drivers/net/wireless/virtual/mac80211_hwsim.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
   4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
   6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
   7  * Copyright (C) 2018 - 2022 Intel Corporation
   8  */
   9
  10 /*
  11  * TODO:
  12  * - Add TSF sync and fix IBSS beacon transmission by adding
  13  *   competition for "air time" at TBTT
  14  * - RX filtering based on filter configuration (data->rx_filter)
  15  */
  16
  17 #include <linux/list.h>
  18 #include <linux/slab.h>
  19 #include <linux/spinlock.h>
  20 #include <net/dst.h>
  21 #include <net/xfrm.h>
  22 #include <net/mac80211.h>
  23 #include <net/ieee80211_radiotap.h>
  24 #include <linux/if_arp.h>
  25 #include <linux/rtnetlink.h>
  26 #include <linux/etherdevice.h>
  27 #include <linux/platform_device.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/module.h>
  30 #include <linux/ktime.h>
  31 #include <net/genetlink.h>
  32 #include <net/net_namespace.h>
  33 #include <net/netns/generic.h>
  34 #include <linux/rhashtable.h>
  35 #include <linux/nospec.h>
  36 #include <linux/virtio.h>
  37 #include <linux/virtio_ids.h>
  38 #include <linux/virtio_config.h>
  39 #include "mac80211_hwsim.h"
  40
  41 #define WARN_QUEUE 100
  42 #define MAX_QUEUE 200
  43
  44 MODULE_AUTHOR("Jouni Malinen");
  45 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
  46 MODULE_LICENSE("GPL");
  47
  48 static int radios = 2;
  49 module_param(radios, int, 0444);
  50 MODULE_PARM_DESC(radios, "Number of simulated radios");
  51
  52 static int channels = 1;
  53 module_param(channels, int, 0444);
  54 MODULE_PARM_DESC(channels, "Number of concurrent channels");
  55
  56 static bool paged_rx = false;
  57 module_param(paged_rx, bool, 0644);
  58 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
  59
  60 static bool rctbl = false;
  61 module_param(rctbl, bool, 0444);
  62 MODULE_PARM_DESC(rctbl, "Handle rate control table");
  63
  64 static bool support_p2p_device = true;
  65 module_param(support_p2p_device, bool, 0444);
  66 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
  67
  68 static bool mlo;
  69 module_param(mlo, bool, 0444);
  70 MODULE_PARM_DESC(mlo, "Support MLO");
  71
  72 /**
  73  * enum hwsim_regtest - the type of regulatory tests we offer
  74  *
  75  * These are the different values you can use for the regtest
  76  * module parameter. This is useful to help test world roaming
  77  * and the driver regulatory_hint() call and combinations of these.
  78  * If you want to do specific alpha2 regulatory domain tests simply
  79  * use the userspace regulatory request as that will be respected as
  80  * well without the need of this module parameter. This is designed
  81  * only for testing the driver regulatory request, world roaming
  82  * and all possible combinations.
  83  *
  84  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
  85  *      this is the default value.
  86  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
  87  *      hint, only one driver regulatory hint will be sent as such the
  88  *      secondary radios are expected to follow.
  89  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
  90  *      request with all radios reporting the same regulatory domain.
  91  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
  92  *      different regulatory domains requests. Expected behaviour is for
  93  *      an intersection to occur but each device will still use their
  94  *      respective regulatory requested domains. Subsequent radios will
  95  *      use the resulting intersection.
  96  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
  97  *      this by using a custom beacon-capable regulatory domain for the first
  98  *      radio. All other device world roam.
  99  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
 100  *      domain requests. All radios will adhere to this custom world regulatory
 101  *      domain.
 102  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
 103  *      domain requests. The first radio will adhere to the first custom world
 104  *      regulatory domain, the second one to the second custom world regulatory
 105  *      domain. All other devices will world roam.
 106  * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
 107  *      settings, only the first radio will send a regulatory domain request
 108  *      and use strict settings. The rest of the radios are expected to follow.
 109  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
 110  *      settings. All radios will adhere to this.
 111  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
 112  *      domain settings, combined with secondary driver regulatory domain
 113  *      settings. The first radio will get a strict regulatory domain setting
 114  *      using the first driver regulatory request and the second radio will use
 115  *      non-strict settings using the second driver regulatory request. All
 116  *      other devices should follow the intersection created between the
 117  *      first two.
 118  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
 119  *      at least 6 radios for a complete test. We will test in this order:
 120  *      1 - driver custom world regulatory domain
 121  *      2 - second custom world regulatory domain
 122  *      3 - first driver regulatory domain request
 123  *      4 - second driver regulatory domain request
 124  *      5 - strict regulatory domain settings using the third driver regulatory
 125  *          domain request
 126  *      6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
 127  *                 regulatory requests.
 128  */
 129 enum hwsim_regtest {
 130         HWSIM_REGTEST_DISABLED = 0,
 131         HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
 132         HWSIM_REGTEST_DRIVER_REG_ALL = 2,
 133         HWSIM_REGTEST_DIFF_COUNTRY = 3,
 134         HWSIM_REGTEST_WORLD_ROAM = 4,
 135         HWSIM_REGTEST_CUSTOM_WORLD = 5,
 136         HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
 137         HWSIM_REGTEST_STRICT_FOLLOW = 7,
 138         HWSIM_REGTEST_STRICT_ALL = 8,
 139         HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
 140         HWSIM_REGTEST_ALL = 10,
 141 };
 142
 143 /* Set to one of the HWSIM_REGTEST_* values above */
 144 static int regtest = HWSIM_REGTEST_DISABLED;
 145 module_param(regtest, int, 0444);
 146 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
 147
 148 static const char *hwsim_alpha2s[] = {
 149         "FI",
 150         "AL",
 151         "US",
 152         "DE",
 153         "JP",
 154         "AL",
 155 };
 156
 157 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
 158         .n_reg_rules = 5,
 159         .alpha2 =  "99",
 160         .reg_rules = {
 161                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 162                 REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
 163                 REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
 164                 REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
 165                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 166         }
 167 };
 168
 169 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
 170         .n_reg_rules = 3,
 171         .alpha2 =  "99",
 172         .reg_rules = {
 173                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
 174                 REG_RULE(5725-10, 5850+10, 40, 0, 30,
 175                          NL80211_RRF_NO_IR),
 176                 REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
 177         }
 178 };
 179
 180 static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
 181         .n_reg_rules = 6,
 182         .alpha2 =  "99",
 183         .reg_rules = {
 184                 REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
 185                 REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
 186                 REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
 187                 REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
 188                 REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
 189                 REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
 190         }
 191 };
 192
 193 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
 194         &hwsim_world_regdom_custom_01,
 195         &hwsim_world_regdom_custom_02,
 196         &hwsim_world_regdom_custom_03,
 197 };
 198
 199 struct hwsim_vif_priv {
 200         u32 magic;
 201         u8 bssid[ETH_ALEN];
 202         bool assoc;
 203         bool bcn_en;
 204         u16 aid;
 205 };
 206
 207 #define HWSIM_VIF_MAGIC 0x69537748
 208
 209 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
 210 {
 211         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 212         WARN(vp->magic != HWSIM_VIF_MAGIC,
 213              "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
 214              vif, vp->magic, vif->addr, vif->type, vif->p2p);
 215 }
 216
 217 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
 218 {
 219         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 220         vp->magic = HWSIM_VIF_MAGIC;
 221 }
 222
 223 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
 224 {
 225         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 226         vp->magic = 0;
 227 }
 228
 229 struct hwsim_sta_priv {
 230         u32 magic;
 231         unsigned int last_link;
 232         u16 active_links_rx;
 233 };
 234
 235 #define HWSIM_STA_MAGIC 0x6d537749
 236
 237 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
 238 {
 239         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 240         WARN_ON(sp->magic != HWSIM_STA_MAGIC);
 241 }
 242
 243 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
 244 {
 245         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 246         sp->magic = HWSIM_STA_MAGIC;
 247 }
 248
 249 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
 250 {
 251         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
 252         sp->magic = 0;
 253 }
 254
 255 struct hwsim_chanctx_priv {
 256         u32 magic;
 257 };
 258
 259 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
 260
 261 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
 262 {
 263         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 264         WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
 265 }
 266
 267 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
 268 {
 269         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 270         cp->magic = HWSIM_CHANCTX_MAGIC;
 271 }
 272
 273 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
 274 {
 275         struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
 276         cp->magic = 0;
 277 }
 278
 279 static unsigned int hwsim_net_id;
 280
 281 static DEFINE_IDA(hwsim_netgroup_ida);
 282
 283 struct hwsim_net {
 284         int netgroup;
 285         u32 wmediumd;
 286 };
 287
 288 static inline int hwsim_net_get_netgroup(struct net *net)
 289 {
 290         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 291
 292         return hwsim_net->netgroup;
 293 }
 294
 295 static inline int hwsim_net_set_netgroup(struct net *net)
 296 {
 297         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 298
 299         hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
 300         return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
 301 }
 302
 303 static inline u32 hwsim_net_get_wmediumd(struct net *net)
 304 {
 305         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 306
 307         return hwsim_net->wmediumd;
 308 }
 309
 310 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
 311 {
 312         struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
 313
 314         hwsim_net->wmediumd = portid;
 315 }
 316
 317 static struct class *hwsim_class;
 318
 319 static struct net_device *hwsim_mon; /* global monitor netdev */
 320
 321 #define CHAN2G(_freq)  { \
 322         .band = NL80211_BAND_2GHZ, \
 323         .center_freq = (_freq), \
 324         .hw_value = (_freq), \
 325 }
 326
 327 #define CHAN5G(_freq) { \
 328         .band = NL80211_BAND_5GHZ, \
 329         .center_freq = (_freq), \
 330         .hw_value = (_freq), \
 331 }
 332
 333 #define CHAN6G(_freq) { \
 334         .band = NL80211_BAND_6GHZ, \
 335         .center_freq = (_freq), \
 336         .hw_value = (_freq), \
 337 }
 338
 339 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
 340         CHAN2G(2412), /* Channel 1 */
 341         CHAN2G(2417), /* Channel 2 */
 342         CHAN2G(2422), /* Channel 3 */
 343         CHAN2G(2427), /* Channel 4 */
 344         CHAN2G(2432), /* Channel 5 */
 345         CHAN2G(2437), /* Channel 6 */
 346         CHAN2G(2442), /* Channel 7 */
 347         CHAN2G(2447), /* Channel 8 */
 348         CHAN2G(2452), /* Channel 9 */
 349         CHAN2G(2457), /* Channel 10 */
 350         CHAN2G(2462), /* Channel 11 */
 351         CHAN2G(2467), /* Channel 12 */
 352         CHAN2G(2472), /* Channel 13 */
 353         CHAN2G(2484), /* Channel 14 */
 354 };
 355
 356 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
 357         CHAN5G(5180), /* Channel 36 */
 358         CHAN5G(5200), /* Channel 40 */
 359         CHAN5G(5220), /* Channel 44 */
 360         CHAN5G(5240), /* Channel 48 */
 361
 362         CHAN5G(5260), /* Channel 52 */
 363         CHAN5G(5280), /* Channel 56 */
 364         CHAN5G(5300), /* Channel 60 */
 365         CHAN5G(5320), /* Channel 64 */
 366
 367         CHAN5G(5500), /* Channel 100 */
 368         CHAN5G(5520), /* Channel 104 */
 369         CHAN5G(5540), /* Channel 108 */
 370         CHAN5G(5560), /* Channel 112 */
 371         CHAN5G(5580), /* Channel 116 */
 372         CHAN5G(5600), /* Channel 120 */
 373         CHAN5G(5620), /* Channel 124 */
 374         CHAN5G(5640), /* Channel 128 */
 375         CHAN5G(5660), /* Channel 132 */
 376         CHAN5G(5680), /* Channel 136 */
 377         CHAN5G(5700), /* Channel 140 */
 378
 379         CHAN5G(5745), /* Channel 149 */
 380         CHAN5G(5765), /* Channel 153 */
 381         CHAN5G(5785), /* Channel 157 */
 382         CHAN5G(5805), /* Channel 161 */
 383         CHAN5G(5825), /* Channel 165 */
 384         CHAN5G(5845), /* Channel 169 */
 385
 386         CHAN5G(5855), /* Channel 171 */
 387         CHAN5G(5860), /* Channel 172 */
 388         CHAN5G(5865), /* Channel 173 */
 389         CHAN5G(5870), /* Channel 174 */
 390
 391         CHAN5G(5875), /* Channel 175 */
 392         CHAN5G(5880), /* Channel 176 */
 393         CHAN5G(5885), /* Channel 177 */
 394         CHAN5G(5890), /* Channel 178 */
 395         CHAN5G(5895), /* Channel 179 */
 396         CHAN5G(5900), /* Channel 180 */
 397         CHAN5G(5905), /* Channel 181 */
 398
 399         CHAN5G(5910), /* Channel 182 */
 400         CHAN5G(5915), /* Channel 183 */
 401         CHAN5G(5920), /* Channel 184 */
 402         CHAN5G(5925), /* Channel 185 */
 403 };
 404
 405 static const struct ieee80211_channel hwsim_channels_6ghz[] = {
 406         CHAN6G(5955), /* Channel 1 */
 407         CHAN6G(5975), /* Channel 5 */
 408         CHAN6G(5995), /* Channel 9 */
 409         CHAN6G(6015), /* Channel 13 */
 410         CHAN6G(6035), /* Channel 17 */
 411         CHAN6G(6055), /* Channel 21 */
 412         CHAN6G(6075), /* Channel 25 */
 413         CHAN6G(6095), /* Channel 29 */
 414         CHAN6G(6115), /* Channel 33 */
 415         CHAN6G(6135), /* Channel 37 */
 416         CHAN6G(6155), /* Channel 41 */
 417         CHAN6G(6175), /* Channel 45 */
 418         CHAN6G(6195), /* Channel 49 */
 419         CHAN6G(6215), /* Channel 53 */
 420         CHAN6G(6235), /* Channel 57 */
 421         CHAN6G(6255), /* Channel 61 */
 422         CHAN6G(6275), /* Channel 65 */
 423         CHAN6G(6295), /* Channel 69 */
 424         CHAN6G(6315), /* Channel 73 */
 425         CHAN6G(6335), /* Channel 77 */
 426         CHAN6G(6355), /* Channel 81 */
 427         CHAN6G(6375), /* Channel 85 */
 428         CHAN6G(6395), /* Channel 89 */
 429         CHAN6G(6415), /* Channel 93 */
 430         CHAN6G(6435), /* Channel 97 */
 431         CHAN6G(6455), /* Channel 181 */
 432         CHAN6G(6475), /* Channel 105 */
 433         CHAN6G(6495), /* Channel 109 */
 434         CHAN6G(6515), /* Channel 113 */
 435         CHAN6G(6535), /* Channel 117 */
 436         CHAN6G(6555), /* Channel 121 */
 437         CHAN6G(6575), /* Channel 125 */
 438         CHAN6G(6595), /* Channel 129 */
 439         CHAN6G(6615), /* Channel 133 */
 440         CHAN6G(6635), /* Channel 137 */
 441         CHAN6G(6655), /* Channel 141 */
 442         CHAN6G(6675), /* Channel 145 */
 443         CHAN6G(6695), /* Channel 149 */
 444         CHAN6G(6715), /* Channel 153 */
 445         CHAN6G(6735), /* Channel 157 */
 446         CHAN6G(6755), /* Channel 161 */
 447         CHAN6G(6775), /* Channel 165 */
 448         CHAN6G(6795), /* Channel 169 */
 449         CHAN6G(6815), /* Channel 173 */
 450         CHAN6G(6835), /* Channel 177 */
 451         CHAN6G(6855), /* Channel 181 */
 452         CHAN6G(6875), /* Channel 185 */
 453         CHAN6G(6895), /* Channel 189 */
 454         CHAN6G(6915), /* Channel 193 */
 455         CHAN6G(6935), /* Channel 197 */
 456         CHAN6G(6955), /* Channel 201 */
 457         CHAN6G(6975), /* Channel 205 */
 458         CHAN6G(6995), /* Channel 209 */
 459         CHAN6G(7015), /* Channel 213 */
 460         CHAN6G(7035), /* Channel 217 */
 461         CHAN6G(7055), /* Channel 221 */
 462         CHAN6G(7075), /* Channel 225 */
 463         CHAN6G(7095), /* Channel 229 */
 464         CHAN6G(7115), /* Channel 233 */
 465 };
 466
 467 #define NUM_S1G_CHANS_US 51
 468 static struct ieee80211_channel hwsim_channels_s1g[NUM_S1G_CHANS_US];
 469
 470 static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
 471         .s1g = true,
 472         .cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
 473                  0,
 474                  0,
 475                  S1G_CAP3_MAX_MPDU_LEN,
 476                  0,
 477                  S1G_CAP5_AMPDU,
 478                  0,
 479                  S1G_CAP7_DUP_1MHZ,
 480                  S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
 481                  0},
 482         .nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
 483         /* RX Highest Supported Long GI Data Rate 0:7 */
 484                      0,
 485         /* RX Highest Supported Long GI Data Rate 0:7 */
 486         /* TX S1G MCS Map 0:6 */
 487                      0xfa,
 488         /* TX S1G MCS Map :7 */
 489         /* TX Highest Supported Long GI Data Rate 0:6 */
 490                      0x80,
 491         /* TX Highest Supported Long GI Data Rate 7:8 */
 492         /* Rx Single spatial stream and S1G-MCS Map for 1MHz */
 493         /* Tx Single spatial stream and S1G-MCS Map for 1MHz */
 494                      0 },
 495 };
 496
 497 static void hwsim_init_s1g_channels(struct ieee80211_channel *chans)
 498 {
 499         int ch, freq;
 500
 501         for (ch = 0; ch < NUM_S1G_CHANS_US; ch++) {
 502                 freq = 902000 + (ch + 1) * 500;
 503                 chans[ch].band = NL80211_BAND_S1GHZ;
 504                 chans[ch].center_freq = KHZ_TO_MHZ(freq);
 505                 chans[ch].freq_offset = freq % 1000;
 506                 chans[ch].hw_value = ch + 1;
 507         }
 508 }
 509
 510 static const struct ieee80211_rate hwsim_rates[] = {
 511         { .bitrate = 10 },
 512         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 513         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 514         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 515         { .bitrate = 60 },
 516         { .bitrate = 90 },
 517         { .bitrate = 120 },
 518         { .bitrate = 180 },
 519         { .bitrate = 240 },
 520         { .bitrate = 360 },
 521         { .bitrate = 480 },
 522         { .bitrate = 540 }
 523 };
 524
 525 #define DEFAULT_RX_RSSI -50
 526
 527 static const u32 hwsim_ciphers[] = {
 528         WLAN_CIPHER_SUITE_WEP40,
 529         WLAN_CIPHER_SUITE_WEP104,
 530         WLAN_CIPHER_SUITE_TKIP,
 531         WLAN_CIPHER_SUITE_CCMP,
 532         WLAN_CIPHER_SUITE_CCMP_256,
 533         WLAN_CIPHER_SUITE_GCMP,
 534         WLAN_CIPHER_SUITE_GCMP_256,
 535         WLAN_CIPHER_SUITE_AES_CMAC,
 536         WLAN_CIPHER_SUITE_BIP_CMAC_256,
 537         WLAN_CIPHER_SUITE_BIP_GMAC_128,
 538         WLAN_CIPHER_SUITE_BIP_GMAC_256,
 539 };
 540
 541 #define OUI_QCA 0x001374
 542 #define QCA_NL80211_SUBCMD_TEST 1
 543 enum qca_nl80211_vendor_subcmds {
 544         QCA_WLAN_VENDOR_ATTR_TEST = 8,
 545         QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
 546 };
 547
 548 static const struct nla_policy
 549 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
 550         [QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
 551 };
 552
 553 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
 554                                           struct wireless_dev *wdev,
 555                                           const void *data, int data_len)
 556 {
 557         struct sk_buff *skb;
 558         struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 559         int err;
 560         u32 val;
 561
 562         err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
 563                                    data_len, hwsim_vendor_test_policy, NULL);
 564         if (err)
 565                 return err;
 566         if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
 567                 return -EINVAL;
 568         val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
 569         wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
 570
 571         /* Send a vendor event as a test. Note that this would not normally be
 572          * done within a command handler, but rather, based on some other
 573          * trigger. For simplicity, this command is used to trigger the event
 574          * here.
 575          *
 576          * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
 577          */
 578         skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
 579         if (skb) {
 580                 /* skb_put() or nla_put() will fill up data within
 581                  * NL80211_ATTR_VENDOR_DATA.
 582                  */
 583
 584                 /* Add vendor data */
 585                 nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
 586
 587                 /* Send the event - this will call nla_nest_end() */
 588                 cfg80211_vendor_event(skb, GFP_KERNEL);
 589         }
 590
 591         /* Send a response to the command */
 592         skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
 593         if (!skb)
 594                 return -ENOMEM;
 595
 596         /* skb_put() or nla_put() will fill up data within
 597          * NL80211_ATTR_VENDOR_DATA
 598          */
 599         nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
 600
 601         return cfg80211_vendor_cmd_reply(skb);
 602 }
 603
 604 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
 605         {
 606                 .info = { .vendor_id = OUI_QCA,
 607                           .subcmd = QCA_NL80211_SUBCMD_TEST },
 608                 .flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
 609                 .doit = mac80211_hwsim_vendor_cmd_test,
 610                 .policy = hwsim_vendor_test_policy,
 611                 .maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
 612         }
 613 };
 614
 615 /* Advertise support vendor specific events */
 616 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
 617         { .vendor_id = OUI_QCA, .subcmd = 1 },
 618 };
 619
 620 static DEFINE_SPINLOCK(hwsim_radio_lock);
 621 static LIST_HEAD(hwsim_radios);
 622 static struct rhashtable hwsim_radios_rht;
 623 static int hwsim_radio_idx;
 624 static int hwsim_radios_generation = 1;
 625
 626 static struct platform_driver mac80211_hwsim_driver = {
 627         .driver = {
 628                 .name = "mac80211_hwsim",
 629         },
 630 };
 631
 632 struct mac80211_hwsim_link_data {
 633         u32 link_id;
 634         u64 beacon_int  /* beacon interval in us */;
 635         struct hrtimer beacon_timer;
 636 };
 637
 638 struct mac80211_hwsim_data {
 639         struct list_head list;
 640         struct rhash_head rht;
 641         struct ieee80211_hw *hw;
 642         struct device *dev;
 643         struct ieee80211_supported_band bands[NUM_NL80211_BANDS];
 644         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
 645         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
 646         struct ieee80211_channel channels_6ghz[ARRAY_SIZE(hwsim_channels_6ghz)];
 647         struct ieee80211_channel channels_s1g[ARRAY_SIZE(hwsim_channels_s1g)];
 648         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 649         struct ieee80211_iface_combination if_combination;
 650         struct ieee80211_iface_limit if_limits[3];
 651         int n_if_limits;
 652
 653         u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
 654
 655         struct mac_address addresses[2];
 656         int channels, idx;
 657         bool use_chanctx;
 658         bool destroy_on_close;
 659         u32 portid;
 660         char alpha2[2];
 661         const struct ieee80211_regdomain *regd;
 662
 663         struct ieee80211_channel *tmp_chan;
 664         struct ieee80211_channel *roc_chan;
 665         u32 roc_duration;
 666         struct delayed_work roc_start;
 667         struct delayed_work roc_done;
 668         struct delayed_work hw_scan;
 669         struct cfg80211_scan_request *hw_scan_request;
 670         struct ieee80211_vif *hw_scan_vif;
 671         int scan_chan_idx;
 672         u8 scan_addr[ETH_ALEN];
 673         struct {
 674                 struct ieee80211_channel *channel;
 675                 unsigned long next_start, start, end;
 676         } survey_data[ARRAY_SIZE(hwsim_channels_2ghz) +
 677                       ARRAY_SIZE(hwsim_channels_5ghz) +
 678                       ARRAY_SIZE(hwsim_channels_6ghz)];
 679
 680         struct ieee80211_channel *channel;
 681         enum nl80211_chan_width bw;
 682         unsigned int rx_filter;
 683         bool started, idle, scanning;
 684         struct mutex mutex;
 685         enum ps_mode {
 686                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
 687         } ps;
 688         bool ps_poll_pending;
 689         struct dentry *debugfs;
 690
 691         atomic_t pending_cookie;
 692         struct sk_buff_head pending;    /* packets pending */
 693         /*
 694          * Only radios in the same group can communicate together (the
 695          * channel has to match too). Each bit represents a group. A
 696          * radio can be in more than one group.
 697          */
 698         u64 group;
 699
 700         /* group shared by radios created in the same netns */
 701         int netgroup;
 702         /* wmediumd portid responsible for netgroup of this radio */
 703         u32 wmediumd;
 704
 705         /* difference between this hw's clock and the real clock, in usecs */
 706         s64 tsf_offset;
 707         s64 bcn_delta;
 708         /* absolute beacon transmission time. Used to cover up "tx" delay. */
 709         u64 abs_bcn_ts;
 710
 711         /* Stats */
 712         u64 tx_pkts;
 713         u64 rx_pkts;
 714         u64 tx_bytes;
 715         u64 rx_bytes;
 716         u64 tx_dropped;
 717         u64 tx_failed;
 718
 719         /* RSSI in rx status of the receiver */
 720         int rx_rssi;
 721
 722         /* only used when pmsr capability is supplied */
 723         struct cfg80211_pmsr_capabilities pmsr_capa;
 724         struct cfg80211_pmsr_request *pmsr_request;
 725         struct wireless_dev *pmsr_request_wdev;
 726
 727         struct mac80211_hwsim_link_data link_data[IEEE80211_MLD_MAX_NUM_LINKS];
 728 };
 729
 730 static const struct rhashtable_params hwsim_rht_params = {
 731         .nelem_hint = 2,
 732         .automatic_shrinking = true,
 733         .key_len = ETH_ALEN,
 734         .key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
 735         .head_offset = offsetof(struct mac80211_hwsim_data, rht),
 736 };
 737
 738 struct hwsim_radiotap_hdr {
 739         struct ieee80211_radiotap_header hdr;
 740         __le64 rt_tsft;
 741         u8 rt_flags;
 742         u8 rt_rate;
 743         __le16 rt_channel;
 744         __le16 rt_chbitmask;
 745 } __packed;
 746
 747 struct hwsim_radiotap_ack_hdr {
 748         struct ieee80211_radiotap_header hdr;
 749         u8 rt_flags;
 750         u8 pad;
 751         __le16 rt_channel;
 752         __le16 rt_chbitmask;
 753 } __packed;
 754
 755 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
 756 {
 757         return rhashtable_lookup_fast(&hwsim_radios_rht, addr, hwsim_rht_params);
 758 }
 759
 760 /* MAC80211_HWSIM netlink family */
 761 static struct genl_family hwsim_genl_family;
 762
 763 enum hwsim_multicast_groups {
 764         HWSIM_MCGRP_CONFIG,
 765 };
 766
 767 static const struct genl_multicast_group hwsim_mcgrps[] = {
 768         [HWSIM_MCGRP_CONFIG] = { .name = "config", },
 769 };
 770
 771 /* MAC80211_HWSIM netlink policy */
 772
 773 static const struct nla_policy
 774 hwsim_rate_info_policy[HWSIM_RATE_INFO_ATTR_MAX + 1] = {
 775         [HWSIM_RATE_INFO_ATTR_FLAGS] = { .type = NLA_U8 },
 776         [HWSIM_RATE_INFO_ATTR_MCS] = { .type = NLA_U8 },
 777         [HWSIM_RATE_INFO_ATTR_LEGACY] = { .type = NLA_U16 },
 778         [HWSIM_RATE_INFO_ATTR_NSS] = { .type = NLA_U8 },
 779         [HWSIM_RATE_INFO_ATTR_BW] = { .type = NLA_U8 },
 780         [HWSIM_RATE_INFO_ATTR_HE_GI] = { .type = NLA_U8 },
 781         [HWSIM_RATE_INFO_ATTR_HE_DCM] = { .type = NLA_U8 },
 782         [HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC] = { .type = NLA_U8 },
 783         [HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH] = { .type = NLA_U8 },
 784         [HWSIM_RATE_INFO_ATTR_EHT_GI] = { .type = NLA_U8 },
 785         [HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC] = { .type = NLA_U8 },
 786 };
 787
 788 static const struct nla_policy
 789 hwsim_ftm_result_policy[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1] = {
 790         [NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON] = { .type = NLA_U32 },
 791         [NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX] = { .type = NLA_U16 },
 792         [NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS] = { .type = NLA_U32 },
 793         [NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES] = { .type = NLA_U32 },
 794         [NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME] = { .type = NLA_U8 },
 795         [NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP] = { .type = NLA_U8 },
 796         [NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION] = { .type = NLA_U8 },
 797         [NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
 798         [NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG] = { .type = NLA_U32 },
 799         [NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD] = { .type = NLA_U32 },
 800         [NL80211_PMSR_FTM_RESP_ATTR_TX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 801         [NL80211_PMSR_FTM_RESP_ATTR_RX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
 802         [NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG] = { .type = NLA_U64 },
 803         [NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE] = { .type = NLA_U64 },
 804         [NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD] = { .type = NLA_U64 },
 805         [NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG] = { .type = NLA_U64 },
 806         [NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE] = { .type = NLA_U64 },
 807         [NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD] = { .type = NLA_U64 },
 808         [NL80211_PMSR_FTM_RESP_ATTR_LCI] = { .type = NLA_STRING },
 809         [NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_STRING },
 810 };
 811
 812 static const struct nla_policy
 813 hwsim_pmsr_resp_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 814         [NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_result_policy),
 815 };
 816
 817 static const struct nla_policy
 818 hwsim_pmsr_resp_policy[NL80211_PMSR_RESP_ATTR_MAX + 1] = {
 819         [NL80211_PMSR_RESP_ATTR_STATUS] = { .type = NLA_U32 },
 820         [NL80211_PMSR_RESP_ATTR_HOST_TIME] = { .type = NLA_U64 },
 821         [NL80211_PMSR_RESP_ATTR_AP_TSF] = { .type = NLA_U64 },
 822         [NL80211_PMSR_RESP_ATTR_FINAL] = { .type = NLA_FLAG },
 823         [NL80211_PMSR_RESP_ATTR_DATA] = NLA_POLICY_NESTED(hwsim_pmsr_resp_type_policy),
 824 };
 825
 826 static const struct nla_policy
 827 hwsim_pmsr_peer_result_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 828         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 829         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_REJECT },
 830         [NL80211_PMSR_PEER_ATTR_REQ] = { .type = NLA_REJECT },
 831         [NL80211_PMSR_PEER_ATTR_RESP] = NLA_POLICY_NESTED(hwsim_pmsr_resp_policy),
 832 };
 833
 834 static const struct nla_policy
 835 hwsim_pmsr_peers_result_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 836         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 837         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 838         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 839         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 840         [NL80211_PMSR_ATTR_PEERS] = NLA_POLICY_NESTED_ARRAY(hwsim_pmsr_peer_result_policy),
 841 };
 842
 843 static const struct nla_policy
 844 hwsim_ftm_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
 845         [NL80211_PMSR_FTM_CAPA_ATTR_ASAP] = { .type = NLA_FLAG },
 846         [NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP] = { .type = NLA_FLAG },
 847         [NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI] = { .type = NLA_FLAG },
 848         [NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC] = { .type = NLA_FLAG },
 849         [NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES] = { .type = NLA_U32 },
 850         [NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS] = { .type = NLA_U32 },
 851         [NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT] = NLA_POLICY_MAX(NLA_U8, 15),
 852         [NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST] = NLA_POLICY_MAX(NLA_U8, 31),
 853         [NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 854         [NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 855 };
 856
 857 static const struct nla_policy
 858 hwsim_pmsr_capa_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 859         [NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_capa_policy),
 860 };
 861
 862 static const struct nla_policy
 863 hwsim_pmsr_capa_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 864         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_U32 },
 865         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_FLAG },
 866         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_FLAG },
 867         [NL80211_PMSR_ATTR_TYPE_CAPA] = NLA_POLICY_NESTED(hwsim_pmsr_capa_type_policy),
 868         [NL80211_PMSR_ATTR_PEERS] = { .type = NLA_REJECT }, // only for request.
 869 };
 870
 871 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
 872         [HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
 873         [HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
 874         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
 875                                .len = IEEE80211_MAX_DATA_LEN },
 876         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
 877         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
 878         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
 879         [HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
 880                                  .len = IEEE80211_TX_MAX_RATES *
 881                                         sizeof(struct hwsim_tx_rate)},
 882         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
 883         [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
 884         [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
 885         [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 886         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
 887         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 888         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
 889         [HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
 890         [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
 891         [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
 892         [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
 893         [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 894         [HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
 895         [HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
 896         [HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
 897         [HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
 898         [HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 899         [HWSIM_ATTR_PMSR_SUPPORT] = NLA_POLICY_NESTED(hwsim_pmsr_capa_policy),
 900         [HWSIM_ATTR_PMSR_RESULT] = NLA_POLICY_NESTED(hwsim_pmsr_peers_result_policy),
 901 };
 902
 903 #if IS_REACHABLE(CONFIG_VIRTIO)
 904
 905 /* MAC80211_HWSIM virtio queues */
 906 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
 907 static bool hwsim_virtio_enabled;
 908 static DEFINE_SPINLOCK(hwsim_virtio_lock);
 909
 910 static void hwsim_virtio_rx_work(struct work_struct *work);
 911 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
 912
 913 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 914                            struct sk_buff *skb)
 915 {
 916         struct scatterlist sg[1];
 917         unsigned long flags;
 918         int err;
 919
 920         spin_lock_irqsave(&hwsim_virtio_lock, flags);
 921         if (!hwsim_virtio_enabled) {
 922                 err = -ENODEV;
 923                 goto out_free;
 924         }
 925
 926         sg_init_one(sg, skb->head, skb_end_offset(skb));
 927         err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
 928                                    GFP_ATOMIC);
 929         if (err)
 930                 goto out_free;
 931         virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
 932         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 933         return 0;
 934
 935 out_free:
 936         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
 937         nlmsg_free(skb);
 938         return err;
 939 }
 940 #else
 941 /* cause a linker error if this ends up being needed */
 942 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
 943                            struct sk_buff *skb);
 944 #define hwsim_virtio_enabled false
 945 #endif
 946
 947 static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
 948 {
 949         switch (bw) {
 950         case NL80211_CHAN_WIDTH_20_NOHT:
 951         case NL80211_CHAN_WIDTH_20:
 952                 return 20;
 953         case NL80211_CHAN_WIDTH_40:
 954                 return 40;
 955         case NL80211_CHAN_WIDTH_80:
 956                 return 80;
 957         case NL80211_CHAN_WIDTH_80P80:
 958         case NL80211_CHAN_WIDTH_160:
 959                 return 160;
 960         case NL80211_CHAN_WIDTH_320:
 961                 return 320;
 962         case NL80211_CHAN_WIDTH_5:
 963                 return 5;
 964         case NL80211_CHAN_WIDTH_10:
 965                 return 10;
 966         case NL80211_CHAN_WIDTH_1:
 967                 return 1;
 968         case NL80211_CHAN_WIDTH_2:
 969                 return 2;
 970         case NL80211_CHAN_WIDTH_4:
 971                 return 4;
 972         case NL80211_CHAN_WIDTH_8:
 973                 return 8;
 974         case NL80211_CHAN_WIDTH_16:
 975                 return 16;
 976         }
 977
 978         return INT_MAX;
 979 }
 980
 981 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 982                                     struct sk_buff *skb,
 983                                     struct ieee80211_channel *chan);
 984
 985 /* sysfs attributes */
 986 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
 987 {
 988         struct mac80211_hwsim_data *data = dat;
 989         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
 990         struct sk_buff *skb;
 991         struct ieee80211_pspoll *pspoll;
 992
 993         if (!vp->assoc)
 994                 return;
 995
 996         wiphy_dbg(data->hw->wiphy,
 997                   "%s: send PS-Poll to %pM for aid %d\n",
 998                   __func__, vp->bssid, vp->aid);
 999
1000         skb = dev_alloc_skb(sizeof(*pspoll));
1001         if (!skb)
1002                 return;
1003         pspoll = skb_put(skb, sizeof(*pspoll));
1004         pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1005                                             IEEE80211_STYPE_PSPOLL |
1006                                             IEEE80211_FCTL_PM);
1007         pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
1008         memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
1009         memcpy(pspoll->ta, mac, ETH_ALEN);
1010
1011         rcu_read_lock();
1012         mac80211_hwsim_tx_frame(data->hw, skb,
1013                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1014         rcu_read_unlock();
1015 }
1016
1017 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
1018                                 struct ieee80211_vif *vif, int ps)
1019 {
1020         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1021         struct sk_buff *skb;
1022         struct ieee80211_hdr *hdr;
1023         struct ieee80211_tx_info *cb;
1024
1025         if (!vp->assoc)
1026                 return;
1027
1028         wiphy_dbg(data->hw->wiphy,
1029                   "%s: send data::nullfunc to %pM ps=%d\n",
1030                   __func__, vp->bssid, ps);
1031
1032         skb = dev_alloc_skb(sizeof(*hdr));
1033         if (!skb)
1034                 return;
1035         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
1036         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
1037                                          IEEE80211_STYPE_NULLFUNC |
1038                                          IEEE80211_FCTL_TODS |
1039                                          (ps ? IEEE80211_FCTL_PM : 0));
1040         hdr->duration_id = cpu_to_le16(0);
1041         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
1042         memcpy(hdr->addr2, mac, ETH_ALEN);
1043         memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
1044
1045         cb = IEEE80211_SKB_CB(skb);
1046         cb->control.rates[0].count = 1;
1047         cb->control.rates[1].idx = -1;
1048
1049         rcu_read_lock();
1050         mac80211_hwsim_tx_frame(data->hw, skb,
1051                                 rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1052         rcu_read_unlock();
1053 }
1054
1055
1056 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
1057                                    struct ieee80211_vif *vif)
1058 {
1059         struct mac80211_hwsim_data *data = dat;
1060         hwsim_send_nullfunc(data, mac, vif, 1);
1061 }
1062
1063 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
1064                                       struct ieee80211_vif *vif)
1065 {
1066         struct mac80211_hwsim_data *data = dat;
1067         hwsim_send_nullfunc(data, mac, vif, 0);
1068 }
1069
1070 static int hwsim_fops_ps_read(void *dat, u64 *val)
1071 {
1072         struct mac80211_hwsim_data *data = dat;
1073         *val = data->ps;
1074         return 0;
1075 }
1076
1077 static int hwsim_fops_ps_write(void *dat, u64 val)
1078 {
1079         struct mac80211_hwsim_data *data = dat;
1080         enum ps_mode old_ps;
1081
1082         if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
1083             val != PS_MANUAL_POLL)
1084                 return -EINVAL;
1085
1086         if (val == PS_MANUAL_POLL) {
1087                 if (data->ps != PS_ENABLED)
1088                         return -EINVAL;
1089                 local_bh_disable();
1090                 ieee80211_iterate_active_interfaces_atomic(
1091                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1092                         hwsim_send_ps_poll, data);
1093                 local_bh_enable();
1094                 return 0;
1095         }
1096         old_ps = data->ps;
1097         data->ps = val;
1098
1099         local_bh_disable();
1100         if (old_ps == PS_DISABLED && val != PS_DISABLED) {
1101                 ieee80211_iterate_active_interfaces_atomic(
1102                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1103                         hwsim_send_nullfunc_ps, data);
1104         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
1105                 ieee80211_iterate_active_interfaces_atomic(
1106                         data->hw, IEEE80211_IFACE_ITER_NORMAL,
1107                         hwsim_send_nullfunc_no_ps, data);
1108         }
1109         local_bh_enable();
1110
1111         return 0;
1112 }
1113
1114 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1115                          "%llu\n");
1116
1117 static int hwsim_write_simulate_radar(void *dat, u64 val)
1118 {
1119         struct mac80211_hwsim_data *data = dat;
1120
1121         ieee80211_radar_detected(data->hw);
1122
1123         return 0;
1124 }
1125
1126 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1127                          hwsim_write_simulate_radar, "%llu\n");
1128
1129 static int hwsim_fops_group_read(void *dat, u64 *val)
1130 {
1131         struct mac80211_hwsim_data *data = dat;
1132         *val = data->group;
1133         return 0;
1134 }
1135
1136 static int hwsim_fops_group_write(void *dat, u64 val)
1137 {
1138         struct mac80211_hwsim_data *data = dat;
1139         data->group = val;
1140         return 0;
1141 }
1142
1143 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1144                          hwsim_fops_group_read, hwsim_fops_group_write,
1145                          "%llx\n");
1146
1147 static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1148 {
1149         struct mac80211_hwsim_data *data = dat;
1150         *val = data->rx_rssi;
1151         return 0;
1152 }
1153
1154 static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1155 {
1156         struct mac80211_hwsim_data *data = dat;
1157         int rssi = (int)val;
1158
1159         if (rssi >= 0 || rssi < -100)
1160                 return -EINVAL;
1161
1162         data->rx_rssi = rssi;
1163         return 0;
1164 }
1165
1166 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1167                          hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1168                          "%lld\n");
1169
1170 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1171                                         struct net_device *dev)
1172 {
1173         /* TODO: allow packet injection */
1174         dev_kfree_skb(skb);
1175         return NETDEV_TX_OK;
1176 }
1177
1178 static inline u64 mac80211_hwsim_get_tsf_raw(void)
1179 {
1180         return ktime_to_us(ktime_get_real());
1181 }
1182
1183 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1184 {
1185         u64 now = mac80211_hwsim_get_tsf_raw();
1186         return cpu_to_le64(now + data->tsf_offset);
1187 }
1188
1189 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1190                                   struct ieee80211_vif *vif)
1191 {
1192         struct mac80211_hwsim_data *data = hw->priv;
1193         return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
1194 }
1195
1196 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1197                 struct ieee80211_vif *vif, u64 tsf)
1198 {
1199         struct mac80211_hwsim_data *data = hw->priv;
1200         u64 now = mac80211_hwsim_get_tsf(hw, vif);
1201         /* MLD not supported here */
1202         u32 bcn_int = data->link_data[0].beacon_int;
1203         u64 delta = abs(tsf - now);
1204
1205         /* adjust after beaconing with new timestamp at old TBTT */
1206         if (tsf > now) {
1207                 data->tsf_offset += delta;
1208                 data->bcn_delta = do_div(delta, bcn_int);
1209         } else {
1210                 data->tsf_offset -= delta;
1211                 data->bcn_delta = -(s64)do_div(delta, bcn_int);
1212         }
1213 }
1214
1215 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1216                                       struct sk_buff *tx_skb,
1217                                       struct ieee80211_channel *chan)
1218 {
1219         struct mac80211_hwsim_data *data = hw->priv;
1220         struct sk_buff *skb;
1221         struct hwsim_radiotap_hdr *hdr;
1222         u16 flags, bitrate;
1223         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1224         struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
1225
1226         if (!txrate)
1227                 bitrate = 0;
1228         else
1229                 bitrate = txrate->bitrate;
1230
1231         if (!netif_running(hwsim_mon))
1232                 return;
1233
1234         skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1235         if (skb == NULL)
1236                 return;
1237
1238         hdr = skb_push(skb, sizeof(*hdr));
1239         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1240         hdr->hdr.it_pad = 0;
1241         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1242         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1243                                           (1 << IEEE80211_RADIOTAP_RATE) |
1244                                           (1 << IEEE80211_RADIOTAP_TSFT) |
1245                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1246         hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1247         hdr->rt_flags = 0;
1248         hdr->rt_rate = bitrate / 5;
1249         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1250         flags = IEEE80211_CHAN_2GHZ;
1251         if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1252                 flags |= IEEE80211_CHAN_OFDM;
1253         else
1254                 flags |= IEEE80211_CHAN_CCK;
1255         hdr->rt_chbitmask = cpu_to_le16(flags);
1256
1257         skb->dev = hwsim_mon;
1258         skb_reset_mac_header(skb);
1259         skb->ip_summed = CHECKSUM_UNNECESSARY;
1260         skb->pkt_type = PACKET_OTHERHOST;
1261         skb->protocol = htons(ETH_P_802_2);
1262         memset(skb->cb, 0, sizeof(skb->cb));
1263         netif_rx(skb);
1264 }
1265
1266
1267 static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
1268                                        const u8 *addr)
1269 {
1270         struct sk_buff *skb;
1271         struct hwsim_radiotap_ack_hdr *hdr;
1272         u16 flags;
1273         struct ieee80211_hdr *hdr11;
1274
1275         if (!netif_running(hwsim_mon))
1276                 return;
1277
1278         skb = dev_alloc_skb(100);
1279         if (skb == NULL)
1280                 return;
1281
1282         hdr = skb_put(skb, sizeof(*hdr));
1283         hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1284         hdr->hdr.it_pad = 0;
1285         hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1286         hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1287                                           (1 << IEEE80211_RADIOTAP_CHANNEL));
1288         hdr->rt_flags = 0;
1289         hdr->pad = 0;
1290         hdr->rt_channel = cpu_to_le16(chan->center_freq);
1291         flags = IEEE80211_CHAN_2GHZ;
1292         hdr->rt_chbitmask = cpu_to_le16(flags);
1293
1294         hdr11 = skb_put(skb, 10);
1295         hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1296                                            IEEE80211_STYPE_ACK);
1297         hdr11->duration_id = cpu_to_le16(0);
1298         memcpy(hdr11->addr1, addr, ETH_ALEN);
1299
1300         skb->dev = hwsim_mon;
1301         skb_reset_mac_header(skb);
1302         skb->ip_summed = CHECKSUM_UNNECESSARY;
1303         skb->pkt_type = PACKET_OTHERHOST;
1304         skb->protocol = htons(ETH_P_802_2);
1305         memset(skb->cb, 0, sizeof(skb->cb));
1306         netif_rx(skb);
1307 }
1308
1309 struct mac80211_hwsim_addr_match_data {
1310         u8 addr[ETH_ALEN];
1311         bool ret;
1312 };
1313
1314 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1315                                      struct ieee80211_vif *vif)
1316 {
1317         int i;
1318         struct mac80211_hwsim_addr_match_data *md = data;
1319
1320         if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1321                 md->ret = true;
1322                 return;
1323         }
1324
1325         /* Match the link address */
1326         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1327                 struct ieee80211_bss_conf *conf;
1328
1329                 conf = rcu_dereference(vif->link_conf[i]);
1330                 if (!conf)
1331                         continue;
1332
1333                 if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1334                         md->ret = true;
1335                         return;
1336                 }
1337         }
1338 }
1339
1340 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1341                                       const u8 *addr)
1342 {
1343         struct mac80211_hwsim_addr_match_data md = {
1344                 .ret = false,
1345         };
1346
1347         if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1348                 return true;
1349
1350         memcpy(md.addr, addr, ETH_ALEN);
1351
1352         ieee80211_iterate_active_interfaces_atomic(data->hw,
1353                                                    IEEE80211_IFACE_ITER_NORMAL,
1354                                                    mac80211_hwsim_addr_iter,
1355                                                    &md);
1356
1357         return md.ret;
1358 }
1359
1360 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1361                            struct sk_buff *skb)
1362 {
1363         switch (data->ps) {
1364         case PS_DISABLED:
1365                 return true;
1366         case PS_ENABLED:
1367                 return false;
1368         case PS_AUTO_POLL:
1369                 /* TODO: accept (some) Beacons by default and other frames only
1370                  * if pending PS-Poll has been sent */
1371                 return true;
1372         case PS_MANUAL_POLL:
1373                 /* Allow unicast frames to own address if there is a pending
1374                  * PS-Poll */
1375                 if (data->ps_poll_pending &&
1376                     mac80211_hwsim_addr_match(data, skb->data + 4)) {
1377                         data->ps_poll_pending = false;
1378                         return true;
1379                 }
1380                 return false;
1381         }
1382
1383         return true;
1384 }
1385
1386 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1387                                   struct sk_buff *skb, int portid)
1388 {
1389         struct net *net;
1390         bool found = false;
1391         int res = -ENOENT;
1392
1393         rcu_read_lock();
1394         for_each_net_rcu(net) {
1395                 if (data->netgroup == hwsim_net_get_netgroup(net)) {
1396                         res = genlmsg_unicast(net, skb, portid);
1397                         found = true;
1398                         break;
1399                 }
1400         }
1401         rcu_read_unlock();
1402
1403         if (!found)
1404                 nlmsg_free(skb);
1405
1406         return res;
1407 }
1408
1409 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1410                                          const u8 *addr, bool add)
1411 {
1412         struct mac80211_hwsim_data *data = hw->priv;
1413         u32 _portid = READ_ONCE(data->wmediumd);
1414         struct sk_buff *skb;
1415         void *msg_head;
1416
1417         WARN_ON(!is_valid_ether_addr(addr));
1418
1419         if (!_portid && !hwsim_virtio_enabled)
1420                 return;
1421
1422         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1423         if (!skb)
1424                 return;
1425
1426         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1427                                add ? HWSIM_CMD_ADD_MAC_ADDR :
1428                                      HWSIM_CMD_DEL_MAC_ADDR);
1429         if (!msg_head) {
1430                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1431                 goto nla_put_failure;
1432         }
1433
1434         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1435                     ETH_ALEN, data->addresses[1].addr))
1436                 goto nla_put_failure;
1437
1438         if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1439                 goto nla_put_failure;
1440
1441         genlmsg_end(skb, msg_head);
1442
1443         if (hwsim_virtio_enabled)
1444                 hwsim_tx_virtio(data, skb);
1445         else
1446                 hwsim_unicast_netgroup(data, skb, _portid);
1447         return;
1448 nla_put_failure:
1449         nlmsg_free(skb);
1450 }
1451
1452 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1453 {
1454         u16 result = 0;
1455
1456         if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1457                 result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1458         if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1459                 result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1460         if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1461                 result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1462         if (rate->flags & IEEE80211_TX_RC_MCS)
1463                 result |= MAC80211_HWSIM_TX_RC_MCS;
1464         if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1465                 result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1466         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1467                 result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1468         if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1469                 result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1470         if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1471                 result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1472         if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1473                 result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1474         if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1475                 result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1476         if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1477                 result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1478
1479         return result;
1480 }
1481
1482 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1483                                        struct sk_buff *my_skb,
1484                                        int dst_portid,
1485                                        struct ieee80211_channel *channel)
1486 {
1487         struct sk_buff *skb;
1488         struct mac80211_hwsim_data *data = hw->priv;
1489         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1490         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1491         void *msg_head;
1492         unsigned int hwsim_flags = 0;
1493         int i;
1494         struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1495         struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1496         uintptr_t cookie;
1497
1498         if (data->ps != PS_DISABLED)
1499                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1500         /* If the queue contains MAX_QUEUE skb's drop some */
1501         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1502                 /* Dropping until WARN_QUEUE level */
1503                 while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1504                         ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1505                         data->tx_dropped++;
1506                 }
1507         }
1508
1509         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1510         if (skb == NULL)
1511                 goto nla_put_failure;
1512
1513         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1514                                HWSIM_CMD_FRAME);
1515         if (msg_head == NULL) {
1516                 pr_debug("mac80211_hwsim: problem with msg_head\n");
1517                 goto nla_put_failure;
1518         }
1519
1520         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1521                     ETH_ALEN, data->addresses[1].addr))
1522                 goto nla_put_failure;
1523
1524         /* We get the skb->data */
1525         if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1526                 goto nla_put_failure;
1527
1528         /* We get the flags for this transmission, and we translate them to
1529            wmediumd flags  */
1530
1531         if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1532                 hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1533
1534         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1535                 hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1536
1537         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1538                 goto nla_put_failure;
1539
1540         if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1541                 goto nla_put_failure;
1542
1543         /* We get the tx control (rate and retries) info*/
1544
1545         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1546                 tx_attempts[i].idx = info->status.rates[i].idx;
1547                 tx_attempts_flags[i].idx = info->status.rates[i].idx;
1548                 tx_attempts[i].count = info->status.rates[i].count;
1549                 tx_attempts_flags[i].flags =
1550                                 trans_tx_rate_flags_ieee2hwsim(
1551                                                 &info->status.rates[i]);
1552         }
1553
1554         if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1555                     sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1556                     tx_attempts))
1557                 goto nla_put_failure;
1558
1559         if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1560                     sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1561                     tx_attempts_flags))
1562                 goto nla_put_failure;
1563
1564         /* We create a cookie to identify this skb */
1565         cookie = atomic_inc_return(&data->pending_cookie);
1566         info->rate_driver_data[0] = (void *)cookie;
1567         if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1568                 goto nla_put_failure;
1569
1570         genlmsg_end(skb, msg_head);
1571
1572         if (hwsim_virtio_enabled) {
1573                 if (hwsim_tx_virtio(data, skb))
1574                         goto err_free_txskb;
1575         } else {
1576                 if (hwsim_unicast_netgroup(data, skb, dst_portid))
1577                         goto err_free_txskb;
1578         }
1579
1580         /* Enqueue the packet */
1581         skb_queue_tail(&data->pending, my_skb);
1582         data->tx_pkts++;
1583         data->tx_bytes += my_skb->len;
1584         return;
1585
1586 nla_put_failure:
1587         nlmsg_free(skb);
1588 err_free_txskb:
1589         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1590         ieee80211_free_txskb(hw, my_skb);
1591         data->tx_failed++;
1592 }
1593
1594 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1595                                struct ieee80211_channel *c2)
1596 {
1597         if (!c1 || !c2)
1598                 return false;
1599
1600         return c1->center_freq == c2->center_freq;
1601 }
1602
1603 struct tx_iter_data {
1604         struct ieee80211_channel *channel;
1605         bool receive;
1606 };
1607
1608 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1609                                    struct ieee80211_vif *vif)
1610 {
1611         struct tx_iter_data *data = _data;
1612         int i;
1613
1614         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1615                 struct ieee80211_bss_conf *conf;
1616                 struct ieee80211_chanctx_conf *chanctx;
1617
1618                 conf = rcu_dereference(vif->link_conf[i]);
1619                 if (!conf)
1620                         continue;
1621
1622                 chanctx = rcu_dereference(conf->chanctx_conf);
1623                 if (!chanctx)
1624                         continue;
1625
1626                 if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1627                         continue;
1628
1629                 data->receive = true;
1630                 return;
1631         }
1632 }
1633
1634 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1635 {
1636         /*
1637          * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1638          * e.g. like this:
1639          * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1640          * (but you should use a valid OUI, not that)
1641          *
1642          * If anyone wants to 'donate' a radiotap OUI/subns code
1643          * please send a patch removing this #ifdef and changing
1644          * the values accordingly.
1645          */
1646 #ifdef HWSIM_RADIOTAP_OUI
1647         struct ieee80211_radiotap_vendor_tlv *rtap;
1648         static const char vendor_data[8] = "ABCDEFGH";
1649
1650         // Make sure no padding is needed
1651         BUILD_BUG_ON(sizeof(vendor_data) % 4);
1652         /* this is last radiotap info before the mac header, so
1653          * skb_reset_mac_header for mac8022 to know the end of
1654          * the radiotap TLV/beginning of the 802.11 header
1655          */
1656         skb_reset_mac_header(skb);
1657
1658         /*
1659          * Note that this code requires the headroom in the SKB
1660          * that was allocated earlier.
1661          */
1662         rtap = skb_push(skb, sizeof(*rtap) + sizeof(vendor_data));
1663
1664         rtap->len = cpu_to_le16(sizeof(*rtap) -
1665                                 sizeof(struct ieee80211_radiotap_tlv) +
1666                                 sizeof(vendor_data));
1667         rtap->type = cpu_to_le16(IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
1668
1669         rtap->content.oui[0] = HWSIM_RADIOTAP_OUI[0];
1670         rtap->content.oui[1] = HWSIM_RADIOTAP_OUI[1];
1671         rtap->content.oui[2] = HWSIM_RADIOTAP_OUI[2];
1672         rtap->content.oui_subtype = 127;
1673         /* clear reserved field */
1674         rtap->content.reserved = 0;
1675         rtap->content.vendor_type = 0;
1676         memcpy(rtap->content.data, vendor_data, sizeof(vendor_data));
1677
1678         IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
1679 #endif
1680 }
1681
1682 static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1683                               struct ieee80211_rx_status *rx_status,
1684                               struct sk_buff *skb)
1685 {
1686         struct ieee80211_hdr *hdr = (void *)skb->data;
1687
1688         if (!ieee80211_has_morefrags(hdr->frame_control) &&
1689             !is_multicast_ether_addr(hdr->addr1) &&
1690             (ieee80211_is_mgmt(hdr->frame_control) ||
1691              ieee80211_is_data(hdr->frame_control))) {
1692                 struct ieee80211_sta *sta;
1693                 unsigned int link_id;
1694
1695                 rcu_read_lock();
1696                 sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1697                                                        hdr->addr1, &link_id);
1698                 if (sta) {
1699                         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1700
1701                         if (ieee80211_has_pm(hdr->frame_control))
1702                                 sp->active_links_rx &= ~BIT(link_id);
1703                         else
1704                                 sp->active_links_rx |= BIT(link_id);
1705                 }
1706                 rcu_read_unlock();
1707         }
1708
1709         memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1710
1711         mac80211_hwsim_add_vendor_rtap(skb);
1712
1713         data->rx_pkts++;
1714         data->rx_bytes += skb->len;
1715         ieee80211_rx_irqsafe(data->hw, skb);
1716 }
1717
1718 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1719                                           struct sk_buff *skb,
1720                                           struct ieee80211_channel *chan)
1721 {
1722         struct mac80211_hwsim_data *data = hw->priv, *data2;
1723         bool ack = false;
1724         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1725         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1726         struct ieee80211_rx_status rx_status;
1727         u64 now;
1728
1729         memset(&rx_status, 0, sizeof(rx_status));
1730         rx_status.flag |= RX_FLAG_MACTIME_START;
1731         rx_status.freq = chan->center_freq;
1732         rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1733         rx_status.band = chan->band;
1734         if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1735                 rx_status.rate_idx =
1736                         ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1737                 rx_status.nss =
1738                         ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1739                 rx_status.encoding = RX_ENC_VHT;
1740         } else {
1741                 rx_status.rate_idx = info->control.rates[0].idx;
1742                 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1743                         rx_status.encoding = RX_ENC_HT;
1744         }
1745         if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1746                 rx_status.bw = RATE_INFO_BW_40;
1747         else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1748                 rx_status.bw = RATE_INFO_BW_80;
1749         else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1750                 rx_status.bw = RATE_INFO_BW_160;
1751         else
1752                 rx_status.bw = RATE_INFO_BW_20;
1753         if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1754                 rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1755         /* TODO: simulate optional packet loss */
1756         rx_status.signal = data->rx_rssi;
1757         if (info->control.vif)
1758                 rx_status.signal += info->control.vif->bss_conf.txpower;
1759
1760         if (data->ps != PS_DISABLED)
1761                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1762
1763         /* release the skb's source info */
1764         skb_orphan(skb);
1765         skb_dst_drop(skb);
1766         skb->mark = 0;
1767         skb_ext_reset(skb);
1768         nf_reset_ct(skb);
1769
1770         /*
1771          * Get absolute mactime here so all HWs RX at the "same time", and
1772          * absolute TX time for beacon mactime so the timestamp matches.
1773          * Giving beacons a different mactime than non-beacons looks messy, but
1774          * it helps the Toffset be exact and a ~10us mactime discrepancy
1775          * probably doesn't really matter.
1776          */
1777         if (ieee80211_is_beacon(hdr->frame_control) ||
1778             ieee80211_is_probe_resp(hdr->frame_control)) {
1779                 rx_status.boottime_ns = ktime_get_boottime_ns();
1780                 now = data->abs_bcn_ts;
1781         } else {
1782                 now = mac80211_hwsim_get_tsf_raw();
1783         }
1784
1785         /* Copy skb to all enabled radios that are on the current frequency */
1786         spin_lock(&hwsim_radio_lock);
1787         list_for_each_entry(data2, &hwsim_radios, list) {
1788                 struct sk_buff *nskb;
1789                 struct tx_iter_data tx_iter_data = {
1790                         .receive = false,
1791                         .channel = chan,
1792                 };
1793
1794                 if (data == data2)
1795                         continue;
1796
1797                 if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1798                     !hwsim_ps_rx_ok(data2, skb))
1799                         continue;
1800
1801                 if (!(data->group & data2->group))
1802                         continue;
1803
1804                 if (data->netgroup != data2->netgroup)
1805                         continue;
1806
1807                 if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
1808                     !hwsim_chans_compat(chan, data2->channel)) {
1809                         ieee80211_iterate_active_interfaces_atomic(
1810                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
1811                                 mac80211_hwsim_tx_iter, &tx_iter_data);
1812                         if (!tx_iter_data.receive)
1813                                 continue;
1814                 }
1815
1816                 /*
1817                  * reserve some space for our vendor and the normal
1818                  * radiotap header, since we're copying anyway
1819                  */
1820                 if (skb->len < PAGE_SIZE && paged_rx) {
1821                         struct page *page = alloc_page(GFP_ATOMIC);
1822
1823                         if (!page)
1824                                 continue;
1825
1826                         nskb = dev_alloc_skb(128);
1827                         if (!nskb) {
1828                                 __free_page(page);
1829                                 continue;
1830                         }
1831
1832                         memcpy(page_address(page), skb->data, skb->len);
1833                         skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
1834                 } else {
1835                         nskb = skb_copy(skb, GFP_ATOMIC);
1836                         if (!nskb)
1837                                 continue;
1838                 }
1839
1840                 if (mac80211_hwsim_addr_match(data2, hdr->addr1))
1841                         ack = true;
1842
1843                 rx_status.mactime = now + data2->tsf_offset;
1844
1845                 mac80211_hwsim_rx(data2, &rx_status, nskb);
1846         }
1847         spin_unlock(&hwsim_radio_lock);
1848
1849         return ack;
1850 }
1851
1852 static struct ieee80211_bss_conf *
1853 mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
1854                               struct ieee80211_vif *vif,
1855                               struct ieee80211_sta *sta,
1856                               struct ieee80211_hdr *hdr,
1857                               struct ieee80211_link_sta **link_sta)
1858 {
1859         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1860         int i;
1861
1862         if (!vif->valid_links)
1863                 return &vif->bss_conf;
1864
1865         WARN_ON(is_multicast_ether_addr(hdr->addr1));
1866
1867         if (WARN_ON_ONCE(!sta->valid_links))
1868                 return &vif->bss_conf;
1869
1870         for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1871                 struct ieee80211_bss_conf *bss_conf;
1872                 unsigned int link_id;
1873
1874                 /* round-robin the available link IDs */
1875                 link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
1876
1877                 if (!(vif->active_links & BIT(link_id)))
1878                         continue;
1879
1880                 if (!(sp->active_links_rx & BIT(link_id)))
1881                         continue;
1882
1883                 *link_sta = rcu_dereference(sta->link[link_id]);
1884                 if (!*link_sta)
1885                         continue;
1886
1887                 bss_conf = rcu_dereference(vif->link_conf[link_id]);
1888                 if (WARN_ON_ONCE(!bss_conf))
1889                         continue;
1890
1891                 /* can happen while switching links */
1892                 if (!rcu_access_pointer(bss_conf->chanctx_conf))
1893                         continue;
1894
1895                 sp->last_link = link_id;
1896                 return bss_conf;
1897         }
1898
1899         return NULL;
1900 }
1901
1902 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
1903                               struct ieee80211_tx_control *control,
1904                               struct sk_buff *skb)
1905 {
1906         struct mac80211_hwsim_data *data = hw->priv;
1907         struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
1908         struct ieee80211_hdr *hdr = (void *)skb->data;
1909         struct ieee80211_chanctx_conf *chanctx_conf;
1910         struct ieee80211_channel *channel;
1911         bool ack;
1912         enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
1913         u32 _portid, i;
1914
1915         if (WARN_ON(skb->len < 10)) {
1916                 /* Should not happen; just a sanity check for addr1 use */
1917                 ieee80211_free_txskb(hw, skb);
1918                 return;
1919         }
1920
1921         if (!data->use_chanctx) {
1922                 channel = data->channel;
1923                 confbw = data->bw;
1924         } else if (txi->hw_queue == 4) {
1925                 channel = data->tmp_chan;
1926         } else {
1927                 u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
1928                                        IEEE80211_TX_CTRL_MLO_LINK);
1929                 struct ieee80211_vif *vif = txi->control.vif;
1930                 struct ieee80211_link_sta *link_sta = NULL;
1931                 struct ieee80211_sta *sta = control->sta;
1932                 struct ieee80211_bss_conf *bss_conf;
1933
1934                 if (link != IEEE80211_LINK_UNSPECIFIED) {
1935                         bss_conf = rcu_dereference(txi->control.vif->link_conf[link]);
1936                         if (sta)
1937                                 link_sta = rcu_dereference(sta->link[link]);
1938                 } else {
1939                         bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
1940                                                                  hdr, &link_sta);
1941                 }
1942
1943                 if (WARN_ON(!bss_conf)) {
1944                         ieee80211_free_txskb(hw, skb);
1945                         return;
1946                 }
1947
1948                 if (sta && sta->mlo) {
1949                         if (WARN_ON(!link_sta)) {
1950                                 ieee80211_free_txskb(hw, skb);
1951                                 return;
1952                         }
1953                         /* address translation to link addresses on TX */
1954                         ether_addr_copy(hdr->addr1, link_sta->addr);
1955                         ether_addr_copy(hdr->addr2, bss_conf->addr);
1956                         /* translate A3 only if it's the BSSID */
1957                         if (!ieee80211_has_tods(hdr->frame_control) &&
1958                             !ieee80211_has_fromds(hdr->frame_control)) {
1959                                 if (ether_addr_equal(hdr->addr3, sta->addr))
1960                                         ether_addr_copy(hdr->addr3, link_sta->addr);
1961                                 else if (ether_addr_equal(hdr->addr3, vif->addr))
1962                                         ether_addr_copy(hdr->addr3, bss_conf->addr);
1963                         }
1964                         /* no need to look at A4, if present it's SA */
1965                 }
1966
1967                 chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
1968                 if (chanctx_conf) {
1969                         channel = chanctx_conf->def.chan;
1970                         confbw = chanctx_conf->def.width;
1971                 } else {
1972                         channel = NULL;
1973                 }
1974         }
1975
1976         if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
1977                 ieee80211_free_txskb(hw, skb);
1978                 return;
1979         }
1980
1981         if (data->idle && !data->tmp_chan) {
1982                 wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
1983                 ieee80211_free_txskb(hw, skb);
1984                 return;
1985         }
1986
1987         if (txi->control.vif)
1988                 hwsim_check_magic(txi->control.vif);
1989         if (control->sta)
1990                 hwsim_check_sta_magic(control->sta);
1991
1992         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
1993                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
1994                                        txi->control.rates,
1995                                        ARRAY_SIZE(txi->control.rates));
1996
1997         for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
1998                 u16 rflags = txi->control.rates[i].flags;
1999                 /* initialize to data->bw for 5/10 MHz handling */
2000                 enum nl80211_chan_width bw = data->bw;
2001
2002                 if (txi->control.rates[i].idx == -1)
2003                         break;
2004
2005                 if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
2006                         bw = NL80211_CHAN_WIDTH_40;
2007                 else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
2008                         bw = NL80211_CHAN_WIDTH_80;
2009                 else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
2010                         bw = NL80211_CHAN_WIDTH_160;
2011
2012                 if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
2013                         return;
2014         }
2015
2016         if (skb->len >= 24 + 8 &&
2017             ieee80211_is_probe_resp(hdr->frame_control)) {
2018                 /* fake header transmission time */
2019                 struct ieee80211_mgmt *mgmt;
2020                 struct ieee80211_rate *txrate;
2021                 /* TODO: get MCS */
2022                 int bitrate = 100;
2023                 u64 ts;
2024
2025                 mgmt = (struct ieee80211_mgmt *)skb->data;
2026                 txrate = ieee80211_get_tx_rate(hw, txi);
2027                 if (txrate)
2028                         bitrate = txrate->bitrate;
2029                 ts = mac80211_hwsim_get_tsf_raw();
2030                 mgmt->u.probe_resp.timestamp =
2031                         cpu_to_le64(ts + data->tsf_offset +
2032                                     24 * 8 * 10 / bitrate);
2033         }
2034
2035         mac80211_hwsim_monitor_rx(hw, skb, channel);
2036
2037         /* wmediumd mode check */
2038         _portid = READ_ONCE(data->wmediumd);
2039
2040         if (_portid || hwsim_virtio_enabled)
2041                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
2042
2043         /* NO wmediumd detected, perfect medium simulation */
2044         data->tx_pkts++;
2045         data->tx_bytes += skb->len;
2046         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
2047
2048         if (ack && skb->len >= 16)
2049                 mac80211_hwsim_monitor_ack(channel, hdr->addr2);
2050
2051         ieee80211_tx_info_clear_status(txi);
2052
2053         /* frame was transmitted at most favorable rate at first attempt */
2054         txi->control.rates[0].count = 1;
2055         txi->control.rates[1].idx = -1;
2056
2057         if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
2058                 txi->flags |= IEEE80211_TX_STAT_ACK;
2059         ieee80211_tx_status_irqsafe(hw, skb);
2060 }
2061
2062
2063 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
2064 {
2065         struct mac80211_hwsim_data *data = hw->priv;
2066         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2067         data->started = true;
2068         return 0;
2069 }
2070
2071
2072 static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
2073 {
2074         struct mac80211_hwsim_data *data = hw->priv;
2075         int i;
2076
2077         data->started = false;
2078
2079         for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
2080                 hrtimer_cancel(&data->link_data[i].beacon_timer);
2081
2082         while (!skb_queue_empty(&data->pending))
2083                 ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
2084
2085         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2086 }
2087
2088
2089 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
2090                                         struct ieee80211_vif *vif)
2091 {
2092         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2093                   __func__, ieee80211_vif_type_p2p(vif),
2094                   vif->addr);
2095         hwsim_set_magic(vif);
2096
2097         if (vif->type != NL80211_IFTYPE_MONITOR)
2098                 mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
2099
2100         vif->cab_queue = 0;
2101         vif->hw_queue[IEEE80211_AC_VO] = 0;
2102         vif->hw_queue[IEEE80211_AC_VI] = 1;
2103         vif->hw_queue[IEEE80211_AC_BE] = 2;
2104         vif->hw_queue[IEEE80211_AC_BK] = 3;
2105
2106         return 0;
2107 }
2108
2109
2110 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
2111                                            struct ieee80211_vif *vif,
2112                                            enum nl80211_iftype newtype,
2113                                            bool newp2p)
2114 {
2115         newtype = ieee80211_iftype_p2p(newtype, newp2p);
2116         wiphy_dbg(hw->wiphy,
2117                   "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2118                   __func__, ieee80211_vif_type_p2p(vif),
2119                     newtype, vif->addr);
2120         hwsim_check_magic(vif);
2121
2122         /*
2123          * interface may change from non-AP to AP in
2124          * which case this needs to be set up again
2125          */
2126         vif->cab_queue = 0;
2127
2128         return 0;
2129 }
2130
2131 static void mac80211_hwsim_remove_interface(
2132         struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2133 {
2134         wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2135                   __func__, ieee80211_vif_type_p2p(vif),
2136                   vif->addr);
2137         hwsim_check_magic(vif);
2138         hwsim_clear_magic(vif);
2139         if (vif->type != NL80211_IFTYPE_MONITOR)
2140                 mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2141 }
2142
2143 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2144                                     struct sk_buff *skb,
2145                                     struct ieee80211_channel *chan)
2146 {
2147         struct mac80211_hwsim_data *data = hw->priv;
2148         u32 _portid = READ_ONCE(data->wmediumd);
2149
2150         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2151                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2152                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2153                                        txi->control.rates,
2154                                        ARRAY_SIZE(txi->control.rates));
2155         }
2156
2157         mac80211_hwsim_monitor_rx(hw, skb, chan);
2158
2159         if (_portid || hwsim_virtio_enabled)
2160                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, chan);
2161
2162         data->tx_pkts++;
2163         data->tx_bytes += skb->len;
2164         mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2165         dev_kfree_skb(skb);
2166 }
2167
2168 static void __mac80211_hwsim_beacon_tx(struct ieee80211_bss_conf *link_conf,
2169                                        struct mac80211_hwsim_data *data,
2170                                        struct ieee80211_hw *hw,
2171                                        struct ieee80211_vif *vif,
2172                                        struct sk_buff *skb)
2173 {
2174         struct ieee80211_tx_info *info;
2175         struct ieee80211_rate *txrate;
2176         struct ieee80211_mgmt *mgmt;
2177         /* TODO: get MCS */
2178         int bitrate = 100;
2179
2180         info = IEEE80211_SKB_CB(skb);
2181         if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2182                 ieee80211_get_tx_rates(vif, NULL, skb,
2183                                        info->control.rates,
2184                                        ARRAY_SIZE(info->control.rates));
2185
2186         txrate = ieee80211_get_tx_rate(hw, info);
2187         if (txrate)
2188                 bitrate = txrate->bitrate;
2189
2190         mgmt = (struct ieee80211_mgmt *) skb->data;
2191         /* fake header transmission time */
2192         data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
2193         if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
2194                 struct ieee80211_ext *ext = (void *) mgmt;
2195
2196                 ext->u.s1g_beacon.timestamp = cpu_to_le32(data->abs_bcn_ts +
2197                                                           data->tsf_offset +
2198                                                           10 * 8 * 10 /
2199                                                           bitrate);
2200         } else {
2201                 mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
2202                                                        data->tsf_offset +
2203                                                        24 * 8 * 10 /
2204                                                        bitrate);
2205         }
2206
2207         mac80211_hwsim_tx_frame(hw, skb,
2208                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2209 }
2210
2211 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2212                                      struct ieee80211_vif *vif)
2213 {
2214         struct mac80211_hwsim_link_data *link_data = arg;
2215         u32 link_id = link_data->link_id;
2216         struct ieee80211_bss_conf *link_conf;
2217         struct mac80211_hwsim_data *data =
2218                 container_of(link_data, struct mac80211_hwsim_data,
2219                              link_data[link_id]);
2220         struct ieee80211_hw *hw = data->hw;
2221         struct sk_buff *skb;
2222
2223         hwsim_check_magic(vif);
2224
2225         link_conf = rcu_dereference(vif->link_conf[link_id]);
2226         if (!link_conf)
2227                 return;
2228
2229         if (vif->type != NL80211_IFTYPE_AP &&
2230             vif->type != NL80211_IFTYPE_MESH_POINT &&
2231             vif->type != NL80211_IFTYPE_ADHOC &&
2232             vif->type != NL80211_IFTYPE_OCB)
2233                 return;
2234
2235         if (vif->mbssid_tx_vif && vif->mbssid_tx_vif != vif)
2236                 return;
2237
2238         if (vif->bss_conf.ema_ap) {
2239                 struct ieee80211_ema_beacons *ema;
2240                 u8 i = 0;
2241
2242                 ema = ieee80211_beacon_get_template_ema_list(hw, vif, link_id);
2243                 if (!ema || !ema->cnt)
2244                         return;
2245
2246                 for (i = 0; i < ema->cnt; i++) {
2247                         __mac80211_hwsim_beacon_tx(link_conf, data, hw, vif,
2248                                                    ema->bcn[i].skb);
2249                         ema->bcn[i].skb = NULL; /* Already freed */
2250                 }
2251                 ieee80211_beacon_free_ema_list(ema);
2252         } else {
2253                 skb = ieee80211_beacon_get(hw, vif, link_id);
2254                 if (!skb)
2255                         return;
2256
2257                 __mac80211_hwsim_beacon_tx(link_conf, data, hw, vif, skb);
2258         }
2259
2260         while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2261                 mac80211_hwsim_tx_frame(hw, skb,
2262                         rcu_dereference(link_conf->chanctx_conf)->def.chan);
2263         }
2264
2265         if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif))
2266                 ieee80211_csa_finish(vif);
2267 }
2268
2269 static enum hrtimer_restart
2270 mac80211_hwsim_beacon(struct hrtimer *timer)
2271 {
2272         struct mac80211_hwsim_link_data *link_data =
2273                 container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2274         struct mac80211_hwsim_data *data =
2275                 container_of(link_data, struct mac80211_hwsim_data,
2276                              link_data[link_data->link_id]);
2277         struct ieee80211_hw *hw = data->hw;
2278         u64 bcn_int = link_data->beacon_int;
2279
2280         if (!data->started)
2281                 return HRTIMER_NORESTART;
2282
2283         ieee80211_iterate_active_interfaces_atomic(
2284                 hw, IEEE80211_IFACE_ITER_NORMAL,
2285                 mac80211_hwsim_beacon_tx, link_data);
2286
2287         /* beacon at new TBTT + beacon interval */
2288         if (data->bcn_delta) {
2289                 bcn_int -= data->bcn_delta;
2290                 data->bcn_delta = 0;
2291         }
2292         hrtimer_forward_now(&link_data->beacon_timer,
2293                             ns_to_ktime(bcn_int * NSEC_PER_USEC));
2294         return HRTIMER_RESTART;
2295 }
2296
2297 static const char * const hwsim_chanwidths[] = {
2298         [NL80211_CHAN_WIDTH_5] = "ht5",
2299         [NL80211_CHAN_WIDTH_10] = "ht10",
2300         [NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2301         [NL80211_CHAN_WIDTH_20] = "ht20",
2302         [NL80211_CHAN_WIDTH_40] = "ht40",
2303         [NL80211_CHAN_WIDTH_80] = "vht80",
2304         [NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2305         [NL80211_CHAN_WIDTH_160] = "vht160",
2306         [NL80211_CHAN_WIDTH_1] = "1MHz",
2307         [NL80211_CHAN_WIDTH_2] = "2MHz",
2308         [NL80211_CHAN_WIDTH_4] = "4MHz",
2309         [NL80211_CHAN_WIDTH_8] = "8MHz",
2310         [NL80211_CHAN_WIDTH_16] = "16MHz",
2311 };
2312
2313 static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
2314 {
2315         struct mac80211_hwsim_data *data = hw->priv;
2316         struct ieee80211_conf *conf = &hw->conf;
2317         static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2318                 [IEEE80211_SMPS_AUTOMATIC] = "auto",
2319                 [IEEE80211_SMPS_OFF] = "off",
2320                 [IEEE80211_SMPS_STATIC] = "static",
2321                 [IEEE80211_SMPS_DYNAMIC] = "dynamic",
2322         };
2323         int idx;
2324
2325         if (conf->chandef.chan)
2326                 wiphy_dbg(hw->wiphy,
2327                           "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2328                           __func__,
2329                           conf->chandef.chan->center_freq,
2330                           conf->chandef.center_freq1,
2331                           conf->chandef.center_freq2,
2332                           hwsim_chanwidths[conf->chandef.width],
2333                           !!(conf->flags & IEEE80211_CONF_IDLE),
2334                           !!(conf->flags & IEEE80211_CONF_PS),
2335                           smps_modes[conf->smps_mode]);
2336         else
2337                 wiphy_dbg(hw->wiphy,
2338                           "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2339                           __func__,
2340                           !!(conf->flags & IEEE80211_CONF_IDLE),
2341                           !!(conf->flags & IEEE80211_CONF_PS),
2342                           smps_modes[conf->smps_mode]);
2343
2344         data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2345
2346         WARN_ON(conf->chandef.chan && data->use_chanctx);
2347
2348         mutex_lock(&data->mutex);
2349         if (data->scanning && conf->chandef.chan) {
2350                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2351                         if (data->survey_data[idx].channel == data->channel) {
2352                                 data->survey_data[idx].start =
2353                                         data->survey_data[idx].next_start;
2354                                 data->survey_data[idx].end = jiffies;
2355                                 break;
2356                         }
2357                 }
2358
2359                 data->channel = conf->chandef.chan;
2360                 data->bw = conf->chandef.width;
2361
2362                 for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2363                         if (data->survey_data[idx].channel &&
2364                             data->survey_data[idx].channel != data->channel)
2365                                 continue;
2366                         data->survey_data[idx].channel = data->channel;
2367                         data->survey_data[idx].next_start = jiffies;
2368                         break;
2369                 }
2370         } else {
2371                 data->channel = conf->chandef.chan;
2372                 data->bw = conf->chandef.width;
2373         }
2374         mutex_unlock(&data->mutex);
2375
2376         for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2377                 struct mac80211_hwsim_link_data *link_data =
2378                         &data->link_data[idx];
2379
2380                 if (!data->started || !link_data->beacon_int) {
2381                         hrtimer_cancel(&link_data->beacon_timer);
2382                 } else if (!hrtimer_is_queued(&link_data->beacon_timer)) {
2383                         u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2384                         u32 bcn_int = link_data->beacon_int;
2385                         u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2386
2387                         hrtimer_start(&link_data->beacon_timer,
2388                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2389                                       HRTIMER_MODE_REL_SOFT);
2390                 }
2391         }
2392
2393         return 0;
2394 }
2395
2396
2397 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2398                                             unsigned int changed_flags,
2399                                             unsigned int *total_flags,u64 multicast)
2400 {
2401         struct mac80211_hwsim_data *data = hw->priv;
2402
2403         wiphy_dbg(hw->wiphy, "%s\n", __func__);
2404
2405         data->rx_filter = 0;
2406         if (*total_flags & FIF_ALLMULTI)
2407                 data->rx_filter |= FIF_ALLMULTI;
2408         if (*total_flags & FIF_MCAST_ACTION)
2409                 data->rx_filter |= FIF_MCAST_ACTION;
2410
2411         *total_flags = data->rx_filter;
2412 }
2413
2414 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2415                                        struct ieee80211_vif *vif)
2416 {
2417         unsigned int *count = data;
2418         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2419
2420         if (vp->bcn_en)
2421                 (*count)++;
2422 }
2423
2424 static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2425                                             struct ieee80211_vif *vif,
2426                                             u64 changed)
2427 {
2428         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2429
2430         hwsim_check_magic(vif);
2431
2432         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2433                   __func__, changed, vif->addr);
2434
2435         if (changed & BSS_CHANGED_ASSOC) {
2436                 wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2437                           vif->cfg.assoc, vif->cfg.aid);
2438                 vp->assoc = vif->cfg.assoc;
2439                 vp->aid = vif->cfg.aid;
2440         }
2441 }
2442
2443 static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2444                                              struct ieee80211_vif *vif,
2445                                              struct ieee80211_bss_conf *info,
2446                                              u64 changed)
2447 {
2448         struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2449         struct mac80211_hwsim_data *data = hw->priv;
2450         unsigned int link_id = info->link_id;
2451         struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2452
2453         hwsim_check_magic(vif);
2454
2455         wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2456                   __func__, (unsigned long long)changed, vif->addr, link_id);
2457
2458         if (changed & BSS_CHANGED_BSSID) {
2459                 wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2460                           __func__, info->bssid);
2461                 memcpy(vp->bssid, info->bssid, ETH_ALEN);
2462         }
2463
2464         if (changed & BSS_CHANGED_BEACON_ENABLED) {
2465                 wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2466                           info->enable_beacon, info->beacon_int);
2467                 vp->bcn_en = info->enable_beacon;
2468                 if (data->started &&
2469                     !hrtimer_is_queued(&link_data->beacon_timer) &&
2470                     info->enable_beacon) {
2471                         u64 tsf, until_tbtt;
2472                         u32 bcn_int;
2473                         link_data->beacon_int = info->beacon_int * 1024;
2474                         tsf = mac80211_hwsim_get_tsf(hw, vif);
2475                         bcn_int = link_data->beacon_int;
2476                         until_tbtt = bcn_int - do_div(tsf, bcn_int);
2477
2478                         hrtimer_start(&link_data->beacon_timer,
2479                                       ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2480                                       HRTIMER_MODE_REL_SOFT);
2481                 } else if (!info->enable_beacon) {
2482                         unsigned int count = 0;
2483                         ieee80211_iterate_active_interfaces_atomic(
2484                                 data->hw, IEEE80211_IFACE_ITER_NORMAL,
2485                                 mac80211_hwsim_bcn_en_iter, &count);
2486                         wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2487                                   count);
2488                         if (count == 0) {
2489                                 hrtimer_cancel(&link_data->beacon_timer);
2490                                 link_data->beacon_int = 0;
2491                         }
2492                 }
2493         }
2494
2495         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2496                 wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2497                           info->use_cts_prot);
2498         }
2499
2500         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2501                 wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2502                           info->use_short_preamble);
2503         }
2504
2505         if (changed & BSS_CHANGED_ERP_SLOT) {
2506                 wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2507         }
2508
2509         if (changed & BSS_CHANGED_HT) {
2510                 wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2511                           info->ht_operation_mode);
2512         }
2513
2514         if (changed & BSS_CHANGED_BASIC_RATES) {
2515                 wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2516                           (unsigned long long) info->basic_rates);
2517         }
2518
2519         if (changed & BSS_CHANGED_TXPOWER)
2520                 wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2521 }
2522
2523 static void
2524 mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2525                              struct ieee80211_vif *vif,
2526                              struct ieee80211_sta *sta,
2527                              u32 changed)
2528 {
2529         struct mac80211_hwsim_data *data = hw->priv;
2530         u32 bw = U32_MAX;
2531         int link_id;
2532
2533         rcu_read_lock();
2534         for (link_id = 0;
2535              link_id < ARRAY_SIZE(vif->link_conf);
2536              link_id++) {
2537                 enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2538                 struct ieee80211_bss_conf *vif_conf;
2539                 struct ieee80211_link_sta *link_sta;
2540
2541                 link_sta = rcu_dereference(sta->link[link_id]);
2542
2543                 if (!link_sta)
2544                         continue;
2545
2546                 switch (link_sta->bandwidth) {
2547 #define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2548                 C(20);
2549                 C(40);
2550                 C(80);
2551                 C(160);
2552                 C(320);
2553 #undef C
2554                 }
2555
2556                 if (!data->use_chanctx) {
2557                         confbw = data->bw;
2558                 } else {
2559                         struct ieee80211_chanctx_conf *chanctx_conf;
2560
2561                         vif_conf = rcu_dereference(vif->link_conf[link_id]);
2562                         if (WARN_ON(!vif_conf))
2563                                 continue;
2564
2565                         chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2566
2567                         if (!WARN_ON(!chanctx_conf))
2568                                 confbw = chanctx_conf->def.width;
2569                 }
2570
2571                 WARN(bw > hwsim_get_chanwidth(confbw),
2572                      "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2573                      vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2574                      hwsim_get_chanwidth(data->bw), data->bw);
2575
2576
2577         }
2578         rcu_read_unlock();
2579
2580
2581 }
2582
2583 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2584                                   struct ieee80211_vif *vif,
2585                                   struct ieee80211_sta *sta)
2586 {
2587         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2588
2589         hwsim_check_magic(vif);
2590         hwsim_set_sta_magic(sta);
2591         mac80211_hwsim_sta_rc_update(hw, vif, sta, 0);
2592
2593         if (sta->valid_links) {
2594                 WARN(hweight16(sta->valid_links) > 1,
2595                      "expect to add STA with single link, have 0x%x\n",
2596                      sta->valid_links);
2597                 sp->active_links_rx = sta->valid_links;
2598         }
2599
2600         return 0;
2601 }
2602
2603 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2604                                      struct ieee80211_vif *vif,
2605                                      struct ieee80211_sta *sta)
2606 {
2607         hwsim_check_magic(vif);
2608         hwsim_clear_sta_magic(sta);
2609
2610         return 0;
2611 }
2612
2613 static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2614                                     struct ieee80211_vif *vif,
2615                                     struct ieee80211_sta *sta,
2616                                     enum ieee80211_sta_state old_state,
2617                                     enum ieee80211_sta_state new_state)
2618 {
2619         if (new_state == IEEE80211_STA_NOTEXIST)
2620                 return mac80211_hwsim_sta_remove(hw, vif, sta);
2621
2622         if (old_state == IEEE80211_STA_NOTEXIST)
2623                 return mac80211_hwsim_sta_add(hw, vif, sta);
2624
2625         /*
2626          * when client is authorized (AP station marked as such),
2627          * enable all links
2628          */
2629         if (vif->type == NL80211_IFTYPE_STATION &&
2630             new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2631                 ieee80211_set_active_links_async(vif, vif->valid_links);
2632
2633         return 0;
2634 }
2635
2636 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2637                                       struct ieee80211_vif *vif,
2638                                       enum sta_notify_cmd cmd,
2639                                       struct ieee80211_sta *sta)
2640 {
2641         hwsim_check_magic(vif);
2642
2643         switch (cmd) {
2644         case STA_NOTIFY_SLEEP:
2645         case STA_NOTIFY_AWAKE:
2646                 /* TODO: make good use of these flags */
2647                 break;
2648         default:
2649                 WARN(1, "Invalid sta notify: %d\n", cmd);
2650                 break;
2651         }
2652 }
2653
2654 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2655                                   struct ieee80211_sta *sta,
2656                                   bool set)
2657 {
2658         hwsim_check_sta_magic(sta);
2659         return 0;
2660 }
2661
2662 static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2663                                   struct ieee80211_vif *vif,
2664                                   unsigned int link_id, u16 queue,
2665                                   const struct ieee80211_tx_queue_params *params)
2666 {
2667         wiphy_dbg(hw->wiphy,
2668                   "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2669                   __func__, queue,
2670                   params->txop, params->cw_min,
2671                   params->cw_max, params->aifs);
2672         return 0;
2673 }
2674
2675 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2676                                      struct survey_info *survey)
2677 {
2678         struct mac80211_hwsim_data *hwsim = hw->priv;
2679
2680         if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2681                 return -ENOENT;
2682
2683         mutex_lock(&hwsim->mutex);
2684         survey->channel = hwsim->survey_data[idx].channel;
2685         if (!survey->channel) {
2686                 mutex_unlock(&hwsim->mutex);
2687                 return -ENOENT;
2688         }
2689
2690         /*
2691          * Magically conjured dummy values --- this is only ok for simulated hardware.
2692          *
2693          * A real driver which cannot determine real values noise MUST NOT
2694          * report any, especially not a magically conjured ones :-)
2695          */
2696         survey->filled = SURVEY_INFO_NOISE_DBM |
2697                          SURVEY_INFO_TIME |
2698                          SURVEY_INFO_TIME_BUSY;
2699         survey->noise = -92;
2700         survey->time =
2701                 jiffies_to_msecs(hwsim->survey_data[idx].end -
2702                                  hwsim->survey_data[idx].start);
2703         /* report 12.5% of channel time is used */
2704         survey->time_busy = survey->time/8;
2705         mutex_unlock(&hwsim->mutex);
2706
2707         return 0;
2708 }
2709
2710 #ifdef CONFIG_NL80211_TESTMODE
2711 /*
2712  * This section contains example code for using netlink
2713  * attributes with the testmode command in nl80211.
2714  */
2715
2716 /* These enums need to be kept in sync with userspace */
2717 enum hwsim_testmode_attr {
2718         __HWSIM_TM_ATTR_INVALID = 0,
2719         HWSIM_TM_ATTR_CMD       = 1,
2720         HWSIM_TM_ATTR_PS        = 2,
2721
2722         /* keep last */
2723         __HWSIM_TM_ATTR_AFTER_LAST,
2724         HWSIM_TM_ATTR_MAX       = __HWSIM_TM_ATTR_AFTER_LAST - 1
2725 };
2726
2727 enum hwsim_testmode_cmd {
2728         HWSIM_TM_CMD_SET_PS             = 0,
2729         HWSIM_TM_CMD_GET_PS             = 1,
2730         HWSIM_TM_CMD_STOP_QUEUES        = 2,
2731         HWSIM_TM_CMD_WAKE_QUEUES        = 3,
2732 };
2733
2734 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
2735         [HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
2736         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
2737 };
2738
2739 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
2740                                        struct ieee80211_vif *vif,
2741                                        void *data, int len)
2742 {
2743         struct mac80211_hwsim_data *hwsim = hw->priv;
2744         struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
2745         struct sk_buff *skb;
2746         int err, ps;
2747
2748         err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
2749                                    hwsim_testmode_policy, NULL);
2750         if (err)
2751                 return err;
2752
2753         if (!tb[HWSIM_TM_ATTR_CMD])
2754                 return -EINVAL;
2755
2756         switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
2757         case HWSIM_TM_CMD_SET_PS:
2758                 if (!tb[HWSIM_TM_ATTR_PS])
2759                         return -EINVAL;
2760                 ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
2761                 return hwsim_fops_ps_write(hwsim, ps);
2762         case HWSIM_TM_CMD_GET_PS:
2763                 skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
2764                                                 nla_total_size(sizeof(u32)));
2765                 if (!skb)
2766                         return -ENOMEM;
2767                 if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
2768                         goto nla_put_failure;
2769                 return cfg80211_testmode_reply(skb);
2770         case HWSIM_TM_CMD_STOP_QUEUES:
2771                 ieee80211_stop_queues(hw);
2772                 return 0;
2773         case HWSIM_TM_CMD_WAKE_QUEUES:
2774                 ieee80211_wake_queues(hw);
2775                 return 0;
2776         default:
2777                 return -EOPNOTSUPP;
2778         }
2779
2780  nla_put_failure:
2781         kfree_skb(skb);
2782         return -ENOBUFS;
2783 }
2784 #endif
2785
2786 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
2787                                        struct ieee80211_vif *vif,
2788                                        struct ieee80211_ampdu_params *params)
2789 {
2790         struct ieee80211_sta *sta = params->sta;
2791         enum ieee80211_ampdu_mlme_action action = params->action;
2792         u16 tid = params->tid;
2793
2794         switch (action) {
2795         case IEEE80211_AMPDU_TX_START:
2796                 return IEEE80211_AMPDU_TX_START_IMMEDIATE;
2797         case IEEE80211_AMPDU_TX_STOP_CONT:
2798         case IEEE80211_AMPDU_TX_STOP_FLUSH:
2799         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
2800                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2801                 break;
2802         case IEEE80211_AMPDU_TX_OPERATIONAL:
2803                 break;
2804         case IEEE80211_AMPDU_RX_START:
2805         case IEEE80211_AMPDU_RX_STOP:
2806                 break;
2807         default:
2808                 return -EOPNOTSUPP;
2809         }
2810
2811         return 0;
2812 }
2813
2814 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
2815                                  struct ieee80211_vif *vif,
2816                                  u32 queues, bool drop)
2817 {
2818         /* Not implemented, queues only on kernel side */
2819 }
2820
2821 static void hw_scan_work(struct work_struct *work)
2822 {
2823         struct mac80211_hwsim_data *hwsim =
2824                 container_of(work, struct mac80211_hwsim_data, hw_scan.work);
2825         struct cfg80211_scan_request *req = hwsim->hw_scan_request;
2826         int dwell, i;
2827
2828         mutex_lock(&hwsim->mutex);
2829         if (hwsim->scan_chan_idx >= req->n_channels) {
2830                 struct cfg80211_scan_info info = {
2831                         .aborted = false,
2832                 };
2833
2834                 wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
2835                 ieee80211_scan_completed(hwsim->hw, &info);
2836                 hwsim->hw_scan_request = NULL;
2837                 hwsim->hw_scan_vif = NULL;
2838                 hwsim->tmp_chan = NULL;
2839                 mutex_unlock(&hwsim->mutex);
2840                 mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
2841                                              false);
2842                 return;
2843         }
2844
2845         wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
2846                   req->channels[hwsim->scan_chan_idx]->center_freq);
2847
2848         hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
2849         if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
2850                                       IEEE80211_CHAN_RADAR) ||
2851             !req->n_ssids) {
2852                 dwell = 120;
2853         } else {
2854                 dwell = 30;
2855                 /* send probes */
2856                 for (i = 0; i < req->n_ssids; i++) {
2857                         struct sk_buff *probe;
2858                         struct ieee80211_mgmt *mgmt;
2859
2860                         probe = ieee80211_probereq_get(hwsim->hw,
2861                                                        hwsim->scan_addr,
2862                                                        req->ssids[i].ssid,
2863                                                        req->ssids[i].ssid_len,
2864                                                        req->ie_len);
2865                         if (!probe)
2866                                 continue;
2867
2868                         mgmt = (struct ieee80211_mgmt *) probe->data;
2869                         memcpy(mgmt->da, req->bssid, ETH_ALEN);
2870                         memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
2871
2872                         if (req->ie_len)
2873                                 skb_put_data(probe, req->ie, req->ie_len);
2874
2875                         rcu_read_lock();
2876                         if (!ieee80211_tx_prepare_skb(hwsim->hw,
2877                                                       hwsim->hw_scan_vif,
2878                                                       probe,
2879                                                       hwsim->tmp_chan->band,
2880                                                       NULL)) {
2881                                 rcu_read_unlock();
2882                                 kfree_skb(probe);
2883                                 continue;
2884                         }
2885
2886                         local_bh_disable();
2887                         mac80211_hwsim_tx_frame(hwsim->hw, probe,
2888                                                 hwsim->tmp_chan);
2889                         rcu_read_unlock();
2890                         local_bh_enable();
2891                 }
2892         }
2893         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
2894                                      msecs_to_jiffies(dwell));
2895         hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
2896         hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
2897         hwsim->survey_data[hwsim->scan_chan_idx].end =
2898                 jiffies + msecs_to_jiffies(dwell);
2899         hwsim->scan_chan_idx++;
2900         mutex_unlock(&hwsim->mutex);
2901 }
2902
2903 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
2904                                   struct ieee80211_vif *vif,
2905                                   struct ieee80211_scan_request *hw_req)
2906 {
2907         struct mac80211_hwsim_data *hwsim = hw->priv;
2908         struct cfg80211_scan_request *req = &hw_req->req;
2909
2910         mutex_lock(&hwsim->mutex);
2911         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
2912                 mutex_unlock(&hwsim->mutex);
2913                 return -EBUSY;
2914         }
2915         hwsim->hw_scan_request = req;
2916         hwsim->hw_scan_vif = vif;
2917         hwsim->scan_chan_idx = 0;
2918         if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
2919                 get_random_mask_addr(hwsim->scan_addr,
2920                                      hw_req->req.mac_addr,
2921                                      hw_req->req.mac_addr_mask);
2922         else
2923                 memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
2924         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2925         mutex_unlock(&hwsim->mutex);
2926
2927         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2928         wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
2929
2930         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
2931
2932         return 0;
2933 }
2934
2935 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
2936                                           struct ieee80211_vif *vif)
2937 {
2938         struct mac80211_hwsim_data *hwsim = hw->priv;
2939         struct cfg80211_scan_info info = {
2940                 .aborted = true,
2941         };
2942
2943         wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
2944
2945         cancel_delayed_work_sync(&hwsim->hw_scan);
2946
2947         mutex_lock(&hwsim->mutex);
2948         ieee80211_scan_completed(hwsim->hw, &info);
2949         hwsim->tmp_chan = NULL;
2950         hwsim->hw_scan_request = NULL;
2951         hwsim->hw_scan_vif = NULL;
2952         mutex_unlock(&hwsim->mutex);
2953 }
2954
2955 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
2956                                    struct ieee80211_vif *vif,
2957                                    const u8 *mac_addr)
2958 {
2959         struct mac80211_hwsim_data *hwsim = hw->priv;
2960
2961         mutex_lock(&hwsim->mutex);
2962
2963         if (hwsim->scanning) {
2964                 pr_debug("two hwsim sw_scans detected!\n");
2965                 goto out;
2966         }
2967
2968         pr_debug("hwsim sw_scan request, prepping stuff\n");
2969
2970         memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
2971         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
2972         hwsim->scanning = true;
2973         memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
2974
2975 out:
2976         mutex_unlock(&hwsim->mutex);
2977 }
2978
2979 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
2980                                             struct ieee80211_vif *vif)
2981 {
2982         struct mac80211_hwsim_data *hwsim = hw->priv;
2983
2984         mutex_lock(&hwsim->mutex);
2985
2986         pr_debug("hwsim sw_scan_complete\n");
2987         hwsim->scanning = false;
2988         mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
2989         eth_zero_addr(hwsim->scan_addr);
2990
2991         mutex_unlock(&hwsim->mutex);
2992 }
2993
2994 static void hw_roc_start(struct work_struct *work)
2995 {
2996         struct mac80211_hwsim_data *hwsim =
2997                 container_of(work, struct mac80211_hwsim_data, roc_start.work);
2998
2999         mutex_lock(&hwsim->mutex);
3000
3001         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
3002         hwsim->tmp_chan = hwsim->roc_chan;
3003         ieee80211_ready_on_channel(hwsim->hw);
3004
3005         ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
3006                                      msecs_to_jiffies(hwsim->roc_duration));
3007
3008         mutex_unlock(&hwsim->mutex);
3009 }
3010
3011 static void hw_roc_done(struct work_struct *work)
3012 {
3013         struct mac80211_hwsim_data *hwsim =
3014                 container_of(work, struct mac80211_hwsim_data, roc_done.work);
3015
3016         mutex_lock(&hwsim->mutex);
3017         ieee80211_remain_on_channel_expired(hwsim->hw);
3018         hwsim->tmp_chan = NULL;
3019         mutex_unlock(&hwsim->mutex);
3020
3021         wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
3022 }
3023
3024 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
3025                               struct ieee80211_vif *vif,
3026                               struct ieee80211_channel *chan,
3027                               int duration,
3028                               enum ieee80211_roc_type type)
3029 {
3030         struct mac80211_hwsim_data *hwsim = hw->priv;
3031
3032         mutex_lock(&hwsim->mutex);
3033         if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
3034                 mutex_unlock(&hwsim->mutex);
3035                 return -EBUSY;
3036         }
3037
3038         hwsim->roc_chan = chan;
3039         hwsim->roc_duration = duration;
3040         mutex_unlock(&hwsim->mutex);
3041
3042         wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
3043                   chan->center_freq, duration);
3044         ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
3045
3046         return 0;
3047 }
3048
3049 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
3050                                struct ieee80211_vif *vif)
3051 {
3052         struct mac80211_hwsim_data *hwsim = hw->priv;
3053
3054         cancel_delayed_work_sync(&hwsim->roc_start);
3055         cancel_delayed_work_sync(&hwsim->roc_done);
3056
3057         mutex_lock(&hwsim->mutex);
3058         hwsim->tmp_chan = NULL;
3059         mutex_unlock(&hwsim->mutex);
3060
3061         wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
3062
3063         return 0;
3064 }
3065
3066 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
3067                                       struct ieee80211_chanctx_conf *ctx)
3068 {
3069         hwsim_set_chanctx_magic(ctx);
3070         wiphy_dbg(hw->wiphy,
3071                   "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3072                   ctx->def.chan->center_freq, ctx->def.width,
3073                   ctx->def.center_freq1, ctx->def.center_freq2);
3074         return 0;
3075 }
3076
3077 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
3078                                           struct ieee80211_chanctx_conf *ctx)
3079 {
3080         wiphy_dbg(hw->wiphy,
3081                   "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3082                   ctx->def.chan->center_freq, ctx->def.width,
3083                   ctx->def.center_freq1, ctx->def.center_freq2);
3084         hwsim_check_chanctx_magic(ctx);
3085         hwsim_clear_chanctx_magic(ctx);
3086 }
3087
3088 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
3089                                           struct ieee80211_chanctx_conf *ctx,
3090                                           u32 changed)
3091 {
3092         hwsim_check_chanctx_magic(ctx);
3093         wiphy_dbg(hw->wiphy,
3094                   "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3095                   ctx->def.chan->center_freq, ctx->def.width,
3096                   ctx->def.center_freq1, ctx->def.center_freq2);
3097 }
3098
3099 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
3100                                              struct ieee80211_vif *vif,
3101                                              struct ieee80211_bss_conf *link_conf,
3102                                              struct ieee80211_chanctx_conf *ctx)
3103 {
3104         hwsim_check_magic(vif);
3105         hwsim_check_chanctx_magic(ctx);
3106
3107         /* if we activate a link while already associated wake it up */
3108         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3109                 struct sk_buff *skb;
3110
3111                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3112                 if (skb) {
3113                         local_bh_disable();
3114                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3115                         local_bh_enable();
3116                 }
3117         }
3118
3119         return 0;
3120 }
3121
3122 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
3123                                                 struct ieee80211_vif *vif,
3124                                                 struct ieee80211_bss_conf *link_conf,
3125                                                 struct ieee80211_chanctx_conf *ctx)
3126 {
3127         hwsim_check_magic(vif);
3128         hwsim_check_chanctx_magic(ctx);
3129
3130         /* if we deactivate a link while associated suspend it first */
3131         if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3132                 struct sk_buff *skb;
3133
3134                 skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3135                 if (skb) {
3136                         struct ieee80211_hdr *hdr = (void *)skb->data;
3137
3138                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
3139
3140                         local_bh_disable();
3141                         mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3142                         local_bh_enable();
3143                 }
3144         }
3145 }
3146
3147 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3148         "tx_pkts_nic",
3149         "tx_bytes_nic",
3150         "rx_pkts_nic",
3151         "rx_bytes_nic",
3152         "d_tx_dropped",
3153         "d_tx_failed",
3154         "d_ps_mode",
3155         "d_group",
3156 };
3157
3158 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3159
3160 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3161                                           struct ieee80211_vif *vif,
3162                                           u32 sset, u8 *data)
3163 {
3164         if (sset == ETH_SS_STATS)
3165                 memcpy(data, *mac80211_hwsim_gstrings_stats,
3166                        sizeof(mac80211_hwsim_gstrings_stats));
3167 }
3168
3169 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3170                                             struct ieee80211_vif *vif, int sset)
3171 {
3172         if (sset == ETH_SS_STATS)
3173                 return MAC80211_HWSIM_SSTATS_LEN;
3174         return 0;
3175 }
3176
3177 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3178                                         struct ieee80211_vif *vif,
3179                                         struct ethtool_stats *stats, u64 *data)
3180 {
3181         struct mac80211_hwsim_data *ar = hw->priv;
3182         int i = 0;
3183
3184         data[i++] = ar->tx_pkts;
3185         data[i++] = ar->tx_bytes;
3186         data[i++] = ar->rx_pkts;
3187         data[i++] = ar->rx_bytes;
3188         data[i++] = ar->tx_dropped;
3189         data[i++] = ar->tx_failed;
3190         data[i++] = ar->ps;
3191         data[i++] = ar->group;
3192
3193         WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3194 }
3195
3196 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3197 {
3198         return 1;
3199 }
3200
3201 static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
3202 {
3203         return -EOPNOTSUPP;
3204 }
3205
3206 static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3207                                            struct ieee80211_vif *vif,
3208                                            u16 old_links, u16 new_links,
3209                                            struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3210 {
3211         unsigned long rem = old_links & ~new_links;
3212         unsigned long add = new_links & ~old_links;
3213         int i;
3214
3215         if (!old_links)
3216                 rem |= BIT(0);
3217         if (!new_links)
3218                 add |= BIT(0);
3219
3220         for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS)
3221                 mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3222
3223         for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3224                 struct ieee80211_bss_conf *link_conf;
3225
3226                 link_conf = link_conf_dereference_protected(vif, i);
3227                 if (WARN_ON(!link_conf))
3228                         continue;
3229
3230                 mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3231         }
3232
3233         return 0;
3234 }
3235
3236 static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3237                                            struct ieee80211_vif *vif,
3238                                            struct ieee80211_sta *sta,
3239                                            u16 old_links, u16 new_links)
3240 {
3241         struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3242
3243         hwsim_check_sta_magic(sta);
3244
3245         if (vif->type == NL80211_IFTYPE_STATION)
3246                 sp->active_links_rx = new_links;
3247
3248         return 0;
3249 }
3250
3251 static int mac80211_hwsim_send_pmsr_ftm_request_peer(struct sk_buff *msg,
3252                                                      struct cfg80211_pmsr_ftm_request_peer *request)
3253 {
3254         struct nlattr *ftm;
3255
3256         if (!request->requested)
3257                 return -EINVAL;
3258
3259         ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
3260         if (!ftm)
3261                 return -ENOBUFS;
3262
3263         if (nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE, request->preamble))
3264                 return -ENOBUFS;
3265
3266         if (nla_put_u16(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD, request->burst_period))
3267                 return -ENOBUFS;
3268
3269         if (request->asap && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_ASAP))
3270                 return -ENOBUFS;
3271
3272         if (request->request_lci && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI))
3273                 return -ENOBUFS;
3274
3275         if (request->request_civicloc &&
3276             nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC))
3277                 return -ENOBUFS;
3278
3279         if (request->trigger_based && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED))
3280                 return -ENOBUFS;
3281
3282         if (request->non_trigger_based &&
3283             nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED))
3284                 return -ENOBUFS;
3285
3286         if (request->lmr_feedback && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK))
3287                 return -ENOBUFS;
3288
3289         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP, request->num_bursts_exp))
3290                 return -ENOBUFS;
3291
3292         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3293                 return -ENOBUFS;
3294
3295         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST, request->ftms_per_burst))
3296                 return -ENOBUFS;
3297
3298         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES, request->ftmr_retries))
3299                 return -ENOBUFS;
3300
3301         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3302                 return -ENOBUFS;
3303
3304         if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, request->bss_color))
3305                 return -ENOBUFS;
3306
3307         nla_nest_end(msg, ftm);
3308
3309         return 0;
3310 }
3311
3312 static int mac80211_hwsim_send_pmsr_request_peer(struct sk_buff *msg,
3313                                                  struct cfg80211_pmsr_request_peer *request)
3314 {
3315         struct nlattr *peer, *chandef, *req, *data;
3316         int err;
3317
3318         peer = nla_nest_start(msg, NL80211_PMSR_ATTR_PEERS);
3319         if (!peer)
3320                 return -ENOBUFS;
3321
3322         if (nla_put(msg, NL80211_PMSR_PEER_ATTR_ADDR, ETH_ALEN,
3323                     request->addr))
3324                 return -ENOBUFS;
3325
3326         chandef = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_CHAN);
3327         if (!chandef)
3328                 return -ENOBUFS;
3329
3330         err = nl80211_send_chandef(msg, &request->chandef);
3331         if (err)
3332                 return err;
3333
3334         nla_nest_end(msg, chandef);
3335
3336         req = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_REQ);
3337         if (!req)
3338                 return -ENOBUFS;
3339
3340         if (request->report_ap_tsf && nla_put_flag(msg, NL80211_PMSR_REQ_ATTR_GET_AP_TSF))
3341                 return -ENOBUFS;
3342
3343         data = nla_nest_start(msg, NL80211_PMSR_REQ_ATTR_DATA);
3344         if (!data)
3345                 return -ENOBUFS;
3346
3347         err = mac80211_hwsim_send_pmsr_ftm_request_peer(msg, &request->ftm);
3348         if (err)
3349                 return err;
3350
3351         nla_nest_end(msg, data);
3352         nla_nest_end(msg, req);
3353         nla_nest_end(msg, peer);
3354
3355         return 0;
3356 }
3357
3358 static int mac80211_hwsim_send_pmsr_request(struct sk_buff *msg,
3359                                             struct cfg80211_pmsr_request *request)
3360 {
3361         struct nlattr *pmsr;
3362         int err;
3363
3364         pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
3365         if (!pmsr)
3366                 return -ENOBUFS;
3367
3368         if (nla_put_u32(msg, NL80211_ATTR_TIMEOUT, request->timeout))
3369                 return -ENOBUFS;
3370
3371         if (!is_zero_ether_addr(request->mac_addr)) {
3372                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, request->mac_addr))
3373                         return -ENOBUFS;
3374                 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, request->mac_addr_mask))
3375                         return -ENOBUFS;
3376         }
3377
3378         for (int i = 0; i < request->n_peers; i++) {
3379                 err = mac80211_hwsim_send_pmsr_request_peer(msg, &request->peers[i]);
3380                 if (err)
3381                         return err;
3382         }
3383
3384         nla_nest_end(msg, pmsr);
3385
3386         return 0;
3387 }
3388
3389 static int mac80211_hwsim_start_pmsr(struct ieee80211_hw *hw,
3390                                      struct ieee80211_vif *vif,
3391                                      struct cfg80211_pmsr_request *request)
3392 {
3393         struct mac80211_hwsim_data *data;
3394         struct sk_buff *skb = NULL;
3395         struct nlattr *pmsr;
3396         void *msg_head;
3397         u32 _portid;
3398         int err = 0;
3399
3400         data = hw->priv;
3401         _portid = READ_ONCE(data->wmediumd);
3402         if (!_portid && !hwsim_virtio_enabled)
3403                 return -EOPNOTSUPP;
3404
3405         mutex_lock(&data->mutex);
3406
3407         if (data->pmsr_request) {
3408                 err = -EBUSY;
3409                 goto out_free;
3410         }
3411
3412         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3413
3414         if (!skb) {
3415                 err = -ENOMEM;
3416                 goto out_free;
3417         }
3418
3419         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_START_PMSR);
3420
3421         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
3422                     ETH_ALEN, data->addresses[1].addr)) {
3423                 err = -ENOMEM;
3424                 goto out_free;
3425         }
3426
3427         pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3428         if (!pmsr) {
3429                 err = -ENOMEM;
3430                 goto out_free;
3431         }
3432
3433         err = mac80211_hwsim_send_pmsr_request(skb, request);
3434         if (err)
3435                 goto out_free;
3436
3437         nla_nest_end(skb, pmsr);
3438
3439         genlmsg_end(skb, msg_head);
3440         if (hwsim_virtio_enabled)
3441                 hwsim_tx_virtio(data, skb);
3442         else
3443                 hwsim_unicast_netgroup(data, skb, _portid);
3444
3445         data->pmsr_request = request;
3446         data->pmsr_request_wdev = ieee80211_vif_to_wdev(vif);
3447
3448 out_free:
3449         if (err && skb)
3450                 nlmsg_free(skb);
3451
3452         mutex_unlock(&data->mutex);
3453         return err;
3454 }
3455
3456 static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
3457                                       struct ieee80211_vif *vif,
3458                                       struct cfg80211_pmsr_request *request)
3459 {
3460         struct mac80211_hwsim_data *data;
3461         struct sk_buff *skb = NULL;
3462         struct nlattr *pmsr;
3463         void *msg_head;
3464         u32 _portid;
3465         int err = 0;
3466
3467         data = hw->priv;
3468         _portid = READ_ONCE(data->wmediumd);
3469         if (!_portid && !hwsim_virtio_enabled)
3470                 return;
3471
3472         mutex_lock(&data->mutex);
3473
3474         if (data->pmsr_request != request) {
3475                 err = -EINVAL;
3476                 goto out;
3477         }
3478
3479         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3480         if (!skb) {
3481                 err = -ENOMEM;
3482                 goto out;
3483         }
3484
3485         msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_ABORT_PMSR);
3486
3487         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER, ETH_ALEN, data->addresses[1].addr))
3488                 goto out;
3489
3490         pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3491         if (!pmsr) {
3492                 err = -ENOMEM;
3493                 goto out;
3494         }
3495
3496         err = mac80211_hwsim_send_pmsr_request(skb, request);
3497         if (err)
3498                 goto out;
3499
3500         err = nla_nest_end(skb, pmsr);
3501         if (err)
3502                 goto out;
3503
3504         genlmsg_end(skb, msg_head);
3505         if (hwsim_virtio_enabled)
3506                 hwsim_tx_virtio(data, skb);
3507         else
3508                 hwsim_unicast_netgroup(data, skb, _portid);
3509
3510 out:
3511         if (err && skb)
3512                 nlmsg_free(skb);
3513
3514         mutex_unlock(&data->mutex);
3515 }
3516
3517 static int mac80211_hwsim_parse_rate_info(struct nlattr *rateattr,
3518                                           struct rate_info *rate_info,
3519                                           struct genl_info *info)
3520 {
3521         struct nlattr *tb[HWSIM_RATE_INFO_ATTR_MAX + 1];
3522         int ret;
3523
3524         ret = nla_parse_nested(tb, HWSIM_RATE_INFO_ATTR_MAX,
3525                                rateattr, hwsim_rate_info_policy, info->extack);
3526         if (ret)
3527                 return ret;
3528
3529         if (tb[HWSIM_RATE_INFO_ATTR_FLAGS])
3530                 rate_info->flags = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_FLAGS]);
3531
3532         if (tb[HWSIM_RATE_INFO_ATTR_MCS])
3533                 rate_info->mcs = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_MCS]);
3534
3535         if (tb[HWSIM_RATE_INFO_ATTR_LEGACY])
3536                 rate_info->legacy = nla_get_u16(tb[HWSIM_RATE_INFO_ATTR_LEGACY]);
3537
3538         if (tb[HWSIM_RATE_INFO_ATTR_NSS])
3539                 rate_info->nss = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_NSS]);
3540
3541         if (tb[HWSIM_RATE_INFO_ATTR_BW])
3542                 rate_info->bw = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_BW]);
3543
3544         if (tb[HWSIM_RATE_INFO_ATTR_HE_GI])
3545                 rate_info->he_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_GI]);
3546
3547         if (tb[HWSIM_RATE_INFO_ATTR_HE_DCM])
3548                 rate_info->he_dcm = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_DCM]);
3549
3550         if (tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC])
3551                 rate_info->he_ru_alloc =
3552                         nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC]);
3553
3554         if (tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH])
3555                 rate_info->n_bonded_ch = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH]);
3556
3557         if (tb[HWSIM_RATE_INFO_ATTR_EHT_GI])
3558                 rate_info->eht_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_GI]);
3559
3560         if (tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC])
3561                 rate_info->eht_ru_alloc = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC]);
3562
3563         return 0;
3564 }
3565
3566 static int mac80211_hwsim_parse_ftm_result(struct nlattr *ftm,
3567                                            struct cfg80211_pmsr_ftm_result *result,
3568                                            struct genl_info *info)
3569 {
3570         struct nlattr *tb[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1];
3571         int ret;
3572
3573         ret = nla_parse_nested(tb, NL80211_PMSR_FTM_RESP_ATTR_MAX,
3574                                ftm, hwsim_ftm_result_policy, info->extack);
3575         if (ret)
3576                 return ret;
3577
3578         if (tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON])
3579                 result->failure_reason = nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON]);
3580
3581         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX])
3582                 result->burst_index = nla_get_u16(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX]);
3583
3584         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]) {
3585                 result->num_ftmr_attempts_valid = 1;
3586                 result->num_ftmr_attempts =
3587                         nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]);
3588         }
3589
3590         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]) {
3591                 result->num_ftmr_successes_valid = 1;
3592                 result->num_ftmr_successes =
3593                         nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]);
3594         }
3595
3596         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME])
3597                 result->busy_retry_time =
3598                         nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME]);
3599
3600         if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP])
3601                 result->num_bursts_exp = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP]);
3602
3603         if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION])
3604                 result->burst_duration = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION]);
3605
3606         if (tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST])
3607                 result->ftms_per_burst = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST]);
3608
3609         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]) {
3610                 result->rssi_avg_valid = 1;
3611                 result->rssi_avg = nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]);
3612         }
3613         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]) {
3614                 result->rssi_spread_valid = 1;
3615                 result->rssi_spread =
3616                         nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]);
3617         }
3618
3619         if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE]) {
3620                 result->tx_rate_valid = 1;
3621                 ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE],
3622                                                      &result->tx_rate, info);
3623                 if (ret)
3624                         return ret;
3625         }
3626
3627         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE]) {
3628                 result->rx_rate_valid = 1;
3629                 ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE],
3630                                                      &result->rx_rate, info);
3631                 if (ret)
3632                         return ret;
3633         }
3634
3635         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]) {
3636                 result->rtt_avg_valid = 1;
3637                 result->rtt_avg =
3638                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]);
3639         }
3640         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]) {
3641                 result->rtt_variance_valid = 1;
3642                 result->rtt_variance =
3643                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]);
3644         }
3645         if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]) {
3646                 result->rtt_spread_valid = 1;
3647                 result->rtt_spread =
3648                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]);
3649         }
3650         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]) {
3651                 result->dist_avg_valid = 1;
3652                 result->dist_avg =
3653                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]);
3654         }
3655         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]) {
3656                 result->dist_variance_valid = 1;
3657                 result->dist_variance =
3658                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]);
3659         }
3660         if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]) {
3661                 result->dist_spread_valid = 1;
3662                 result->dist_spread =
3663                         nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]);
3664         }
3665
3666         if (tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]) {
3667                 result->lci = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3668                 result->lci_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
3669         }
3670
3671         if (tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]) {
3672                 result->civicloc = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3673                 result->civicloc_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
3674         }
3675
3676         return 0;
3677 }
3678
3679 static int mac80211_hwsim_parse_pmsr_resp(struct nlattr *resp,
3680                                           struct cfg80211_pmsr_result *result,
3681                                           struct genl_info *info)
3682 {
3683         struct nlattr *tb[NL80211_PMSR_RESP_ATTR_MAX + 1];
3684         struct nlattr *pmsr;
3685         int rem;
3686         int ret;
3687
3688         ret = nla_parse_nested(tb, NL80211_PMSR_RESP_ATTR_MAX, resp, hwsim_pmsr_resp_policy,
3689                                info->extack);
3690         if (ret)
3691                 return ret;
3692
3693         if (tb[NL80211_PMSR_RESP_ATTR_STATUS])
3694                 result->status = nla_get_u32(tb[NL80211_PMSR_RESP_ATTR_STATUS]);
3695
3696         if (tb[NL80211_PMSR_RESP_ATTR_HOST_TIME])
3697                 result->host_time = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_HOST_TIME]);
3698
3699         if (tb[NL80211_PMSR_RESP_ATTR_AP_TSF]) {
3700                 result->ap_tsf_valid = 1;
3701                 result->ap_tsf = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_AP_TSF]);
3702         }
3703
3704         result->final = !!tb[NL80211_PMSR_RESP_ATTR_FINAL];
3705
3706         if (!tb[NL80211_PMSR_RESP_ATTR_DATA])
3707                 return 0;
3708
3709         nla_for_each_nested(pmsr, tb[NL80211_PMSR_RESP_ATTR_DATA], rem) {
3710                 switch (nla_type(pmsr)) {
3711                 case NL80211_PMSR_TYPE_FTM:
3712                         result->type = NL80211_PMSR_TYPE_FTM;
3713                         ret = mac80211_hwsim_parse_ftm_result(pmsr, &result->ftm, info);
3714                         if (ret)
3715                                 return ret;
3716                         break;
3717                 default:
3718                         NL_SET_ERR_MSG_ATTR(info->extack, pmsr, "Unknown pmsr resp type");
3719                         return -EINVAL;
3720                 }
3721         }
3722
3723         return 0;
3724 }
3725
3726 static int mac80211_hwsim_parse_pmsr_result(struct nlattr *peer,
3727                                             struct cfg80211_pmsr_result *result,
3728                                             struct genl_info *info)
3729 {
3730         struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];
3731         int ret;
3732
3733         if (!peer)
3734                 return -EINVAL;
3735
3736         ret = nla_parse_nested(tb, NL80211_PMSR_PEER_ATTR_MAX, peer,
3737                                hwsim_pmsr_peer_result_policy, info->extack);
3738         if (ret)
3739                 return ret;
3740
3741         if (tb[NL80211_PMSR_PEER_ATTR_ADDR])
3742                 memcpy(result->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]),
3743                        ETH_ALEN);
3744
3745         if (tb[NL80211_PMSR_PEER_ATTR_RESP]) {
3746                 ret = mac80211_hwsim_parse_pmsr_resp(tb[NL80211_PMSR_PEER_ATTR_RESP], result, info);
3747                 if (ret)
3748                         return ret;
3749         }
3750
3751         return 0;
3752 };
3753
3754 static int hwsim_pmsr_report_nl(struct sk_buff *msg, struct genl_info *info)
3755 {
3756         struct mac80211_hwsim_data *data;
3757         struct nlattr *peers, *peer;
3758         struct nlattr *reqattr;
3759         const u8 *src;
3760         int err;
3761         int rem;
3762
3763         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER])
3764                 return -EINVAL;
3765
3766         src = nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
3767         data = get_hwsim_data_ref_from_addr(src);
3768         if (!data)
3769                 return -EINVAL;
3770
3771         mutex_lock(&data->mutex);
3772         if (!data->pmsr_request) {
3773                 err = -EINVAL;
3774                 goto out;
3775         }
3776
3777         reqattr = info->attrs[HWSIM_ATTR_PMSR_RESULT];
3778         if (!reqattr) {
3779                 err = -EINVAL;
3780                 goto out;
3781         }
3782
3783         peers = nla_find_nested(reqattr, NL80211_PMSR_ATTR_PEERS);
3784         if (!peers) {
3785                 err = -EINVAL;
3786                 goto out;
3787         }
3788
3789         nla_for_each_nested(peer, peers, rem) {
3790                 struct cfg80211_pmsr_result result;
3791
3792                 err = mac80211_hwsim_parse_pmsr_result(peer, &result, info);
3793                 if (err)
3794                         goto out;
3795
3796                 cfg80211_pmsr_report(data->pmsr_request_wdev,
3797                                      data->pmsr_request, &result, GFP_KERNEL);
3798         }
3799
3800         cfg80211_pmsr_complete(data->pmsr_request_wdev, data->pmsr_request, GFP_KERNEL);
3801
3802         err = 0;
3803 out:
3804         data->pmsr_request = NULL;
3805         data->pmsr_request_wdev = NULL;
3806
3807         mutex_unlock(&data->mutex);
3808         return err;
3809 }
3810
3811 #define HWSIM_COMMON_OPS                                        \
3812         .tx = mac80211_hwsim_tx,                                \
3813         .wake_tx_queue = ieee80211_handle_wake_tx_queue,        \
3814         .start = mac80211_hwsim_start,                          \
3815         .stop = mac80211_hwsim_stop,                            \
3816         .add_interface = mac80211_hwsim_add_interface,          \
3817         .change_interface = mac80211_hwsim_change_interface,    \
3818         .remove_interface = mac80211_hwsim_remove_interface,    \
3819         .config = mac80211_hwsim_config,                        \
3820         .configure_filter = mac80211_hwsim_configure_filter,    \
3821         .vif_cfg_changed = mac80211_hwsim_vif_info_changed,     \
3822         .link_info_changed = mac80211_hwsim_link_info_changed,  \
3823         .tx_last_beacon = mac80211_hwsim_tx_last_beacon,        \
3824         .sta_notify = mac80211_hwsim_sta_notify,                \
3825         .sta_rc_update = mac80211_hwsim_sta_rc_update,          \
3826         .conf_tx = mac80211_hwsim_conf_tx,                      \
3827         .get_survey = mac80211_hwsim_get_survey,                \
3828         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)      \
3829         .ampdu_action = mac80211_hwsim_ampdu_action,            \
3830         .flush = mac80211_hwsim_flush,                          \
3831         .get_et_sset_count = mac80211_hwsim_get_et_sset_count,  \
3832         .get_et_stats = mac80211_hwsim_get_et_stats,            \
3833         .get_et_strings = mac80211_hwsim_get_et_strings,        \
3834         .start_pmsr = mac80211_hwsim_start_pmsr,                \
3835         .abort_pmsr = mac80211_hwsim_abort_pmsr,
3836
3837 #define HWSIM_NON_MLO_OPS                                       \
3838         .sta_add = mac80211_hwsim_sta_add,                      \
3839         .sta_remove = mac80211_hwsim_sta_remove,                \
3840         .set_tim = mac80211_hwsim_set_tim,                      \
3841         .get_tsf = mac80211_hwsim_get_tsf,                      \
3842         .set_tsf = mac80211_hwsim_set_tsf,
3843
3844 static const struct ieee80211_ops mac80211_hwsim_ops = {
3845         HWSIM_COMMON_OPS
3846         HWSIM_NON_MLO_OPS
3847         .sw_scan_start = mac80211_hwsim_sw_scan,
3848         .sw_scan_complete = mac80211_hwsim_sw_scan_complete,
3849 };
3850
3851 #define HWSIM_CHANCTX_OPS                                       \
3852         .hw_scan = mac80211_hwsim_hw_scan,                      \
3853         .cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,        \
3854         .remain_on_channel = mac80211_hwsim_roc,                \
3855         .cancel_remain_on_channel = mac80211_hwsim_croc,        \
3856         .add_chanctx = mac80211_hwsim_add_chanctx,              \
3857         .remove_chanctx = mac80211_hwsim_remove_chanctx,        \
3858         .change_chanctx = mac80211_hwsim_change_chanctx,        \
3859         .assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
3860         .unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx,
3861
3862 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
3863         HWSIM_COMMON_OPS
3864         HWSIM_NON_MLO_OPS
3865         HWSIM_CHANCTX_OPS
3866 };
3867
3868 static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
3869         HWSIM_COMMON_OPS
3870         HWSIM_CHANCTX_OPS
3871         .set_rts_threshold = mac80211_hwsim_set_rts_threshold,
3872         .change_vif_links = mac80211_hwsim_change_vif_links,
3873         .change_sta_links = mac80211_hwsim_change_sta_links,
3874         .sta_state = mac80211_hwsim_sta_state,
3875 };
3876
3877 struct hwsim_new_radio_params {
3878         unsigned int channels;
3879         const char *reg_alpha2;
3880         const struct ieee80211_regdomain *regd;
3881         bool reg_strict;
3882         bool p2p_device;
3883         bool use_chanctx;
3884         bool destroy_on_close;
3885         const char *hwname;
3886         bool no_vif;
3887         const u8 *perm_addr;
3888         u32 iftypes;
3889         u32 *ciphers;
3890         u8 n_ciphers;
3891         bool mlo;
3892         const struct cfg80211_pmsr_capabilities *pmsr_capa;
3893 };
3894
3895 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
3896                                    struct genl_info *info)
3897 {
3898         if (info)
3899                 genl_notify(&hwsim_genl_family, mcast_skb, info,
3900                             HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3901         else
3902                 genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
3903                                   HWSIM_MCGRP_CONFIG, GFP_KERNEL);
3904 }
3905
3906 static int append_radio_msg(struct sk_buff *skb, int id,
3907                             struct hwsim_new_radio_params *param)
3908 {
3909         int ret;
3910
3911         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
3912         if (ret < 0)
3913                 return ret;
3914
3915         if (param->channels) {
3916                 ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
3917                 if (ret < 0)
3918                         return ret;
3919         }
3920
3921         if (param->reg_alpha2) {
3922                 ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
3923                               param->reg_alpha2);
3924                 if (ret < 0)
3925                         return ret;
3926         }
3927
3928         if (param->regd) {
3929                 int i;
3930
3931                 for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
3932                         if (hwsim_world_regdom_custom[i] != param->regd)
3933                                 continue;
3934
3935                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
3936                         if (ret < 0)
3937                                 return ret;
3938                         break;
3939                 }
3940         }
3941
3942         if (param->reg_strict) {
3943                 ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
3944                 if (ret < 0)
3945                         return ret;
3946         }
3947
3948         if (param->p2p_device) {
3949                 ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
3950                 if (ret < 0)
3951                         return ret;
3952         }
3953
3954         if (param->use_chanctx) {
3955                 ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
3956                 if (ret < 0)
3957                         return ret;
3958         }
3959
3960         if (param->hwname) {
3961                 ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
3962                               strlen(param->hwname), param->hwname);
3963                 if (ret < 0)
3964                         return ret;
3965         }
3966
3967         return 0;
3968 }
3969
3970 static void hwsim_mcast_new_radio(int id, struct genl_info *info,
3971                                   struct hwsim_new_radio_params *param)
3972 {
3973         struct sk_buff *mcast_skb;
3974         void *data;
3975
3976         mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3977         if (!mcast_skb)
3978                 return;
3979
3980         data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
3981                            HWSIM_CMD_NEW_RADIO);
3982         if (!data)
3983                 goto out_err;
3984
3985         if (append_radio_msg(mcast_skb, id, param) < 0)
3986                 goto out_err;
3987
3988         genlmsg_end(mcast_skb, data);
3989
3990         hwsim_mcast_config_msg(mcast_skb, info);
3991         return;
3992
3993 out_err:
3994         nlmsg_free(mcast_skb);
3995 }
3996
3997 static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
3998         {
3999                 .types_mask = BIT(NL80211_IFTYPE_STATION),
4000                 .he_cap = {
4001                         .has_he = true,
4002                         .he_cap_elem = {
4003                                 .mac_cap_info[0] =
4004                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4005                                 .mac_cap_info[1] =
4006                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4007                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4008                                 .mac_cap_info[2] =
4009                                         IEEE80211_HE_MAC_CAP2_BSR |
4010                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4011                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4012                                 .mac_cap_info[3] =
4013                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4014                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4015                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4016                                 .phy_cap_info[1] =
4017                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4018                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4019                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4020                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4021                                 .phy_cap_info[2] =
4022                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4023                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4024                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4025                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4026                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4027
4028                                 /* Leave all the other PHY capability bytes
4029                                  * unset, as DCM, beam forming, RU and PPE
4030                                  * threshold information are not supported
4031                                  */
4032                         },
4033                         .he_mcs_nss_supp = {
4034                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4035                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4036                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4037                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4038                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4039                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4040                         },
4041                 },
4042                 .eht_cap = {
4043                         .has_eht = true,
4044                         .eht_cap_elem = {
4045                                 .mac_cap_info[0] =
4046                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4047                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4048                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4049                                 .phy_cap_info[0] =
4050                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4051                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4052                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4053                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4054                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4055                                 .phy_cap_info[3] =
4056                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4057                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4058                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4059                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4060                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4061                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4062                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4063                                 .phy_cap_info[4] =
4064                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4065                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4066                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4067                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4068                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4069                                 .phy_cap_info[5] =
4070                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4071                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4072                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4073                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4074                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4075                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4076                                 .phy_cap_info[6] =
4077                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4078                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4079                                 .phy_cap_info[7] =
4080                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4081                         },
4082
4083                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4084                          * Rx
4085                          */
4086                         .eht_mcs_nss_supp = {
4087                                 /*
4088                                  * Since B0, B1, B2 and B3 are not set in
4089                                  * the supported channel width set field in the
4090                                  * HE PHY capabilities information field the
4091                                  * device is a 20MHz only device on 2.4GHz band.
4092                                  */
4093                                 .only_20mhz = {
4094                                         .rx_tx_mcs7_max_nss = 0x88,
4095                                         .rx_tx_mcs9_max_nss = 0x88,
4096                                         .rx_tx_mcs11_max_nss = 0x88,
4097                                         .rx_tx_mcs13_max_nss = 0x88,
4098                                 },
4099                         },
4100                         /* PPE threshold information is not supported */
4101                 },
4102         },
4103         {
4104                 .types_mask = BIT(NL80211_IFTYPE_AP),
4105                 .he_cap = {
4106                         .has_he = true,
4107                         .he_cap_elem = {
4108                                 .mac_cap_info[0] =
4109                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4110                                 .mac_cap_info[1] =
4111                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4112                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4113                                 .mac_cap_info[2] =
4114                                         IEEE80211_HE_MAC_CAP2_BSR |
4115                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4116                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4117                                 .mac_cap_info[3] =
4118                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4119                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4120                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4121                                 .phy_cap_info[1] =
4122                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4123                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4124                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4125                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4126                                 .phy_cap_info[2] =
4127                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4128                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4129                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4130                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4131                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4132
4133                                 /* Leave all the other PHY capability bytes
4134                                  * unset, as DCM, beam forming, RU and PPE
4135                                  * threshold information are not supported
4136                                  */
4137                         },
4138                         .he_mcs_nss_supp = {
4139                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4140                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4141                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4142                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4143                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4144                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4145                         },
4146                 },
4147                 .eht_cap = {
4148                         .has_eht = true,
4149                         .eht_cap_elem = {
4150                                 .mac_cap_info[0] =
4151                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4152                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4153                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4154                                 .phy_cap_info[0] =
4155                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4156                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4157                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4158                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4159                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4160                                 .phy_cap_info[3] =
4161                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4162                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4163                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4164                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4165                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4166                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4167                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4168                                 .phy_cap_info[4] =
4169                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4170                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4171                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4172                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4173                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4174                                 .phy_cap_info[5] =
4175                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4176                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4177                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4178                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4179                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4180                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4181                                 .phy_cap_info[6] =
4182                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4183                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4184                                 .phy_cap_info[7] =
4185                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4186                         },
4187
4188                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4189                          * Rx
4190                          */
4191                         .eht_mcs_nss_supp = {
4192                                 /*
4193                                  * Since B0, B1, B2 and B3 are not set in
4194                                  * the supported channel width set field in the
4195                                  * HE PHY capabilities information field the
4196                                  * device is a 20MHz only device on 2.4GHz band.
4197                                  */
4198                                 .only_20mhz = {
4199                                         .rx_tx_mcs7_max_nss = 0x88,
4200                                         .rx_tx_mcs9_max_nss = 0x88,
4201                                         .rx_tx_mcs11_max_nss = 0x88,
4202                                         .rx_tx_mcs13_max_nss = 0x88,
4203                                 },
4204                         },
4205                         /* PPE threshold information is not supported */
4206                 },
4207         },
4208 #ifdef CONFIG_MAC80211_MESH
4209         {
4210                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4211                 .he_cap = {
4212                         .has_he = true,
4213                         .he_cap_elem = {
4214                                 .mac_cap_info[0] =
4215                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4216                                 .mac_cap_info[1] =
4217                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4218                                 .mac_cap_info[2] =
4219                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4220                                 .mac_cap_info[3] =
4221                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4222                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4223                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4224                                 .phy_cap_info[1] =
4225                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4226                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4227                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4228                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4229                                 .phy_cap_info[2] = 0,
4230
4231                                 /* Leave all the other PHY capability bytes
4232                                  * unset, as DCM, beam forming, RU and PPE
4233                                  * threshold information are not supported
4234                                  */
4235                         },
4236                         .he_mcs_nss_supp = {
4237                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4238                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4239                                 .rx_mcs_160 = cpu_to_le16(0xffff),
4240                                 .tx_mcs_160 = cpu_to_le16(0xffff),
4241                                 .rx_mcs_80p80 = cpu_to_le16(0xffff),
4242                                 .tx_mcs_80p80 = cpu_to_le16(0xffff),
4243                         },
4244                 },
4245         },
4246 #endif
4247 };
4248
4249 static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
4250         {
4251                 /* TODO: should we support other types, e.g., P2P? */
4252                 .types_mask = BIT(NL80211_IFTYPE_STATION),
4253                 .he_cap = {
4254                         .has_he = true,
4255                         .he_cap_elem = {
4256                                 .mac_cap_info[0] =
4257                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4258                                 .mac_cap_info[1] =
4259                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4260                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4261                                 .mac_cap_info[2] =
4262                                         IEEE80211_HE_MAC_CAP2_BSR |
4263                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4264                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4265                                 .mac_cap_info[3] =
4266                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4267                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4268                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4269                                 .phy_cap_info[0] =
4270                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4271                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4272                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4273                                 .phy_cap_info[1] =
4274                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4275                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4276                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4277                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4278                                 .phy_cap_info[2] =
4279                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4280                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4281                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4282                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4283                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4284
4285                                 /* Leave all the other PHY capability bytes
4286                                  * unset, as DCM, beam forming, RU and PPE
4287                                  * threshold information are not supported
4288                                  */
4289                         },
4290                         .he_mcs_nss_supp = {
4291                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4292                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4293                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4294                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4295                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4296                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4297                         },
4298                 },
4299                 .eht_cap = {
4300                         .has_eht = true,
4301                         .eht_cap_elem = {
4302                                 .mac_cap_info[0] =
4303                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4304                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4305                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4306                                 .phy_cap_info[0] =
4307                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4308                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4309                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4310                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4311                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4312                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4313                                 .phy_cap_info[1] =
4314                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4315                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4316                                 .phy_cap_info[2] =
4317                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4318                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4319                                 .phy_cap_info[3] =
4320                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4321                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4322                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4323                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4324                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4325                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4326                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4327                                 .phy_cap_info[4] =
4328                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4329                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4330                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4331                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4332                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4333                                 .phy_cap_info[5] =
4334                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4335                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4336                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4337                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4338                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4339                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4340                                 .phy_cap_info[6] =
4341                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4342                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4343                                 .phy_cap_info[7] =
4344                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4345                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4346                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4347                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4348                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4349                         },
4350
4351                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4352                          * Rx
4353                          */
4354                         .eht_mcs_nss_supp = {
4355                                 /*
4356                                  * As B1 and B2 are set in the supported
4357                                  * channel width set field in the HE PHY
4358                                  * capabilities information field include all
4359                                  * the following MCS/NSS.
4360                                  */
4361                                 .bw._80 = {
4362                                         .rx_tx_mcs9_max_nss = 0x88,
4363                                         .rx_tx_mcs11_max_nss = 0x88,
4364                                         .rx_tx_mcs13_max_nss = 0x88,
4365                                 },
4366                                 .bw._160 = {
4367                                         .rx_tx_mcs9_max_nss = 0x88,
4368                                         .rx_tx_mcs11_max_nss = 0x88,
4369                                         .rx_tx_mcs13_max_nss = 0x88,
4370                                 },
4371                         },
4372                         /* PPE threshold information is not supported */
4373                 },
4374         },
4375         {
4376                 .types_mask = BIT(NL80211_IFTYPE_AP),
4377                 .he_cap = {
4378                         .has_he = true,
4379                         .he_cap_elem = {
4380                                 .mac_cap_info[0] =
4381                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4382                                 .mac_cap_info[1] =
4383                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4384                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4385                                 .mac_cap_info[2] =
4386                                         IEEE80211_HE_MAC_CAP2_BSR |
4387                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4388                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4389                                 .mac_cap_info[3] =
4390                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4391                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4392                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4393                                 .phy_cap_info[0] =
4394                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4395                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4396                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4397                                 .phy_cap_info[1] =
4398                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4399                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4400                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4401                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4402                                 .phy_cap_info[2] =
4403                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4404                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4405                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4406                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4407                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4408
4409                                 /* Leave all the other PHY capability bytes
4410                                  * unset, as DCM, beam forming, RU and PPE
4411                                  * threshold information are not supported
4412                                  */
4413                         },
4414                         .he_mcs_nss_supp = {
4415                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4416                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4417                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4418                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4419                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4420                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4421                         },
4422                 },
4423                 .eht_cap = {
4424                         .has_eht = true,
4425                         .eht_cap_elem = {
4426                                 .mac_cap_info[0] =
4427                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4428                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4429                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4430                                 .phy_cap_info[0] =
4431                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4432                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4433                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4434                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4435                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4436                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4437                                 .phy_cap_info[1] =
4438                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4439                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4440                                 .phy_cap_info[2] =
4441                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4442                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4443                                 .phy_cap_info[3] =
4444                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4445                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4446                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4447                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4448                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4449                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4450                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4451                                 .phy_cap_info[4] =
4452                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4453                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4454                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4455                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4456                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4457                                 .phy_cap_info[5] =
4458                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4459                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4460                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4461                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4462                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4463                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4464                                 .phy_cap_info[6] =
4465                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4466                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4467                                 .phy_cap_info[7] =
4468                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4469                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4470                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4471                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4472                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4473                         },
4474
4475                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4476                          * Rx
4477                          */
4478                         .eht_mcs_nss_supp = {
4479                                 /*
4480                                  * As B1 and B2 are set in the supported
4481                                  * channel width set field in the HE PHY
4482                                  * capabilities information field include all
4483                                  * the following MCS/NSS.
4484                                  */
4485                                 .bw._80 = {
4486                                         .rx_tx_mcs9_max_nss = 0x88,
4487                                         .rx_tx_mcs11_max_nss = 0x88,
4488                                         .rx_tx_mcs13_max_nss = 0x88,
4489                                 },
4490                                 .bw._160 = {
4491                                         .rx_tx_mcs9_max_nss = 0x88,
4492                                         .rx_tx_mcs11_max_nss = 0x88,
4493                                         .rx_tx_mcs13_max_nss = 0x88,
4494                                 },
4495                         },
4496                         /* PPE threshold information is not supported */
4497                 },
4498         },
4499 #ifdef CONFIG_MAC80211_MESH
4500         {
4501                 /* TODO: should we support other types, e.g., IBSS?*/
4502                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4503                 .he_cap = {
4504                         .has_he = true,
4505                         .he_cap_elem = {
4506                                 .mac_cap_info[0] =
4507                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4508                                 .mac_cap_info[1] =
4509                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4510                                 .mac_cap_info[2] =
4511                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4512                                 .mac_cap_info[3] =
4513                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4514                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4515                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4516                                 .phy_cap_info[0] =
4517                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4518                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4519                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4520                                 .phy_cap_info[1] =
4521                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4522                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4523                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4524                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4525                                 .phy_cap_info[2] = 0,
4526
4527                                 /* Leave all the other PHY capability bytes
4528                                  * unset, as DCM, beam forming, RU and PPE
4529                                  * threshold information are not supported
4530                                  */
4531                         },
4532                         .he_mcs_nss_supp = {
4533                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4534                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4535                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4536                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4537                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4538                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4539                         },
4540                 },
4541         },
4542 #endif
4543 };
4544
4545 static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
4546         {
4547                 /* TODO: should we support other types, e.g., P2P? */
4548                 .types_mask = BIT(NL80211_IFTYPE_STATION),
4549                 .he_6ghz_capa = {
4550                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4551                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4552                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4553                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4554                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4555                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4556                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4557                 },
4558                 .he_cap = {
4559                         .has_he = true,
4560                         .he_cap_elem = {
4561                                 .mac_cap_info[0] =
4562                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4563                                 .mac_cap_info[1] =
4564                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4565                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4566                                 .mac_cap_info[2] =
4567                                         IEEE80211_HE_MAC_CAP2_BSR |
4568                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4569                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4570                                 .mac_cap_info[3] =
4571                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4572                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4573                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4574                                 .phy_cap_info[0] =
4575                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4576                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4577                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4578                                 .phy_cap_info[1] =
4579                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4580                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4581                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4582                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4583                                 .phy_cap_info[2] =
4584                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4585                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4586                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4587                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4588                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4589
4590                                 /* Leave all the other PHY capability bytes
4591                                  * unset, as DCM, beam forming, RU and PPE
4592                                  * threshold information are not supported
4593                                  */
4594                         },
4595                         .he_mcs_nss_supp = {
4596                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4597                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4598                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4599                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4600                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4601                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4602                         },
4603                 },
4604                 .eht_cap = {
4605                         .has_eht = true,
4606                         .eht_cap_elem = {
4607                                 .mac_cap_info[0] =
4608                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4609                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4610                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4611                                 .phy_cap_info[0] =
4612                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4613                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4614                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4615                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4616                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4617                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4618                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4619                                 .phy_cap_info[1] =
4620                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4621                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4622                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4623                                 .phy_cap_info[2] =
4624                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4625                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4626                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4627                                 .phy_cap_info[3] =
4628                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4629                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4630                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4631                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4632                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4633                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4634                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4635                                 .phy_cap_info[4] =
4636                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4637                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4638                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4639                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4640                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4641                                 .phy_cap_info[5] =
4642                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4643                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4644                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4645                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4646                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4647                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4648                                 .phy_cap_info[6] =
4649                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4650                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4651                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4652                                 .phy_cap_info[7] =
4653                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4654                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4655                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4656                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4657                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4658                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4659                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4660                         },
4661
4662                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4663                          * Rx
4664                          */
4665                         .eht_mcs_nss_supp = {
4666                                 /*
4667                                  * As B1 and B2 are set in the supported
4668                                  * channel width set field in the HE PHY
4669                                  * capabilities information field and 320MHz in
4670                                  * 6GHz is supported include all the following
4671                                  * MCS/NSS.
4672                                  */
4673                                 .bw._80 = {
4674                                         .rx_tx_mcs9_max_nss = 0x88,
4675                                         .rx_tx_mcs11_max_nss = 0x88,
4676                                         .rx_tx_mcs13_max_nss = 0x88,
4677                                 },
4678                                 .bw._160 = {
4679                                         .rx_tx_mcs9_max_nss = 0x88,
4680                                         .rx_tx_mcs11_max_nss = 0x88,
4681                                         .rx_tx_mcs13_max_nss = 0x88,
4682                                 },
4683                                 .bw._320 = {
4684                                         .rx_tx_mcs9_max_nss = 0x88,
4685                                         .rx_tx_mcs11_max_nss = 0x88,
4686                                         .rx_tx_mcs13_max_nss = 0x88,
4687                                 },
4688                         },
4689                         /* PPE threshold information is not supported */
4690                 },
4691         },
4692         {
4693                 .types_mask = BIT(NL80211_IFTYPE_AP),
4694                 .he_6ghz_capa = {
4695                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4696                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4697                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4698                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4699                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4700                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4701                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4702                 },
4703                 .he_cap = {
4704                         .has_he = true,
4705                         .he_cap_elem = {
4706                                 .mac_cap_info[0] =
4707                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4708                                 .mac_cap_info[1] =
4709                                         IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4710                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4711                                 .mac_cap_info[2] =
4712                                         IEEE80211_HE_MAC_CAP2_BSR |
4713                                         IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4714                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4715                                 .mac_cap_info[3] =
4716                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4717                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4718                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4719                                 .phy_cap_info[0] =
4720                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4721                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4722                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4723                                 .phy_cap_info[1] =
4724                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4725                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4726                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4727                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4728                                 .phy_cap_info[2] =
4729                                         IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4730                                         IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4731                                         IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4732                                         IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4733                                         IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4734
4735                                 /* Leave all the other PHY capability bytes
4736                                  * unset, as DCM, beam forming, RU and PPE
4737                                  * threshold information are not supported
4738                                  */
4739                         },
4740                         .he_mcs_nss_supp = {
4741                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4742                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4743                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4744                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4745                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4746                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4747                         },
4748                 },
4749                 .eht_cap = {
4750                         .has_eht = true,
4751                         .eht_cap_elem = {
4752                                 .mac_cap_info[0] =
4753                                         IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4754                                         IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4755                                         IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4756                                 .phy_cap_info[0] =
4757                                         IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
4758                                         IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4759                                         IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4760                                         IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4761                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4762                                         IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4763                                         IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4764                                 .phy_cap_info[1] =
4765                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4766                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
4767                                         IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
4768                                 .phy_cap_info[2] =
4769                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4770                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
4771                                         IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
4772                                 .phy_cap_info[3] =
4773                                         IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4774                                         IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4775                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4776                                         IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4777                                         IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4778                                         IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4779                                         IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4780                                 .phy_cap_info[4] =
4781                                         IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4782                                         IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4783                                         IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4784                                         IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4785                                         IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4786                                 .phy_cap_info[5] =
4787                                         IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4788                                         IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4789                                         IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4790                                         IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4791                                         IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4792                                         IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4793                                 .phy_cap_info[6] =
4794                                         IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4795                                         IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
4796                                         IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
4797                                 .phy_cap_info[7] =
4798                                         IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4799                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4800                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4801                                         IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
4802                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4803                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
4804                                         IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
4805                         },
4806
4807                         /* For all MCS and bandwidth, set 8 NSS for both Tx and
4808                          * Rx
4809                          */
4810                         .eht_mcs_nss_supp = {
4811                                 /*
4812                                  * As B1 and B2 are set in the supported
4813                                  * channel width set field in the HE PHY
4814                                  * capabilities information field and 320MHz in
4815                                  * 6GHz is supported include all the following
4816                                  * MCS/NSS.
4817                                  */
4818                                 .bw._80 = {
4819                                         .rx_tx_mcs9_max_nss = 0x88,
4820                                         .rx_tx_mcs11_max_nss = 0x88,
4821                                         .rx_tx_mcs13_max_nss = 0x88,
4822                                 },
4823                                 .bw._160 = {
4824                                         .rx_tx_mcs9_max_nss = 0x88,
4825                                         .rx_tx_mcs11_max_nss = 0x88,
4826                                         .rx_tx_mcs13_max_nss = 0x88,
4827                                 },
4828                                 .bw._320 = {
4829                                         .rx_tx_mcs9_max_nss = 0x88,
4830                                         .rx_tx_mcs11_max_nss = 0x88,
4831                                         .rx_tx_mcs13_max_nss = 0x88,
4832                                 },
4833                         },
4834                         /* PPE threshold information is not supported */
4835                 },
4836         },
4837 #ifdef CONFIG_MAC80211_MESH
4838         {
4839                 /* TODO: should we support other types, e.g., IBSS?*/
4840                 .types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4841                 .he_6ghz_capa = {
4842                         .capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
4843                                             IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
4844                                             IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
4845                                             IEEE80211_HE_6GHZ_CAP_SM_PS |
4846                                             IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
4847                                             IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
4848                                             IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
4849                 },
4850                 .he_cap = {
4851                         .has_he = true,
4852                         .he_cap_elem = {
4853                                 .mac_cap_info[0] =
4854                                         IEEE80211_HE_MAC_CAP0_HTC_HE,
4855                                 .mac_cap_info[1] =
4856                                         IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4857                                 .mac_cap_info[2] =
4858                                         IEEE80211_HE_MAC_CAP2_ACK_EN,
4859                                 .mac_cap_info[3] =
4860                                         IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4861                                         IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4862                                 .mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4863                                 .phy_cap_info[0] =
4864                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4865                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4866                                         IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4867                                 .phy_cap_info[1] =
4868                                         IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4869                                         IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4870                                         IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4871                                         IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4872                                 .phy_cap_info[2] = 0,
4873
4874                                 /* Leave all the other PHY capability bytes
4875                                  * unset, as DCM, beam forming, RU and PPE
4876                                  * threshold information are not supported
4877                                  */
4878                         },
4879                         .he_mcs_nss_supp = {
4880                                 .rx_mcs_80 = cpu_to_le16(0xfffa),
4881                                 .tx_mcs_80 = cpu_to_le16(0xfffa),
4882                                 .rx_mcs_160 = cpu_to_le16(0xfffa),
4883                                 .tx_mcs_160 = cpu_to_le16(0xfffa),
4884                                 .rx_mcs_80p80 = cpu_to_le16(0xfffa),
4885                                 .tx_mcs_80p80 = cpu_to_le16(0xfffa),
4886                         },
4887                 },
4888         },
4889 #endif
4890 };
4891
4892 static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
4893 {
4894         u16 n_iftype_data;
4895
4896         if (sband->band == NL80211_BAND_2GHZ) {
4897                 n_iftype_data = ARRAY_SIZE(sband_capa_2ghz);
4898                 sband->iftype_data =
4899                         (struct ieee80211_sband_iftype_data *)sband_capa_2ghz;
4900         } else if (sband->band == NL80211_BAND_5GHZ) {
4901                 n_iftype_data = ARRAY_SIZE(sband_capa_5ghz);
4902                 sband->iftype_data =
4903                         (struct ieee80211_sband_iftype_data *)sband_capa_5ghz;
4904         } else if (sband->band == NL80211_BAND_6GHZ) {
4905                 n_iftype_data = ARRAY_SIZE(sband_capa_6ghz);
4906                 sband->iftype_data =
4907                         (struct ieee80211_sband_iftype_data *)sband_capa_6ghz;
4908         } else {
4909                 return;
4910         }
4911
4912         sband->n_iftype_data = n_iftype_data;
4913 }
4914
4915 #ifdef CONFIG_MAC80211_MESH
4916 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
4917 #else
4918 #define HWSIM_MESH_BIT 0
4919 #endif
4920
4921 #define HWSIM_DEFAULT_IF_LIMIT \
4922         (BIT(NL80211_IFTYPE_STATION) | \
4923          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4924          BIT(NL80211_IFTYPE_AP) | \
4925          BIT(NL80211_IFTYPE_P2P_GO) | \
4926          HWSIM_MESH_BIT)
4927
4928 #define HWSIM_IFTYPE_SUPPORT_MASK \
4929         (BIT(NL80211_IFTYPE_STATION) | \
4930          BIT(NL80211_IFTYPE_AP) | \
4931          BIT(NL80211_IFTYPE_P2P_CLIENT) | \
4932          BIT(NL80211_IFTYPE_P2P_GO) | \
4933          BIT(NL80211_IFTYPE_ADHOC) | \
4934          BIT(NL80211_IFTYPE_MESH_POINT) | \
4935          BIT(NL80211_IFTYPE_OCB))
4936
4937 static int mac80211_hwsim_new_radio(struct genl_info *info,
4938                                     struct hwsim_new_radio_params *param)
4939 {
4940         int err;
4941         u8 addr[ETH_ALEN];
4942         struct mac80211_hwsim_data *data;
4943         struct ieee80211_hw *hw;
4944         enum nl80211_band band;
4945         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
4946         struct net *net;
4947         int idx, i;
4948         int n_limits = 0;
4949
4950         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
4951                 return -EINVAL;
4952
4953         spin_lock_bh(&hwsim_radio_lock);
4954         idx = hwsim_radio_idx++;
4955         spin_unlock_bh(&hwsim_radio_lock);
4956
4957         if (param->mlo)
4958                 ops = &mac80211_hwsim_mlo_ops;
4959         else if (param->use_chanctx)
4960                 ops = &mac80211_hwsim_mchan_ops;
4961         hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
4962         if (!hw) {
4963                 pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
4964                 err = -ENOMEM;
4965                 goto failed;
4966         }
4967
4968         /* ieee80211_alloc_hw_nm may have used a default name */
4969         param->hwname = wiphy_name(hw->wiphy);
4970
4971         if (info)
4972                 net = genl_info_net(info);
4973         else
4974                 net = &init_net;
4975         wiphy_net_set(hw->wiphy, net);
4976
4977         data = hw->priv;
4978         data->hw = hw;
4979
4980         data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
4981         if (IS_ERR(data->dev)) {
4982                 printk(KERN_DEBUG
4983                        "mac80211_hwsim: device_create failed (%ld)\n",
4984                        PTR_ERR(data->dev));
4985                 err = -ENOMEM;
4986                 goto failed_drvdata;
4987         }
4988         data->dev->driver = &mac80211_hwsim_driver.driver;
4989         err = device_bind_driver(data->dev);
4990         if (err != 0) {
4991                 pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
4992                        err);
4993                 goto failed_bind;
4994         }
4995
4996         skb_queue_head_init(&data->pending);
4997
4998         SET_IEEE80211_DEV(hw, data->dev);
4999         if (!param->perm_addr) {
5000                 eth_zero_addr(addr);
5001                 addr[0] = 0x02;
5002                 addr[3] = idx >> 8;
5003                 addr[4] = idx;
5004                 memcpy(data->addresses[0].addr, addr, ETH_ALEN);
5005                 /* Why need here second address ? */
5006                 memcpy(data->addresses[1].addr, addr, ETH_ALEN);
5007                 data->addresses[1].addr[0] |= 0x40;
5008                 hw->wiphy->n_addresses = 2;
5009                 hw->wiphy->addresses = data->addresses;
5010                 /* possible address clash is checked at hash table insertion */
5011         } else {
5012                 memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
5013                 /* compatibility with automatically generated mac addr */
5014                 memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
5015                 hw->wiphy->n_addresses = 2;
5016                 hw->wiphy->addresses = data->addresses;
5017         }
5018
5019         data->channels = param->channels;
5020         data->use_chanctx = param->use_chanctx;
5021         data->idx = idx;
5022         data->destroy_on_close = param->destroy_on_close;
5023         if (info)
5024                 data->portid = info->snd_portid;
5025
5026         /* setup interface limits, only on interface types we support */
5027         if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
5028                 data->if_limits[n_limits].max = 1;
5029                 data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
5030                 n_limits++;
5031         }
5032
5033         if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
5034                 data->if_limits[n_limits].max = 2048;
5035                 /*
5036                  * For this case, we may only support a subset of
5037                  * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
5038                  * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
5039                  */
5040                 data->if_limits[n_limits].types =
5041                                         HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
5042                 n_limits++;
5043         }
5044
5045         if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5046                 data->if_limits[n_limits].max = 1;
5047                 data->if_limits[n_limits].types =
5048                                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
5049                 n_limits++;
5050         }
5051
5052         if (data->use_chanctx) {
5053                 hw->wiphy->max_scan_ssids = 255;
5054                 hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
5055                 hw->wiphy->max_remain_on_channel_duration = 1000;
5056                 data->if_combination.radar_detect_widths = 0;
5057                 data->if_combination.num_different_channels = data->channels;
5058         } else {
5059                 data->if_combination.num_different_channels = 1;
5060                 data->if_combination.radar_detect_widths =
5061                                         BIT(NL80211_CHAN_WIDTH_5) |
5062                                         BIT(NL80211_CHAN_WIDTH_10) |
5063                                         BIT(NL80211_CHAN_WIDTH_20_NOHT) |
5064                                         BIT(NL80211_CHAN_WIDTH_20) |
5065                                         BIT(NL80211_CHAN_WIDTH_40) |
5066                                         BIT(NL80211_CHAN_WIDTH_80) |
5067                                         BIT(NL80211_CHAN_WIDTH_160);
5068         }
5069
5070         if (!n_limits) {
5071                 err = -EINVAL;
5072                 goto failed_hw;
5073         }
5074
5075         data->if_combination.max_interfaces = 0;
5076         for (i = 0; i < n_limits; i++)
5077                 data->if_combination.max_interfaces +=
5078                         data->if_limits[i].max;
5079
5080         data->if_combination.n_limits = n_limits;
5081         data->if_combination.limits = data->if_limits;
5082
5083         /*
5084          * If we actually were asked to support combinations,
5085          * advertise them - if there's only a single thing like
5086          * only IBSS then don't advertise it as combinations.
5087          */
5088         if (data->if_combination.max_interfaces > 1) {
5089                 hw->wiphy->iface_combinations = &data->if_combination;
5090                 hw->wiphy->n_iface_combinations = 1;
5091         }
5092
5093         if (param->ciphers) {
5094                 memcpy(data->ciphers, param->ciphers,
5095                        param->n_ciphers * sizeof(u32));
5096                 hw->wiphy->cipher_suites = data->ciphers;
5097                 hw->wiphy->n_cipher_suites = param->n_ciphers;
5098         }
5099
5100         hw->wiphy->mbssid_max_interfaces = 8;
5101         hw->wiphy->ema_max_profile_periodicity = 3;
5102
5103         data->rx_rssi = DEFAULT_RX_RSSI;
5104
5105         INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
5106         INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
5107         INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
5108
5109         hw->queues = 5;
5110         hw->offchannel_tx_hw_queue = 4;
5111
5112         ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
5113         ieee80211_hw_set(hw, CHANCTX_STA_CSA);
5114         ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
5115         ieee80211_hw_set(hw, QUEUE_CONTROL);
5116         ieee80211_hw_set(hw, WANT_MONITOR_VIF);
5117         ieee80211_hw_set(hw, AMPDU_AGGREGATION);
5118         ieee80211_hw_set(hw, MFP_CAPABLE);
5119         ieee80211_hw_set(hw, SIGNAL_DBM);
5120         ieee80211_hw_set(hw, SUPPORTS_PS);
5121         ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
5122         ieee80211_hw_set(hw, TDLS_WIDER_BW);
5123         ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
5124
5125         if (param->mlo) {
5126                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
5127                 ieee80211_hw_set(hw, HAS_RATE_CONTROL);
5128                 ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
5129                 ieee80211_hw_set(hw, CONNECTION_MONITOR);
5130                 ieee80211_hw_set(hw, AP_LINK_PS);
5131         } else {
5132                 ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
5133                 ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
5134                 if (rctbl)
5135                         ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
5136         }
5137
5138         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
5139         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
5140                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
5141                             WIPHY_FLAG_AP_UAPSD |
5142                             WIPHY_FLAG_SUPPORTS_5_10_MHZ |
5143                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
5144         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
5145                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
5146                                NL80211_FEATURE_STATIC_SMPS |
5147                                NL80211_FEATURE_DYNAMIC_SMPS |
5148                                NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
5149         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
5150         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
5151         wiphy_ext_feature_set(hw->wiphy,
5152                               NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
5153         wiphy_ext_feature_set(hw->wiphy,
5154                               NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
5155         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
5156
5157         wiphy_ext_feature_set(hw->wiphy,
5158                               NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT);
5159
5160         hw->wiphy->interface_modes = param->iftypes;
5161
5162         /* ask mac80211 to reserve space for magic */
5163         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
5164         hw->sta_data_size = sizeof(struct hwsim_sta_priv);
5165         hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
5166
5167         memcpy(data->channels_2ghz, hwsim_channels_2ghz,
5168                 sizeof(hwsim_channels_2ghz));
5169         memcpy(data->channels_5ghz, hwsim_channels_5ghz,
5170                 sizeof(hwsim_channels_5ghz));
5171         memcpy(data->channels_6ghz, hwsim_channels_6ghz,
5172                 sizeof(hwsim_channels_6ghz));
5173         memcpy(data->channels_s1g, hwsim_channels_s1g,
5174                sizeof(hwsim_channels_s1g));
5175         memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
5176
5177         for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
5178                 struct ieee80211_supported_band *sband = &data->bands[band];
5179
5180                 sband->band = band;
5181
5182                 switch (band) {
5183                 case NL80211_BAND_2GHZ:
5184                         sband->channels = data->channels_2ghz;
5185                         sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
5186                         sband->bitrates = data->rates;
5187                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
5188                         break;
5189                 case NL80211_BAND_5GHZ:
5190                         sband->channels = data->channels_5ghz;
5191                         sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
5192                         sband->bitrates = data->rates + 4;
5193                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5194
5195                         sband->vht_cap.vht_supported = true;
5196                         sband->vht_cap.cap =
5197                                 IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
5198                                 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
5199                                 IEEE80211_VHT_CAP_RXLDPC |
5200                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
5201                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
5202                                 IEEE80211_VHT_CAP_TXSTBC |
5203                                 IEEE80211_VHT_CAP_RXSTBC_4 |
5204                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
5205                         sband->vht_cap.vht_mcs.rx_mcs_map =
5206                                 cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
5207                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
5208                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
5209                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |
5210                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |
5211                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
5212                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
5213                                             IEEE80211_VHT_MCS_SUPPORT_0_9 << 14);
5214                         sband->vht_cap.vht_mcs.tx_mcs_map =
5215                                 sband->vht_cap.vht_mcs.rx_mcs_map;
5216                         break;
5217                 case NL80211_BAND_6GHZ:
5218                         sband->channels = data->channels_6ghz;
5219                         sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
5220                         sband->bitrates = data->rates + 4;
5221                         sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
5222                         break;
5223                 case NL80211_BAND_S1GHZ:
5224                         memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
5225                                sizeof(sband->s1g_cap));
5226                         sband->channels = data->channels_s1g;
5227                         sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
5228                         break;
5229                 default:
5230                         continue;
5231                 }
5232
5233                 if (band != NL80211_BAND_6GHZ){
5234                         sband->ht_cap.ht_supported = true;
5235                         sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
5236                                             IEEE80211_HT_CAP_GRN_FLD |
5237                                             IEEE80211_HT_CAP_SGI_20 |
5238                                             IEEE80211_HT_CAP_SGI_40 |
5239                                             IEEE80211_HT_CAP_DSSSCCK40;
5240                         sband->ht_cap.ampdu_factor = 0x3;
5241                         sband->ht_cap.ampdu_density = 0x6;
5242                         memset(&sband->ht_cap.mcs, 0,
5243                                sizeof(sband->ht_cap.mcs));
5244                         sband->ht_cap.mcs.rx_mask[0] = 0xff;
5245                         sband->ht_cap.mcs.rx_mask[1] = 0xff;
5246                         sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5247                 }
5248
5249                 mac80211_hwsim_sband_capab(sband);
5250
5251                 hw->wiphy->bands[band] = sband;
5252         }
5253
5254         /* By default all radios belong to the first group */
5255         data->group = 1;
5256         mutex_init(&data->mutex);
5257
5258         data->netgroup = hwsim_net_get_netgroup(net);
5259         data->wmediumd = hwsim_net_get_wmediumd(net);
5260
5261         /* Enable frame retransmissions for lossy channels */
5262         hw->max_rates = 4;
5263         hw->max_rate_tries = 11;
5264
5265         hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
5266         hw->wiphy->n_vendor_commands =
5267                 ARRAY_SIZE(mac80211_hwsim_vendor_commands);
5268         hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
5269         hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
5270
5271         if (param->reg_strict)
5272                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
5273         if (param->regd) {
5274                 data->regd = param->regd;
5275                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
5276                 wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
5277                 /* give the regulatory workqueue a chance to run */
5278                 schedule_timeout_interruptible(1);
5279         }
5280
5281         if (param->no_vif)
5282                 ieee80211_hw_set(hw, NO_AUTO_VIF);
5283
5284         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
5285
5286         for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
5287                 hrtimer_init(&data->link_data[i].beacon_timer, CLOCK_MONOTONIC,
5288                              HRTIMER_MODE_ABS_SOFT);
5289                 data->link_data[i].beacon_timer.function =
5290                         mac80211_hwsim_beacon;
5291                 data->link_data[i].link_id = i;
5292         }
5293
5294         err = ieee80211_register_hw(hw);
5295         if (err < 0) {
5296                 pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
5297                        err);
5298                 goto failed_hw;
5299         }
5300
5301         wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
5302
5303         if (param->reg_alpha2) {
5304                 data->alpha2[0] = param->reg_alpha2[0];
5305                 data->alpha2[1] = param->reg_alpha2[1];
5306                 regulatory_hint(hw->wiphy, param->reg_alpha2);
5307         }
5308
5309         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
5310         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
5311         debugfs_create_file("group", 0666, data->debugfs, data,
5312                             &hwsim_fops_group);
5313         debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
5314                             &hwsim_fops_rx_rssi);
5315         if (!data->use_chanctx)
5316                 debugfs_create_file("dfs_simulate_radar", 0222,
5317                                     data->debugfs,
5318                                     data, &hwsim_simulate_radar);
5319
5320         if (param->pmsr_capa) {
5321                 data->pmsr_capa = *param->pmsr_capa;
5322                 hw->wiphy->pmsr_capa = &data->pmsr_capa;
5323         }
5324
5325         spin_lock_bh(&hwsim_radio_lock);
5326         err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
5327                                      hwsim_rht_params);
5328         if (err < 0) {
5329                 if (info) {
5330                         GENL_SET_ERR_MSG(info, "perm addr already present");
5331                         NL_SET_BAD_ATTR(info->extack,
5332                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
5333                 }
5334                 spin_unlock_bh(&hwsim_radio_lock);
5335                 goto failed_final_insert;
5336         }
5337
5338         list_add_tail(&data->list, &hwsim_radios);
5339         hwsim_radios_generation++;
5340         spin_unlock_bh(&hwsim_radio_lock);
5341
5342         hwsim_mcast_new_radio(idx, info, param);
5343
5344         return idx;
5345
5346 failed_final_insert:
5347         debugfs_remove_recursive(data->debugfs);
5348         ieee80211_unregister_hw(data->hw);
5349 failed_hw:
5350         device_release_driver(data->dev);
5351 failed_bind:
5352         device_unregister(data->dev);
5353 failed_drvdata:
5354         ieee80211_free_hw(hw);
5355 failed:
5356         return err;
5357 }
5358
5359 static void hwsim_mcast_del_radio(int id, const char *hwname,
5360                                   struct genl_info *info)
5361 {
5362         struct sk_buff *skb;
5363         void *data;
5364         int ret;
5365
5366         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
5367         if (!skb)
5368                 return;
5369
5370         data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
5371                            HWSIM_CMD_DEL_RADIO);
5372         if (!data)
5373                 goto error;
5374
5375         ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
5376         if (ret < 0)
5377                 goto error;
5378
5379         ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
5380                       hwname);
5381         if (ret < 0)
5382                 goto error;
5383
5384         genlmsg_end(skb, data);
5385
5386         hwsim_mcast_config_msg(skb, info);
5387
5388         return;
5389
5390 error:
5391         nlmsg_free(skb);
5392 }
5393
5394 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
5395                                      const char *hwname,
5396                                      struct genl_info *info)
5397 {
5398         hwsim_mcast_del_radio(data->idx, hwname, info);
5399         debugfs_remove_recursive(data->debugfs);
5400         ieee80211_unregister_hw(data->hw);
5401         device_release_driver(data->dev);
5402         device_unregister(data->dev);
5403         ieee80211_free_hw(data->hw);
5404 }
5405
5406 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
5407                                     struct mac80211_hwsim_data *data,
5408                                     u32 portid, u32 seq,
5409                                     struct netlink_callback *cb, int flags)
5410 {
5411         void *hdr;
5412         struct hwsim_new_radio_params param = { };
5413         int res = -EMSGSIZE;
5414
5415         hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
5416                           HWSIM_CMD_GET_RADIO);
5417         if (!hdr)
5418                 return -EMSGSIZE;
5419
5420         if (cb)
5421                 genl_dump_check_consistent(cb, hdr);
5422
5423         if (data->alpha2[0] && data->alpha2[1])
5424                 param.reg_alpha2 = data->alpha2;
5425
5426         param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
5427                                         REGULATORY_STRICT_REG);
5428         param.p2p_device = !!(data->hw->wiphy->interface_modes &
5429                                         BIT(NL80211_IFTYPE_P2P_DEVICE));
5430         param.use_chanctx = data->use_chanctx;
5431         param.regd = data->regd;
5432         param.channels = data->channels;
5433         param.hwname = wiphy_name(data->hw->wiphy);
5434         param.pmsr_capa = &data->pmsr_capa;
5435
5436         res = append_radio_msg(skb, data->idx, &param);
5437         if (res < 0)
5438                 goto out_err;
5439
5440         genlmsg_end(skb, hdr);
5441         return 0;
5442
5443 out_err:
5444         genlmsg_cancel(skb, hdr);
5445         return res;
5446 }
5447
5448 static void mac80211_hwsim_free(void)
5449 {
5450         struct mac80211_hwsim_data *data;
5451
5452         spin_lock_bh(&hwsim_radio_lock);
5453         while ((data = list_first_entry_or_null(&hwsim_radios,
5454                                                 struct mac80211_hwsim_data,
5455                                                 list))) {
5456                 list_del(&data->list);
5457                 spin_unlock_bh(&hwsim_radio_lock);
5458                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
5459                                          NULL);
5460                 spin_lock_bh(&hwsim_radio_lock);
5461         }
5462         spin_unlock_bh(&hwsim_radio_lock);
5463         class_destroy(hwsim_class);
5464 }
5465
5466 static const struct net_device_ops hwsim_netdev_ops = {
5467         .ndo_start_xmit         = hwsim_mon_xmit,
5468         .ndo_set_mac_address    = eth_mac_addr,
5469         .ndo_validate_addr      = eth_validate_addr,
5470 };
5471
5472 static void hwsim_mon_setup(struct net_device *dev)
5473 {
5474         u8 addr[ETH_ALEN];
5475
5476         dev->netdev_ops = &hwsim_netdev_ops;
5477         dev->needs_free_netdev = true;
5478         ether_setup(dev);
5479         dev->priv_flags |= IFF_NO_QUEUE;
5480         dev->type = ARPHRD_IEEE80211_RADIOTAP;
5481         eth_zero_addr(addr);
5482         addr[0] = 0x12;
5483         eth_hw_addr_set(dev, addr);
5484 }
5485
5486 static void hwsim_register_wmediumd(struct net *net, u32 portid)
5487 {
5488         struct mac80211_hwsim_data *data;
5489
5490         hwsim_net_set_wmediumd(net, portid);
5491
5492         spin_lock_bh(&hwsim_radio_lock);
5493         list_for_each_entry(data, &hwsim_radios, list) {
5494                 if (data->netgroup == hwsim_net_get_netgroup(net))
5495                         data->wmediumd = portid;
5496         }
5497         spin_unlock_bh(&hwsim_radio_lock);
5498 }
5499
5500 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
5501                                            struct genl_info *info)
5502 {
5503
5504         struct ieee80211_hdr *hdr;
5505         struct mac80211_hwsim_data *data2;
5506         struct ieee80211_tx_info *txi;
5507         struct hwsim_tx_rate *tx_attempts;
5508         u64 ret_skb_cookie;
5509         struct sk_buff *skb, *tmp;
5510         const u8 *src;
5511         unsigned int hwsim_flags;
5512         int i;
5513         unsigned long flags;
5514         bool found = false;
5515
5516         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
5517             !info->attrs[HWSIM_ATTR_FLAGS] ||
5518             !info->attrs[HWSIM_ATTR_COOKIE] ||
5519             !info->attrs[HWSIM_ATTR_SIGNAL] ||
5520             !info->attrs[HWSIM_ATTR_TX_INFO])
5521                 goto out;
5522
5523         src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
5524         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
5525         ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
5526
5527         data2 = get_hwsim_data_ref_from_addr(src);
5528         if (!data2)
5529                 goto out;
5530
5531         if (!hwsim_virtio_enabled) {
5532                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
5533                     data2->netgroup)
5534                         goto out;
5535
5536                 if (info->snd_portid != data2->wmediumd)
5537                         goto out;
5538         }
5539
5540         /* look for the skb matching the cookie passed back from user */
5541         spin_lock_irqsave(&data2->pending.lock, flags);
5542         skb_queue_walk_safe(&data2->pending, skb, tmp) {
5543                 uintptr_t skb_cookie;
5544
5545                 txi = IEEE80211_SKB_CB(skb);
5546                 skb_cookie = (uintptr_t)txi->rate_driver_data[0];
5547
5548                 if (skb_cookie == ret_skb_cookie) {
5549                         __skb_unlink(skb, &data2->pending);
5550                         found = true;
5551                         break;
5552                 }
5553         }
5554         spin_unlock_irqrestore(&data2->pending.lock, flags);
5555
5556         /* not found */
5557         if (!found)
5558                 goto out;
5559
5560         /* Tx info received because the frame was broadcasted on user space,
5561          so we get all the necessary info: tx attempts and skb control buff */
5562
5563         tx_attempts = (struct hwsim_tx_rate *)nla_data(
5564                        info->attrs[HWSIM_ATTR_TX_INFO]);
5565
5566         /* now send back TX status */
5567         txi = IEEE80211_SKB_CB(skb);
5568
5569         ieee80211_tx_info_clear_status(txi);
5570
5571         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
5572                 txi->status.rates[i].idx = tx_attempts[i].idx;
5573                 txi->status.rates[i].count = tx_attempts[i].count;
5574         }
5575
5576         txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
5577
5578         if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
5579            (hwsim_flags & HWSIM_TX_STAT_ACK)) {
5580                 if (skb->len >= 16) {
5581                         hdr = (struct ieee80211_hdr *) skb->data;
5582                         mac80211_hwsim_monitor_ack(data2->channel,
5583                                                    hdr->addr2);
5584                 }
5585                 txi->flags |= IEEE80211_TX_STAT_ACK;
5586         }
5587
5588         if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
5589                 txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
5590
5591         ieee80211_tx_status_irqsafe(data2->hw, skb);
5592         return 0;
5593 out:
5594         return -EINVAL;
5595
5596 }
5597
5598 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
5599                                           struct genl_info *info)
5600 {
5601         struct mac80211_hwsim_data *data2;
5602         struct ieee80211_rx_status rx_status;
5603         struct ieee80211_hdr *hdr;
5604         const u8 *dst;
5605         int frame_data_len;
5606         void *frame_data;
5607         struct sk_buff *skb = NULL;
5608         struct ieee80211_channel *channel = NULL;
5609
5610         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
5611             !info->attrs[HWSIM_ATTR_FRAME] ||
5612             !info->attrs[HWSIM_ATTR_RX_RATE] ||
5613             !info->attrs[HWSIM_ATTR_SIGNAL])
5614                 goto out;
5615
5616         dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
5617         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
5618         frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
5619
5620         /* Allocate new skb here */
5621         skb = alloc_skb(frame_data_len, GFP_KERNEL);
5622         if (skb == NULL)
5623                 goto err;
5624
5625         if (frame_data_len > IEEE80211_MAX_DATA_LEN)
5626                 goto err;
5627
5628         /* Copy the data */
5629         skb_put_data(skb, frame_data, frame_data_len);
5630
5631         data2 = get_hwsim_data_ref_from_addr(dst);
5632         if (!data2)
5633                 goto out;
5634
5635         if (data2->use_chanctx) {
5636                 if (data2->tmp_chan)
5637                         channel = data2->tmp_chan;
5638         } else {
5639                 channel = data2->channel;
5640         }
5641
5642         if (!hwsim_virtio_enabled) {
5643                 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
5644                     data2->netgroup)
5645                         goto out;
5646
5647                 if (info->snd_portid != data2->wmediumd)
5648                         goto out;
5649         }
5650
5651         /* check if radio is configured properly */
5652
5653         if ((data2->idle && !data2->tmp_chan) || !data2->started)
5654                 goto out;
5655
5656         /* A frame is received from user space */
5657         memset(&rx_status, 0, sizeof(rx_status));
5658         if (info->attrs[HWSIM_ATTR_FREQ]) {
5659                 struct tx_iter_data iter_data = {};
5660
5661                 /* throw away off-channel packets, but allow both the temporary
5662                  * ("hw" scan/remain-on-channel), regular channels and links,
5663                  * since the internal datapath also allows this
5664                  */
5665                 rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
5666
5667                 iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
5668                                                           rx_status.freq);
5669                 if (!iter_data.channel)
5670                         goto out;
5671                 rx_status.band = iter_data.channel->band;
5672
5673                 mutex_lock(&data2->mutex);
5674                 if (!hwsim_chans_compat(iter_data.channel, channel)) {
5675                         ieee80211_iterate_active_interfaces_atomic(
5676                                 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
5677                                 mac80211_hwsim_tx_iter, &iter_data);
5678                         if (!iter_data.receive) {
5679                                 mutex_unlock(&data2->mutex);
5680                                 goto out;
5681                         }
5682                 }
5683                 mutex_unlock(&data2->mutex);
5684         } else if (!channel) {
5685                 goto out;
5686         } else {
5687                 rx_status.freq = channel->center_freq;
5688                 rx_status.band = channel->band;
5689         }
5690
5691         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
5692         if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
5693                 goto out;
5694         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
5695
5696         hdr = (void *)skb->data;
5697
5698         if (ieee80211_is_beacon(hdr->frame_control) ||
5699             ieee80211_is_probe_resp(hdr->frame_control))
5700                 rx_status.boottime_ns = ktime_get_boottime_ns();
5701
5702         mac80211_hwsim_rx(data2, &rx_status, skb);
5703
5704         return 0;
5705 err:
5706         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
5707 out:
5708         dev_kfree_skb(skb);
5709         return -EINVAL;
5710 }
5711
5712 static int hwsim_register_received_nl(struct sk_buff *skb_2,
5713                                       struct genl_info *info)
5714 {
5715         struct net *net = genl_info_net(info);
5716         struct mac80211_hwsim_data *data;
5717         int chans = 1;
5718
5719         spin_lock_bh(&hwsim_radio_lock);
5720         list_for_each_entry(data, &hwsim_radios, list)
5721                 chans = max(chans, data->channels);
5722         spin_unlock_bh(&hwsim_radio_lock);
5723
5724         /* In the future we should revise the userspace API and allow it
5725          * to set a flag that it does support multi-channel, then we can
5726          * let this pass conditionally on the flag.
5727          * For current userspace, prohibit it since it won't work right.
5728          */
5729         if (chans > 1)
5730                 return -EOPNOTSUPP;
5731
5732         if (hwsim_net_get_wmediumd(net))
5733                 return -EBUSY;
5734
5735         hwsim_register_wmediumd(net, info->snd_portid);
5736
5737         pr_debug("mac80211_hwsim: received a REGISTER, "
5738                "switching to wmediumd mode with pid %d\n", info->snd_portid);
5739
5740         return 0;
5741 }
5742
5743 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
5744 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
5745 {
5746         int i;
5747
5748         for (i = 0; i < n_ciphers; i++) {
5749                 int j;
5750                 int found = 0;
5751
5752                 for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
5753                         if (ciphers[i] == hwsim_ciphers[j]) {
5754                                 found = 1;
5755                                 break;
5756                         }
5757                 }
5758
5759                 if (!found)
5760                         return false;
5761         }
5762
5763         return true;
5764 }
5765
5766 static int parse_ftm_capa(const struct nlattr *ftm_capa, struct cfg80211_pmsr_capabilities *out,
5767                           struct genl_info *info)
5768 {
5769         struct nlattr *tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
5770         int ret;
5771
5772         ret = nla_parse_nested(tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX, ftm_capa, hwsim_ftm_capa_policy,
5773                                NULL);
5774         if (ret) {
5775                 NL_SET_ERR_MSG_ATTR(info->extack, ftm_capa, "malformed FTM capability");
5776                 return -EINVAL;
5777         }
5778
5779         out->ftm.supported = 1;
5780         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES])
5781                 out->ftm.preambles = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]);
5782         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS])
5783                 out->ftm.bandwidths = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]);
5784         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT])
5785                 out->ftm.max_bursts_exponent =
5786                         nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT]);
5787         if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST])
5788                 out->ftm.max_ftms_per_burst =
5789                         nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST]);
5790         out->ftm.asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_ASAP];
5791         out->ftm.non_asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP];
5792         out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI];
5793         out->ftm.request_civicloc = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC];
5794         out->ftm.trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED];
5795         out->ftm.non_trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED];
5796
5797         return 0;
5798 }
5799
5800 static int parse_pmsr_capa(const struct nlattr *pmsr_capa, struct cfg80211_pmsr_capabilities *out,
5801                            struct genl_info *info)
5802 {
5803         struct nlattr *tb[NL80211_PMSR_ATTR_MAX + 1];
5804         struct nlattr *nla;
5805         int size;
5806         int ret;
5807
5808         ret = nla_parse_nested(tb, NL80211_PMSR_ATTR_MAX, pmsr_capa, hwsim_pmsr_capa_policy, NULL);
5809         if (ret) {
5810                 NL_SET_ERR_MSG_ATTR(info->extack, pmsr_capa, "malformed PMSR capability");
5811                 return -EINVAL;
5812         }
5813
5814         if (tb[NL80211_PMSR_ATTR_MAX_PEERS])
5815                 out->max_peers = nla_get_u32(tb[NL80211_PMSR_ATTR_MAX_PEERS]);
5816         out->report_ap_tsf = !!tb[NL80211_PMSR_ATTR_REPORT_AP_TSF];
5817         out->randomize_mac_addr = !!tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR];
5818
5819         if (!tb[NL80211_PMSR_ATTR_TYPE_CAPA]) {
5820                 NL_SET_ERR_MSG_ATTR(info->extack, tb[NL80211_PMSR_ATTR_TYPE_CAPA],
5821                                     "malformed PMSR type");
5822                 return -EINVAL;
5823         }
5824
5825         nla_for_each_nested(nla, tb[NL80211_PMSR_ATTR_TYPE_CAPA], size) {
5826                 switch (nla_type(nla)) {
5827                 case NL80211_PMSR_TYPE_FTM:
5828                         parse_ftm_capa(nla, out, info);
5829                         break;
5830                 default:
5831                         NL_SET_ERR_MSG_ATTR(info->extack, nla, "unsupported measurement type");
5832                         return -EINVAL;
5833                 }
5834         }
5835
5836         return 0;
5837 }
5838
5839 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
5840 {
5841         struct hwsim_new_radio_params param = { 0 };
5842         const char *hwname = NULL;
5843         int ret;
5844
5845         param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
5846         param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
5847         param.channels = channels;
5848         param.destroy_on_close =
5849                 info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
5850
5851         if (info->attrs[HWSIM_ATTR_CHANNELS])
5852                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
5853
5854         if (param.channels < 1) {
5855                 GENL_SET_ERR_MSG(info, "must have at least one channel");
5856                 return -EINVAL;
5857         }
5858
5859         if (info->attrs[HWSIM_ATTR_NO_VIF])
5860                 param.no_vif = true;
5861
5862         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
5863                 param.use_chanctx = true;
5864         else
5865                 param.use_chanctx = (param.channels > 1);
5866
5867         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
5868                 param.reg_alpha2 =
5869                         nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
5870
5871         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
5872                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
5873
5874                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
5875                         return -EINVAL;
5876
5877                 idx = array_index_nospec(idx,
5878                                          ARRAY_SIZE(hwsim_world_regdom_custom));
5879                 param.regd = hwsim_world_regdom_custom[idx];
5880         }
5881
5882         if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
5883                 if (!is_valid_ether_addr(
5884                                 nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
5885                         GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
5886                         NL_SET_BAD_ATTR(info->extack,
5887                                         info->attrs[HWSIM_ATTR_PERM_ADDR]);
5888                         return -EINVAL;
5889                 }
5890
5891                 param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
5892         }
5893
5894         if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
5895                 param.iftypes =
5896                         nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
5897
5898                 if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
5899                         NL_SET_ERR_MSG_ATTR(info->extack,
5900                                             info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
5901                                             "cannot support more iftypes than kernel");
5902                         return -EINVAL;
5903                 }
5904         } else {
5905                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
5906         }
5907
5908         /* ensure both flag and iftype support is honored */
5909         if (param.p2p_device ||
5910             param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5911                 param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
5912                 param.p2p_device = true;
5913         }
5914
5915         if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
5916                 u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5917
5918                 param.ciphers =
5919                         nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
5920
5921                 if (len % sizeof(u32)) {
5922                         NL_SET_ERR_MSG_ATTR(info->extack,
5923                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5924                                             "bad cipher list length");
5925                         return -EINVAL;
5926                 }
5927
5928                 param.n_ciphers = len / sizeof(u32);
5929
5930                 if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
5931                         NL_SET_ERR_MSG_ATTR(info->extack,
5932                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5933                                             "too many ciphers specified");
5934                         return -EINVAL;
5935                 }
5936
5937                 if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
5938                         NL_SET_ERR_MSG_ATTR(info->extack,
5939                                             info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
5940                                             "unsupported ciphers specified");
5941                         return -EINVAL;
5942                 }
5943         }
5944
5945         param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
5946
5947         if (param.mlo)
5948                 param.use_chanctx = true;
5949
5950         if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5951                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5952                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5953                                   GFP_KERNEL);
5954                 if (!hwname)
5955                         return -ENOMEM;
5956                 param.hwname = hwname;
5957         }
5958
5959         if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
5960                 struct cfg80211_pmsr_capabilities *pmsr_capa;
5961
5962                 pmsr_capa = kmalloc(sizeof(*pmsr_capa), GFP_KERNEL);
5963                 if (!pmsr_capa) {
5964                         ret = -ENOMEM;
5965                         goto out_free;
5966                 }
5967                 param.pmsr_capa = pmsr_capa;
5968
5969                 ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info);
5970                 if (ret)
5971                         goto out_free;
5972         }
5973
5974         ret = mac80211_hwsim_new_radio(info, &param);
5975
5976 out_free:
5977         kfree(hwname);
5978         kfree(param.pmsr_capa);
5979         return ret;
5980 }
5981
5982 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
5983 {
5984         struct mac80211_hwsim_data *data;
5985         s64 idx = -1;
5986         const char *hwname = NULL;
5987
5988         if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
5989                 idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
5990         } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
5991                 hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5992                                   nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
5993                                   GFP_KERNEL);
5994                 if (!hwname)
5995                         return -ENOMEM;
5996         } else
5997                 return -EINVAL;
5998
5999         spin_lock_bh(&hwsim_radio_lock);
6000         list_for_each_entry(data, &hwsim_radios, list) {
6001                 if (idx >= 0) {
6002                         if (data->idx != idx)
6003                                 continue;
6004                 } else {
6005                         if (!hwname ||
6006                             strcmp(hwname, wiphy_name(data->hw->wiphy)))
6007                                 continue;
6008                 }
6009
6010                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6011                         continue;
6012
6013                 list_del(&data->list);
6014                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6015                                        hwsim_rht_params);
6016                 hwsim_radios_generation++;
6017                 spin_unlock_bh(&hwsim_radio_lock);
6018                 mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
6019                                          info);
6020                 kfree(hwname);
6021                 return 0;
6022         }
6023         spin_unlock_bh(&hwsim_radio_lock);
6024
6025         kfree(hwname);
6026         return -ENODEV;
6027 }
6028
6029 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
6030 {
6031         struct mac80211_hwsim_data *data;
6032         struct sk_buff *skb;
6033         int idx, res = -ENODEV;
6034
6035         if (!info->attrs[HWSIM_ATTR_RADIO_ID])
6036                 return -EINVAL;
6037         idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
6038
6039         spin_lock_bh(&hwsim_radio_lock);
6040         list_for_each_entry(data, &hwsim_radios, list) {
6041                 if (data->idx != idx)
6042                         continue;
6043
6044                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
6045                         continue;
6046
6047                 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6048                 if (!skb) {
6049                         res = -ENOMEM;
6050                         goto out_err;
6051                 }
6052
6053                 res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
6054                                                info->snd_seq, NULL, 0);
6055                 if (res < 0) {
6056                         nlmsg_free(skb);
6057                         goto out_err;
6058                 }
6059
6060                 res = genlmsg_reply(skb, info);
6061                 break;
6062         }
6063
6064 out_err:
6065         spin_unlock_bh(&hwsim_radio_lock);
6066
6067         return res;
6068 }
6069
6070 static int hwsim_dump_radio_nl(struct sk_buff *skb,
6071                                struct netlink_callback *cb)
6072 {
6073         int last_idx = cb->args[0] - 1;
6074         struct mac80211_hwsim_data *data = NULL;
6075         int res = 0;
6076         void *hdr;
6077
6078         spin_lock_bh(&hwsim_radio_lock);
6079         cb->seq = hwsim_radios_generation;
6080
6081         if (last_idx >= hwsim_radio_idx-1)
6082                 goto done;
6083
6084         list_for_each_entry(data, &hwsim_radios, list) {
6085                 if (data->idx <= last_idx)
6086                         continue;
6087
6088                 if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
6089                         continue;
6090
6091                 res = mac80211_hwsim_get_radio(skb, data,
6092                                                NETLINK_CB(cb->skb).portid,
6093                                                cb->nlh->nlmsg_seq, cb,
6094                                                NLM_F_MULTI);
6095                 if (res < 0)
6096                         break;
6097
6098                 last_idx = data->idx;
6099         }
6100
6101         cb->args[0] = last_idx + 1;
6102
6103         /* list changed, but no new element sent, set interrupted flag */
6104         if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
6105                 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
6106                                   cb->nlh->nlmsg_seq, &hwsim_genl_family,
6107                                   NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
6108                 if (hdr) {
6109                         genl_dump_check_consistent(cb, hdr);
6110                         genlmsg_end(skb, hdr);
6111                 } else {
6112                         res = -EMSGSIZE;
6113                 }
6114         }
6115
6116 done:
6117         spin_unlock_bh(&hwsim_radio_lock);
6118         return res ?: skb->len;
6119 }
6120
6121 /* Generic Netlink operations array */
6122 static const struct genl_small_ops hwsim_ops[] = {
6123         {
6124                 .cmd = HWSIM_CMD_REGISTER,
6125                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6126                 .doit = hwsim_register_received_nl,
6127                 .flags = GENL_UNS_ADMIN_PERM,
6128         },
6129         {
6130                 .cmd = HWSIM_CMD_FRAME,
6131                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6132                 .doit = hwsim_cloned_frame_received_nl,
6133         },
6134         {
6135                 .cmd = HWSIM_CMD_TX_INFO_FRAME,
6136                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6137                 .doit = hwsim_tx_info_frame_received_nl,
6138         },
6139         {
6140                 .cmd = HWSIM_CMD_NEW_RADIO,
6141                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6142                 .doit = hwsim_new_radio_nl,
6143                 .flags = GENL_UNS_ADMIN_PERM,
6144         },
6145         {
6146                 .cmd = HWSIM_CMD_DEL_RADIO,
6147                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6148                 .doit = hwsim_del_radio_nl,
6149                 .flags = GENL_UNS_ADMIN_PERM,
6150         },
6151         {
6152                 .cmd = HWSIM_CMD_GET_RADIO,
6153                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6154                 .doit = hwsim_get_radio_nl,
6155                 .dumpit = hwsim_dump_radio_nl,
6156         },
6157         {
6158                 .cmd = HWSIM_CMD_REPORT_PMSR,
6159                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
6160                 .doit = hwsim_pmsr_report_nl,
6161         },
6162 };
6163
6164 static struct genl_family hwsim_genl_family __ro_after_init = {
6165         .name = "MAC80211_HWSIM",
6166         .version = 1,
6167         .maxattr = HWSIM_ATTR_MAX,
6168         .policy = hwsim_genl_policy,
6169         .netnsok = true,
6170         .module = THIS_MODULE,
6171         .small_ops = hwsim_ops,
6172         .n_small_ops = ARRAY_SIZE(hwsim_ops),
6173         .resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
6174         .mcgrps = hwsim_mcgrps,
6175         .n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
6176 };
6177
6178 static void remove_user_radios(u32 portid)
6179 {
6180         struct mac80211_hwsim_data *entry, *tmp;
6181         LIST_HEAD(list);
6182
6183         spin_lock_bh(&hwsim_radio_lock);
6184         list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
6185                 if (entry->destroy_on_close && entry->portid == portid) {
6186                         list_move(&entry->list, &list);
6187                         rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
6188                                                hwsim_rht_params);
6189                         hwsim_radios_generation++;
6190                 }
6191         }
6192         spin_unlock_bh(&hwsim_radio_lock);
6193
6194         list_for_each_entry_safe(entry, tmp, &list, list) {
6195                 list_del(&entry->list);
6196                 mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
6197                                          NULL);
6198         }
6199 }
6200
6201 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
6202                                          unsigned long state,
6203                                          void *_notify)
6204 {
6205         struct netlink_notify *notify = _notify;
6206
6207         if (state != NETLINK_URELEASE)
6208                 return NOTIFY_DONE;
6209
6210         remove_user_radios(notify->portid);
6211
6212         if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
6213                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
6214                        " socket, switching to perfect channel medium\n");
6215                 hwsim_register_wmediumd(notify->net, 0);
6216         }
6217         return NOTIFY_DONE;
6218
6219 }
6220
6221 static struct notifier_block hwsim_netlink_notifier = {
6222         .notifier_call = mac80211_hwsim_netlink_notify,
6223 };
6224
6225 static int __init hwsim_init_netlink(void)
6226 {
6227         int rc;
6228
6229         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
6230
6231         rc = genl_register_family(&hwsim_genl_family);
6232         if (rc)
6233                 goto failure;
6234
6235         rc = netlink_register_notifier(&hwsim_netlink_notifier);
6236         if (rc) {
6237                 genl_unregister_family(&hwsim_genl_family);
6238                 goto failure;
6239         }
6240
6241         return 0;
6242
6243 failure:
6244         pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
6245         return -EINVAL;
6246 }
6247
6248 static __net_init int hwsim_init_net(struct net *net)
6249 {
6250         return hwsim_net_set_netgroup(net);
6251 }
6252
6253 static void __net_exit hwsim_exit_net(struct net *net)
6254 {
6255         struct mac80211_hwsim_data *data, *tmp;
6256         LIST_HEAD(list);
6257
6258         spin_lock_bh(&hwsim_radio_lock);
6259         list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
6260                 if (!net_eq(wiphy_net(data->hw->wiphy), net))
6261                         continue;
6262
6263                 /* Radios created in init_net are returned to init_net. */
6264                 if (data->netgroup == hwsim_net_get_netgroup(&init_net))
6265                         continue;
6266
6267                 list_move(&data->list, &list);
6268                 rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6269                                        hwsim_rht_params);
6270                 hwsim_radios_generation++;
6271         }
6272         spin_unlock_bh(&hwsim_radio_lock);
6273
6274         list_for_each_entry_safe(data, tmp, &list, list) {
6275                 list_del(&data->list);
6276                 mac80211_hwsim_del_radio(data,
6277                                          wiphy_name(data->hw->wiphy),
6278                                          NULL);
6279         }
6280
6281         ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
6282 }
6283
6284 static struct pernet_operations hwsim_net_ops = {
6285         .init = hwsim_init_net,
6286         .exit = hwsim_exit_net,
6287         .id   = &hwsim_net_id,
6288         .size = sizeof(struct hwsim_net),
6289 };
6290
6291 static void hwsim_exit_netlink(void)
6292 {
6293         /* unregister the notifier */
6294         netlink_unregister_notifier(&hwsim_netlink_notifier);
6295         /* unregister the family */
6296         genl_unregister_family(&hwsim_genl_family);
6297 }
6298
6299 #if IS_REACHABLE(CONFIG_VIRTIO)
6300 static void hwsim_virtio_tx_done(struct virtqueue *vq)
6301 {
6302         unsigned int len;
6303         struct sk_buff *skb;
6304         unsigned long flags;
6305
6306         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6307         while ((skb = virtqueue_get_buf(vq, &len)))
6308                 nlmsg_free(skb);
6309         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6310 }
6311
6312 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
6313 {
6314         struct nlmsghdr *nlh;
6315         struct genlmsghdr *gnlh;
6316         struct nlattr *tb[HWSIM_ATTR_MAX + 1];
6317         struct genl_info info = {};
6318         int err;
6319
6320         nlh = nlmsg_hdr(skb);
6321         gnlh = nlmsg_data(nlh);
6322
6323         if (skb->len < nlh->nlmsg_len)
6324                 return -EINVAL;
6325
6326         err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
6327                             hwsim_genl_policy, NULL);
6328         if (err) {
6329                 pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
6330                 return err;
6331         }
6332
6333         info.attrs = tb;
6334
6335         switch (gnlh->cmd) {
6336         case HWSIM_CMD_FRAME:
6337                 hwsim_cloned_frame_received_nl(skb, &info);
6338                 break;
6339         case HWSIM_CMD_TX_INFO_FRAME:
6340                 hwsim_tx_info_frame_received_nl(skb, &info);
6341                 break;
6342         case HWSIM_CMD_REPORT_PMSR:
6343                 hwsim_pmsr_report_nl(skb, &info);
6344                 break;
6345         default:
6346                 pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
6347                 return -EPROTO;
6348         }
6349         return 0;
6350 }
6351
6352 static void hwsim_virtio_rx_work(struct work_struct *work)
6353 {
6354         struct virtqueue *vq;
6355         unsigned int len;
6356         struct sk_buff *skb;
6357         struct scatterlist sg[1];
6358         int err;
6359         unsigned long flags;
6360
6361         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6362         if (!hwsim_virtio_enabled)
6363                 goto out_unlock;
6364
6365         skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
6366         if (!skb)
6367                 goto out_unlock;
6368         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6369
6370         skb->data = skb->head;
6371         skb_reset_tail_pointer(skb);
6372         skb_put(skb, len);
6373         hwsim_virtio_handle_cmd(skb);
6374
6375         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6376         if (!hwsim_virtio_enabled) {
6377                 nlmsg_free(skb);
6378                 goto out_unlock;
6379         }
6380         vq = hwsim_vqs[HWSIM_VQ_RX];
6381         sg_init_one(sg, skb->head, skb_end_offset(skb));
6382         err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
6383         if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
6384                 nlmsg_free(skb);
6385         else
6386                 virtqueue_kick(vq);
6387         schedule_work(&hwsim_virtio_rx);
6388
6389 out_unlock:
6390         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6391 }
6392
6393 static void hwsim_virtio_rx_done(struct virtqueue *vq)
6394 {
6395         schedule_work(&hwsim_virtio_rx);
6396 }
6397
6398 static int init_vqs(struct virtio_device *vdev)
6399 {
6400         vq_callback_t *callbacks[HWSIM_NUM_VQS] = {
6401                 [HWSIM_VQ_TX] = hwsim_virtio_tx_done,
6402                 [HWSIM_VQ_RX] = hwsim_virtio_rx_done,
6403         };
6404         const char *names[HWSIM_NUM_VQS] = {
6405                 [HWSIM_VQ_TX] = "tx",
6406                 [HWSIM_VQ_RX] = "rx",
6407         };
6408
6409         return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
6410                                hwsim_vqs, callbacks, names, NULL);
6411 }
6412
6413 static int fill_vq(struct virtqueue *vq)
6414 {
6415         int i, err;
6416         struct sk_buff *skb;
6417         struct scatterlist sg[1];
6418
6419         for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
6420                 skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
6421                 if (!skb)
6422                         return -ENOMEM;
6423
6424                 sg_init_one(sg, skb->head, skb_end_offset(skb));
6425                 err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
6426                 if (err) {
6427                         nlmsg_free(skb);
6428                         return err;
6429                 }
6430         }
6431         virtqueue_kick(vq);
6432         return 0;
6433 }
6434
6435 static void remove_vqs(struct virtio_device *vdev)
6436 {
6437         int i;
6438
6439         virtio_reset_device(vdev);
6440
6441         for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
6442                 struct virtqueue *vq = hwsim_vqs[i];
6443                 struct sk_buff *skb;
6444
6445                 while ((skb = virtqueue_detach_unused_buf(vq)))
6446                         nlmsg_free(skb);
6447         }
6448
6449         vdev->config->del_vqs(vdev);
6450 }
6451
6452 static int hwsim_virtio_probe(struct virtio_device *vdev)
6453 {
6454         int err;
6455         unsigned long flags;
6456
6457         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6458         if (hwsim_virtio_enabled) {
6459                 spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6460                 return -EEXIST;
6461         }
6462         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6463
6464         err = init_vqs(vdev);
6465         if (err)
6466                 return err;
6467
6468         virtio_device_ready(vdev);
6469
6470         err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
6471         if (err)
6472                 goto out_remove;
6473
6474         spin_lock_irqsave(&hwsim_virtio_lock, flags);
6475         hwsim_virtio_enabled = true;
6476         spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
6477
6478         schedule_work(&hwsim_virtio_rx);
6479         return 0;
6480
6481 out_remove:
6482         remove_vqs(vdev);
6483         return err;
6484 }
6485
6486 static void hwsim_virtio_remove(struct virtio_device *vdev)
6487 {
6488         hwsim_virtio_enabled = false;
6489
6490         cancel_work_sync(&hwsim_virtio_rx);
6491
6492         remove_vqs(vdev);
6493 }
6494
6495 /* MAC80211_HWSIM virtio device id table */
6496 static const struct virtio_device_id id_table[] = {
6497         { VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
6498         { 0 }
6499 };
6500 MODULE_DEVICE_TABLE(virtio, id_table);
6501
6502 static struct virtio_driver virtio_hwsim = {
6503         .driver.name = KBUILD_MODNAME,
6504         .driver.owner = THIS_MODULE,
6505         .id_table = id_table,
6506         .probe = hwsim_virtio_probe,
6507         .remove = hwsim_virtio_remove,
6508 };
6509
6510 static int hwsim_register_virtio_driver(void)
6511 {
6512         return register_virtio_driver(&virtio_hwsim);
6513 }
6514
6515 static void hwsim_unregister_virtio_driver(void)
6516 {
6517         unregister_virtio_driver(&virtio_hwsim);
6518 }
6519 #else
6520 static inline int hwsim_register_virtio_driver(void)
6521 {
6522         return 0;
6523 }
6524
6525 static inline void hwsim_unregister_virtio_driver(void)
6526 {
6527 }
6528 #endif
6529
6530 static int __init init_mac80211_hwsim(void)
6531 {
6532         int i, err;
6533
6534         if (radios < 0 || radios > 100)
6535                 return -EINVAL;
6536
6537         if (channels < 1)
6538                 return -EINVAL;
6539
6540         err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
6541         if (err)
6542                 return err;
6543
6544         err = register_pernet_device(&hwsim_net_ops);
6545         if (err)
6546                 goto out_free_rht;
6547
6548         err = platform_driver_register(&mac80211_hwsim_driver);
6549         if (err)
6550                 goto out_unregister_pernet;
6551
6552         err = hwsim_init_netlink();
6553         if (err)
6554                 goto out_unregister_driver;
6555
6556         err = hwsim_register_virtio_driver();
6557         if (err)
6558                 goto out_exit_netlink;
6559
6560         hwsim_class = class_create("mac80211_hwsim");
6561         if (IS_ERR(hwsim_class)) {
6562                 err = PTR_ERR(hwsim_class);
6563                 goto out_exit_virtio;
6564         }
6565
6566         hwsim_init_s1g_channels(hwsim_channels_s1g);
6567
6568         for (i = 0; i < radios; i++) {
6569                 struct hwsim_new_radio_params param = { 0 };
6570
6571                 param.channels = channels;
6572
6573                 switch (regtest) {
6574                 case HWSIM_REGTEST_DIFF_COUNTRY:
6575                         if (i < ARRAY_SIZE(hwsim_alpha2s))
6576                                 param.reg_alpha2 = hwsim_alpha2s[i];
6577                         break;
6578                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
6579                         if (!i)
6580                                 param.reg_alpha2 = hwsim_alpha2s[0];
6581                         break;
6582                 case HWSIM_REGTEST_STRICT_ALL:
6583                         param.reg_strict = true;
6584                         fallthrough;
6585                 case HWSIM_REGTEST_DRIVER_REG_ALL:
6586                         param.reg_alpha2 = hwsim_alpha2s[0];
6587                         break;
6588                 case HWSIM_REGTEST_WORLD_ROAM:
6589                         if (i == 0)
6590                                 param.regd = &hwsim_world_regdom_custom_01;
6591                         break;
6592                 case HWSIM_REGTEST_CUSTOM_WORLD:
6593                         param.regd = &hwsim_world_regdom_custom_01;
6594                         break;
6595                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
6596                         if (i == 0)
6597                                 param.regd = &hwsim_world_regdom_custom_01;
6598                         else if (i == 1)
6599                                 param.regd = &hwsim_world_regdom_custom_02;
6600                         break;
6601                 case HWSIM_REGTEST_STRICT_FOLLOW:
6602                         if (i == 0) {
6603                                 param.reg_strict = true;
6604                                 param.reg_alpha2 = hwsim_alpha2s[0];
6605                         }
6606                         break;
6607                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
6608                         if (i == 0) {
6609                                 param.reg_strict = true;
6610                                 param.reg_alpha2 = hwsim_alpha2s[0];
6611                         } else if (i == 1) {
6612                                 param.reg_alpha2 = hwsim_alpha2s[1];
6613                         }
6614                         break;
6615                 case HWSIM_REGTEST_ALL:
6616                         switch (i) {
6617                         case 0:
6618                                 param.regd = &hwsim_world_regdom_custom_01;
6619                                 break;
6620                         case 1:
6621                                 param.regd = &hwsim_world_regdom_custom_02;
6622                                 break;
6623                         case 2:
6624                                 param.reg_alpha2 = hwsim_alpha2s[0];
6625                                 break;
6626                         case 3:
6627                                 param.reg_alpha2 = hwsim_alpha2s[1];
6628                                 break;
6629                         case 4:
6630                                 param.reg_strict = true;
6631                                 param.reg_alpha2 = hwsim_alpha2s[2];
6632                                 break;
6633                         }
6634                         break;
6635                 default:
6636                         break;
6637                 }
6638
6639                 param.p2p_device = support_p2p_device;
6640                 param.mlo = mlo;
6641                 param.use_chanctx = channels > 1 || mlo;
6642                 param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
6643                 if (param.p2p_device)
6644                         param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
6645
6646                 err = mac80211_hwsim_new_radio(NULL, &param);
6647                 if (err < 0)
6648                         goto out_free_radios;
6649         }
6650
6651         hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
6652                                  hwsim_mon_setup);
6653         if (hwsim_mon == NULL) {
6654                 err = -ENOMEM;
6655                 goto out_free_radios;
6656         }
6657
6658         rtnl_lock();
6659         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
6660         if (err < 0) {
6661                 rtnl_unlock();
6662                 goto out_free_mon;
6663         }
6664
6665         err = register_netdevice(hwsim_mon);
6666         if (err < 0) {
6667                 rtnl_unlock();
6668                 goto out_free_mon;
6669         }
6670         rtnl_unlock();
6671
6672         return 0;
6673
6674 out_free_mon:
6675         free_netdev(hwsim_mon);
6676 out_free_radios:
6677         mac80211_hwsim_free();
6678 out_exit_virtio:
6679         hwsim_unregister_virtio_driver();
6680 out_exit_netlink:
6681         hwsim_exit_netlink();
6682 out_unregister_driver:
6683         platform_driver_unregister(&mac80211_hwsim_driver);
6684 out_unregister_pernet:
6685         unregister_pernet_device(&hwsim_net_ops);
6686 out_free_rht:
6687         rhashtable_destroy(&hwsim_radios_rht);
6688         return err;
6689 }
6690 module_init(init_mac80211_hwsim);
6691
6692 static void __exit exit_mac80211_hwsim(void)
6693 {
6694         pr_debug("mac80211_hwsim: unregister radios\n");
6695
6696         hwsim_unregister_virtio_driver();
6697         hwsim_exit_netlink();
6698
6699         mac80211_hwsim_free();
6700
6701         rhashtable_destroy(&hwsim_radios_rht);
6702         unregister_netdev(hwsim_mon);
6703         platform_driver_unregister(&mac80211_hwsim_driver);
6704         unregister_pernet_device(&hwsim_net_ops);
6705 }
6706 module_exit(exit_mac80211_hwsim);