Add a kernel module package for the TI LP5569 RGB LED controller driver,
used by the front panel LEDs of the Zyxel NBG7815.
The driver registers an i2c and an of device table, so AutoProbe is
enough and no load priority is needed. The boot flag is kept, as the
other LED modules do, so that the module is available to preinit on a
device that signals boot state through one of its LEDs.
Signed-off-by: André Valentin <avalentin@marcant.net>
The led init script already knows how to drive a multicolor LED: it reads
multi_index and writes one intensity per color to multi_intensity, taken
from color_<name> options of the led section. Nothing fills those options
in, though - generate_led only passes name, sysfs, trigger and default on
to uci, so the intensities stay at zero and the LED remains dark whatever
trigger is set. No board has been able to use it so far.
Pass any color_* key of a board.json led object through to the led
section, and add ucidef_set_led_colors() to set them from board.d:
ucidef_set_led_default "led1" "LED1" "nbg7815:led1" "1"
ucidef_set_led_colors "led1" red 255 green 255 blue 255
The colors are not restricted to RGB - the keys are matched against
whatever the LED reports in multi_index.
Signed-off-by: André Valentin <avalentin@marcant.net>
On 6.18 the rfc7539(chacha20,poly1305) template takes its ChaCha20
skcipher from crypto/chacha.ko, which CRYPTO_CHACHA20POLY1305 selects
but no package ships, and which needs lib/crypto/libchacha.ko.
Instantiating rfc7539esp(chacha20,poly1305) for IPsec then fails with
ENOSYS.
Ship chacha.ko with kmod-crypto-chacha20poly1305 on 6.18, load it
before the template and depend on kmod-crypto-lib-chacha20 for
libchacha.ko.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25544
Signed-off-by: Robert Marko <robimarko@gmail.com>
The linux-riscv64-openwrt target inherits linux-generic64, which sets no
asm_arch, so OpenSSL builds only its C code on riscv64. Inherit
linux64-riscv64 instead. That adds the riscv64 assembly for AES, GHASH,
ChaCha20 and SHA-2, which uses the Zb*, Zk* and vector crypto extensions
only when the CPU reports them at runtime.
libcrypto.so.3 grows by 24 KiB, and is 2.3 KiB smaller after xz.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25581
Signed-off-by: Robert Marko <robimarko@gmail.com>
Since kmod-input-evdev depends on input-support, kmod-hid and
kmod-usb-hid are hidden without it, and so is everything selecting
kmod-hid: kmod-bluetooth, kmod-hci-uart and kmod-btusb. A device that
lists one of them in DEVICE_PACKAGES fails to build as a single profile:
ERROR: unable to select packages:
kmod-hci-uart (no such package):
Neither module needs evdev, so select it only with input-support.
Fixes: a7c50f7d73 ("input-support: add a package for input device handling")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25565
Signed-off-by: Nick Hainke <vincent@systemli.org>
As the MIPI-DBI firmware blobs are carrying target-dependencies to only
be available and get built for the targets they are actually used by,
the package needs to be flagged as 'nonshared'.
While at it, remove the duplicated firmware compiler and instead use the
(archived) upstream repo it came from.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Enabling CONFIG_TARGET_ROOTFS_PERSIST_VAR leaves /var/lock on
persistent storage, allowing stale lock files to survive reboots.
Link /var/lock to ../tmp/lock so that lock files remain volatile.
Use a relative symlink to keep build-time accesses within the
target root filesystem. Create the target directory for rootfs
preparation. procd already recreates /tmp/lock at boot.
Fixes: 57807f50de ("base-files: add option to make /var persistent")
Signed-off-by: Ivan Romanov <drizt72@zoho.eu>
Link: https://github.com/openwrt/openwrt/pull/25718
Signed-off-by: Robert Marko <robimarko@gmail.com>
phram exposes a physical memory range as a read-write MTD device. This
can be used to access RAM regions reserved by firmware or described in
the device tree.
Of particular interest, phram nodes carved out of the reserved region
can survive soft reboots, making it a useful primitive to pass one-shot
bootenv overrides to uboot (fw_setenv -c) without the risk of bricking,
having to wire up a serial console etc.
This patch does the kernel module enablement, paving the way for
potential userspace integrations further down the line (ubus, procd,
sysupgrade etc.)
Run-tested on Linksys E8450 (UBI) with OpenWrt uboot.
Signed-off-by: Gary Dotzler <geldot@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/25692
Signed-off-by: Nick Hainke <vincent@systemli.org>
Add the Dual Queue Coupled AQM (RFC 9332) queuing discipline, which
gives L4S traffic a low latency without starving classic traffic. It
is available since kernel 6.17, tc supports it already.
Link: https://github.com/openwrt/openwrt/pull/25779
Signed-off-by: Nick Hainke <vincent@systemli.org>
Add the Earliest TxTime First queuing discipline, which sends packets
at the time set with SO_TXTIME. It is used for Time-Sensitive
Networking, also together with taprio in txtime-assist mode.
Link: https://github.com/openwrt/openwrt/pull/25777
Signed-off-by: Nick Hainke <vincent@systemli.org>
Add the Time Aware Priority (IEEE 802.1Qbv) queuing discipline, used
for Time-Sensitive Networking.
The Hellcreek switch driver depends on taprio, so disable it to avoid
a new config prompt.
Link: https://github.com/openwrt/openwrt/pull/25777
Signed-off-by: Nick Hainke <vincent@systemli.org>
hostapd-utils and wpa-cli use VARIANT:=*, so every variant packs them.
Since the variants are built in parallel, they write the same package
file and pkginfo files at the same time. This makes the build fail
randomly:
Package hostapd-utils is missing dependencies for the following libraries:
libgcc_s.so.1
Only pack them in the first selected variant that builds them.
Fixes: b029d56e0b ("hostapd: build the variants in parallel")
Link: https://github.com/openwrt/openwrt/pull/25796
Signed-off-by: Nick Hainke <vincent@systemli.org>
The vendor BL2 of the Wavlink WL-WNT100X3 initializes DDR3 at
1866 MT/s:
NOTICE: BL2: v2.7(release):292bca1-dirty
NOTICE: DDR3 1866MHZ
NOTICE: EMI: Using DDR3 settings
while the plain spim-nand-ddr3 BL2 used by the ubootmod variant runs
DDR3 at the default 2133 MT/s, which is above what the vendor
qualified on this board.
Switch the ubootmod BL2 to the existing DDR3 1866 MT/s build, in line
with the vendor firmware.
Tested on WL-WNT100X3: BL2 reports the ddr3-1866 build, the memory
test passes, U-Boot and OpenWrt boot from UBI.
Fixes: d2fabb974c ("mediatek: add support for Wavlink WL-WNT100X3 ubootmod")
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25763
Signed-off-by: Robert Marko <robimarko@gmail.com>
The internal PHYs of the QCA8327/8334/8337 switches are handled by the
qca83xx PHY driver. Without it they silently fall back to genphy and
lose the chip-specific setup and fixups. Every device using
kmod-dsa-qca8k already pulls it in manually except the MikroTik
RB960PGS, which was missing it.
Add the dependency, like other DSA packages do with their PHY drivers,
and drop the now-redundant device package entries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25767
Signed-off-by: Robert Marko <robimarko@gmail.com>
The firmware images of Layerscape boards booting from QSPI, e.g. the
LS1046A-FRWY, differ between builds in 4 bytes at the end of the PBL:
-00009e80: 019f 1e98 0000 0000 0000 0000 0000 0000
+00009e80: e10f e4a8 0000 0000 0000 0000 0000 0000
byte_swap pads the PBL to a multiple of 8 bytes from a 4 byte variable,
so fwrite() reads up to 4 bytes of the stack past it, and an aligned
PBL always gets 8 bytes appended, 4 of them random.
Add a patch that pads with an 8 byte buffer of zeros. The output keeps
its length and layout: for an aligned input only the 4 former random
bytes become zeros, an unaligned input gives the same output as before.
Link: https://github.com/openwrt/openwrt/pull/25720
Signed-off-by: Paul Spooren <mail@aparcar.org>
libopenssl3 differs between builds depending on the environment of the
build host, e.g. in the images of the Turris Omnia:
-compiler: arm-openwrt-linux-muslgnueabi-gcc -fPIC -pthread -Os ...
+compiler: arm-openwrt-linux-muslgnueabi-gcc -fPIC -pthread -Wa,--noexecstack -Os ...
- GNU_STACK ... RWE 0x10
+ GNU_STACK ... RW 0x10
Configure probes whether the assembler supports --noexecstack by running
$CROSS_COMPILE$CC, with CC taken from the environment. A host which sets
CC to select its compiler, e.g. CC=gcc-13, makes it run
arm-openwrt-linux-muslgnueabi-gcc-13, which does not exist, so the flag
is silently dropped and libcrypto ends up with an executable stack.
Pass CC=gcc to Configure, so that it always probes the cross compiler.
With CC=gcc-13 in the environment, the configuration now gets
-Wa,--noexecstack like a build without CC set.
Link: https://github.com/openwrt/openwrt/pull/25719
Signed-off-by: Paul Spooren <mail@aparcar.org>
The PPPoA plugin only uses text2atm() and text2qos() from libatm. ppp
ships copies of both and uses them unless configured --with-atm, so
link the bundled copies and drop the dependency on linux-atm.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25707
Signed-off-by: Robert Marko <robimarko@gmail.com>
162f8985525f wifi: mt76: mt7925: don't put the band auto marker in TGID
047558e81f6b wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory
f3e7928585db wifi: mt76: fix memory leak in USB TX path
c50f17ec046e wifi: mt76: mt7603: initialize global station WCID
1297eb4e49fc wifi: mt76: mt7615: restore DBDC state after ext PHY failure
2009416d3f90 wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
7f30d9cb0d3e wifi: mt76: mt792x: pick the SAR table layout from the table itself
20f0979088b3 wifi: mt76: mt7915: publish wcid before MCU add commands
8f69e214f057 wifi: mt76: fix unlocked wcid check in mt76_tx_status_skb_add()
7ff2f295a629 wifi: mt76: fix wcid teardown ordering in mt76_reset_device()
7fec0ac4e12c wifi: mt76: connac2: fill TXD spe_idx for connac2 fixed-rate frames
5073b08ce0c4 wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path
d7675366ff03 wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path
bbde131e8f2c wifi: mt76: move the channel survey when the channel changes
9e96501e32e5 wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
a2a78703435c wifi: mt76: mt7915: check default EEPROM firmware size before copying
56c8b4a4b407 wifi: mt76: mt7996: validate firmware event lengths before parsing
fee59a3f8bca wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure
fd3dc2614c73 wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump
40bd3ff75a69 wifi: mt76: mt7996: bound RRO session id before indexing addr_elem[]
27a48eed077f wifi: mt76: mt76x02: validate RX padding before use
17bfd775f483 wifi: mt76: mt7615: cancel reset work during unregister
c228f918e321 wifi: mt76: mt7925: keep MLD membership consistent during link add
c02187d15016 wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.
3318ff5daa93 wifi: mt76: mt7921: keep the join ROC until the station is authorized
fddc43d51481 wifi: mt76: mt7925: keep the join ROC until the station is authorized
790d1ae1e534 wifi: mt76: mt792x: defer the MCU shutdown past unregister on USB
4e819092f203 wifi: mt76: usb: fix source overread in mt76u_copy
be33bbd93f1a wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy
a0a409c3091d wifi: mt76: mt7915: fix thermal zone use-after-free
a374cac12909 wifi: mt76: mt7603: don't drop short frames looped back on PS entry
210948383adf wifi: mt76: mt7996: refresh the tx BA session timer on NPU devices
9559d859e64e wifi: mt76: avoid iter_keys_rcu() where not needed
d17b8d5eff29 wifi: mt76: mt7996: validate TLV length in mt7996_mcu_ie_countdown()
e51abae4a28e wifi: mt76: Fix spelling mistake "dowload" -> "download"
ecc63ee35093 wifi: mt76: mt7996: Fix spelling mistake "retriving" -> "retrieving"
b1bc93f95379 wifi: mt76: fix wcid->pktid corruption in mt76_wcid_cleanup()
c4809c50393c wifi: mt76: mt7925: Remove useless condition
08dd35bb504c wifi: mt76: mt7615: read MT7663 temperature from the correct offset
b94b75e4edcf wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()
1c9854c4365a wifi: mt76: mt7615: validate MCU response lengths
6163958192b9 wifi: mt76: connac: pass the command to mt76_connac_mcu_chip_config()
2fe9842d4a5f wifi: mt76: mt7921: enable thermal protection
c7dba52baf55 wifi: mt76: mt7996: guard station-only MLO TX handling
d855630e62e2 wifi: mt76: mt792x: fix negative errno truncation in offload capability
175a9b92ff39 wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()
0f7f2f6fd028 wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
ed623597107c wifi: mt76: feed the station RSSI average from the chain signals
aa0868c8a105 wifi: mt76: mt7921: clear WM2 from MT7902 RX all_complete_mask
7adc7a8e8398 wifi: mt76: mt7925: Fix MCU command timeouts during module unload
42bd01d693c6 wifi: mt76: mt7925: add AXI DMA calibration cache for MT7928
b260b1861071 wifi: mt76: abort a scan only for a link change on the scanning radio
5a9b590919a6 wifi: mt76: mt7996: enable the SKU power limit table
490519f8fb53 wifi: mt76: mt7996: set sniffer mode on a radio that is already running
53c7bed27b21 wifi: mt76: mt7996: update the address of an AP link that is added again
bc69664723f9 wifi: mt76: mt7996: size the MLD setup TLV by the links it describes
45f8f94c7cf1 wifi: mt76: mt7996: find the last MLD link among the links torn down
39bd92a3a5d7 wifi: mt76: mt7996: upload only the keys of the link being set up
a2464b215715 wifi: mt76: mt7996: do not walk the vif keys when a link is destroyed
b0ce6b0d6143 wifi: mt76: mt7996: report station statistics from the primary link
f2d50d200941 wifi: mt76: mt7996: clear all link wcid entries in sta_pre_rcu_remove
e46d47df718d wifi: mt76: mt7996: free the WTBL index if a link allocation fails
3aa923dc58e2 wifi: mt76: mt7996: pick the secondary link from links with driver state
965aa0ec734c wifi: mt76: mt7996: make a returning link primary if a station has none
50193c8fba22 wifi: mt76: mt7996: do not reuse the deflink of a removed station link
cf73928ba1a5 wifi: mt76: mt7996: keep a returning link when adding station links fails
f06234e078fa wifi: mt76: mt7996: add the station BMC entry as new once per BSSID
df395b4054af wifi: mt76: mt7996: keep 4-address and decap state per station
f6bb3fab6315 wifi: mt76: mt7996: do not add a station link in disconnected state
6db96c229855 wifi: mt76: mt7996: record the connection state of a station
bfa293034c38 wifi: mt76: mt7996: keep the block ack session parameters per station
0ea35bbe67f7 wifi: mt76: mt7996: set up the BSS of a late station link before its peer
8fce9b01ca98 wifi: mt76: mt7996: bring up station links added after association
42f455d1c817 wifi: mt76: mt7996: set up block ack sessions on station links added later
9ff341e9c17e wifi: mt76: mt7996: restore a station link that returns after a removal
8d6bbe90bedf wifi: mt76: mt7996: fix PLE free page and AC queue register offsets
8d0f3dbd4708 wifi: mt76: mt7996: fix the hw-queues debugfs queue requests
d39a5b53249c wifi: mt76: mt7996: disable the RX NAPIs before the DMA cleanup
dbdcc627e24c wifi: mt76: mt7996: keep the airtime weight of a station for HW ATF
d5ead84240fe wifi: mt76: mt7996: refuse scan and ROC until the hardware restart is done
960c1a94baf5 wifi: mt76: report an aborted scan or ROC to mac80211 during a reset
f6dbd94a444c wifi: mt76: mt7921: fix of_node reference leaks in regd update
b68c3cb175e6 wifi: mt76: mt792x: compute the assoc RSSI from the chain signals
0f37e419a340 wifi: mt76: remove the unused signal field from struct mt76_rx_status
bd5d316e5604 wifi: mt76: mt7996: take the offchannel link of a frame from its wcid
44625d0665e7 wifi: mt76: scan all radios of a request at the same time
65dce9c22385 wifi: mt76: mt7996: scan all bands with one request
d80e427a17db wifi: mt76: keep beacons from queueing the scan work during an abort
467ae2e3f190 wifi: mt76: bypass DPD on a scan channel while a monitor is active
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The spatial reuse settings that a radio runs with were not visible at
runtime: get_status did not report them, and nl80211 does not carry
them. A radio with he_spr_sr_control=3 could not be told apart from an
unrestricted one.
get_status now adds, beside the BSS Color fields, at the top level and
in each entry of the links of an AP MLD, the running values of the
radio's configuration:
- he_spr_sr_control, he_spr_non_srg_obss_pd_max_offset,
he_spr_srg_obss_pd_min_offset and he_spr_srg_obss_pd_max_offset, as
numbers;
- he_spr_srg_bss_colors and he_spr_srg_partial_bssid, as the bitmap
value with bit n for colour or partial BSSID n (IEEE Std 802.11-2024
9.4.2.251), in 16 lowercase hex digits. The element holds the value
little-endian; a ubus integer is signed, and colour 63 is bit 63.
he_spr_srg_bss_colors=7 8 reads "0000000000000180".
Signed-off-by: Felix Fietkau <nbd@nbd.name>
When several stations match addr2 of a data frame, a failed link lookup
for one station kept every station after it from getting the frame.
Also, the link_id of an MLO station leaked to the stations after it,
which dropped the frame for a non-MLO station.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
On an EHT BSS or an AP MLD with sae, psk3, sae-mixed or psk3-mixed, the
RSNE Override 2 element carries SAE-EXT-KEY and GCMP-256 (CCMP without
phy support). An explicit sae_ext_key 1 and gcmp256 1 also put both
items into the RSNE, and the element stayed as a duplicate.
A configuration that asks for an RSNE with AKM 24 and GCMP-256 and an
RSNXE only sets sae_ext_key 1 and gcmp256 1. The Beacon then had an
RSNO2E and an RSNXOE in addition.
A duplicate RSNO2E adds nothing. A client sees both items in the RSNE,
and the RSNE meets WPA3 Specification v3.5 2.5 items 4 and 5.
Build the element only when the RSNE lacks its AKM or its pairwise
cipher. Without an RSNO2E, hostapd writes no RSNXOE either
(wpa_auth_gen_wpa_ie()). The default keeps the element as before, with
the client fixes of commits fc652db52a and 5e067465ff, and so does a
BSS with one of the two options. One exception: without phy support for
GCMP-256, the element carries SAE-EXT-KEY and CCMP, which an RSNE with
sae_ext_key 1 already offers, so that BSS sends no element. 0 still
keeps an item out of both elements. sae-compat keeps its own elements.
On an AP MLD, the decision covers all links (ap.uc mld_rsno2()): WPA3
Specification v3.5 14.2 requires an identical RSNE Override 2 element
on all links of an AP MLD that uses RSN overriding. The element goes
only where the RSNE of every link offers both items. A psk2 or
psk-mixed AP MLD has PSK in the RSNE of its 2.4 and 5 GHz links, so all
its links keep the element, also the 6 GHz link, whose RSNE has SAE. An
AP MLD of sae whose RSNE has both items on every link uses no RSN
overriding. IEEE 802.11be-2024 12.6.2 then requires the same RSNE on
every link except the AKM list and MFPR, and one common AKM. The links
share SAE and SAE-EXT-KEY, also on a 6 GHz link.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
iface_restart() aborts the pending setup of a phy before it removes the
interface, but iface_config_remove() does not. A config_set without
interfaces, the shutdown and the removal of the last link of an AP MLD
left the setup pending, and its wpa_supplicant reply later added an
interface for a configuration that no longer exists.
Abort the pending setup in iface_config_remove() as well.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
When nl80211_setup_ap() fails in wpa_driver_nl80211_if_add(), the new
i802_bss stays linked into the driver and in *drv_priv. For an AP MLD
BSS, the caller's cleanup then runs driver_nl80211_link_remove() on
that BSS, which reports EVENT_MLD_INTERFACE_FREED with a NULL context,
and hostapd crashes in hostapd_wpa_event(). A failure of
nl80211_set_mode() leaks the BSS.
198-nl80211-undo-a-failed-ap-bss-add undoes the add on both failures,
as the other error paths of the function do. Upstream hostap has the
same code.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The bss_remove hook of hostapd.uc sends a service event with a
synchronous ubus call. While libubus waits for that reply, it runs the
completion callbacks of other pending requests, among them the
wpa_supplicant phy_status or phy_set_state request of an interface
setup in progress. The callback advanced the setup to
hostapd.add_iface() nested inside the teardown that called the hook.
With an AP MLD, a config_set for radio 0 followed by one for radio 1
added the radio 0 link while the radio 1 link was half removed and
still held its driver BSS and management frame registrations. The add
failed with "Match already configured", and its cleanup crashed hostapd
in hostapd_wpa_event(). This happened on the first such reconfiguration
after a bring-up.
Run the next step of the pending setup from a uloop timer instead, and
cancel the timer where the pending request is aborted.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The links of an AP MLD share one wiphy, which runs one scan at a time.
With ACS on several links, each link scans for itself, and every link
after the first gets -EBUSY and retries every 5 seconds.
172-acs-scan-for-all-links-of-an-ap-mld-with-one-request (from John
Crispin) adds the channels of every partner link in ACS to the scan
request, and hands the survey of that scan to each link. The partner
scan check of hostapd_driver_scan() from 171 moves into
hostapd_mld_partner_scanning(). Changes to the patch as received:
- every link, the requesting one included, continues from the event
loop. The partner fallback of EVENT_SCAN_RESULTS otherwise runs the
scan callback of a partner whose next scan a link started from its
own callback, and counts that scan as completed at once;
- every link keeps its scan callback until the survey is fetched, so
that each link of the scan gets its survey on whichever link the
driver reports it;
- a link that the scan of a partner link includes waits at most
ACS_SCAN_WAIT_TIMEOUT seconds for its results and then scans for
itself, so that it does not stay in ACS for good when the results
never come, for example when the partner link is torn down during the
scan;
- acs_cleanup() drops the ACS scan callback, so that a link disabled
during its scan does not make hostapd_mld_partner_scanning() refuse
the scans of its partner links.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
setup_sta() mapped the encryption mode by the band of the radio that
rendered the network block. An MLD station on 2.4, 5 and 6 GHz radios
was set up for 6 GHz, so psk2 became sae with PMF required. The
station then skipped a WPA2-PSK BSS on 2.4 GHz.
An AP MLD maps each link by its own band: the 6 GHz link takes SAE,
and the other links keep psk2. A station has one network block for
all its links, so it must allow the AKM of each band it can join.
netifd passes mlo_bands to an MLD station as well. With 6 GHz among
other bands, psk2 now becomes sae-mixed and wpa2 becomes wpa3-mixed.
wpa_supplicant removes the PSK AKMs for a 6 GHz BSS (events.c, "WPA
PSK is not allowed on the 6 GHz band"), so the station uses SAE
there. PMF optional meets the MFPR that a 6 GHz BSS sets. With 6 GHz
bands only, the 6 GHz mapping applies as before. Other modes keep
their station behaviour on a mixed MLD.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
hostapd_switch_color_timeout_handler() sets he_bss_color_disabled
before it starts the colour change of each BSS of the radio. The
driver installs the CCA beacons, which carry BSS Color Disabled, only
for a change it starts. Where hostapd_drv_switch_color() fails, or the
settings cannot be built, for every BSS, no beacon carries the disabled
state, but the configuration keeps it: get_status reports -1 for a
colour the beacons still use, and a later beacon rebuild disables BSS
Color without a colour change.
607-ap-restore-bss-color-disabled-when-no-color-change-starts counts
the colour changes that started, and where none did, restores the
state BSS Color Disabled had before. That also resumes the ageing of
the OBSS colours, which the disabled state paused (174). The
bss-color-change notification after the loop (606) then reports the
restored state.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A subscriber that reports the BSS Color and the OBSS colours of a radio
must know when they change without a configuration change. The kernel announces a colour change that the
driver starts, aborts or completes, but hostapd takes the new colour,
or leaves BSS Color disabled, only when it handles that event. Some
changes have no event at all:
- with no free colour left, the collision timeout disables BSS Color
and picks a new colour itself;
- a collision timeout whose colour change the driver does not start
leaves BSS Color disabled;
- the OBSS colours of the radio change.
606-ap-notify-ubus-of-a-bss-color-change calls the new
hostapd_ubus_notify_bss_color():
- in the no free colour branch of the collision timeout;
- after the colour change loop of the collision timeout. This call
fires in every case, whether the driver started the change or not;
- at the end of hostapd_event_color_change(), after hostapd took the
new colour at a completion, or left BSS Color disabled at an abort;
- when the aged set of OBSS colours of the radio changes, as a colour
is added or leaves it (174), and not at each repeated collision
event.
It sends the bss-color-change notification, { ifname, bssid, link_id }
(link_id for an affiliated AP of an AP MLD), on the object of the BSS.
get_status carries the new values.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A subscriber that reports the BSS colours of a radio needs three
fields: the BSS Color subfield and the Partial BSS Color subfield that
the radio transmits, and the colours of the OBSSs that the AP
identified itself or learnt from the BSS Color Collision reports of its
stations. get_status named the
colour, as -1 while BSS Color is disabled, and neither of the others.
hostapd kept its colours in use per BSS, and each collision event
replaced them. It also added the colour of a BSS Color In Use report,
which names a colour a station uses with a peer (IEEE Std 802.11-2024
11.21.2.8), not an OBSS colour. 174-ap-keep-the-obss-colors-of-a-radio
keeps two sets per radio:
- the OBSS colours, which the kernel's collision events and the BSS
Color Collision reports of stations add to. A colour leaves the set
60 s after an event named it, or 130 s after a report did (the
longest dot11BSSColorCollisionSTAPeriod, 120 s, plus a 10 s margin),
and the ageing pauses while BSS Color is disabled;
- the colours of BSS Color In Use reports, held per station until a
report of colour 0 or until the station leaves.
A colour change picks a colour outside both sets.
get_status now adds, beside bss_color, at the top level and in each
entry of the links of an AP MLD:
- he_bss_color: the BSS Color subfield of the HE Operation element.
It keeps the colour while BSS Color is disabled
(IEEE Std 802.11-2024 26.11.4); bss_color keeps -1 then;
- bss_color_partial: he_bss_color_partial of the radio;
- bss_colors_in_use: the OBSS colours of the radio, 1 to 63. The
colours of BSS Color In Use reports are not among them.
On mt76 the kernel's collision events name the colliding colour only:
mt7996 does not detect collisions itself, and mac80211
(ieee80211_rx_check_bss_color_collision()) reports an OBSS whose colour
equals the BSS's own. Other OBSS colours reach the set only through
the BSS Color Collision reports of stations.
The colours are a list rather than the 64-bit bitmap, because a blobmsg
int64 with bit 63 set reads as a negative number in ucode and JSON.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The links of an AP MLD share one ubus object, and get_status describes
the BSS of one link (mld->fbss, or the first link that joined the
object). Each affiliated AP runs on its own radio, with its own
hostapd_iface and so its own channel and BSS Color. A subscriber could
read the BSS Color of one radio of an AP MLD only, not the BSS Color
that each radio transmits.
For an AP MLD, get_status now adds links [{ link_id, bssid, freq,
bss_color }], one entry per link that joined the object: the link ID,
the BSSID of the affiliated AP, its frequency, and its BSS Color with
the meaning of the top-level field (-1 while BSS Color is disabled).
The top-level fields are unchanged. A BSS that is not affiliated with
an AP MLD gets no new field.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The links of an AP MLD share one ubus object, and the ifname of the
key-mismatch event is the MLD netdev. A subscriber could only take the
BSSID of get_status, the BSSID of the first BSS of the MLD, whichever
link the station used. A subscriber that reports a failed connection
needs the BSSID of the BSS that the station tried to connect to, so it
named the wrong BSS for an attempt on another link.
hostapd_ubus_notify_key_mismatch() now adds:
- bssid: own_addr of the hostapd_data that handles the failure, the
BSSID of the link for an affiliated AP, as it is: the link of the
SAE Authentication frame, or the association link for the 4-way
handshake;
- link_id: the link ID of that affiliated AP, for an AP MLD only.
The 4-way PSK failure of hostapd_wpa_auth_psk_failure_report() (an
invalid MIC in EAPOL message 2) now goes through the same function, so
its event carries the two fields too. It carries no rsn_error:
HOSTAPD_UBUS_RSN_ERROR_NONE (0, a reserved value) leaves the field out.
RSN Error 3 (EAPOL message 2) belongs to a separate patch that changes
the psk_failure_report callback to pass the EAPOL-Key frame. Until that
patch lands, the event of a PSK mismatch on an RSNA BSS carries no
rsn_error. The SAE Confirm event does not change otherwise.
The two lines the call takes in 600 move the wpa_auth_glue.c hunks of
601 and 730 by one; refresh them so that the series applies without
offsets.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
iface_wpa_stations() wrote the wifi-station PSKs to
/var/run/hostapd-<ifname>.psk and named that file only where the user
had not set wpa_psk_file. With a user's file, hostapd read that file
alone, and the wifi-station PSKs never reached it, as it was for SAE
before the commit "wifi-scripts: wifi-station SAE passwords with a
user's file".
hostapd keeps one wpa_psk_file: config_file.c replaces the path at each
wpa_psk_file line, and hostapd_config_read_wpa_psk() reads lines of
"[keyid=..] [wps=..] [vlanid=..] <MAC> <PSK or passphrase>", skips
empty lines and lines that start with '#', and fails the setup of the
BSS when the file is missing. A second wpa_psk_file line is therefore
no option, and the user's lines are copied into the generated file.
Move the copy that iface_sae_stations() does into station_file_write()
and use it for both files: it writes the user's lines, then the
wifi-station lines, and names the generated file; a user's file that
cannot be read stays named, so hostapd reports it as before.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
iface_sae_stations() wrote the wifi-station SAE passwords to
/var/run/hostapd-<ifname>.sae and named that file only where the user
had not set sae_password_file. With a user's file, hostapd read that
file alone, and the wifi-station passwords never reached it.
hostapd's parse_sae_password_file() adds each line of the file to the
SAE password list, and each sae_password_file line reads one more file,
so two lines would work for hostapd. The hostapd service keeps one hash
per file option (file_fields in hostapd.uc), though, and a second line
would replace the hash of the first, so a change in one of the files
could go unnoticed. Copy the lines of the user's file into the generated
file instead, before the wifi-station entries, and always name the
generated file. Where the user's file cannot be read, keep naming it, so
hostapd reports it as before.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
key_kind() took every key of 64 characters as a raw PSK, and ap.uc wrote
it as wpa_psk, or as multi_ap_backhaul_wpa_psk for the Multi-AP backhaul
key. hostapd's config_file.c reads both with hexstr2bin() and counts a
key that is not 64 hex digits as an error ("Invalid PSK"), so it
rejected the configuration of the whole radio, and every BSS on it
stayed down.
Take a key of 64 characters as a raw PSK only where all of them are hex
digits, upper or lower case, and as invalid otherwise. bss_refusal()
then refuses that BSS with INVALID_WPA_PSK, for the BSS key and for the
backhaul key alike, and the other BSSes of the radio come up. A psk BSS
without a key stays as it is: outside 6 GHz, wpa_psk_file gives its
per-station PSKs.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Each radio renders its own link of an AP MLD, and bss_refusal() looked
at that link only. Some refusals depend on the band: a 6 GHz link of a
transition mode is SAE only, and WPS with its backhaul key runs outside
6 GHz only. With a raw PSK, the 6 GHz link of a sae-mixed AP MLD was
refused while its 2.4 and 5 GHz links came up, and a Multi-AP backhaul
key that is no key refused the 2.4 and 5 GHz links but not 6 GHz.
All links run one configuration. For an AP MLD, mld_refusal() maps and
parses the configuration of each band in mlo_bands, in its order, and
returns the first refusal.
The RSNE Override 2 element of a psk2 AP MLD, and so MLD_SAE_NO_PASSWORD,
followed the htmode of the radio that renders the link. A link on an HE
radio was written while the EHT links were refused. hostapd refuses
mld_ap without IEEE 802.11be ("Cannot enable mld_ap when IEEE 802.11be
is disabled"), so parse_encryption() now treats an AP MLD as EHT for
that element. Every link gets the same result, so either the AP MLD is
refused on every link with the same reason, or on none.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
parse_bool() compared its argument with the strings "1", "true", "0"
and "false" only. A service-injected wireless config arrives as JSON, so
a value of true, false, 1 or 0 gave null. wireless.uc then read
"mlo": true of such a wifi-iface as no MLO, and parse_attribute_list()
dropped every boolean attribute that came as JSON.
Accept true and 1 as true, and false and 0 as false. The result for the
UCI strings stays the same.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Commit adb1fce19b ("wifi-scripts: set rsn_overriding for client mode
interfaces") made setup_sta() write rsn_overriding=1 for a station with
rsn_override set and an HE or EHT htmode. The wifi-iface schema did not
declare rsn_override, so netifd dropped the option before the handler
ran, and that branch could not be reached.
Declare it as a boolean without a default.
Fixes: adb1fce19b ("wifi-scripts: set rsn_overriding for client mode interfaces")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
WPA3 Specification v3.5 2.5 item 10: "A STA that enables EHT or MLO
shall, in its Network Profile, allow GCMP-256 to be selected as a
pairwise cipher." setup_sta() wrote pairwise=CCMP for every RSN mode,
because parse_encryption() got no phy features in station mode.
Read the GCMP-256 support of the phy in supplicant.generate() for an
EHT htmode, and write pairwise=CCMP GCMP-256 for an RSN station when
the phy supports GCMP-256. An explicit cipher or gcmp256 0 is kept.
The GCMP-256 test moves to iface.phy_cipher_gcmp256(), which
hostapd.uc uses as well.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
An AP MLD with wpa or wpa-mixed and no 6 GHz link enabled WPA version
1, which has no RSNE, so a multi-link association had no RSN parameters
to use. With a 6 GHz link these modes already became wpa2.
Render wpa and wpa-mixed as wpa2 on every AP MLD, as psk and psk-mixed
become psk2.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
An AP MLD with psk, psk2 or psk-mixed advertised PSK alone. A
multi-link association then used PSK. On an AP MLD with a 6 GHz link,
where the 6 GHz link uses SAE, the links had no AKM in common.
For every AP MLD, keep PSK in the RSNE of the 2.4 and 5 GHz links for
single-link stations, and offer SAE with MFP required in the RSNE
Override 2 element of every link. A multi-link association with RSN
overriding uses that element (WPA3 Specification v3.5 14.2), so it
always uses SAE, and all links share it. The 6 GHz link keeps SAE in
its RSNE. psk and psk-mixed become psk2, because an AP MLD needs RSN
on every link and WPA3 Specification v3.5 2.5 item 1 forbids WPA
version 1 beside WPA3-Personal.
The element carries the SAE-EXT-KEY AKM, which IEEE 802.11be-2024
12.12.9 requires for SAE between EHT stations, with GCMP-256 (CCMP
without phy support), as for the WPA3-Personal modes on EHT. psk2 on
an AP MLD now sets up SAE:
- the password file, sae_pwe, sae_groups and sae_require_mfp;
- okc on by default, as for the SAE and OWE auth types, so that its
SAE stations get PMKSA caching;
- with ieee80211r, FT-SAE-EXT-KEY in the element. hostapd's local FT
response covers FT-PSK only ("Whether to generate FT response locally
for PSK networks", hostapd.conf), so ft_psk_generate_local stays off,
the r0kh and r1kh key holders are written, and bss_refusal() requires
a key to derive them from.
A key of 64 hex digits is a raw PSK, which SAE cannot use. Without
another SAE password, every SAE authentication would end in "SAE: No
password available", so bss_refusal() refuses such a BSS with
MLD_SAE_NO_PASSWORD, as an SAE-only BSS without a password is refused.
The BSS is left out of the radio, and netifd shows the reason as the
`error` of the interface. The same sources give SAE a password as
there: a passphrase, PPSK, a wifi-station password, a
sae_password_file option, or a sae_password or sae_password_file line
in hostapd_bss_options.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
André Valentin
Julius Bairaktaris
Daniel Golle
Ivan Romanov
Gary Dotzler
Yanase Yuki
Shiji Yang
Nick Hainke
Fil Dunsky
Rosen PenevandClaude Opus 5.5
Paul Spooren
Felix Fietkau
John Crispin