summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/virtual
AgeCommit message (Collapse)Author
2 dayswifi: mac80211_hwsim: get wiphy_name() after registrationJohannes Berg
The wiphy name registration is (or at least looks, since hwsim is the only user and doesn't have parallel ops) currently racy. In preparation for fixing that, grab wiphy_name() after the new radio is registered, since registration might change it. Link: https://patch.msgid.link/20261011113308.13b74d285682.I738d8363368771b442c3d9c683fef2c7e6c39da1@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2 dayswifi: mac80211_hwsim: support lockless beacon updatesJohannes Berg
We just use ieee80211_beacon_get_template_ema_list() or ieee80211_beacon_get() here to transmit the beacons, so there's no need to implement update_beacon() and we can just set NL80211_EXT_FEATURE_UPDATE_BEACON. Link: https://patch.msgid.link/20261009201417.b70fda659f6a.I811ea72fc189eb20bbc07b27cfaf9ffd420a70c9@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
6 dayswifi: mac80211_hwsim: call cfg80211 event with wiphy mutexJohannes Berg
These functions really require the wiphy mutex (though they're not yet documented as such), call them with it. Link: https://patch.msgid.link/20261006120655.34c6cd54cb9d.I4a45533cc3a020c472f7d90f33e854d7a89b2d3a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
6 dayswifi: mac80211_hwsim: Pin module for debugfs file operationsBui Viet Dung
An open debugfs file retains its file_operations pointer in the debugfs proxy state. However, hwsim_background_cac_ops and hwsim_simulate_incumbent_signal_fops in mac80211_hwsim_main.c have no .owner set to THIS_MODULE. As a result, full_proxy_open_regular() calls fops_get() which succeeds without taking a reference to the mac80211_hwsim module. When a userspace process opens either of these debugfs files, a subsequent module unload (rmmod mac80211_hwsim) can succeed while the file descriptor remains open. When the userspace process subsequently closes the descriptor, full_proxy_release() accesses the already unmapped file_operations structure, triggering a kernel oops in full_proxy_release(): BUG: unable to handle page fault for address: fffffbfff84f49e7 Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:full_proxy_release+0x8e/0x140 Call Trace: <TASK> __fput+0x39f/0xa60 __x64_sys_close+0x80/0xe0 do_syscall_64+0xc3/0x590 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> The issue was discovered via manual code audit of mac80211_hwsim_main.c and reproduced on a Linux 7.3-rc6 test VM with CONFIG_MAC80211_HWSIM=m. Set .owner = THIS_MODULE on both debugfs file_operations structures in mac80211_hwsim_main.c so that debugfs pins the module until close has completed. Signed-off-by: Bui Viet Dung <dungvn2345@gmail.com> Link: https://patch.msgid.link/20261008122838.224835-1-dungvn2345@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 dayswifi: mac80211_hwsim: add NAN Instant Communication supportIlan Peer
Advertise Instant Communication (IC) support, and when it is enabled: - Transmit the discovery beacons disregarding the role and the state, with the configured beacon interval and the NAN attributes set by user space. - Accept beacons that carry a Service ID List or a Subscribe Service ID List attribute at any time, so that they are forwarded to mac80211. - Process discovery beacons received during non DW slots for anchor master tracking and synchronization. Assisted-by: GitHubCopilot:claude-opus-5 Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20261005084458.3666739-12-ilan.peer@intel.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 dayswifi: mac80211_hwsim: nan: Handle more of the NAN configurationIlan Peer
- Use the discovery beacon interval configured by user space instead of always using hardcoded 100 TUs. - Append the NAN attributes set by user space to the locally generated ones in the discovery beacons. Assisted-by: GitHubCopilot:claude-opus-5 Signed-off-by: Ilan Peer <ilan.peer@intel.com> Link: https://patch.msgid.link/20261005084458.3666739-11-ilan.peer@intel.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 dayswifi: mac80211_hwsim: nan: prepare for more configurable NAN settingsIlan Peer
In preparation for handling more of the NAN configuration setting, do some refactoring and cleanup: - Extract mac80211_hwsim_nan_set_config() and call it both when NAN is started and when the configuration changes. - Add NAN_BEACON_ELEM_LEN instead of the hardcoded 27. Assisted-by: GitHubCopilot:claude-opus-5 Signed-off-by: Ilan Peer <ilan.peer@intel.com> Link: https://patch.msgid.link/20261005084458.3666739-10-ilan.peer@intel.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 dayswifi: mac80211_hwsim: nan: use ieee80211_is_nan_beacon() helperIlan Peer
Use the new ieee80211_is_nan_beacon() helper to identify NAN beacons instead of open-coding the cluster ID and vendor element checks. Assisted-by: GitHubCopilot:claude-opus-5 Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20261005084458.3666739-9-ilan.peer@intel.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
10 dayswifi: mac80211_hwsim: reserve headroom for software encryptionFelix Fietkau
mac80211_hwsim accepts CCMP and GCMP keys in mac80211_hwsim_set_key() and encrypts unicast data frames itself in mac80211_hwsim_tx(), through ieee80211_encrypt_tx_skb(). It asks mac80211 to reserve tailroom for the MIC, but not headroom for the CCMP or GCMP header. Reserve the header as driver headroom. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260930084729.3000295-1-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-28wifi: mac80211_hwsim: Support NAN deferred schedule completionAndrei Otcheretianski
Simulate firmware completing a deferred NAN schedule update in mac80211_hwsim by calling ieee80211_nan_sched_update_done() from a delayed work, so that the completion notification reaches user space after the update request returns, as it would with real hardware. This doesn't really implement the schedule update flow and doesn't announce anything to the peers. However, it should be good enough meanwhile for some minimal testing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260922144356.81f62b390ef6.I21654fe82a0065a055a1b958297b2beb4337a1f0@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-28wifi: mac80211_hwsim: claim support for Control Integrity ProtocolBenjamin Berg
The mac80211_hwsim driver never actually generates control frames. As such, it can simply claim the Control Integrity protocol (CIP). Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Link: https://patch.msgid.link/20260921144048.6a4047ca21a1.If483ea588361a90b58a52493936cc0bbbc74c075@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-21Merge tag 'wireless-next-2026-09-21' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== More changes, including drivers: - brcmfmac: FT/OKC roaming offload - ath12k: IPQ5332 platform infrastructure - cfg80211/mac80211: non-STA TX/RX infrastructure for MLO to fix address translation bugs - the rest is mostly minor cleanups etc. * tag 'wireless-next-2026-09-21' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (101 commits) dt-bindings: net: wireless: Convert WL1251 to DT schema libertas: mesh: remove unused and undocumented sysfs attribute groups wifi: mac80211: fix multi-link UHR association wifi: nl80211: rename no-ACK bitmap to TID bitmap wifi: radiotap: correct EHT TB U-SIG 1 B20:25 wifi: ieee80211: fix FTM bufferable check wifi: mac80211: allow advertising 20 MHz-only non-AP STA wifi: mac80211: WARN on 40 MHz HT/HE mismatch wifi: mac80211: tests: fix memory leak wifi: mac80211: use assign_bit() where applicable wifi: mac80211: pass error station if non-STA transmit was requested wifi: mac80211: pass station to ieee80211_tx_skb_tid wifi: mac80211: report to cfg80211 when no STA is known for a frame wifi: cfg80211: add attribute for TX/RX denoting there is no station wifi: mac80211: rework RX packet handling wifi: mac80211: refactor RX link_id and station handling wifi: mac80211: change public RX API to use link stations wifi: iwlwifi: use link_sta internally to the driver MAINTAINERS: Replace wireless.wiki.kernel.org links wifi: brcmfmac: log the firmware status when a connect fails ... ==================== Link: https://patch.msgid.link/20260921121635.195723-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-16wifi: mac80211: change public RX API to use link stationsBenjamin Berg
If a station is passed then the link ID also needs to be known. As such, it is a more natural API to simply pass the link station directly rather than pushing the link information into the RX status. Furthermore, having the link ID in the RX status is not actually correct because the link IDs are VIF specific and there may be multiple VIFs. In the case of a station this relationship is clear, but then one may as well use the link station. This patch only changes the API and emulates the old (incorrect) behaviour for now. The mac80211 RX code will be updated in later patches. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Link: https://patch.msgid.link/20260915151925.06f41565116a.I4a2d45609e94b52654b10ec572e59a45d09c41f4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-14wifi: mac80211_hwsim: overwrite report SKBJohannes Berg
In a new test framework for hwsim I'm working on, tests can modify the frame as it passes through the wmediumd APIs. If then the original frame is reported on the monitor interface, things get a bit confusing. Overwrite the frame that will be reported to the monitor with the frame reported for RX if both transmitter and cookie attributes are present (wmediumd doesn't set them). Also add a HWSIM_ATTR_NO_MONITOR flag to allow a frame to be dropped entirely from monitor report, e.g. in case it was never delivered to any peer. Link: https://patch.msgid.link/20260911154632.c06da6d18055.Iaba24acec4c5765fbad77376418b17d1b863791b@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-14wifi: mac80211_hwsim: fix potential channel crashJohannes Berg
If wmediumd is used together with a hwsim radio that has channel contexts enabled, the channel pointer can be NULL. Track the frequency so we don't need it at that point, avoiding the crash but still reporting the right freq. Link: https://patch.msgid.link/20260911154632.44cf5d8492c2.I9448bd3cea76eb90554ae73fc77e0a3092ff1271@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-14wifi: mac80211_hwsim: send config events to the radio's net namespaceMaoyi Xie
hwsim_mcast_config_msg() falls back to genlmsg_multicast() when it has no genl_info, and that only reaches init_net. A radio in another namespace therefore has its DEL_RADIO announced in init_net, while its own namespace hears nothing. Multicast to wiphy_net() instead, the net that GET and DUMP already filter on. Tested with a config-group listener in each namespace, on a base and a patched kernel. Assisted-by: Claude:claude-opus-5 codeql Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Link: https://patch.msgid.link/20260904140300.3402053-1-maoyixie.tju@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-14wifi: virt_wifi: don't transfer operstate before registerZihan Xi
virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", free_netdev() immediately frees the object. A later linkwatch_fire_event() then use-after-frees the list entry. Move the transfer to after netdev_upper_dev_link(), as macvlan and ipvlan already do. Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") Reported-by: Vega <vega@nebusec.ai> Assisted-by: LLM Co-developed-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Zihan Xi <zihanx@nebusec.ai> Link: https://patch.msgid.link/f5a832fb0ab228ce6e2b5a91fba4ca8b79198a2f.1788948455.git.zihanx@nebusec.ai Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-09wifi: mac80211_hwsim: don't hand frames to mac80211 while stoppingJohannes Berg
The code checks ->started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the WARN_ON(!local->started). Expand the mutex for this case and synchronise against it when the radio is stopped to avoid being able to hit the warning with hwsim. Drop the error print that would've complicated the error path, it only triggers for allocation failures (already noisy) and malformed frames anyway. Assisted-by: LLM Fixes: 7882513bacb1 ("mac80211_hwsim driver support userspace frame tx/rx") Reported-by: syzbot+b4aa2b672b18f1d4dc5f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b4aa2b672b18f1d4dc5f Link: https://patch.msgid.link/20260904170140.5f69a10d606b.I4a7921d00643f69e439c7a3b221d104f66a3dcdc@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-04wifi: virt_wifi: free skb when disconnectedMariano Baragiola
When the simulated link is disconnected, virt_wifi_start_xmit() returns NET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this return value as consumed, so every packet sent while disconnected leaks its skb. Free the skb before returning the drop status. Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") Signed-off-by: Mariano Baragiola <mbaragiola@linux.com> Link: https://patch.msgid.link/20260809124947.3590270-1-mbaragiola@linux.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-27Merge tag 'wireless-2026-07-26' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== wireless-next-2026-07-26 Mostly driver changes this time: - new driver mm81x for an S1G device - new driver nxpwifi for NXP devices (mostly forked off from mwifiex) - ath12k: much kernel infrastructure integration work - brcmfmac: DPP support, some Cypress part update - nl80211: per-link statistics support ==================== Link: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22wifi: mac80211_hwsim: report TX status link_idPriyansha Tiwari
Populate link_valid/link_id in mac80211_hwsim TX status so the transmitted link is reported to mac80211. Set the link information in both the direct TX status path and the wmediumd/netlink TX status path. With that done, enable NL80211_EXT_FEATURE_PROBE_AP. Signed-off-by: Priyansha Tiwari <priyansha.tiwari@oss.qualcomm.com> Link: https://patch.msgid.link/20260709114228.672317-3-pritiwa@qti.qualcomm.com [add note about NL80211_EXT_FEATURE_PROBE_AP] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211_hwsim: clear PMSR request state on abortZhao Li
mac80211_hwsim saves the in-flight cfg80211 PMSR request and its wdev in data->pmsr_request / data->pmsr_request_wdev when a measurement starts, and clears them only when it reports completion. mac80211_hwsim_abort_pmsr() never cleared that saved state. cfg80211 owns the request and frees it once the abort callback returns (cfg80211_pmsr_process_abort() calls rdev_abort_pmsr() then kfree(req)), so after an abort data->pmsr_request dangles. A later hwsim PMSR report then dereferences the freed request in hwsim_pmsr_report_nl() and completes it; a use-after-free. Clear data->pmsr_request and data->pmsr_request_wdev once the abort matches the active request. Move the wmediumd/virtio notification check below the clear so the saved state is dropped even when no notification is sent. Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260708195911.84365-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211_hwsim: authenticate PMSR report sendersZhao Li
hwsim_pmsr_report_nl() looks up the radio by HWSIM_ATTR_ADDR_TRANSMITTER and, when data->pmsr_request is set, parses the reported peer results, hands them to cfg80211_pmsr_report(), then unconditionally clears data->pmsr_request and calls cfg80211_pmsr_complete() to end the measurement. Unlike the sibling wmediumd data-path handlers hwsim_tx_info_frame_received_nl() and hwsim_cloned_frame_received_nl(), which check the sending socket's netgroup against data->netgroup and its portid against data->wmediumd, this handler did not check the sender at all, and its genl op carries no GENL_UNS_ADMIN_PERM flag. In non-virtio (wmediumd) mode any process in the netns that can reach the hwsim generic netlink family could therefore send a report. The transmitter address is not secret, so such a process could inject spoofed ranging results for another radio's in-flight request and, because the handler always completes the measurement, terminate a ranging operation owned by the real wmediumd session. Reject reports whose sender does not match the registered wmediumd instance, mirroring the sibling handlers: in non-virtio mode require the sending socket's netgroup to equal data->netgroup and info->snd_portid to equal data->wmediumd before touching the request state. Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260708195911.84365-3-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFOIbrahim Hashimov
hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload. Require the exact length in the policy, so a malformed attribute is rejected before the handler runs. Signed-off-by: Ibrahim Hashimov <security@auditcode.ai> Assisted-by: AuditCode-AI:2026.07 Link: https://patch.msgid.link/20260721115346.17236-1-security@auditcode.ai Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-07wifi: mac80211_hwsim: avoid NULL skb in stop queue drainCen Zhang
mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate. Fixes: bd18de517923 ("mac80211_hwsim: drop pending frames on stop") Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang <zzzccc427@gmail.com> Link: https://patch.msgid.link/20260706161822.921039-1-zzzccc427@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-07wifi: mac80211_hwsim: clean up radio rhashtable on freeCen Zhang
mac80211_hwsim_free() removes each radio from hwsim_radios before calling mac80211_hwsim_del_radio(), but leaves the matching hwsim_radios_rht entry in place until the whole table is destroyed. Other radio removal paths remove both the list entry and data->rht while holding hwsim_radio_lock, before dropping the lock and deleting the radio. Do the same here so the all-radio cleanup path follows the same object visibility ordering. This helper is used while all radios are being torn down, either after callback users have already been unregistered or while module init is unwinding, so no hwsim_radios_generation update is needed. Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang <zzzccc427@gmail.com> Link: https://patch.msgid.link/20260706123756.343818-1-zzzccc427@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-06wifi: mac80211_hwsim: avoid treating MCS as legacy rate indexYousef Alhouseen
Injected HT and VHT rates store an MCS value in rates[0].idx rather than an index into the legacy bitrate table. hwsim nevertheless passes these rates to ieee80211_get_tx_rate() while generating monitor frames and timestamps. A crafted injected frame can therefore read beyond the bitrate table. If the resulting bitrate is zero, mac80211_hwsim_write_tsf() also divides by zero, as observed by syzbot. Use ieee80211_get_tx_rate() only for legacy rates. The existing fallback continues to supply a conservative bitrate where hwsim does not yet calculate MCS rates. Reported-by: syzbot+21629c14aa749636db9d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=21629c14aa749636db9d Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Link: https://patch.msgid.link/20260628002537.23550-1-alhouseenyousef@gmail.com [drop wrong Fixes tag] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-06wifi: mac80211_hwsim: clamp virtio RX length before skb_putBryam Vargas
hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem. Fixes: 5d44fe7c9808 ("mac80211_hwsim: add frame transmission support over virtio") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260620-b4-disp-474bee37-v1-1-1a4d37f3e2d4@proton.me Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-03wifi: mac80211_hwsim: claim DBE capabilityJohannes Berg
Claim DBE capability in UHR MAC capabilities, hostapd will have to sort out the actual DBE capabilities based on the EHT capabilities. Link: https://patch.msgid.link/20260529102644.4db84674e8c2.I8731be8ea589c94ece5623e7e716cbbc03f50466@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-03wifi: Update UHR PHY capabilities to D1.4Johannes Berg
There are new capabilities in D1.4, and some reserved bits. Update the code accordingly. Link: https://patch.msgid.link/20260529102644.f146932b21e2.I12bad84157bf809fbe285b79420143b3c456d9d2@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-03wifi: cfg80211: remove 5/10 MHz channel supportJohannes Berg
Remove WIPHY_FLAG_SUPPORTS_5_10_MHZ and 5/10 MHz channel width support. We contemplated this back in early 2023 and didn't do it yet, but nobody stepped up to maintain it. It's already _mostly_ dead code since it can really only be used for AP and maybe IBSS and monitor, but not on a client since there's no way to scan (and hasn't been in a very long time, if ever), so the only thing that ever could really happen with it was run syzbot and trip over assumptions in the code. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260529084502.080c5885f0b7.I77cc94485b523c3c006005b9233db13cd4e077b3@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28wifi: mac80211_hwsim: add debug messages for link changesJohannes Berg
It's useful to be able to see the link addresses when the interface links change, so add some prints to hwsim for the vif link change callback. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260527224151.b22a048abc7c.Ief2132c5c4bb67fa56e90eb8e7d59dfd9f2b9378@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28wifi: mac80211_hwsim: modernise S1G channel listLachlan Hodges
The current S1G channel list in mac80211_hwsim does not represent what S1G drivers would advertise that being 1MHz primaries. Also, include the NO_PRIMARY flag on the edgeband 1MHz primaries to emulate US operation such that it can also be tested. Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260527033828.183821-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28wifi: mac80211_hwsim: don't run RC update on new STA on S1G vifLachlan Hodges
mac80211_hwsim_sta_rc_update() is unable to handle S1G widths so when a new STA is added under a S1G vif the WARN is hit preventing hwsim use for S1G. For now, skip calling rc_update() for S1G interfaces. This is required such that the soon-to-be S1G hwsim tests can successfully run. Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260527033828.183821-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: mac80211_hwsim: Do not declare NAN support for Extended Key IDIlan Peer
Do not declare support for Extended Key ID for NAN, as defined in section 7.4 in the WiFi Aware specification v4.0 (in order to support security association upgrade). Fixes: eaa7ce66c3e2 ("wifi: mac80211_hwsim: Fix possible NULL dereference") Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260515141442.365ca3ab29f9.Ib435168dcc1d7d8719a5612109035ca1950967ed@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: mac80211_hwsim: advertise NPCA capabilityJohannes Berg
This doesn't really do anything, but we can advertise it and then check that the AP can be configured and client can connect, etc. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260512224724.abfd51f480b7.I2024d7fc8067a0fca26234f312937cc764b660f4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: mac80211_hwsim: reject NAN on multi-radio wiphysDeepanshu Kartikey
When userspace creates a new hwsim radio with both HWSIM_ATTR_MULTI_RADIO and HWSIM_ATTR_SUPPORT_NAN_DEVICE, hwsim_new_radio_nl() sets BIT(NL80211_IFTYPE_NAN_DATA) in wiphy->interface_modes while configuring the wiphy with n_radio > 1. This violates the invariant checked in wiphy_register(): (interface_modes & BIT(NL80211_IFTYPE_NAN_DATA)) && (!nan_capa.phy.ht.ht_supported || n_radio > 1) triggering a WARN reachable from userspace via genetlink. With panic_on_warn this becomes a denial of service. Refuse the combination at parse time with -EINVAL and an extack message, matching the cfg80211 constraint that NAN is not supported on multi-radio wiphys. Reported-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2002864e6c6895cb0ac3 Fixes: 2c7c70ee7cee ("wifi: mac80211_hwsim: enable NAN_DATA interface simulation support") Tested-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Link: https://patch.msgid.link/20260509004628.79446-1-kartikey406@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: claim HT STBC capabilityJohannes Berg
This is already claimed for VHT and HE, so it doesn't really make sense to not claim it for HT, and this causes sigma-dut failures since it assumes VHT support implies HT support. Link: https://patch.msgid.link/20260506093231.155762-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: enable NAN_DATA interface simulation supportDaniel Gabay
Enable NAN_DATA interface simulation support by adding it to the supported interface types. This completes the NAN Data Path simulation introduced in the previous patches. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.d4bd95959bfa.I450087714bd55189242ab6a72ce6650be36edbcb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: Support Tx of multicast data on NANIlan Peer
Add support for transmitting multicast data frames. These frames can be transmitted when all the peer NDI stations on the interface are available at the current slot. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.0af7e24f0df3.I3c2de3e456ae092c939e6bfd3d30960fbf2fbeaa@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: Do not declare support for NDPEIlan Peer
Do not declare support for NAN Data Path Extension attribute as this is handled by user space and should be set by it. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.711c61538c8a.I9796410c0376f50a07259cc611428d76c51f180a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: Declare support for secure NANDaniel Gabay
Advertise NL80211_EXT_FEATURE_SECURE_NAN to indicate support for NAN Pairing, enabling peer authentication and secure data path establishment. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Reviewed-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.d3bcc26b4525.I6993cc70c43579694ffd429f1afb971a73db2ae4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: add NAN data path TX/RX supportDaniel Gabay
Implement TX and RX path handling for NAN Data Path (NDP) frames, enabling data communication between NAN peers during scheduled availability windows. TX path: - Select TX channel based on current time slot: use DW channel during Discovery Windows, or FAW channel from local schedule during Further Availability Windows. - Verify peer availability before transmission by checking committed DW schedule or FAW of the peer schedule. RX path: - Extend NAN receive filtering to handle NAN_DATA interface frames. - Accept incoming frames during FAW slots when channel matches local schedule. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.155252ebc72b.Ic210f6c095c6ff372941bc8c77ee9c8c37d0356c@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: set HAS_RATE_CONTROL when using NANDaniel Gabay
- NAN switches between bands/channels per its schedule, so mac80211 rate control can't work, set HAS_RATE_CONTROL instead. - Skip rate control checks for NAN interfaces in mac80211_hwsim_sta_rc_update() as it's not relevant. - Move set_rts_threshold stub to HWSIM_COMMON_OPS and return 0 instead of -EOPNOTSUPP to prevent failures in non-MLO tests that set RTS threshold (hwsim ignores the use_rts instruction from mac80211 anyway). Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.216e68be61ac.If9ef94a12cec8dfc55416afaf745d6e5025a5ec9@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: implement NAN schedule callbacksDaniel Gabay
Implement mac80211 schedule callbacks for NAN Data Path support: - Track local schedule via BSS_CHANGED_NAN_LOCAL_SCHED, caching the channel for each 16TU time slot. - Copy peer schedule to driver-private storage in nan_peer_sched_changed callback for use in TX availability decisions. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.f3ad9e3dc9d4.I75cf3555b7506d5b8bb30e70a0f3721ab73477cb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: add NAN PHY capabilitiesDaniel Gabay
Add static HT, VHT and HE PHY capabilities to the NAN capabilities structure. These are based on the existing band capability structures and initialization in mac80211_hwsim. The NAN PHY capabilities are used by mac80211 and nl80211 to advertise device capabilities for NAN data interfaces. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.2c94c156f05d.I539fab4adf2eb43bfec27006f7529b926e5208ea@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: add NAN_DATA interface limitsDaniel Gabay
Increase interface limits for NAN_DATA interface. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.587955b23089.I261b782e5c198726b9465815d59ce037f094784d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: implement NAN synchronizationBenjamin Berg
Add all the handling to do NAN synchronization on 2.4 GHz including sending out beacons. With this, the mac80211_hwsim NAN device also works when used in conjunction with an external medium simulation. Note that the TSF sync is not ideal in case of an external medium simulation. This is because the mactime for received frames needs to be estimated and the simulation may not update the timestamp of beacons to the actual time that the frame was transmitted. The implementation has an initial short phase where it scans for clusters. This facilitates cluster joining and avoids creating a new cluster immediately, which would result in two cluster join notifications. It does not scan otherwise and will only see another cluster appearing if a discovery beacon happens to be sent during the 2.4 GHz discovery window (DW). Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.7d21c3cdc565.I98b6c15eadefd6d123658294ef1a0cd3c2ce3054@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: protect tsf_offset using a spinlockBenjamin Berg
To implement NAN synchronization in hwsim, the TSF needs to be adjusted regularly from the RX path. Add a spinlock so that this can be done in a safe manner. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.18f36f264eb9.I0da5477220b896e2177bd521f7d9a8f2595631e6@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: only RX on NAN when active on a slotBenjamin Berg
This moves the NAN receive into the main code and changes it so that frame RX only happens when the device is active on the channel. This limits RX to the DW slots as there is currently no datapath. With this the globally stored channel is obsolete, remove it. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.8cf4a67d3436.Ife07cf4ae8a2d59766356398163f7ee8d734bd6a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>