xref: /linux/drivers/net/wireless/virtual/mac80211_hwsim_main.c (revision 03b0588c2511dd5cf7745a194fedaadabba4b163)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
4  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
5  * Copyright (c) 2011, Javier Lopez <jlopex@gmail.com>
6  * Copyright (c) 2016 - 2017 Intel Deutschland GmbH
7  * Copyright (C) 2018 - 2026 Intel Corporation
8  */
9 
10 /*
11  * TODO:
12  * - Add TSF sync and fix IBSS beacon transmission by adding
13  *   competition for "air time" at TBTT
14  * - RX filtering based on filter configuration (data->rx_filter)
15  */
16 
17 #include <linux/list.h>
18 #include <linux/slab.h>
19 #include <linux/spinlock.h>
20 #include <net/dst.h>
21 #include <net/xfrm.h>
22 #include <net/mac80211.h>
23 #include <net/ieee80211_radiotap.h>
24 #include <linux/if_arp.h>
25 #include <linux/rtnetlink.h>
26 #include <linux/etherdevice.h>
27 #include <linux/platform_device.h>
28 #include <linux/debugfs.h>
29 #include <linux/module.h>
30 #include <linux/ktime.h>
31 #include <net/genetlink.h>
32 #include <net/net_namespace.h>
33 #include <net/netns/generic.h>
34 #include <linux/rhashtable.h>
35 #include <linux/nospec.h>
36 #include <linux/virtio.h>
37 #include <linux/virtio_ids.h>
38 #include <linux/virtio_config.h>
39 #include <linux/uaccess.h>
40 #include <linux/string.h>
41 #include "mac80211_hwsim.h"
42 #include "mac80211_hwsim_i.h"
43 
44 #define WARN_QUEUE 100
45 #define MAX_QUEUE 200
46 
47 MODULE_AUTHOR("Jouni Malinen");
48 MODULE_DESCRIPTION("Software simulator of 802.11 radio(s) for mac80211");
49 MODULE_LICENSE("GPL");
50 
51 static int radios = 2;
52 module_param(radios, int, 0444);
53 MODULE_PARM_DESC(radios, "Number of simulated radios");
54 
55 static int channels = 1;
56 module_param(channels, int, 0444);
57 MODULE_PARM_DESC(channels, "Number of concurrent channels");
58 
59 static bool paged_rx = false;
60 module_param(paged_rx, bool, 0644);
61 MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
62 
63 static bool rctbl = false;
64 module_param(rctbl, bool, 0444);
65 MODULE_PARM_DESC(rctbl, "Handle rate control table");
66 
67 static bool support_p2p_device = true;
68 module_param(support_p2p_device, bool, 0444);
69 MODULE_PARM_DESC(support_p2p_device, "Support P2P-Device interface type");
70 
71 static bool mlo;
72 module_param(mlo, bool, 0444);
73 MODULE_PARM_DESC(mlo, "Support MLO");
74 
75 static bool multi_radio;
76 module_param(multi_radio, bool, 0444);
77 MODULE_PARM_DESC(multi_radio, "Support Multiple Radios per wiphy");
78 
79 /**
80  * enum hwsim_regtest - the type of regulatory tests we offer
81  *
82  * @HWSIM_REGTEST_DISABLED: No regulatory tests are performed,
83  * 	this is the default value.
84  * @HWSIM_REGTEST_DRIVER_REG_FOLLOW: Used for testing the driver regulatory
85  *	hint, only one driver regulatory hint will be sent as such the
86  * 	secondary radios are expected to follow.
87  * @HWSIM_REGTEST_DRIVER_REG_ALL: Used for testing the driver regulatory
88  * 	request with all radios reporting the same regulatory domain.
89  * @HWSIM_REGTEST_DIFF_COUNTRY: Used for testing the drivers calling
90  * 	different regulatory domains requests. Expected behaviour is for
91  * 	an intersection to occur but each device will still use their
92  * 	respective regulatory requested domains. Subsequent radios will
93  * 	use the resulting intersection.
94  * @HWSIM_REGTEST_WORLD_ROAM: Used for testing the world roaming. We accomplish
95  *	this by using a custom beacon-capable regulatory domain for the first
96  *	radio. All other device world roam.
97  * @HWSIM_REGTEST_CUSTOM_WORLD: Used for testing the custom world regulatory
98  * 	domain requests. All radios will adhere to this custom world regulatory
99  * 	domain.
100  * @HWSIM_REGTEST_CUSTOM_WORLD_2: Used for testing 2 custom world regulatory
101  * 	domain requests. The first radio will adhere to the first custom world
102  * 	regulatory domain, the second one to the second custom world regulatory
103  * 	domain. All other devices will world roam.
104  * @HWSIM_REGTEST_STRICT_FOLLOW: Used for testing strict regulatory domain
105  *	settings, only the first radio will send a regulatory domain request
106  *	and use strict settings. The rest of the radios are expected to follow.
107  * @HWSIM_REGTEST_STRICT_ALL: Used for testing strict regulatory domain
108  *	settings. All radios will adhere to this.
109  * @HWSIM_REGTEST_STRICT_AND_DRIVER_REG: Used for testing strict regulatory
110  *	domain settings, combined with secondary driver regulatory domain
111  *	settings. The first radio will get a strict regulatory domain setting
112  *	using the first driver regulatory request and the second radio will use
113  *	non-strict settings using the second driver regulatory request. All
114  *	other devices should follow the intersection created between the
115  *	first two.
116  * @HWSIM_REGTEST_ALL: Used for testing every possible mix. You will need
117  * 	at least 6 radios for a complete test. We will test in this order:
118  * 	1 - driver custom world regulatory domain
119  * 	2 - second custom world regulatory domain
120  * 	3 - first driver regulatory domain request
121  * 	4 - second driver regulatory domain request
122  * 	5 - strict regulatory domain settings using the third driver regulatory
123  * 	    domain request
124  * 	6 and on - should follow the intersection of the 3rd, 4rth and 5th radio
125  * 	           regulatory requests.
126  *
127  * These are the different values you can use for the regtest
128  * module parameter. This is useful to help test world roaming
129  * and the driver regulatory_hint() call and combinations of these.
130  * If you want to do specific alpha2 regulatory domain tests simply
131  * use the userspace regulatory request as that will be respected as
132  * well without the need of this module parameter. This is designed
133  * only for testing the driver regulatory request, world roaming
134  * and all possible combinations.
135  */
136 enum hwsim_regtest {
137 	HWSIM_REGTEST_DISABLED = 0,
138 	HWSIM_REGTEST_DRIVER_REG_FOLLOW = 1,
139 	HWSIM_REGTEST_DRIVER_REG_ALL = 2,
140 	HWSIM_REGTEST_DIFF_COUNTRY = 3,
141 	HWSIM_REGTEST_WORLD_ROAM = 4,
142 	HWSIM_REGTEST_CUSTOM_WORLD = 5,
143 	HWSIM_REGTEST_CUSTOM_WORLD_2 = 6,
144 	HWSIM_REGTEST_STRICT_FOLLOW = 7,
145 	HWSIM_REGTEST_STRICT_ALL = 8,
146 	HWSIM_REGTEST_STRICT_AND_DRIVER_REG = 9,
147 	HWSIM_REGTEST_ALL = 10,
148 };
149 
150 /* Set to one of the HWSIM_REGTEST_* values above */
151 static int regtest = HWSIM_REGTEST_DISABLED;
152 module_param(regtest, int, 0444);
153 MODULE_PARM_DESC(regtest, "The type of regulatory test we want to run");
154 
155 static const char *hwsim_alpha2s[] = {
156 	"FI",
157 	"AL",
158 	"US",
159 	"DE",
160 	"JP",
161 	"AL",
162 };
163 
164 static const struct ieee80211_regdomain hwsim_world_regdom_custom_01 = {
165 	.n_reg_rules = 5,
166 	.alpha2 =  "99",
167 	.reg_rules = {
168 		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
169 		REG_RULE(2484-10, 2484+10, 40, 0, 20, 0),
170 		REG_RULE(5150-10, 5240+10, 40, 0, 30, 0),
171 		REG_RULE(5745-10, 5825+10, 40, 0, 30, 0),
172 		REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
173 	}
174 };
175 
176 static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
177 	.n_reg_rules = 3,
178 	.alpha2 =  "99",
179 	.reg_rules = {
180 		REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
181 		REG_RULE(5725-10, 5850+10, 40, 0, 30,
182 			 NL80211_RRF_NO_IR),
183 		REG_RULE(5855-10, 5925+10, 40, 0, 33, 0),
184 	}
185 };
186 
187 static const struct ieee80211_regdomain hwsim_world_regdom_custom_03 = {
188 	.n_reg_rules = 6,
189 	.alpha2 =  "99",
190 	.reg_rules = {
191 		REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
192 		REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
193 		REG_RULE(5150 - 10, 5240 + 10, 40, 0, 30, 0),
194 		REG_RULE(5745 - 10, 5825 + 10, 40, 0, 30, 0),
195 		REG_RULE(5855 - 10, 5925 + 10, 40, 0, 33, 0),
196 		REG_RULE(5955 - 10, 7125 + 10, 320, 0, 33, 0),
197 	}
198 };
199 
200 static const struct ieee80211_regdomain hwsim_world_regdom_custom_04 = {
201 	.n_reg_rules = 6,
202 	.alpha2 =  "99",
203 	.reg_rules = {
204 		REG_RULE(2412 - 10, 2462 + 10, 40, 0, 20, 0),
205 		REG_RULE(2484 - 10, 2484 + 10, 40, 0, 20, 0),
206 		REG_RULE(5150 - 10, 5240 + 10, 80, 0, 30, NL80211_RRF_AUTO_BW),
207 		REG_RULE(5260 - 10, 5320 + 10, 80, 0, 30,
208 			 NL80211_RRF_DFS_CONCURRENT | NL80211_RRF_DFS |
209 			 NL80211_RRF_AUTO_BW),
210 		REG_RULE(5500 - 10, 5720 + 10, 160, 0, 30,
211 			 NL80211_RRF_DFS_CONCURRENT | NL80211_RRF_DFS),
212 		REG_RULE(5745 - 10, 5825 + 10, 80, 0, 30, 0),
213 		REG_RULE(5855 - 10, 5925 + 10, 80, 0, 33, 0),
214 	}
215 };
216 
217 static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
218 	&hwsim_world_regdom_custom_01,
219 	&hwsim_world_regdom_custom_02,
220 	&hwsim_world_regdom_custom_03,
221 	&hwsim_world_regdom_custom_04,
222 };
223 
224 struct hwsim_vif_priv {
225 	u32 magic;
226 	u32 skip_beacons[IEEE80211_MLD_MAX_NUM_LINKS];
227 	u8 bssid[ETH_ALEN];
228 	bool assoc;
229 	bool bcn_en;
230 	u16 aid;
231 };
232 
233 #define HWSIM_VIF_MAGIC	0x69537748
234 
235 static inline void hwsim_check_magic(struct ieee80211_vif *vif)
236 {
237 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
238 	WARN(vp->magic != HWSIM_VIF_MAGIC,
239 	     "Invalid VIF (%p) magic %#x, %pM, %d/%d\n",
240 	     vif, vp->magic, vif->addr, vif->type, vif->p2p);
241 }
242 
243 static inline void hwsim_set_magic(struct ieee80211_vif *vif)
244 {
245 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
246 	vp->magic = HWSIM_VIF_MAGIC;
247 }
248 
249 static inline void hwsim_clear_magic(struct ieee80211_vif *vif)
250 {
251 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
252 	vp->magic = 0;
253 }
254 
255 static inline void hwsim_check_sta_magic(struct ieee80211_sta *sta)
256 {
257 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
258 	WARN_ON(sp->magic != HWSIM_STA_MAGIC);
259 }
260 
261 static inline void hwsim_set_sta_magic(struct ieee80211_sta *sta)
262 {
263 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
264 	sp->magic = HWSIM_STA_MAGIC;
265 }
266 
267 static inline void hwsim_clear_sta_magic(struct ieee80211_sta *sta)
268 {
269 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
270 	sp->magic = 0;
271 }
272 
273 struct hwsim_chanctx_priv {
274 	u32 magic;
275 };
276 
277 #define HWSIM_CHANCTX_MAGIC 0x6d53774a
278 
279 static inline void hwsim_check_chanctx_magic(struct ieee80211_chanctx_conf *c)
280 {
281 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
282 	WARN_ON(cp->magic != HWSIM_CHANCTX_MAGIC);
283 }
284 
285 static inline void hwsim_set_chanctx_magic(struct ieee80211_chanctx_conf *c)
286 {
287 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
288 	cp->magic = HWSIM_CHANCTX_MAGIC;
289 }
290 
291 static inline void hwsim_clear_chanctx_magic(struct ieee80211_chanctx_conf *c)
292 {
293 	struct hwsim_chanctx_priv *cp = (void *)c->drv_priv;
294 	cp->magic = 0;
295 }
296 
297 static unsigned int hwsim_net_id;
298 
299 static DEFINE_IDA(hwsim_netgroup_ida);
300 
301 struct hwsim_net {
302 	int netgroup;
303 	u32 wmediumd;
304 };
305 
306 static inline int hwsim_net_get_netgroup(struct net *net)
307 {
308 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
309 
310 	return hwsim_net->netgroup;
311 }
312 
313 static inline int hwsim_net_set_netgroup(struct net *net)
314 {
315 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
316 
317 	hwsim_net->netgroup = ida_alloc(&hwsim_netgroup_ida, GFP_KERNEL);
318 	return hwsim_net->netgroup >= 0 ? 0 : -ENOMEM;
319 }
320 
321 static inline u32 hwsim_net_get_wmediumd(struct net *net)
322 {
323 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
324 
325 	return hwsim_net->wmediumd;
326 }
327 
328 static inline void hwsim_net_set_wmediumd(struct net *net, u32 portid)
329 {
330 	struct hwsim_net *hwsim_net = net_generic(net, hwsim_net_id);
331 
332 	hwsim_net->wmediumd = portid;
333 }
334 
335 static const struct class hwsim_class = {
336 	.name	= "mac80211_hwsim"
337 };
338 
339 static struct net_device *hwsim_mon; /* global monitor netdev */
340 
341 #define CHAN2G(_freq)  { \
342 	.band = NL80211_BAND_2GHZ, \
343 	.center_freq = (_freq), \
344 	.hw_value = (_freq), \
345 }
346 
347 #define CHAN5G(_freq) { \
348 	.band = NL80211_BAND_5GHZ, \
349 	.center_freq = (_freq), \
350 	.hw_value = (_freq), \
351 }
352 
353 #define CHAN6G(_freq) { \
354 	.band = NL80211_BAND_6GHZ, \
355 	.center_freq = (_freq), \
356 	.hw_value = (_freq), \
357 }
358 
359 #define CHANS1G(_freq, _offset, _flags) { \
360 	.band = NL80211_BAND_S1GHZ, \
361 	.center_freq = (_freq), \
362 	.freq_offset = (_offset), \
363 	.hw_value = (_freq), \
364 	.flags = (_flags), \
365 }
366 
367 static const struct ieee80211_channel hwsim_channels_2ghz[] = {
368 	CHAN2G(2412), /* Channel 1 */
369 	CHAN2G(2417), /* Channel 2 */
370 	CHAN2G(2422), /* Channel 3 */
371 	CHAN2G(2427), /* Channel 4 */
372 	CHAN2G(2432), /* Channel 5 */
373 	CHAN2G(2437), /* Channel 6 */
374 	CHAN2G(2442), /* Channel 7 */
375 	CHAN2G(2447), /* Channel 8 */
376 	CHAN2G(2452), /* Channel 9 */
377 	CHAN2G(2457), /* Channel 10 */
378 	CHAN2G(2462), /* Channel 11 */
379 	CHAN2G(2467), /* Channel 12 */
380 	CHAN2G(2472), /* Channel 13 */
381 	CHAN2G(2484), /* Channel 14 */
382 };
383 static_assert(HWSIM_NUM_CHANNELS_2GHZ == ARRAY_SIZE(hwsim_channels_2ghz),
384 	      "Inconsistent 2 GHz channel count");
385 
386 static const struct ieee80211_channel hwsim_channels_5ghz[] = {
387 	CHAN5G(5180), /* Channel 36 */
388 	CHAN5G(5200), /* Channel 40 */
389 	CHAN5G(5220), /* Channel 44 */
390 	CHAN5G(5240), /* Channel 48 */
391 
392 	CHAN5G(5260), /* Channel 52 */
393 	CHAN5G(5280), /* Channel 56 */
394 	CHAN5G(5300), /* Channel 60 */
395 	CHAN5G(5320), /* Channel 64 */
396 
397 	CHAN5G(5500), /* Channel 100 */
398 	CHAN5G(5520), /* Channel 104 */
399 	CHAN5G(5540), /* Channel 108 */
400 	CHAN5G(5560), /* Channel 112 */
401 	CHAN5G(5580), /* Channel 116 */
402 	CHAN5G(5600), /* Channel 120 */
403 	CHAN5G(5620), /* Channel 124 */
404 	CHAN5G(5640), /* Channel 128 */
405 	CHAN5G(5660), /* Channel 132 */
406 	CHAN5G(5680), /* Channel 136 */
407 	CHAN5G(5700), /* Channel 140 */
408 
409 	CHAN5G(5745), /* Channel 149 */
410 	CHAN5G(5765), /* Channel 153 */
411 	CHAN5G(5785), /* Channel 157 */
412 	CHAN5G(5805), /* Channel 161 */
413 	CHAN5G(5825), /* Channel 165 */
414 	CHAN5G(5845), /* Channel 169 */
415 
416 	CHAN5G(5855), /* Channel 171 */
417 	CHAN5G(5860), /* Channel 172 */
418 	CHAN5G(5865), /* Channel 173 */
419 	CHAN5G(5870), /* Channel 174 */
420 
421 	CHAN5G(5875), /* Channel 175 */
422 	CHAN5G(5880), /* Channel 176 */
423 	CHAN5G(5885), /* Channel 177 */
424 	CHAN5G(5890), /* Channel 178 */
425 	CHAN5G(5895), /* Channel 179 */
426 	CHAN5G(5900), /* Channel 180 */
427 	CHAN5G(5905), /* Channel 181 */
428 
429 	CHAN5G(5910), /* Channel 182 */
430 	CHAN5G(5915), /* Channel 183 */
431 	CHAN5G(5920), /* Channel 184 */
432 	CHAN5G(5925), /* Channel 185 */
433 };
434 static_assert(HWSIM_NUM_CHANNELS_5GHZ == ARRAY_SIZE(hwsim_channels_5ghz),
435 	      "Inconsistent 5 GHz channel count");
436 
437 static const struct ieee80211_channel hwsim_channels_6ghz[] = {
438 	CHAN6G(5955), /* Channel 1 */
439 	CHAN6G(5975), /* Channel 5 */
440 	CHAN6G(5995), /* Channel 9 */
441 	CHAN6G(6015), /* Channel 13 */
442 	CHAN6G(6035), /* Channel 17 */
443 	CHAN6G(6055), /* Channel 21 */
444 	CHAN6G(6075), /* Channel 25 */
445 	CHAN6G(6095), /* Channel 29 */
446 	CHAN6G(6115), /* Channel 33 */
447 	CHAN6G(6135), /* Channel 37 */
448 	CHAN6G(6155), /* Channel 41 */
449 	CHAN6G(6175), /* Channel 45 */
450 	CHAN6G(6195), /* Channel 49 */
451 	CHAN6G(6215), /* Channel 53 */
452 	CHAN6G(6235), /* Channel 57 */
453 	CHAN6G(6255), /* Channel 61 */
454 	CHAN6G(6275), /* Channel 65 */
455 	CHAN6G(6295), /* Channel 69 */
456 	CHAN6G(6315), /* Channel 73 */
457 	CHAN6G(6335), /* Channel 77 */
458 	CHAN6G(6355), /* Channel 81 */
459 	CHAN6G(6375), /* Channel 85 */
460 	CHAN6G(6395), /* Channel 89 */
461 	CHAN6G(6415), /* Channel 93 */
462 	CHAN6G(6435), /* Channel 97 */
463 	CHAN6G(6455), /* Channel 181 */
464 	CHAN6G(6475), /* Channel 105 */
465 	CHAN6G(6495), /* Channel 109 */
466 	CHAN6G(6515), /* Channel 113 */
467 	CHAN6G(6535), /* Channel 117 */
468 	CHAN6G(6555), /* Channel 121 */
469 	CHAN6G(6575), /* Channel 125 */
470 	CHAN6G(6595), /* Channel 129 */
471 	CHAN6G(6615), /* Channel 133 */
472 	CHAN6G(6635), /* Channel 137 */
473 	CHAN6G(6655), /* Channel 141 */
474 	CHAN6G(6675), /* Channel 145 */
475 	CHAN6G(6695), /* Channel 149 */
476 	CHAN6G(6715), /* Channel 153 */
477 	CHAN6G(6735), /* Channel 157 */
478 	CHAN6G(6755), /* Channel 161 */
479 	CHAN6G(6775), /* Channel 165 */
480 	CHAN6G(6795), /* Channel 169 */
481 	CHAN6G(6815), /* Channel 173 */
482 	CHAN6G(6835), /* Channel 177 */
483 	CHAN6G(6855), /* Channel 181 */
484 	CHAN6G(6875), /* Channel 185 */
485 	CHAN6G(6895), /* Channel 189 */
486 	CHAN6G(6915), /* Channel 193 */
487 	CHAN6G(6935), /* Channel 197 */
488 	CHAN6G(6955), /* Channel 201 */
489 	CHAN6G(6975), /* Channel 205 */
490 	CHAN6G(6995), /* Channel 209 */
491 	CHAN6G(7015), /* Channel 213 */
492 	CHAN6G(7035), /* Channel 217 */
493 	CHAN6G(7055), /* Channel 221 */
494 	CHAN6G(7075), /* Channel 225 */
495 	CHAN6G(7095), /* Channel 229 */
496 	CHAN6G(7115), /* Channel 233 */
497 };
498 static_assert(HWSIM_NUM_CHANNELS_6GHZ == ARRAY_SIZE(hwsim_channels_6ghz),
499 	      "Inconsistent 6 GHz channel count");
500 
501 /*
502  * US 2024 channels (op class 1). Additionally to emulate real world
503  * US operation, the edgeband 1MHz channels (1, 51) are marked as NO_PRIMARY.
504  */
505 static const struct ieee80211_channel hwsim_channels_s1g[] = {
506 	CHANS1G(902, 500, IEEE80211_CHAN_S1G_NO_PRIMARY), /* Channel 1 */
507 	CHANS1G(903, 500, 0), /* Channel 3 */
508 	CHANS1G(904, 500, 0), /* Channel 5 */
509 	CHANS1G(905, 500, 0), /* Channel 7 */
510 	CHANS1G(906, 500, 0), /* Channel 9 */
511 	CHANS1G(907, 500, 0), /* Channel 11 */
512 	CHANS1G(908, 500, 0), /* Channel 13 */
513 	CHANS1G(909, 500, 0), /* Channel 15 */
514 	CHANS1G(910, 500, 0), /* Channel 17 */
515 	CHANS1G(911, 500, 0), /* Channel 19 */
516 	CHANS1G(912, 500, 0), /* Channel 21 */
517 	CHANS1G(913, 500, 0), /* Channel 23 */
518 	CHANS1G(914, 500, 0), /* Channel 25 */
519 	CHANS1G(915, 500, 0), /* Channel 27 */
520 	CHANS1G(916, 500, 0), /* Channel 29 */
521 	CHANS1G(917, 500, 0), /* Channel 31 */
522 	CHANS1G(918, 500, 0), /* Channel 33 */
523 	CHANS1G(919, 500, 0), /* Channel 35 */
524 	CHANS1G(920, 500, 0), /* Channel 37 */
525 	CHANS1G(921, 500, 0), /* Channel 39 */
526 	CHANS1G(922, 500, 0), /* Channel 41 */
527 	CHANS1G(923, 500, 0), /* Channel 43 */
528 	CHANS1G(924, 500, 0), /* Channel 45 */
529 	CHANS1G(925, 500, 0), /* Channel 47 */
530 	CHANS1G(926, 500, 0), /* Channel 49 */
531 	CHANS1G(927, 500, IEEE80211_CHAN_S1G_NO_PRIMARY), /* Channel 51 */
532 };
533 
534 static const struct ieee80211_sta_s1g_cap hwsim_s1g_cap = {
535 	.s1g = true,
536 	.cap = { S1G_CAP0_SGI_1MHZ | S1G_CAP0_SGI_2MHZ,
537 		 0,
538 		 0,
539 		 S1G_CAP3_MAX_MPDU_LEN,
540 		 0,
541 		 S1G_CAP5_AMPDU,
542 		 0,
543 		 S1G_CAP7_DUP_1MHZ,
544 		 S1G_CAP8_TWT_RESPOND | S1G_CAP8_TWT_REQUEST,
545 		 0},
546 	.nss_mcs = { 0xfc | 1, /* MCS 7 for 1 SS */
547 	/* RX Highest Supported Long GI Data Rate 0:7 */
548 		     0,
549 	/* RX Highest Supported Long GI Data Rate 0:7 */
550 	/* TX S1G MCS Map 0:6 */
551 		     0xfa,
552 	/* TX S1G MCS Map :7 */
553 	/* TX Highest Supported Long GI Data Rate 0:6 */
554 		     0x80,
555 	/* TX Highest Supported Long GI Data Rate 7:8 */
556 	/* Rx Single spatial stream and S1G-MCS Map for 1MHz */
557 	/* Tx Single spatial stream and S1G-MCS Map for 1MHz */
558 		     0 },
559 };
560 
561 static const struct ieee80211_rate hwsim_rates[] = {
562 	{ .bitrate = 10 },
563 	{ .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
564 	{ .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
565 	{ .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
566 	{ .bitrate = 60 },
567 	{ .bitrate = 90 },
568 	{ .bitrate = 120 },
569 	{ .bitrate = 180 },
570 	{ .bitrate = 240 },
571 	{ .bitrate = 360 },
572 	{ .bitrate = 480 },
573 	{ .bitrate = 540 }
574 };
575 static_assert(HWSIM_NUM_RATES == ARRAY_SIZE(hwsim_rates),
576 	      "Inconsistent rates count");
577 
578 #define DEFAULT_RX_RSSI -50
579 
580 static const u32 hwsim_ciphers[] = {
581 	WLAN_CIPHER_SUITE_WEP40,
582 	WLAN_CIPHER_SUITE_WEP104,
583 	WLAN_CIPHER_SUITE_TKIP,
584 	WLAN_CIPHER_SUITE_CCMP,
585 	WLAN_CIPHER_SUITE_CCMP_256,
586 	WLAN_CIPHER_SUITE_GCMP,
587 	WLAN_CIPHER_SUITE_GCMP_256,
588 	WLAN_CIPHER_SUITE_AES_CMAC,
589 	WLAN_CIPHER_SUITE_BIP_CMAC_256,
590 	WLAN_CIPHER_SUITE_BIP_GMAC_128,
591 	WLAN_CIPHER_SUITE_BIP_GMAC_256,
592 };
593 static_assert(HWSIM_NUM_CIPHERS == ARRAY_SIZE(hwsim_ciphers),
594 	      "Inconsistent cipher count");
595 
596 #define OUI_QCA 0x001374
597 #define QCA_NL80211_SUBCMD_TEST 1
598 enum qca_nl80211_vendor_subcmds {
599 	QCA_WLAN_VENDOR_ATTR_TEST = 8,
600 	QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_TEST
601 };
602 
603 static const struct nla_policy
604 hwsim_vendor_test_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
605 	[QCA_WLAN_VENDOR_ATTR_MAX] = { .type = NLA_U32 },
606 };
607 
608 static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,
609 					  struct wireless_dev *wdev,
610 					  const void *data, int data_len)
611 {
612 	struct sk_buff *skb;
613 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
614 	int err;
615 	u32 val;
616 
617 	err = nla_parse_deprecated(tb, QCA_WLAN_VENDOR_ATTR_MAX, data,
618 				   data_len, hwsim_vendor_test_policy, NULL);
619 	if (err)
620 		return err;
621 	if (!tb[QCA_WLAN_VENDOR_ATTR_TEST])
622 		return -EINVAL;
623 	val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_TEST]);
624 	wiphy_dbg(wiphy, "%s: test=%u\n", __func__, val);
625 
626 	/* Send a vendor event as a test. Note that this would not normally be
627 	 * done within a command handler, but rather, based on some other
628 	 * trigger. For simplicity, this command is used to trigger the event
629 	 * here.
630 	 *
631 	 * event_idx = 0 (index in mac80211_hwsim_vendor_commands)
632 	 */
633 	skb = cfg80211_vendor_event_alloc(wiphy, wdev, 100, 0, GFP_KERNEL);
634 	if (skb) {
635 		/* skb_put() or nla_put() will fill up data within
636 		 * NL80211_ATTR_VENDOR_DATA.
637 		 */
638 
639 		/* Add vendor data */
640 		nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 1);
641 
642 		/* Send the event - this will call nla_nest_end() */
643 		cfg80211_vendor_event(skb, GFP_KERNEL);
644 	}
645 
646 	/* Send a response to the command */
647 	skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, 10);
648 	if (!skb)
649 		return -ENOMEM;
650 
651 	/* skb_put() or nla_put() will fill up data within
652 	 * NL80211_ATTR_VENDOR_DATA
653 	 */
654 	nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_TEST, val + 2);
655 
656 	return cfg80211_vendor_cmd_reply(skb);
657 }
658 
659 static struct wiphy_vendor_command mac80211_hwsim_vendor_commands[] = {
660 	{
661 		.info = { .vendor_id = OUI_QCA,
662 			  .subcmd = QCA_NL80211_SUBCMD_TEST },
663 		.flags = WIPHY_VENDOR_CMD_NEED_NETDEV,
664 		.doit = mac80211_hwsim_vendor_cmd_test,
665 		.policy = hwsim_vendor_test_policy,
666 		.maxattr = QCA_WLAN_VENDOR_ATTR_MAX,
667 	}
668 };
669 
670 /* Advertise support vendor specific events */
671 static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
672 	{ .vendor_id = OUI_QCA, .subcmd = 1 },
673 };
674 
675 DEFINE_SPINLOCK(hwsim_radio_lock);
676 LIST_HEAD(hwsim_radios);
677 static struct rhashtable hwsim_radios_rht;
678 static int hwsim_radio_idx;
679 static int hwsim_radios_generation = 1;
680 
681 static struct platform_driver mac80211_hwsim_driver = {
682 	.driver = {
683 		.name = "mac80211_hwsim",
684 	},
685 };
686 
687 static const struct rhashtable_params hwsim_rht_params = {
688 	.nelem_hint = 2,
689 	.automatic_shrinking = true,
690 	.key_len = ETH_ALEN,
691 	.key_offset = offsetof(struct mac80211_hwsim_data, addresses[1]),
692 	.head_offset = offsetof(struct mac80211_hwsim_data, rht),
693 };
694 
695 struct hwsim_radiotap_hdr {
696 	struct ieee80211_radiotap_header_fixed hdr;
697 	__le64 rt_tsft;
698 	u8 rt_flags;
699 	u8 rt_rate;
700 	__le16 rt_channel;
701 	__le16 rt_chbitmask;
702 } __packed;
703 
704 struct hwsim_radiotap_ack_hdr {
705 	struct ieee80211_radiotap_header_fixed hdr;
706 	u8 rt_flags;
707 	u8 pad;
708 	__le16 rt_channel;
709 	__le16 rt_chbitmask;
710 } __packed;
711 
712 static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
713 {
714 	return rhashtable_lookup_fast(&hwsim_radios_rht, addr, hwsim_rht_params);
715 }
716 
717 /* MAC80211_HWSIM netlink family */
718 static struct genl_family hwsim_genl_family;
719 
720 enum hwsim_multicast_groups {
721 	HWSIM_MCGRP_CONFIG,
722 };
723 
724 static const struct genl_multicast_group hwsim_mcgrps[] = {
725 	[HWSIM_MCGRP_CONFIG] = { .name = "config", },
726 };
727 
728 /* MAC80211_HWSIM netlink policy */
729 
730 static const struct nla_policy
731 hwsim_rate_info_policy[HWSIM_RATE_INFO_ATTR_MAX + 1] = {
732 	[HWSIM_RATE_INFO_ATTR_FLAGS] = { .type = NLA_U8 },
733 	[HWSIM_RATE_INFO_ATTR_MCS] = { .type = NLA_U8 },
734 	[HWSIM_RATE_INFO_ATTR_LEGACY] = { .type = NLA_U16 },
735 	[HWSIM_RATE_INFO_ATTR_NSS] = { .type = NLA_U8 },
736 	[HWSIM_RATE_INFO_ATTR_BW] = { .type = NLA_U8 },
737 	[HWSIM_RATE_INFO_ATTR_HE_GI] = { .type = NLA_U8 },
738 	[HWSIM_RATE_INFO_ATTR_HE_DCM] = { .type = NLA_U8 },
739 	[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC] = { .type = NLA_U8 },
740 	[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH] = { .type = NLA_U8 },
741 	[HWSIM_RATE_INFO_ATTR_EHT_GI] = { .type = NLA_U8 },
742 	[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC] = { .type = NLA_U8 },
743 };
744 
745 static const struct nla_policy
746 hwsim_ftm_result_policy[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1] = {
747 	[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON] = { .type = NLA_U32 },
748 	[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX] = { .type = NLA_U16 },
749 	[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS] = { .type = NLA_U32 },
750 	[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES] = { .type = NLA_U32 },
751 	[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME] = { .type = NLA_U8 },
752 	[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP] = { .type = NLA_U8 },
753 	[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION] = { .type = NLA_U8 },
754 	[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
755 	[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG] = { .type = NLA_U32 },
756 	[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD] = { .type = NLA_U32 },
757 	[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
758 	[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE] = NLA_POLICY_NESTED(hwsim_rate_info_policy),
759 	[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG] = { .type = NLA_U64 },
760 	[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE] = { .type = NLA_U64 },
761 	[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD] = { .type = NLA_U64 },
762 	[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG] = { .type = NLA_U64 },
763 	[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE] = { .type = NLA_U64 },
764 	[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD] = { .type = NLA_U64 },
765 	[NL80211_PMSR_FTM_RESP_ATTR_LCI] = { .type = NLA_STRING },
766 	[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_STRING },
767 	[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT] = { .type = NLA_U32 },
768 	[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT] = { .type = NLA_U32 },
769 	[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS] = { .type = NLA_U32 },
770 	[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS] = { .type = NLA_U32 },
771 	[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS] = { .type = NLA_U8 },
772 	[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS] = { .type = NLA_U8 },
773 	[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
774 	[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW] = { .type = NLA_U32 },
775 	[NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
776 	[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE] = { .type = NLA_U32 },
777 	[NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR] = { .type = NLA_FLAG },
778 };
779 
780 static const struct nla_policy
781 hwsim_pmsr_resp_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
782 	[NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_result_policy),
783 };
784 
785 static const struct nla_policy
786 hwsim_pmsr_resp_policy[NL80211_PMSR_RESP_ATTR_MAX + 1] = {
787 	[NL80211_PMSR_RESP_ATTR_STATUS] = { .type = NLA_U32 },
788 	[NL80211_PMSR_RESP_ATTR_HOST_TIME] = { .type = NLA_U64 },
789 	[NL80211_PMSR_RESP_ATTR_AP_TSF] = { .type = NLA_U64 },
790 	[NL80211_PMSR_RESP_ATTR_FINAL] = { .type = NLA_FLAG },
791 	[NL80211_PMSR_RESP_ATTR_DATA] = NLA_POLICY_NESTED(hwsim_pmsr_resp_type_policy),
792 };
793 
794 static const struct nla_policy
795 hwsim_pmsr_peer_result_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
796 	[NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
797 	[NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_REJECT },
798 	[NL80211_PMSR_PEER_ATTR_REQ] = { .type = NLA_REJECT },
799 	[NL80211_PMSR_PEER_ATTR_RESP] = NLA_POLICY_NESTED(hwsim_pmsr_resp_policy),
800 };
801 
802 static const struct nla_policy
803 hwsim_pmsr_peers_result_policy[NL80211_PMSR_ATTR_MAX + 1] = {
804 	[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
805 	[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
806 	[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
807 	[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
808 	[NL80211_PMSR_ATTR_PEERS] = NLA_POLICY_NESTED_ARRAY(hwsim_pmsr_peer_result_policy),
809 };
810 
811 static const struct nla_policy
812 hwsim_ftm_role_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
813 	[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_NTB] = { .type = NLA_FLAG },
814 	[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_TB] = { .type = NLA_FLAG },
815 	[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_EDCA] = { .type = NLA_FLAG },
816 };
817 
818 static const struct nla_policy
819 hwsim_ftm_type_capa_policy[NL80211_PMSR_FTM_TYPE_CAPA_ATTR_MAX + 1] = {
820 	[NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INFRA_SUPPORT] = { .type = NLA_FLAG },
821 	[NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT] = { .type = NLA_FLAG },
822 };
823 
824 static const struct nla_policy
825 hwsim_ftm_capa_policy[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1] = {
826 	[NL80211_PMSR_FTM_CAPA_ATTR_ASAP] = { .type = NLA_FLAG },
827 	[NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP] = { .type = NLA_FLAG },
828 	[NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI] = { .type = NLA_FLAG },
829 	[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC] = { .type = NLA_FLAG },
830 	[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES] = { .type = NLA_U32 },
831 	[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS] = { .type = NLA_U32 },
832 	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT] = NLA_POLICY_MAX(NLA_U8, 15),
833 	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST] = NLA_POLICY_MAX(NLA_U8, 31),
834 	[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
835 	[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
836 	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS] = { .type = NLA_U8 },
837 	[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS] = { .type = NLA_U8 },
838 	[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA] = { .type = NLA_U32 },
839 	[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB] = { .type = NLA_U32 },
840 	[NL80211_PMSR_FTM_CAPA_ATTR_PD_PREAMBLES] = { .type = NLA_U32 },
841 	[NL80211_PMSR_FTM_CAPA_ATTR_PD_BANDWIDTHS] = { .type = NLA_U32 },
842 	[NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS] =
843 		NLA_POLICY_NESTED(hwsim_ftm_role_capa_policy),
844 	[NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS] =
845 		NLA_POLICY_NESTED(hwsim_ftm_role_capa_policy),
846 	[NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS] =
847 		NLA_POLICY_NESTED(hwsim_ftm_type_capa_policy),
848 	[NL80211_PMSR_FTM_CAPA_ATTR_CONCURRENT_ISTA_RSTA_SUPPORT] = { .type = NLA_FLAG },
849 };
850 
851 static const struct nla_policy
852 hwsim_pmsr_capa_type_policy[NL80211_PMSR_TYPE_MAX + 1] = {
853 	[NL80211_PMSR_TYPE_FTM] = NLA_POLICY_NESTED(hwsim_ftm_capa_policy),
854 };
855 
856 static const struct nla_policy
857 hwsim_pmsr_capa_policy[NL80211_PMSR_ATTR_MAX + 1] = {
858 	[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_U32 },
859 	[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_FLAG },
860 	[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_FLAG },
861 	[NL80211_PMSR_ATTR_TYPE_CAPA] = NLA_POLICY_NESTED(hwsim_pmsr_capa_type_policy),
862 	[NL80211_PMSR_ATTR_PEERS] = { .type = NLA_REJECT }, // only for request.
863 };
864 
865 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
866 	[HWSIM_ATTR_ADDR_RECEIVER] = NLA_POLICY_ETH_ADDR_COMPAT,
867 	[HWSIM_ATTR_ADDR_TRANSMITTER] = NLA_POLICY_ETH_ADDR_COMPAT,
868 	[HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
869 			       .len = IEEE80211_MAX_DATA_LEN },
870 	[HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
871 	[HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
872 	[HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
873 	[HWSIM_ATTR_TX_INFO] =
874 		NLA_POLICY_EXACT_LEN(IEEE80211_TX_MAX_RATES *
875 				     sizeof(struct hwsim_tx_rate)),
876 	[HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
877 	[HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
878 	[HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
879 	[HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
880 	[HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
881 	[HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
882 	[HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
883 	[HWSIM_ATTR_USE_CHANCTX] = { .type = NLA_FLAG },
884 	[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
885 	[HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
886 	[HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
887 	[HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
888 	[HWSIM_ATTR_TX_INFO_FLAGS] = { .type = NLA_BINARY },
889 	[HWSIM_ATTR_PERM_ADDR] = NLA_POLICY_ETH_ADDR_COMPAT,
890 	[HWSIM_ATTR_IFTYPE_SUPPORT] = { .type = NLA_U32 },
891 	[HWSIM_ATTR_CIPHER_SUPPORT] = { .type = NLA_BINARY },
892 	[HWSIM_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
893 	[HWSIM_ATTR_PMSR_SUPPORT] = NLA_POLICY_NESTED(hwsim_pmsr_capa_policy),
894 	[HWSIM_ATTR_PMSR_RESULT] = NLA_POLICY_NESTED(hwsim_pmsr_peers_result_policy),
895 	[HWSIM_ATTR_MULTI_RADIO] = { .type = NLA_FLAG },
896 	[HWSIM_ATTR_SUPPORT_NAN_DEVICE] = { .type = NLA_FLAG },
897 	[HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR] = { .type = NLA_FLAG },
898 	[HWSIM_ATTR_NO_MONITOR] = { .type = NLA_FLAG },
899 };
900 
901 #if IS_REACHABLE(CONFIG_VIRTIO)
902 
903 /* MAC80211_HWSIM virtio queues */
904 static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];
905 static bool hwsim_virtio_enabled;
906 static DEFINE_SPINLOCK(hwsim_virtio_lock);
907 
908 static void hwsim_virtio_rx_work(struct work_struct *work);
909 static DECLARE_WORK(hwsim_virtio_rx, hwsim_virtio_rx_work);
910 
911 static int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
912 			   struct sk_buff *skb)
913 {
914 	struct scatterlist sg[1];
915 	unsigned long flags;
916 	int err;
917 
918 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
919 	if (!hwsim_virtio_enabled) {
920 		err = -ENODEV;
921 		goto out_free;
922 	}
923 
924 	sg_init_one(sg, skb->head, skb_end_offset(skb));
925 	err = virtqueue_add_outbuf(hwsim_vqs[HWSIM_VQ_TX], sg, 1, skb,
926 				   GFP_ATOMIC);
927 	if (err)
928 		goto out_free;
929 	virtqueue_kick(hwsim_vqs[HWSIM_VQ_TX]);
930 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
931 	return 0;
932 
933 out_free:
934 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
935 	nlmsg_free(skb);
936 	return err;
937 }
938 #else
939 /* cause a linker error if this ends up being needed */
940 extern int hwsim_tx_virtio(struct mac80211_hwsim_data *data,
941 			   struct sk_buff *skb);
942 #define hwsim_virtio_enabled false
943 #endif
944 
945 static int hwsim_get_chanwidth(enum nl80211_chan_width bw)
946 {
947 	switch (bw) {
948 	case NL80211_CHAN_WIDTH_20_NOHT:
949 	case NL80211_CHAN_WIDTH_20:
950 		return 20;
951 	case NL80211_CHAN_WIDTH_40:
952 		return 40;
953 	case NL80211_CHAN_WIDTH_80:
954 		return 80;
955 	case NL80211_CHAN_WIDTH_80P80:
956 	case NL80211_CHAN_WIDTH_160:
957 		return 160;
958 	case NL80211_CHAN_WIDTH_320:
959 		return 320;
960 	case NL80211_CHAN_WIDTH_5:
961 		return 5;
962 	case NL80211_CHAN_WIDTH_10:
963 		return 10;
964 	case NL80211_CHAN_WIDTH_1:
965 		return 1;
966 	case NL80211_CHAN_WIDTH_2:
967 		return 2;
968 	case NL80211_CHAN_WIDTH_4:
969 		return 4;
970 	case NL80211_CHAN_WIDTH_8:
971 		return 8;
972 	case NL80211_CHAN_WIDTH_16:
973 		return 16;
974 	}
975 
976 	return INT_MAX;
977 }
978 
979 /* sysfs attributes */
980 static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
981 {
982 	struct mac80211_hwsim_data *data = dat;
983 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
984 	struct sk_buff *skb;
985 	struct ieee80211_pspoll *pspoll;
986 
987 	if (!vp->assoc)
988 		return;
989 
990 	wiphy_dbg(data->hw->wiphy,
991 		  "%s: send PS-Poll to %pM for aid %d\n",
992 		  __func__, vp->bssid, vp->aid);
993 
994 	skb = dev_alloc_skb(sizeof(*pspoll));
995 	if (!skb)
996 		return;
997 	pspoll = skb_put(skb, sizeof(*pspoll));
998 	pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
999 					    IEEE80211_STYPE_PSPOLL |
1000 					    IEEE80211_FCTL_PM);
1001 	pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
1002 	memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
1003 	memcpy(pspoll->ta, mac, ETH_ALEN);
1004 
1005 	rcu_read_lock();
1006 	mac80211_hwsim_tx_frame(data->hw, skb,
1007 				rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1008 	rcu_read_unlock();
1009 }
1010 
1011 static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
1012 				struct ieee80211_vif *vif, int ps)
1013 {
1014 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
1015 	struct sk_buff *skb;
1016 	struct ieee80211_hdr *hdr;
1017 	struct ieee80211_tx_info *cb;
1018 
1019 	if (!vp->assoc)
1020 		return;
1021 
1022 	wiphy_dbg(data->hw->wiphy,
1023 		  "%s: send data::nullfunc to %pM ps=%d\n",
1024 		  __func__, vp->bssid, ps);
1025 
1026 	skb = dev_alloc_skb(sizeof(*hdr));
1027 	if (!skb)
1028 		return;
1029 	hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
1030 	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
1031 					 IEEE80211_STYPE_NULLFUNC |
1032 					 IEEE80211_FCTL_TODS |
1033 					 (ps ? IEEE80211_FCTL_PM : 0));
1034 	hdr->duration_id = cpu_to_le16(0);
1035 	memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
1036 	memcpy(hdr->addr2, mac, ETH_ALEN);
1037 	memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
1038 
1039 	cb = IEEE80211_SKB_CB(skb);
1040 	cb->control.rates[0].count = 1;
1041 	cb->control.rates[1].idx = -1;
1042 
1043 	rcu_read_lock();
1044 	mac80211_hwsim_tx_frame(data->hw, skb,
1045 				rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan);
1046 	rcu_read_unlock();
1047 }
1048 
1049 
1050 static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
1051 				   struct ieee80211_vif *vif)
1052 {
1053 	struct mac80211_hwsim_data *data = dat;
1054 	hwsim_send_nullfunc(data, mac, vif, 1);
1055 }
1056 
1057 static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
1058 				      struct ieee80211_vif *vif)
1059 {
1060 	struct mac80211_hwsim_data *data = dat;
1061 	hwsim_send_nullfunc(data, mac, vif, 0);
1062 }
1063 
1064 static int hwsim_fops_ps_read(void *dat, u64 *val)
1065 {
1066 	struct mac80211_hwsim_data *data = dat;
1067 	*val = data->ps;
1068 	return 0;
1069 }
1070 
1071 static int hwsim_fops_ps_write(void *dat, u64 val)
1072 {
1073 	struct mac80211_hwsim_data *data = dat;
1074 	enum ps_mode old_ps;
1075 
1076 	if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
1077 	    val != PS_MANUAL_POLL)
1078 		return -EINVAL;
1079 
1080 	if (val == PS_MANUAL_POLL) {
1081 		if (data->ps != PS_ENABLED)
1082 			return -EINVAL;
1083 		local_bh_disable();
1084 		ieee80211_iterate_active_interfaces_atomic(
1085 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
1086 			hwsim_send_ps_poll, data);
1087 		local_bh_enable();
1088 		return 0;
1089 	}
1090 	old_ps = data->ps;
1091 	data->ps = val;
1092 
1093 	local_bh_disable();
1094 	if (old_ps == PS_DISABLED && val != PS_DISABLED) {
1095 		ieee80211_iterate_active_interfaces_atomic(
1096 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
1097 			hwsim_send_nullfunc_ps, data);
1098 	} else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
1099 		ieee80211_iterate_active_interfaces_atomic(
1100 			data->hw, IEEE80211_IFACE_ITER_NORMAL,
1101 			hwsim_send_nullfunc_no_ps, data);
1102 	}
1103 	local_bh_enable();
1104 
1105 	return 0;
1106 }
1107 
1108 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
1109 			 "%llu\n");
1110 
1111 static int hwsim_write_simulate_radar(void *dat, u64 val)
1112 {
1113 	struct mac80211_hwsim_data *data = dat;
1114 
1115 	ieee80211_radar_detected(data->hw, NULL);
1116 
1117 	return 0;
1118 }
1119 
1120 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
1121 			 hwsim_write_simulate_radar, "%llu\n");
1122 
1123 static ssize_t hwsim_background_cac_write(struct file *file,
1124 					  const char __user *user_buf,
1125 					  size_t count, loff_t *ppos)
1126 {
1127 	struct mac80211_hwsim_data *data = file->private_data;
1128 	char buf[8] = {};
1129 
1130 	if (count >= sizeof(buf))
1131 		return -EINVAL;
1132 
1133 	if (copy_from_user(buf, user_buf, count))
1134 		return -EFAULT;
1135 
1136 	guard(wiphy)(data->hw->wiphy);
1137 
1138 	/* Check if background radar channel is configured */
1139 	if (!data->radar_background_chandef.chan)
1140 		return -ENOENT;
1141 
1142 	if (sysfs_streq(buf, "radar"))
1143 		cfg80211_background_radar_event(data->hw->wiphy,
1144 						&data->radar_background_chandef,
1145 						GFP_KERNEL);
1146 	else if (sysfs_streq(buf, "cancel"))
1147 		cfg80211_background_cac_abort(data->hw->wiphy);
1148 	else
1149 		return -EINVAL;
1150 
1151 	return count;
1152 }
1153 
1154 static const struct file_operations hwsim_background_cac_ops = {
1155 	.owner = THIS_MODULE,
1156 	.write = hwsim_background_cac_write,
1157 	.open = simple_open,
1158 	.llseek = default_llseek,
1159 };
1160 
1161 struct hwsim_chanctx_iter_arg {
1162 	struct ieee80211_chanctx_conf *conf;
1163 	u32 freq_mhz;
1164 };
1165 
1166 static void hwsim_6ghz_chanctx_iter(struct ieee80211_hw *hw,
1167 				    struct ieee80211_chanctx_conf *conf,
1168 				    void *data)
1169 {
1170 	struct hwsim_chanctx_iter_arg *arg = data;
1171 
1172 	if (conf->def.chan &&
1173 	    conf->def.chan->band == NL80211_BAND_6GHZ &&
1174 	    conf->def.chan->center_freq == arg->freq_mhz)
1175 		arg->conf = conf;
1176 }
1177 
1178 static ssize_t hwsim_simulate_incumbent_signal_write(struct file *file,
1179 						     const char __user *ubuf,
1180 						     size_t len, loff_t *ppos)
1181 {
1182 	struct mac80211_hwsim_data *data = file->private_data;
1183 	struct hwsim_chanctx_iter_arg arg = {};
1184 	u32 bitmap;
1185 	char buf[64];
1186 
1187 	if (!len || len > sizeof(buf) - 1)
1188 		return -EINVAL;
1189 
1190 	if (copy_from_user(buf, ubuf, len))
1191 		return -EFAULT;
1192 	buf[len] = '\0';
1193 
1194 	if (sscanf(buf, "%u %i", &arg.freq_mhz, &bitmap) != 2)
1195 		return -EINVAL;
1196 
1197 	if (!arg.freq_mhz)
1198 		return -EINVAL;
1199 
1200 	ieee80211_iter_chan_contexts_atomic(data->hw,
1201 					    hwsim_6ghz_chanctx_iter,
1202 					    &arg);
1203 
1204 	if (!arg.conf)
1205 		return -EINVAL;
1206 
1207 	cfg80211_incumbent_signal_notify(data->hw->wiphy,
1208 					 &arg.conf->def,
1209 					 bitmap,
1210 					 GFP_KERNEL);
1211 
1212 	return len;
1213 }
1214 
1215 static const struct file_operations hwsim_simulate_incumbent_signal_fops = {
1216 	.owner	= THIS_MODULE,
1217 	.open	= simple_open,
1218 	.write	= hwsim_simulate_incumbent_signal_write,
1219 };
1220 
1221 static int hwsim_fops_group_read(void *dat, u64 *val)
1222 {
1223 	struct mac80211_hwsim_data *data = dat;
1224 	*val = data->group;
1225 	return 0;
1226 }
1227 
1228 static int hwsim_fops_group_write(void *dat, u64 val)
1229 {
1230 	struct mac80211_hwsim_data *data = dat;
1231 	data->group = val;
1232 	return 0;
1233 }
1234 
1235 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_group,
1236 			 hwsim_fops_group_read, hwsim_fops_group_write,
1237 			 "%llx\n");
1238 
1239 static int hwsim_fops_rx_rssi_read(void *dat, u64 *val)
1240 {
1241 	struct mac80211_hwsim_data *data = dat;
1242 	*val = data->rx_rssi;
1243 	return 0;
1244 }
1245 
1246 static int hwsim_fops_rx_rssi_write(void *dat, u64 val)
1247 {
1248 	struct mac80211_hwsim_data *data = dat;
1249 	int rssi = (int)val;
1250 
1251 	if (rssi >= 0 || rssi < -100)
1252 		return -EINVAL;
1253 
1254 	data->rx_rssi = rssi;
1255 	return 0;
1256 }
1257 
1258 DEFINE_DEBUGFS_ATTRIBUTE(hwsim_fops_rx_rssi,
1259 			 hwsim_fops_rx_rssi_read, hwsim_fops_rx_rssi_write,
1260 			 "%lld\n");
1261 
1262 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
1263 					struct net_device *dev)
1264 {
1265 	/* TODO: allow packet injection */
1266 	dev_kfree_skb(skb);
1267 	return NETDEV_TX_OK;
1268 }
1269 
1270 static inline u64 mac80211_hwsim_get_sim_tsf(void)
1271 {
1272 	return ktime_to_us(ktime_get_boottime());
1273 }
1274 
1275 ktime_t mac80211_hwsim_tsf_to_boottime(struct mac80211_hwsim_data *data,
1276 				       u64 tsf)
1277 {
1278 	scoped_guard(spinlock_bh, &data->tsf_offset_lock) {
1279 		return us_to_ktime(tsf - data->tsf_offset);
1280 	}
1281 }
1282 
1283 u64 mac80211_hwsim_boottime_to_tsf(struct mac80211_hwsim_data *data,
1284 				   ktime_t ts)
1285 {
1286 	scoped_guard(spinlock_bh, &data->tsf_offset_lock) {
1287 		return ktime_to_us(ts) + data->tsf_offset;
1288 	}
1289 }
1290 
1291 u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
1292 			   struct ieee80211_vif *vif)
1293 {
1294 	struct mac80211_hwsim_data *data = hw->priv;
1295 	u64 sim_time = mac80211_hwsim_get_sim_tsf();
1296 
1297 	scoped_guard(spinlock_bh, &data->tsf_offset_lock) {
1298 		return sim_time + data->tsf_offset;
1299 	}
1300 }
1301 
1302 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
1303 {
1304 	u64 sim_time = mac80211_hwsim_get_sim_tsf();
1305 
1306 	scoped_guard(spinlock_bh, &data->tsf_offset_lock) {
1307 		return cpu_to_le64(sim_time + data->tsf_offset);
1308 	}
1309 }
1310 
1311 static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
1312 		struct ieee80211_vif *vif, u64 tsf)
1313 {
1314 	struct mac80211_hwsim_data *data = hw->priv;
1315 	u64 now = mac80211_hwsim_get_tsf(hw, vif);
1316 	u64 delta = abs(tsf - now);
1317 	struct ieee80211_bss_conf *conf;
1318 
1319 	conf = link_conf_dereference_protected(vif, data->link_data[0].link_id);
1320 	if (conf && !conf->enable_beacon)
1321 		return;
1322 
1323 	scoped_guard(spinlock_bh, &data->tsf_offset_lock) {
1324 		/* adjust after beaconing with new timestamp at old TBTT */
1325 		if (tsf > now)
1326 			data->tsf_offset += delta;
1327 		else
1328 			data->tsf_offset -= delta;
1329 	}
1330 }
1331 
1332 static struct ieee80211_rate *
1333 mac80211_hwsim_get_tx_rate(struct ieee80211_hw *hw,
1334 			   struct ieee80211_tx_info *info)
1335 {
1336 	if (info->control.rates[0].flags &
1337 	    (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
1338 		return NULL;
1339 
1340 	return ieee80211_get_tx_rate(hw, info);
1341 }
1342 
1343 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
1344 				      struct sk_buff *tx_skb,
1345 				      u32 freq)
1346 {
1347 	struct mac80211_hwsim_data *data = hw->priv;
1348 	struct sk_buff *skb;
1349 	struct hwsim_radiotap_hdr *hdr;
1350 	u16 flags, bitrate;
1351 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_skb);
1352 	struct ieee80211_rate *txrate = mac80211_hwsim_get_tx_rate(hw, info);
1353 
1354 	if (!txrate)
1355 		bitrate = 0;
1356 	else
1357 		bitrate = txrate->bitrate;
1358 
1359 	if (!netif_running(hwsim_mon))
1360 		return;
1361 
1362 	skb = skb_copy_expand(tx_skb, sizeof(*hdr), 0, GFP_ATOMIC);
1363 	if (skb == NULL)
1364 		return;
1365 
1366 	hdr = skb_push(skb, sizeof(*hdr));
1367 	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1368 	hdr->hdr.it_pad = 0;
1369 	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1370 	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1371 					  (1 << IEEE80211_RADIOTAP_RATE) |
1372 					  (1 << IEEE80211_RADIOTAP_TSFT) |
1373 					  (1 << IEEE80211_RADIOTAP_CHANNEL));
1374 	hdr->rt_tsft = __mac80211_hwsim_get_tsf(data);
1375 	hdr->rt_flags = 0;
1376 	hdr->rt_rate = bitrate / 5;
1377 	hdr->rt_channel = cpu_to_le16(freq);
1378 	flags = IEEE80211_CHAN_2GHZ;
1379 	if (txrate && txrate->flags & IEEE80211_RATE_ERP_G)
1380 		flags |= IEEE80211_CHAN_OFDM;
1381 	else
1382 		flags |= IEEE80211_CHAN_CCK;
1383 	hdr->rt_chbitmask = cpu_to_le16(flags);
1384 
1385 	skb->dev = hwsim_mon;
1386 	skb_reset_mac_header(skb);
1387 	skb->ip_summed = CHECKSUM_UNNECESSARY;
1388 	skb->pkt_type = PACKET_OTHERHOST;
1389 	skb->protocol = htons(ETH_P_802_2);
1390 	memset(skb->cb, 0, sizeof(skb->cb));
1391 	netif_rx(skb);
1392 }
1393 
1394 
1395 static void mac80211_hwsim_monitor_ack(u32 freq, const u8 *addr)
1396 {
1397 	struct sk_buff *skb;
1398 	struct hwsim_radiotap_ack_hdr *hdr;
1399 	u16 flags;
1400 	struct ieee80211_hdr *hdr11;
1401 
1402 	if (!netif_running(hwsim_mon))
1403 		return;
1404 
1405 	skb = dev_alloc_skb(100);
1406 	if (skb == NULL)
1407 		return;
1408 
1409 	hdr = skb_put(skb, sizeof(*hdr));
1410 	hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
1411 	hdr->hdr.it_pad = 0;
1412 	hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
1413 	hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1414 					  (1 << IEEE80211_RADIOTAP_CHANNEL));
1415 	hdr->rt_flags = 0;
1416 	hdr->pad = 0;
1417 	hdr->rt_channel = cpu_to_le16(freq);
1418 	flags = IEEE80211_CHAN_2GHZ;
1419 	hdr->rt_chbitmask = cpu_to_le16(flags);
1420 
1421 	hdr11 = skb_put(skb, 10);
1422 	hdr11->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
1423 					   IEEE80211_STYPE_ACK);
1424 	hdr11->duration_id = cpu_to_le16(0);
1425 	memcpy(hdr11->addr1, addr, ETH_ALEN);
1426 
1427 	skb->dev = hwsim_mon;
1428 	skb_reset_mac_header(skb);
1429 	skb->ip_summed = CHECKSUM_UNNECESSARY;
1430 	skb->pkt_type = PACKET_OTHERHOST;
1431 	skb->protocol = htons(ETH_P_802_2);
1432 	memset(skb->cb, 0, sizeof(skb->cb));
1433 	netif_rx(skb);
1434 }
1435 
1436 struct mac80211_hwsim_addr_match_data {
1437 	u8 addr[ETH_ALEN];
1438 	bool ret;
1439 };
1440 
1441 static void mac80211_hwsim_addr_iter(void *data, u8 *mac,
1442 				     struct ieee80211_vif *vif)
1443 {
1444 	int i;
1445 	struct mac80211_hwsim_addr_match_data *md = data;
1446 
1447 	if (memcmp(mac, md->addr, ETH_ALEN) == 0) {
1448 		md->ret = true;
1449 		return;
1450 	}
1451 
1452 	/* Match the link address */
1453 	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1454 		struct ieee80211_bss_conf *conf;
1455 
1456 		conf = rcu_dereference(vif->link_conf[i]);
1457 		if (!conf)
1458 			continue;
1459 
1460 		if (memcmp(conf->addr, md->addr, ETH_ALEN) == 0) {
1461 			md->ret = true;
1462 			return;
1463 		}
1464 	}
1465 }
1466 
1467 static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
1468 				      const u8 *addr)
1469 {
1470 	struct mac80211_hwsim_addr_match_data md = {
1471 		.ret = false,
1472 	};
1473 
1474 	if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
1475 		return true;
1476 
1477 	memcpy(md.addr, addr, ETH_ALEN);
1478 
1479 	ieee80211_iterate_active_interfaces_atomic(data->hw,
1480 						   IEEE80211_IFACE_ITER_NORMAL,
1481 						   mac80211_hwsim_addr_iter,
1482 						   &md);
1483 
1484 	return md.ret;
1485 }
1486 
1487 static bool hwsim_ps_rx_ok(struct mac80211_hwsim_data *data,
1488 			   struct sk_buff *skb)
1489 {
1490 	switch (data->ps) {
1491 	case PS_DISABLED:
1492 		return true;
1493 	case PS_ENABLED:
1494 		return false;
1495 	case PS_AUTO_POLL:
1496 		/* TODO: accept (some) Beacons by default and other frames only
1497 		 * if pending PS-Poll has been sent */
1498 		return true;
1499 	case PS_MANUAL_POLL:
1500 		/* Allow unicast frames to own address if there is a pending
1501 		 * PS-Poll */
1502 		if (data->ps_poll_pending &&
1503 		    mac80211_hwsim_addr_match(data, skb->data + 4)) {
1504 			data->ps_poll_pending = false;
1505 			return true;
1506 		}
1507 		return false;
1508 	}
1509 
1510 	return true;
1511 }
1512 
1513 static int hwsim_unicast_netgroup(struct mac80211_hwsim_data *data,
1514 				  struct sk_buff *skb, int portid)
1515 {
1516 	struct net *net;
1517 	bool found = false;
1518 	int res = -ENOENT;
1519 
1520 	rcu_read_lock();
1521 	for_each_net_rcu(net) {
1522 		if (data->netgroup == hwsim_net_get_netgroup(net)) {
1523 			res = genlmsg_unicast(net, skb, portid);
1524 			found = true;
1525 			break;
1526 		}
1527 	}
1528 	rcu_read_unlock();
1529 
1530 	if (!found)
1531 		nlmsg_free(skb);
1532 
1533 	return res;
1534 }
1535 
1536 static void mac80211_hwsim_config_mac_nl(struct ieee80211_hw *hw,
1537 					 const u8 *addr, bool add)
1538 {
1539 	struct mac80211_hwsim_data *data = hw->priv;
1540 	u32 _portid = READ_ONCE(data->wmediumd);
1541 	struct sk_buff *skb;
1542 	void *msg_head;
1543 
1544 	WARN_ON(!is_valid_ether_addr(addr));
1545 
1546 	if (!_portid && !hwsim_virtio_enabled)
1547 		return;
1548 
1549 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1550 	if (!skb)
1551 		return;
1552 
1553 	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1554 			       add ? HWSIM_CMD_ADD_MAC_ADDR :
1555 				     HWSIM_CMD_DEL_MAC_ADDR);
1556 	if (!msg_head) {
1557 		pr_debug("mac80211_hwsim: problem with msg_head\n");
1558 		goto nla_put_failure;
1559 	}
1560 
1561 	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1562 		    ETH_ALEN, data->addresses[1].addr))
1563 		goto nla_put_failure;
1564 
1565 	if (nla_put(skb, HWSIM_ATTR_ADDR_RECEIVER, ETH_ALEN, addr))
1566 		goto nla_put_failure;
1567 
1568 	genlmsg_end(skb, msg_head);
1569 
1570 	if (hwsim_virtio_enabled)
1571 		hwsim_tx_virtio(data, skb);
1572 	else
1573 		hwsim_unicast_netgroup(data, skb, _portid);
1574 	return;
1575 nla_put_failure:
1576 	nlmsg_free(skb);
1577 }
1578 
1579 static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
1580 {
1581 	u16 result = 0;
1582 
1583 	if (rate->flags & IEEE80211_TX_RC_USE_RTS_CTS)
1584 		result |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;
1585 	if (rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
1586 		result |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;
1587 	if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
1588 		result |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;
1589 	if (rate->flags & IEEE80211_TX_RC_MCS)
1590 		result |= MAC80211_HWSIM_TX_RC_MCS;
1591 	if (rate->flags & IEEE80211_TX_RC_GREEN_FIELD)
1592 		result |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;
1593 	if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1594 		result |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;
1595 	if (rate->flags & IEEE80211_TX_RC_DUP_DATA)
1596 		result |= MAC80211_HWSIM_TX_RC_DUP_DATA;
1597 	if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
1598 		result |= MAC80211_HWSIM_TX_RC_SHORT_GI;
1599 	if (rate->flags & IEEE80211_TX_RC_VHT_MCS)
1600 		result |= MAC80211_HWSIM_TX_RC_VHT_MCS;
1601 	if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1602 		result |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;
1603 	if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1604 		result |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;
1605 
1606 	return result;
1607 }
1608 
1609 static void mac80211_hwsim_write_tsf(struct mac80211_hwsim_data *data,
1610 				     struct sk_buff *skb, u64 sim_time)
1611 {
1612 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1613 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1614 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
1615 	struct ieee80211_rate *txrate;
1616 	/* TODO: get MCS */
1617 	int bitrate = 100;
1618 
1619 	spin_lock_bh(&data->tsf_offset_lock);
1620 
1621 	txrate = mac80211_hwsim_get_tx_rate(data->hw, info);
1622 	if (txrate)
1623 		bitrate = txrate->bitrate;
1624 
1625 	if (skb->len >= offsetofend(typeof(*mgmt), u.probe_resp.timestamp) &&
1626 	    ieee80211_is_probe_resp(hdr->frame_control)) {
1627 		mgmt->u.probe_resp.timestamp =
1628 			cpu_to_le64(sim_time + data->tsf_offset +
1629 				    24 * 8 * 10 / bitrate);
1630 	} else if (skb->len >= offsetofend(typeof(*mgmt), u.beacon.timestamp) &&
1631 		   ieee80211_is_beacon(mgmt->frame_control)) {
1632 		mgmt->u.beacon.timestamp = cpu_to_le64(sim_time +
1633 						       data->tsf_offset +
1634 						       24 * 8 * 10 /
1635 						       bitrate);
1636 	} else if (skb->len >= offsetofend(struct ieee80211_ext,
1637 					   u.s1g_beacon.timestamp) &&
1638 		   ieee80211_is_s1g_beacon(mgmt->frame_control)) {
1639 		struct ieee80211_ext *ext = (void *)mgmt;
1640 
1641 		ext->u.s1g_beacon.timestamp = cpu_to_le32(sim_time +
1642 							  data->tsf_offset +
1643 							  10 * 8 * 10 /
1644 							  bitrate);
1645 	}
1646 
1647 	spin_unlock_bh(&data->tsf_offset_lock);
1648 }
1649 
1650 static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
1651 				       struct sk_buff *my_skb,
1652 				       int dst_portid,
1653 				       struct ieee80211_channel *channel)
1654 {
1655 	struct sk_buff *skb;
1656 	struct mac80211_hwsim_data *data = hw->priv;
1657 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) my_skb->data;
1658 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(my_skb);
1659 	void *msg_head;
1660 	unsigned int hwsim_flags = 0;
1661 	int i;
1662 	struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES];
1663 	struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES];
1664 	uintptr_t cookie;
1665 	u64 sim_tsf;
1666 
1667 	if (data->ps != PS_DISABLED)
1668 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1669 	/* If the queue contains MAX_QUEUE skb's drop some */
1670 	if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
1671 		/* Dropping until WARN_QUEUE level */
1672 		while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
1673 			ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
1674 			data->tx_dropped++;
1675 		}
1676 	}
1677 
1678 	sim_tsf = mac80211_hwsim_get_sim_tsf();
1679 	mac80211_hwsim_write_tsf(data, my_skb, sim_tsf);
1680 
1681 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1682 	if (skb == NULL)
1683 		goto nla_put_failure;
1684 
1685 	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
1686 			       HWSIM_CMD_FRAME);
1687 	if (msg_head == NULL) {
1688 		pr_debug("mac80211_hwsim: problem with msg_head\n");
1689 		goto nla_put_failure;
1690 	}
1691 
1692 	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
1693 		    ETH_ALEN, data->addresses[1].addr))
1694 		goto nla_put_failure;
1695 
1696 	/* We get the skb->data */
1697 	if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
1698 		goto nla_put_failure;
1699 
1700 	/* We get the flags for this transmission, and we translate them to
1701 	   wmediumd flags  */
1702 
1703 	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)
1704 		hwsim_flags |= HWSIM_TX_CTL_REQ_TX_STATUS;
1705 
1706 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
1707 		hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
1708 
1709 	if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
1710 		goto nla_put_failure;
1711 
1712 	if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
1713 		goto nla_put_failure;
1714 
1715 	/* We get the tx control (rate and retries) info*/
1716 
1717 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
1718 		tx_attempts[i].idx = info->status.rates[i].idx;
1719 		tx_attempts_flags[i].idx = info->status.rates[i].idx;
1720 		tx_attempts[i].count = info->status.rates[i].count;
1721 		tx_attempts_flags[i].flags =
1722 				trans_tx_rate_flags_ieee2hwsim(
1723 						&info->status.rates[i]);
1724 	}
1725 
1726 	if (nla_put(skb, HWSIM_ATTR_TX_INFO,
1727 		    sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
1728 		    tx_attempts))
1729 		goto nla_put_failure;
1730 
1731 	if (nla_put(skb, HWSIM_ATTR_TX_INFO_FLAGS,
1732 		    sizeof(struct hwsim_tx_rate_flag) * IEEE80211_TX_MAX_RATES,
1733 		    tx_attempts_flags))
1734 		goto nla_put_failure;
1735 
1736 	/* We create a cookie to identify this skb */
1737 	cookie = atomic_inc_return(&data->pending_cookie);
1738 	info->rate_driver_data[0] = (void *)cookie;
1739 	if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
1740 		goto nla_put_failure;
1741 
1742 	/* track the frequency */
1743 	info->rate_driver_data[1] = (void *)(uintptr_t)channel->center_freq;
1744 
1745 	genlmsg_end(skb, msg_head);
1746 
1747 	if (hwsim_virtio_enabled) {
1748 		if (hwsim_tx_virtio(data, skb))
1749 			goto err_free_txskb;
1750 	} else {
1751 		if (hwsim_unicast_netgroup(data, skb, dst_portid))
1752 			goto err_free_txskb;
1753 	}
1754 
1755 	/* Enqueue the packet */
1756 	skb_queue_tail(&data->pending, my_skb);
1757 	data->tx_pkts++;
1758 	data->tx_bytes += my_skb->len;
1759 	return;
1760 
1761 nla_put_failure:
1762 	nlmsg_free(skb);
1763 err_free_txskb:
1764 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
1765 	ieee80211_free_txskb(hw, my_skb);
1766 	data->tx_failed++;
1767 }
1768 
1769 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
1770 			       struct ieee80211_channel *c2)
1771 {
1772 	if (!c1 || !c2)
1773 		return false;
1774 
1775 	return c1->center_freq == c2->center_freq;
1776 }
1777 
1778 struct tx_iter_data {
1779 	struct ieee80211_channel *channel;
1780 	struct ieee80211_rx_status *rx_status;
1781 	struct ieee80211_hw *hw;
1782 	struct sk_buff *skb;
1783 	bool receive;
1784 };
1785 
1786 static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
1787 				   struct ieee80211_vif *vif)
1788 {
1789 	struct tx_iter_data *data = _data;
1790 	int i;
1791 
1792 	if (vif->type == NL80211_IFTYPE_NAN ||
1793 	    vif->type == NL80211_IFTYPE_NAN_DATA) {
1794 		data->receive = mac80211_hwsim_nan_receive(data->hw,
1795 							   data->skb,
1796 							   data->channel,
1797 							   data->rx_status);
1798 		return;
1799 	}
1800 
1801 	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
1802 		struct ieee80211_bss_conf *conf;
1803 		struct ieee80211_chanctx_conf *chanctx;
1804 
1805 		conf = rcu_dereference(vif->link_conf[i]);
1806 		if (!conf)
1807 			continue;
1808 
1809 		chanctx = rcu_dereference(conf->chanctx_conf);
1810 		if (!chanctx)
1811 			continue;
1812 
1813 		if (!hwsim_chans_compat(data->channel, chanctx->def.chan))
1814 			continue;
1815 
1816 		data->receive = true;
1817 		return;
1818 	}
1819 }
1820 
1821 static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
1822 {
1823 	/*
1824 	 * To enable this code, #define the HWSIM_RADIOTAP_OUI,
1825 	 * e.g. like this:
1826 	 * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
1827 	 * (but you should use a valid OUI, not that)
1828 	 *
1829 	 * If anyone wants to 'donate' a radiotap OUI/subns code
1830 	 * please send a patch removing this #ifdef and changing
1831 	 * the values accordingly.
1832 	 */
1833 #ifdef HWSIM_RADIOTAP_OUI
1834 	struct ieee80211_radiotap_vendor_tlv *rtap;
1835 	static const char vendor_data[8] = "ABCDEFGH";
1836 
1837 	// Make sure no padding is needed
1838 	BUILD_BUG_ON(sizeof(vendor_data) % 4);
1839 	/* this is last radiotap info before the mac header, so
1840 	 * skb_reset_mac_header for mac8022 to know the end of
1841 	 * the radiotap TLV/beginning of the 802.11 header
1842 	 */
1843 	skb_reset_mac_header(skb);
1844 
1845 	/*
1846 	 * Note that this code requires the headroom in the SKB
1847 	 * that was allocated earlier.
1848 	 */
1849 	rtap = skb_push(skb, sizeof(*rtap) + sizeof(vendor_data));
1850 
1851 	rtap->len = cpu_to_le16(sizeof(*rtap) -
1852 				sizeof(struct ieee80211_radiotap_tlv) +
1853 				sizeof(vendor_data));
1854 	rtap->type = cpu_to_le16(IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
1855 
1856 	rtap->content.oui[0] = HWSIM_RADIOTAP_OUI[0];
1857 	rtap->content.oui[1] = HWSIM_RADIOTAP_OUI[1];
1858 	rtap->content.oui[2] = HWSIM_RADIOTAP_OUI[2];
1859 	rtap->content.oui_subtype = 127;
1860 	/* clear reserved field */
1861 	rtap->content.reserved = 0;
1862 	rtap->content.vendor_type = 0;
1863 	memcpy(rtap->content.data, vendor_data, sizeof(vendor_data));
1864 
1865 	IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_TLV_AT_END;
1866 #endif
1867 }
1868 
1869 static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
1870 			      struct ieee80211_rx_status *rx_status,
1871 			      struct sk_buff *skb)
1872 {
1873 	struct ieee80211_hdr *hdr = (void *)skb->data;
1874 
1875 	if (!ieee80211_has_morefrags(hdr->frame_control) &&
1876 	    !is_multicast_ether_addr(hdr->addr1) &&
1877 	    (ieee80211_is_mgmt(hdr->frame_control) ||
1878 	     ieee80211_is_data(hdr->frame_control))) {
1879 		struct ieee80211_sta *sta;
1880 		unsigned int link_id;
1881 
1882 		rcu_read_lock();
1883 		sta = ieee80211_find_sta_by_link_addrs(data->hw, hdr->addr2,
1884 						       hdr->addr1, &link_id);
1885 		if (sta) {
1886 			struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
1887 
1888 			if (ieee80211_has_pm(hdr->frame_control))
1889 				sp->active_links_rx &= ~BIT(link_id);
1890 			else
1891 				sp->active_links_rx |= BIT(link_id);
1892 		}
1893 		rcu_read_unlock();
1894 	}
1895 
1896 	memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
1897 
1898 	mac80211_hwsim_add_vendor_rtap(skb);
1899 
1900 	if (data->nan.device_vif)
1901 		mac80211_hwsim_nan_rx(data->hw, skb);
1902 
1903 	data->rx_pkts++;
1904 	data->rx_bytes += skb->len;
1905 	ieee80211_rx_irqsafe(data->hw, skb);
1906 }
1907 
1908 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
1909 					  struct sk_buff *skb,
1910 					  struct ieee80211_channel *chan)
1911 {
1912 	struct mac80211_hwsim_data *data = hw->priv, *data2;
1913 	bool ack = false;
1914 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1915 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1916 	struct ieee80211_rx_status rx_status;
1917 	u64 sim_tsf = mac80211_hwsim_get_sim_tsf();
1918 
1919 	mac80211_hwsim_write_tsf(data, skb, sim_tsf);
1920 
1921 	mac80211_hwsim_monitor_rx(hw, skb, chan->center_freq);
1922 
1923 	memset(&rx_status, 0, sizeof(rx_status));
1924 	rx_status.flag |= RX_FLAG_MACTIME_START;
1925 	rx_status.freq = chan->center_freq;
1926 	rx_status.freq_offset = chan->freq_offset ? 1 : 0;
1927 	rx_status.band = chan->band;
1928 	if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
1929 		rx_status.rate_idx =
1930 			ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
1931 		rx_status.nss =
1932 			ieee80211_rate_get_vht_nss(&info->control.rates[0]);
1933 		rx_status.encoding = RX_ENC_VHT;
1934 	} else {
1935 		rx_status.rate_idx = info->control.rates[0].idx;
1936 		if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
1937 			rx_status.encoding = RX_ENC_HT;
1938 	}
1939 	if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
1940 		rx_status.bw = RATE_INFO_BW_40;
1941 	else if (info->control.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
1942 		rx_status.bw = RATE_INFO_BW_80;
1943 	else if (info->control.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
1944 		rx_status.bw = RATE_INFO_BW_160;
1945 	else
1946 		rx_status.bw = RATE_INFO_BW_20;
1947 	if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
1948 		rx_status.enc_flags |= RX_ENC_FLAG_SHORT_GI;
1949 	/* TODO: simulate optional packet loss */
1950 	rx_status.signal = data->rx_rssi;
1951 	if (info->control.vif)
1952 		rx_status.signal += info->control.vif->bss_conf.txpower;
1953 
1954 	if (data->ps != PS_DISABLED)
1955 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1956 
1957 	/* release the skb's source info */
1958 	skb_orphan(skb);
1959 	skb_dst_drop(skb);
1960 	skb->mark = 0;
1961 	skb_ext_reset(skb);
1962 	nf_reset_ct(skb);
1963 
1964 	if (ieee80211_is_beacon(hdr->frame_control) ||
1965 	    ieee80211_is_probe_resp(hdr->frame_control))
1966 		rx_status.boottime_ns = ktime_get_boottime_ns();
1967 
1968 	/* Copy skb to all enabled radios that are on the current frequency */
1969 	spin_lock(&hwsim_radio_lock);
1970 	list_for_each_entry(data2, &hwsim_radios, list) {
1971 		struct sk_buff *nskb;
1972 		struct tx_iter_data tx_iter_data = {
1973 			.receive = false,
1974 			.hw = data2->hw,
1975 			.channel = chan,
1976 			.rx_status = &rx_status,
1977 			.skb = skb,
1978 		};
1979 
1980 		if (data == data2)
1981 			continue;
1982 
1983 		if (!data2->started || (data2->idle && !data2->tmp_chan) ||
1984 		    !hwsim_ps_rx_ok(data2, skb))
1985 			continue;
1986 
1987 		if (!(data->group & data2->group))
1988 			continue;
1989 
1990 		if (data->netgroup != data2->netgroup)
1991 			continue;
1992 
1993 		/*
1994 		 * Set mactime early since NAN RX filtering relies on it
1995 		 * for slot calculation
1996 		 */
1997 		rx_status.mactime = sim_tsf + data2->tsf_offset;
1998 
1999 		if (!hwsim_chans_compat(chan, data2->tmp_chan) &&
2000 		    !hwsim_chans_compat(chan, data2->channel)) {
2001 			ieee80211_iterate_active_interfaces_atomic(
2002 				data2->hw, IEEE80211_IFACE_ITER_NORMAL,
2003 				mac80211_hwsim_tx_iter, &tx_iter_data);
2004 			if (!tx_iter_data.receive)
2005 				continue;
2006 		}
2007 
2008 		/*
2009 		 * reserve some space for our vendor and the normal
2010 		 * radiotap header, since we're copying anyway
2011 		 */
2012 		if (skb->len < PAGE_SIZE && paged_rx) {
2013 			struct page *page = alloc_page(GFP_ATOMIC);
2014 
2015 			if (!page)
2016 				continue;
2017 
2018 			nskb = dev_alloc_skb(128);
2019 			if (!nskb) {
2020 				__free_page(page);
2021 				continue;
2022 			}
2023 
2024 			memcpy(page_address(page), skb->data, skb->len);
2025 			skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
2026 		} else {
2027 			nskb = skb_copy(skb, GFP_ATOMIC);
2028 			if (!nskb)
2029 				continue;
2030 		}
2031 
2032 		if (mac80211_hwsim_addr_match(data2, hdr->addr1))
2033 			ack = true;
2034 
2035 		mac80211_hwsim_rx(data2, &rx_status, nskb);
2036 	}
2037 	spin_unlock(&hwsim_radio_lock);
2038 
2039 	return ack;
2040 }
2041 
2042 static struct ieee80211_bss_conf *
2043 mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
2044 			      struct ieee80211_vif *vif,
2045 			      struct ieee80211_sta *sta,
2046 			      struct ieee80211_hdr *hdr,
2047 			      struct ieee80211_link_sta **link_sta)
2048 {
2049 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2050 	int i;
2051 
2052 	if (!ieee80211_vif_is_mld(vif))
2053 		return &vif->bss_conf;
2054 
2055 	WARN_ON(is_multicast_ether_addr(hdr->addr1));
2056 
2057 	if (WARN_ON_ONCE(!sta || !sta->valid_links))
2058 		return &vif->bss_conf;
2059 
2060 	for (i = 0; i < ARRAY_SIZE(vif->link_conf); i++) {
2061 		struct ieee80211_bss_conf *bss_conf;
2062 		unsigned int link_id;
2063 
2064 		/* round-robin the available link IDs */
2065 		link_id = (sp->last_link + i + 1) % ARRAY_SIZE(vif->link_conf);
2066 
2067 		if (!(vif->active_links & BIT(link_id)))
2068 			continue;
2069 
2070 		if (!(sp->active_links_rx & BIT(link_id)))
2071 			continue;
2072 
2073 		*link_sta = rcu_dereference(sta->link[link_id]);
2074 		if (!*link_sta)
2075 			continue;
2076 
2077 		bss_conf = rcu_dereference(vif->link_conf[link_id]);
2078 		if (WARN_ON_ONCE(!bss_conf))
2079 			continue;
2080 
2081 		/* can happen while switching links */
2082 		if (!rcu_access_pointer(bss_conf->chanctx_conf))
2083 			continue;
2084 
2085 		sp->last_link = link_id;
2086 		return bss_conf;
2087 	}
2088 
2089 	return NULL;
2090 }
2091 
2092 static int mac80211_hwsim_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
2093 				  struct ieee80211_vif *vif,
2094 				  struct ieee80211_sta *sta,
2095 				  struct ieee80211_key_conf *key)
2096 {
2097 	switch (key->cipher) {
2098 	case WLAN_CIPHER_SUITE_CCMP:
2099 	case WLAN_CIPHER_SUITE_CCMP_256:
2100 	case WLAN_CIPHER_SUITE_GCMP:
2101 	case WLAN_CIPHER_SUITE_GCMP_256:
2102 		break;
2103 	default:
2104 		return 1;
2105 	}
2106 
2107 	key->flags |= IEEE80211_KEY_FLAG_RESERVE_TAILROOM;
2108 	return 0;
2109 }
2110 
2111 static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
2112 			      struct ieee80211_tx_control *control,
2113 			      struct sk_buff *skb)
2114 {
2115 	struct mac80211_hwsim_data *data = hw->priv;
2116 	struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2117 	struct ieee80211_hdr *hdr = (void *)skb->data;
2118 	struct ieee80211_chanctx_conf *chanctx_conf;
2119 	struct ieee80211_channel *channel;
2120 	struct ieee80211_vif *vif = txi->control.vif;
2121 	bool ack, unicast_data;
2122 	enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2123 	u32 _portid, i;
2124 	int tx_link_id = -1;
2125 
2126 	if (WARN_ON(skb->len < 10)) {
2127 		/* Should not happen; just a sanity check for addr1 use */
2128 		ieee80211_free_txskb(hw, skb);
2129 		return;
2130 	}
2131 
2132 	unicast_data = is_unicast_ether_addr(hdr->addr1) &&
2133 		       ieee80211_is_data(hdr->frame_control);
2134 
2135 	if (unicast_data && ieee80211_encrypt_tx_skb(skb) < 0) {
2136 		ieee80211_free_txskb(hw, skb);
2137 		return;
2138 	}
2139 	/* re-assign hdr since skb data may have shifted after encryption */
2140 	hdr = (void *)skb->data;
2141 
2142 	if (vif && !data->tmp_chan &&
2143 	    (vif->type == NL80211_IFTYPE_NAN ||
2144 	     vif->type == NL80211_IFTYPE_NAN_DATA)) {
2145 		struct cfg80211_chan_def chandef;
2146 
2147 		mac80211_hwsim_nan_get_tx_chandef(hw, &chandef);
2148 		if (WARN_ON(!chandef.chan)) {
2149 			/* No valid channel in current slot, drop frame */
2150 			ieee80211_free_txskb(hw, skb);
2151 			return;
2152 		}
2153 		channel = chandef.chan;
2154 		confbw = chandef.width;
2155 	} else if (!data->use_chanctx) {
2156 		channel = data->channel;
2157 		confbw = data->bw;
2158 	} else if (txi->hw_queue == 4) {
2159 		channel = data->tmp_chan;
2160 	} else {
2161 		u8 link = u32_get_bits(IEEE80211_SKB_CB(skb)->control.flags,
2162 				       IEEE80211_TX_CTRL_MLO_LINK);
2163 		struct ieee80211_link_sta *link_sta = NULL;
2164 		struct ieee80211_sta *sta = control->sta;
2165 		struct ieee80211_bss_conf *bss_conf;
2166 
2167 		/* This can happen in case of monitor injection */
2168 		if (!vif) {
2169 			ieee80211_free_txskb(hw, skb);
2170 			return;
2171 		}
2172 
2173 		if (link != IEEE80211_LINK_UNSPECIFIED) {
2174 			bss_conf = rcu_dereference(vif->link_conf[link]);
2175 			if (sta)
2176 				link_sta = rcu_dereference(sta->link[link]);
2177 		} else {
2178 			bss_conf = mac80211_hwsim_select_tx_link(data, vif, sta,
2179 								 hdr, &link_sta);
2180 		}
2181 
2182 		if (bss_conf)
2183 			tx_link_id = bss_conf->link_id;
2184 
2185 		if (unlikely(!bss_conf)) {
2186 			/* if it's an MLO STA, it might have deactivated all
2187 			 * links temporarily - but we don't handle real PS in
2188 			 * this code yet, so just drop the frame in that case
2189 			 */
2190 			WARN(link != IEEE80211_LINK_UNSPECIFIED || !sta || !sta->mlo,
2191 			     "link:%d, sta:%pM, sta->mlo:%d\n",
2192 			     link, sta ? sta->addr : NULL, sta ? sta->mlo : -1);
2193 			ieee80211_free_txskb(hw, skb);
2194 			return;
2195 		}
2196 
2197 		/* Do address translations only between shared links. It is
2198 		 * possible that while an non-AP MLD station and an AP MLD
2199 		 * station have shared links, the frame is intended to be sent
2200 		 * on a link which is not shared (for example when sending a
2201 		 * probe response).
2202 		 */
2203 		if (sta && sta->mlo && link_sta) {
2204 			/* address translation to link addresses on TX */
2205 			ether_addr_copy(hdr->addr1, link_sta->addr);
2206 			ether_addr_copy(hdr->addr2, bss_conf->addr);
2207 			/* translate A3 only if it's the BSSID */
2208 			if (!ieee80211_has_tods(hdr->frame_control) &&
2209 			    !ieee80211_has_fromds(hdr->frame_control)) {
2210 				if (ether_addr_equal(hdr->addr3, sta->addr))
2211 					ether_addr_copy(hdr->addr3, link_sta->addr);
2212 				else if (ether_addr_equal(hdr->addr3, vif->addr))
2213 					ether_addr_copy(hdr->addr3, bss_conf->addr);
2214 			}
2215 			/* no need to look at A4, if present it's SA */
2216 		}
2217 
2218 		chanctx_conf = rcu_dereference(bss_conf->chanctx_conf);
2219 		if (chanctx_conf) {
2220 			channel = chanctx_conf->def.chan;
2221 			confbw = chanctx_conf->def.width;
2222 		} else {
2223 			channel = NULL;
2224 		}
2225 	}
2226 
2227 	if (!unicast_data && ieee80211_encrypt_tx_skb(skb) < 0) {
2228 		ieee80211_free_txskb(hw, skb);
2229 		return;
2230 	}
2231 	/* re-assign hdr since skb data may have shifted after encryption */
2232 	hdr = (void *)skb->data;
2233 
2234 	if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
2235 		ieee80211_free_txskb(hw, skb);
2236 		return;
2237 	}
2238 
2239 	if (data->idle && !data->tmp_chan) {
2240 		wiphy_dbg(hw->wiphy, "Trying to TX when idle - reject\n");
2241 		ieee80211_free_txskb(hw, skb);
2242 		return;
2243 	}
2244 
2245 	if (vif)
2246 		hwsim_check_magic(vif);
2247 	if (control->sta)
2248 		hwsim_check_sta_magic(control->sta);
2249 
2250 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2251 		ieee80211_get_tx_rates(vif, control->sta, skb,
2252 				       txi->control.rates,
2253 				       ARRAY_SIZE(txi->control.rates));
2254 
2255 	for (i = 0; i < ARRAY_SIZE(txi->control.rates); i++) {
2256 		u16 rflags = txi->control.rates[i].flags;
2257 		/* initialize to data->bw for 5/10 MHz handling */
2258 		enum nl80211_chan_width bw = data->bw;
2259 
2260 		if (txi->control.rates[i].idx == -1)
2261 			break;
2262 
2263 		if (rflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
2264 			bw = NL80211_CHAN_WIDTH_40;
2265 		else if (rflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
2266 			bw = NL80211_CHAN_WIDTH_80;
2267 		else if (rflags & IEEE80211_TX_RC_160_MHZ_WIDTH)
2268 			bw = NL80211_CHAN_WIDTH_160;
2269 
2270 		if (WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)))
2271 			return;
2272 	}
2273 
2274 	/* wmediumd mode check */
2275 	_portid = READ_ONCE(data->wmediumd);
2276 
2277 	if (_portid || hwsim_virtio_enabled)
2278 		return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
2279 
2280 	/* NO wmediumd detected, perfect medium simulation */
2281 	data->tx_pkts++;
2282 	data->tx_bytes += skb->len;
2283 	ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
2284 
2285 	if (ack && skb->len >= 16)
2286 		mac80211_hwsim_monitor_ack(channel->center_freq, hdr->addr2);
2287 
2288 	ieee80211_tx_info_clear_status(txi);
2289 
2290 	/* frame was transmitted at most favorable rate at first attempt */
2291 	txi->control.rates[0].count = 1;
2292 	txi->control.rates[1].idx = -1;
2293 
2294 	if (!(txi->flags & IEEE80211_TX_CTL_NO_ACK) && ack)
2295 		txi->flags |= IEEE80211_TX_STAT_ACK;
2296 
2297 	if (tx_link_id >= 0) {
2298 		txi->status.link_valid = 1;
2299 		txi->status.link_id = tx_link_id;
2300 	}
2301 
2302 	ieee80211_tx_status_irqsafe(hw, skb);
2303 }
2304 
2305 void ieee80211_hwsim_wake_tx_queue(struct ieee80211_hw *hw,
2306 				   struct ieee80211_txq *txq)
2307 {
2308 	struct ieee80211_tx_control control = {
2309 		.sta = txq->sta,
2310 	};
2311 	struct sk_buff *skb;
2312 
2313 	if ((txq->vif->type == NL80211_IFTYPE_NAN ||
2314 	     txq->vif->type == NL80211_IFTYPE_NAN_DATA) &&
2315 	    !mac80211_hwsim_nan_txq_transmitting(hw, txq))
2316 		return;
2317 
2318 	while ((skb = ieee80211_tx_dequeue(hw, txq)))
2319 		mac80211_hwsim_tx(hw, &control, skb);
2320 }
2321 
2322 static int mac80211_hwsim_start(struct ieee80211_hw *hw)
2323 {
2324 	struct mac80211_hwsim_data *data = hw->priv;
2325 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
2326 	data->started = true;
2327 	return 0;
2328 }
2329 
2330 
2331 static void mac80211_hwsim_stop(struct ieee80211_hw *hw, bool suspend)
2332 {
2333 	struct mac80211_hwsim_data *data = hw->priv;
2334 	struct sk_buff *skb;
2335 	int i;
2336 
2337 	/*
2338 	 * Serialise against wmediumd userspace, so no more frames
2339 	 * can be handed to mac80211 after this returns.
2340 	 */
2341 	scoped_guard(mutex, &data->mutex)
2342 		data->started = false;
2343 
2344 	for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
2345 		hrtimer_cancel(&data->link_data[i].beacon_timer);
2346 
2347 	while ((skb = skb_dequeue(&data->pending)))
2348 		ieee80211_free_txskb(hw, skb);
2349 
2350 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
2351 }
2352 
2353 
2354 static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,
2355 					struct ieee80211_vif *vif)
2356 {
2357 	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2358 		  __func__, ieee80211_vif_type_p2p(vif),
2359 		  vif->addr);
2360 	hwsim_set_magic(vif);
2361 
2362 	if (vif->type != NL80211_IFTYPE_MONITOR)
2363 		mac80211_hwsim_config_mac_nl(hw, vif->addr, true);
2364 
2365 	vif->cab_queue = 0;
2366 	vif->hw_queue[IEEE80211_AC_VO] = 0;
2367 	vif->hw_queue[IEEE80211_AC_VI] = 1;
2368 	vif->hw_queue[IEEE80211_AC_BE] = 2;
2369 	vif->hw_queue[IEEE80211_AC_BK] = 3;
2370 
2371 	return 0;
2372 }
2373 
2374 #ifdef CONFIG_MAC80211_DEBUGFS
2375 static void
2376 mac80211_hwsim_link_add_debugfs(struct ieee80211_hw *hw,
2377 				struct ieee80211_vif *vif,
2378 				struct ieee80211_bss_conf *link_conf,
2379 				struct dentry *dir)
2380 {
2381 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2382 
2383 	debugfs_create_u32("skip_beacons", 0600, dir,
2384 			   &vp->skip_beacons[link_conf->link_id]);
2385 }
2386 #endif
2387 
2388 static int mac80211_hwsim_change_interface(struct ieee80211_hw *hw,
2389 					   struct ieee80211_vif *vif,
2390 					   enum nl80211_iftype newtype,
2391 					   bool newp2p)
2392 {
2393 	newtype = ieee80211_iftype_p2p(newtype, newp2p);
2394 	wiphy_dbg(hw->wiphy,
2395 		  "%s (old type=%d, new type=%d, mac_addr=%pM)\n",
2396 		  __func__, ieee80211_vif_type_p2p(vif),
2397 		    newtype, vif->addr);
2398 	hwsim_check_magic(vif);
2399 
2400 	/*
2401 	 * interface may change from non-AP to AP in
2402 	 * which case this needs to be set up again
2403 	 */
2404 	vif->cab_queue = 0;
2405 
2406 	return 0;
2407 }
2408 
2409 static void mac80211_hwsim_remove_interface(
2410 	struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2411 {
2412 	wiphy_dbg(hw->wiphy, "%s (type=%d mac_addr=%pM)\n",
2413 		  __func__, ieee80211_vif_type_p2p(vif),
2414 		  vif->addr);
2415 	hwsim_check_magic(vif);
2416 	hwsim_clear_magic(vif);
2417 	if (vif->type != NL80211_IFTYPE_MONITOR)
2418 		mac80211_hwsim_config_mac_nl(hw, vif->addr, false);
2419 }
2420 
2421 void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
2422 			     struct sk_buff *skb,
2423 			     struct ieee80211_channel *chan)
2424 {
2425 	struct mac80211_hwsim_data *data = hw->priv;
2426 	u32 _portid = READ_ONCE(data->wmediumd);
2427 
2428 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE)) {
2429 		struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
2430 		ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
2431 				       txi->control.rates,
2432 				       ARRAY_SIZE(txi->control.rates));
2433 	}
2434 
2435 	if (_portid || hwsim_virtio_enabled)
2436 		return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, chan);
2437 
2438 	data->tx_pkts++;
2439 	data->tx_bytes += skb->len;
2440 	mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
2441 	dev_kfree_skb(skb);
2442 }
2443 
2444 static void __mac80211_hwsim_beacon_tx(struct ieee80211_bss_conf *link_conf,
2445 				       struct mac80211_hwsim_data *data,
2446 				       struct ieee80211_hw *hw,
2447 				       struct ieee80211_vif *vif,
2448 				       struct sk_buff *skb)
2449 {
2450 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2451 	struct ieee80211_tx_info *info;
2452 
2453 	if (vp->skip_beacons[link_conf->link_id]) {
2454 		vp->skip_beacons[link_conf->link_id]--;
2455 		dev_kfree_skb(skb);
2456 		return;
2457 	}
2458 
2459 	info = IEEE80211_SKB_CB(skb);
2460 	if (ieee80211_hw_check(hw, SUPPORTS_RC_TABLE))
2461 		ieee80211_get_tx_rates(vif, NULL, skb,
2462 				       info->control.rates,
2463 				       ARRAY_SIZE(info->control.rates));
2464 
2465 	mac80211_hwsim_tx_frame(hw, skb,
2466 			rcu_dereference(link_conf->chanctx_conf)->def.chan);
2467 }
2468 
2469 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
2470 				     struct ieee80211_vif *vif)
2471 {
2472 	struct mac80211_hwsim_link_data *link_data = arg;
2473 	u32 link_id = link_data->link_id;
2474 	struct ieee80211_bss_conf *link_conf, *tx_bss_conf;
2475 	struct mac80211_hwsim_data *data =
2476 		container_of(link_data, struct mac80211_hwsim_data,
2477 			     link_data[link_id]);
2478 	struct ieee80211_hw *hw = data->hw;
2479 	struct sk_buff *skb;
2480 
2481 	hwsim_check_magic(vif);
2482 
2483 	link_conf = rcu_dereference(vif->link_conf[link_id]);
2484 	if (!link_conf)
2485 		return;
2486 
2487 	if (vif->type != NL80211_IFTYPE_AP &&
2488 	    vif->type != NL80211_IFTYPE_MESH_POINT &&
2489 	    vif->type != NL80211_IFTYPE_ADHOC &&
2490 	    vif->type != NL80211_IFTYPE_OCB)
2491 		return;
2492 
2493 	tx_bss_conf = rcu_access_pointer(link_conf->tx_bss_conf);
2494 	if (tx_bss_conf && tx_bss_conf != link_conf)
2495 		return;
2496 
2497 	if (link_conf->ema_ap) {
2498 		struct ieee80211_ema_beacons *ema;
2499 		u8 i = 0;
2500 
2501 		ema = ieee80211_beacon_get_template_ema_list(hw, vif, link_id);
2502 		if (!ema || !ema->cnt)
2503 			return;
2504 
2505 		for (i = 0; i < ema->cnt; i++) {
2506 			__mac80211_hwsim_beacon_tx(link_conf, data, hw, vif,
2507 						   ema->bcn[i].skb);
2508 			ema->bcn[i].skb = NULL; /* Already freed */
2509 		}
2510 		ieee80211_beacon_free_ema_list(ema);
2511 	} else {
2512 		skb = ieee80211_beacon_get(hw, vif, link_id);
2513 		if (!skb)
2514 			return;
2515 
2516 		__mac80211_hwsim_beacon_tx(link_conf, data, hw, vif, skb);
2517 	}
2518 
2519 	while ((skb = ieee80211_get_buffered_bc(hw, vif)) != NULL) {
2520 		mac80211_hwsim_tx_frame(hw, skb,
2521 			rcu_dereference(link_conf->chanctx_conf)->def.chan);
2522 	}
2523 
2524 	if (link_conf->csa_active && ieee80211_beacon_cntdwn_is_complete(vif, link_id))
2525 		ieee80211_csa_finish(vif, link_id);
2526 
2527 	if (link_conf->color_change_active &&
2528 	    ieee80211_beacon_cntdwn_is_complete(vif, link_id))
2529 		ieee80211_color_change_finish(vif, link_id);
2530 }
2531 
2532 static enum hrtimer_restart
2533 mac80211_hwsim_beacon(struct hrtimer *timer)
2534 {
2535 	struct mac80211_hwsim_link_data *link_data =
2536 		container_of(timer, struct mac80211_hwsim_link_data, beacon_timer);
2537 	struct mac80211_hwsim_data *data =
2538 		container_of(link_data, struct mac80211_hwsim_data,
2539 			     link_data[link_data->link_id]);
2540 	struct ieee80211_hw *hw = data->hw;
2541 	u32 remainder;
2542 	u64 tsf_now;
2543 	u64 tbtt;
2544 
2545 	if (!data->started)
2546 		return HRTIMER_NORESTART;
2547 
2548 	ieee80211_iterate_active_interfaces_atomic(
2549 		hw, IEEE80211_IFACE_ITER_NORMAL,
2550 		mac80211_hwsim_beacon_tx, link_data);
2551 
2552 	/* TSF is the same for all VIFs, parameter is unused */
2553 	tsf_now = mac80211_hwsim_get_tsf(hw, NULL);
2554 
2555 	/* Wrap value to be after the next TBTT */
2556 	tbtt = tsf_now + link_data->beacon_int;
2557 
2558 	/* Round TBTT down to the correct time */
2559 	div_u64_rem(tbtt, link_data->beacon_int, &remainder);
2560 	tbtt = tbtt - remainder;
2561 
2562 	hrtimer_set_expires(&link_data->beacon_timer,
2563 			    mac80211_hwsim_tsf_to_boottime(data, tbtt));
2564 
2565 	return HRTIMER_RESTART;
2566 }
2567 
2568 static const char * const hwsim_chanwidths[] = {
2569 	[NL80211_CHAN_WIDTH_5] = "ht5",
2570 	[NL80211_CHAN_WIDTH_10] = "ht10",
2571 	[NL80211_CHAN_WIDTH_20_NOHT] = "noht",
2572 	[NL80211_CHAN_WIDTH_20] = "ht20",
2573 	[NL80211_CHAN_WIDTH_40] = "ht40",
2574 	[NL80211_CHAN_WIDTH_80] = "vht80",
2575 	[NL80211_CHAN_WIDTH_80P80] = "vht80p80",
2576 	[NL80211_CHAN_WIDTH_160] = "vht160",
2577 	[NL80211_CHAN_WIDTH_1] = "1MHz",
2578 	[NL80211_CHAN_WIDTH_2] = "2MHz",
2579 	[NL80211_CHAN_WIDTH_4] = "4MHz",
2580 	[NL80211_CHAN_WIDTH_8] = "8MHz",
2581 	[NL80211_CHAN_WIDTH_16] = "16MHz",
2582 	[NL80211_CHAN_WIDTH_320] = "eht320",
2583 };
2584 
2585 static int mac80211_hwsim_config(struct ieee80211_hw *hw, int radio_idx,
2586 				 u32 changed)
2587 {
2588 	struct mac80211_hwsim_data *data = hw->priv;
2589 	struct ieee80211_conf *conf = &hw->conf;
2590 	static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
2591 		[IEEE80211_SMPS_AUTOMATIC] = "auto",
2592 		[IEEE80211_SMPS_OFF] = "off",
2593 		[IEEE80211_SMPS_STATIC] = "static",
2594 		[IEEE80211_SMPS_DYNAMIC] = "dynamic",
2595 	};
2596 	int idx;
2597 
2598 	if (conf->chandef.chan)
2599 		wiphy_dbg(hw->wiphy,
2600 			  "%s (freq=%d(%d - %d)/%s idle=%d ps=%d smps=%s)\n",
2601 			  __func__,
2602 			  conf->chandef.chan->center_freq,
2603 			  conf->chandef.center_freq1,
2604 			  conf->chandef.center_freq2,
2605 			  hwsim_chanwidths[conf->chandef.width],
2606 			  !!(conf->flags & IEEE80211_CONF_IDLE),
2607 			  !!(conf->flags & IEEE80211_CONF_PS),
2608 			  smps_modes[conf->smps_mode]);
2609 	else
2610 		wiphy_dbg(hw->wiphy,
2611 			  "%s (freq=0 idle=%d ps=%d smps=%s)\n",
2612 			  __func__,
2613 			  !!(conf->flags & IEEE80211_CONF_IDLE),
2614 			  !!(conf->flags & IEEE80211_CONF_PS),
2615 			  smps_modes[conf->smps_mode]);
2616 
2617 	data->idle = !!(conf->flags & IEEE80211_CONF_IDLE);
2618 
2619 	WARN_ON(conf->chandef.chan && data->use_chanctx);
2620 
2621 	mutex_lock(&data->mutex);
2622 	if (data->scanning && conf->chandef.chan) {
2623 		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2624 			if (data->survey_data[idx].channel == data->channel) {
2625 				data->survey_data[idx].start =
2626 					data->survey_data[idx].next_start;
2627 				data->survey_data[idx].end = jiffies;
2628 				break;
2629 			}
2630 		}
2631 
2632 		data->channel = conf->chandef.chan;
2633 		data->bw = conf->chandef.width;
2634 
2635 		for (idx = 0; idx < ARRAY_SIZE(data->survey_data); idx++) {
2636 			if (data->survey_data[idx].channel &&
2637 			    data->survey_data[idx].channel != data->channel)
2638 				continue;
2639 			data->survey_data[idx].channel = data->channel;
2640 			data->survey_data[idx].next_start = jiffies;
2641 			break;
2642 		}
2643 	} else {
2644 		data->channel = conf->chandef.chan;
2645 		data->bw = conf->chandef.width;
2646 	}
2647 	mutex_unlock(&data->mutex);
2648 
2649 	for (idx = 0; idx < ARRAY_SIZE(data->link_data); idx++) {
2650 		struct mac80211_hwsim_link_data *link_data =
2651 			&data->link_data[idx];
2652 
2653 		if (!data->started || !link_data->beacon_int) {
2654 			hrtimer_cancel(&link_data->beacon_timer);
2655 		} else if (!hrtimer_active(&link_data->beacon_timer)) {
2656 			u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
2657 			u32 bcn_int = link_data->beacon_int;
2658 			u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
2659 
2660 			hrtimer_start(&link_data->beacon_timer,
2661 				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2662 				      HRTIMER_MODE_REL_SOFT);
2663 		}
2664 	}
2665 
2666 	return 0;
2667 }
2668 
2669 
2670 static void mac80211_hwsim_configure_filter(struct ieee80211_hw *hw,
2671 					    unsigned int changed_flags,
2672 					    unsigned int *total_flags,u64 multicast)
2673 {
2674 	struct mac80211_hwsim_data *data = hw->priv;
2675 
2676 	wiphy_dbg(hw->wiphy, "%s\n", __func__);
2677 
2678 	data->rx_filter = 0;
2679 	if (*total_flags & FIF_ALLMULTI)
2680 		data->rx_filter |= FIF_ALLMULTI;
2681 	if (*total_flags & FIF_MCAST_ACTION)
2682 		data->rx_filter |= FIF_MCAST_ACTION;
2683 
2684 	*total_flags = data->rx_filter;
2685 }
2686 
2687 static void mac80211_hwsim_bcn_en_iter(void *data, u8 *mac,
2688 				       struct ieee80211_vif *vif)
2689 {
2690 	unsigned int *count = data;
2691 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2692 
2693 	if (vp->bcn_en)
2694 		(*count)++;
2695 }
2696 
2697 static void mac80211_hwsim_vif_info_changed(struct ieee80211_hw *hw,
2698 					    struct ieee80211_vif *vif,
2699 					    u64 changed)
2700 {
2701 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2702 
2703 	hwsim_check_magic(vif);
2704 
2705 	wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM)\n",
2706 		  __func__, changed, vif->addr);
2707 
2708 	if (changed & BSS_CHANGED_ASSOC) {
2709 		wiphy_dbg(hw->wiphy, "  ASSOC: assoc=%d aid=%d\n",
2710 			  vif->cfg.assoc, vif->cfg.aid);
2711 		vp->assoc = vif->cfg.assoc;
2712 		vp->aid = vif->cfg.aid;
2713 	}
2714 
2715 	if (changed & BSS_CHANGED_NAN_LOCAL_SCHED)
2716 		mac80211_hwsim_nan_local_sched_changed(hw, vif);
2717 
2718 	if (vif->type == NL80211_IFTYPE_STATION &&
2719 	    changed & (BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)) {
2720 		u16 usable_links = ieee80211_vif_usable_links(vif);
2721 
2722 		if (vif->active_links != usable_links)
2723 			ieee80211_set_active_links_async(vif, usable_links);
2724 	}
2725 }
2726 
2727 static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2728 					     struct ieee80211_vif *vif,
2729 					     struct ieee80211_bss_conf *info,
2730 					     u64 changed)
2731 {
2732 	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2733 	struct mac80211_hwsim_data *data = hw->priv;
2734 	unsigned int link_id = info->link_id;
2735 	struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
2736 
2737 	hwsim_check_magic(vif);
2738 
2739 	wiphy_dbg(hw->wiphy, "%s(changed=0x%llx vif->addr=%pM, link id %u)\n",
2740 		  __func__, (unsigned long long)changed, vif->addr, link_id);
2741 
2742 	if (changed & BSS_CHANGED_BSSID) {
2743 		wiphy_dbg(hw->wiphy, "%s: BSSID changed: %pM\n",
2744 			  __func__, info->bssid);
2745 		memcpy(vp->bssid, info->bssid, ETH_ALEN);
2746 	}
2747 
2748 	if (changed & BSS_CHANGED_BEACON_ENABLED) {
2749 		wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2750 			  info->enable_beacon, info->beacon_int);
2751 		vp->bcn_en = info->enable_beacon;
2752 		if (data->started &&
2753 		    !hrtimer_active(&link_data->beacon_timer) &&
2754 		    info->enable_beacon) {
2755 			u64 tsf, until_tbtt;
2756 			u32 bcn_int;
2757 			link_data->beacon_int = info->beacon_int * 1024;
2758 			tsf = mac80211_hwsim_get_tsf(hw, vif);
2759 			bcn_int = link_data->beacon_int;
2760 			until_tbtt = bcn_int - do_div(tsf, bcn_int);
2761 
2762 			hrtimer_start(&link_data->beacon_timer,
2763 				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2764 				      HRTIMER_MODE_REL_SOFT);
2765 		} else if (!info->enable_beacon) {
2766 			unsigned int count = 0;
2767 			ieee80211_iterate_active_interfaces_atomic(
2768 				data->hw, IEEE80211_IFACE_ITER_NORMAL,
2769 				mac80211_hwsim_bcn_en_iter, &count);
2770 			wiphy_dbg(hw->wiphy, "  beaconing vifs remaining: %u",
2771 				  count);
2772 			if (count == 0) {
2773 				hrtimer_cancel(&link_data->beacon_timer);
2774 				link_data->beacon_int = 0;
2775 			}
2776 		}
2777 	}
2778 
2779 	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
2780 		wiphy_dbg(hw->wiphy, "  ERP_CTS_PROT: %d\n",
2781 			  info->use_cts_prot);
2782 	}
2783 
2784 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
2785 		wiphy_dbg(hw->wiphy, "  ERP_PREAMBLE: %d\n",
2786 			  info->use_short_preamble);
2787 	}
2788 
2789 	if (changed & BSS_CHANGED_ERP_SLOT) {
2790 		wiphy_dbg(hw->wiphy, "  ERP_SLOT: %d\n", info->use_short_slot);
2791 	}
2792 
2793 	if (changed & BSS_CHANGED_HT) {
2794 		wiphy_dbg(hw->wiphy, "  HT: op_mode=0x%x\n",
2795 			  info->ht_operation_mode);
2796 	}
2797 
2798 	if (changed & BSS_CHANGED_BASIC_RATES) {
2799 		wiphy_dbg(hw->wiphy, "  BASIC_RATES: 0x%llx\n",
2800 			  (unsigned long long) info->basic_rates);
2801 	}
2802 
2803 	if (changed & BSS_CHANGED_TXPOWER)
2804 		wiphy_dbg(hw->wiphy, "  TX Power: %d dBm\n", info->txpower);
2805 }
2806 
2807 static void
2808 mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
2809 			     struct ieee80211_vif *vif,
2810 			     struct ieee80211_link_sta *link_sta,
2811 			     u32 changed)
2812 {
2813 	struct mac80211_hwsim_data *data = hw->priv;
2814 	struct ieee80211_sta *sta = link_sta->sta;
2815 	u32 bw = U32_MAX;
2816 	int link_id;
2817 
2818 	if (vif->type == NL80211_IFTYPE_NAN ||
2819 	    vif->type == NL80211_IFTYPE_NAN_DATA)
2820 		return;
2821 
2822 	rcu_read_lock();
2823 	for (link_id = 0;
2824 	     link_id < ARRAY_SIZE(vif->link_conf);
2825 	     link_id++) {
2826 		enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
2827 		struct ieee80211_bss_conf *vif_conf;
2828 
2829 		link_sta = rcu_dereference(sta->link[link_id]);
2830 
2831 		if (!link_sta)
2832 			continue;
2833 
2834 		switch (link_sta->bandwidth) {
2835 #define C(_bw) case IEEE80211_STA_RX_BW_##_bw: bw = _bw; break
2836 		C(20);
2837 		C(40);
2838 		C(80);
2839 		C(160);
2840 		C(320);
2841 #undef C
2842 		}
2843 
2844 		if (!data->use_chanctx) {
2845 			confbw = data->bw;
2846 		} else {
2847 			struct ieee80211_chanctx_conf *chanctx_conf;
2848 
2849 			vif_conf = rcu_dereference(vif->link_conf[link_id]);
2850 			if (WARN_ON(!vif_conf))
2851 				continue;
2852 
2853 			chanctx_conf = rcu_dereference(vif_conf->chanctx_conf);
2854 
2855 			if (!WARN_ON(!chanctx_conf))
2856 				confbw = chanctx_conf->def.width;
2857 		}
2858 
2859 		WARN(bw > hwsim_get_chanwidth(confbw),
2860 		     "intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
2861 		     vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
2862 		     hwsim_get_chanwidth(data->bw), data->bw);
2863 
2864 
2865 	}
2866 	rcu_read_unlock();
2867 
2868 
2869 }
2870 
2871 static int mac80211_hwsim_sta_add(struct ieee80211_hw *hw,
2872 				  struct ieee80211_vif *vif,
2873 				  struct ieee80211_sta *sta)
2874 {
2875 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
2876 
2877 	hwsim_check_magic(vif);
2878 	hwsim_set_sta_magic(sta);
2879 
2880 	/* For now, don't run RC update on STAs on an S1G interface */
2881 	if (!vif->cfg.s1g)
2882 		mac80211_hwsim_sta_rc_update(hw, vif, &sta->deflink, 0);
2883 
2884 	if (sta->valid_links) {
2885 		WARN(hweight16(sta->valid_links) > 1,
2886 		     "expect to add STA with single link, have 0x%x\n",
2887 		     sta->valid_links);
2888 		sp->active_links_rx = sta->valid_links;
2889 	}
2890 
2891 	spin_lock_init(&sp->nan_sched.lock);
2892 
2893 	return 0;
2894 }
2895 
2896 static int mac80211_hwsim_sta_remove(struct ieee80211_hw *hw,
2897 				     struct ieee80211_vif *vif,
2898 				     struct ieee80211_sta *sta)
2899 {
2900 	hwsim_check_magic(vif);
2901 	hwsim_clear_sta_magic(sta);
2902 
2903 	return 0;
2904 }
2905 
2906 static int mac80211_hwsim_sta_state(struct ieee80211_hw *hw,
2907 				    struct ieee80211_vif *vif,
2908 				    struct ieee80211_sta *sta,
2909 				    enum ieee80211_sta_state old_state,
2910 				    enum ieee80211_sta_state new_state)
2911 {
2912 	if (new_state == IEEE80211_STA_NOTEXIST)
2913 		return mac80211_hwsim_sta_remove(hw, vif, sta);
2914 
2915 	if (old_state == IEEE80211_STA_NOTEXIST)
2916 		return mac80211_hwsim_sta_add(hw, vif, sta);
2917 
2918 	/*
2919 	 * in an MLO connection, when client is authorized
2920 	 * (AP station marked as such), enable all links
2921 	 */
2922 	if (ieee80211_vif_is_mld(vif) &&
2923 	    vif->type == NL80211_IFTYPE_STATION &&
2924 	    new_state == IEEE80211_STA_AUTHORIZED && !sta->tdls)
2925 		ieee80211_set_active_links_async(vif,
2926 						 ieee80211_vif_usable_links(vif));
2927 
2928 	return 0;
2929 }
2930 
2931 static void mac80211_hwsim_sta_notify(struct ieee80211_hw *hw,
2932 				      struct ieee80211_vif *vif,
2933 				      enum sta_notify_cmd cmd,
2934 				      struct ieee80211_sta *sta)
2935 {
2936 	hwsim_check_magic(vif);
2937 
2938 	switch (cmd) {
2939 	case STA_NOTIFY_SLEEP:
2940 	case STA_NOTIFY_AWAKE:
2941 		/* TODO: make good use of these flags */
2942 		break;
2943 	default:
2944 		WARN(1, "Invalid sta notify: %d\n", cmd);
2945 		break;
2946 	}
2947 }
2948 
2949 static int mac80211_hwsim_set_tim(struct ieee80211_hw *hw,
2950 				  struct ieee80211_sta *sta,
2951 				  bool set)
2952 {
2953 	hwsim_check_sta_magic(sta);
2954 	return 0;
2955 }
2956 
2957 static int mac80211_hwsim_conf_tx(struct ieee80211_hw *hw,
2958 				  struct ieee80211_vif *vif,
2959 				  unsigned int link_id, u16 queue,
2960 				  const struct ieee80211_tx_queue_params *params)
2961 {
2962 	wiphy_dbg(hw->wiphy,
2963 		  "%s (queue=%d txop=%d cw_min=%d cw_max=%d aifs=%d)\n",
2964 		  __func__, queue,
2965 		  params->txop, params->cw_min,
2966 		  params->cw_max, params->aifs);
2967 	return 0;
2968 }
2969 
2970 static int mac80211_hwsim_get_survey(struct ieee80211_hw *hw, int idx,
2971 				     struct survey_info *survey)
2972 {
2973 	struct mac80211_hwsim_data *hwsim = hw->priv;
2974 
2975 	if (idx < 0 || idx >= ARRAY_SIZE(hwsim->survey_data))
2976 		return -ENOENT;
2977 
2978 	mutex_lock(&hwsim->mutex);
2979 	survey->channel = hwsim->survey_data[idx].channel;
2980 	if (!survey->channel) {
2981 		mutex_unlock(&hwsim->mutex);
2982 		return -ENOENT;
2983 	}
2984 
2985 	/*
2986 	 * Magically conjured dummy values --- this is only ok for simulated hardware.
2987 	 *
2988 	 * A real driver which cannot determine real values noise MUST NOT
2989 	 * report any, especially not a magically conjured ones :-)
2990 	 */
2991 	survey->filled = SURVEY_INFO_NOISE_DBM |
2992 			 SURVEY_INFO_TIME |
2993 			 SURVEY_INFO_TIME_BUSY;
2994 	survey->noise = -92;
2995 	survey->time =
2996 		jiffies_to_msecs(hwsim->survey_data[idx].end -
2997 				 hwsim->survey_data[idx].start);
2998 	/* report 12.5% of channel time is used */
2999 	survey->time_busy = survey->time/8;
3000 	mutex_unlock(&hwsim->mutex);
3001 
3002 	return 0;
3003 }
3004 
3005 static enum ieee80211_neg_ttlm_res
3006 mac80211_hwsim_can_neg_ttlm(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3007 			    struct ieee80211_neg_ttlm *neg_ttlm)
3008 {
3009 	u32 i;
3010 
3011 	/* For testing purposes, accept if all TIDs are mapped to the same links
3012 	 * set, otherwise reject.
3013 	 */
3014 	for (i = 0; i < IEEE80211_TTLM_NUM_TIDS; i++) {
3015 		if (neg_ttlm->downlink[i] != neg_ttlm->uplink[i] ||
3016 		    neg_ttlm->downlink[i] != neg_ttlm->downlink[0])
3017 			return NEG_TTLM_RES_REJECT;
3018 	}
3019 
3020 	return NEG_TTLM_RES_ACCEPT;
3021 }
3022 
3023 #ifdef CONFIG_NL80211_TESTMODE
3024 /*
3025  * This section contains example code for using netlink
3026  * attributes with the testmode command in nl80211.
3027  */
3028 
3029 /* These enums need to be kept in sync with userspace */
3030 enum hwsim_testmode_attr {
3031 	__HWSIM_TM_ATTR_INVALID	= 0,
3032 	HWSIM_TM_ATTR_CMD	= 1,
3033 	HWSIM_TM_ATTR_PS	= 2,
3034 
3035 	/* keep last */
3036 	__HWSIM_TM_ATTR_AFTER_LAST,
3037 	HWSIM_TM_ATTR_MAX	= __HWSIM_TM_ATTR_AFTER_LAST - 1
3038 };
3039 
3040 enum hwsim_testmode_cmd {
3041 	HWSIM_TM_CMD_SET_PS		= 0,
3042 	HWSIM_TM_CMD_GET_PS		= 1,
3043 	HWSIM_TM_CMD_STOP_QUEUES	= 2,
3044 	HWSIM_TM_CMD_WAKE_QUEUES	= 3,
3045 };
3046 
3047 static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
3048 	[HWSIM_TM_ATTR_CMD] = { .type = NLA_U32 },
3049 	[HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
3050 };
3051 
3052 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
3053 				       struct ieee80211_vif *vif,
3054 				       void *data, int len)
3055 {
3056 	struct mac80211_hwsim_data *hwsim = hw->priv;
3057 	struct nlattr *tb[HWSIM_TM_ATTR_MAX + 1];
3058 	struct sk_buff *skb;
3059 	int err, ps;
3060 
3061 	err = nla_parse_deprecated(tb, HWSIM_TM_ATTR_MAX, data, len,
3062 				   hwsim_testmode_policy, NULL);
3063 	if (err)
3064 		return err;
3065 
3066 	if (!tb[HWSIM_TM_ATTR_CMD])
3067 		return -EINVAL;
3068 
3069 	switch (nla_get_u32(tb[HWSIM_TM_ATTR_CMD])) {
3070 	case HWSIM_TM_CMD_SET_PS:
3071 		if (!tb[HWSIM_TM_ATTR_PS])
3072 			return -EINVAL;
3073 		ps = nla_get_u32(tb[HWSIM_TM_ATTR_PS]);
3074 		return hwsim_fops_ps_write(hwsim, ps);
3075 	case HWSIM_TM_CMD_GET_PS:
3076 		skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
3077 						nla_total_size(sizeof(u32)));
3078 		if (!skb)
3079 			return -ENOMEM;
3080 		if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
3081 			goto nla_put_failure;
3082 		return cfg80211_testmode_reply(skb);
3083 	case HWSIM_TM_CMD_STOP_QUEUES:
3084 	case HWSIM_TM_CMD_WAKE_QUEUES:
3085 	default:
3086 		return -EOPNOTSUPP;
3087 	}
3088 
3089  nla_put_failure:
3090 	kfree_skb(skb);
3091 	return -ENOBUFS;
3092 }
3093 #endif
3094 
3095 static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
3096 				       struct ieee80211_vif *vif,
3097 				       struct ieee80211_ampdu_params *params)
3098 {
3099 	struct ieee80211_sta *sta = params->sta;
3100 	enum ieee80211_ampdu_mlme_action action = params->action;
3101 	u16 tid = params->tid;
3102 
3103 	switch (action) {
3104 	case IEEE80211_AMPDU_TX_START:
3105 		return IEEE80211_AMPDU_TX_START_IMMEDIATE;
3106 	case IEEE80211_AMPDU_TX_STOP_CONT:
3107 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
3108 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
3109 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
3110 		break;
3111 	case IEEE80211_AMPDU_TX_OPERATIONAL:
3112 		break;
3113 	case IEEE80211_AMPDU_RX_START:
3114 	case IEEE80211_AMPDU_RX_STOP:
3115 		break;
3116 	default:
3117 		return -EOPNOTSUPP;
3118 	}
3119 
3120 	return 0;
3121 }
3122 
3123 static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
3124 				 struct ieee80211_vif *vif,
3125 				 u32 queues, bool drop)
3126 {
3127 	/* Not implemented, queues only on kernel side */
3128 }
3129 
3130 static void hw_scan_work(struct work_struct *work)
3131 {
3132 	struct mac80211_hwsim_data *hwsim =
3133 		container_of(work, struct mac80211_hwsim_data, hw_scan.work);
3134 	struct cfg80211_scan_request *req = hwsim->hw_scan_request;
3135 	int dwell, i;
3136 
3137 	mutex_lock(&hwsim->mutex);
3138 	if (hwsim->scan_chan_idx >= req->n_channels) {
3139 		struct cfg80211_scan_info info = {
3140 			.aborted = false,
3141 		};
3142 
3143 		wiphy_dbg(hwsim->hw->wiphy, "hw scan complete\n");
3144 		ieee80211_scan_completed(hwsim->hw, &info);
3145 		hwsim->hw_scan_request = NULL;
3146 		hwsim->hw_scan_vif = NULL;
3147 		hwsim->tmp_chan = NULL;
3148 		mutex_unlock(&hwsim->mutex);
3149 		mac80211_hwsim_config_mac_nl(hwsim->hw, hwsim->scan_addr,
3150 					     false);
3151 		return;
3152 	}
3153 
3154 	wiphy_dbg(hwsim->hw->wiphy, "hw scan %d MHz\n",
3155 		  req->channels[hwsim->scan_chan_idx]->center_freq);
3156 
3157 	hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
3158 	if (hwsim->tmp_chan->flags & (IEEE80211_CHAN_NO_IR |
3159 				      IEEE80211_CHAN_RADAR) ||
3160 	    !req->n_ssids) {
3161 		dwell = 120;
3162 	} else {
3163 		dwell = 30;
3164 		/* send probes */
3165 		for (i = 0; i < req->n_ssids; i++) {
3166 			struct sk_buff *probe;
3167 			struct ieee80211_mgmt *mgmt;
3168 
3169 			probe = ieee80211_probereq_get(hwsim->hw,
3170 						       hwsim->scan_addr,
3171 						       req->ssids[i].ssid,
3172 						       req->ssids[i].ssid_len,
3173 						       req->ie_len);
3174 			if (!probe)
3175 				continue;
3176 
3177 			mgmt = (struct ieee80211_mgmt *) probe->data;
3178 			memcpy(mgmt->da, req->bssid, ETH_ALEN);
3179 			memcpy(mgmt->bssid, req->bssid, ETH_ALEN);
3180 
3181 			if (req->ie_len)
3182 				skb_put_data(probe, req->ie, req->ie_len);
3183 
3184 			rcu_read_lock();
3185 			if (!ieee80211_tx_prepare_skb(hwsim->hw,
3186 						      hwsim->hw_scan_vif,
3187 						      probe,
3188 						      hwsim->tmp_chan->band,
3189 						      NULL)) {
3190 				rcu_read_unlock();
3191 				continue;
3192 			}
3193 
3194 			local_bh_disable();
3195 			mac80211_hwsim_tx_frame(hwsim->hw, probe,
3196 						hwsim->tmp_chan);
3197 			rcu_read_unlock();
3198 			local_bh_enable();
3199 		}
3200 	}
3201 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan,
3202 				     msecs_to_jiffies(dwell));
3203 	hwsim->survey_data[hwsim->scan_chan_idx].channel = hwsim->tmp_chan;
3204 	hwsim->survey_data[hwsim->scan_chan_idx].start = jiffies;
3205 	hwsim->survey_data[hwsim->scan_chan_idx].end =
3206 		jiffies + msecs_to_jiffies(dwell);
3207 	hwsim->scan_chan_idx++;
3208 	mutex_unlock(&hwsim->mutex);
3209 }
3210 
3211 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
3212 				  struct ieee80211_vif *vif,
3213 				  struct ieee80211_scan_request *hw_req)
3214 {
3215 	struct mac80211_hwsim_data *hwsim = hw->priv;
3216 	struct cfg80211_scan_request *req = &hw_req->req;
3217 
3218 	mutex_lock(&hwsim->mutex);
3219 	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
3220 		mutex_unlock(&hwsim->mutex);
3221 		return -EBUSY;
3222 	}
3223 	hwsim->hw_scan_request = req;
3224 	hwsim->hw_scan_vif = vif;
3225 	hwsim->scan_chan_idx = 0;
3226 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
3227 		get_random_mask_addr(hwsim->scan_addr,
3228 				     hw_req->req.mac_addr,
3229 				     hw_req->req.mac_addr_mask);
3230 	else
3231 		memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
3232 	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
3233 	mutex_unlock(&hwsim->mutex);
3234 
3235 	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
3236 	wiphy_dbg(hw->wiphy, "hwsim hw_scan request\n");
3237 
3238 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->hw_scan, 0);
3239 
3240 	return 0;
3241 }
3242 
3243 static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
3244 					  struct ieee80211_vif *vif)
3245 {
3246 	struct mac80211_hwsim_data *hwsim = hw->priv;
3247 	struct cfg80211_scan_info info = {
3248 		.aborted = true,
3249 	};
3250 
3251 	wiphy_dbg(hw->wiphy, "hwsim cancel_hw_scan\n");
3252 
3253 	cancel_delayed_work_sync(&hwsim->hw_scan);
3254 
3255 	mutex_lock(&hwsim->mutex);
3256 	ieee80211_scan_completed(hwsim->hw, &info);
3257 	hwsim->tmp_chan = NULL;
3258 	hwsim->hw_scan_request = NULL;
3259 	hwsim->hw_scan_vif = NULL;
3260 	mutex_unlock(&hwsim->mutex);
3261 }
3262 
3263 static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
3264 				   struct ieee80211_vif *vif,
3265 				   const u8 *mac_addr)
3266 {
3267 	struct mac80211_hwsim_data *hwsim = hw->priv;
3268 
3269 	mutex_lock(&hwsim->mutex);
3270 
3271 	if (hwsim->scanning) {
3272 		pr_debug("two hwsim sw_scans detected!\n");
3273 		goto out;
3274 	}
3275 
3276 	pr_debug("hwsim sw_scan request, prepping stuff\n");
3277 
3278 	memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
3279 	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, true);
3280 	hwsim->scanning = true;
3281 	memset(hwsim->survey_data, 0, sizeof(hwsim->survey_data));
3282 
3283 out:
3284 	mutex_unlock(&hwsim->mutex);
3285 }
3286 
3287 static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
3288 					    struct ieee80211_vif *vif)
3289 {
3290 	struct mac80211_hwsim_data *hwsim = hw->priv;
3291 
3292 	mutex_lock(&hwsim->mutex);
3293 
3294 	pr_debug("hwsim sw_scan_complete\n");
3295 	hwsim->scanning = false;
3296 	mac80211_hwsim_config_mac_nl(hw, hwsim->scan_addr, false);
3297 	eth_zero_addr(hwsim->scan_addr);
3298 
3299 	mutex_unlock(&hwsim->mutex);
3300 }
3301 
3302 static void hw_roc_start(struct work_struct *work)
3303 {
3304 	struct mac80211_hwsim_data *hwsim =
3305 		container_of(work, struct mac80211_hwsim_data, roc_start.work);
3306 
3307 	mutex_lock(&hwsim->mutex);
3308 
3309 	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC begins\n");
3310 	hwsim->tmp_chan = hwsim->roc_chan;
3311 	ieee80211_ready_on_channel(hwsim->hw);
3312 
3313 	ieee80211_queue_delayed_work(hwsim->hw, &hwsim->roc_done,
3314 				     msecs_to_jiffies(hwsim->roc_duration));
3315 
3316 	mutex_unlock(&hwsim->mutex);
3317 }
3318 
3319 static void hw_roc_done(struct work_struct *work)
3320 {
3321 	struct mac80211_hwsim_data *hwsim =
3322 		container_of(work, struct mac80211_hwsim_data, roc_done.work);
3323 
3324 	mutex_lock(&hwsim->mutex);
3325 	ieee80211_remain_on_channel_expired(hwsim->hw);
3326 	hwsim->tmp_chan = NULL;
3327 	mutex_unlock(&hwsim->mutex);
3328 
3329 	wiphy_dbg(hwsim->hw->wiphy, "hwsim ROC expired\n");
3330 }
3331 
3332 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
3333 			      struct ieee80211_vif *vif,
3334 			      struct ieee80211_channel *chan,
3335 			      int duration,
3336 			      enum ieee80211_roc_type type)
3337 {
3338 	struct mac80211_hwsim_data *hwsim = hw->priv;
3339 
3340 	mutex_lock(&hwsim->mutex);
3341 	if (WARN_ON(hwsim->tmp_chan || hwsim->hw_scan_request)) {
3342 		mutex_unlock(&hwsim->mutex);
3343 		return -EBUSY;
3344 	}
3345 
3346 	hwsim->roc_chan = chan;
3347 	hwsim->roc_duration = duration;
3348 	mutex_unlock(&hwsim->mutex);
3349 
3350 	wiphy_dbg(hw->wiphy, "hwsim ROC (%d MHz, %d ms)\n",
3351 		  chan->center_freq, duration);
3352 	ieee80211_queue_delayed_work(hw, &hwsim->roc_start, HZ/50);
3353 
3354 	return 0;
3355 }
3356 
3357 static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
3358 			       struct ieee80211_vif *vif)
3359 {
3360 	struct mac80211_hwsim_data *hwsim = hw->priv;
3361 
3362 	cancel_delayed_work_sync(&hwsim->roc_start);
3363 	cancel_delayed_work_sync(&hwsim->roc_done);
3364 
3365 	mutex_lock(&hwsim->mutex);
3366 	hwsim->tmp_chan = NULL;
3367 	mutex_unlock(&hwsim->mutex);
3368 
3369 	wiphy_dbg(hw->wiphy, "hwsim ROC canceled\n");
3370 
3371 	return 0;
3372 }
3373 
3374 static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
3375 				      struct ieee80211_chanctx_conf *ctx)
3376 {
3377 	hwsim_set_chanctx_magic(ctx);
3378 	wiphy_dbg(hw->wiphy,
3379 		  "add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3380 		  ctx->def.chan->center_freq, ctx->def.width,
3381 		  ctx->def.center_freq1, ctx->def.center_freq2);
3382 	return 0;
3383 }
3384 
3385 static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
3386 					  struct ieee80211_chanctx_conf *ctx)
3387 {
3388 	wiphy_dbg(hw->wiphy,
3389 		  "remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3390 		  ctx->def.chan->center_freq, ctx->def.width,
3391 		  ctx->def.center_freq1, ctx->def.center_freq2);
3392 	hwsim_check_chanctx_magic(ctx);
3393 	hwsim_clear_chanctx_magic(ctx);
3394 }
3395 
3396 static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
3397 					  struct ieee80211_chanctx_conf *ctx,
3398 					  u32 changed)
3399 {
3400 	hwsim_check_chanctx_magic(ctx);
3401 	wiphy_dbg(hw->wiphy,
3402 		  "change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3403 		  ctx->def.chan->center_freq, ctx->def.width,
3404 		  ctx->def.center_freq1, ctx->def.center_freq2);
3405 }
3406 
3407 static int mac80211_hwsim_assign_vif_chanctx(struct ieee80211_hw *hw,
3408 					     struct ieee80211_vif *vif,
3409 					     struct ieee80211_bss_conf *link_conf,
3410 					     struct ieee80211_chanctx_conf *ctx)
3411 {
3412 	hwsim_check_magic(vif);
3413 	hwsim_check_chanctx_magic(ctx);
3414 
3415 	/* if we activate a link while already associated wake it up */
3416 	if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3417 		struct sk_buff *skb;
3418 
3419 		skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3420 		if (skb) {
3421 			local_bh_disable();
3422 			mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3423 			local_bh_enable();
3424 		}
3425 	}
3426 
3427 	return 0;
3428 }
3429 
3430 static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
3431 						struct ieee80211_vif *vif,
3432 						struct ieee80211_bss_conf *link_conf,
3433 						struct ieee80211_chanctx_conf *ctx)
3434 {
3435 	hwsim_check_magic(vif);
3436 	hwsim_check_chanctx_magic(ctx);
3437 
3438 	/* if we deactivate a link while associated suspend it first */
3439 	if (vif->type == NL80211_IFTYPE_STATION && vif->cfg.assoc) {
3440 		struct sk_buff *skb;
3441 
3442 		skb = ieee80211_nullfunc_get(hw, vif, link_conf->link_id, true);
3443 		if (skb) {
3444 			struct ieee80211_hdr *hdr = (void *)skb->data;
3445 
3446 			hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
3447 
3448 			local_bh_disable();
3449 			mac80211_hwsim_tx_frame(hw, skb, ctx->def.chan);
3450 			local_bh_enable();
3451 		}
3452 	}
3453 }
3454 
3455 static int mac80211_hwsim_switch_vif_chanctx(struct ieee80211_hw *hw,
3456 					     struct ieee80211_vif_chanctx_switch *vifs,
3457 					     int n_vifs,
3458 					     enum ieee80211_chanctx_switch_mode mode)
3459 {
3460 	int i;
3461 
3462 	if (n_vifs <= 0)
3463 		return -EINVAL;
3464 
3465 	wiphy_dbg(hw->wiphy,
3466 		  "switch vif channel context mode: %u\n", mode);
3467 
3468 	for (i = 0; i < n_vifs; i++) {
3469 		hwsim_check_chanctx_magic(vifs[i].old_ctx);
3470 		wiphy_dbg(hw->wiphy,
3471 			  "switch vif channel context: %d MHz/width: %d/cfreqs:%d/%d MHz -> %d MHz/width: %d/cfreqs:%d/%d MHz\n",
3472 			  vifs[i].old_ctx->def.chan->center_freq,
3473 			  vifs[i].old_ctx->def.width,
3474 			  vifs[i].old_ctx->def.center_freq1,
3475 			  vifs[i].old_ctx->def.center_freq2,
3476 			  vifs[i].new_ctx->def.chan->center_freq,
3477 			  vifs[i].new_ctx->def.width,
3478 			  vifs[i].new_ctx->def.center_freq1,
3479 			  vifs[i].new_ctx->def.center_freq2);
3480 
3481 		switch (mode) {
3482 		case CHANCTX_SWMODE_REASSIGN_VIF:
3483 			hwsim_check_chanctx_magic(vifs[i].new_ctx);
3484 			break;
3485 		case CHANCTX_SWMODE_SWAP_CONTEXTS:
3486 			hwsim_set_chanctx_magic(vifs[i].new_ctx);
3487 			hwsim_clear_chanctx_magic(vifs[i].old_ctx);
3488 			break;
3489 		default:
3490 			WARN(1, "Invalid mode %d\n", mode);
3491 		}
3492 	}
3493 	return 0;
3494 }
3495 
3496 static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
3497 	"tx_pkts_nic",
3498 	"tx_bytes_nic",
3499 	"rx_pkts_nic",
3500 	"rx_bytes_nic",
3501 	"d_tx_dropped",
3502 	"d_tx_failed",
3503 	"d_ps_mode",
3504 	"d_group",
3505 };
3506 
3507 #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
3508 
3509 static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
3510 					  struct ieee80211_vif *vif,
3511 					  u32 sset, u8 *data)
3512 {
3513 	if (sset == ETH_SS_STATS)
3514 		memcpy(data, mac80211_hwsim_gstrings_stats,
3515 		       sizeof(mac80211_hwsim_gstrings_stats));
3516 }
3517 
3518 static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
3519 					    struct ieee80211_vif *vif, int sset)
3520 {
3521 	if (sset == ETH_SS_STATS)
3522 		return MAC80211_HWSIM_SSTATS_LEN;
3523 	return 0;
3524 }
3525 
3526 static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
3527 					struct ieee80211_vif *vif,
3528 					struct ethtool_stats *stats, u64 *data)
3529 {
3530 	struct mac80211_hwsim_data *ar = hw->priv;
3531 	int i = 0;
3532 
3533 	data[i++] = ar->tx_pkts;
3534 	data[i++] = ar->tx_bytes;
3535 	data[i++] = ar->rx_pkts;
3536 	data[i++] = ar->rx_bytes;
3537 	data[i++] = ar->tx_dropped;
3538 	data[i++] = ar->tx_failed;
3539 	data[i++] = ar->ps;
3540 	data[i++] = ar->group;
3541 
3542 	WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
3543 }
3544 
3545 static int mac80211_hwsim_tx_last_beacon(struct ieee80211_hw *hw)
3546 {
3547 	return 1;
3548 }
3549 
3550 static int mac80211_hwsim_set_rts_threshold(struct ieee80211_hw *hw,
3551 					    int radio_idx, u32 value)
3552 {
3553 	/* hwsim ignores the use_rts instruction from mac80211 anyway */
3554 	return 0;
3555 }
3556 
3557 static int mac80211_hwsim_change_vif_links(struct ieee80211_hw *hw,
3558 					   struct ieee80211_vif *vif,
3559 					   u16 old_links, u16 new_links,
3560 					   struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
3561 {
3562 	unsigned long rem = old_links & ~new_links;
3563 	unsigned long add = new_links & ~old_links;
3564 	int i;
3565 
3566 	if (!old_links)
3567 		rem |= BIT(0);
3568 	if (!new_links)
3569 		add |= BIT(0);
3570 
3571 	wiphy_dbg(hw->wiphy, "%s:\n", __func__);
3572 
3573 	for_each_set_bit(i, &rem, IEEE80211_MLD_MAX_NUM_LINKS) {
3574 		mac80211_hwsim_config_mac_nl(hw, old[i]->addr, false);
3575 		wiphy_dbg(hw->wiphy,
3576 			  "  link [%d/%pM] removed\n", i, old[i]->addr);
3577 	}
3578 
3579 	for_each_set_bit(i, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
3580 		struct ieee80211_bss_conf *link_conf;
3581 
3582 		link_conf = link_conf_dereference_protected(vif, i);
3583 		if (WARN_ON(!link_conf))
3584 			continue;
3585 
3586 		mac80211_hwsim_config_mac_nl(hw, link_conf->addr, true);
3587 		wiphy_dbg(hw->wiphy,
3588 			  "  link [%d/%pM] added\n", i, link_conf->addr);
3589 	}
3590 
3591 	return 0;
3592 }
3593 
3594 static int mac80211_hwsim_change_sta_links(struct ieee80211_hw *hw,
3595 					   struct ieee80211_vif *vif,
3596 					   struct ieee80211_sta *sta,
3597 					   u16 old_links, u16 new_links)
3598 {
3599 	struct hwsim_sta_priv *sp = (void *)sta->drv_priv;
3600 
3601 	hwsim_check_sta_magic(sta);
3602 
3603 	if (vif->type == NL80211_IFTYPE_STATION)
3604 		sp->active_links_rx = new_links;
3605 
3606 	return 0;
3607 }
3608 
3609 static int mac80211_hwsim_send_pmsr_ftm_request_peer(struct sk_buff *msg,
3610 						     struct cfg80211_pmsr_ftm_request_peer *request)
3611 {
3612 	struct nlattr *ftm;
3613 
3614 	if (!request->requested)
3615 		return -EINVAL;
3616 
3617 	ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
3618 	if (!ftm)
3619 		return -ENOBUFS;
3620 
3621 	if (nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE, request->preamble))
3622 		return -ENOBUFS;
3623 
3624 	if (nla_put_u16(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD, request->burst_period))
3625 		return -ENOBUFS;
3626 
3627 	if (request->asap && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_ASAP))
3628 		return -ENOBUFS;
3629 
3630 	if (request->request_lci && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI))
3631 		return -ENOBUFS;
3632 
3633 	if (request->request_civicloc &&
3634 	    nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC))
3635 		return -ENOBUFS;
3636 
3637 	if (request->trigger_based && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED))
3638 		return -ENOBUFS;
3639 
3640 	if (request->non_trigger_based &&
3641 	    nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED))
3642 		return -ENOBUFS;
3643 
3644 	if (request->lmr_feedback && nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK))
3645 		return -ENOBUFS;
3646 
3647 	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP, request->num_bursts_exp))
3648 		return -ENOBUFS;
3649 
3650 	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3651 		return -ENOBUFS;
3652 
3653 	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST, request->ftms_per_burst))
3654 		return -ENOBUFS;
3655 
3656 	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES, request->ftmr_retries))
3657 		return -ENOBUFS;
3658 
3659 	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION, request->burst_duration))
3660 		return -ENOBUFS;
3661 
3662 	if (nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, request->bss_color))
3663 		return -ENOBUFS;
3664 
3665 	if (request->min_time_between_measurements &&
3666 	    nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS,
3667 			request->min_time_between_measurements))
3668 		return -ENOBUFS;
3669 
3670 	if (request->max_time_between_measurements &&
3671 	    nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS,
3672 			request->max_time_between_measurements))
3673 		return -ENOBUFS;
3674 
3675 	if (request->availability_window &&
3676 	    nla_put_u8(msg, NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
3677 		       request->availability_window))
3678 		return -ENOBUFS;
3679 
3680 	if (request->nominal_time &&
3681 	    nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
3682 			request->nominal_time))
3683 		return -ENOBUFS;
3684 
3685 	if (request->num_measurements &&
3686 	    nla_put_u32(msg, NL80211_PMSR_FTM_REQ_ATTR_NUM_MEASUREMENTS,
3687 			request->num_measurements))
3688 		return -ENOBUFS;
3689 
3690 	if (request->ingress_distance &&
3691 	    nla_put_u64_64bit(msg, NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
3692 			      request->ingress_distance,
3693 			      NL80211_PMSR_FTM_REQ_ATTR_PAD))
3694 		return -ENOBUFS;
3695 
3696 	if (request->egress_distance &&
3697 	    nla_put_u64_64bit(msg, NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
3698 			      request->egress_distance,
3699 			      NL80211_PMSR_FTM_REQ_ATTR_PAD))
3700 		return -ENOBUFS;
3701 
3702 	if (request->pd_suppress_range_results &&
3703 	    nla_put_flag(msg, NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS))
3704 		return -ENOBUFS;
3705 
3706 	nla_nest_end(msg, ftm);
3707 
3708 	return 0;
3709 }
3710 
3711 static int mac80211_hwsim_send_pmsr_request_peer(struct sk_buff *msg,
3712 						 struct cfg80211_pmsr_request_peer *request)
3713 {
3714 	struct nlattr *peer, *chandef, *req, *data;
3715 	int err;
3716 
3717 	peer = nla_nest_start(msg, NL80211_PMSR_ATTR_PEERS);
3718 	if (!peer)
3719 		return -ENOBUFS;
3720 
3721 	if (nla_put(msg, NL80211_PMSR_PEER_ATTR_ADDR, ETH_ALEN,
3722 		    request->addr))
3723 		return -ENOBUFS;
3724 
3725 	chandef = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_CHAN);
3726 	if (!chandef)
3727 		return -ENOBUFS;
3728 
3729 	err = nl80211_send_chandef(msg, &request->chandef);
3730 	if (err)
3731 		return err;
3732 
3733 	nla_nest_end(msg, chandef);
3734 
3735 	req = nla_nest_start(msg, NL80211_PMSR_PEER_ATTR_REQ);
3736 	if (!req)
3737 		return -ENOBUFS;
3738 
3739 	if (request->report_ap_tsf && nla_put_flag(msg, NL80211_PMSR_REQ_ATTR_GET_AP_TSF))
3740 		return -ENOBUFS;
3741 
3742 	data = nla_nest_start(msg, NL80211_PMSR_REQ_ATTR_DATA);
3743 	if (!data)
3744 		return -ENOBUFS;
3745 
3746 	err = mac80211_hwsim_send_pmsr_ftm_request_peer(msg, &request->ftm);
3747 	if (err)
3748 		return err;
3749 
3750 	nla_nest_end(msg, data);
3751 	nla_nest_end(msg, req);
3752 	nla_nest_end(msg, peer);
3753 
3754 	return 0;
3755 }
3756 
3757 static int mac80211_hwsim_send_pmsr_request(struct sk_buff *msg,
3758 					    struct cfg80211_pmsr_request *request)
3759 {
3760 	struct nlattr *pmsr;
3761 	int err;
3762 
3763 	pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
3764 	if (!pmsr)
3765 		return -ENOBUFS;
3766 
3767 	if (nla_put_u32(msg, NL80211_ATTR_TIMEOUT, request->timeout))
3768 		return -ENOBUFS;
3769 
3770 	if (!is_zero_ether_addr(request->mac_addr)) {
3771 		if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, request->mac_addr))
3772 			return -ENOBUFS;
3773 		if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, request->mac_addr_mask))
3774 			return -ENOBUFS;
3775 	}
3776 
3777 	for (int i = 0; i < request->n_peers; i++) {
3778 		err = mac80211_hwsim_send_pmsr_request_peer(msg, &request->peers[i]);
3779 		if (err)
3780 			return err;
3781 	}
3782 
3783 	nla_nest_end(msg, pmsr);
3784 
3785 	return 0;
3786 }
3787 
3788 static int mac80211_hwsim_start_pmsr(struct ieee80211_hw *hw,
3789 				     struct ieee80211_vif *vif,
3790 				     struct cfg80211_pmsr_request *request)
3791 {
3792 	struct mac80211_hwsim_data *data;
3793 	struct sk_buff *skb = NULL;
3794 	struct nlattr *pmsr;
3795 	void *msg_head;
3796 	u32 _portid;
3797 	int err = 0;
3798 
3799 	data = hw->priv;
3800 	_portid = READ_ONCE(data->wmediumd);
3801 	if (!_portid && !hwsim_virtio_enabled)
3802 		return -EOPNOTSUPP;
3803 
3804 	mutex_lock(&data->mutex);
3805 
3806 	if (data->pmsr_request) {
3807 		err = -EBUSY;
3808 		goto out_free;
3809 	}
3810 
3811 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3812 
3813 	if (!skb) {
3814 		err = -ENOMEM;
3815 		goto out_free;
3816 	}
3817 
3818 	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_START_PMSR);
3819 
3820 	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
3821 		    ETH_ALEN, data->addresses[1].addr)) {
3822 		err = -ENOMEM;
3823 		goto out_free;
3824 	}
3825 
3826 	pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3827 	if (!pmsr) {
3828 		err = -ENOMEM;
3829 		goto out_free;
3830 	}
3831 
3832 	err = mac80211_hwsim_send_pmsr_request(skb, request);
3833 	if (err)
3834 		goto out_free;
3835 
3836 	nla_nest_end(skb, pmsr);
3837 
3838 	genlmsg_end(skb, msg_head);
3839 	if (hwsim_virtio_enabled)
3840 		hwsim_tx_virtio(data, skb);
3841 	else
3842 		hwsim_unicast_netgroup(data, skb, _portid);
3843 
3844 	data->pmsr_request = request;
3845 	data->pmsr_request_wdev = ieee80211_vif_to_wdev(vif);
3846 
3847 out_free:
3848 	if (err && skb)
3849 		nlmsg_free(skb);
3850 
3851 	mutex_unlock(&data->mutex);
3852 	return err;
3853 }
3854 
3855 static void mac80211_hwsim_abort_pmsr(struct ieee80211_hw *hw,
3856 				      struct ieee80211_vif *vif,
3857 				      struct cfg80211_pmsr_request *request)
3858 {
3859 	struct mac80211_hwsim_data *data;
3860 	struct sk_buff *skb = NULL;
3861 	struct nlattr *pmsr;
3862 	void *msg_head;
3863 	u32 _portid;
3864 	int err = 0;
3865 
3866 	data = hw->priv;
3867 
3868 	mutex_lock(&data->mutex);
3869 
3870 	if (data->pmsr_request != request) {
3871 		err = -EINVAL;
3872 		goto out;
3873 	}
3874 
3875 	data->pmsr_request = NULL;
3876 	data->pmsr_request_wdev = NULL;
3877 
3878 	_portid = READ_ONCE(data->wmediumd);
3879 	if (!_portid && !hwsim_virtio_enabled)
3880 		goto out;
3881 
3882 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
3883 	if (!skb) {
3884 		err = -ENOMEM;
3885 		goto out;
3886 	}
3887 
3888 	msg_head = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, HWSIM_CMD_ABORT_PMSR);
3889 
3890 	if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER, ETH_ALEN, data->addresses[1].addr))
3891 		goto out;
3892 
3893 	pmsr = nla_nest_start(skb, HWSIM_ATTR_PMSR_REQUEST);
3894 	if (!pmsr) {
3895 		err = -ENOMEM;
3896 		goto out;
3897 	}
3898 
3899 	err = mac80211_hwsim_send_pmsr_request(skb, request);
3900 	if (err)
3901 		goto out;
3902 
3903 	err = nla_nest_end(skb, pmsr);
3904 	if (err)
3905 		goto out;
3906 
3907 	genlmsg_end(skb, msg_head);
3908 	if (hwsim_virtio_enabled)
3909 		hwsim_tx_virtio(data, skb);
3910 	else
3911 		hwsim_unicast_netgroup(data, skb, _portid);
3912 
3913 out:
3914 	if (err && skb)
3915 		nlmsg_free(skb);
3916 
3917 	mutex_unlock(&data->mutex);
3918 }
3919 
3920 static int mac80211_hwsim_parse_rate_info(struct nlattr *rateattr,
3921 					  struct rate_info *rate_info,
3922 					  struct genl_info *info)
3923 {
3924 	struct nlattr *tb[HWSIM_RATE_INFO_ATTR_MAX + 1];
3925 	int ret;
3926 
3927 	ret = nla_parse_nested(tb, HWSIM_RATE_INFO_ATTR_MAX,
3928 			       rateattr, hwsim_rate_info_policy, info->extack);
3929 	if (ret)
3930 		return ret;
3931 
3932 	if (tb[HWSIM_RATE_INFO_ATTR_FLAGS])
3933 		rate_info->flags = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_FLAGS]);
3934 
3935 	if (tb[HWSIM_RATE_INFO_ATTR_MCS])
3936 		rate_info->mcs = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_MCS]);
3937 
3938 	if (tb[HWSIM_RATE_INFO_ATTR_LEGACY])
3939 		rate_info->legacy = nla_get_u16(tb[HWSIM_RATE_INFO_ATTR_LEGACY]);
3940 
3941 	if (tb[HWSIM_RATE_INFO_ATTR_NSS])
3942 		rate_info->nss = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_NSS]);
3943 
3944 	if (tb[HWSIM_RATE_INFO_ATTR_BW])
3945 		rate_info->bw = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_BW]);
3946 
3947 	if (tb[HWSIM_RATE_INFO_ATTR_HE_GI])
3948 		rate_info->he_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_GI]);
3949 
3950 	if (tb[HWSIM_RATE_INFO_ATTR_HE_DCM])
3951 		rate_info->he_dcm = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_DCM]);
3952 
3953 	if (tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC])
3954 		rate_info->he_ru_alloc =
3955 			nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_HE_RU_ALLOC]);
3956 
3957 	if (tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH])
3958 		rate_info->n_bonded_ch = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_N_BOUNDED_CH]);
3959 
3960 	if (tb[HWSIM_RATE_INFO_ATTR_EHT_GI])
3961 		rate_info->eht_gi = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_GI]);
3962 
3963 	if (tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC])
3964 		rate_info->eht_ru_alloc = nla_get_u8(tb[HWSIM_RATE_INFO_ATTR_EHT_RU_ALLOC]);
3965 
3966 	return 0;
3967 }
3968 
3969 static int mac80211_hwsim_parse_ftm_result(struct nlattr *ftm,
3970 					   struct cfg80211_pmsr_ftm_result *result,
3971 					   struct genl_info *info)
3972 {
3973 	struct nlattr *tb[NL80211_PMSR_FTM_RESP_ATTR_MAX + 1];
3974 	int ret;
3975 
3976 	ret = nla_parse_nested(tb, NL80211_PMSR_FTM_RESP_ATTR_MAX,
3977 			       ftm, hwsim_ftm_result_policy, info->extack);
3978 	if (ret)
3979 		return ret;
3980 
3981 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON])
3982 		result->failure_reason = nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON]);
3983 
3984 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX])
3985 		result->burst_index = nla_get_u16(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX]);
3986 
3987 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]) {
3988 		result->num_ftmr_attempts_valid = 1;
3989 		result->num_ftmr_attempts =
3990 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS]);
3991 	}
3992 
3993 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]) {
3994 		result->num_ftmr_successes_valid = 1;
3995 		result->num_ftmr_successes =
3996 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES]);
3997 	}
3998 
3999 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME])
4000 		result->busy_retry_time =
4001 			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME]);
4002 
4003 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP])
4004 		result->num_bursts_exp = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP]);
4005 
4006 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION])
4007 		result->burst_duration = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION]);
4008 
4009 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST])
4010 		result->ftms_per_burst = nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST]);
4011 
4012 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]) {
4013 		result->rssi_avg_valid = 1;
4014 		result->rssi_avg = nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG]);
4015 	}
4016 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]) {
4017 		result->rssi_spread_valid = 1;
4018 		result->rssi_spread =
4019 			nla_get_s32(tb[NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD]);
4020 	}
4021 
4022 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE]) {
4023 		result->tx_rate_valid = 1;
4024 		ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_RATE],
4025 						     &result->tx_rate, info);
4026 		if (ret)
4027 			return ret;
4028 	}
4029 
4030 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE]) {
4031 		result->rx_rate_valid = 1;
4032 		ret = mac80211_hwsim_parse_rate_info(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_RATE],
4033 						     &result->rx_rate, info);
4034 		if (ret)
4035 			return ret;
4036 	}
4037 
4038 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]) {
4039 		result->rtt_avg_valid = 1;
4040 		result->rtt_avg =
4041 			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG]);
4042 	}
4043 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]) {
4044 		result->rtt_variance_valid = 1;
4045 		result->rtt_variance =
4046 			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE]);
4047 	}
4048 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]) {
4049 		result->rtt_spread_valid = 1;
4050 		result->rtt_spread =
4051 			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD]);
4052 	}
4053 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]) {
4054 		result->dist_avg_valid = 1;
4055 		result->dist_avg =
4056 			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG]);
4057 	}
4058 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]) {
4059 		result->dist_variance_valid = 1;
4060 		result->dist_variance =
4061 			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE]);
4062 	}
4063 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]) {
4064 		result->dist_spread_valid = 1;
4065 		result->dist_spread =
4066 			nla_get_u64(tb[NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD]);
4067 	}
4068 
4069 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]) {
4070 		result->lci = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
4071 		result->lci_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_LCI]);
4072 	}
4073 
4074 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]) {
4075 		result->civicloc = nla_data(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
4076 		result->civicloc_len = nla_len(tb[NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC]);
4077 	}
4078 
4079 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT]) {
4080 		result->tx_ltf_repetition_count_valid = 1;
4081 		result->tx_ltf_repetition_count =
4082 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT]);
4083 	}
4084 
4085 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT]) {
4086 		result->rx_ltf_repetition_count_valid = 1;
4087 		result->rx_ltf_repetition_count =
4088 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT]);
4089 	}
4090 
4091 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS]) {
4092 		result->max_time_between_measurements_valid = 1;
4093 		result->max_time_between_measurements =
4094 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS]);
4095 	}
4096 
4097 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS]) {
4098 		result->min_time_between_measurements_valid = 1;
4099 		result->min_time_between_measurements =
4100 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS]);
4101 	}
4102 
4103 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS]) {
4104 		result->num_tx_spatial_streams_valid = 1;
4105 		result->num_tx_spatial_streams =
4106 			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS]);
4107 	}
4108 
4109 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS]) {
4110 		result->num_rx_spatial_streams_valid = 1;
4111 		result->num_rx_spatial_streams =
4112 			nla_get_u8(tb[NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS]);
4113 	}
4114 
4115 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME]) {
4116 		result->nominal_time_valid = 1;
4117 		result->nominal_time =
4118 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME]);
4119 	}
4120 
4121 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW]) {
4122 		result->availability_window_valid = 1;
4123 		result->availability_window =
4124 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW]);
4125 	}
4126 
4127 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH]) {
4128 		result->chan_width_valid = 1;
4129 		result->chan_width =
4130 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH]);
4131 	}
4132 
4133 	if (tb[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE]) {
4134 		result->preamble_valid = 1;
4135 		result->preamble =
4136 			nla_get_u32(tb[NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE]);
4137 	}
4138 
4139 	result->is_delayed_lmr =
4140 		nla_get_flag(tb[NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR]);
4141 
4142 	return 0;
4143 }
4144 
4145 static int mac80211_hwsim_parse_pmsr_resp(struct nlattr *resp,
4146 					  struct cfg80211_pmsr_result *result,
4147 					  struct genl_info *info)
4148 {
4149 	struct nlattr *tb[NL80211_PMSR_RESP_ATTR_MAX + 1];
4150 	struct nlattr *pmsr;
4151 	int rem;
4152 	int ret;
4153 
4154 	ret = nla_parse_nested(tb, NL80211_PMSR_RESP_ATTR_MAX, resp, hwsim_pmsr_resp_policy,
4155 			       info->extack);
4156 	if (ret)
4157 		return ret;
4158 
4159 	if (tb[NL80211_PMSR_RESP_ATTR_STATUS])
4160 		result->status = nla_get_u32(tb[NL80211_PMSR_RESP_ATTR_STATUS]);
4161 
4162 	if (tb[NL80211_PMSR_RESP_ATTR_HOST_TIME])
4163 		result->host_time = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_HOST_TIME]);
4164 
4165 	if (tb[NL80211_PMSR_RESP_ATTR_AP_TSF]) {
4166 		result->ap_tsf_valid = 1;
4167 		result->ap_tsf = nla_get_u64(tb[NL80211_PMSR_RESP_ATTR_AP_TSF]);
4168 	}
4169 
4170 	result->final = !!tb[NL80211_PMSR_RESP_ATTR_FINAL];
4171 
4172 	if (!tb[NL80211_PMSR_RESP_ATTR_DATA])
4173 		return 0;
4174 
4175 	nla_for_each_nested(pmsr, tb[NL80211_PMSR_RESP_ATTR_DATA], rem) {
4176 		switch (nla_type(pmsr)) {
4177 		case NL80211_PMSR_TYPE_FTM:
4178 			result->type = NL80211_PMSR_TYPE_FTM;
4179 			ret = mac80211_hwsim_parse_ftm_result(pmsr, &result->ftm, info);
4180 			if (ret)
4181 				return ret;
4182 			break;
4183 		default:
4184 			NL_SET_ERR_MSG_ATTR(info->extack, pmsr, "Unknown pmsr resp type");
4185 			return -EINVAL;
4186 		}
4187 	}
4188 
4189 	return 0;
4190 }
4191 
4192 static int mac80211_hwsim_parse_pmsr_result(struct nlattr *peer,
4193 					    struct cfg80211_pmsr_result *result,
4194 					    struct genl_info *info)
4195 {
4196 	struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];
4197 	int ret;
4198 
4199 	if (!peer)
4200 		return -EINVAL;
4201 
4202 	ret = nla_parse_nested(tb, NL80211_PMSR_PEER_ATTR_MAX, peer,
4203 			       hwsim_pmsr_peer_result_policy, info->extack);
4204 	if (ret)
4205 		return ret;
4206 
4207 	if (tb[NL80211_PMSR_PEER_ATTR_ADDR])
4208 		memcpy(result->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]),
4209 		       ETH_ALEN);
4210 
4211 	if (tb[NL80211_PMSR_PEER_ATTR_RESP]) {
4212 		ret = mac80211_hwsim_parse_pmsr_resp(tb[NL80211_PMSR_PEER_ATTR_RESP], result, info);
4213 		if (ret)
4214 			return ret;
4215 	}
4216 
4217 	return 0;
4218 };
4219 
4220 static int hwsim_pmsr_report_nl(struct sk_buff *msg, struct genl_info *info)
4221 {
4222 	struct mac80211_hwsim_data *data;
4223 	struct nlattr *peers, *peer;
4224 	struct nlattr *reqattr;
4225 	const u8 *src;
4226 	int err;
4227 	int rem;
4228 
4229 	if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER])
4230 		return -EINVAL;
4231 
4232 	src = nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
4233 	data = get_hwsim_data_ref_from_addr(src);
4234 	if (!data)
4235 		return -EINVAL;
4236 
4237 	if (!hwsim_virtio_enabled) {
4238 		if (hwsim_net_get_netgroup(genl_info_net(info)) !=
4239 		    data->netgroup)
4240 			return -EINVAL;
4241 
4242 		if (info->snd_portid != data->wmediumd)
4243 			return -EPERM;
4244 	}
4245 
4246 	mutex_lock(&data->mutex);
4247 	if (!data->pmsr_request) {
4248 		err = -EINVAL;
4249 		goto out;
4250 	}
4251 
4252 	reqattr = info->attrs[HWSIM_ATTR_PMSR_RESULT];
4253 	if (!reqattr) {
4254 		err = -EINVAL;
4255 		goto out;
4256 	}
4257 
4258 	peers = nla_find_nested(reqattr, NL80211_PMSR_ATTR_PEERS);
4259 	if (!peers) {
4260 		err = -EINVAL;
4261 		goto out;
4262 	}
4263 
4264 	nla_for_each_nested(peer, peers, rem) {
4265 		struct cfg80211_pmsr_result result = {};
4266 
4267 		err = mac80211_hwsim_parse_pmsr_result(peer, &result, info);
4268 		if (err)
4269 			goto out;
4270 
4271 		cfg80211_pmsr_report(data->pmsr_request_wdev,
4272 				     data->pmsr_request, &result, GFP_KERNEL);
4273 	}
4274 
4275 	cfg80211_pmsr_complete(data->pmsr_request_wdev, data->pmsr_request, GFP_KERNEL);
4276 
4277 	err = 0;
4278 out:
4279 	data->pmsr_request = NULL;
4280 	data->pmsr_request_wdev = NULL;
4281 
4282 	mutex_unlock(&data->mutex);
4283 	return err;
4284 }
4285 
4286 static int mac80211_hwsim_set_radar_background(struct ieee80211_hw *hw,
4287 					       struct cfg80211_chan_def *chan)
4288 {
4289 	struct mac80211_hwsim_data *data = hw->priv;
4290 
4291 	if (!wiphy_ext_feature_isset(hw->wiphy,
4292 				     NL80211_EXT_FEATURE_RADAR_BACKGROUND))
4293 		return -EOPNOTSUPP;
4294 
4295 	if (chan)
4296 		data->radar_background_chandef = *chan;
4297 	else
4298 		memset(&data->radar_background_chandef, 0,
4299 		       sizeof(data->radar_background_chandef));
4300 
4301 	return 0;
4302 }
4303 
4304 #ifdef CONFIG_MAC80211_DEBUGFS
4305 #define HWSIM_DEBUGFS_OPS					\
4306 	.link_add_debugfs = mac80211_hwsim_link_add_debugfs,
4307 #else
4308 #define HWSIM_DEBUGFS_OPS
4309 #endif
4310 
4311 #define HWSIM_COMMON_OPS					\
4312 	.tx = mac80211_hwsim_tx,				\
4313 	.wake_tx_queue = ieee80211_hwsim_wake_tx_queue,		\
4314 	.start = mac80211_hwsim_start,				\
4315 	.stop = mac80211_hwsim_stop,				\
4316 	.add_interface = mac80211_hwsim_add_interface,		\
4317 	.change_interface = mac80211_hwsim_change_interface,	\
4318 	.remove_interface = mac80211_hwsim_remove_interface,	\
4319 	.config = mac80211_hwsim_config,			\
4320 	.configure_filter = mac80211_hwsim_configure_filter,	\
4321 	.vif_cfg_changed = mac80211_hwsim_vif_info_changed,	\
4322 	.link_info_changed = mac80211_hwsim_link_info_changed,  \
4323 	.tx_last_beacon = mac80211_hwsim_tx_last_beacon,	\
4324 	.sta_notify = mac80211_hwsim_sta_notify,		\
4325 	.link_sta_rc_update = mac80211_hwsim_sta_rc_update,	\
4326 	.conf_tx = mac80211_hwsim_conf_tx,			\
4327 	.get_survey = mac80211_hwsim_get_survey,		\
4328 	CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)	\
4329 	.ampdu_action = mac80211_hwsim_ampdu_action,		\
4330 	.flush = mac80211_hwsim_flush,				\
4331 	.get_et_sset_count = mac80211_hwsim_get_et_sset_count,	\
4332 	.get_et_stats = mac80211_hwsim_get_et_stats,		\
4333 	.get_et_strings = mac80211_hwsim_get_et_strings,	\
4334 	.start_pmsr = mac80211_hwsim_start_pmsr,		\
4335 	.abort_pmsr = mac80211_hwsim_abort_pmsr,		\
4336 	.set_radar_background = mac80211_hwsim_set_radar_background, \
4337 	.set_key = mac80211_hwsim_set_key,			\
4338 	.set_rts_threshold = mac80211_hwsim_set_rts_threshold,	\
4339 	.start_nan = mac80211_hwsim_nan_start,			\
4340 	.stop_nan = mac80211_hwsim_nan_stop,			\
4341 	.nan_change_conf = mac80211_hwsim_nan_change_config,	\
4342 	.nan_peer_sched_changed = mac80211_hwsim_nan_peer_sched_changed, \
4343 	HWSIM_DEBUGFS_OPS
4344 
4345 #define HWSIM_NON_MLO_OPS					\
4346 	.sta_add = mac80211_hwsim_sta_add,			\
4347 	.sta_remove = mac80211_hwsim_sta_remove,		\
4348 	.set_tim = mac80211_hwsim_set_tim,			\
4349 	.get_tsf = mac80211_hwsim_get_tsf,			\
4350 	.set_tsf = mac80211_hwsim_set_tsf,
4351 
4352 static const struct ieee80211_ops mac80211_hwsim_ops = {
4353 	HWSIM_COMMON_OPS
4354 	HWSIM_NON_MLO_OPS
4355 	.sw_scan_start = mac80211_hwsim_sw_scan,
4356 	.sw_scan_complete = mac80211_hwsim_sw_scan_complete,
4357 	.add_chanctx = ieee80211_emulate_add_chanctx,
4358 	.remove_chanctx = ieee80211_emulate_remove_chanctx,
4359 	.change_chanctx = ieee80211_emulate_change_chanctx,
4360 	.switch_vif_chanctx = ieee80211_emulate_switch_vif_chanctx,
4361 };
4362 
4363 #define HWSIM_CHANCTX_OPS					\
4364 	.hw_scan = mac80211_hwsim_hw_scan,			\
4365 	.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan,	\
4366 	.remain_on_channel = mac80211_hwsim_roc,		\
4367 	.cancel_remain_on_channel = mac80211_hwsim_croc,	\
4368 	.add_chanctx = mac80211_hwsim_add_chanctx,		\
4369 	.remove_chanctx = mac80211_hwsim_remove_chanctx,	\
4370 	.change_chanctx = mac80211_hwsim_change_chanctx,	\
4371 	.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx,\
4372 	.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx, \
4373 	.switch_vif_chanctx = mac80211_hwsim_switch_vif_chanctx,
4374 
4375 static const struct ieee80211_ops mac80211_hwsim_mchan_ops = {
4376 	HWSIM_COMMON_OPS
4377 	HWSIM_NON_MLO_OPS
4378 	HWSIM_CHANCTX_OPS
4379 };
4380 
4381 static const struct ieee80211_ops mac80211_hwsim_mlo_ops = {
4382 	HWSIM_COMMON_OPS
4383 	HWSIM_CHANCTX_OPS
4384 	.change_vif_links = mac80211_hwsim_change_vif_links,
4385 	.change_sta_links = mac80211_hwsim_change_sta_links,
4386 	.sta_state = mac80211_hwsim_sta_state,
4387 	.can_neg_ttlm = mac80211_hwsim_can_neg_ttlm,
4388 };
4389 
4390 struct hwsim_new_radio_params {
4391 	unsigned int channels;
4392 	const char *reg_alpha2;
4393 	const struct ieee80211_regdomain *regd;
4394 	bool reg_strict;
4395 	bool p2p_device;
4396 	bool use_chanctx;
4397 	bool multi_radio;
4398 	bool destroy_on_close;
4399 	const char *hwname;
4400 	bool no_vif;
4401 	const u8 *perm_addr;
4402 	u32 iftypes;
4403 	u32 *ciphers;
4404 	u8 n_ciphers;
4405 	bool mlo;
4406 	const struct cfg80211_pmsr_capabilities *pmsr_capa;
4407 	bool nan_device;
4408 	bool background_radar;
4409 };
4410 
4411 static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb, struct net *net,
4412 				   struct genl_info *info)
4413 {
4414 	if (info)
4415 		genl_notify(&hwsim_genl_family, mcast_skb, info,
4416 			    HWSIM_MCGRP_CONFIG, GFP_KERNEL);
4417 	else
4418 		genlmsg_multicast_netns(&hwsim_genl_family, net, mcast_skb, 0,
4419 					HWSIM_MCGRP_CONFIG, GFP_KERNEL);
4420 }
4421 
4422 static int append_radio_msg(struct sk_buff *skb, int id,
4423 			    struct hwsim_new_radio_params *param)
4424 {
4425 	int ret;
4426 
4427 	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
4428 	if (ret < 0)
4429 		return ret;
4430 
4431 	if (param->channels) {
4432 		ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
4433 		if (ret < 0)
4434 			return ret;
4435 	}
4436 
4437 	if (param->reg_alpha2) {
4438 		ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
4439 			      param->reg_alpha2);
4440 		if (ret < 0)
4441 			return ret;
4442 	}
4443 
4444 	if (param->regd) {
4445 		int i;
4446 
4447 		for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
4448 			if (hwsim_world_regdom_custom[i] != param->regd)
4449 				continue;
4450 
4451 			ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
4452 			if (ret < 0)
4453 				return ret;
4454 			break;
4455 		}
4456 	}
4457 
4458 	if (param->reg_strict) {
4459 		ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
4460 		if (ret < 0)
4461 			return ret;
4462 	}
4463 
4464 	if (param->p2p_device) {
4465 		ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
4466 		if (ret < 0)
4467 			return ret;
4468 	}
4469 
4470 	if (param->use_chanctx) {
4471 		ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
4472 		if (ret < 0)
4473 			return ret;
4474 	}
4475 
4476 	if (param->multi_radio) {
4477 		ret = nla_put_flag(skb, HWSIM_ATTR_MULTI_RADIO);
4478 		if (ret < 0)
4479 			return ret;
4480 	}
4481 
4482 	if (param->hwname) {
4483 		ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
4484 			      strlen(param->hwname), param->hwname);
4485 		if (ret < 0)
4486 			return ret;
4487 	}
4488 
4489 	if (param->nan_device) {
4490 		ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_NAN_DEVICE);
4491 		if (ret < 0)
4492 			return ret;
4493 	}
4494 
4495 	if (param->background_radar) {
4496 		ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR);
4497 		if (ret < 0)
4498 			return ret;
4499 	}
4500 	return 0;
4501 }
4502 
4503 static void hwsim_mcast_new_radio(int id, struct net *net,
4504 				  struct genl_info *info,
4505 				  struct hwsim_new_radio_params *param)
4506 {
4507 	struct sk_buff *mcast_skb;
4508 	void *data;
4509 
4510 	mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
4511 	if (!mcast_skb)
4512 		return;
4513 
4514 	data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
4515 			   HWSIM_CMD_NEW_RADIO);
4516 	if (!data)
4517 		goto out_err;
4518 
4519 	if (append_radio_msg(mcast_skb, id, param) < 0)
4520 		goto out_err;
4521 
4522 	genlmsg_end(mcast_skb, data);
4523 
4524 	hwsim_mcast_config_msg(mcast_skb, net, info);
4525 	return;
4526 
4527 out_err:
4528 	nlmsg_free(mcast_skb);
4529 }
4530 
4531 static const struct ieee80211_sband_iftype_data sband_capa_2ghz[] = {
4532 	{
4533 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
4534 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
4535 		.he_cap = {
4536 			.has_he = true,
4537 			.he_cap_elem = {
4538 				.mac_cap_info[0] =
4539 					IEEE80211_HE_MAC_CAP0_HTC_HE,
4540 				.mac_cap_info[1] =
4541 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4542 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4543 				.mac_cap_info[2] =
4544 					IEEE80211_HE_MAC_CAP2_BSR |
4545 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4546 					IEEE80211_HE_MAC_CAP2_ACK_EN,
4547 				.mac_cap_info[3] =
4548 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4549 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4550 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4551 				.phy_cap_info[0] =
4552 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4553 				.phy_cap_info[1] =
4554 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4555 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4556 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4557 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4558 				.phy_cap_info[2] =
4559 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4560 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4561 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4562 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4563 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4564 
4565 				/* Leave all the other PHY capability bytes
4566 				 * unset, as DCM, beam forming, RU and PPE
4567 				 * threshold information are not supported
4568 				 */
4569 			},
4570 			.he_mcs_nss_supp = {
4571 				.rx_mcs_80 = cpu_to_le16(0xfffa),
4572 				.tx_mcs_80 = cpu_to_le16(0xfffa),
4573 				.rx_mcs_160 = cpu_to_le16(0xffff),
4574 				.tx_mcs_160 = cpu_to_le16(0xffff),
4575 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
4576 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
4577 			},
4578 		},
4579 		.eht_cap = {
4580 			.has_eht = true,
4581 			.eht_cap_elem = {
4582 				.mac_cap_info[0] =
4583 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4584 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4585 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4586 				.phy_cap_info[0] =
4587 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4588 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4589 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4590 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4591 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4592 				.phy_cap_info[3] =
4593 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4594 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4595 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4596 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4597 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4598 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4599 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4600 				.phy_cap_info[4] =
4601 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4602 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4603 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4604 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4605 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4606 				.phy_cap_info[5] =
4607 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4608 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4609 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4610 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4611 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4612 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4613 				.phy_cap_info[6] =
4614 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4615 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4616 				.phy_cap_info[7] =
4617 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4618 			},
4619 
4620 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4621 			 * Rx
4622 			 */
4623 			.eht_mcs_nss_supp = {
4624 				/*
4625 				 * Since B0, B1, B2 and B3 are not set in
4626 				 * the supported channel width set field in the
4627 				 * HE PHY capabilities information field the
4628 				 * device is a 20MHz only device on 2.4GHz band.
4629 				 */
4630 				.only_20mhz = {
4631 					.rx_tx_mcs7_max_nss = 0x88,
4632 					.rx_tx_mcs9_max_nss = 0x88,
4633 					.rx_tx_mcs11_max_nss = 0x88,
4634 					.rx_tx_mcs13_max_nss = 0x88,
4635 				},
4636 			},
4637 			/* PPE threshold information is not supported */
4638 		},
4639 		.uhr_cap = {
4640 			.has_uhr = true,
4641 			.mac.mac_cap = {
4642 				[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP,
4643 			},
4644 			.phy.cap = cpu_to_le32(IEEE80211_UHR_PHY_CAP_ELR_RX |
4645 					       IEEE80211_UHR_PHY_CAP_ELR_TX),
4646 		},
4647 	},
4648 	{
4649 		.types_mask = BIT(NL80211_IFTYPE_AP) |
4650 			      BIT(NL80211_IFTYPE_P2P_GO),
4651 		.he_cap = {
4652 			.has_he = true,
4653 			.he_cap_elem = {
4654 				.mac_cap_info[0] =
4655 					IEEE80211_HE_MAC_CAP0_HTC_HE,
4656 				.mac_cap_info[1] =
4657 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4658 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4659 				.mac_cap_info[2] =
4660 					IEEE80211_HE_MAC_CAP2_BSR |
4661 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4662 					IEEE80211_HE_MAC_CAP2_ACK_EN,
4663 				.mac_cap_info[3] =
4664 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4665 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4666 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4667 				.phy_cap_info[0] =
4668 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4669 				.phy_cap_info[1] =
4670 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4671 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4672 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4673 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4674 				.phy_cap_info[2] =
4675 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4676 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4677 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4678 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4679 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4680 
4681 				/* Leave all the other PHY capability bytes
4682 				 * unset, as DCM, beam forming, RU and PPE
4683 				 * threshold information are not supported
4684 				 */
4685 			},
4686 			.he_mcs_nss_supp = {
4687 				.rx_mcs_80 = cpu_to_le16(0xfffa),
4688 				.tx_mcs_80 = cpu_to_le16(0xfffa),
4689 				.rx_mcs_160 = cpu_to_le16(0xffff),
4690 				.tx_mcs_160 = cpu_to_le16(0xffff),
4691 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
4692 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
4693 			},
4694 		},
4695 		.eht_cap = {
4696 			.has_eht = true,
4697 			.eht_cap_elem = {
4698 				.mac_cap_info[0] =
4699 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4700 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4701 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4702 				.phy_cap_info[0] =
4703 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4704 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4705 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4706 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4707 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE,
4708 				.phy_cap_info[3] =
4709 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4710 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4711 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4712 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4713 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4714 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4715 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4716 				.phy_cap_info[4] =
4717 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4718 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4719 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4720 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4721 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4722 				.phy_cap_info[5] =
4723 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4724 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4725 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4726 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4727 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4728 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4729 				.phy_cap_info[6] =
4730 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4731 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4732 				.phy_cap_info[7] =
4733 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW,
4734 			},
4735 
4736 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4737 			 * Rx
4738 			 */
4739 			.eht_mcs_nss_supp = {
4740 				/*
4741 				 * Since B0, B1, B2 and B3 are not set in
4742 				 * the supported channel width set field in the
4743 				 * HE PHY capabilities information field the
4744 				 * device is a 20MHz only device on 2.4GHz band.
4745 				 */
4746 				.only_20mhz = {
4747 					.rx_tx_mcs7_max_nss = 0x88,
4748 					.rx_tx_mcs9_max_nss = 0x88,
4749 					.rx_tx_mcs11_max_nss = 0x88,
4750 					.rx_tx_mcs13_max_nss = 0x88,
4751 				},
4752 			},
4753 			/* PPE threshold information is not supported */
4754 		},
4755 		.uhr_cap = {
4756 			.has_uhr = true,
4757 			.mac.mac_cap = {
4758 				[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP,
4759 				[1] = IEEE80211_UHR_MAC_CAP1_DBE_SUPP,
4760 			},
4761 			.phy.cap = cpu_to_le32(IEEE80211_UHR_PHY_CAP_ELR_RX |
4762 					       IEEE80211_UHR_PHY_CAP_ELR_TX),
4763 		},
4764 	},
4765 #ifdef CONFIG_MAC80211_MESH
4766 	{
4767 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
4768 		.he_cap = {
4769 			.has_he = true,
4770 			.he_cap_elem = {
4771 				.mac_cap_info[0] =
4772 					IEEE80211_HE_MAC_CAP0_HTC_HE,
4773 				.mac_cap_info[1] =
4774 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4775 				.mac_cap_info[2] =
4776 					IEEE80211_HE_MAC_CAP2_ACK_EN,
4777 				.mac_cap_info[3] =
4778 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4779 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4780 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4781 				.phy_cap_info[0] =
4782 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G,
4783 				.phy_cap_info[1] =
4784 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4785 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4786 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4787 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4788 				.phy_cap_info[2] = 0,
4789 
4790 				/* Leave all the other PHY capability bytes
4791 				 * unset, as DCM, beam forming, RU and PPE
4792 				 * threshold information are not supported
4793 				 */
4794 			},
4795 			.he_mcs_nss_supp = {
4796 				.rx_mcs_80 = cpu_to_le16(0xfffa),
4797 				.tx_mcs_80 = cpu_to_le16(0xfffa),
4798 				.rx_mcs_160 = cpu_to_le16(0xffff),
4799 				.tx_mcs_160 = cpu_to_le16(0xffff),
4800 				.rx_mcs_80p80 = cpu_to_le16(0xffff),
4801 				.tx_mcs_80p80 = cpu_to_le16(0xffff),
4802 			},
4803 		},
4804 	},
4805 #endif
4806 };
4807 
4808 static const struct ieee80211_sband_iftype_data sband_capa_5ghz[] = {
4809 	{
4810 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
4811 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
4812 		.he_cap = {
4813 			.has_he = true,
4814 			.he_cap_elem = {
4815 				.mac_cap_info[0] =
4816 					IEEE80211_HE_MAC_CAP0_HTC_HE,
4817 				.mac_cap_info[1] =
4818 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4819 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4820 				.mac_cap_info[2] =
4821 					IEEE80211_HE_MAC_CAP2_BSR |
4822 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4823 					IEEE80211_HE_MAC_CAP2_ACK_EN,
4824 				.mac_cap_info[3] =
4825 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4826 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4827 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4828 				.phy_cap_info[0] =
4829 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4830 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4831 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4832 				.phy_cap_info[1] =
4833 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4834 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4835 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4836 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4837 				.phy_cap_info[2] =
4838 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4839 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4840 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4841 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4842 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4843 
4844 				/* Leave all the other PHY capability bytes
4845 				 * unset, as DCM, beam forming, RU and PPE
4846 				 * threshold information are not supported
4847 				 */
4848 			},
4849 			.he_mcs_nss_supp = {
4850 				.rx_mcs_80 = cpu_to_le16(0xfffa),
4851 				.tx_mcs_80 = cpu_to_le16(0xfffa),
4852 				.rx_mcs_160 = cpu_to_le16(0xfffa),
4853 				.tx_mcs_160 = cpu_to_le16(0xfffa),
4854 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4855 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4856 			},
4857 		},
4858 		.eht_cap = {
4859 			.has_eht = true,
4860 			.eht_cap_elem = {
4861 				.mac_cap_info[0] =
4862 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4863 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4864 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4865 				.phy_cap_info[0] =
4866 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
4867 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
4868 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
4869 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
4870 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
4871 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
4872 				.phy_cap_info[1] =
4873 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
4874 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
4875 				.phy_cap_info[2] =
4876 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
4877 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
4878 				.phy_cap_info[3] =
4879 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
4880 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
4881 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
4882 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
4883 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
4884 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
4885 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
4886 				.phy_cap_info[4] =
4887 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
4888 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
4889 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
4890 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
4891 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
4892 				.phy_cap_info[5] =
4893 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
4894 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
4895 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
4896 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
4897 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
4898 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
4899 				.phy_cap_info[6] =
4900 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
4901 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
4902 				.phy_cap_info[7] =
4903 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
4904 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
4905 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
4906 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
4907 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
4908 			},
4909 
4910 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
4911 			 * Rx
4912 			 */
4913 			.eht_mcs_nss_supp = {
4914 				/*
4915 				 * As B1 and B2 are set in the supported
4916 				 * channel width set field in the HE PHY
4917 				 * capabilities information field include all
4918 				 * the following MCS/NSS.
4919 				 */
4920 				.bw._80 = {
4921 					.rx_tx_mcs9_max_nss = 0x88,
4922 					.rx_tx_mcs11_max_nss = 0x88,
4923 					.rx_tx_mcs13_max_nss = 0x88,
4924 				},
4925 				.bw._160 = {
4926 					.rx_tx_mcs9_max_nss = 0x88,
4927 					.rx_tx_mcs11_max_nss = 0x88,
4928 					.rx_tx_mcs13_max_nss = 0x88,
4929 				},
4930 			},
4931 			/* PPE threshold information is not supported */
4932 		},
4933 		.uhr_cap = {
4934 			.has_uhr = true,
4935 			.mac.mac_cap = {
4936 				[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP,
4937 				[1] = IEEE80211_UHR_MAC_CAP1_DBE_SUPP,
4938 			},
4939 			.phy.cap = cpu_to_le32(IEEE80211_UHR_PHY_CAP_ELR_TX),
4940 		},
4941 	},
4942 	{
4943 		.types_mask = BIT(NL80211_IFTYPE_AP) |
4944 			      BIT(NL80211_IFTYPE_P2P_GO),
4945 		.he_cap = {
4946 			.has_he = true,
4947 			.he_cap_elem = {
4948 				.mac_cap_info[0] =
4949 					IEEE80211_HE_MAC_CAP0_HTC_HE,
4950 				.mac_cap_info[1] =
4951 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
4952 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
4953 				.mac_cap_info[2] =
4954 					IEEE80211_HE_MAC_CAP2_BSR |
4955 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
4956 					IEEE80211_HE_MAC_CAP2_ACK_EN,
4957 				.mac_cap_info[3] =
4958 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
4959 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
4960 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
4961 				.phy_cap_info[0] =
4962 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
4963 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4964 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
4965 				.phy_cap_info[1] =
4966 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
4967 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
4968 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
4969 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
4970 				.phy_cap_info[2] =
4971 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
4972 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
4973 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
4974 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
4975 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
4976 
4977 				/* Leave all the other PHY capability bytes
4978 				 * unset, as DCM, beam forming, RU and PPE
4979 				 * threshold information are not supported
4980 				 */
4981 			},
4982 			.he_mcs_nss_supp = {
4983 				.rx_mcs_80 = cpu_to_le16(0xfffa),
4984 				.tx_mcs_80 = cpu_to_le16(0xfffa),
4985 				.rx_mcs_160 = cpu_to_le16(0xfffa),
4986 				.tx_mcs_160 = cpu_to_le16(0xfffa),
4987 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
4988 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
4989 			},
4990 		},
4991 		.eht_cap = {
4992 			.has_eht = true,
4993 			.eht_cap_elem = {
4994 				.mac_cap_info[0] =
4995 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
4996 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
4997 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
4998 				.phy_cap_info[0] =
4999 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
5000 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
5001 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
5002 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
5003 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
5004 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
5005 				.phy_cap_info[1] =
5006 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
5007 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK,
5008 				.phy_cap_info[2] =
5009 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
5010 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK,
5011 				.phy_cap_info[3] =
5012 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
5013 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
5014 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
5015 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
5016 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
5017 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
5018 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
5019 				.phy_cap_info[4] =
5020 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
5021 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
5022 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
5023 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
5024 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
5025 				.phy_cap_info[5] =
5026 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
5027 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
5028 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
5029 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
5030 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
5031 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
5032 				.phy_cap_info[6] =
5033 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
5034 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK,
5035 				.phy_cap_info[7] =
5036 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
5037 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
5038 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
5039 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
5040 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ,
5041 			},
5042 
5043 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
5044 			 * Rx
5045 			 */
5046 			.eht_mcs_nss_supp = {
5047 				/*
5048 				 * As B1 and B2 are set in the supported
5049 				 * channel width set field in the HE PHY
5050 				 * capabilities information field include all
5051 				 * the following MCS/NSS.
5052 				 */
5053 				.bw._80 = {
5054 					.rx_tx_mcs9_max_nss = 0x88,
5055 					.rx_tx_mcs11_max_nss = 0x88,
5056 					.rx_tx_mcs13_max_nss = 0x88,
5057 				},
5058 				.bw._160 = {
5059 					.rx_tx_mcs9_max_nss = 0x88,
5060 					.rx_tx_mcs11_max_nss = 0x88,
5061 					.rx_tx_mcs13_max_nss = 0x88,
5062 				},
5063 			},
5064 			/* PPE threshold information is not supported */
5065 		},
5066 		.uhr_cap = {
5067 			.has_uhr = true,
5068 			.mac.mac_cap = {
5069 				[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP,
5070 				[1] = IEEE80211_UHR_MAC_CAP1_DBE_SUPP,
5071 			},
5072 			.phy.cap = cpu_to_le32(IEEE80211_UHR_PHY_CAP_ELR_RX),
5073 		},
5074 	},
5075 #ifdef CONFIG_MAC80211_MESH
5076 	{
5077 		/* TODO: should we support other types, e.g., IBSS?*/
5078 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
5079 		.he_cap = {
5080 			.has_he = true,
5081 			.he_cap_elem = {
5082 				.mac_cap_info[0] =
5083 					IEEE80211_HE_MAC_CAP0_HTC_HE,
5084 				.mac_cap_info[1] =
5085 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5086 				.mac_cap_info[2] =
5087 					IEEE80211_HE_MAC_CAP2_ACK_EN,
5088 				.mac_cap_info[3] =
5089 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5090 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5091 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5092 				.phy_cap_info[0] =
5093 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5094 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5095 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5096 				.phy_cap_info[1] =
5097 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5098 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5099 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5100 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5101 				.phy_cap_info[2] = 0,
5102 
5103 				/* Leave all the other PHY capability bytes
5104 				 * unset, as DCM, beam forming, RU and PPE
5105 				 * threshold information are not supported
5106 				 */
5107 			},
5108 			.he_mcs_nss_supp = {
5109 				.rx_mcs_80 = cpu_to_le16(0xfffa),
5110 				.tx_mcs_80 = cpu_to_le16(0xfffa),
5111 				.rx_mcs_160 = cpu_to_le16(0xfffa),
5112 				.tx_mcs_160 = cpu_to_le16(0xfffa),
5113 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
5114 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
5115 			},
5116 		},
5117 	},
5118 #endif
5119 };
5120 
5121 static const struct ieee80211_sband_iftype_data sband_capa_6ghz[] = {
5122 	{
5123 		.types_mask = BIT(NL80211_IFTYPE_STATION) |
5124 			      BIT(NL80211_IFTYPE_P2P_CLIENT),
5125 		.he_6ghz_capa = {
5126 			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
5127 					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
5128 					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
5129 					    IEEE80211_HE_6GHZ_CAP_SM_PS |
5130 					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
5131 					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
5132 					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
5133 		},
5134 		.he_cap = {
5135 			.has_he = true,
5136 			.he_cap_elem = {
5137 				.mac_cap_info[0] =
5138 					IEEE80211_HE_MAC_CAP0_HTC_HE,
5139 				.mac_cap_info[1] =
5140 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
5141 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5142 				.mac_cap_info[2] =
5143 					IEEE80211_HE_MAC_CAP2_BSR |
5144 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
5145 					IEEE80211_HE_MAC_CAP2_ACK_EN,
5146 				.mac_cap_info[3] =
5147 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5148 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5149 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5150 				.phy_cap_info[0] =
5151 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5152 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5153 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5154 				.phy_cap_info[1] =
5155 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5156 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5157 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5158 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5159 				.phy_cap_info[2] =
5160 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
5161 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
5162 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
5163 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
5164 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
5165 
5166 				/* Leave all the other PHY capability bytes
5167 				 * unset, as DCM, beam forming, RU and PPE
5168 				 * threshold information are not supported
5169 				 */
5170 			},
5171 			.he_mcs_nss_supp = {
5172 				.rx_mcs_80 = cpu_to_le16(0xfffa),
5173 				.tx_mcs_80 = cpu_to_le16(0xfffa),
5174 				.rx_mcs_160 = cpu_to_le16(0xfffa),
5175 				.tx_mcs_160 = cpu_to_le16(0xfffa),
5176 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
5177 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
5178 			},
5179 		},
5180 		.eht_cap = {
5181 			.has_eht = true,
5182 			.eht_cap_elem = {
5183 				.mac_cap_info[0] =
5184 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
5185 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
5186 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
5187 				.phy_cap_info[0] =
5188 					IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
5189 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
5190 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
5191 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
5192 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
5193 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
5194 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
5195 				.phy_cap_info[1] =
5196 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
5197 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
5198 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
5199 				.phy_cap_info[2] =
5200 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
5201 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
5202 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
5203 				.phy_cap_info[3] =
5204 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
5205 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
5206 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
5207 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
5208 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
5209 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
5210 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
5211 				.phy_cap_info[4] =
5212 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
5213 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
5214 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
5215 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
5216 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
5217 				.phy_cap_info[5] =
5218 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
5219 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
5220 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
5221 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
5222 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
5223 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
5224 				.phy_cap_info[6] =
5225 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
5226 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
5227 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
5228 				.phy_cap_info[7] =
5229 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
5230 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
5231 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
5232 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
5233 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
5234 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
5235 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
5236 			},
5237 
5238 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
5239 			 * Rx
5240 			 */
5241 			.eht_mcs_nss_supp = {
5242 				/*
5243 				 * As B1 and B2 are set in the supported
5244 				 * channel width set field in the HE PHY
5245 				 * capabilities information field and 320MHz in
5246 				 * 6GHz is supported include all the following
5247 				 * MCS/NSS.
5248 				 */
5249 				.bw._80 = {
5250 					.rx_tx_mcs9_max_nss = 0x88,
5251 					.rx_tx_mcs11_max_nss = 0x88,
5252 					.rx_tx_mcs13_max_nss = 0x88,
5253 				},
5254 				.bw._160 = {
5255 					.rx_tx_mcs9_max_nss = 0x88,
5256 					.rx_tx_mcs11_max_nss = 0x88,
5257 					.rx_tx_mcs13_max_nss = 0x88,
5258 				},
5259 				.bw._320 = {
5260 					.rx_tx_mcs9_max_nss = 0x88,
5261 					.rx_tx_mcs11_max_nss = 0x88,
5262 					.rx_tx_mcs13_max_nss = 0x88,
5263 				},
5264 			},
5265 			/* PPE threshold information is not supported */
5266 		},
5267 		.uhr_cap = {
5268 			.has_uhr = true,
5269 			.mac.mac_cap = {
5270 				[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP,
5271 				[1] = IEEE80211_UHR_MAC_CAP1_DBE_SUPP,
5272 			},
5273 			.phy.cap = cpu_to_le32(IEEE80211_UHR_PHY_CAP_ELR_TX),
5274 		},
5275 	},
5276 	{
5277 		.types_mask = BIT(NL80211_IFTYPE_AP) |
5278 			      BIT(NL80211_IFTYPE_P2P_GO),
5279 		.he_6ghz_capa = {
5280 			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
5281 					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
5282 					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
5283 					    IEEE80211_HE_6GHZ_CAP_SM_PS |
5284 					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
5285 					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
5286 					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
5287 		},
5288 		.he_cap = {
5289 			.has_he = true,
5290 			.he_cap_elem = {
5291 				.mac_cap_info[0] =
5292 					IEEE80211_HE_MAC_CAP0_HTC_HE,
5293 				.mac_cap_info[1] =
5294 					IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
5295 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5296 				.mac_cap_info[2] =
5297 					IEEE80211_HE_MAC_CAP2_BSR |
5298 					IEEE80211_HE_MAC_CAP2_MU_CASCADING |
5299 					IEEE80211_HE_MAC_CAP2_ACK_EN,
5300 				.mac_cap_info[3] =
5301 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5302 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5303 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5304 				.phy_cap_info[0] =
5305 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5306 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5307 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5308 				.phy_cap_info[1] =
5309 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5310 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5311 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5312 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5313 				.phy_cap_info[2] =
5314 					IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
5315 					IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
5316 					IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
5317 					IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
5318 					IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
5319 
5320 				/* Leave all the other PHY capability bytes
5321 				 * unset, as DCM, beam forming, RU and PPE
5322 				 * threshold information are not supported
5323 				 */
5324 			},
5325 			.he_mcs_nss_supp = {
5326 				.rx_mcs_80 = cpu_to_le16(0xfffa),
5327 				.tx_mcs_80 = cpu_to_le16(0xfffa),
5328 				.rx_mcs_160 = cpu_to_le16(0xfffa),
5329 				.tx_mcs_160 = cpu_to_le16(0xfffa),
5330 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
5331 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
5332 			},
5333 		},
5334 		.eht_cap = {
5335 			.has_eht = true,
5336 			.eht_cap_elem = {
5337 				.mac_cap_info[0] =
5338 					IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
5339 					IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
5340 					IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
5341 				.phy_cap_info[0] =
5342 					IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ |
5343 					IEEE80211_EHT_PHY_CAP0_242_TONE_RU_GT20MHZ |
5344 					IEEE80211_EHT_PHY_CAP0_NDP_4_EHT_LFT_32_GI |
5345 					IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO |
5346 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMER |
5347 					IEEE80211_EHT_PHY_CAP0_SU_BEAMFORMEE |
5348 					IEEE80211_EHT_PHY_CAP0_BEAMFORMEE_SS_80MHZ_MASK,
5349 				.phy_cap_info[1] =
5350 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_80MHZ_MASK |
5351 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_160MHZ_MASK |
5352 					IEEE80211_EHT_PHY_CAP1_BEAMFORMEE_SS_320MHZ_MASK,
5353 				.phy_cap_info[2] =
5354 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_80MHZ_MASK |
5355 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_160MHZ_MASK |
5356 					IEEE80211_EHT_PHY_CAP2_SOUNDING_DIM_320MHZ_MASK,
5357 				.phy_cap_info[3] =
5358 					IEEE80211_EHT_PHY_CAP3_NG_16_SU_FEEDBACK |
5359 					IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
5360 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
5361 					IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
5362 					IEEE80211_EHT_PHY_CAP3_TRIG_SU_BF_FDBK |
5363 					IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
5364 					IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK,
5365 				.phy_cap_info[4] =
5366 					IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
5367 					IEEE80211_EHT_PHY_CAP4_PSR_SR_SUPP |
5368 					IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP |
5369 					IEEE80211_EHT_PHY_CAP4_EHT_MU_PPDU_4_EHT_LTF_08_GI |
5370 					IEEE80211_EHT_PHY_CAP4_MAX_NC_MASK,
5371 				.phy_cap_info[5] =
5372 					IEEE80211_EHT_PHY_CAP5_NON_TRIG_CQI_FEEDBACK |
5373 					IEEE80211_EHT_PHY_CAP5_TX_LESS_242_TONE_RU_SUPP |
5374 					IEEE80211_EHT_PHY_CAP5_RX_LESS_242_TONE_RU_SUPP |
5375 					IEEE80211_EHT_PHY_CAP5_PPE_THRESHOLD_PRESENT |
5376 					IEEE80211_EHT_PHY_CAP5_COMMON_NOMINAL_PKT_PAD_MASK |
5377 					IEEE80211_EHT_PHY_CAP5_MAX_NUM_SUPP_EHT_LTF_MASK,
5378 				.phy_cap_info[6] =
5379 					IEEE80211_EHT_PHY_CAP6_MAX_NUM_SUPP_EHT_LTF_MASK |
5380 					IEEE80211_EHT_PHY_CAP6_MCS15_SUPP_MASK |
5381 					IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP,
5382 				.phy_cap_info[7] =
5383 					IEEE80211_EHT_PHY_CAP7_20MHZ_STA_RX_NDP_WIDER_BW |
5384 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_80MHZ |
5385 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_160MHZ |
5386 					IEEE80211_EHT_PHY_CAP7_NON_OFDMA_UL_MU_MIMO_320MHZ |
5387 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_80MHZ |
5388 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_160MHZ |
5389 					IEEE80211_EHT_PHY_CAP7_MU_BEAMFORMER_320MHZ,
5390 			},
5391 
5392 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
5393 			 * Rx
5394 			 */
5395 			.eht_mcs_nss_supp = {
5396 				/*
5397 				 * As B1 and B2 are set in the supported
5398 				 * channel width set field in the HE PHY
5399 				 * capabilities information field and 320MHz in
5400 				 * 6GHz is supported include all the following
5401 				 * MCS/NSS.
5402 				 */
5403 				.bw._80 = {
5404 					.rx_tx_mcs9_max_nss = 0x88,
5405 					.rx_tx_mcs11_max_nss = 0x88,
5406 					.rx_tx_mcs13_max_nss = 0x88,
5407 				},
5408 				.bw._160 = {
5409 					.rx_tx_mcs9_max_nss = 0x88,
5410 					.rx_tx_mcs11_max_nss = 0x88,
5411 					.rx_tx_mcs13_max_nss = 0x88,
5412 				},
5413 				.bw._320 = {
5414 					.rx_tx_mcs9_max_nss = 0x88,
5415 					.rx_tx_mcs11_max_nss = 0x88,
5416 					.rx_tx_mcs13_max_nss = 0x88,
5417 				},
5418 			},
5419 			/* PPE threshold information is not supported */
5420 		},
5421 		.uhr_cap = {
5422 			.has_uhr = true,
5423 			.mac.mac_cap = {
5424 				[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP,
5425 				[1] = IEEE80211_UHR_MAC_CAP1_DBE_SUPP,
5426 			},
5427 			.phy.cap = cpu_to_le32(IEEE80211_UHR_PHY_CAP_ELR_RX),
5428 		},
5429 	},
5430 #ifdef CONFIG_MAC80211_MESH
5431 	{
5432 		/* TODO: should we support other types, e.g., IBSS?*/
5433 		.types_mask = BIT(NL80211_IFTYPE_MESH_POINT),
5434 		.he_6ghz_capa = {
5435 			.capa = cpu_to_le16(IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START |
5436 					    IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP |
5437 					    IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN |
5438 					    IEEE80211_HE_6GHZ_CAP_SM_PS |
5439 					    IEEE80211_HE_6GHZ_CAP_RD_RESPONDER |
5440 					    IEEE80211_HE_6GHZ_CAP_TX_ANTPAT_CONS |
5441 					    IEEE80211_HE_6GHZ_CAP_RX_ANTPAT_CONS),
5442 		},
5443 		.he_cap = {
5444 			.has_he = true,
5445 			.he_cap_elem = {
5446 				.mac_cap_info[0] =
5447 					IEEE80211_HE_MAC_CAP0_HTC_HE,
5448 				.mac_cap_info[1] =
5449 					IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5450 				.mac_cap_info[2] =
5451 					IEEE80211_HE_MAC_CAP2_ACK_EN,
5452 				.mac_cap_info[3] =
5453 					IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5454 					IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5455 				.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5456 				.phy_cap_info[0] =
5457 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5458 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5459 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5460 				.phy_cap_info[1] =
5461 					IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5462 					IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5463 					IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5464 					IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5465 				.phy_cap_info[2] = 0,
5466 
5467 				/* Leave all the other PHY capability bytes
5468 				 * unset, as DCM, beam forming, RU and PPE
5469 				 * threshold information are not supported
5470 				 */
5471 			},
5472 			.he_mcs_nss_supp = {
5473 				.rx_mcs_80 = cpu_to_le16(0xfffa),
5474 				.tx_mcs_80 = cpu_to_le16(0xfffa),
5475 				.rx_mcs_160 = cpu_to_le16(0xfffa),
5476 				.tx_mcs_160 = cpu_to_le16(0xfffa),
5477 				.rx_mcs_80p80 = cpu_to_le16(0xfffa),
5478 				.tx_mcs_80p80 = cpu_to_le16(0xfffa),
5479 			},
5480 		},
5481 		.eht_cap = {
5482 			.has_eht = true,
5483 			.eht_cap_elem = {
5484 				.mac_cap_info[0] = IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
5485 						   IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1,
5486 				.phy_cap_info[0] = IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ,
5487 				/* Leave all the other PHY capability bytes
5488 				 * unset, as DCM, beam forming, RU and PPE
5489 				 * threshold information are not supported
5490 				 */
5491 			},
5492 			/* For all MCS and bandwidth, set 8 NSS for both Tx and
5493 			 * Rx
5494 			 */
5495 			.eht_mcs_nss_supp = {
5496 				/* As B1 and B2 are set in the supported
5497 				 * channel width set field in the HE PHY
5498 				 * capabilities information field and 320MHz in
5499 				 * 6GHz is supported include all the following
5500 				 * MCS/NSS.
5501 				 */
5502 				.bw._80 = {
5503 					.rx_tx_mcs9_max_nss = 0x88,
5504 					.rx_tx_mcs11_max_nss = 0x88,
5505 					.rx_tx_mcs13_max_nss = 0x88,
5506 				},
5507 				.bw._160 = {
5508 					.rx_tx_mcs9_max_nss = 0x88,
5509 					.rx_tx_mcs11_max_nss = 0x88,
5510 					.rx_tx_mcs13_max_nss = 0x88,
5511 				},
5512 				.bw._320 = {
5513 					.rx_tx_mcs9_max_nss = 0x88,
5514 					.rx_tx_mcs11_max_nss = 0x88,
5515 					.rx_tx_mcs13_max_nss = 0x88,
5516 				},
5517 			},
5518 			/* PPE threshold information is not supported */
5519 		},
5520 		.uhr_cap = {
5521 			.has_uhr = true,
5522 			.mac.mac_cap = {
5523 				[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP,
5524 			},
5525 			.phy.cap = cpu_to_le32(IEEE80211_UHR_PHY_CAP_ELR_RX |
5526 					       IEEE80211_UHR_PHY_CAP_ELR_TX),
5527 		},
5528 	},
5529 #endif
5530 };
5531 
5532 #define HWSIM_VHT_MCS_MAP				\
5533 	(IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |		\
5534 	 IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |		\
5535 	 IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |		\
5536 	 IEEE80211_VHT_MCS_SUPPORT_0_9 << 6 |		\
5537 	 IEEE80211_VHT_MCS_SUPPORT_0_9 << 8 |		\
5538 	 IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |		\
5539 	 IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |		\
5540 	 IEEE80211_VHT_MCS_SUPPORT_0_9 << 14)
5541 
5542 static const struct ieee80211_sta_ht_cap hwsim_nan_ht_cap = {
5543 	.ht_supported = true,
5544 	.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
5545 	       IEEE80211_HT_CAP_GRN_FLD |
5546 	       IEEE80211_HT_CAP_SGI_20 |
5547 	       IEEE80211_HT_CAP_SGI_40 |
5548 	       IEEE80211_HT_CAP_DSSSCCK40,
5549 	.ampdu_factor = 0x3,
5550 	.ampdu_density = 0x6,
5551 	.mcs = {
5552 		.rx_mask = { 0xff, 0xff },
5553 		.tx_params = IEEE80211_HT_MCS_TX_DEFINED,
5554 	},
5555 };
5556 
5557 static const struct ieee80211_sta_vht_cap hwsim_nan_vht_cap = {
5558 	.vht_supported = true,
5559 	.cap = IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
5560 	       IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
5561 	       IEEE80211_VHT_CAP_RXLDPC |
5562 	       IEEE80211_VHT_CAP_SHORT_GI_80 |
5563 	       IEEE80211_VHT_CAP_SHORT_GI_160 |
5564 	       IEEE80211_VHT_CAP_TXSTBC |
5565 	       IEEE80211_VHT_CAP_RXSTBC_4 |
5566 	       IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK,
5567 	.vht_mcs = {
5568 		.rx_mcs_map = cpu_to_le16(HWSIM_VHT_MCS_MAP),
5569 		.tx_mcs_map = cpu_to_le16(HWSIM_VHT_MCS_MAP),
5570 	},
5571 };
5572 
5573 static const struct ieee80211_sta_he_cap hwsim_nan_he_cap = {
5574 	.has_he = true,
5575 	.he_cap_elem = {
5576 		.mac_cap_info[0] =
5577 			IEEE80211_HE_MAC_CAP0_HTC_HE,
5578 		.mac_cap_info[1] =
5579 			IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US |
5580 			IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8,
5581 		.mac_cap_info[2] =
5582 			IEEE80211_HE_MAC_CAP2_BSR |
5583 			IEEE80211_HE_MAC_CAP2_MU_CASCADING |
5584 			IEEE80211_HE_MAC_CAP2_ACK_EN,
5585 		.mac_cap_info[3] =
5586 			IEEE80211_HE_MAC_CAP3_OMI_CONTROL |
5587 			IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3,
5588 		.mac_cap_info[4] = IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU,
5589 		.phy_cap_info[0] =
5590 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
5591 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
5592 			IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G,
5593 		.phy_cap_info[1] =
5594 			IEEE80211_HE_PHY_CAP1_PREAMBLE_PUNC_RX_MASK |
5595 			IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A |
5596 			IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD |
5597 			IEEE80211_HE_PHY_CAP1_MIDAMBLE_RX_TX_MAX_NSTS,
5598 		.phy_cap_info[2] =
5599 			IEEE80211_HE_PHY_CAP2_NDP_4x_LTF_AND_3_2US |
5600 			IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ |
5601 			IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ |
5602 			IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO |
5603 			IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO,
5604 
5605 		/*
5606 		 * Leave all the other PHY capability bytes
5607 		 * unset, as DCM, beam forming, RU and PPE
5608 		 * threshold information are not supported
5609 		 */
5610 	},
5611 	.he_mcs_nss_supp = {
5612 		.rx_mcs_80 = cpu_to_le16(0xfffa),
5613 		.tx_mcs_80 = cpu_to_le16(0xfffa),
5614 		.rx_mcs_160 = cpu_to_le16(0xfffa),
5615 		.tx_mcs_160 = cpu_to_le16(0xfffa),
5616 		.rx_mcs_80p80 = cpu_to_le16(0xfffa),
5617 		.tx_mcs_80p80 = cpu_to_le16(0xfffa),
5618 	},
5619 };
5620 
5621 static void mac80211_hwsim_sband_capab(struct ieee80211_supported_band *sband)
5622 {
5623 	switch (sband->band) {
5624 	case NL80211_BAND_2GHZ:
5625 		ieee80211_set_sband_iftype_data(sband, sband_capa_2ghz);
5626 		break;
5627 	case NL80211_BAND_5GHZ:
5628 		ieee80211_set_sband_iftype_data(sband, sband_capa_5ghz);
5629 		break;
5630 	case NL80211_BAND_6GHZ:
5631 		ieee80211_set_sband_iftype_data(sband, sband_capa_6ghz);
5632 		break;
5633 	default:
5634 		break;
5635 	}
5636 }
5637 
5638 #ifdef CONFIG_MAC80211_MESH
5639 #define HWSIM_MESH_BIT BIT(NL80211_IFTYPE_MESH_POINT)
5640 #else
5641 #define HWSIM_MESH_BIT 0
5642 #endif
5643 
5644 #define HWSIM_DEFAULT_IF_LIMIT \
5645 	(BIT(NL80211_IFTYPE_STATION) | \
5646 	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
5647 	 BIT(NL80211_IFTYPE_AP) | \
5648 	 BIT(NL80211_IFTYPE_P2P_GO) | \
5649 	 HWSIM_MESH_BIT)
5650 
5651 #define HWSIM_IFTYPE_SUPPORT_MASK \
5652 	(BIT(NL80211_IFTYPE_STATION) | \
5653 	 BIT(NL80211_IFTYPE_AP) | \
5654 	 BIT(NL80211_IFTYPE_P2P_CLIENT) | \
5655 	 BIT(NL80211_IFTYPE_P2P_GO) | \
5656 	 BIT(NL80211_IFTYPE_ADHOC) | \
5657 	 BIT(NL80211_IFTYPE_MESH_POINT) | \
5658 	 BIT(NL80211_IFTYPE_OCB))
5659 
5660 static const u8 iftypes_ext_capa[] = {
5661 	 [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
5662 	 [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
5663 	 [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF |
5664 	       WLAN_EXT_CAPA8_MAX_MSDU_IN_AMSDU_LSB,
5665 	 [8] = WLAN_EXT_CAPA9_MAX_MSDU_IN_AMSDU_MSB,
5666 };
5667 
5668 static const u8 iftypes_ext_capa_ap[] = {
5669 	 [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING,
5670 	 [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT,
5671 	 [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF |
5672 	       WLAN_EXT_CAPA8_MAX_MSDU_IN_AMSDU_LSB,
5673 	 [8] = WLAN_EXT_CAPA9_MAX_MSDU_IN_AMSDU_MSB,
5674 	 [9] = WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT,
5675 };
5676 
5677 #define MAC80211_HWSIM_MLD_CAPA_OPS				\
5678 	FIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP, \
5679 			 IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP_SAME) | \
5680 	FIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS, \
5681 			 IEEE80211_MLD_MAX_NUM_LINKS - 1)
5682 
5683 static const struct wiphy_iftype_ext_capab mac80211_hwsim_iftypes_ext_capa[] = {
5684 	{
5685 		.iftype = NL80211_IFTYPE_AP,
5686 		.extended_capabilities = iftypes_ext_capa_ap,
5687 		.extended_capabilities_mask = iftypes_ext_capa_ap,
5688 		.extended_capabilities_len = sizeof(iftypes_ext_capa_ap),
5689 		.eml_capabilities = IEEE80211_EML_CAP_EMLSR_SUPP |
5690 				    IEEE80211_EML_CAP_EMLMR_SUPPORT,
5691 		.mld_capa_and_ops = MAC80211_HWSIM_MLD_CAPA_OPS,
5692 		/* CIP works as hwsim does not have control frames */
5693 		.cip_supported = true,
5694 		.cip_capabilities = 0,
5695 	},
5696 	{
5697 		.iftype = NL80211_IFTYPE_STATION,
5698 		.extended_capabilities = iftypes_ext_capa,
5699 		.extended_capabilities_mask = iftypes_ext_capa,
5700 		.extended_capabilities_len = sizeof(iftypes_ext_capa),
5701 		.cip_supported = true,
5702 		.cip_capabilities = 0,
5703 	},
5704 	{
5705 		.iftype = NL80211_IFTYPE_P2P_CLIENT,
5706 		.extended_capabilities = iftypes_ext_capa,
5707 		.extended_capabilities_mask = iftypes_ext_capa,
5708 		.extended_capabilities_len = sizeof(iftypes_ext_capa),
5709 		.cip_supported = true,
5710 		.cip_capabilities = 0,
5711 	},
5712 	{
5713 		.iftype = NL80211_IFTYPE_P2P_GO,
5714 		.extended_capabilities = iftypes_ext_capa,
5715 		.extended_capabilities_mask = iftypes_ext_capa,
5716 		.extended_capabilities_len = sizeof(iftypes_ext_capa),
5717 		.cip_supported = true,
5718 		.cip_capabilities = 0,
5719 	},
5720 };
5721 
5722 static int mac80211_hwsim_new_radio(struct genl_info *info,
5723 				    struct hwsim_new_radio_params *param)
5724 {
5725 	int err;
5726 	u8 addr[ETH_ALEN];
5727 	struct mac80211_hwsim_data *data;
5728 	struct ieee80211_hw *hw;
5729 	enum nl80211_band band;
5730 	const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
5731 	struct net *net;
5732 	int idx, i;
5733 	int n_limits = 0;
5734 	int n_bands = 0;
5735 
5736 	if (WARN_ON(param->channels > 1 && !param->use_chanctx))
5737 		return -EINVAL;
5738 
5739 	spin_lock_bh(&hwsim_radio_lock);
5740 	idx = hwsim_radio_idx++;
5741 	spin_unlock_bh(&hwsim_radio_lock);
5742 
5743 	if (param->mlo)
5744 		ops = &mac80211_hwsim_mlo_ops;
5745 	else if (param->use_chanctx)
5746 		ops = &mac80211_hwsim_mchan_ops;
5747 	hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
5748 	if (!hw) {
5749 		pr_debug("mac80211_hwsim: ieee80211_alloc_hw failed\n");
5750 		err = -ENOMEM;
5751 		goto failed;
5752 	}
5753 
5754 	if (info)
5755 		net = genl_info_net(info);
5756 	else
5757 		net = &init_net;
5758 	wiphy_net_set(hw->wiphy, net);
5759 
5760 	data = hw->priv;
5761 	data->hw = hw;
5762 
5763 	data->dev = device_create(&hwsim_class, NULL, 0, hw, "hwsim%d", idx);
5764 	if (IS_ERR(data->dev)) {
5765 		printk(KERN_DEBUG
5766 		       "mac80211_hwsim: device_create failed (%ld)\n",
5767 		       PTR_ERR(data->dev));
5768 		err = -ENOMEM;
5769 		goto failed_drvdata;
5770 	}
5771 	data->dev->driver = &mac80211_hwsim_driver.driver;
5772 	err = device_bind_driver(data->dev);
5773 	if (err != 0) {
5774 		pr_debug("mac80211_hwsim: device_bind_driver failed (%d)\n",
5775 		       err);
5776 		goto failed_bind;
5777 	}
5778 
5779 	skb_queue_head_init(&data->pending);
5780 
5781 	SET_IEEE80211_DEV(hw, data->dev);
5782 	if (!param->perm_addr) {
5783 		eth_zero_addr(addr);
5784 		addr[0] = 0x02;
5785 		addr[3] = idx >> 8;
5786 		addr[4] = idx;
5787 		memcpy(data->addresses[0].addr, addr, ETH_ALEN);
5788 		/* Why need here second address ? */
5789 		memcpy(data->addresses[1].addr, addr, ETH_ALEN);
5790 		data->addresses[1].addr[0] |= 0x40;
5791 		memcpy(data->addresses[2].addr, addr, ETH_ALEN);
5792 		data->addresses[2].addr[0] |= 0x50;
5793 
5794 		hw->wiphy->n_addresses = 3;
5795 		hw->wiphy->addresses = data->addresses;
5796 		/* possible address clash is checked at hash table insertion */
5797 	} else {
5798 		memcpy(data->addresses[0].addr, param->perm_addr, ETH_ALEN);
5799 		/* compatibility with automatically generated mac addr */
5800 		memcpy(data->addresses[1].addr, param->perm_addr, ETH_ALEN);
5801 		memcpy(data->addresses[2].addr, param->perm_addr, ETH_ALEN);
5802 		hw->wiphy->n_addresses = 3;
5803 		hw->wiphy->addresses = data->addresses;
5804 	}
5805 
5806 	data->channels = param->channels;
5807 	data->use_chanctx = param->use_chanctx;
5808 	data->idx = idx;
5809 	data->destroy_on_close = param->destroy_on_close;
5810 	if (info)
5811 		data->portid = info->snd_portid;
5812 
5813 	/* setup interface limits, only on interface types we support */
5814 	if (param->iftypes & BIT(NL80211_IFTYPE_ADHOC)) {
5815 		data->if_limits[n_limits].max = 1;
5816 		data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_ADHOC);
5817 		n_limits++;
5818 	}
5819 
5820 	if (param->iftypes & HWSIM_DEFAULT_IF_LIMIT) {
5821 		data->if_limits[n_limits].max = 2048;
5822 		/*
5823 		 * For this case, we may only support a subset of
5824 		 * HWSIM_DEFAULT_IF_LIMIT, therefore we only want to add the
5825 		 * bits that both param->iftype & HWSIM_DEFAULT_IF_LIMIT have.
5826 		 */
5827 		data->if_limits[n_limits].types =
5828 					HWSIM_DEFAULT_IF_LIMIT & param->iftypes;
5829 		n_limits++;
5830 	}
5831 
5832 	if (param->iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
5833 		data->if_limits[n_limits].max = 1;
5834 		data->if_limits[n_limits].types =
5835 						BIT(NL80211_IFTYPE_P2P_DEVICE);
5836 		n_limits++;
5837 	}
5838 
5839 	if (param->iftypes & BIT(NL80211_IFTYPE_NAN)) {
5840 		data->if_limits[n_limits].max = 1;
5841 		data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_NAN);
5842 		n_limits++;
5843 
5844 		hw->wiphy->nan_supported_bands = BIT(NL80211_BAND_2GHZ) |
5845 						 BIT(NL80211_BAND_5GHZ);
5846 
5847 		hw->wiphy->nan_capa.flags = WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC |
5848 					    WIPHY_NAN_FLAGS_USERSPACE_DE |
5849 					    WIPHY_NAN_FLAGS_INSTANT_COMM;
5850 		hw->wiphy->nan_capa.op_mode = NAN_OP_MODE_PHY_MODE_MASK |
5851 					      NAN_OP_MODE_80P80MHZ |
5852 					      NAN_OP_MODE_160MHZ;
5853 
5854 		hw->wiphy->nan_capa.n_antennas = 0x22;
5855 		hw->wiphy->nan_capa.max_channel_switch_time = 0;
5856 
5857 		wiphy_ext_feature_set(hw->wiphy,
5858 				      NL80211_EXT_FEATURE_SECURE_NAN);
5859 
5860 		hrtimer_setup(&data->nan.slot_timer,
5861 			      mac80211_hwsim_nan_slot_timer,
5862 			      CLOCK_BOOTTIME, HRTIMER_MODE_ABS_SOFT);
5863 		hrtimer_setup(&data->nan.resume_txqs_timer,
5864 			      mac80211_hwsim_nan_resume_txqs_timer,
5865 			      CLOCK_BOOTTIME, HRTIMER_MODE_ABS_SOFT);
5866 		hrtimer_setup(&data->nan.discovery_beacon_timer,
5867 			      mac80211_hwsim_nan_discovery_beacon_timer,
5868 			      CLOCK_BOOTTIME, HRTIMER_MODE_ABS_SOFT);
5869 
5870 		spin_lock_init(&data->nan.state_lock);
5871 	}
5872 
5873 	if (param->iftypes & BIT(NL80211_IFTYPE_NAN_DATA)) {
5874 		data->if_limits[n_limits].max = 2;
5875 		data->if_limits[n_limits].types = BIT(NL80211_IFTYPE_NAN_DATA);
5876 		n_limits++;
5877 
5878 		hw->wiphy->nan_capa.phy.ht = hwsim_nan_ht_cap;
5879 		hw->wiphy->nan_capa.phy.vht = hwsim_nan_vht_cap;
5880 		hw->wiphy->nan_capa.phy.he = hwsim_nan_he_cap;
5881 
5882 		/*
5883 		 * NAN switches between bands/channels per its schedule,
5884 		 * so mac80211 rate control can't work here.
5885 		 */
5886 		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
5887 	}
5888 
5889 	data->if_combination.radar_detect_widths =
5890 				BIT(NL80211_CHAN_WIDTH_5) |
5891 				BIT(NL80211_CHAN_WIDTH_10) |
5892 				BIT(NL80211_CHAN_WIDTH_20_NOHT) |
5893 				BIT(NL80211_CHAN_WIDTH_20) |
5894 				BIT(NL80211_CHAN_WIDTH_40) |
5895 				BIT(NL80211_CHAN_WIDTH_80) |
5896 				BIT(NL80211_CHAN_WIDTH_160);
5897 
5898 	if (data->use_chanctx) {
5899 		hw->wiphy->max_scan_ssids = 255;
5900 		hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
5901 		hw->wiphy->max_remain_on_channel_duration = 1000;
5902 		data->if_combination.num_different_channels = data->channels;
5903 	} else {
5904 		data->if_combination.num_different_channels = 1;
5905 	}
5906 
5907 	if (!n_limits) {
5908 		err = -EINVAL;
5909 		goto failed_hw;
5910 	}
5911 
5912 	data->if_combination.max_interfaces = 0;
5913 	for (i = 0; i < n_limits; i++)
5914 		data->if_combination.max_interfaces +=
5915 			data->if_limits[i].max;
5916 
5917 	data->if_combination.n_limits = n_limits;
5918 	data->if_combination.limits = data->if_limits;
5919 
5920 	/*
5921 	 * If we actually were asked to support combinations,
5922 	 * advertise them - if there's only a single thing like
5923 	 * only IBSS then don't advertise it as combinations.
5924 	 */
5925 	if (data->if_combination.max_interfaces > 1) {
5926 		hw->wiphy->iface_combinations = &data->if_combination;
5927 		hw->wiphy->n_iface_combinations = 1;
5928 	}
5929 
5930 	if (param->ciphers) {
5931 		memcpy(data->ciphers, param->ciphers,
5932 		       param->n_ciphers * sizeof(u32));
5933 		hw->wiphy->cipher_suites = data->ciphers;
5934 		hw->wiphy->n_cipher_suites = param->n_ciphers;
5935 	}
5936 
5937 	hw->wiphy->mbssid_max_interfaces = 8;
5938 	hw->wiphy->ema_max_profile_periodicity = 3;
5939 
5940 	spin_lock_init(&data->tsf_offset_lock);
5941 
5942 	data->rx_rssi = DEFAULT_RX_RSSI;
5943 
5944 	INIT_DELAYED_WORK(&data->roc_start, hw_roc_start);
5945 	INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
5946 	INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
5947 
5948 	hw->queues = 5;
5949 	hw->offchannel_tx_hw_queue = 4;
5950 	hw->extra_tx_headroom = IEEE80211_CCMP_HDR_LEN;
5951 
5952 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
5953 	ieee80211_hw_set(hw, CHANCTX_STA_CSA);
5954 	ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
5955 	ieee80211_hw_set(hw, QUEUE_CONTROL);
5956 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
5957 	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
5958 	ieee80211_hw_set(hw, MFP_CAPABLE);
5959 	ieee80211_hw_set(hw, SIGNAL_DBM);
5960 	ieee80211_hw_set(hw, SUPPORTS_PS);
5961 	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
5962 	ieee80211_hw_set(hw, TDLS_WIDER_BW);
5963 	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
5964 	ieee80211_hw_set(hw, STRICT);
5965 	ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
5966 	ieee80211_hw_set(hw, STA_MMPDU_TXQ);
5967 
5968 	if (param->mlo) {
5969 		hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
5970 		ieee80211_hw_set(hw, HAS_RATE_CONTROL);
5971 		ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
5972 		ieee80211_hw_set(hw, CONNECTION_MONITOR);
5973 		ieee80211_hw_set(hw, AP_LINK_PS);
5974 
5975 		hw->wiphy->iftype_ext_capab = mac80211_hwsim_iftypes_ext_capa;
5976 		hw->wiphy->num_iftype_ext_capab =
5977 			ARRAY_SIZE(mac80211_hwsim_iftypes_ext_capa);
5978 	} else {
5979 		ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
5980 		ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
5981 		if (rctbl)
5982 			ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
5983 	}
5984 
5985 	hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
5986 	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
5987 			    WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
5988 			    WIPHY_FLAG_AP_UAPSD |
5989 			    WIPHY_FLAG_HAS_CHANNEL_SWITCH;
5990 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
5991 	hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
5992 			       NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
5993 			       NL80211_FEATURE_STATIC_SMPS |
5994 			       NL80211_FEATURE_DYNAMIC_SMPS |
5995 			       NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
5996 			       NL80211_FEATURE_AP_SCAN;
5997 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_VHT_IBSS);
5998 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_BEACON_PROTECTION);
5999 	wiphy_ext_feature_set(hw->wiphy,
6000 			      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
6001 	wiphy_ext_feature_set(hw->wiphy,
6002 			      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY);
6003 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
6004 
6005 	wiphy_ext_feature_set(hw->wiphy,
6006 			      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT);
6007 	wiphy_ext_feature_set(hw->wiphy,
6008 			      NL80211_EXT_FEATURE_BSS_COLOR);
6009 	wiphy_ext_feature_set(hw->wiphy,
6010 			      NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT);
6011 	wiphy_ext_feature_set(hw->wiphy,
6012 			      NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
6013 	wiphy_ext_feature_set(hw->wiphy,
6014 			      NL80211_EXT_FEATURE_EXT_KEY_ID);
6015 	wiphy_ext_feature_set(hw->wiphy,
6016 			      NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION);
6017 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_UPDATE_BEACON);
6018 
6019 	hw->wiphy->interface_modes = param->iftypes;
6020 
6021 	/* ask mac80211 to reserve space for magic */
6022 	hw->vif_data_size = sizeof(struct hwsim_vif_priv);
6023 	hw->sta_data_size = sizeof(struct hwsim_sta_priv);
6024 	hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
6025 	hw->txq_data_size = 0;
6026 
6027 	memcpy(data->channels_2ghz, hwsim_channels_2ghz,
6028 		sizeof(hwsim_channels_2ghz));
6029 	memcpy(data->channels_5ghz, hwsim_channels_5ghz,
6030 		sizeof(hwsim_channels_5ghz));
6031 	memcpy(data->channels_6ghz, hwsim_channels_6ghz,
6032 		sizeof(hwsim_channels_6ghz));
6033 	memcpy(data->channels_s1g, hwsim_channels_s1g,
6034 	       sizeof(hwsim_channels_s1g));
6035 	memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
6036 
6037 	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
6038 		struct ieee80211_supported_band *sband = &data->bands[band];
6039 		struct wiphy_radio_freq_range *radio_range;
6040 		const struct ieee80211_channel *c;
6041 		struct wiphy_radio *radio;
6042 
6043 		sband->band = band;
6044 
6045 		switch (band) {
6046 		case NL80211_BAND_2GHZ:
6047 			sband->channels = data->channels_2ghz;
6048 			sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
6049 			sband->bitrates = data->rates;
6050 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
6051 			break;
6052 		case NL80211_BAND_5GHZ:
6053 			sband->channels = data->channels_5ghz;
6054 			sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
6055 			sband->bitrates = data->rates + 4;
6056 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
6057 
6058 			sband->vht_cap.vht_supported = true;
6059 			sband->vht_cap.cap =
6060 				IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
6061 				IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
6062 				IEEE80211_VHT_CAP_RXLDPC |
6063 				IEEE80211_VHT_CAP_SHORT_GI_80 |
6064 				IEEE80211_VHT_CAP_SHORT_GI_160 |
6065 				IEEE80211_VHT_CAP_TXSTBC |
6066 				IEEE80211_VHT_CAP_RXSTBC_4 |
6067 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
6068 			sband->vht_cap.vht_mcs.rx_mcs_map =
6069 				cpu_to_le16(HWSIM_VHT_MCS_MAP);
6070 			sband->vht_cap.vht_mcs.tx_mcs_map =
6071 				sband->vht_cap.vht_mcs.rx_mcs_map;
6072 			break;
6073 		case NL80211_BAND_6GHZ:
6074 			sband->channels = data->channels_6ghz;
6075 			sband->n_channels = ARRAY_SIZE(hwsim_channels_6ghz);
6076 			sband->bitrates = data->rates + 4;
6077 			sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
6078 			break;
6079 		case NL80211_BAND_S1GHZ:
6080 			memcpy(&sband->s1g_cap, &hwsim_s1g_cap,
6081 			       sizeof(sband->s1g_cap));
6082 			sband->channels = data->channels_s1g;
6083 			sband->n_channels = ARRAY_SIZE(hwsim_channels_s1g);
6084 			break;
6085 		default:
6086 			continue;
6087 		}
6088 
6089 		if (band != NL80211_BAND_6GHZ){
6090 			sband->ht_cap.ht_supported = true;
6091 			sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
6092 					    IEEE80211_HT_CAP_GRN_FLD |
6093 					    IEEE80211_HT_CAP_SGI_20 |
6094 					    IEEE80211_HT_CAP_SGI_40 |
6095 					    IEEE80211_HT_CAP_DSSSCCK40 |
6096 					    IEEE80211_HT_CAP_TX_STBC |
6097 					    IEEE80211_HT_CAP_RX_STBC;
6098 			sband->ht_cap.ampdu_factor = 0x3;
6099 			sband->ht_cap.ampdu_density = 0x6;
6100 			memset(&sband->ht_cap.mcs, 0,
6101 			       sizeof(sband->ht_cap.mcs));
6102 			sband->ht_cap.mcs.rx_mask[0] = 0xff;
6103 			sband->ht_cap.mcs.rx_mask[1] = 0xff;
6104 			sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6105 		}
6106 
6107 		mac80211_hwsim_sband_capab(sband);
6108 
6109 		hw->wiphy->bands[band] = sband;
6110 
6111 		if (!param->multi_radio)
6112 			continue;
6113 
6114 		c = sband->channels;
6115 		radio_range = &data->radio_range[n_bands];
6116 		radio_range->start_freq = ieee80211_channel_to_khz(c) - 10000;
6117 
6118 		c += sband->n_channels - 1;
6119 		radio_range->end_freq = ieee80211_channel_to_khz(c) + 10000;
6120 
6121 		radio = &data->radio[n_bands++];
6122 		radio->freq_range = radio_range;
6123 		radio->n_freq_range = 1;
6124 		radio->iface_combinations = &data->if_combination_radio;
6125 		radio->n_iface_combinations = 1;
6126 	}
6127 
6128 	if (param->multi_radio) {
6129 		hw->wiphy->radio = data->radio;
6130 		hw->wiphy->n_radio = n_bands;
6131 
6132 		memcpy(&data->if_combination_radio, &data->if_combination,
6133 		       sizeof(data->if_combination));
6134 		data->if_combination.num_different_channels *= n_bands;
6135 	}
6136 
6137 	if (data->use_chanctx)
6138 		data->if_combination.radar_detect_widths = 0;
6139 
6140 	/* By default all radios belong to the first group */
6141 	data->group = 1;
6142 	mutex_init(&data->mutex);
6143 
6144 	data->netgroup = hwsim_net_get_netgroup(net);
6145 	data->wmediumd = hwsim_net_get_wmediumd(net);
6146 
6147 	/* Enable frame retransmissions for lossy channels */
6148 	hw->max_rates = 4;
6149 	hw->max_rate_tries = 11;
6150 
6151 	hw->wiphy->vendor_commands = mac80211_hwsim_vendor_commands;
6152 	hw->wiphy->n_vendor_commands =
6153 		ARRAY_SIZE(mac80211_hwsim_vendor_commands);
6154 	hw->wiphy->vendor_events = mac80211_hwsim_vendor_events;
6155 	hw->wiphy->n_vendor_events = ARRAY_SIZE(mac80211_hwsim_vendor_events);
6156 
6157 	if (param->reg_strict)
6158 		hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
6159 	if (param->regd) {
6160 		data->regd = param->regd;
6161 		hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6162 		wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
6163 		/* give the regulatory workqueue a chance to run */
6164 		schedule_timeout_interruptible(1);
6165 	}
6166 
6167 	wiphy_ext_feature_set(hw->wiphy,
6168 			      NL80211_EXT_FEATURE_DFS_CONCURRENT);
6169 	if (param->background_radar)
6170 		wiphy_ext_feature_set(hw->wiphy,
6171 				      NL80211_EXT_FEATURE_RADAR_BACKGROUND);
6172 
6173 	if (param->no_vif)
6174 		ieee80211_hw_set(hw, NO_AUTO_VIF);
6175 
6176 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
6177 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_PUNCT);
6178 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_PROBE_AP);
6179 
6180 	for (i = 0; i < ARRAY_SIZE(data->link_data); i++) {
6181 		hrtimer_setup(&data->link_data[i].beacon_timer, mac80211_hwsim_beacon,
6182 			      CLOCK_MONOTONIC, HRTIMER_MODE_ABS_SOFT);
6183 		data->link_data[i].link_id = i;
6184 	}
6185 
6186 	err = ieee80211_register_hw(hw);
6187 	if (err < 0) {
6188 		pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
6189 		       err);
6190 		goto failed_hw;
6191 	}
6192 
6193 	wiphy_dbg(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
6194 
6195 	if (param->reg_alpha2) {
6196 		data->alpha2[0] = param->reg_alpha2[0];
6197 		data->alpha2[1] = param->reg_alpha2[1];
6198 		regulatory_hint(hw->wiphy, param->reg_alpha2);
6199 	}
6200 
6201 	data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
6202 	debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
6203 	debugfs_create_file("group", 0666, data->debugfs, data,
6204 			    &hwsim_fops_group);
6205 	debugfs_create_file("rx_rssi", 0666, data->debugfs, data,
6206 			    &hwsim_fops_rx_rssi);
6207 	if (!data->use_chanctx)
6208 		debugfs_create_file("dfs_simulate_radar", 0222,
6209 				    data->debugfs,
6210 				    data, &hwsim_simulate_radar);
6211 	if (param->background_radar)
6212 		debugfs_create_file("dfs_background_cac", 0200,
6213 				    data->debugfs,
6214 				    data, &hwsim_background_cac_ops);
6215 	debugfs_create_file("simulate_incumbent_signal_interference", 0200,
6216 			    data->debugfs,
6217 			    data, &hwsim_simulate_incumbent_signal_fops);
6218 
6219 	if (param->pmsr_capa) {
6220 		data->pmsr_capa = *param->pmsr_capa;
6221 		hw->wiphy->pmsr_capa = &data->pmsr_capa;
6222 	}
6223 
6224 	spin_lock_bh(&hwsim_radio_lock);
6225 	err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
6226 				     hwsim_rht_params);
6227 	if (err < 0) {
6228 		if (info) {
6229 			GENL_SET_ERR_MSG(info, "perm addr already present");
6230 			NL_SET_BAD_ATTR(info->extack,
6231 					info->attrs[HWSIM_ATTR_PERM_ADDR]);
6232 		}
6233 		spin_unlock_bh(&hwsim_radio_lock);
6234 		goto failed_final_insert;
6235 	}
6236 
6237 	list_add_tail(&data->list, &hwsim_radios);
6238 	hwsim_radios_generation++;
6239 	spin_unlock_bh(&hwsim_radio_lock);
6240 
6241 	/* alloc/register can change the name, we want the right one */
6242 	param->hwname = wiphy_name(hw->wiphy);
6243 
6244 	hwsim_mcast_new_radio(idx, wiphy_net(data->hw->wiphy), info, param);
6245 
6246 	return idx;
6247 
6248 failed_final_insert:
6249 	debugfs_remove_recursive(data->debugfs);
6250 	ieee80211_unregister_hw(data->hw);
6251 failed_hw:
6252 	device_release_driver(data->dev);
6253 failed_bind:
6254 	device_unregister(data->dev);
6255 failed_drvdata:
6256 	ieee80211_free_hw(hw);
6257 failed:
6258 	return err;
6259 }
6260 
6261 static void hwsim_mcast_del_radio(int id, const char *hwname,
6262 				  struct net *net, struct genl_info *info)
6263 {
6264 	struct sk_buff *skb;
6265 	void *data;
6266 	int ret;
6267 
6268 	skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
6269 	if (!skb)
6270 		return;
6271 
6272 	data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
6273 			   HWSIM_CMD_DEL_RADIO);
6274 	if (!data)
6275 		goto error;
6276 
6277 	ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
6278 	if (ret < 0)
6279 		goto error;
6280 
6281 	ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
6282 		      hwname);
6283 	if (ret < 0)
6284 		goto error;
6285 
6286 	genlmsg_end(skb, data);
6287 
6288 	hwsim_mcast_config_msg(skb, net, info);
6289 
6290 	return;
6291 
6292 error:
6293 	nlmsg_free(skb);
6294 }
6295 
6296 static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
6297 				     const char *hwname,
6298 				     struct genl_info *info)
6299 {
6300 	hwsim_mcast_del_radio(data->idx, hwname, wiphy_net(data->hw->wiphy), info);
6301 	debugfs_remove_recursive(data->debugfs);
6302 	ieee80211_unregister_hw(data->hw);
6303 	device_release_driver(data->dev);
6304 	device_unregister(data->dev);
6305 	ieee80211_free_hw(data->hw);
6306 }
6307 
6308 static int mac80211_hwsim_get_radio(struct sk_buff *skb,
6309 				    struct mac80211_hwsim_data *data,
6310 				    u32 portid, u32 seq,
6311 				    struct netlink_callback *cb, int flags)
6312 {
6313 	void *hdr;
6314 	struct hwsim_new_radio_params param = { };
6315 	int res = -EMSGSIZE;
6316 
6317 	hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
6318 			  HWSIM_CMD_GET_RADIO);
6319 	if (!hdr)
6320 		return -EMSGSIZE;
6321 
6322 	if (cb)
6323 		genl_dump_check_consistent(cb, hdr);
6324 
6325 	if (data->alpha2[0] && data->alpha2[1])
6326 		param.reg_alpha2 = data->alpha2;
6327 
6328 	param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
6329 					REGULATORY_STRICT_REG);
6330 	param.p2p_device = !!(data->hw->wiphy->interface_modes &
6331 					BIT(NL80211_IFTYPE_P2P_DEVICE));
6332 	param.nan_device = !!(data->hw->wiphy->interface_modes &
6333 					BIT(NL80211_IFTYPE_NAN));
6334 	param.use_chanctx = data->use_chanctx;
6335 	param.regd = data->regd;
6336 	param.channels = data->channels;
6337 	param.hwname = wiphy_name(data->hw->wiphy);
6338 	param.pmsr_capa = &data->pmsr_capa;
6339 	param.background_radar =
6340 		wiphy_ext_feature_isset(data->hw->wiphy,
6341 					NL80211_EXT_FEATURE_RADAR_BACKGROUND);
6342 
6343 	res = append_radio_msg(skb, data->idx, &param);
6344 	if (res < 0)
6345 		goto out_err;
6346 
6347 	genlmsg_end(skb, hdr);
6348 	return 0;
6349 
6350 out_err:
6351 	genlmsg_cancel(skb, hdr);
6352 	return res;
6353 }
6354 
6355 static void mac80211_hwsim_free(void)
6356 {
6357 	struct mac80211_hwsim_data *data;
6358 
6359 	spin_lock_bh(&hwsim_radio_lock);
6360 	while ((data = list_first_entry_or_null(&hwsim_radios,
6361 						struct mac80211_hwsim_data,
6362 						list))) {
6363 		list_del(&data->list);
6364 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
6365 				       hwsim_rht_params);
6366 		spin_unlock_bh(&hwsim_radio_lock);
6367 		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
6368 					 NULL);
6369 		spin_lock_bh(&hwsim_radio_lock);
6370 	}
6371 	spin_unlock_bh(&hwsim_radio_lock);
6372 	class_unregister(&hwsim_class);
6373 }
6374 
6375 static const struct net_device_ops hwsim_netdev_ops = {
6376 	.ndo_start_xmit 	= hwsim_mon_xmit,
6377 	.ndo_set_mac_address 	= eth_mac_addr,
6378 	.ndo_validate_addr	= eth_validate_addr,
6379 };
6380 
6381 static void hwsim_mon_setup(struct net_device *dev)
6382 {
6383 	u8 addr[ETH_ALEN];
6384 
6385 	dev->netdev_ops = &hwsim_netdev_ops;
6386 	dev->needs_free_netdev = true;
6387 	ether_setup(dev);
6388 	dev->priv_flags |= IFF_NO_QUEUE;
6389 	dev->type = ARPHRD_IEEE80211_RADIOTAP;
6390 	eth_zero_addr(addr);
6391 	addr[0] = 0x12;
6392 	eth_hw_addr_set(dev, addr);
6393 }
6394 
6395 static void hwsim_register_wmediumd(struct net *net, u32 portid)
6396 {
6397 	struct mac80211_hwsim_data *data;
6398 
6399 	hwsim_net_set_wmediumd(net, portid);
6400 
6401 	spin_lock_bh(&hwsim_radio_lock);
6402 	list_for_each_entry(data, &hwsim_radios, list) {
6403 		if (data->netgroup == hwsim_net_get_netgroup(net))
6404 			data->wmediumd = portid;
6405 	}
6406 	spin_unlock_bh(&hwsim_radio_lock);
6407 }
6408 
6409 static int mac80211_hwsim_get_link_id(struct ieee80211_vif *vif,
6410 				      struct ieee80211_hdr *hdr)
6411 {
6412 	int i;
6413 
6414 	if (!vif || !ieee80211_vif_is_mld(vif))
6415 		return -1;
6416 
6417 	for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
6418 		struct ieee80211_bss_conf *link_conf;
6419 
6420 		link_conf = rcu_dereference(vif->link_conf[i]);
6421 		if (!link_conf)
6422 			continue;
6423 		if (ether_addr_equal(link_conf->addr, hdr->addr2))
6424 			return i;
6425 	}
6426 
6427 	return -1;
6428 }
6429 
6430 static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
6431 					   struct genl_info *info)
6432 {
6433 
6434 	struct ieee80211_hdr *hdr;
6435 	struct mac80211_hwsim_data *data2;
6436 	struct ieee80211_tx_info *txi;
6437 	struct hwsim_tx_rate *tx_attempts;
6438 	u64 ret_skb_cookie;
6439 	struct sk_buff *skb, *tmp;
6440 	const u8 *src;
6441 	unsigned int hwsim_flags;
6442 	int i;
6443 	unsigned long flags;
6444 	bool found = false;
6445 	bool no_monitor;
6446 	u32 freq;
6447 
6448 	if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
6449 	    !info->attrs[HWSIM_ATTR_FLAGS] ||
6450 	    !info->attrs[HWSIM_ATTR_COOKIE] ||
6451 	    !info->attrs[HWSIM_ATTR_SIGNAL] ||
6452 	    !info->attrs[HWSIM_ATTR_TX_INFO])
6453 		goto out;
6454 
6455 	src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
6456 	hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
6457 	ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
6458 	no_monitor = nla_get_flag(info->attrs[HWSIM_ATTR_NO_MONITOR]);
6459 
6460 	data2 = get_hwsim_data_ref_from_addr(src);
6461 	if (!data2)
6462 		goto out;
6463 
6464 	if (!hwsim_virtio_enabled) {
6465 		if (hwsim_net_get_netgroup(genl_info_net(info)) !=
6466 		    data2->netgroup)
6467 			goto out;
6468 
6469 		if (info->snd_portid != data2->wmediumd)
6470 			goto out;
6471 	}
6472 
6473 	/* look for the skb matching the cookie passed back from user */
6474 	spin_lock_irqsave(&data2->pending.lock, flags);
6475 	skb_queue_walk_safe(&data2->pending, skb, tmp) {
6476 		uintptr_t skb_cookie;
6477 
6478 		txi = IEEE80211_SKB_CB(skb);
6479 		skb_cookie = (uintptr_t)txi->rate_driver_data[0];
6480 
6481 		if (skb_cookie == ret_skb_cookie) {
6482 			__skb_unlink(skb, &data2->pending);
6483 			found = true;
6484 			break;
6485 		}
6486 	}
6487 	spin_unlock_irqrestore(&data2->pending.lock, flags);
6488 
6489 	/* not found */
6490 	if (!found)
6491 		goto out;
6492 
6493 	txi = IEEE80211_SKB_CB(skb);
6494 	freq = (uintptr_t)txi->rate_driver_data[1];
6495 
6496 	if (!no_monitor)
6497 		mac80211_hwsim_monitor_rx(data2->hw, skb, freq);
6498 
6499 	/* Tx info received because the frame was broadcasted on user space,
6500 	 so we get all the necessary info: tx attempts and skb control buff */
6501 
6502 	tx_attempts = (struct hwsim_tx_rate *)nla_data(
6503 		       info->attrs[HWSIM_ATTR_TX_INFO]);
6504 
6505 	/* now send back TX status */
6506 	ieee80211_tx_info_clear_status(txi);
6507 
6508 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
6509 		txi->status.rates[i].idx = tx_attempts[i].idx;
6510 		txi->status.rates[i].count = tx_attempts[i].count;
6511 	}
6512 
6513 	txi->status.ack_signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
6514 
6515 	hdr = (struct ieee80211_hdr *)skb->data;
6516 	i = mac80211_hwsim_get_link_id(txi->control.vif, hdr);
6517 	if (i >= 0) {
6518 		txi->status.link_valid = 1;
6519 		txi->status.link_id = i;
6520 	}
6521 
6522 	if (!(hwsim_flags & HWSIM_TX_CTL_NO_ACK) &&
6523 	   (hwsim_flags & HWSIM_TX_STAT_ACK)) {
6524 		if (skb->len >= 16)
6525 			mac80211_hwsim_monitor_ack(freq, hdr->addr2);
6526 		txi->flags |= IEEE80211_TX_STAT_ACK;
6527 	}
6528 
6529 	if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
6530 		txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
6531 
6532 	ieee80211_tx_status_irqsafe(data2->hw, skb);
6533 	return 0;
6534 out:
6535 	return -EINVAL;
6536 
6537 }
6538 
6539 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
6540 					  struct genl_info *info)
6541 {
6542 	struct mac80211_hwsim_data *data2;
6543 	struct ieee80211_rx_status rx_status;
6544 	struct ieee80211_hdr *hdr;
6545 	const u8 *dst;
6546 	int frame_data_len;
6547 	void *frame_data;
6548 	struct sk_buff *skb = NULL;
6549 	struct ieee80211_channel *channel = NULL;
6550 
6551 	if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
6552 	    !info->attrs[HWSIM_ATTR_FRAME] ||
6553 	    !info->attrs[HWSIM_ATTR_RX_RATE] ||
6554 	    !info->attrs[HWSIM_ATTR_SIGNAL])
6555 		goto out;
6556 
6557 	dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
6558 	frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
6559 	frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
6560 
6561 	if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
6562 	    frame_data_len > IEEE80211_MAX_DATA_LEN)
6563 		goto out;
6564 
6565 	/* Allocate new skb here */
6566 	skb = alloc_skb(frame_data_len, GFP_KERNEL);
6567 	if (skb == NULL)
6568 		goto out;
6569 
6570 	/* Copy the data */
6571 	skb_put_data(skb, frame_data, frame_data_len);
6572 
6573 	data2 = get_hwsim_data_ref_from_addr(dst);
6574 	if (!data2)
6575 		goto out;
6576 
6577 	if (data2->use_chanctx) {
6578 		if (data2->tmp_chan)
6579 			channel = data2->tmp_chan;
6580 	} else {
6581 		channel = data2->channel;
6582 	}
6583 
6584 	if (!hwsim_virtio_enabled) {
6585 		if (hwsim_net_get_netgroup(genl_info_net(info)) !=
6586 		    data2->netgroup)
6587 			goto out;
6588 
6589 		if (info->snd_portid != data2->wmediumd)
6590 			goto out;
6591 	}
6592 
6593 	/*
6594 	 * Serialise against mac80211_hwsim_stop() - mac80211 doesn't allow
6595 	 * frames reported while the HW is down, hence the ->started check
6596 	 * must be under mutex.
6597 	 */
6598 	mutex_lock(&data2->mutex);
6599 
6600 	/* look for the skb matching the cookie passed back from user */
6601 	if (info->attrs[HWSIM_ATTR_COOKIE] &&
6602 	    info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]) {
6603 		u64 cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
6604 		struct sk_buff *orig_skb, *found = NULL;
6605 		struct mac80211_hwsim_data *txdata;
6606 		struct ieee80211_tx_info *txi;
6607 		const u8 *transmitter;
6608 		unsigned long flags;
6609 
6610 		transmitter = nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
6611 		txdata = get_hwsim_data_ref_from_addr(transmitter);
6612 		if (!txdata || txdata->netgroup != data2->netgroup)
6613 			goto out_unlock;
6614 
6615 		spin_lock_irqsave(&txdata->pending.lock, flags);
6616 		skb_queue_walk(&txdata->pending, orig_skb) {
6617 			uintptr_t skb_cookie;
6618 
6619 			txi = IEEE80211_SKB_CB(orig_skb);
6620 			skb_cookie = (uintptr_t)txi->rate_driver_data[0];
6621 
6622 			if (skb_cookie == cookie) {
6623 				found = orig_skb;
6624 				break;
6625 			}
6626 		}
6627 
6628 		/* that's weird */
6629 		if (!found) {
6630 			spin_unlock_irqrestore(&txdata->pending.lock, flags);
6631 			goto out_unlock;
6632 		}
6633 
6634 		if (frame_data_len > found->len &&
6635 		    pskb_expand_head(found, 0, frame_data_len - found->len,
6636 				     GFP_ATOMIC)) {
6637 			spin_unlock_irqrestore(&txdata->pending.lock, flags);
6638 			goto out_unlock;
6639 		}
6640 		skb_trim(found, 0);
6641 		skb_put_data(found, frame_data, frame_data_len);
6642 		spin_unlock_irqrestore(&txdata->pending.lock, flags);
6643 	}
6644 
6645 	/* check if radio is configured properly */
6646 
6647 	if ((data2->idle && !data2->tmp_chan) || !data2->started)
6648 		goto out_unlock;
6649 
6650 	/* A frame is received from user space */
6651 	memset(&rx_status, 0, sizeof(rx_status));
6652 	if (info->attrs[HWSIM_ATTR_FREQ]) {
6653 		struct tx_iter_data iter_data = {
6654 			.hw = data2->hw,
6655 			.rx_status = &rx_status,
6656 			.skb = skb,
6657 		};
6658 
6659 		/* throw away off-channel packets, but allow both the temporary
6660 		 * ("hw" scan/remain-on-channel), regular channels and links,
6661 		 * since the internal datapath also allows this
6662 		 */
6663 		rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
6664 
6665 		iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
6666 							  rx_status.freq);
6667 		if (!iter_data.channel)
6668 			goto out_unlock;
6669 		rx_status.band = iter_data.channel->band;
6670 
6671 		if (!hwsim_chans_compat(iter_data.channel, channel)) {
6672 			ieee80211_iterate_active_interfaces_atomic(
6673 				data2->hw, IEEE80211_IFACE_ITER_NORMAL,
6674 				mac80211_hwsim_tx_iter, &iter_data);
6675 			if (!iter_data.receive)
6676 				goto out_unlock;
6677 		}
6678 	} else if (!channel) {
6679 		goto out_unlock;
6680 	} else {
6681 		rx_status.freq = channel->center_freq;
6682 		rx_status.band = channel->band;
6683 	}
6684 
6685 	rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
6686 	if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
6687 		goto out_unlock;
6688 	rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
6689 
6690 	hdr = (void *)skb->data;
6691 
6692 	if (ieee80211_is_beacon(hdr->frame_control) ||
6693 	    ieee80211_is_probe_resp(hdr->frame_control))
6694 		rx_status.boottime_ns = ktime_get_boottime_ns();
6695 
6696 	mac80211_hwsim_rx(data2, &rx_status, skb);
6697 	mutex_unlock(&data2->mutex);
6698 
6699 	return 0;
6700 out_unlock:
6701 	mutex_unlock(&data2->mutex);
6702 out:
6703 	dev_kfree_skb(skb);
6704 	return -EINVAL;
6705 }
6706 
6707 static int hwsim_register_received_nl(struct sk_buff *skb_2,
6708 				      struct genl_info *info)
6709 {
6710 	struct net *net = genl_info_net(info);
6711 	struct mac80211_hwsim_data *data;
6712 	int chans = 1;
6713 
6714 	spin_lock_bh(&hwsim_radio_lock);
6715 	list_for_each_entry(data, &hwsim_radios, list)
6716 		chans = max(chans, data->channels);
6717 	spin_unlock_bh(&hwsim_radio_lock);
6718 
6719 	/* In the future we should revise the userspace API and allow it
6720 	 * to set a flag that it does support multi-channel, then we can
6721 	 * let this pass conditionally on the flag.
6722 	 * For current userspace, prohibit it since it won't work right.
6723 	 */
6724 	if (chans > 1)
6725 		return -EOPNOTSUPP;
6726 
6727 	if (hwsim_net_get_wmediumd(net))
6728 		return -EBUSY;
6729 
6730 	hwsim_register_wmediumd(net, info->snd_portid);
6731 
6732 	pr_debug("mac80211_hwsim: received a REGISTER, "
6733 	       "switching to wmediumd mode with pid %d\n", info->snd_portid);
6734 
6735 	return 0;
6736 }
6737 
6738 /* ensures ciphers only include ciphers listed in 'hwsim_ciphers' array */
6739 static bool hwsim_known_ciphers(const u32 *ciphers, int n_ciphers)
6740 {
6741 	int i;
6742 
6743 	for (i = 0; i < n_ciphers; i++) {
6744 		int j;
6745 		int found = 0;
6746 
6747 		for (j = 0; j < ARRAY_SIZE(hwsim_ciphers); j++) {
6748 			if (ciphers[i] == hwsim_ciphers[j]) {
6749 				found = 1;
6750 				break;
6751 			}
6752 		}
6753 
6754 		if (!found)
6755 			return false;
6756 	}
6757 
6758 	return true;
6759 }
6760 
6761 static int parse_ftm_capa(const struct nlattr *ftm_capa, struct cfg80211_pmsr_capabilities *out,
6762 			  struct genl_info *info)
6763 {
6764 	struct nlattr *tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
6765 	int ret;
6766 
6767 	ret = nla_parse_nested(tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX, ftm_capa, hwsim_ftm_capa_policy,
6768 			       NULL);
6769 	if (ret) {
6770 		NL_SET_ERR_MSG_ATTR(info->extack, ftm_capa, "malformed FTM capability");
6771 		return -EINVAL;
6772 	}
6773 
6774 	out->ftm.supported = 1;
6775 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES])
6776 		out->ftm.preambles = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES]);
6777 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS])
6778 		out->ftm.bandwidths = nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS]);
6779 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT])
6780 		out->ftm.max_bursts_exponent =
6781 			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT]);
6782 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST])
6783 		out->ftm.max_ftms_per_burst =
6784 			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST]);
6785 	out->ftm.asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_ASAP];
6786 	out->ftm.non_asap = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP];
6787 	out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI];
6788 	out->ftm.request_civicloc = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC];
6789 	out->ftm.trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED];
6790 	out->ftm.non_trigger_based = !!tb[NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED];
6791 
6792 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS])
6793 		out->ftm.max_no_of_tx_antennas =
6794 			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS]);
6795 
6796 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS])
6797 		out->ftm.max_no_of_rx_antennas =
6798 			nla_get_u8(tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS]);
6799 
6800 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA])
6801 		out->ftm.min_allowed_ranging_interval_edca =
6802 			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA]);
6803 
6804 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB])
6805 		out->ftm.min_allowed_ranging_interval_ntb =
6806 			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB]);
6807 
6808 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_PREAMBLES])
6809 		out->ftm.pd_preambles =
6810 			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_PREAMBLES]);
6811 
6812 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_BANDWIDTHS])
6813 		out->ftm.pd_bandwidths =
6814 			nla_get_u32(tb[NL80211_PMSR_FTM_CAPA_ATTR_PD_BANDWIDTHS]);
6815 
6816 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS]) {
6817 		struct nlattr *ista_tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
6818 
6819 		if (!nla_parse_nested(ista_tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX,
6820 				      tb[NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS],
6821 				      hwsim_ftm_role_capa_policy, NULL)) {
6822 			out->ftm.ista.support_ntb =
6823 				!!ista_tb[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_NTB];
6824 			out->ftm.ista.support_tb =
6825 				!!ista_tb[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_TB];
6826 			out->ftm.ista.support_edca =
6827 				!!ista_tb[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_EDCA];
6828 			if (ista_tb[NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE])
6829 				out->ftm.ista.max_peers =
6830 					nla_get_u32(ista_tb[NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE]);
6831 		}
6832 	}
6833 
6834 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS]) {
6835 		struct nlattr *rsta_tb[NL80211_PMSR_FTM_CAPA_ATTR_MAX + 1];
6836 
6837 		if (!nla_parse_nested(rsta_tb, NL80211_PMSR_FTM_CAPA_ATTR_MAX,
6838 				      tb[NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS],
6839 				      hwsim_ftm_role_capa_policy, NULL)) {
6840 			out->ftm.rsta.support_ntb =
6841 				!!rsta_tb[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_NTB];
6842 			out->ftm.rsta.support_tb =
6843 				!!rsta_tb[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_TB];
6844 			out->ftm.rsta.support_edca =
6845 				!!rsta_tb[NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_EDCA];
6846 			if (rsta_tb[NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE])
6847 				out->ftm.rsta.max_peers =
6848 					nla_get_u32(rsta_tb[NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE]);
6849 		}
6850 	}
6851 
6852 	if (tb[NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS]) {
6853 		struct nlattr *type_tb[NL80211_PMSR_FTM_TYPE_CAPA_ATTR_MAX + 1];
6854 
6855 		if (!nla_parse_nested(type_tb, NL80211_PMSR_FTM_TYPE_CAPA_ATTR_MAX,
6856 				      tb[NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS],
6857 				      hwsim_ftm_type_capa_policy, NULL)) {
6858 			out->ftm.type.infra_support =
6859 				!!type_tb[NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INFRA_SUPPORT];
6860 			out->ftm.type.pd_support =
6861 				!!type_tb[NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT];
6862 		}
6863 	}
6864 
6865 	out->ftm.concurrent_ista_rsta_support =
6866 		!!tb[NL80211_PMSR_FTM_CAPA_ATTR_CONCURRENT_ISTA_RSTA_SUPPORT];
6867 
6868 	return 0;
6869 }
6870 
6871 static int parse_pmsr_capa(const struct nlattr *pmsr_capa, struct cfg80211_pmsr_capabilities *out,
6872 			   struct genl_info *info)
6873 {
6874 	struct nlattr *tb[NL80211_PMSR_ATTR_MAX + 1];
6875 	struct nlattr *nla;
6876 	int size;
6877 	int ret;
6878 
6879 	ret = nla_parse_nested(tb, NL80211_PMSR_ATTR_MAX, pmsr_capa, hwsim_pmsr_capa_policy, NULL);
6880 	if (ret) {
6881 		NL_SET_ERR_MSG_ATTR(info->extack, pmsr_capa, "malformed PMSR capability");
6882 		return -EINVAL;
6883 	}
6884 
6885 	if (tb[NL80211_PMSR_ATTR_MAX_PEERS])
6886 		out->max_peers = nla_get_u32(tb[NL80211_PMSR_ATTR_MAX_PEERS]);
6887 	out->report_ap_tsf = !!tb[NL80211_PMSR_ATTR_REPORT_AP_TSF];
6888 	out->randomize_mac_addr = !!tb[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR];
6889 
6890 	if (!tb[NL80211_PMSR_ATTR_TYPE_CAPA]) {
6891 		NL_SET_ERR_MSG_ATTR(info->extack, tb[NL80211_PMSR_ATTR_TYPE_CAPA],
6892 				    "malformed PMSR type");
6893 		return -EINVAL;
6894 	}
6895 
6896 	nla_for_each_nested(nla, tb[NL80211_PMSR_ATTR_TYPE_CAPA], size) {
6897 		switch (nla_type(nla)) {
6898 		case NL80211_PMSR_TYPE_FTM:
6899 			parse_ftm_capa(nla, out, info);
6900 			break;
6901 		default:
6902 			NL_SET_ERR_MSG_ATTR(info->extack, nla, "unsupported measurement type");
6903 			return -EINVAL;
6904 		}
6905 	}
6906 
6907 	return 0;
6908 }
6909 
6910 static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
6911 {
6912 	struct hwsim_new_radio_params param = { 0 };
6913 	const char *hwname = NULL;
6914 	int ret;
6915 
6916 	param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
6917 	param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
6918 	param.nan_device = info->attrs[HWSIM_ATTR_SUPPORT_NAN_DEVICE];
6919 	param.channels = channels;
6920 	param.destroy_on_close =
6921 		info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
6922 
6923 	if (info->attrs[HWSIM_ATTR_CHANNELS])
6924 		param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
6925 
6926 	if (param.channels < 1) {
6927 		GENL_SET_ERR_MSG(info, "must have at least one channel");
6928 		return -EINVAL;
6929 	}
6930 
6931 	if (info->attrs[HWSIM_ATTR_NO_VIF])
6932 		param.no_vif = true;
6933 
6934 	if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
6935 		param.use_chanctx = true;
6936 	else
6937 		param.use_chanctx = (param.channels > 1);
6938 
6939 	if (info->attrs[HWSIM_ATTR_MULTI_RADIO])
6940 		param.multi_radio = true;
6941 
6942 	if (info->attrs[HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR])
6943 		param.background_radar = true;
6944 
6945 	if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
6946 		param.reg_alpha2 =
6947 			nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
6948 
6949 	if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
6950 		u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
6951 
6952 		if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
6953 			return -EINVAL;
6954 
6955 		idx = array_index_nospec(idx,
6956 					 ARRAY_SIZE(hwsim_world_regdom_custom));
6957 		param.regd = hwsim_world_regdom_custom[idx];
6958 	}
6959 
6960 	if (info->attrs[HWSIM_ATTR_PERM_ADDR]) {
6961 		if (!is_valid_ether_addr(
6962 				nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]))) {
6963 			GENL_SET_ERR_MSG(info,"MAC is no valid source addr");
6964 			NL_SET_BAD_ATTR(info->extack,
6965 					info->attrs[HWSIM_ATTR_PERM_ADDR]);
6966 			return -EINVAL;
6967 		}
6968 
6969 		param.perm_addr = nla_data(info->attrs[HWSIM_ATTR_PERM_ADDR]);
6970 	}
6971 
6972 	if (info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]) {
6973 		param.iftypes =
6974 			nla_get_u32(info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT]);
6975 
6976 		if (param.iftypes & ~HWSIM_IFTYPE_SUPPORT_MASK) {
6977 			NL_SET_ERR_MSG_ATTR(info->extack,
6978 					    info->attrs[HWSIM_ATTR_IFTYPE_SUPPORT],
6979 					    "cannot support more iftypes than kernel");
6980 			return -EINVAL;
6981 		}
6982 	} else {
6983 		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
6984 	}
6985 
6986 	/* ensure both flag and iftype support is honored */
6987 	if (param.p2p_device ||
6988 	    param.iftypes & BIT(NL80211_IFTYPE_P2P_DEVICE)) {
6989 		param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
6990 		param.p2p_device = true;
6991 	}
6992 
6993 	if (param.nan_device) {
6994 		if (param.multi_radio) {
6995 			NL_SET_ERR_MSG(info->extack,
6996 				       "NAN is not supported on multi-radio wiphys");
6997 			return -EINVAL;
6998 		}
6999 		param.iftypes |= BIT(NL80211_IFTYPE_NAN) |
7000 				 BIT(NL80211_IFTYPE_NAN_DATA);
7001 	}
7002 
7003 	if (info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]) {
7004 		u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
7005 
7006 		param.ciphers =
7007 			nla_data(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
7008 
7009 		if (len % sizeof(u32)) {
7010 			NL_SET_ERR_MSG_ATTR(info->extack,
7011 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
7012 					    "bad cipher list length");
7013 			return -EINVAL;
7014 		}
7015 
7016 		param.n_ciphers = len / sizeof(u32);
7017 
7018 		if (param.n_ciphers > ARRAY_SIZE(hwsim_ciphers)) {
7019 			NL_SET_ERR_MSG_ATTR(info->extack,
7020 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
7021 					    "too many ciphers specified");
7022 			return -EINVAL;
7023 		}
7024 
7025 		if (!hwsim_known_ciphers(param.ciphers, param.n_ciphers)) {
7026 			NL_SET_ERR_MSG_ATTR(info->extack,
7027 					    info->attrs[HWSIM_ATTR_CIPHER_SUPPORT],
7028 					    "unsupported ciphers specified");
7029 			return -EINVAL;
7030 		}
7031 	}
7032 
7033 	param.mlo = info->attrs[HWSIM_ATTR_MLO_SUPPORT];
7034 
7035 	if (param.mlo || param.multi_radio)
7036 		param.use_chanctx = true;
7037 
7038 	if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
7039 		hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
7040 				  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
7041 				  GFP_KERNEL);
7042 		if (!hwname)
7043 			return -ENOMEM;
7044 		param.hwname = hwname;
7045 	}
7046 
7047 	if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
7048 		struct cfg80211_pmsr_capabilities *pmsr_capa;
7049 
7050 		pmsr_capa = kzalloc_obj(*pmsr_capa);
7051 		if (!pmsr_capa) {
7052 			ret = -ENOMEM;
7053 			goto out_free;
7054 		}
7055 		param.pmsr_capa = pmsr_capa;
7056 
7057 		ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info);
7058 		if (ret)
7059 			goto out_free;
7060 	}
7061 
7062 	ret = mac80211_hwsim_new_radio(info, &param);
7063 
7064 out_free:
7065 	kfree(hwname);
7066 	kfree(param.pmsr_capa);
7067 	return ret;
7068 }
7069 
7070 static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
7071 {
7072 	struct mac80211_hwsim_data *data;
7073 	s64 idx = -1;
7074 	const char *hwname = NULL;
7075 
7076 	if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
7077 		idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
7078 	} else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
7079 		hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
7080 				  nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
7081 				  GFP_KERNEL);
7082 		if (!hwname)
7083 			return -ENOMEM;
7084 	} else
7085 		return -EINVAL;
7086 
7087 	spin_lock_bh(&hwsim_radio_lock);
7088 	list_for_each_entry(data, &hwsim_radios, list) {
7089 		if (idx >= 0) {
7090 			if (data->idx != idx)
7091 				continue;
7092 		} else {
7093 			if (!hwname ||
7094 			    strcmp(hwname, wiphy_name(data->hw->wiphy)))
7095 				continue;
7096 		}
7097 
7098 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
7099 			continue;
7100 
7101 		list_del(&data->list);
7102 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
7103 				       hwsim_rht_params);
7104 		hwsim_radios_generation++;
7105 		spin_unlock_bh(&hwsim_radio_lock);
7106 		mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
7107 					 info);
7108 		kfree(hwname);
7109 		return 0;
7110 	}
7111 	spin_unlock_bh(&hwsim_radio_lock);
7112 
7113 	kfree(hwname);
7114 	return -ENODEV;
7115 }
7116 
7117 static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
7118 {
7119 	struct mac80211_hwsim_data *data;
7120 	struct sk_buff *skb;
7121 	int idx, res = -ENODEV;
7122 
7123 	if (!info->attrs[HWSIM_ATTR_RADIO_ID])
7124 		return -EINVAL;
7125 	idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
7126 
7127 	spin_lock_bh(&hwsim_radio_lock);
7128 	list_for_each_entry(data, &hwsim_radios, list) {
7129 		if (data->idx != idx)
7130 			continue;
7131 
7132 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
7133 			continue;
7134 
7135 		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
7136 		if (!skb) {
7137 			res = -ENOMEM;
7138 			goto out_err;
7139 		}
7140 
7141 		res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
7142 					       info->snd_seq, NULL, 0);
7143 		if (res < 0) {
7144 			nlmsg_free(skb);
7145 			goto out_err;
7146 		}
7147 
7148 		res = genlmsg_reply(skb, info);
7149 		break;
7150 	}
7151 
7152 out_err:
7153 	spin_unlock_bh(&hwsim_radio_lock);
7154 
7155 	return res;
7156 }
7157 
7158 static int hwsim_dump_radio_nl(struct sk_buff *skb,
7159 			       struct netlink_callback *cb)
7160 {
7161 	int last_idx = cb->args[0] - 1;
7162 	struct mac80211_hwsim_data *data = NULL;
7163 	int res = 0;
7164 	void *hdr;
7165 
7166 	spin_lock_bh(&hwsim_radio_lock);
7167 	cb->seq = hwsim_radios_generation;
7168 
7169 	if (last_idx >= hwsim_radio_idx-1)
7170 		goto done;
7171 
7172 	list_for_each_entry(data, &hwsim_radios, list) {
7173 		if (data->idx <= last_idx)
7174 			continue;
7175 
7176 		if (!net_eq(wiphy_net(data->hw->wiphy), sock_net(skb->sk)))
7177 			continue;
7178 
7179 		res = mac80211_hwsim_get_radio(skb, data,
7180 					       NETLINK_CB(cb->skb).portid,
7181 					       cb->nlh->nlmsg_seq, cb,
7182 					       NLM_F_MULTI);
7183 		if (res < 0)
7184 			break;
7185 
7186 		last_idx = data->idx;
7187 	}
7188 
7189 	cb->args[0] = last_idx + 1;
7190 
7191 	/* list changed, but no new element sent, set interrupted flag */
7192 	if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
7193 		hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
7194 				  cb->nlh->nlmsg_seq, &hwsim_genl_family,
7195 				  NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
7196 		if (hdr) {
7197 			genl_dump_check_consistent(cb, hdr);
7198 			genlmsg_end(skb, hdr);
7199 		} else {
7200 			res = -EMSGSIZE;
7201 		}
7202 	}
7203 
7204 done:
7205 	spin_unlock_bh(&hwsim_radio_lock);
7206 	return res ?: skb->len;
7207 }
7208 
7209 /* Generic Netlink operations array */
7210 static const struct genl_small_ops hwsim_ops[] = {
7211 	{
7212 		.cmd = HWSIM_CMD_REGISTER,
7213 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
7214 		.doit = hwsim_register_received_nl,
7215 		.flags = GENL_UNS_ADMIN_PERM,
7216 	},
7217 	{
7218 		.cmd = HWSIM_CMD_FRAME,
7219 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
7220 		.doit = hwsim_cloned_frame_received_nl,
7221 	},
7222 	{
7223 		.cmd = HWSIM_CMD_TX_INFO_FRAME,
7224 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
7225 		.doit = hwsim_tx_info_frame_received_nl,
7226 	},
7227 	{
7228 		.cmd = HWSIM_CMD_NEW_RADIO,
7229 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
7230 		.doit = hwsim_new_radio_nl,
7231 		.flags = GENL_UNS_ADMIN_PERM,
7232 	},
7233 	{
7234 		.cmd = HWSIM_CMD_DEL_RADIO,
7235 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
7236 		.doit = hwsim_del_radio_nl,
7237 		.flags = GENL_UNS_ADMIN_PERM,
7238 	},
7239 	{
7240 		.cmd = HWSIM_CMD_GET_RADIO,
7241 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
7242 		.doit = hwsim_get_radio_nl,
7243 		.dumpit = hwsim_dump_radio_nl,
7244 	},
7245 	{
7246 		.cmd = HWSIM_CMD_REPORT_PMSR,
7247 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
7248 		.doit = hwsim_pmsr_report_nl,
7249 	},
7250 };
7251 
7252 static struct genl_family hwsim_genl_family __ro_after_init = {
7253 	.name = "MAC80211_HWSIM",
7254 	.version = 1,
7255 	.maxattr = HWSIM_ATTR_MAX,
7256 	.policy = hwsim_genl_policy,
7257 	.netnsok = true,
7258 	.module = THIS_MODULE,
7259 	.small_ops = hwsim_ops,
7260 	.n_small_ops = ARRAY_SIZE(hwsim_ops),
7261 	.resv_start_op = HWSIM_CMD_REPORT_PMSR + 1, // match with __HWSIM_CMD_MAX
7262 	.mcgrps = hwsim_mcgrps,
7263 	.n_mcgrps = ARRAY_SIZE(hwsim_mcgrps),
7264 };
7265 
7266 static void remove_user_radios(u32 portid, int netgroup)
7267 {
7268 	struct mac80211_hwsim_data *entry, *tmp;
7269 	LIST_HEAD(list);
7270 
7271 	spin_lock_bh(&hwsim_radio_lock);
7272 	list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
7273 		if (entry->destroy_on_close && entry->portid == portid &&
7274 		    entry->netgroup == netgroup) {
7275 			list_move(&entry->list, &list);
7276 			rhashtable_remove_fast(&hwsim_radios_rht, &entry->rht,
7277 					       hwsim_rht_params);
7278 			hwsim_radios_generation++;
7279 		}
7280 	}
7281 	spin_unlock_bh(&hwsim_radio_lock);
7282 
7283 	list_for_each_entry_safe(entry, tmp, &list, list) {
7284 		list_del(&entry->list);
7285 		mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
7286 					 NULL);
7287 	}
7288 }
7289 
7290 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
7291 					 unsigned long state,
7292 					 void *_notify)
7293 {
7294 	struct netlink_notify *notify = _notify;
7295 
7296 	if (state != NETLINK_URELEASE)
7297 		return NOTIFY_DONE;
7298 
7299 	remove_user_radios(notify->portid, hwsim_net_get_netgroup(notify->net));
7300 
7301 	if (notify->portid == hwsim_net_get_wmediumd(notify->net)) {
7302 		printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
7303 		       " socket, switching to perfect channel medium\n");
7304 		hwsim_register_wmediumd(notify->net, 0);
7305 	}
7306 	return NOTIFY_DONE;
7307 
7308 }
7309 
7310 static struct notifier_block hwsim_netlink_notifier = {
7311 	.notifier_call = mac80211_hwsim_netlink_notify,
7312 };
7313 
7314 static int __init hwsim_init_netlink(void)
7315 {
7316 	int rc;
7317 
7318 	printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
7319 
7320 	rc = genl_register_family(&hwsim_genl_family);
7321 	if (rc)
7322 		goto failure;
7323 
7324 	rc = netlink_register_notifier(&hwsim_netlink_notifier);
7325 	if (rc) {
7326 		genl_unregister_family(&hwsim_genl_family);
7327 		goto failure;
7328 	}
7329 
7330 	return 0;
7331 
7332 failure:
7333 	pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
7334 	return -EINVAL;
7335 }
7336 
7337 static __net_init int hwsim_init_net(struct net *net)
7338 {
7339 	return hwsim_net_set_netgroup(net);
7340 }
7341 
7342 static void __net_exit hwsim_exit_net(struct net *net)
7343 {
7344 	struct mac80211_hwsim_data *data, *tmp;
7345 	LIST_HEAD(list);
7346 
7347 	spin_lock_bh(&hwsim_radio_lock);
7348 	list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
7349 		if (!net_eq(wiphy_net(data->hw->wiphy), net))
7350 			continue;
7351 
7352 		/* Radios created in init_net are returned to init_net. */
7353 		if (data->netgroup == hwsim_net_get_netgroup(&init_net))
7354 			continue;
7355 
7356 		list_move(&data->list, &list);
7357 		rhashtable_remove_fast(&hwsim_radios_rht, &data->rht,
7358 				       hwsim_rht_params);
7359 		hwsim_radios_generation++;
7360 	}
7361 	spin_unlock_bh(&hwsim_radio_lock);
7362 
7363 	list_for_each_entry_safe(data, tmp, &list, list) {
7364 		list_del(&data->list);
7365 		mac80211_hwsim_del_radio(data,
7366 					 wiphy_name(data->hw->wiphy),
7367 					 NULL);
7368 	}
7369 
7370 	ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
7371 }
7372 
7373 static struct pernet_operations hwsim_net_ops = {
7374 	.init = hwsim_init_net,
7375 	.exit = hwsim_exit_net,
7376 	.id   = &hwsim_net_id,
7377 	.size = sizeof(struct hwsim_net),
7378 };
7379 
7380 static void hwsim_exit_netlink(void)
7381 {
7382 	/* unregister the notifier */
7383 	netlink_unregister_notifier(&hwsim_netlink_notifier);
7384 	/* unregister the family */
7385 	genl_unregister_family(&hwsim_genl_family);
7386 }
7387 
7388 #if IS_REACHABLE(CONFIG_VIRTIO)
7389 static void hwsim_virtio_tx_done(struct virtqueue *vq)
7390 {
7391 	unsigned int len;
7392 	struct sk_buff *skb;
7393 	unsigned long flags;
7394 
7395 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
7396 	while ((skb = virtqueue_get_buf(vq, &len)))
7397 		dev_kfree_skb_irq(skb);
7398 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
7399 }
7400 
7401 static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
7402 {
7403 	struct nlmsghdr *nlh;
7404 	struct genlmsghdr *gnlh;
7405 	struct nlattr *tb[HWSIM_ATTR_MAX + 1];
7406 	struct genl_info info = {};
7407 	int err;
7408 
7409 	nlh = nlmsg_hdr(skb);
7410 	gnlh = nlmsg_data(nlh);
7411 
7412 	if (skb->len < nlh->nlmsg_len)
7413 		return -EINVAL;
7414 
7415 	err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
7416 			    hwsim_genl_policy, NULL);
7417 	if (err) {
7418 		pr_err_ratelimited("hwsim: genlmsg_parse returned %d\n", err);
7419 		return err;
7420 	}
7421 
7422 	info.attrs = tb;
7423 
7424 	switch (gnlh->cmd) {
7425 	case HWSIM_CMD_FRAME:
7426 		hwsim_cloned_frame_received_nl(skb, &info);
7427 		break;
7428 	case HWSIM_CMD_TX_INFO_FRAME:
7429 		hwsim_tx_info_frame_received_nl(skb, &info);
7430 		break;
7431 	case HWSIM_CMD_REPORT_PMSR:
7432 		hwsim_pmsr_report_nl(skb, &info);
7433 		break;
7434 	default:
7435 		pr_err_ratelimited("hwsim: invalid cmd: %d\n", gnlh->cmd);
7436 		return -EPROTO;
7437 	}
7438 	return 0;
7439 }
7440 
7441 static void hwsim_virtio_rx_work(struct work_struct *work)
7442 {
7443 	struct virtqueue *vq;
7444 	unsigned int len;
7445 	struct sk_buff *skb;
7446 	struct scatterlist sg[1];
7447 	int err;
7448 	unsigned long flags;
7449 
7450 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
7451 	if (!hwsim_virtio_enabled)
7452 		goto out_unlock;
7453 
7454 	skb = virtqueue_get_buf(hwsim_vqs[HWSIM_VQ_RX], &len);
7455 	if (!skb)
7456 		goto out_unlock;
7457 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
7458 
7459 	skb->data = skb->head;
7460 	skb_reset_tail_pointer(skb);
7461 	len = min(len, skb_end_offset(skb));
7462 	skb_put(skb, len);
7463 	hwsim_virtio_handle_cmd(skb);
7464 
7465 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
7466 	if (!hwsim_virtio_enabled) {
7467 		dev_kfree_skb_irq(skb);
7468 		goto out_unlock;
7469 	}
7470 	vq = hwsim_vqs[HWSIM_VQ_RX];
7471 	sg_init_one(sg, skb->head, skb_end_offset(skb));
7472 	err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_ATOMIC);
7473 	if (WARN(err, "virtqueue_add_inbuf returned %d\n", err))
7474 		dev_kfree_skb_irq(skb);
7475 	else
7476 		virtqueue_kick(vq);
7477 	schedule_work(&hwsim_virtio_rx);
7478 
7479 out_unlock:
7480 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
7481 }
7482 
7483 static void hwsim_virtio_rx_done(struct virtqueue *vq)
7484 {
7485 	schedule_work(&hwsim_virtio_rx);
7486 }
7487 
7488 static int init_vqs(struct virtio_device *vdev)
7489 {
7490 	struct virtqueue_info vqs_info[HWSIM_NUM_VQS] = {
7491 		[HWSIM_VQ_TX] = { "tx", hwsim_virtio_tx_done },
7492 		[HWSIM_VQ_RX] = { "rx", hwsim_virtio_rx_done },
7493 	};
7494 
7495 	return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
7496 			       hwsim_vqs, vqs_info, NULL);
7497 }
7498 
7499 static int fill_vq(struct virtqueue *vq)
7500 {
7501 	int i, err;
7502 	struct sk_buff *skb;
7503 	struct scatterlist sg[1];
7504 
7505 	for (i = 0; i < virtqueue_get_vring_size(vq); i++) {
7506 		skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
7507 		if (!skb)
7508 			return -ENOMEM;
7509 
7510 		sg_init_one(sg, skb->head, skb_end_offset(skb));
7511 		err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
7512 		if (err) {
7513 			nlmsg_free(skb);
7514 			return err;
7515 		}
7516 	}
7517 	virtqueue_kick(vq);
7518 	return 0;
7519 }
7520 
7521 static void remove_vqs(struct virtio_device *vdev)
7522 {
7523 	int i;
7524 
7525 	virtio_reset_device(vdev);
7526 
7527 	for (i = 0; i < ARRAY_SIZE(hwsim_vqs); i++) {
7528 		struct virtqueue *vq = hwsim_vqs[i];
7529 		struct sk_buff *skb;
7530 
7531 		while ((skb = virtqueue_detach_unused_buf(vq)))
7532 			nlmsg_free(skb);
7533 	}
7534 
7535 	vdev->config->del_vqs(vdev);
7536 }
7537 
7538 static int hwsim_virtio_probe(struct virtio_device *vdev)
7539 {
7540 	int err;
7541 	unsigned long flags;
7542 
7543 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
7544 	if (hwsim_virtio_enabled) {
7545 		spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
7546 		return -EEXIST;
7547 	}
7548 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
7549 
7550 	err = init_vqs(vdev);
7551 	if (err)
7552 		return err;
7553 
7554 	virtio_device_ready(vdev);
7555 
7556 	err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
7557 	if (err)
7558 		goto out_remove;
7559 
7560 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
7561 	hwsim_virtio_enabled = true;
7562 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
7563 
7564 	schedule_work(&hwsim_virtio_rx);
7565 	return 0;
7566 
7567 out_remove:
7568 	remove_vqs(vdev);
7569 	return err;
7570 }
7571 
7572 static void hwsim_virtio_remove(struct virtio_device *vdev)
7573 {
7574 	hwsim_virtio_enabled = false;
7575 
7576 	cancel_work_sync(&hwsim_virtio_rx);
7577 
7578 	remove_vqs(vdev);
7579 }
7580 
7581 /* MAC80211_HWSIM virtio device id table */
7582 static const struct virtio_device_id id_table[] = {
7583 	{ VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },
7584 	{ 0 }
7585 };
7586 MODULE_DEVICE_TABLE(virtio, id_table);
7587 
7588 static struct virtio_driver virtio_hwsim = {
7589 	.driver.name = KBUILD_MODNAME,
7590 	.id_table = id_table,
7591 	.probe = hwsim_virtio_probe,
7592 	.remove = hwsim_virtio_remove,
7593 };
7594 
7595 static int hwsim_register_virtio_driver(void)
7596 {
7597 	return register_virtio_driver(&virtio_hwsim);
7598 }
7599 
7600 static void hwsim_unregister_virtio_driver(void)
7601 {
7602 	unregister_virtio_driver(&virtio_hwsim);
7603 }
7604 #else
7605 static inline int hwsim_register_virtio_driver(void)
7606 {
7607 	return 0;
7608 }
7609 
7610 static inline void hwsim_unregister_virtio_driver(void)
7611 {
7612 }
7613 #endif
7614 
7615 static int __init init_mac80211_hwsim(void)
7616 {
7617 	int i, err;
7618 
7619 	if (radios < 0 || radios > 100)
7620 		return -EINVAL;
7621 
7622 	if (channels < 1)
7623 		return -EINVAL;
7624 
7625 	err = rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
7626 	if (err)
7627 		return err;
7628 
7629 	err = register_pernet_device(&hwsim_net_ops);
7630 	if (err)
7631 		goto out_free_rht;
7632 
7633 	err = platform_driver_register(&mac80211_hwsim_driver);
7634 	if (err)
7635 		goto out_unregister_pernet;
7636 
7637 	err = hwsim_init_netlink();
7638 	if (err)
7639 		goto out_unregister_driver;
7640 
7641 	err = hwsim_register_virtio_driver();
7642 	if (err)
7643 		goto out_exit_netlink;
7644 
7645 	err = class_register(&hwsim_class);
7646 	if (err)
7647 		goto out_exit_virtio;
7648 
7649 	for (i = 0; i < radios; i++) {
7650 		struct hwsim_new_radio_params param = { 0 };
7651 
7652 		param.channels = channels;
7653 
7654 		switch (regtest) {
7655 		case HWSIM_REGTEST_DIFF_COUNTRY:
7656 			if (i < ARRAY_SIZE(hwsim_alpha2s))
7657 				param.reg_alpha2 = hwsim_alpha2s[i];
7658 			break;
7659 		case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
7660 			if (!i)
7661 				param.reg_alpha2 = hwsim_alpha2s[0];
7662 			break;
7663 		case HWSIM_REGTEST_STRICT_ALL:
7664 			param.reg_strict = true;
7665 			fallthrough;
7666 		case HWSIM_REGTEST_DRIVER_REG_ALL:
7667 			param.reg_alpha2 = hwsim_alpha2s[0];
7668 			break;
7669 		case HWSIM_REGTEST_WORLD_ROAM:
7670 			if (i == 0)
7671 				param.regd = &hwsim_world_regdom_custom_01;
7672 			break;
7673 		case HWSIM_REGTEST_CUSTOM_WORLD:
7674 			param.regd = &hwsim_world_regdom_custom_03;
7675 			break;
7676 		case HWSIM_REGTEST_CUSTOM_WORLD_2:
7677 			if (i == 0)
7678 				param.regd = &hwsim_world_regdom_custom_03;
7679 			else if (i == 1)
7680 				param.regd = &hwsim_world_regdom_custom_02;
7681 			break;
7682 		case HWSIM_REGTEST_STRICT_FOLLOW:
7683 			if (i == 0) {
7684 				param.reg_strict = true;
7685 				param.reg_alpha2 = hwsim_alpha2s[0];
7686 			}
7687 			break;
7688 		case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
7689 			if (i == 0) {
7690 				param.reg_strict = true;
7691 				param.reg_alpha2 = hwsim_alpha2s[0];
7692 			} else if (i == 1) {
7693 				param.reg_alpha2 = hwsim_alpha2s[1];
7694 			}
7695 			break;
7696 		case HWSIM_REGTEST_ALL:
7697 			switch (i) {
7698 			case 0:
7699 				param.regd = &hwsim_world_regdom_custom_01;
7700 				break;
7701 			case 1:
7702 				param.regd = &hwsim_world_regdom_custom_02;
7703 				break;
7704 			case 2:
7705 				param.reg_alpha2 = hwsim_alpha2s[0];
7706 				break;
7707 			case 3:
7708 				param.reg_alpha2 = hwsim_alpha2s[1];
7709 				break;
7710 			case 4:
7711 				param.reg_strict = true;
7712 				param.reg_alpha2 = hwsim_alpha2s[2];
7713 				break;
7714 			}
7715 			break;
7716 		default:
7717 			break;
7718 		}
7719 
7720 		param.p2p_device = support_p2p_device;
7721 		param.mlo = mlo;
7722 		param.multi_radio = multi_radio;
7723 		param.background_radar = true;
7724 		param.use_chanctx = channels > 1 || mlo || multi_radio;
7725 		param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
7726 		if (param.p2p_device)
7727 			param.iftypes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
7728 
7729 		err = mac80211_hwsim_new_radio(NULL, &param);
7730 		if (err < 0)
7731 			goto out_free_radios;
7732 	}
7733 
7734 	hwsim_mon = alloc_netdev(0, "hwsim%d", NET_NAME_UNKNOWN,
7735 				 hwsim_mon_setup);
7736 	if (hwsim_mon == NULL) {
7737 		err = -ENOMEM;
7738 		goto out_free_radios;
7739 	}
7740 
7741 	rtnl_lock();
7742 	err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
7743 	if (err < 0) {
7744 		rtnl_unlock();
7745 		goto out_free_mon;
7746 	}
7747 
7748 	err = register_netdevice(hwsim_mon);
7749 	if (err < 0) {
7750 		rtnl_unlock();
7751 		goto out_free_mon;
7752 	}
7753 	rtnl_unlock();
7754 
7755 	return 0;
7756 
7757 out_free_mon:
7758 	free_netdev(hwsim_mon);
7759 out_free_radios:
7760 	mac80211_hwsim_free();
7761 out_exit_virtio:
7762 	hwsim_unregister_virtio_driver();
7763 out_exit_netlink:
7764 	hwsim_exit_netlink();
7765 out_unregister_driver:
7766 	platform_driver_unregister(&mac80211_hwsim_driver);
7767 out_unregister_pernet:
7768 	unregister_pernet_device(&hwsim_net_ops);
7769 out_free_rht:
7770 	rhashtable_destroy(&hwsim_radios_rht);
7771 	return err;
7772 }
7773 module_init(init_mac80211_hwsim);
7774 
7775 static void __exit exit_mac80211_hwsim(void)
7776 {
7777 	pr_debug("mac80211_hwsim: unregister radios\n");
7778 
7779 	hwsim_unregister_virtio_driver();
7780 	hwsim_exit_netlink();
7781 
7782 	mac80211_hwsim_free();
7783 
7784 	rhashtable_destroy(&hwsim_radios_rht);
7785 	unregister_netdev(hwsim_mon);
7786 	platform_driver_unregister(&mac80211_hwsim_driver);
7787 	unregister_pernet_device(&hwsim_net_ops);
7788 }
7789 module_exit(exit_mac80211_hwsim);
7790