 0x88,
5060					.rx_tx_mcs13_max_nss = 0x88,
5061				},
5062				.bw._160 = {
5063					.rx_tx_mcs9_max_nss = 0x88,
5064					.rx_tx_mcs11_max_nss = 0x88,
5065					.rx_tx_mcs13_max_nss = 0x88,
5066				},
5067				.bw._320 = {
5068					.rx_tx_mcs9_max_nss = 0x88,
5069					.rx_tx_mcs11_max_nss = 0x88,
5070					.rx_tx_mcs13_max_nss = 0x88,
5071				},
5072			},
5073			/* PPE threshold information is not supported */
5074		},
5075	},
5076	{
5077		.types_mask = BIT(NL80211_IFTYPE_AP) |
5078			      BIT(NL80211_IFTYPE_P2P_GO),
5079		.he_6ghz_capa = {
5080			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
5081					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
5082					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
5083					    IEEE80211_HE_6GHZ_CAP_SM_PS |
5084					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
5085					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
5086					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
5087		},
5088		.he_cap = {
5089			.has_he = true,
5090			.he_cap_elem = {
5091				.mac_cap_info[0] =
5092					IEEE80211_HE_MAC_CAP0_HTC_HE,
5093				.mac_cap_info[1] =
5094					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
5095					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5096				.mac_cap_info[2] =
5097					IEEE80211_HE_MAC_CAP2_BSR |
5098					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
5099					IEEE80211_HE_MAC_CAP2_ACK_EN,
5100				.mac_cap_info[3] =
5101					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5102					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5103				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5104				.phy_cap_info[0] =
5105					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5106					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5107					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5108				.phy_cap_info[1] =
5109					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5110					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5111					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5112					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5113				.phy_cap_info[2] =
5114					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
5115					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
5116					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
5117					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
5118					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
5119
5120				/* Leave all the other PHY capability bytes
5121				 * unset, as DCM, beam forming, RU and PPE
5122				 * threshold information are not supported
5123				 */
5124			},
5125			.he_mcs_nss_supp = {
5126				.rx_mcs_80 = cpu_to_le16(0xfffa),
5127				.tx_mcs_80 = cpu_to_le16(0xfffa),
5128				.rx_mcs_160 = cpu_to_le16(0xfffa),
5129				.tx_mcs_160 = cpu_to_le16(0xfffa),
5130				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
5131				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
5132			},
5133		},
5134		.eht_cap = {
5135			.has_eht = true,
5136			.eht_cap_elem = {
5137				.mac_cap_info[0] =
5138					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
5139					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
5140					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
5141				.phy_cap_info[0] =
5142					IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
5143					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
5144					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
5145					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
5146					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
5147					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
5148					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
5149				.phy_cap_info[1] =
5150					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
5151					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
5152					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
5153				.phy_cap_info[2] =
5154					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
5155					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
5156					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
5157				.phy_cap_info[3] =
5158					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
5159					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
5160					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
5161					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
5162					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
5163					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
5164					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
5165				.phy_cap_info[4] =
5166					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
5167					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
5168					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
5169					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
5170					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
5171				.phy_cap_info[5] =
5172					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
5173					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
5174					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
5175					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
5176					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
5177					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
5178				.phy_cap_info[6] =
5179					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
5180					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
5181					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
5182				.phy_cap_info[7] =
5183					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
5184					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
5185					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
5186					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
5187					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
5188					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
5189					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
5190			},
5191
5192			/* For all MCS and bandwidth, set 8 NSS for both Tx and
5193			 * Rx
5194			 */
5195			.eht_mcs_nss_supp = {
5196				/*
5197				 * As B1 and B2 are set in the supported
5198				 * channel width set field in the HE PHY
5199				 * capabilities information field and 320MHz in
5200				 * 6GHz is supported include all the following
5201				 * MCS/NSS.
5202				 */
5203				.bw._80 = {
5204					.rx_tx_mcs9_max_nss = 0x88,
5205					.rx_tx_mcs11_max_nss = 0x88,
5206					.rx_tx_mcs13_max_nss = 0x88,
5207				},
5208				.bw._160 = {
5209					.rx_tx_mcs9_max_nss = 0x88,
5210					.rx_tx_mcs11_max_nss = 0x88,
5211					.rx_tx_mcs13_max_nss = 0x88,
5212				},
5213				.bw._320 = {
5214					.rx_tx_mcs9_max_nss = 0x88,
5215					.rx_tx_mcs11_max_nss = 0x88,
5216					.rx_tx_mcs13_max_nss = 0x88,
5217				},
5218			},
5219			/* PPE threshold information is not supported */
5220		},
5221	},
5222#ifdef CONFIG_MAC80211_MESH
5223	{
5224		/* TODO: should we support other types, e.g., IBSS?*/
5225		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
5226		.he_6ghz_capa = {
5227			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
5228					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
5229					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
5230					    IEEE80211_HE_6GHZ_CAP_SM_PS |
5231					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
5232					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
5233					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
5234		},
5235		.he_cap = {
5236			.has_he = true,
5237			.he_cap_elem = {
5238				.mac_cap_info[0] =
5239					IEEE80211_HE_MAC_CAP0_HTC_HE,
5240				.mac_cap_info[1] =
5241					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5242				.mac_cap_info[2] =
5243					IEEE80211_HE_MAC_CAP2_ACK_EN,
5244				.mac_cap_info[3] =
5245					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5246					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5247				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5248				.phy_cap_info[0] =
5249					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5250					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5251					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5252				.phy_cap_info[1] =
5253					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5254					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5255					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5256					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5257				.phy_cap_info[2] = 0,
5258
5259				/* Leave all the other PHY capability bytes
5260				 * unset, as DCM, beam forming, RU and PPE
5261				 * threshold information are not supported
5262				 */
5263			},
5264			.he_mcs_nss_supp = {
5265				.rx_mcs_80 = cpu_to_le16(0xfffa),
5266				.tx_mcs_80 = cpu_to_le16(0xfffa),
5267				.rx_mcs_160 = cpu_to_le16(0xfffa),
5268				.tx_mcs_160 = cpu_to_le16(0xfffa),
5269				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
5270				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
5271			},
5272		},
5273		.eht_cap = {
5274			.has_eht = true,
5275			.eht_cap_elem = {
5276				.mac_cap_info[0] = IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
5277						   IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
5278				.phy_cap_info[0] = IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ,
5279				/* Leave all the other PHY capability bytes
5280				 * unset, as DCM, beam forming, RU and PPE
5281				 * threshold information are not supported
5282				 */
5283			},
5284			/* For all MCS and bandwidth, set 8 NSS for both Tx and
5285			 * Rx
5286			 */
5287			.eht_mcs_nss_supp = {
5288				/* As B1 and B2 are set in the supported
5289				 * channel width set field in the HE PHY
5290				 * capabilities information field and 320MHz in
5291				 * 6GHz is supported include all the following
5292				 * MCS/NSS.
5293				 */
5294				.bw._80 = {
5295					.rx_tx_mcs9_max_nss = 0x88,
5296					.rx_tx_mcs11_max_nss = 0x88,
5297					.rx_tx_mcs13_max_nss = 0x88,
5298				},
5299				.bw._160 = {
5300					.rx_tx_mcs9_max_nss = 0x88,
5301					.rx_tx_mcs11_max_nss = 0x88,
5302					.rx_tx_mcs13_max_nss = 0x88,
5303				},
5304				.bw._320 = {
5305					.rx_tx_mcs9_max_nss = 0x88,
5306					.rx_tx_mcs11_max_nss = 0x88,
5307					.rx_tx_mcs13_max_nss = 0x88,
5308				},
5309			},
5310			/* PPE threshold information is not supported */
5311		},
5312	},
5313#endif
5314};
5315
5316static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
5317{
5318	switch (sband->band) {
5319	case NL80211_BAND_2GHZ:
5320		ieee80211_set_sband_iftype_data(sband, sband_capa_2ghz);
5321		break;
5322	case NL80211_BAND_5GHZ:
5323		ieee80211_set_sband_iftype_data(sband, sband_capa_5ghz);
5324		break;
5325	case NL80211_BAND_6GHZ:
5326		ieee80211_set_sband_iftype_data(sband, sband_capa_6ghz);
5327		break;
5328	default:
5329		break;
5330	}
5331}
5332
5333#ifdef CONFIG_MAC80211_MESH
5334#define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
5335#else
5336#define HWSIM_MESH_BIT 0
5337#endif
5338
5339#define HWSIM_DEFAULT_IF_LIMIT \
5340	(BIT(NL80211_IFTYPE_STATION) | \
5341	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
5342	 BIT(NL80211_IFTYPE_AP) | \
5343	 BIT(NL80211_IFTYPE_P2P_GO) | \
5344	 HWSIM_MESH_BIT)
5345
5346#define HWSIM_IFTYPE_SUPPORT_MASK \
5347	(BIT(NL80211_IFTYPE_STATION) | \
5348	 BIT(NL80211_IFTYPE_AP) | \
5349	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
5350	 BIT(NL80211_IFTYPE_P2P_GO) | \
5351	 BIT(NL80211_IFTYPE_ADHOC) | \
5352	 BIT(NL80211_IFTYPE_MESH_POINT) | \
5353	 BIT(NL80211_IFTYPE_OCB))
5354
5355static const u8 iftypes_ext_capa_ap[] = {
5356	 [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
5357	 [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
5358	 [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF |
5359	       WLAN_EXT_CAPA8_MAX_MSDU_IN_AMSDU_LSB,
5360	 [8] = WLAN_EXT_CAPA9_MAX_MSDU_IN_AMSDU_MSB,
5361	 [9] = WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT,
5362};
5363
5364#define MAC80211_HWSIM_MLD_CAPA_OPS				\
5365	FIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP, \
5366			 IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP_SAME) | \
5367	FIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS, \
5368			 IEEE80211_MLD_MAX_NUM_LINKS - 1)
5369
5370static const struct wiphy_iftype_ext_capab mac80211_hwsim_iftypes_ext_capa[] = {
5371	{
5372		.iftype = NL80211_IFTYPE_AP,
5373		.extended_capabilities = iftypes_ext_capa_ap,
5374		.extended_capabilities_mask = iftypes_ext_capa_ap,
5375		.extended_capabilities_len = sizeof(iftypes_ext_capa_ap),
5376		.eml_capabilities = IEEE80211_EML_CAP_EMLSR_SUPP |
5377				    IEEE80211_EML_CAP_EMLMR_SUPPORT,
5378		.mld_capa_and_ops = MAC80211_HWSIM_MLD_CAPA_OPS,
5379	},
5380};
5381
5382static int mac80211_hwsim_new_radio(struct genl_info *info,
5383				    struct hwsim_new_radio_params *param)
5384{
5385	int err;
5386	u8 addr[ETH_ALEN];
5387	struct mac80211_hwsim_data *data;
5388	struct ieee80211_hw *hw;
5389	enum nl80211_band band;
5390	const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
5391	struct net *net;
5392	int idx, i;
5393	int n_limits = 0;
5394	int n_bands = 0;
5395
5396	if (WARN_ON(param->channels > 1 && !param->use_chanctx))
5397		return -EINVAL;
5398
5399	spin_lock_bh(&hwsim_radio_lock);
5400	idx = hwsim_radio_idx++;
5401	spin_unlock_bh(&hwsim_radio_lock);
5402
5403	if (param->mlo)
5404		ops = &mac80211_hwsim_mlo_ops;
5405	else if (param->use_chanctx)
5406		ops = &mac80211_hwsim_mchan_ops;
5407	hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
5408	if (!hw) {
5409		pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
5410		err = -ENOMEM;
5411		goto failed;
5412	}
5413
5414	/* ieee80211_alloc_hw_nm may have used a default name */
5415	param->hwname = wiphy_name(hw->wiphy);
5416
5417	if (info)
5418		net = genl_info_net(info);
5419	else
5420		net = &init_net;
5421	wiphy_net_set(hw->wiphy, net);
5422
5423	data = hw->priv;
5424	data->hw = hw;
5425
5426	data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
5427	if (IS_ERR(data->dev)) {
5428		printk(KERN_DEBUG
5429		       "mac80211_hwsim: device_create failed (%ld)\n",
5430		       PTR_ERR(data->dev));
5431		err = -ENOMEM;
5432		goto failed_drvdata;
5433	}
5434	data->dev->driver = &mac80211_hwsim_driver.driver;
5435	err = device_bind_driver(data->dev);
5436	if (err != 0) {
5437		pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
5438		       err);
5439		goto failed_bind;
5440	}
5441
5442	skb_queue_head_init(&data->pending);
5443
5444	SET_IEEE80211_DEV(hw, data->dev);
5445	if (!param->perm_addr) {
5446		eth_zero_addr(addr);
5447		addr[0] = 0x02;
5448		addr[3] = idx >> 8;
5449		addr[4] = idx;
5450		memcpy(data->addresses[0].addr, addr, ETH_ALEN);
5451		/* Why need here second address ? */
5452		memcpy(data->addresses[1].addr, addr, ETH_ALEN);
5453		data->addresses[1].addr[0] |= 0x40;
5454		memcpy(data->addresses[2].addr, addr, ETH_ALEN);
5455		data->addresses[2].addr[0] |= 0x50;
5456
5457		hw->wiphy->n_addresses = 3;
5458		hw->wiphy->addresses = data->addresses;
5459		/* possible address clash is checked at hash table insertion */
5460	} else {
5461		memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
5462		/* compatibility with automatically generated mac addr */
5463		memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
5464		memcpy(data->addresses[2].addr, param->perm_addr, ETH_ALEN);
5465		hw->wiphy->n_addresses = 3;
5466		hw->wiphy->addresses = data->addresses;
5467	}
5468
5469	data->channels = param->channels;
5470	data->use_chanctx = param->use_chanctx;
5471	data->idx = idx;
5472	data->destroy_on_close = param->destroy_on_close;
5473	if (info)
5474		data->portid = info->snd_portid;
5475
5476	/* setup interface limits, only on interface types we support */
5477	if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
5478		data->if_limits[n_limits].max = 1;
5479		data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
5480		n_limits++;
5481	}
5482
5483	if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
5484		data->if_limits[n_limits].max = 2048;
5485		/*
5486		 * For this case, we may only support a subset of
5487		 * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
5488		 * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
5489		 */
5490		data->if_limits[n_limits].types =
5491					HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
5492		n_limits++;
5493	}
5494
5495	if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5496		data->if_limits[n_limits].max = 1;
5497		data->if_limits[n_limits].types =
5498						BIT(NL80211_IFTYPE_P2P_DEVICE);
5499		n_limits++;
5500	}
5501
5502	if (param->iftypes & BIT(NL80211_IFTYPE_NAN)) {
5503		data->if_limits[n_limits].max = 1;
5504		data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_NAN);
5505		n_limits++;
5506
5507		hw->wiphy->nan_supported_bands = BIT(NL80211_BAND_2GHZ) |
5508						 BIT(NL80211_BAND_5GHZ);
5509
5510		hw->wiphy->nan_capa.flags = WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC |
5511					    WIPHY_NAN_FLAGS_USERSPACE_DE;
5512		hw->wiphy->nan_capa.op_mode = NAN_OP_MODE_PHY_MODE_MASK |
5513					      NAN_OP_MODE_80P80MHZ |
5514					      NAN_OP_MODE_160MHZ;
5515
5516		hw->wiphy->nan_capa.n_antennas = 0x22;
5517		hw->wiphy->nan_capa.max_channel_switch_time = 0;
5518		hw->wiphy->nan_capa.dev_capabilities =
5519			NAN_DEV_CAPA_EXT_KEY_ID_SUPPORTED |
5520			NAN_DEV_CAPA_NDPE_SUPPORTED;
5521
5522		hrtimer_setup(&data->nan_timer, mac80211_hwsim_nan_dw_start,
5523			      CLOCK_MONOTONIC, HRTIMER_MODE_ABS_SOFT);
5524	}
5525
5526	data->if_combination.radar_detect_widths =
5527				BIT(NL80211_CHAN_WIDTH_5) |
5528				BIT(NL80211_CHAN_WIDTH_10) |
5529				BIT(NL80211_CHAN_WIDTH_20_NOHT) |
5530				BIT(NL80211_CHAN_WIDTH_20) |
5531				BIT(NL80211_CHAN_WIDTH_40) |
5532				BIT(NL80211_CHAN_WIDTH_80) |
5533				BIT(NL80211_CHAN_WIDTH_160);
5534
5535	if (data->use_chanctx) {
5536		hw->wiphy->max_scan_ssids = 255;
5537		hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
5538		hw->wiphy->max_remain_on_channel_duration = 1000;
5539		data->if_combination.num_different_channels = data->channels;
5540	} else {
5541		data->if_combination.num_different_channels = 1;
5542	}
5543
5544	if (!n_limits) {
5545		err = -EINVAL;
5546		goto failed_hw;
5547	}
5548
5549	data->if_combination.max_interfaces = 0;
5550	for (i = 0; i < n_limits; i++)
5551		data->if_combination.max_interfaces +=
5552			data->if_limits[i].max;
5553
5554	data->if_combination.n_limits = n_limits;
5555	data->if_combination.limits = data->if_limits;
5556
5557	/*
5558	 * If we actually were asked to support combinations,
5559	 * advertise them - if there's only a single thing like
5560	 * only IBSS then don't advertise it as combinations.
5561	 */
5562	if (data->if_combination.max_interfaces > 1) {
5563		hw->wiphy->iface_combinations = &data->if_combination;
5564		hw->wiphy->n_iface_combinations = 1;
5565	}
5566
5567	if (param->ciphers) {
5568		memcpy(data->ciphers, param->ciphers,
5569		       param->n_ciphers * sizeof(u32));
5570		hw->wiphy->cipher_suites = data->ciphers;
5571		hw->wiphy->n_cipher_suites = param->n_ciphers;
5572	}
5573
5574	hw->wiphy->mbssid_max_interfaces = 8;
5575	hw->wiphy->ema_max_profile_periodicity = 3;
5576
5577	data->rx_rssi = DEFAULT_RX_RSSI;
5578
5579	INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
5580	INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
5581	INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
5582
5583	hw->queues = 5;
5584	hw->offchannel_tx_hw_queue = 4;
5585
5586	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
5587	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
5588	ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
5589	ieee80211_hw_set(hw, QUEUE_CONTROL);
5590	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
5591	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
5592	ieee80211_hw_set(hw, MFP_CAPABLE);
5593	ieee80211_hw_set(hw, SIGNAL_DBM);
5594	ieee80211_hw_set(hw, SUPPORTS_PS);
5595	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
5596	ieee80211_hw_set(hw, TDLS_WIDER_BW);
5597	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
5598	ieee80211_hw_set(hw, STRICT);
5599
5600	if (param->mlo) {
5601		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
5602		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
5603		ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
5604		ieee80211_hw_set(hw, CONNECTION_MONITOR);
5605		ieee80211_hw_set(hw, AP_LINK_PS);
5606
5607		hw->wiphy->iftype_ext_capab = mac80211_hwsim_iftypes_ext_capa;
5608		hw->wiphy->num_iftype_ext_capab =
5609			ARRAY_SIZE(mac80211_hwsim_iftypes_ext_capa);
5610	} else {
5611		ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
5612		ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
5613		if (rctbl)
5614			ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
5615	}
5616
5617	hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
5618	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
5619			    WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
5620			    WIPHY_FLAG_AP_UAPSD |
5621			    WIPHY_FLAG_SUPPORTS_5_10_MHZ |
5622			    WIPHY_FLAG_HAS_CHANNEL_SWITCH;
5623	hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
5624			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
5625			       NL80211_FEATURE_STATIC_SMPS |
5626			       NL80211_FEATURE_DYNAMIC_SMPS |
5627			       NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
5628			       NL80211_FEATURE_AP_SCAN;
5629	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
5630	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
5631	wiphy_ext_feature_set(hw->wiphy,
5632			      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
5633	wiphy_ext_feature_set(hw->wiphy,
5634			      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
5635	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
5636
5637	wiphy_ext_feature_set(hw->wiphy,
5638			      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT);
5639	wiphy_ext_feature_set(hw->wiphy,
5640			      NL80211_EXT_FEATURE_BSS_COLOR);
5641
5642	hw->wiphy->interface_modes = param->iftypes;
5643
5644	/* ask mac80211 to reserve space for magic */
5645	hw->vif_data_size = sizeof(struct hwsim_vif_priv);
5646	hw->sta_data_size = sizeof(struct hwsim_sta_priv);
5647	hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
5648
5649	memcpy(data->channels_2ghz, hwsim_channels_2ghz,
5650		sizeof(hwsim_channels_2ghz));
5651	memcpy(data->channels_5ghz, hwsim_channels_5ghz,
5652		sizeof(hwsim_channels_5ghz));
5653	memcpy(data->channels_6ghz, hwsim_channels_6ghz,
5654		sizeof(hwsim_channels_6ghz));
5655	memcpy(data->channels_s1g, hwsim_channels_s1g,
5656	       sizeof(hwsim_channels_s1g));
5657	memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
5658
5659	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
5660		struct ieee80211_supported_band *sband = &data->bands[band];
5661		struct wiphy_radio_freq_range *radio_range;
5662		const struct ieee80211_channel *c;
5663		struct wiphy_radio *radio;
5664
5665		sband->band = band;
5666
5667		switch (band) {
5668		case NL80211_BAND_2GHZ:
5669			sband->channels = data->channels_2ghz;
5670			sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
5671			sband->bitrates = data->rates;
5672			sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
5673			break;
5674		case NL80211_BAND_5GHZ:
5675			sband->channels = data->channels_5ghz;
5676			sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
5677			sband->bitrates = data->rates + 4;
5678			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5679
5680			sband->vht_cap.vht_supported = true;
5681			sband->vht_cap.cap =
5682				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
5683				IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
5684				IEEE80211_VHT_CAP_RXLDPC |
5685				IEEE80211_VHT_CAP_SHORT_GI_80 |
5686				IEEE80211_VHT_CAP_SHORT_GI_160 |
5687				IEEE80211_VHT_CAP_TXSTBC |
5688				IEEE80211_VHT_CAP_RXSTBC_4 |
5689				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
5690			sband->vht_cap.vht_mcs.rx_mcs_map =
5691				cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
5692					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
5693					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
5694					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
5695					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
5696					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
5697					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
5698					    IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
5699			sband->vht_cap.vht_mcs.tx_mcs_map =
5700				sband->vht_cap.vht_mcs.rx_mcs_map;
5701			break;
5702		case NL80211_BAND_6GHZ:
5703			sband->channels = data->channels_6ghz;
5704			sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
5705			sband->bitrates = data->rates + 4;
5706			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5707			break;
5708		case NL80211_BAND_S1GHZ:
5709			memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
5710			       sizeof(sband->s1g_cap));
5711			sband->channels = data->channels_s1g;
5712			sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
5713			break;
5714		default:
5715			continue;
5716		}
5717
5718		if (band != NL80211_BAND_6GHZ){
5719			sband->ht_cap.ht_supported = true;
5720			sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
5721					    IEEE80211_HT_CAP_GRN_FLD |
5722					    IEEE80211_HT_CAP_SGI_20 |
5723					    IEEE80211_HT_CAP_SGI_40 |
5724					    IEEE80211_HT_CAP_DSSSCCK40;
5725			sband->ht_cap.ampdu_factor = 0x3;
5726			sband->ht_cap.ampdu_density = 0x6;
5727			memset(&sband->ht_cap.mcs, 0,
5728			       sizeof(sband->ht_cap.mcs));
5729			sband->ht_cap.mcs.rx_mask[0] = 0xff;
5730			sband->ht_cap.mcs.rx_mask[1] = 0xff;
5731			sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5732		}
5733
5734		mac80211_hwsim_sband_capab(sband);
5735
5736		hw->wiphy->bands[band] = sband;
5737
5738		if (!param->multi_radio)
5739			continue;
5740
5741		c = sband->channels;
5742		radio_range = &data->radio_range[n_bands];
5743		radio_range->start_freq = ieee80211_channel_to_khz(c) - 10000;
5744
5745		c += sband->n_channels - 1;
5746		radio_range->end_freq = ieee80211_channel_to_khz(c) + 10000;
5747
5748		radio = &data->radio[n_bands++];
5749		radio->freq_range = radio_range;
5750		radio->n_freq_range = 1;
5751		radio->iface_combinations = &data->if_combination_radio;
5752		radio->n_iface_combinations = 1;
5753	}
5754
5755	if (param->multi_radio) {
5756		hw->wiphy->radio = data->radio;
5757		hw->wiphy->n_radio = n_bands;
5758
5759		memcpy(&data->if_combination_radio, &data->if_combination,
5760		       sizeof(data->if_combination));
5761		data->if_combination.num_different_channels *= n_bands;
5762	}
5763
5764	if (data->use_chanctx)
5765		data->if_combination.radar_detect_widths = 0;
5766
5767	/* By default all radios belong to the first group */
5768	data->group = 1;
5769	mutex_init(&data->mutex);
5770
5771	data->netgroup = hwsim_net_get_netgroup(net);
5772	data->wmediumd = hwsim_net_get_wmediumd(net);
5773
5774	/* Enable frame retransmissions for lossy channels */
5775	hw->max_rates = 4;
5776	hw->max_rate_tries = 11;
5777
5778	hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
5779	hw->wiphy->n_vendor_commands =
5780		ARRAY_SIZE(mac80211_hwsim_vendor_commands);
5781	hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
5782	hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
5783
5784	if (param->reg_strict)
5785		hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
5786	if (param->regd) {
5787		data->regd = param->regd;
5788		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
5789		wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
5790		/* give the regulatory workqueue a chance to run */
5791		schedule_timeout_interruptible(1);
5792	}
5793
5794	wiphy_ext_feature_set(hw->wiphy,
5795			      NL80211_EXT_FEATURE_DFS_CONCURRENT);
5796
5797	if (param->no_vif)
5798		ieee80211_hw_set(hw, NO_AUTO_VIF);
5799
5800	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5801	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_PUNCT);
5802
5803	for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
5804		hrtimer_setup(&data->link_data[i].beacon_timer, mac80211_hwsim_beacon,
5805			      CLOCK_MONOTONIC, HRTIMER_MODE_ABS_SOFT);
5806		data->link_data[i].link_id = i;
5807	}
5808
5809	err = ieee80211_register_hw(hw);
5810	if (err < 0) {
5811		pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
5812		       err);
5813		goto failed_hw;
5814	}
5815
5816	wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
5817
5818	if (param->reg_alpha2) {
5819		data->alpha2[0] = param->reg_alpha2[0];
5820		data->alpha2[1] = param->reg_alpha2[1];
5821		regulatory_hint(hw->wiphy, param->reg_alpha2);
5822	}
5823
5824	data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
5825	debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
5826	debugfs_create_file("group", 0666, data->debugfs, data,
5827			    &hwsim_fops_group);
5828	debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
5829			    &hwsim_fops_rx_rssi);
5830	if (!data->use_chanctx)
5831		debugfs_create_file("dfs_simulate_radar", 0222,
5832				    data->debugfs,
5833				    data, &hwsim_simulate_radar);
5834
5835	if (param->pmsr_capa) {
5836		data->pmsr_capa = *param->pmsr_capa;
5837		hw->wiphy->pmsr_capa = &data->pmsr_capa;
5838	}
5839
5840	spin_lock_bh(&hwsim_radio_lock);
5841	err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
5842				     hwsim_rht_params);
5843	if (err < 0) {
5844		if (info) {
5845			GENL_SET_ERR_MSG(info, "perm addr already present");
5846			NL_SET_BAD_ATTR(info->extack,
5847					info->attrs[HWSIM_ATTR_PERM_ADDR]);
5848		}
5849		spin_unlock_bh(&hwsim_radio_lock);
5850		goto failed_final_insert;
5851	}
5852
5853	list_add_tail(&data->list, &hwsim_radios);
5854	hwsim_radios_generation++;
5855	spin_unlock_bh(&hwsim_radio_lock);
5856
5857	hwsim_mcast_new_radio(idx, info, param);
5858
5859	return idx;
5860
5861failed_final_insert:
5862	debugfs_remove_recursive(data->debugfs);
5863	ieee80211_unregister_hw(data->hw);
5864failed_hw:
5865	device_release_driver(data->dev);
5866failed_bind:
5867	device_unregister(data->dev);
5868failed_drvdata:
5869	ieee80211_free_hw(hw);
5870failed:
5871	return err;
5872}
5873
5874static void hwsim_mcast_del_radio(int id, const char *hwname,
5875				  struct genl_info *info)
5876{
5877	struct sk_buff *skb;
5878	void *data;
5879	int ret;
5880
5881	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
5882	if (!skb)
5883		return;
5884
5885	data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
5886			   HWSIM_CMD_DEL_RADIO);
5887	if (!data)
5888		goto error;
5889
5890	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
5891	if (ret < 0)
5892		goto error;
5893
5894	ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
5895		      hwname);
5896	if (ret < 0)
5897		goto error;
5898
5899	genlmsg_end(skb, data);
5900
5901	hwsim_mcast_config_msg(skb, info);
5902
5903	return;
5904
5905error:
5906	nlmsg_free(skb);
5907}
5908
5909static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
5910				     const char *hwname,
5911				     struct genl_info *info)
5912{
5913	hwsim_mcast_del_radio(data->idx, hwname, info);
5914	debugfs_remove_recursive(data->debugfs);
5915	ieee80211_unregister_hw(data->hw);
5916	device_release_driver(data->dev);
5917	device_unregister(data->dev);
5918	ieee80211_free_hw(data->hw);
5919}
5920
5921static int mac80211_hwsim_get_radio(struct sk_buff *skb,
5922				    struct mac80211_hwsim_data *data,
5923				    u32 portid, u32 seq,
5924				    struct netlink_callback *cb, int flags)
5925{
5926	void *hdr;
5927	struct hwsim_new_radio_params param = { };
5928	int res = -EMSGSIZE;
5929
5930	hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
5931			  HWSIM_CMD_GET_RADIO);
5932	if (!hdr)
5933		return -EMSGSIZE;
5934
5935	if (cb)
5936		genl_dump_check_consistent(cb, hdr);
5937
5938	if (data->alpha2[0] && data->alpha2[1])
5939		param.reg_alpha2 = data->alpha2;
5940
5941	param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
5942					REGULATORY_STRICT_REG);
5943	param.p2p_device = !!(data->hw->wiphy->interface_modes &
5944					BIT(NL80211_IFTYPE_P2P_DEVICE));
5945	param.nan_device = !!(data->hw->wiphy->interface_modes &
5946					BIT(NL80211_IFTYPE_NAN));
5947	param.use_chanctx = data->use_chanctx;
5948	param.regd = data->regd;
5949	param.channels = data->channels;
5950	param.hwname = wiphy_name(data->hw->wiphy);
5951	param.pmsr_capa = &data->pmsr_capa;
5952
5953	res = append_radio_msg(skb, data->idx, &param);
5954	if (res < 0)
5955		goto out_err;
5956
5957	genlmsg_end(skb, hdr);
5958	return 0;
5959
5960out_err:
5961	genlmsg_cancel(skb, hdr);
5962	return res;
5963}
5964
5965static void mac80211_hwsim_free(void)
5966{
5967	struct mac80211_hwsim_data *data;
5968
5969	spin_lock_bh(&hwsim_radio_lock);
5970	while ((data = list_first_entry_or_null(&hwsim_radios,
5971						struct mac80211_hwsim_data,
5972						list))) {
5973		list_del(&data->list);
5974		spin_unlock_bh(&hwsim_radio_lock);
5975		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
5976					 NULL);
5977		spin_lock_bh(&hwsim_radio_lock);
5978	}
5979	spin_unlock_bh(&hwsim_radio_lock);
5980	class_destroy(hwsim_class);
5981}
5982
5983static const struct net_device_ops hwsim_netdev_ops = {
5984	.ndo_start_xmit 	= hwsim_mon_xmit,
5985	.ndo_set_mac_address 	= eth_mac_addr,
5986	.ndo_validate_addr	= eth_validate_addr,
5987};
5988
5989static void hwsim_mon_setup(struct net_device *dev)
5990{
5991	u8 addr[ETH_ALEN];
5992
5993	dev->netdev_ops = &hwsim_netdev_ops;
5994	dev->needs_free_netdev = true;
5995	ether_setup(dev);
5996	dev->priv_flags |= IFF_NO_QUEUE;
5997	dev->type = ARPHRD_IEEE80211_RADIOTAP;
5998	eth_zero_addr(addr);
5999	addr[0] = 0x12;
6000	eth_hw_addr_set(dev, addr);
6001}
6002
6003static void hwsim_register_wmediumd(struct net *net, u32 portid)
6004{
6005	struct mac80211_hwsim_data *data;
6006
6007	hwsim_net_set_wmediumd(net, portid);
6008
6009	spin_lock_bh(&hwsim_radio_lock);
6010	list_for_each_entry(data, &hwsim_radios, list) {
6011		if (data->netgroup == hwsim_net_get_netgroup(net))
6012			data->wmediumd = portid;
6013	}
6014	spin_unlock_bh(&hwsim_radio_lock);
6015}
6016
6017static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
6018					   struct genl_info *info)
6019{
6020
6021	struct ieee80211_hdr *hdr;
6022	struct mac80211_hwsim_data *data2;
6023	struct ieee80211_tx_info *txi;
6024	struct hwsim_tx_rate *tx_attempts;
6025	u64 ret_skb_cookie;
6026	struct sk_buff *skb, *tmp;
6027	const u8 *src;
6028	unsigned int hwsim_flags;
6029	int i;
6030	unsigned long flags;
6031	bool found = false;
6032
6033	if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
6034	    !info->attrs[HWSIM_ATTR_FLAGS] ||
6035	    !info->attrs[HWSIM_ATTR_COOKIE] ||
6036	    !info->attrs[HWSIM_ATTR_SIGNAL] ||
6037	    !info->attrs[HWSIM_ATTR_TX_INFO])
6038		goto out;
6039
6040	src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
6041	hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
6042	ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
6043
6044	data2 = get_hwsim_data_ref_from_addr(src);
6045	if (!data2)
6046		goto out;
6047
6048	if (!hwsim_virtio_enabled) {
6049		if (hwsim_net_get_netgroup(genl_info_net(info)) !=
6050		    data2->netgroup)
6051			goto out;
6052
6053		if (info->snd_portid != data2->wmediumd)
6054			goto out;
6055	}
6056
6057	/* look for the skb matching the cookie passed back from user */
6058	spin_lock_irqsave(&data2->pending.lock, flags);
6059	skb_queue_walk_safe(&data2->pending, skb, tmp) {
6060		uintptr_t skb_cookie;
6061
6062		txi = IEEE80211_SKB_CB(skb);
6063		skb_cookie = (uintptr_t)txi->rate_driver_data[0];
6064
6065		if (skb_cookie == ret_skb_cookie) {
6066			__skb_unlink(skb, &data2->pending);
6067			found = true;
6068			break;
6069		}
6070	}
6071	spin_unlock_irqrestore(&data2->pending.lock, flags);
6072
6073	/* not found */
6074	if (!found)
6075		goto out;
6076
6077	/* Tx info received because the frame was broadcasted on user space,
6078	 so we get all the necessary info: tx attempts and skb control buff */
6079
6080	tx_attempts = (struct hwsim_tx_rate *)nla_data(
6081		       info->attrs[HWSIM_ATTR_TX_INFO]);
6082
6083	/* now send back TX status */
6084	txi = IEEE80211_SKB_CB(skb);
6085
6086	ieee80211_tx_info_clear_status(txi);
6087
6088	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
6089		txi->status.rates[i].idx = tx_attempts[i].idx;
6090		txi->status.rates[i].count = tx_attempts[i].count;
6091	}
6092
6093	txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
6094
6095	if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
6096	   (hwsim_flags & HWSIM_TX_STAT_ACK)) {
6097		if (skb->len >= 16) {
6098			hdr = (struct ieee80211_hdr *) skb->data;
6099			mac80211_hwsim_monitor_ack(data2->channel,
6100						   hdr->addr2);
6101		}
6102		txi->flags |= IEEE80211_TX_STAT_ACK;
6103	}
6104
6105	if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
6106		txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
6107
6108	ieee80211_tx_status_irqsafe(data2->hw, skb);
6109	return 0;
6110out:
6111	return -EINVAL;
6112
6113}
6114
6115static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
6116					  struct genl_info *info)
6117{
6118	struct mac80211_hwsim_data *data2;
6119	struct ieee80211_rx_status rx_status;
6120	struct ieee80211_hdr *hdr;
6121	const u8 *dst;
6122	int frame_data_len;
6123	void *frame_data;
6124	struct sk_buff *skb = NULL;
6125	struct ieee80211_channel *channel = NULL;
6126
6127	if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
6128	    !info->attrs[HWSIM_ATTR_FRAME] ||
6129	    !info->attrs[HWSIM_ATTR_RX_RATE] ||
6130	    !info->attrs[HWSIM_ATTR_SIGNAL])
6131		goto out;
6132
6133	dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
6134	frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
6135	frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
6136
6137	if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
6138	    frame_data_len > IEEE80211_MAX_DATA_LEN)
6139		goto err;
6140
6141	/* Allocate new skb here */
6142	skb = alloc_skb(frame_data_len, GFP_KERNEL);
6143	if (skb == NULL)
6144		goto err;
6145
6146	/* Copy the data */
6147	skb_put_data(skb, frame_data, frame_data_len);
6148
6149	data2 = get_hwsim_data_ref_from_addr(dst);
6150	if (!data2)
6151		goto out;
6152
6153	if (data2->use_chanctx) {
6154		if (data2->tmp_chan)
6155			channel = data2->tmp_chan;
6156	} else {
6157		channel = data2->channel;
6158	}
6159
6160	if (!hwsim_virtio_enabled) {
6161		if (hwsim_net_get_netgroup(genl_info_net(info)) !=
6162		    data2->netgroup)
6163			goto out;
6164
6165		if (info->snd_portid != data2->wmediumd)
6166			goto out;
6167	}
6168
6169	/* check if radio is configured properly */
6170
6171	if ((data2->idle && !data2->tmp_chan) || !data2->started)
6172		goto out;
6173
6174	/* A frame is received from user space */
6175	memset(&rx_status, 0, sizeof(rx_status));
6176	if (info->attrs[HWSIM_ATTR_FREQ]) {
6177		struct tx_iter_data iter_data = {};
6178
6179		/* throw away off-channel packets, but allow both the temporary
6180		 * ("hw" scan/remain-on-channel), regular channels and links,
6181		 * since the internal datapath also allows this
6182		 */
6183		rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
6184
6185		iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
6186							  rx_status.freq);
6187		if (!iter_data.channel)
6188			goto out;
6189		rx_status.band = iter_data.channel->band;
6190
6191		mutex_lock(&data2->mutex);
6192		if (!hwsim_chans_compat(iter_data.channel, channel)) {
6193			ieee80211_iterate_active_interfaces_atomic(
6194				data2->hw, IEEE80211_IFACE_ITER_NORMAL,
6195				mac80211_hwsim_tx_iter, &iter_data);
6196			if (!iter_data.receive) {
6197				mutex_unlock(&data2->mutex);
6198				goto out;
6199			}
6200		}
6201		mutex_unlock(&data2->mutex);
6202	} else if (!channel) {
6203		goto out;
6204	} else {
6205		rx_status.freq = channel->center_freq;
6206		rx_status.band = channel->band;
6207	}
6208
6209	rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
6210	if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
6211		goto out;
6212	rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
6213
6214	hdr = (void *)skb->data;
6215
6216	if (ieee80211_is_beacon(hdr->frame_control) ||
6217	    ieee80211_is_probe_resp(hdr->frame_control))
6218		rx_status.boottime_ns = ktime_get_boottime_ns();
6219
6220	mac80211_hwsim_rx(data2, &rx_status, skb);
6221
6222	return 0;
6223err:
6224	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
6225out:
6226	dev_kfree_skb(skb);
6227	return -EINVAL;
6228}
6229
6230static int hwsim_register_received_nl(struct sk_buff *skb_2,
6231				      struct genl_info *info)
6232{
6233	struct net *net = genl_info_net(info);
6234	struct mac80211_hwsim_data *data;
6235	int chans = 1;
6236
6237	spin_lock_bh(&hwsim_radio_lock);
6238	list_for_each_entry(data, &hwsim_radios, list)
6239		chans = max(chans, data->channels);
6240	spin_unlock_bh(&hwsim_radio_lock);
6241
6242	/* In the future we should revise the userspace API and allow it
6243	 * to set a flag that it does support multi-channel, then we can
6244	 * let this pass conditionally on the flag.
6245	 * For current userspace, prohibit it since it won't work right.
6246	 */
6247	if (chans > 1)
6248		return -EOPNOTSUPP;
6249
6250	if (hwsim_net_get_wmediumd(net))
6251		return -EBUSY;
6252
6253	hwsim_register_wmediumd(net, info->snd_portid);
6254
6255	pr_debug("mac80211_hwsim: received a REGISTER, "
6256	       "switching to wmediumd mode with pid %d\n", info->snd_portid);
6257
6258	return 0;
6259}
6260
6261/* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
6262static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
6263{
6264	int i;
6265
6266	for (i = 0; i < n_ciphers; i++) {
6267		int j;
6268		int found = 0;
6269
6270		for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
6271			if (ciphers[i] == hwsim_ciphers[j]) {
6272				found = 1;
6273				break;
6274			}
6275		}
6276
6277		if (!found)
6278			return false;
6279	}
6280
6281	return true;
6282}
6283
6284static int parse_ftm_capa(const struct nlattr *ftm_capa, struct cfg80211_pmsr_capabilities *out,
6285			  struct genl_info *info)
6286{
6287	struct nlattr *tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
6288	int ret;
6289
6290	ret = nla_parse_nested(tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX, ftm_capa, hwsim_ftm_capa_policy,
6291			       NULL);
6292	if (ret) {
6293		NL_SET_ERR_MSG_ATTR(info->extack, ftm_capa, "malformed FTM capability");
6294		return -EINVAL;
6295	}
6296
6297	out->ftm.supported = 1;
6298	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES])
6299		out->ftm.preambles = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]);
6300	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS])
6301		out->ftm.bandwidths = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]);
6302	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT])
6303		out->ftm.max_bursts_exponent =
6304			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT]);
6305	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST])
6306		out->ftm.max_ftms_per_burst =
6307			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST]);
6308	out->ftm.asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_ASAP];
6309	out->ftm.non_asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP];
6310	out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI];
6311	out->ftm.request_civicloc = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC];
6312	out->ftm.trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED];
6313	out->ftm.non_trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED];
6314
6315	return 0;
6316}
6317
6318static int parse_pmsr_capa(const struct nlattr *pmsr_capa, struct cfg80211_pmsr_capabilities *out,
6319			   struct genl_info *info)
6320{
6321	struct nlattr *tb[NL80211_PMSR_ATTR_MAX + 1];
6322	struct nlattr *nla;
6323	int size;
6324	int ret;
6325
6326	ret = nla_parse_nested(tb, NL80211_PMSR_ATTR_MAX, pmsr_capa, hwsim_pmsr_capa_policy, NULL);
6327	if (ret) {
6328		NL_SET_ERR_MSG_ATTR(info->extack, pmsr_capa, "malformed PMSR capability");
6329		return -EINVAL;
6330	}
6331
6332	if (tb[NL80211_PMSR_ATTR_MAX_PEERS])
6333		out->max_peers = nla_get_u32(tb[NL80211_PMSR_ATTR_MAX_PEERS]);
6334	out->report_ap_tsf = !!tb[NL80211_PMSR_ATTR_REPORT_AP_TSF];
6335	out->randomize_mac_addr = !!tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR];
6336
6337	if (!tb[NL80211_PMSR_ATTR_TYPE_CAPA]) {
6338		NL_SET_ERR_MSG_ATTR(info->extack, tb[NL80211_PMSR_ATTR_TYPE_CAPA],
6339				    "malformed PMSR type");
6340		return -EINVAL;
6341	}
6342
6343	nla_for_each_nested(nla, tb[NL80211_PMSR_ATTR_TYPE_CAPA], size) {
6344		switch (nla_type(nla)) {
6345		case NL80211_PMSR_TYPE_FTM:
6346			parse_ftm_capa(nla, out, info);
6347			break;
6348		default:
6349			NL_SET_ERR_MSG_ATTR(info->extack, nla, "unsupported measurement type");
6350			return -EINVAL;
6351		}
6352	}
6353
6354	return 0;
6355}
6356
6357static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
6358{
6359	struct hwsim_new_radio_params param = { 0 };
6360	const char *hwname = NULL;
6361	int ret;
6362
6363	param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
6364	param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
6365	param.nan_device = info->attrs[HWSIM_ATTR_SUPPORT_NAN_DEVICE];
6366	param.channels = channels;
6367	param.destroy_on_close =
6368		info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
6369
6370	if (info->attrs[HWSIM_ATTR_CHANNELS])
6371		param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
6372
6373	if (param.channels < 1) {
6374		GENL_SET_ERR_MSG(info, "must have at least one channel");
6375		return -EINVAL;
6376	}
6377
6378	if (info->attrs[HWSIM_ATTR_NO_VIF])
6379		param.no_vif = true;
6380
6381	if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
6382		param.use_chanctx = true;
6383	else
6384		param.use_chanctx = (param.channels > 1);
6385
6386	if (info->attrs[HWSIM_ATTR_MULTI_RADIO])
6387		param.multi_radio = true;
6388
6389	if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
6390		param.reg_alpha2 =
6391			nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
6392
6393	if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
6394		u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
6395
6396		if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
6397			return -EINVAL;
6398
6399		idx = array_index_nospec(idx,
6400					 ARRAY_SIZE(hwsim_world_regdom_custom));
6401		param.regd = hwsim_world_regdom_custom[idx];
6402	}
6403
6404	if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
6405		if (!is_valid_ether_addr(
6406				nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
6407			GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
6408			NL_SET_BAD_ATTR(info->extack,
6409					info->attrs[HWSIM_ATTR_PERM_ADDR]);
6410			return -EINVAL;
6411		}
6412
6413		param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
6414	}
6415
6416	if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
6417		param.iftypes =
6418			nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
6419
6420		if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
6421			NL_SET_ERR_MSG_ATTR(info->extack,
6422					    info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
6423					    "cannot support more iftypes than kernel");
6424			return -EINVAL;
6425		}
6426	} else {
6427		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
6428	}
6429
6430	/* ensure both flag and iftype support is honored */
6431	if (param.p2p_device ||
6432	    param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
6433		param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
6434		param.p2p_device = true;
6435	}
6436
6437	/* ensure both flag and iftype support is honored */
6438	if (param.nan_device ||
6439	    param.iftypes & BIT(NL80211_IFTYPE_NAN)) {
6440		param.iftypes |= BIT(NL80211_IFTYPE_NAN);
6441		param.nan_device = true;
6442	}
6443
6444	if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
6445		u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
6446
6447		param.ciphers =
6448			nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
6449
6450		if (len % sizeof(u32)) {
6451			NL_SET_ERR_MSG_ATTR(info->extack,
6452					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
6453					    "bad cipher list length");
6454			return -EINVAL;
6455		}
6456
6457		param.n_ciphers = len / sizeof(u32);
6458
6459		if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
6460			NL_SET_ERR_MSG_ATTR(info->extack,
6461					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
6462					    "too many ciphers specified");
6463			return -EINVAL;
6464		}
6465
6466		if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
6467			NL_SET_ERR_MSG_ATTR(info->extack,
6468					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
6469					    "unsupported ciphers specified");
6470			return -EINVAL;
6471		}
6472	}
6473
6474	param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
6475
6476	if (param.mlo || param.multi_radio)
6477		param.use_chanctx = true;
6478
6479	if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
6480		hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6481				  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6482				  GFP_KERNEL);
6483		if (!hwname)
6484			return -ENOMEM;
6485		param.hwname = hwname;
6486	}
6487
6488	if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
6489		struct cfg80211_pmsr_capabilities *pmsr_capa;
6490
6491		pmsr_capa = kmalloc(sizeof(*pmsr_capa), GFP_KERNEL);
6492		if (!pmsr_capa) {
6493			ret = -ENOMEM;
6494			goto out_free;
6495		}
6496		param.pmsr_capa = pmsr_capa;
6497
6498		ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info);
6499		if (ret)
6500			goto out_free;
6501	}
6502
6503	ret = mac80211_hwsim_new_radio(info, &param);
6504
6505out_free:
6506	kfree(hwname);
6507	kfree(param.pmsr_capa);
6508	return ret;
6509}
6510
6511static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
6512{
6513	struct mac80211_hwsim_data *data;
6514	s64 idx = -1;
6515	const char *hwname = NULL;
6516
6517	if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
6518		idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
6519	} else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
6520		hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6521				  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
6522				  GFP_KERNEL);
6523		if (!hwname)
6524			return -ENOMEM;
6525	} else
6526		return -EINVAL;
6527
6528	spin_lock_bh(&hwsim_radio_lock);
6529	list_for_each_entry(data, &hwsim_radios, list) {
6530		if (idx >= 0) {
6531			if (data->idx != idx)
6532				continue;
6533		} else {
6534			if (!hwname ||
6535			    strcmp(hwname, wiphy_name(data->hw->wiphy)))
6536				continue;
6537		}
6538
6539		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6540			continue;
6541
6542		list_del(&data->list);
6543		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6544				       hwsim_rht_params);
6545		hwsim_radios_generation++;
6546		spin_unlock_bh(&hwsim_radio_lock);
6547		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
6548					 info);
6549		kfree(hwname);
6550		return 0;
6551	}
6552	spin_unlock_bh(&hwsim_radio_lock);
6553
6554	kfree(hwname);
6555	return -ENODEV;
6556}
6557
6558static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
6559{
6560	struct mac80211_hwsim_data *data;
6561	struct sk_buff *skb;
6562	int idx, res = -ENODEV;
6563
6564	if (!info->attrs[HWSIM_ATTR_RADIO_ID])
6565		return -EINVAL;
6566	idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
6567
6568	spin_lock_bh(&hwsim_radio_lock);
6569	list_for_each_entry(data, &hwsim_radios, list) {
6570		if (data->idx != idx)
6571			continue;
6572
6573		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6574			continue;
6575
6576		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6577		if (!skb) {
6578			res = -ENOMEM;
6579			goto out_err;
6580		}
6581
6582		res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
6583					       info->snd_seq, NULL, 0);
6584		if (res < 0) {
6585			nlmsg_free(skb);
6586			goto out_err;
6587		}
6588
6589		res = genlmsg_reply(skb, info);
6590		break;
6591	}
6592
6593out_err:
6594	spin_unlock_bh(&hwsim_radio_lock);
6595
6596	return res;
6597}
6598
6599static int hwsim_dump_radio_nl(struct sk_buff *skb,
6600			       struct netlink_callback *cb)
6601{
6602	int last_idx = cb->args[0] - 1;
6603	struct mac80211_hwsim_data *data = NULL;
6604	int res = 0;
6605	void *hdr;
6606
6607	spin_lock_bh(&hwsim_radio_lock);
6608	cb->seq = hwsim_radios_generation;
6609
6610	if (last_idx >= hwsim_radio_idx-1)
6611		goto done;
6612
6613	list_for_each_entry(data, &hwsim_radios, list) {
6614		if (data->idx <= last_idx)
6615			continue;
6616
6617		if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
6618			continue;
6619
6620		res = mac80211_hwsim_get_radio(skb, data,
6621					       NETLINK_CB(cb->skb).portid,
6622					       cb->nlh->nlmsg_seq, cb,
6623					       NLM_F_MULTI);
6624		if (res < 0)
6625			break;
6626
6627		last_idx = data->idx;
6628	}
6629
6630	cb->args[0] = last_idx + 1;
6631
6632	/* list changed, but no new element sent, set interrupted flag */
6633	if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
6634		hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
6635				  cb->nlh->nlmsg_seq, &hwsim_genl_family,
6636				  NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
6637		if (hdr) {
6638			genl_dump_check_consistent(cb, hdr);
6639			genlmsg_end(skb, hdr);
6640		} else {
6641			res = -EMSGSIZE;
6642		}
6643	}
6644
6645done:
6646	spin_unlock_bh(&hwsim_radio_lock);
6647	return res ?: skb->len;
6648}
6649
6650/* Generic Netlink operations array */
6651static const struct genl_small_ops hwsim_ops[] = {
6652	{
6653		.cmd = HWSIM_CMD_REGISTER,
6654		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6655		.doit = hwsim_register_received_nl,
6656		.flags = GENL_UNS_ADMIN_PERM,
6657	},
6658	{
6659		.cmd = HWSIM_CMD_FRAME,
6660		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6661		.doit = hwsim_cloned_frame_received_nl,
6662	},
6663	{
6664		.cmd = HWSIM_CMD_TX_INFO_FRAME,
6665		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6666		.doit = hwsim_tx_info_frame_received_nl,
6667	},
6668	{
6669		.cmd = HWSIM_CMD_NEW_RADIO,
6670		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6671		.doit = hwsim_new_radio_nl,
6672		.flags = GENL_UNS_ADMIN_PERM,
6673	},
6674	{
6675		.cmd = HWSIM_CMD_DEL_RADIO,
6676		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6677		.doit = hwsim_del_radio_nl,
6678		.flags = GENL_UNS_ADMIN_PERM,
6679	},
6680	{
6681		.cmd = HWSIM_CMD_GET_RADIO,
6682		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6683		.doit = hwsim_get_radio_nl,
6684		.dumpit = hwsim_dump_radio_nl,
6685	},
6686	{
6687		.cmd = HWSIM_CMD_REPORT_PMSR,
6688		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6689		.doit = hwsim_pmsr_report_nl,
6690	},
6691};
6692
6693static struct genl_family hwsim_genl_family __ro_after_init = {
6694	.name = "MAC80211_HWSIM",
6695	.version = 1,
6696	.maxattr = HWSIM_ATTR_MAX,
6697	.policy = hwsim_genl_policy,
6698	.netnsok = true,
6699	.module = THIS_MODULE,
6700	.small_ops = hwsim_ops,
6701	.n_small_ops = ARRAY_SIZE(hwsim_ops),
6702	.resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
6703	.mcgrps = hwsim_mcgrps,
6704	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
6705};
6706
6707static void remove_user_radios(u32 portid, int netgroup)
6708{
6709	struct mac80211_hwsim_data *entry, *tmp;
6710	LIST_HEAD(list);
6711
6712	spin_lock_bh(&hwsim_radio_lock);
6713	list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
6714		if (entry->destroy_on_close && entry->portid == portid &&
6715		    entry->netgroup == netgroup) {
6716			list_move(&entry->list, &list);
6717			rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
6718					       hwsim_rht_params);
6719			hwsim_radios_generation++;
6720		}
6721	}
6722	spin_unlock_bh(&hwsim_radio_lock);
6723
6724	list_for_each_entry_safe(entry, tmp, &list, list) {
6725		list_del(&entry->list);
6726		mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
6727					 NULL);
6728	}
6729}
6730
6731static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
6732					 unsigned long state,
6733					 void *_notify)
6734{
6735	struct netlink_notify *notify = _notify;
6736
6737	if (state != NETLINK_URELEASE)
6738		return NOTIFY_DONE;
6739
6740	remove_user_radios(notify->portid, hwsim_net_get_netgroup(notify->net));
6741
6742	if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
6743		printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
6744		       " socket, switching to perfect channel medium\n");
6745		hwsim_register_wmediumd(notify->net, 0);
6746	}
6747	return NOTIFY_DONE;
6748
6749}
6750
6751static struct notifier_block hwsim_netlink_notifier = {
6752	.notifier_call = mac80211_hwsim_netlink_notify,
6753};
6754
6755static int __init hwsim_init_netlink(void)
6756{
6757	int rc;
6758
6759	printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
6760
6761	rc = genl_register_family(&hwsim_genl_family);
6762	if (rc)
6763		goto failure;
6764
6765	rc = netlink_register_notifier(&hwsim_netlink_notifier);
6766	if (rc) {
6767		genl_unregister_family(&hwsim_genl_family);
6768		goto failure;
6769	}
6770
6771	return 0;
6772
6773failure:
6774	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
6775	return -EINVAL;
6776}
6777
6778static __net_init int hwsim_init_net(struct net *net)
6779{
6780	return hwsim_net_set_netgroup(net);
6781}
6782
6783static void __net_exit hwsim_exit_net(struct net *net)
6784{
6785	struct mac80211_hwsim_data *data, *tmp;
6786	LIST_HEAD(list);
6787
6788	spin_lock_bh(&hwsim_radio_lock);
6789	list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
6790		if (!net_eq(wiphy_net(data->hw->wiphy), net))
6791			continue;
6792
6793		/* Radios created in init_net are returned to init_net. */
6794		if (data->netgroup == hwsim_net_get_netgroup(&init_net))
6795			continue;
6796
6797		list_move(&data->list, &list);
6798		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6799				       hwsim_rht_params);
6800		hwsim_radios_generation++;
6801	}
6802	spin_unlock_bh(&hwsim_radio_lock);
6803
6804	list_for_each_entry_safe(data, tmp, &list, list) {
6805		list_del(&data->list);
6806		mac80211_hwsim_del_radio(data,
6807					 wiphy_name(data->hw->wiphy),
6808					 NULL);
6809	}
6810
6811	ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
6812}
6813
6814static struct pernet_operations hwsim_net_ops = {
6815	.init = hwsim_init_net,
6816	.exit = hwsim_exit_net,
6817	.id   = &hwsim_net_id,
6818	.size = sizeof(struct hwsim_net),
6819};
6820
6821static void hwsim_exit_netlink(void)
6822{
6823	/* unregister the notifier */
6824	netlink_unregister_notifier(&hwsim_netlink_notifier);
6825	/* unregister the family */
6826	genl_unregister_family(&hwsim_genl_family);
6827}
6828
6829#if IS_REACHABLE(CONFIG_VIRTIO)
6830static void hwsim_virtio_tx_done(struct virtqueue *vq)
6831{
6832	unsigned int len;
6833	struct sk_buff *skb;
6834	unsigned long flags;
6835
6836	spin_lock_irqsave(&hwsim_virtio_lock, flags);
6837	while ((skb = virtqueue_get_buf(vq, &len)))
6838		dev_kfree_skb_irq(skb);
6839	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6840}
6841
6842static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
6843{
6844	struct nlmsghdr *nlh;
6845	struct genlmsghdr *gnlh;
6846	struct nlattr *tb[HWSIM_ATTR_MAX + 1];
6847	struct genl_info info = {};
6848	int err;
6849
6850	nlh = nlmsg_hdr(skb);
6851	gnlh = nlmsg_data(nlh);
6852
6853	if (skb->len < nlh->nlmsg_len)
6854		return -EINVAL;
6855
6856	err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
6857			    hwsim_genl_policy, NULL);
6858	if (err) {
6859		pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
6860		return err;
6861	}
6862
6863	info.attrs = tb;
6864
6865	switch (gnlh->cmd) {
6866	case HWSIM_CMD_FRAME:
6867		hwsim_cloned_frame_received_nl(skb, &info);
6868		break;
6869	case HWSIM_CMD_TX_INFO_FRAME:
6870		hwsim_tx_info_frame_received_nl(skb, &info);
6871		break;
6872	case HWSIM_CMD_REPORT_PMSR:
6873		hwsim_pmsr_report_nl(skb, &info);
6874		break;
6875	default:
6876		pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
6877		return -EPROTO;
6878	}
6879	return 0;
6880}
6881
6882static void hwsim_virtio_rx_work(struct work_struct *work)
6883{
6884	struct virtqueue *vq;
6885	unsigned int len;
6886	struct sk_buff *skb;
6887	struct scatterlist sg[1];
6888	int err;
6889	unsigned long flags;
6890
6891	spin_lock_irqsave(&hwsim_virtio_lock, flags);
6892	if (!hwsim_virtio_enabled)
6893		goto out_unlock;
6894
6895	skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
6896	if (!skb)
6897		goto out_unlock;
6898	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6899
6900	skb->data = skb->head;
6901	skb_reset_tail_pointer(skb);
6902	skb_put(skb, len);
6903	hwsim_virtio_handle_cmd(skb);
6904
6905	spin_lock_irqsave(&hwsim_virtio_lock, flags);
6906	if (!hwsim_virtio_enabled) {
6907		dev_kfree_skb_irq(skb);
6908		goto out_unlock;
6909	}
6910	vq = hwsim_vqs[HWSIM_VQ_RX];
6911	sg_init_one(sg, skb->head, skb_end_offset(skb));
6912	err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
6913	if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
6914		dev_kfree_skb_irq(skb);
6915	else
6916		virtqueue_kick(vq);
6917	schedule_work(&hwsim_virtio_rx);
6918
6919out_unlock:
6920	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6921}
6922
6923static void hwsim_virtio_rx_done(struct virtqueue *vq)
6924{
6925	schedule_work(&hwsim_virtio_rx);
6926}
6927
6928static int init_vqs(struct virtio_device *vdev)
6929{
6930	struct virtqueue_info vqs_info[HWSIM_NUM_VQS] = {
6931		[HWSIM_VQ_TX] = { "tx", hwsim_virtio_tx_done },
6932		[HWSIM_VQ_RX] = { "rx", hwsim_virtio_rx_done },
6933	};
6934
6935	return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
6936			       hwsim_vqs, vqs_info, NULL);
6937}
6938
6939static int fill_vq(struct virtqueue *vq)
6940{
6941	int i, err;
6942	struct sk_buff *skb;
6943	struct scatterlist sg[1];
6944
6945	for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
6946		skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
6947		if (!skb)
6948			return -ENOMEM;
6949
6950		sg_init_one(sg, skb->head, skb_end_offset(skb));
6951		err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
6952		if (err) {
6953			nlmsg_free(skb);
6954			return err;
6955		}
6956	}
6957	virtqueue_kick(vq);
6958	return 0;
6959}
6960
6961static void remove_vqs(struct virtio_device *vdev)
6962{
6963	int i;
6964
6965	virtio_reset_device(vdev);
6966
6967	for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
6968		struct virtqueue *vq = hwsim_vqs[i];
6969		struct sk_buff *skb;
6970
6971		while ((skb = virtqueue_detach_unused_buf(vq)))
6972			nlmsg_free(skb);
6973	}
6974
6975	vdev->config->del_vqs(vdev);
6976}
6977
6978static int hwsim_virtio_probe(struct virtio_device *vdev)
6979{
6980	int err;
6981	unsigned long flags;
6982
6983	spin_lock_irqsave(&hwsim_virtio_lock, flags);
6984	if (hwsim_virtio_enabled) {
6985		spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6986		return -EEXIST;
6987	}
6988	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6989
6990	err = init_vqs(vdev);
6991	if (err)
6992		return err;
6993
6994	virtio_device_ready(vdev);
6995
6996	err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
6997	if (err)
6998		goto out_remove;
6999
7000	spin_lock_irqsave(&hwsim_virtio_lock, flags);
7001	hwsim_virtio_enabled = true;
7002	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
7003
7004	schedule_work(&hwsim_virtio_rx);
7005	return 0;
7006
7007out_remove:
7008	remove_vqs(vdev);
7009	return err;
7010}
7011
7012static void hwsim_virtio_remove(struct virtio_device *vdev)
7013{
7014	hwsim_virtio_enabled = false;
7015
7016	cancel_work_sync(&hwsim_virtio_rx);
7017
7018	remove_vqs(vdev);
7019}
7020
7021/* MAC80211_HWSIM virtio device id table */
7022static const struct virtio_device_id id_table[] = {
7023	{ VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
7024	{ 0 }
7025};
7026MODULE_DEVICE_TABLE(virtio, id_table);
7027
7028static struct virtio_driver virtio_hwsim = {
7029	.driver.name = KBUILD_MODNAME,
7030	.id_table = id_table,
7031	.probe = hwsim_virtio_probe,
7032	.remove = hwsim_virtio_remove,
7033};
7034
7035static int hwsim_register_virtio_driver(void)
7036{
7037	return register_virtio_driver(&virtio_hwsim);
7038}
7039
7040static void hwsim_unregister_virtio_driver(void)
7041{
7042	unregister_virtio_driver(&virtio_hwsim);
7043}
7044#else
7045static inline int hwsim_register_virtio_driver(void)
7046{
7047	return 0;
7048}
7049
7050static inline void hwsim_unregister_virtio_driver(void)
7051{
7052}
7053#endif
7054
7055static int __init init_mac80211_hwsim(void)
7056{
7057	int i, err;
7058
7059	if (radios < 0 || radios > 100)
7060		return -EINVAL;
7061
7062	if (channels < 1)
7063		return -EINVAL;
7064
7065	err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
7066	if (err)
7067		return err;
7068
7069	err = register_pernet_device(&hwsim_net_ops);
7070	if (err)
7071		goto out_free_rht;
7072
7073	err = platform_driver_register(&mac80211_hwsim_driver);
7074	if (err)
7075		goto out_unregister_pernet;
7076
7077	err = hwsim_init_netlink();
7078	if (err)
7079		goto out_unregister_driver;
7080
7081	err = hwsim_register_virtio_driver();
7082	if (err)
7083		goto out_exit_netlink;
7084
7085	hwsim_class = class_create("mac80211_hwsim");
7086	if (IS_ERR(hwsim_class)) {
7087		err = PTR_ERR(hwsim_class);
7088		goto out_exit_virtio;
7089	}
7090
7091	hwsim_init_s1g_channels(hwsim_channels_s1g);
7092
7093	for (i = 0; i < radios; i++) {
7094		struct hwsim_new_radio_params param = { 0 };
7095
7096		param.channels = channels;
7097
7098		switch (regtest) {
7099		case HWSIM_REGTEST_DIFF_COUNTRY:
7100			if (i < ARRAY_SIZE(hwsim_alpha2s))
7101				param.reg_alpha2 = hwsim_alpha2s[i];
7102			break;
7103		case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
7104			if (!i)
7105				param.reg_alpha2 = hwsim_alpha2s[0];
7106			break;
7107		case HWSIM_REGTEST_STRICT_ALL:
7108			param.reg_strict = true;
7109			fallthrough;
7110		case HWSIM_REGTEST_DRIVER_REG_ALL:
7111			param.reg_alpha2 = hwsim_alpha2s[0];
7112			break;
7113		case HWSIM_REGTEST_WORLD_ROAM:
7114			if (i == 0)
7115				param.regd = &hwsim_world_regdom_custom_01;
7116			break;
7117		case HWSIM_REGTEST_CUSTOM_WORLD:
7118			param.regd = &hwsim_world_regdom_custom_03;
7119			break;
7120		case HWSIM_REGTEST_CUSTOM_WORLD_2:
7121			if (i == 0)
7122				param.regd = &hwsim_world_regdom_custom_03;
7123			else if (i == 1)
7124				param.regd = &hwsim_world_regdom_custom_02;
7125			break;
7126		case HWSIM_REGTEST_STRICT_FOLLOW:
7127			if (i == 0) {
7128				param.reg_strict = true;
7129				param.reg_alpha2 = hwsim_alpha2s[0];
7130			}
7131			break;
7132		case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
7133			if (i == 0) {
7134				param.reg_strict = true;
7135				param.reg_alpha2 = hwsim_alpha2s[0];
7136			} else if (i == 1) {
7137				param.reg_alpha2 = hwsim_alpha2s[1];
7138			}
7139			break;
7140		case HWSIM_REGTEST_ALL:
7141			switch (i) {
7142			case 0:
7143				param.regd = &hwsim_world_regdom_custom_01;
7144				break;
7145			case 1:
7146				param.regd = &hwsim_world_regdom_custom_02;
7147				break;
7148			case 2:
7149				param.reg_alpha2 = hwsim_alpha2s[0];
7150				break;
7151			case 3:
7152				param.reg_alpha2 = hwsim_alpha2s[1];
7153				break;
7154			case 4:
7155				param.reg_strict = true;
7156				param.reg_alpha2 = hwsim_alpha2s[2];
7157				break;
7158			}
7159			break;
7160		default:
7161			break;
7162		}
7163
7164		param.p2p_device = support_p2p_device;
7165		param.nan_device = true;
7166		param.mlo = mlo;
7167		param.multi_radio = multi_radio;
7168		param.use_chanctx = channels > 1 || mlo || multi_radio;
7169		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
7170		if (param.p2p_device)
7171			param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
7172		param.iftypes |= BIT(NL80211_IFTYPE_NAN);
7173
7174		err = mac80211_hwsim_new_radio(NULL, &param);
7175		if (err < 0)
7176			goto out_free_radios;
7177	}
7178
7179	hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
7180				 hwsim_mon_setup);
7181	if (hwsim_mon == NULL) {
7182		err = -ENOMEM;
7183		goto out_free_radios;
7184	}
7185
7186	rtnl_lock();
7187	err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
7188	if (err < 0) {
7189		rtnl_unlock();
7190		goto out_free_mon;
7191	}
7192
7193	err = register_netdevice(hwsim_mon);
7194	if (err < 0) {
7195		rtnl_unlock();
7196		goto out_free_mon;
7197	}
7198	rtnl_unlock();
7199
7200	return 0;
7201
7202out_free_mon:
7203	free_netdev(hwsim_mon);
7204out_free_radios:
7205	mac80211_hwsim_free();
7206out_exit_virtio:
7207	hwsim_unregister_virtio_driver();
7208out_exit_netlink:
7209	hwsim_exit_netlink();
7210out_unregister_driver:
7211	platform_driver_unregister(&mac80211_hwsim_driver);
7212out_unregister_pernet:
7213	unregister_pernet_device(&hwsim_net_ops);
7214out_free_rht:
7215	rhashtable_destroy(&hwsim_radios_rht);
7216	return err;
7217}
7218module_init(init_mac80211_hwsim);
7219
7220static void __exit exit_mac80211_hwsim(void)
7221{
7222	pr_debug("mac80211_hwsim: unregister radios\n");
7223
7224	hwsim_unregister_virtio_driver();
7225	hwsim_exit_netlink();
7226
7227	mac80211_hwsim_free();
7228
7229	rhashtable_destroy(&hwsim_radios_rht);
7230	unregister_netdev(hwsim_mon);
7231	platform_driver_unregister(&mac80211_hwsim_driver);
7232	unregister_pernet_device(&hwsim_net_ops);
7233}
7234module_exit(exit_mac80211_hwsim);
~/ Read-only file preview.