When radius_request_cui=1 is configured, the EAP path includes a
Chargeable-User-Identity attribute (RFC 4372) but the ACL path used
by psk2-radius / mpsk-radius does not. Add a nul CUI to
hostapd_radius_acl_query() so the RADIUS server is solicited for CUI
in Access-Accept, matching the EAP initial-request behaviour.
Signed-off-by: John Crispin <john@phrozen.org>
- Wire hostname validation enable / disable to hostname_validate
flag in gateway.json
- Fix hostname validation check when server cert Subject CN has
other attributes like Organization in case of Insta
server certs: subject=CN=*.example.com, O=ExampleInc.
Fix backported to libwebsockets from:
5124ffe9d4
Fixes WIFI-15384
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
Move edgecore,eap111 to the correct switch group in 02_network
and adjust the WAP588M patch context to match.
Signed-off-by: John Crispin <john@phrozen.org>
The standard iwinfo added he_chan_info, eht_chan_info and eht_chan_width
which rpcd uses unconditionally. The qca-wifi-7 iwinfo lacks these,
breaking the rpcd build.
Add IWINFO_HAS_EHT_CHAN_INFO to the standard iwinfo header and guard
the HE/EHT scan result blocks in rpcd behind it.
Signed-off-by: John Crispin <john@phrozen.org>
The QCA wifi-7 nl80211.h is missing NL80211_ATTR_MLO_TTLM_DLINK and
NL80211_ATTR_MLO_TTLM_ULINK. Add stub defines mapping them to
NL80211_ATTR_NOT_IMPLEMENTED to fix the build.
Signed-off-by: John Crispin <john@phrozen.org>
On some devices mem.buffered is 0 which evaluates as falsy, causing
the status page to render a "?" instead of a progress bar. Skip the
row entirely when buffered is 0 or absent.
Fixes: WIFI-15328
Signed-off-by: John Crispin <john@phrozen.org>
Vendor hostapd builds such as qca-wifi-6 do not support the
rsn_override_key_mgmt, rsn_override_pairwise and rsn_override_mfp
configuration items. When rsn_override defaults to 1, these items
are emitted for wpa3 and wpa3-mixed encryption types causing hostapd
to reject the entire configuration.
Change the default to 0 making RSN Override opt-in, and gate the
emission of rsn_override_* lines on rsn_override being enabled.
Signed-off-by: John Crispin <john@phrozen.org>
Remove logger calls that were left in from development. The FDB
entries are observable via 'bridge fdb show' and do not need runtime
logging in production.
Signed-off-by: John Crispin <john@phrozen.org>
ntohs() on a right-shifted __be32 produces garbage because the shift
operates on the network-order representation. Use ntohl() first to
convert to host order, then extract the 16-bit halves.
Signed-off-by: John Crispin <john@phrozen.org>
When strict forwarding is enabled, DHCP packets fail to forward
because the bridge lacks static FDB entries for client MACs in the
correct VLAN. Add per-station static FDB entries tagged with the
bridge PVID on sta-authorized and remove them on disconnect.
Signed-off-by: John Crispin <john@phrozen.org>
The checksum code mixes host and network byte order inconsistently,
producing corrupt UDP checksums. Switch to consistently working in
host byte order using ntohs() on each word before summing, and
htons() on the final result.
Signed-off-by: John Crispin <john@phrozen.org>
apk rejects version strings containing alphabetic suffixes. Drop the
csu1 qualifier from PKG_VERSION as it is not needed for the local
source build.
Signed-off-by: John Crispin <john@phrozen.org>
When processing huge console log and dmesg files printing lines
hanged execution blocking ucentral-state startup process.
It seems stdout is mainly for debug purposes and lines are
printed after we store file, so it is safe to disable print
as file is already processed and can be examined.
Fixes: WIFI-15356
Signed-off-by: Mateusz Bajorski <mbajorski@shasta.cloud>
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Remove mac80211.sh and 10-wifi-detect installs from kmod-cfg80211 since
these files are now provided by the standard wifi-scripts package.
Add #mlo pseudo-device early returns to drv_mac80211_setup() and
drv_mac80211_teardown() to prevent errors on MLO pseudo-devices.
Signed-off-by: John Crispin <john@phrozen.org>
Replace the QCA-specific hostapd.uc and wpa_supplicant.uc with copies
of the standard OpenWrt versions, adding try/catch guards around
udebug_set() calls that the older 2021 QCA hostapd binary does not
expose.
Remove common.uc, wdev.uc, hostapd.sh, and wps hotplug installs from
hostapd-common since these are now provided by the standard wifi-scripts
package.
Add ucode-mod-rtnl and libudebug to CORE_DEPENDS as required by the
standard ucode scripts.
Signed-off-by: John Crispin <john@phrozen.org>
Drop the QCA wifi-6 wifi-scripts override so the standard OpenWrt
wifi-scripts package takes over, providing common.uc, wdev.uc,
hostapd.sh, netifd-wireless.sh, sbin/wifi, and mac80211.sh.
The QCA-specific psk2-radius and osen encryption features are ported
to the standard netifd-wireless.sh separately.
Signed-off-by: John Crispin <john@phrozen.org>
Remove #ifdef IW_FULL guards from ntype_11u() and print_osen_ie()
definitions added by 501-compilation-fix.patch. Their callers
print_interworking() and print_wifi_osen() are not guarded, causing
implicit function declaration errors in the tiny (non-IW_FULL) build.
Signed-off-by: John Crispin <john@phrozen.org>
Fix incompatible pointer type in wispr patch: pass sta->bandwidth
(array decays to u32 *) instead of &sta->bandwidth (u32 (*)[2]) to
radius_msg_get_wispr().
Remove stray debug syslog() call in ubus.c.
Signed-off-by: John Crispin <john@phrozen.org>
OpenWrt 25.12 uses apk which has stricter version validation than opkg.
Replace raw git commit hashes used as PKG_VERSION with proper numeric
versions in qca-ssdk-qca, qca-ssdk-shell, qca-nss-dp-qca, qca-nss-ppe,
qca-nss-ppe-ds, qca-nss-ppe-vp and wlan-telemetry. The git hashes are
moved to PKG_SOURCE_VERSION where they belong.
Fix mac80211 version from 6.5-rc3 (invalid due to the -rc suffix) to
6.5.0.3 using PKG_SOURCE_DATE to preserve the source tarball naming.
Uncomment PKG_RELEASE in hostapd and remove EXTRA_DEPENDS with opkg
version pinning syntax that apk rejects.
Signed-off-by: John Crispin <john@phrozen.org>
Add PKG_CONFIG_DEPENDS for QCA WiFi target configs to ensure the ucode
package gets rebuilt when switching between targets.
Signed-off-by: John Crispin <john@phrozen.org>
d322773 package: replace system() with fork/execvp to prevent shell injection
d47d3fd package: migrate from opkg/ipk to apk for OpenWrt 25.12
Signed-off-by: John Crispin <john@phrozen.org>
Backport three upstream fixes for the shell-based mac80211.sh:
- Capabilities grep (adf958c919): grep 'Capabilities:' also matches
HE/EHT capability lines, causing arithmetic overflow and wrong HT
caps. Fix by anchoring the match with grep -E '^\s*Capabilities:'.
- he_spr_psr_enabled (b74318481b): mac80211_add_he_capabilities writes
he_spr_psr_enabled=1 directly into hostapd.conf, but hostapd does not
recognise it as a config directive and fails to start. Remove it from
the capabilities call and check the HW PHY capability register
directly instead.
- iw_htmode (86eb1c0b5a): VHT160 incorrectly falls into the HT40 case,
HE160 has no mapping at all, and 80MHz has wrong casing (80MHZ). Add
proper VHT160/HE160 case and fix casing. For qca-wifi-7, also add the
missing EHT20/EHT40/EHT80/EHT160 mappings.
Signed-off-by: John Crispin <john@phrozen.org>
Netifd in 25.12 delegates wireless management to ucode. The
network.wireless ubus object is now published by wireless.uc,
loaded by netifd's main.uc at startup. Without it, all wifi
ubus calls fail with "Not found".
Install wireless.uc, wireless-device.uc and wifi/utils.uc from
the upstream wifi-scripts package rather than keeping duplicates.
Signed-off-by: John Crispin <john@phrozen.org>
Replace deprecated AUTORELEASE with static release number in
batman-adv and hostapd Makefiles. Add missing kernel config option.
Signed-off-by: John Crispin <john@phrozen.org>
Drop the host_dependencies clang/llvm build logic from qosify and
remove the hostapd include from yuncore_ax820.
Signed-off-by: John Crispin <john@phrozen.org>
apk requires proper version strings. Move git hashes and long version
identifiers to PKG_SOURCE_VERSION/PKG_SOURCE_DATE and set PKG_VERSION
to a conformant version number.
Signed-off-by: John Crispin <john@phrozen.org>
OpenWrt 25.12 uses apk which rejects the git-prefixed version format.
Align with upstream luci.mk version format.
Signed-off-by: John Crispin <john@phrozen.org>
Add the full patch series for OpenWrt 25.12 (0001-0093) covering
base-files, hostapd, netifd, kernel, and target customisations.
Update config.yml accordingly.
Signed-off-by: John Crispin <john@phrozen.org>
These boards need to be migrated to the upstream OpenWrt target
before they can be re-enabled.
Affected boards:
- sonicfi_rap630w-211g
- sonicfi_rap63xc-211g
- edgecore_eap112
- senao_iap4300m
- senao_iap2300m
- senao_jeap6500
- emplus_wap588m
Signed-off-by: John Crispin <john@phrozen.org>
Replace variable-length arrays in lsm303agr_acc_i2c_write() and
lsm303agr_mag_i2c_write() with fixed-size buffers to resolve
-Wvla warnings. Add bounds checking to prevent buffer overflows.
Signed-off-by: John Crispin <john@phrozen.org>
Remove kmod-usb-uas, kmod-fs-msdos and kmod-fs-ntfs from the device
packages as their dependency on kmod-scsi-core requires CONFIG_SCSI
which is not enabled in the kernel config.
Signed-off-by: John Crispin <john@phrozen.org>
The options field holds raw byte values (0-255) but was declared as
signed char, making the end-of-options marker comparison (== 255)
always false on architectures where char is signed. This broke DHCP
option parsing and triggered -Werror=type-limits on MIPS builds.
Signed-off-by: John Crispin <john@phrozen.org>
Remove obsolete mediatek-sdk build tree integration patches (0067, 0069)
and replace with a cleaner approach using a firewall3 default packages
variant. This simplifies the MediaTek SDK integration for OpenWrt 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
The MediaTek SDK uses kernel 5.4.271 which requires adjustments to
the crypto module packaging:
1. The gf128mul module location changed between kernel versions:
- Kernels < 6.2: crypto/gf128mul.ko
- Kernels >= 6.2: lib/crypto/gf128mul.ko
Add version-specific file paths to handle both locations.
2. The sha512-arm64 module doesn't exist in older ARM64 kernels like 5.4,
causing package build failures. Exclude this module for the mt7981
target which uses the older MediaTek SDK kernel.
These changes allow the kernel modules to build correctly whilst
maintaining compatibility with newer kernel versions.
Signed-off-by: John Crispin <john@phrozen.org>
Add kernel version and hash for MediaTek target using Linux 5.4.271
from the MediaTek SDK external feed.
Signed-off-by: John Crispin <john@phrozen.org>
Adds a turnoff command to the LED script for disabling LEDs via the led command.
Renumbered from patches/0014.
Signed-off-by: John Crispin <john@phrozen.org>
Adds support for DHCP option 138 (CAPWAP AC) and option 224 (private/site-specific) in netifd and busybox udhcpc.
Renumbered from patches/0101.
Signed-off-by: John Crispin <john@phrozen.org>
Consolidates all TIP-specific hostapd patches into a single patch including drop script, TIP extensions, shell scripts, global_ban support, builtin patches sync, and radar notification fixes.
Consolidated from patches 0020-0025.
Signed-off-by: John Crispin <john@phrozen.org>
Adds sync after uci-defaults execution to ensure changes are written to disk.
Renumbered from patches/0096.
Signed-off-by: John Crispin <john@phrozen.org>
Calls modemmanager script to set up Quectel LTE modems for WWAN connectivity.
Renumbered from patches/0093.
Signed-off-by: John Crispin <john@phrozen.org>
Adds UBI force detach patch for IPQ807x to handle problematic UBI volumes.
Renumbered from patches/0071.
Signed-off-by: John Crispin <john@phrozen.org>
Adds lib/nl80211 support for QCA WiFi 6/7 nl80211 operations in ucode.
Renumbered and updated from patches/0081.
Signed-off-by: John Crispin <john@phrozen.org>
Prevents using pool NTP servers if DHCP-provided NTP servers are available.
Renumbered from patches/0079.
Signed-off-by: John Crispin <john@phrozen.org>
Checks for EST (Enrollment over Secure Transport) support if the certificate was issued via EST.
Renumbered from patches/0091.
Signed-off-by: John Crispin <john@phrozen.org>
Reverts upstream WiFi interface/device renaming changes from <phy>-<type><index> back to traditional wlan<N> naming to maintain compatibility with existing configurations.
Renumbered from patches/0026. In 24.10 the script moved from mac80211 package to wifi-scripts package.
Signed-off-by: John Crispin <john@phrozen.org>
Increases rootfs size to 500M for targets requiring larger firmware images.
Renumbered and generalised from patches/0085.
Signed-off-by: John Crispin <john@phrozen.org>
Only reloads swconfig if configuration actually changed, avoiding unnecessary switch resets.
Renumbered from patches/0033.
Signed-off-by: John Crispin <john@phrozen.org>
Adds GCMP-256 as a cipher suite when SAE is enabled, particularly for 6GHz operation.
Renumbered from patches/0090.
Signed-off-by: John Crispin <john@phrozen.org>
Uses CLOCK_BOOTTIME instead of CLOCK_MONOTONIC for better suspend/resume handling.
Renumbered from patches/0042.
Signed-off-by: John Crispin <john@phrozen.org>
Reduces SPI clock speed to 20MHz for yuncore ax820 to fix stability issues.
Renumbered from patches/0050.
Signed-off-by: John Crispin <john@phrozen.org>
Adds AFC (Automated Frequency Coordination) related fields to ubus GPS info command.
Renumbered from patches/0076.
Signed-off-by: John Crispin <john@phrozen.org>
Fixes issue where DHCP client would sometimes send supersede requests incorrectly.
Renumbered from patches/0087.
Signed-off-by: John Crispin <john@phrozen.org>
Removes nand.sh from base-files as NAND handling is now done by the sysupgrade framework.
Renumbered and generalised from patches/0065.
Signed-off-by: John Crispin <john@phrozen.org>
Adds helper function to set wireless MAC address base in board configuration.
Renumbered from patches/0083.
Signed-off-by: John Crispin <john@phrozen.org>
Prevents automatic generation of default network interfaces on first boot, allowing full uCentral control.
Renumbered from patches/0082.
Signed-off-by: John Crispin <john@phrozen.org>
Adds wlan-ucentral-schema revision hash to /etc/openwrt_release for version tracking.
Renumbered from patches/0087.
Signed-off-by: John Crispin <john@phrozen.org>
Adds support for CI_FWSETENV environment variable for firmware environment manipulation.
Renumbered from patches/0018.
Signed-off-by: John Crispin <john@phrozen.org>
Makes sysupgrade default to not preserving configuration unless explicitly requested with -f flag.
Renumbered from patches/0013.
Signed-off-by: John Crispin <john@phrozen.org>
Adds the wlan-ap repository hash to /etc/openwrt_release for version tracking.
Renumbered from patches/0012.
Signed-off-by: John Crispin <john@phrozen.org>
Forces users to log in on the serial console for security, removing automatic root access.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Removes --no-interrupt-parent flag when using older device tree compilers that don't support this option.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Adds kernel 6.1 hash to build system for QSDK-based targets using this kernel version.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Adds kernel 5.4 hash to build system, enabling legacy kernel support for older targets.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Always builds kernel 6.6 headers even for older kernels, ensuring compatibility for packages requiring newer kernel APIs.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Fixes GENERIC_PLATFORM_DIR handling for external targets to prevent build system conflicts.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Introduces default location for external target directories, allowing custom targets to be maintained outside the main tree.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Adds build system support for Qualcomm SDK kernels, enabling builds with vendor-specific kernel versions.
New patch for 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Replaces libustream-mbedtls with libustream-openssl throughout the tree for consistency with TIP infrastructure.
Renumbered from patches/0007.
Signed-off-by: John Crispin <john@phrozen.org>
Integrates uCentral state management into OpenWrt's base system, allowing device configuration and monitoring through the uCentral framework.
Renumbered from patches/0019.
Signed-off-by: John Crispin <john@phrozen.org>
This script sets up the OpenWrt build tree based on profile definitions in profiles/.
Carried forward from patches/0001.
Signed-off-by: John Crispin <john@phrozen.org>
Remove busybox udhcpc endless loop fix as this issue no longer exists in the busybox version included in OpenWrt 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Remove mac80211 hostapd dependency, iwinfo 6E support, wireguard-tools kernel module selection, generic pstore, feed.conf, and download.mk git patches as these are no longer needed in OpenWrt 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Remove ipq807x, ipq50xx, and udaya-id5 uboot-envtools patches as this logic has been moved to the target feeds.
Signed-off-by: John Crispin <john@phrozen.org>
Remove version bump patches for netifd, libubox, umdns, ustream-ssl, uclient, ugps, dropbear, and ubus as package versions are already updated in 24.10.
Signed-off-by: John Crispin <john@phrozen.org>
Update subtarget from mt7981 to filogic and simplify profile by removing mediatek feed and redundant configuration options.
Signed-off-by: John Crispin <john@phrozen.org>
Fix EXTRA_DEPENDS to use correct version format with 'r' prefix
(e.g., 2023.09.08~e5ccbfc6-r4 instead of 2023.09.08~e5ccbfc6-4)
to match OpenWrt 24.10's package versioning scheme. This resolves
the dependency resolution failure where wpad-openssl couldn't find
the matching hostapd-common version.
Signed-off-by: John Crispin <john@phrozen.org>
Fix enum type mismatch issues that cause compilation errors with GCC 13.
The patch corrects function signatures to use proper enum types instead
of generic integer types where appropriate.
Signed-off-by: John Crispin <john@phrozen.org>
Fix kconf Makefile to explicitly use gcc for host tools instead of
allowing the cross compiler to leak in. This ensures the build tools
are compiled with the host toolchain rather than the target toolchain.
Signed-off-by: John Crispin <john@phrozen.org>
OpenWrt 24.10 changed the expected directory structure for kernel
patches in feeds. Patches that were previously in feeds/<feed>/mediatek/
now need to be in feeds/<feed>/linux/generic/ to align with the new
feed structure.
This commit moves all kernel backport and configuration files from
feeds/mediatek-sdk/mediatek/ to feeds/mediatek-sdk/linux/generic/
to comply with the new layout requirements.
Signed-off-by: John Crispin <john@phrozen.org>
34379aa cleanup: remove unused MDNS service schema (no-op service)
26ae111 cleanup: remove unused HTTP service template and schema
f080ab3 cleanup: remove unused rtty service template and schema
c0c1d97 cleanup: remove unused files
e142706 fix: restore missing admin_ui variable assignment and validation
25582fa fix: restore correct file path in quality_of_service.uc
b3da9da base/interface-ssid: fix certificates variable scoping for validation
41ae448 base/interface: comprehensive refactoring to new templating pattern
3ec4415 base/switch: refactor to new templating pattern
a4a6f08 base/spotfilter: refactor to new templating pattern
5cd9b66 base/interface-firewall: comprehensive refactoring to new templating pattern
0910040 base/interface-ssid: comprehensive refactoring to new templating pattern
1f7a122 base/interface-mesh: update to new templating pattern
146068d base/interface-ieee8021x: update to new templating pattern
c272931 base/interface-bridge-vlan: update to new templating pattern
ffd4c2c base/interface-captive: update to new templating pattern
696648b base/interface-ipv6: update to new templating pattern
7034597 base/interface-ipv4: update to new templating pattern
3ca71c1 base/interface-dhcp: update to new templating pattern
5626faa base/interface-common: update to new templating pattern
4d030b5 tests: remove example files and fix wpa2-radius.json comment issue
728a10b renderer: add shell.system() method and update captive template
b5ff4fd tests: remove vxlan and gre tests and improve failure reporting
097351f tests: standardize unit test inputs with minimal valid schema pattern
c2bd383 renderer: add math import and remove local requires for deterministic testing
5cc3039 tests: add deterministic math mock and fix copy-to-expected functionality
a0c03a2 tests: add getopt-style CLI and rename to clean executable
a5f15cc tests: improve debug output structure for integration tests
51375e6 tests: add silent debug output for integration tests
ff81174 tests: simplify directory structure by renaming integration/full to full
1ac83ce tests: consolidate duplicate filesystem imports
a50e8d1 tests: remove unnecessary global mock variable assignments
ce32b74 tests: standardize context creation pattern to eliminate mutation anti-patterns
ffb830b tests: add generic single test runner and shared process execution utilities
a79f8a5 tests: create generic single test runner and remove redundant code
4c5bda4 tests: create generic single test runner for both unit and integration tests
404e9ae tests: move integration/base tests to unit/base for proper override support
1018c6f tests: update integration test expected outputs for eap101 board
0f1bd51 tests: fix error handling to preserve stacktrace display for exceptions
49d94f4 tests: consolidate test framework execution and eliminate remaining duplication
91e71b6 tests: consolidate context creation and eliminate duplication patterns
6df4283 tests: consolidate helper utilities and eliminate code duplication
038a514 renderer: extract captive object to shared library and fix integration test mocking
2ae2590 renderer: extract routing_table object to shared library and fix mock files state
2b1bcfb tests: implement process isolation for integration tests to prevent file descriptor leaks
47b67e4 tests: add comprehensive integration testing for all example configurations
cd19590 tests: implement dynamic service discovery and fix MPSK mock
e16284a tests: implement dynamic board-specific wiphy and wifi device loading
5317dd2 tests: integrate wiphy library with real board wiphy data
901f177 renderer: extract wiphy object to shared library
8187b56 tests: use real board configuration files in mock filesystem
39470a0 tests: consolidate code between real and mock renderer
17448da tests: improve error reporting in test framework
a0d463e tests: extract UCI helpers to shared library and update test outputs
3f2f3e3 renderer: minor fixes found while testing on real HW
383bf8e renderer: extract ethernet object to shared library
84cd3db schema: generate updated files
4b426c8 tests: fix integration test framework missing functions
5adba79 tests: implement full configuration integration test framework
dcf2ef8 tests: enhance board test context with dynamic wiphy mock
7a17791 tests: enhance test runner reporting for unit vs integration tests
21fb3c6 base/base: update to new templating pattern
b96def9 tests: implement board-specific integration test framework
4b78b03 renderer: move board.json loading to global scope
81041b3 renderer/templates: remove redundant fs require calls
3231152 renderer/templates/base: remove redundant fs import
bc961e0 base/ethernet: update to new templating pattern
8afa7ae renderer/templates: merge poe.uc into ethernet.uc
62eaa5e tests: add ethernet base template test cases (Step 1)
7e1d756 renderer/templates/ethernet: fix missing boolean wrappers
c82a7a9 schema: validate timeouts field descriptions
f5f6c43 base/timeout: update to new templating pattern
ae504fa tests: add timeout base template test cases (Step 1)
02f6fa9 renderer/templates/timeout: fix syntax error with extra closing tag
0748776 schema: validate unit field descriptions
355ad67 base/unit: update to new templating pattern
ec1b712 renderer/templates/unit: refactor to use helper functions (Step 2)
f3dcc79 tests: add unit base template test cases (Step 1)
12fc839 tests: add mock shell object for password management functions
2ae69f4 docs: update TESTING.md to reflect new test framework architecture
8e1eb31 tests: add support for base template testing infrastructure
0173636 schema: validate admin_ui field descriptions
49fb411 services/admin_ui: update to new templating pattern
b6b298a tests: add admin_ui test cases
b3bcd80 tests: refactor test runner to import-based architecture with individual test counts
0906e81 tests: consolidate test framework and eliminate code duplication
437df91 schema: validate wifi_scan metrics field descriptions
7f83f39 metrics/wifi_scan: update to new templating pattern
9cdc01c tests: add wifi_scan metrics test cases
b5964e5 schema: validate wifi_frames metrics field descriptions
dc96fdf metrics/wifi_frames: update to new templating pattern
8530e1e tests: add wifi_frames metrics test cases
a96f4d8 schema: validate telemetry metrics field descriptions
050ac26 metrics/telemetry: update to new templating pattern
ee43cdb tests: add telemetry metrics test cases
5a5721d schema: validate statistics metrics field descriptions
66ecd0d metrics/statistics: update to new templating pattern
eab7543 tests: add statistics metrics test cases
107a562 schema: enhance realtime metrics documentation
6fe7857 metric/realtime: refactor to new templating patterns
7c5775d tests: add realtime metrics template test cases
ee67163 schema: regenerate the files
3d4da1f schema: validate health metrics field descriptions
7c13c52 metrics/health: update to new templating pattern
d1f2169 tests: add health metric test cases
90f6e60 tests: fix mock renderer to extract metrics variables
4ea8eec schema: validate dhcp_snooping metrics field descriptions
1b3fb93 metrics/dhcp_snooping: update to new templating pattern
ce1582c tests: add dhcp_snooping metric test cases
5bbe42e docs: extend REFACTOR.md to cover metric templates
0994c85 schema: validate rrm field descriptions
00b0079 services/rrm: update to new templating pattern
0f7fa1c tests: add rrm test cases
c7b7130 services/radius_proxy: enhance schema documentation
237c0b3 services/radius_proxy: update to new templating pattern
6185a5a tests: add radius_proxy test cases
569d14a services/radius_gw_proxy: update to new templating pattern
2893469 schema: validate quality_of_service field descriptions
4535634 services/quality_of_service: update to new templating pattern
435744e tests: add quality_of_service test cases
c6c89b5 tests: enhance mock-renderer with QoS JSON support
bd054a5 schema: enhance online-check service documentation
b83b9ac services/online_check: refactor to new templating pattern
59c4a07 tests: add online_check test cases
8abc697 schema: validate gps field descriptions
ed33d61 services/gps: update to new templating pattern
59dca34 tests: add gps test cases
2c6b87f schema: validate fingerprint field descriptions
8d58237 services/fingerprint: update to new templating pattern
5f8be0c tests: add fingerprint test cases
5f1dcff services/dhcp_snooping: update to new templating pattern
e6cfd5f tests: add dhcp_snooping test cases
acf3763 tests: enhance mock-renderer with lookup_by_interface_vlan function
9313004 schema: validate airtime_fairness field descriptions
9a483c9 services/airtime_fairness: update to new templating pattern
bcd446f tests: add airtime_fairness test cases
157f7cf captive: enhance schema documentation and examples
d0388e7 services/captive: update to new templating pattern
1c8c736 tests: add captive test cases
db3d220 tests: enhance mock-renderer with SSID-based interface lookup
5799615 schema: validate dhcp_relay field descriptions
f58a2b3 services/dhcp_relay: update to new templating pattern
21f1d72 tests: add dhcp_relay test cases
0c96e96 schema: validate dhcp_inject field descriptions
670c57f services/dhcp_inject: update to new templating pattern
d7895a2 tests: add dhcp_inject test cases
9925450 tests: enhance mock-renderer with SSID and ethernet port lookups
4adc799 docs: update REFACTOR.md with NTP service example
79a9dcc services/ntp: update to new templating pattern
1f3c2ea tests: add ntp test cases
dc99ee6 schema: validate mdns field descriptions
56cede4 services/mdns: update to new templating pattern
3f86a6d tests: add mdns test cases
2aef7f6 docs: add refactoring guidelines
b42e3cd services/ssh: update to new templating pattern
37ca498 tests: add ssh test cases
c005ec3 tests: add proper mockup service for the files module
962a961 services/ieee8021x: update to new templating pattern
2a6a151 tests: add ieee8021x test cases
faaa0ba services/lldp: update to new templating pattern
b9fdbb0 services/log: update to new templating pattern
f9dbf48 tests: add unit test harness
8851342 add new template guidelines and helper functions
5e88dcb .gitignore: update docs/ filtering
3c822a5 ipcalc: split the implementation out into a library
f7f3937 ip-collide: start using the log module
54dd256 health.uc: refactor the code
3cd8d1f state: split code up into modules and add try/catch block around everything
Signed-off-by: John Crispin <john@phrozen.org>
Remove the qcom_al02-c15 and qcom_al02-c4 profiles as they are early evaluation kit builds no longer in use.
Signed-off-by: John Crispin <john@phrozen.org>
Add quiet flag to uci command to suppress error messages when GPS
configuration doesn't exist, preventing unnecessary log spam during
boot.
Signed-off-by: John Crispin <john@phrozen.org>
Add quiet flag to uci command and check for empty interval to suppress
error messages when onlinecheck configuration doesn't exist, preventing
unnecessary log spam during boot.
Signed-off-by: John Crispin <john@phrozen.org>
Add quiet flag to uci command to suppress error messages when event
configuration doesn't exist, preventing unnecessary log spam during
boot.
Signed-off-by: John Crispin <john@phrozen.org>
Add file existence checks before reading gateway.json and initialise
variables to prevent boot log spam when configuration file doesn't
exist.
Signed-off-by: John Crispin <john@phrozen.org>
Add file existence check before reading gateway.json, fix variable
assignment typo, and improve error output redirection to prevent boot
log spam when configuration files don't exist.
Signed-off-by: John Crispin <john@phrozen.org>
Fix variable quoting in test conditions and remove explicit stderr
redirects to improve error message handling and prevent boot log spam.
Signed-off-by: John Crispin <john@phrozen.org>
Add quiet flag to uci command to suppress error messages when qosify
configuration doesn't exist, preventing unnecessary log spam during
boot.
Signed-off-by: John Crispin <john@phrozen.org>
Update CMakeLists.txt to CMake 3.10 with comprehensive compiler
warnings and security hardening flags. Add strict warning flags
(-Wall, -Wextra, -Werror plus ~30 additional checks) and security
features (stack protector, RELRO). Separate Debug/Release
configurations with appropriate optimisation flags.
Remove ip-collide tool from build and installation as it's no longer
needed.
Signed-off-by: John Crispin <john@phrozen.org>
Add custom lldpd package with older UCI and SYSV init scripts. The
upstream init scripts have changed significantly in 24.10, and we
want to keep the tested version that is known to work.
Signed-off-by: John Crispin <john@phrozen.org>
Fix return type declaration for lws_tls_server_abort_connection to
match the expected signature for gcc13 compatibility.
Signed-off-by: John Crispin <john@phrozen.org>
Fix various compilation issues in the ath12k driver for gcc13:
- Remove invalid ATH12K_DBG_WMI parameter from ath12k_warn calls
- Fix return type mismatch in ath12k_mac_he_gi_to_nl80211_he_gi
Signed-off-by: John Crispin <john@phrozen.org>
Fix kconf Makefile to explicitly use gcc instead of $(CC) variable
for compatibility with gcc13 build environment.
Signed-off-by: John Crispin <john@phrozen.org>
Update iwinfo to latest version (2024-10-20) and add the wifi-scripts
package to work with the latest WiFi configuration changes in OpenWrt
24.10.
The mac80211 package now depends on wifi-scripts, and the mirror hash
has been updated for the new digest algorithm.
Signed-off-by: John Crispin <john@phrozen.org>
Standardise the sysupgrade image format across all IPQ5332-based
devices by renaming the output from .tar to .bin format.
Signed-off-by: John Crispin <john@phrozen.org>
Update device profiles to reflect the feed rename from ipq807x_v5.4
to qca-wifi-6, and change sysupgrade image extension from .tar to
.bin to match the new image format.
Signed-off-by: John Crispin <john@phrozen.org>
Rename the ipq807x_v5.4 feed to qca-wifi-6 to align with the naming
convention used for qca-wifi-7. This change improves consistency and
better reflects the content, which encompasses WiFi 6 (802.11ax)
packages across various Qualcomm IPQ platforms (IPQ5018, IPQ6018,
IPQ8074, etc.).
Signed-off-by: John Crispin <john@phrozen.org>
Remove the hfcl feed which contained workarounds for old bugs that
are now resolved in the mainline code.
Signed-off-by: John Crispin <john@phrozen.org>
Remove the old and unused mcu feed which provided MCU firmware
management and communication utilities for Bluetooth-related
hardware.
Signed-off-by: John Crispin <john@phrozen.org>
Remove the old and unused edgecore feed which provided the ELTT2
(Edgecore Link Layer Test Tool) utility.
Signed-off-by: John Crispin <john@phrozen.org>
Remove the old and unused bluetooth feed which provided generic
Bluetooth support including 6LoWPAN, iBeacon, NRF52840, and LED
indicator utilities.
Signed-off-by: John Crispin <john@phrozen.org>
Remove the old and unused bluetooth-cc2652 feed which provided BLE
scanning and firmware flashing support for TI CC2652 chips.
Signed-off-by: John Crispin <john@phrozen.org>
Use the global count instead of per_band_counters for the basename
to keep it in sync with the captive portal logic.
Fixes: WIFI-15327
Signed-off-by: John Crispin <john@phrozen.org>
Populate bssid and ssid in the nl_cb client event payload by
resolving the hostapd instance using msg.msg.dev. Defaults to empty
values if hostapd context is unavailable.
Improves client visibility in multi-BSS deployments.
Fixes WiFi-15352
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
Duplicate VLAN validation fails in EAP105, which causes the client connectivity to fail.
Interface prefix (phy-*) not handled in the vlan validation
Fixes: WIFI-15351
Signed-off-by: dhileep <c-dsridhar@shasta.cloud>
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
fq_codel is not available on mediatek platforms. Replace it with sfq
during package install when CONFIG_TARGET_mediatek is set.
Fixes: WIFI-15285
Signed-off-by: John Crispin <john@phrozen.org>
Remove extra 'fi' in edgecore,eap105 case block introduced by
commit 1d4cbc46 which replaced a two-level if/else with a
three-level nesting but kept both original closing 'fi' lines.
Fixes: 1d4cbc46 ("ipq807x_v5.4, qca-wifi-7: enable/disable boot bank switch based on upgrade_available value during fw upgrade for Edgecore APs")
Signed-off-by: John Crispin <john@phrozen.org>
On a factory fresh dual boot bank device with birth certificates only
in the primary bank, the alternate bank mount would shadow the primary
with an empty filesystem. The script then exited with failure despite
birth certificates being available underneath.
After checking the alternate bank, unmount it if empty and re-check so
the primary bank's birth certificates remain accessible for EST
enrolment.
Fixes: WIFI-15292
Signed-off-by: John Crispin <john@phrozen.org>
1. Update TX power control to use interface (dev) instead of wiphy, improving
compatibility on Wi-Fi 7 platforms.
2. Introduce bssid_to_ifname() helper to reliably map BSSID to interface name.
3. Add a short delay (10 milliseconds) after setting TX power to allow
driver/firmware state to settle before reading back the value.
Tested on EAP014 and EAP105.
Fixes WIFI-14964
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
Ensure that the center frequency segment 0 index adjustment for
320 MHz bandwidth is applied only for valid 6 GHz frequencies.
Previously, the bandwidth check alone could trigger the adjustment
even when the operating center index did not correspond to a 6 GHz
frequency. Add an explicit is_6ghz_freq() check to avoid incorrect
center frequency offset calculations.
Fixes: WIFI-15238
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
8491119 renderer: make SSID naming band-aware for stable section names
69cf683 renderer: derive no_reconf from radio reconf capability
13f797e radio: use PHY-reported channels instead of hardcoded lists
e5a6295 state: guard against null devstats in iface_add_counters
Signed-off-by: John Crispin <john@phrozen.org>
Set reconf=true in wiphy info during radio detection, indicating that
Wi-Fi 7 radios support BSS reconfiguration without requiring full
interface teardown.
This complements the bss_reload fix by ensuring the reconfiguration
capability is advertised to netifd, allowing it to choose the hot
reload path when appropriate.
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
On Wi-Fi 7 platforms, BSS reload events were always propagated with
reconf=false, forcing netifd/hostapd into a full teardown path even
when a reconfiguration reload was requested.
This change restores the original intent by propagating the reconf
flag correctly from the reload path, allowing hostapd to distinguish
between reconfiguration-capable reloads and teardown-required cases.
With this change, hot reload works consistently on Wi-Fi 7 APs in the
same way as on Wi-Fi 6 platforms, avoiding unnecessary wireless
teardown and driver reinitialization.
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
Fix three issues preventing 6G non-primary SSIDs from connecting on
CIG WF-196:
1. Fix #num_global_macaddr config parsing: the value was stored with
the '#' prefix but accessed without it, causing the setting to be
silently ignored (always defaulting to 1).
2. Fix MBSSID config parsing: look for 'multiple_bssid' (the actual
hostapd config key) instead of 'mbssid'.
3. Fix B5 MAC generation for MBSSID: swap bytes 3 and 5, clear lower
nibble of byte 5, then set locally-administered bit. This avoids
MAC collisions with 6G multi-BSSID interfaces.
4. Add iface_macaddr_init() wrapper to ensure mbssid parameter is
passed consistently during both iface_restart and iface_reload_config.
Signed-off-by: ruanyaoyu <ruanyaoyu@cigtech.com>
When using dynamic VLAN (AP_VLAN) on 5 GHz, CSA finalize may call
_ieee80211_sta_cap_rx_bw() with a non-NULL chandef whose ->chan is NULL.
This leads to a NULL pointer dereference at chandef->chan->band and a
kernel panic.
Avoid the crash by validating chandef->chan before accessing the band and
fall back to the existing non-chandef path when the channel pointer is not
available during CSA.
Trace:
Unable to handle kernel read from unreadable memory at virtual address 0000000000000000
Internal error: Oops: 0000000096000005 [#1] SMP
CPU: 0 PID: 59 Comm: kworker/u4:2
Workqueue: events_unbound wiphy_delayed_work_pending [cfg80211]
Hardware name: Edgecore EAP111 (DT)
pc : _ieee80211_sta_cap_rx_bw+0x14/0xcc [mac80211]
lr : _ieee80211_sta_cur_vht_bw+0x20/0xb0 [mac80211]
Call trace:
_ieee80211_sta_cap_rx_bw+0x14/0xcc [mac80211]
ieee80211_iter_chan_contexts_atomic+0x260/0xf38 [mac80211]
ieee80211_link_unreserve_chanctx+0x430/0xab8 [mac80211]
ieee80211_link_use_reserved_context+0xac/0xf4 [mac80211]
ieee80211_nan_func_terminated+0x3f8c/0x4f00 [mac80211]
ieee80211_csa_finalize_work+0x2c/0x34 [mac80211]
wiphy_delayed_work_pending+0x298/0x3bc [cfg80211]
process_one_work+0x178/0x2f0
worker_thread+0x2e8/0x4d4
kthread+0xdc/0xe0
ret_from_fork+0x10/0x20
Kernel panic - not syncing: Oops: Fatal exception
Fixes: WIFI-15312
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
On dual boot bank devices, avoid running EST twice by checking for
operational certificates before falling back to the alternate bank.
Previously, after an upgrade the AP would boot from the alternate bank,
find only birth certificates there, and run EST again - resulting in
duplicate operational certificates.
Now the flow is:
- If operational.pem exists in current bank, use it
- If only birth certs in current bank, check alternate bank
- Single boot bank devices behave as before
Fixes: WIFI-15292
Signed-off-by: John Crispin <john@phrozen.org>
Description:
Hostapd successfully parsed the uplink and downlink bandwidth attributes from
the RADIUS server, but the values were not being propagated correctly into
sta_info. As a result, the bandwidth information was missing in the UBUS
events sent to ucentral-event.
Fix:
Ensure the parsed bandwidth values are correctly passed to sta_info so they
are included in subsequent UBUS notifications.
Tests Performed:
Configured per-client bandwidth limits on the RADIUS server and verified that:
- The AP enforces the configured uplink/downlink limits, and
- The correct bandwidth values appear in the UBUS events.
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
Interfaces like phy6g-ap0 can produce overly long IFB device names
(e.g., i-phy6g-ap0), which may exceed kernel name-length limits,
specifically in case of VLANs.
This patch normalizes such interface names by replacing the phy
prefix with p and shortening ap → a, producing more compact
IFB device names (e.g., i-p2g-a0).
Other interfaces continue using their original names.
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
a6fdd32 cmd_upgrade: enable curl to follow redirects
1c3e51f fix: Updated schema to fix issue with fingerprinting raw mode
Signed-off-by: John Crispin <john@phrozen.org>
Enable the CONFIG_GPIO_WATCHDOG of kernel config
Add the 'wdt' watchdog service in /etc/init.d/
Signed-off-by: Yang-Yongzhi <yangyongzhi@asterfusion.com>
Description:
The num_peers counter does not always update at the exact moment a peer is deleted.
Since deletion and decrement are not fully atomic, there are scenarios where
num_peers can drift out of sync with the actual number of peers.
Fix:
A complete rewrite of the num_peers update logic—ensuring fully correct
increment/decrement handling during peer insertion and deletion—would require
significant effort and QA validation. As an immediate and effective solution,
this patch synchronizes num_peers with the actual peer count whenever a mismatch
is detected.
Fixes WIFI-14998 and indirectly resolves WIFI-15202.
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
In the DP RX path, fast_rx is set to true by default.
Currently, if peer lookup fails in ath11k_dp_rx_h_mpdu(), the SKB is not sent
to the network stack or mac80211 because fast_rx remains true. This results
in a memory leak.
Fix this by setting fast_rx = false when peer lookup fails in
ath11k_dp_rx_h_mpdu(), ensuring the SKB is properly delivered to mac80211
via ath11k_dp_rx_deliver_msdu().
Fixes: WIFI-15202
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
The num_peers counter becomes corrupted during peer deletion due to race
conditions between ath11k_peer_delete() and ath11k_peer_unmap_event().
The firmware may or may not send unmap events, and the timing varies,
causing the counter to either leak (increment without decrement) or
underflow (double decrement).
Root causes:
1. ath11k_peer_delete() doesn't decrement num_peers, relying on
ath11k_peer_unmap_event() to do it
2. Firmware sometimes doesn't send unmap events, leaving num_peers
inflated
3. When unmap events do arrive, timing races with ath11k_peer_delete()
can cause missed decrements
4. Cleanup paths may double-decrement if delete_in_progress not checked
5. num_peers modified outside proper locking in some paths
This fix:
- Moves num_peers decrement into ath11k_peer_delete() after successful
peer deletion wait, ensuring exactly one decrement per deletion
- Handles both cases: peer removed by unmap event, or peer still in list
- Removes num_peers decrement from ath11k_peer_unmap_event() to prevent
double-decrement when unmap event arrives
- Adds ath11k_dp_peer_cleanup() call before ath11k_peer_delete() in
roaming path to ensure datapath structures properly cleaned up
- Adds delete_in_progress checks in cleanup paths to prevent
double-delete
- Ensures all num_peers modifications happen under base_lock
- Adds comprehensive debug logging to track num_peers throughout peer
lifecycle
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
Signed-off-by: John Crispin <john@phrozen.org>
1. When a connected client roams to another AP, the AP is trying to delete the peer
but for some reason the WMI command times out and while driver is waiting for
the response, we observed that the AP doesn't respond to any frames from STA
(probe requests, authentication etc) and once the response times out (3seconds default)
then AP starts responding to the older requets but client has already connected to
another AP. As the root cause for the response timing out is in the FW, we added
a WAR to reduce the timeout to minimize this blind period, with this AP responds
after 100ms and client connects successfully. And 100ms timeout is also reasonable
for this internal operation.
2. In case of peer deletion timeout, the driver peer database is not cleared, so,
if this happens often (which it is) then eventually we hit the max peers in the
driver and all subsequent operations fail, so, in case of timeout ignore the failure
and proceed with driver peer database cleanup.
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
Add bind-dig package dependency required for CAA record lookups
in est_client, which uses the dig command to query DNS for EST
server discovery.
Signed-off-by: John Crispin <john@phrozen.org>
Change standard FQDN from 'openwifi.network' to 'openwifi.wlan.local'
to prevent DNS hijacking attacks. The .local TLD is reserved for local
network use (mDNS) and cannot be registered in public DNS, ensuring
that discovery traffic cannot be redirected to attacker-controlled
infrastructure.
Signed-off-by: John Crispin <john@phrozen.org>
Move EST client enrollment to occur immediately after successful DHCP
discovery and before starting the ucentral client. This ensures
controller-specific certificates are enrolled before attempting to
connect. If EST enrollment fails during DHCP discovery, the client
will not be started.
Adjust interval_handler to call EST enrollment after DHCP discovery
attempt rather than before, ensuring proper certificate handling for
DHCP-discovered controllers.
Signed-off-by: John Crispin <john@phrozen.org>
Replace resolv module usage with dig command for CAA record lookups
to simplify DNS query handling. Reorganise cert_prefix_determine() to
prioritise controller-specific FQDN from cloud.json before checking
discovery method.
Add extensive debug logging throughout to aid troubleshooting of EST
enrollment process, including curl commands and exit codes.
Signed-off-by: John Crispin <john@phrozen.org>
The air-gapped EST server uses a certificate signed by the OpenLAN
Server Issuing CA. This certificate is used to ensure mTLS
authentication when the device connects to the EST server.
Signed-off-by: John Crispin <john@phrozen.org>
Add dnsmasq_rebind_allow() function to automatically whitelist controller
FQDNs for private IP resolution in air-gapped deployments.
When dnsmasq's boguspriv option is enabled (default), it blocks DNS
responses containing private IP addresses (RFC 1918) as a security
measure. This prevents DHCP Option 224 from resolving controller FQDNs
to local private IPs in air-gapped networks.
Solution: Inject rebind-domain-ok directives into /tmp/dnsmasq.d/
directory, which dnsmasq automatically includes via --conf-dir option.
Behaviour:
- DHCP discovery: Whitelist FQDN from dhcp_server field
- Standard FQDN discovery: Whitelist openwifi.network
- Centralized discovery: No changes (public IPs not affected)
This maintains security by only allowing specific controller domains
to resolve to private IPs whilst filtering all other RFC 1918 responses.
Signed-off-by: John Crispin <john@phrozen.org>
Add cert_prefix_determine() function that reads discovery method from
/tmp/discovery.method and determines appropriate certificate naming:
- Centralized (OpenLAN redirector): operational.pem/operational.ca
- Air-gapped (DHCP/FQDN/Flash): <controller-fqdn>.pem/<controller-fqdn>.ca
The FQDN is extracted from the controller address in /tmp/cloud.json
(DHCP Option 224).
This enables APs to enrol and store separate operational certificates
for multiple controllers, supporting portability between centralized
and air-gapped deployments without certificate conflicts.
Signed-off-by: John Crispin <john@phrozen.org>
Extend gateway.json to include cert and ca fields specifying which
certificate files the client should use for the connection.
Certificate naming strategy:
- Centralized (redirector discovery): operational.pem/operational.ca
- Air-gapped (DHCP/FQDN/Flash): <fqdn>.pem/<fqdn>.ca
Write discovery method to /tmp/discovery.method so est_client can
determine appropriate certificate naming when enrolling.
This enables APs to maintain separate operational certificates for
multiple controllers and automatically select the correct certificates
based on which controller they're connecting to.
Signed-off-by: John Crispin <john@phrozen.org>
Modify early_boot init script to copy all .pem and .ca files from
/certificates/ to /etc/ucentral/ instead of only operational.pem
and operational.ca.
This enables support for multiple trust chains where certificates
are stored with FQDN-based names (e.g., controller.example.com.pem)
alongside the traditional operational.pem.
The simple wildcard copy allows air-gapped deployments to maintain
certificates for multiple controllers without complex logic.
Signed-off-by: John Crispin <john@phrozen.org>
Add discovery method that attempts to resolve a standard FQDN when DHCP
discovery fails. This enables zero-touch provisioning in environments
where administrators configure DNS without modifying DHCP infrastructure.
The standard FQDN is configurable via STANDARD_FQDN constant (defaults
to "openwifi.network"). Administrators can configure their local DNS to
resolve this FQDN to their controller, allowing APs to discover the
controller automatically.
Discovery priority order:
1. EST enrollment (blocking)
2. DHCP discovery (Option 224/138)
3. Flash-based configuration
4. Standard FQDN resolution (NEW)
5. Cloud redirector service (internet-connected only)
The implementation uses the resolv module for DNS queries, performing
A record lookups. If resolution fails, discovery continues to the next
method. The standard FQDN method integrates with the existing discovery
block list mechanism to prevent repeated failed attempts.
Note: The boguspriv dnsmasq option may prevent FQDNs from resolving to
private IPs. Administrators should either use CG NAT Safe IP addresses
(100.64.0.0/10) or configure dnsmasq with rebind-domain-ok exceptions.
Signed-off-by: John Crispin <john@phrozen.org>
Implement EST server discovery via CAA DNS records for air-gapped
deployments. When DHCP Option 224 provides a controller FQDN, query
CAA records to determine the appropriate EST server endpoint.
The discovery flow:
1. Read controller FQDN from /tmp/cloud.json (set by DHCP handler)
2. Query CAA records for the controller domain
3. Use EST server from CAA 'issue' tag if present
4. Fall back to certificate issuer-based selection if CAA lookup fails
This allows network administrators to configure local EST servers via
DNS rather than relying on hardcoded public endpoints. Air-gapped
deployments can now specify private EST servers through standard DNS
infrastructure.
Example DNS configuration:
controller.local. IN CAA 0 issue "est.local:8001"
When an AP receives controller.local via DHCP Option 224, it will
query CAA records and use est.local:8001 for certificate enrollment
instead of the public est.certificates.open-lan.org endpoint.
Signed-off-by: John Crispin <john@phrozen.org>
Add missing ';;' after edgecore,eap111/eap112 LED configuration to
prevent fall-through to subsequent case statements.
Signed-off-by: John Crispin <john@phrozen.org>
Allow configuring small values of duration time for passive
scanning in software scan.
Fixes: WIFI-14822
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
**SPECIFICATIONS:**
SOC: Qualcomm IPQ6018 (64-bit quad-core ARM Cortex-A53 @ 1.8Ghz)
Flash: SPI NOR 8MB + NAND 128MB
Memory: 1GB
2.4GHz Frequency Band: 2.4GHz ~ 2.484GHz (802.11 b/g/n/ax)
5GHz Frequency Band: 5.150GHz~5.850GHz (802.11 a/n/ac/ax)
Wireless Speed: 2.4GHz: 574Mbps, 5GHz: 1201Mbps
**BACKUP YOUR STOCK FIRMWARE:**
- Put openwrt-*-initramfs-kernel.bin to your TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli and exec these commands:
```
tftpboot <your_tftp_server_ip>:initramfs.bin
bootm
```
- Once boot completed and you get the openwrt shell execute below commands:
```
device=<device_name>
mkdir -p /tmp/fw_backup; cd /tmp/fw_backup
rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
dd if=/dev/${rootfs} of=rootfs_${rootfs} bs=1M
dd if=/dev/${rootfs_1} of=rootfs_1_${rootfs_1} bs=1M
cp /sys/firmware/fdt fdt.dtb
md5sum * > md5sum
tar -cvzf /tmp/${device}.tar.gz .
sum=$(md5sum /tmp/${device}.tar.gz | cut -d' ' -f1)
mv /tmp/${device}.tar.gz /tmp/${device}_${sum}.tar.gz
echo "stock fw backup saved to: /tmp/${device}_${sum}.tar.gz"
```
- Upload/save your backup to a safe place.
**STOCK FIRMWARE RECOVERY:**
- Boot initramfs image
- Upload your backed-up stock fw tarball to the device
using scp or download it from the device using wget.
- Enter device ssh cli or tty and exec:
```
cd /tmp && wget <your_web_server_ip>/${stock_fw_backup}.tar.gz`
tar -xpzf ${stock_fw_backup}.tar.gz
rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f /tmp/rootfs_${rootfs}
ubiformat /dev/${rootfs_1} -y -f /tmp/rootfs_1_${rootfs_1}
reboot
```
**INSTALLATION:**
1. initramfs method
- Put openwrt-*-initramfs-kernel.bin to your TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli and exec these commands:
```
tftpboot <your_tftp_server_ip>:initramfs.bin
bootm
```
- Once boot completed and you get the openwrt shell execute below commands:
```
cd /tmp && wget <your_web_server_ip>/factory.ubi`
export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f factory.ubi
ubiformat /dev/${rootfs_1} -y -f factory.ubi
reboot
```
2. u-boot nand-factory.bin image method
- Put openwrt-*-squashfs-nand-factory.bin to your TFTP server and enter u-boot cli and exec these commands:
```
tftpboot <your_tftp_server_ip>:factory.bin
#After downloading is finished:
imxtract 0x44000000 ubi
flash rootfs
flash rootfs_1
reset
```
Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
During 802.11r Fast Transition roaming, when a client moves between
APs (e.g., wlan0 to wlan1) with the same dynamic VLAN assignment, the
vlan_add handler's refcount mechanism prevented the new WiFi interface
from being added to the bridge.
When wlan0-v100 and wlan1-v100 exist simultaneously with VLAN ID 100,
the refcount becomes 2, causing vlan_add to exit early for wlan1-v100.
This left wlan1-v100 out of the bridge VLAN table, breaking connectivity
after roaming despite correct VLAN assignment via RADIUS and RRB frames.
Fix by detecting WiFi VLAN interfaces (wlan*-v*) and always adding them
to the bridge regardless of refcount. The refcount mechanism now only
controls WAN port VLAN configuration, which should only occur once per
VLAN ID.
Also reorganise vlan_add/vlan_remove to check swconfig early for clarity.
Signed-off-by: John Crispin <john@phrozen.org>
Enable CONFIG_LEDS_TRIGGER_HEARTBEAT to allow LED heartbeat
functionality when device goes offline. Without this kernel option,
the LED trigger mechanism was unavailable, preventing the LED from
flashing to indicate offline status.
Fixes: WIFI-14646
Signed-off-by: John Crispin <john@phrozen.org>
When a station roams between bands on the same VLAN, the vlan_remove
event from the old band can arrive after the vlan_add event from the
new band, causing the VLAN to be incorrectly deleted whilst still in use.
Add reference counting that tracks how many interfaces are using each
VLAN ID. Only create VLAN devices on the first reference and only
remove them when the last reference is dropped.
On startup, initialise refcounts from current station state to handle
daemon restarts correctly.
Signed-off-by: John Crispin <john@phrozen.org>
676e155 dhcp_inject: fix a syntax issue in dhcp_inject
e594c44 captive.uam.mac-auth: the default was wrong
Signed-off-by: John Crispin <john@phrozen.org>
LAN switch exposes single eth1 instead of per-port interfaces for RAP750W-311A.
Using VLAN to separate LAN to each physical port for RAP750W-311A.
Fixes: WIFI-15163
Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
make openwrt/profiles relative so moving or renaming the repo directory won't break the symlink
Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
Changelog:
- Fix MAC address assignment for Ethernet ports
- Fix Ethernet port configuration (was not working in the current DTS
because GPIOs 23 and 24, used for LEDs, are RGMII2 pins)
- Add package kmod-7915-firmware to enable Wi-Fi
Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
Set max_ap_assoc at wiphy init instead of vif init for mt7915.
Hard code max_ap_assoc to 128 for EAP112 in wifi_max_user.uc
Fixes WIFI-15027
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
100c045 Fix cloud cannot show association list when WDS-AP in state.uc
168f6a4 dhcp_inject: Support multiple upstream
Signed-off-by: John Crispin <john@phrozen.org>
Introduce a blocklist mechanism to avoid retrying failed discovery
methods within the same discovery cycle. Each time a method fails
validation, it is added to the blacklist. The blacklist is cleared
once the device transitions to ONLINE or after all discovery methods
have been attempted.
This prevents repeated attempts of failing methods and ensures the
discovery process progresses more reliably.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
In cases where gateway.json exists, the discovery method may be unset.
Writing an empty value to discovery.state.json is not useful, so
avoid updating the file in this case.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Always obtain EST certificates before starting the discovery process.
This ensures certificates are already available from the EST server, since
the FQDN may be provided via DHCP discovery or another discovery method,
and requires valid certificates to proceed.
Fixes: WIFI-15123
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Commit 2e4972e9ad ("ipq53xx: Add KERNEL_IPQ_MEM_PROFILE for IPQ53XX")
introduced KERNEL_IPQ_MEM_PROFILE but didn't set it for all IPQ53xx
boards, causing them to boot with incorrect RAM size settings.
This adds CONFIG_KERNEL_IPQ_MEM_PROFILE=0 to the affected board profiles:
- cig_wf189, cig_wf189h, cig_wf189w, cig_wf672
- edgecore_eap105
- sonicfi_rap7110c-341x
Signed-off-by: John Crispin <john@phrozen.org>
Reverse byte order in non-OUI part of MAC address to prevent overlap
when MBSSID is enabled. Swaps bytes 3 and 5 and masks lower nibble
of byte 5 before applying index XOR.
Signed-off-by: John Crispin <john@phrozen.org>
Ensure that LEDs are configured to be ON before attempting to change their state.
Previously, if the LED was configured to be OFF, it would still enter a double-blink
state when the cloud connection was lost, and then switch to solid ON upon
reconnection—ignoring the configured OFF state.
This update changes that behavior:
- If LEDs are configured OFF, they will remain OFF even during cloud
disconnection (no double-blink).
- After temporary state changes (e.g., during factory reset), the LED will
return to its configured state (either OFF or ON).
Signed-off-by: Paul White <paul@shasta.cloud>
The MIB loop cnt variable was defined as a static variable in the function that
implements the loop, however this function can be called for more than one switch
on some platforms. This results in a race condition that leads to memory
corruption and kernel crashes.
The fix moves the loop cnt variable to the passed in switch handle, this way
there is one per switch chip. Thix fix was identified by looking at newer
versions of the qca-ssdk software package from QCA.
Signed-off-by: Paul White <paul@shasta.cloud>
A scenario was seen where UCI config was not flushed to disk before
an AP power-cycle after uci-defaults was completed. Since these
scripts are deleted after being ran once, there is no way to recover
without a factory reset.
Adding this sync operation proved to help avoid this situation from
happening
Signed-off-by: Paul White <paul@shasta.cloud>
Adds support for recording the method used to discover the cloud
controller (e.g. DHCP, FLASH, OpenLAN).
The selected method records the current date and time along
with the discovery method into "/etc/ucentral/discovery.state.json".
The date is stored in epoch format.
Fixed: WIFI-14966
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
cloud_discovery will not start if the CN does not match the devices serial.
an error will be written to syslog
---
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: The certificate used has a CN that does not match the serial of the device
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
---
Signed-off-by: John Crispin <john@phrozen.org>
The daemon will check the vailidity of the operational certificate once and hour.
If the certificate is valid for less than three days, a reenrollment is attempted.
Once the reenroll happened the connection to the cloud controller will be restarted.
Fixes: WIFI-14900
Fixes: WIFI-14694
Signed-off-by: John Crispin <john@phrozen.org>
The updated flow:
- Mount /dev/mtdblock* (the certificates partition) to /mnt
- Copy its contents to /certificates
- Unmount /mnt
- Extract the PKI 2.0 certificates into /certificates
Fixes: WIFI-14904
Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
To fix EMI and avoid Ethernet RX stuck after reboot for Zyxel NWA130BE.
Ethernet Rx stuck was sometimes happened when we do stress reboot,
need to adjust the amplitude level of SGMII for CPU and QCA8385 side.
And those settings come from the result that Zyxel HW team and Manufacturer
co-work to fine tune for NWA130BE.
Signed-off-by: YenLin Pan <YenLin.Pan@zyxel.com.tw>
92fb3c1 WIFI-14901: Add rrm_chanutil status to health.uc (when it fails) and save health metric in /tmp/ucentral.health
6313892 WIFI-14906: Add 'sync' after file generation in Cloud discovery process
Signed-off-by: John Crispin <john@phrozen.org>
This patch enhances WPA3 encryption support in netifd by introducing GCMP-256
cipher handling for wireless interfaces operating on the 6 GHz band with HE/EHT
modes.
Fixes: WIFI-14594
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
b971b73 Support HaLow Mesh on EAP112
7d28320 Fix in ucode script of config_raw to add multiple UCI sections via config-raw object of the schema
1453f2e chanUtil per radio shall be obtained from the policy_chanutil.uc script
fa26853 enable multiple bssid by default on 6G
Signed-off-by: John Crispin <john@phrozen.org>
Rate limiting was not applied on WiFi-7 devices because their
hostapd interface names use the phy* prefix instead of wlan*.
This patch extends the match pattern to include both wlan* and phy*.
Fixes: WIFI-14884
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
1. For EAP112 LTE module (Quectel EM60 series), when username and password is configured, it is required to update the context with the QICSGP AT command.
2. Use a handler function to check if the AT command is stuck and retry.
Fixes: WIFI-14545
Signed-off-by: Sebastian Huang <sebastian_huang@accton.com>
Description:
A missing ;; in the 02_network file for the ipq50xx target caused
improper network configuration across all ipq50xx platforms
(e.g., Edgecore EAP104, Cybertan RAP630C-311G).
This resulted in loss of Internet connectivity.
Fix:
Added the missing ;; in the appropriate case block.
Tests Performed:
Verified on Edgecore EAP104. Network configuration was applied
correctly and Internet connectivity was restored.
Fixes: WIFI-14847
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
1. Copy modemmanager to feeds/ucentral.
2. Add function to find the device sysfs path when protocol is "wwan".
3. Call ifup when modem is ready for connection.
4. Add trigger to restart modemmanager when network uci is updated.
Fixes: WIFI-14751
Signed-off-by: Sebastian Huang <sebastian_huang@accton.com>
* Reduce the i2c frequency to enable the encryption chip to be recognized
* Add USB xr Serial driver and init gps uart param
* Factory reset when switching wifi mode
* SFP gpio should be input mode
Fixes: WIFI-14789
Signed-off-by: Justin.Guo <guoxijun@actiontec.com>
1.Change the WiFi temperature threshold.
2.Use single antenna when temperature is too high.
Fixes: WIFI-14788
Signed-off-by: Justin.Guo <guoxijun@actiontec.com>
2819f87 HaLow: fix channel 8/24/40 cannot be set
3b04c09 HaLow: set default channel to avoid HaLow not working when no channel set by JSON
Signed-off-by: John Crispin <john@phrozen.org>
2b8a58b dont crash if udevmand does not reply
985f3cb WIFI-14588: Cloud Package Manager
Fixes: WIFI-14752
Signed-off-by: John Crispin <john@phrozen.org>
Support user to control PSE on/off (chip: tps23861) via ucentral config file.
Use uci-default to write poe's uci default file.
Fixes: WIFI-14724
Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
125a148 add PoE support for client ports
17b6c18 Cloud Package Manager
a86b8b0 Fix typo in enhanced MPSK property name
57852ed update schema.json to 4.1.0
e155483 command: update upgrade and factory commands to handle new operational certs
Signed-off-by: John Crispin <john@phrozen.org>
If MPSK is enabled on any interface, `ssid.mpsk` should be true.
Prevents overwriting true with a false value when multiple interfaces
share the same SSID.
Also allow handling of the 'reload' event even when MPSK is not enabled,
to ensure config reloads are not skipped, e.g. when configuration is empty.
Fixes: WIFI-14484
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
After roaming to EAP105, the roaming frames were exchanged successfully,
but the STA sent a deauthentication frame to the AP with an "INVALID IE" error.
The RSNXE subfield in the FTIE was set in the Reassociation Response frame.
The STA validated the Reassociation frame and was unable to process the
RSNXE subfield.
Modified SAE options (sae_pwe=4 and sae_require_pmf=0).
Fixes: WIFI-14544
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
A printk() was previously introduced that is passing the log level as the first argument
instead of prefixing the format with the level. Given this code path, this is causing a
kernel fault and CPU reboot without any kernel panic/stack trace, since it's crashing
inside of printk().
CPU:0 ts:206871944795 ffffffc008dcf828 ffffffc008dfe914 cleanup_module [batman_adv] <- cfg80211_vendor_cmd_reply+0x7ff4/0xa064 [cfg80211]
CPU:0 ts:206871944800 ffffffc0108e69d0 ffffffc008dcf80c printk <- cleanup_module+0xb22c/0xa20 [batman_adv]
CPU:0 ts:206871944802 ffffffc0101173c0 ffffffc0108e6a08 vprintk_func <- printk+0x60/0x6c
CPU:0 ts:206871944806 ffffffc010115e44 ffffffc0101160ec vprintk_emit <- vprintk_default+0x4c/0x60
CPU:0 ts:206871944809 ffffffc0101172d0 ffffffc010115e88 __printk_safe_enter <- vprintk_emit+0x84/0x29c
CPU:0 ts:206871944812 ffffffc010115c20 ffffffc010115ec4 vprintk_store <- vprintk_emit+0xc0/0x29c
CPU:0 ts:206871944816 ffffffc0100a53a4 ffffffc010080fb4 do_translation_fault <- do_mem_abort+0x54/0xb0
CPU:0 ts:206871944819 ffffffc0100a4eb4 ffffffc0100a5448 do_page_fault <- do_translation_fault+0xc8/0xe0
CPU:0 ts:206871944821 ffffffc0100a4d08 ffffffc0100a5038 __do_kernel_fault <- do_page_fault+0x1a8/0x4f0
CPU:0 ts:206871944837 ffffffc0100a4c88 ffffffc0100a4df0 die_kernel_fault <- __do_kernel_fault+0x110/0x1b0
After applying the fix, we can see this code path is being hit:
[26799.175166] cfg80211_calculate_bitrate_he: invalid rate->nss: 0
This still doesn't fix the original issue triggering this code path, which is why a nss value
of 0 is being reported.
Fixes: eb9cbaec7 ("ipq807x: Shorten the kernel backtrace warning msg for ieee80211_bss_get_elem")
Fixes: WIFI-14677
Signed-off-by: Paul White <paul@shasta.cloud>
Fix the case where firmware crashes when STA sends AUTH with same
MAC address to multiple SSIDs on the same radio.
Fixes: WIFI-13276
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
When using psk2-radius in combination with enhanced MPSK,
the passphrase was not properly propagated to user scripts
via the ucode interface, because the PSK field was not set
in the connected station context.
This patch fixes that by copying the passphrase into the
psk field.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
For the Edgecore EAP-105 platform, configure the 2.4GHz, 5GHz,
and 6GHz WLAN interfaces to use MAC addresses derived
from the base WAN MAC address.
Fixes: WIFI-14624
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
* While Roaming the AP couldn't find the wildcard R0KH and R1KH ids,
which are required by Fast transistion.
* Issue caused by the placement of conf parser in the invalid location.
Fixes: WIFI-14544
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
9710867 (HEAD -> main, origin/main, origin/HEAD) make the MTU configurable on GRE tunnels
4dd0904 SSH IdleTimeout can be configured from JSON config
6faaa1f HaLow: Extend ucentral schema & state for HaLow
Signed-off-by: John Crispin <john@phrozen.org>
6faaa1f HaLow: Extend ucentral schema & state for HaLow
aa9cac5 dhcp_inject: Use same keyword "dhcp-inject" in config file
Signed-off-by: John Crispin <john@phrozen.org>
1. porting MorseMicro HaLow driver to support HaLow on EAP112
2. Only support FCC regulation because of hardware limitation
3. Add /etc/init.d/halow-gpio-reset to initialize HaLow chip in early stage
4. Add /etc/uci-defaults/aaa-fix-phy0-to-morse to correct the default uci for HaLow radio.
Signed-off-by: Ian Chen <ian77_chen@accton.com>
* add "limit_rtlphy_10g_ablity" in DTS , no side effect on other product.
* disable 10G capability if DTS defined limit_rtlphy_10g_ablity , no side effect on other product.
* revert the last 0006-qca-ssdk-Fix-10G-rtl-phy-driver-for-c45-mdio-read-wr.patch and based on 0005 patch.
Fixes: WIFI-14567
Signed-off-by: Ken Shi <xshi@actiontec.com>
Added check when parsing ssid info retrieved from iwinfo.
Program will exit if expected interface count and iwinfo entry count mismatch.
Fixes: WIFI-14564
Signed-off-by: alex18_huang <alex18_huang@accton.com>
The main reason was adding missed functionality for Radius
configuration which caused rejecting WiFi clients on
authentication level.
Still some changes not included:
* AFC,
* hs20_release,
* multiple_bssid,
* he_co_locate
Fixes: WIFI-14459
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
- avoid calculated Channel Utilization value to be 'infinity' from cycle_count_delta being '0'
Fixes: WIFI-14536
Signed-off-by: Tanya Singh <tanya_singh@accton.com>
Program sometimes did not setup tc qdisc on some interfaces when creating SSID with dhcpinject enabled initially.
Added delayed startup.
Fixes: WIFI-14522
Signed-off-by: alex18_huang <alex18_huang@accton.com>
The bug was in the upstream hostapd codebase, backport/rebase the fix
--> ba150059d1ec964add8f29eb2c92dd6dfde97308
Fixes: WIFI-14508
Signed-off-by: John Crispin <john@phrozen.org>
246873b add max-inactivity to ssid config
3b5a5c4 Allow option 82 DHCP fields to be transparently injected into client DHCP requests
Signed-off-by: John Crispin <john@phrozen.org>
During roaming validation, an issue was detected with
the ASSOC-REJECT event, which had a status code of 55.
To resolve this, the SNonce from the Auth Request Frame
was copied, and the random ANonce is now used
only when expired.
Fixes: WIFI-14326
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Fix removing rhash when station is roaming between radios and
apply logic from opensource driver during adding/removing
peer.
Fixes: 7374c39d ("ath11k: fix STA roaming between radios")
Fixes: WIFI-14457
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
1. Integrated WiFi boarddata
2. Integrated LEDs
3. sysupgrade changes are integrated
4. Network ports are enumerated
5. A new profile is added under profiles
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
c2338ad snmp: fix schema/yaml syntax
50c4ead set schema version to 4.0.0
d8260f8 add property that allows disabling MPSK
Signed-off-by: John Crispin <john@phrozen.org>
1c11c1b WIFI-14284: Use swconfig to get the correct port to VLAN ID mapping for statistics
Fixes: WIFI-14284
Signed-off-by: John Crispin <john@phrozen.org>
d2ff805 Change realtime events type from enum to string
a518b02 schema, ssid: add mpsk-radius encryption
Signed-off-by: John Crispin <john@phrozen.org>
Add casting center frequency to int, previosly was used
string.
{
"dev": "wlan1",
"wiphy_freq": "5180",
"measurement_duration": "70",
"center_freq1": "518030",
"scan_ssids": [
""
],
"scan_flags": 4
}
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Update scan module to support WiFi 7 devices
which have virtual phys defined. Scanning on
the different virtual phys but on the same physical
phy isn't allowed.
Add NL CBs to notify about scanning progress.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Need to unblock chandef as scanning definitions which
is used by TIP modules for scanning trigger.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Invalid logical operator was used for checking null
pointers in channel_switch function: AND instead OR
Fixes: 7477963b ("ucentral-event: add channel switch handler")
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Broadcast / Multciast transmission is not working in DVLAN mode in the driver.
If we send the frames as unicast frames, it works. This is a workaround for now.
Need to rollback once we add a clean fix.
Fixes: WIFI-14441
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
Add channel switch handler to update hapd object
with new frequency and channel info.
Fixes: WIFI-14336
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
"bandwidth_up", and "bandwidth_down" had typos. The correct attributes are
"bandwidth-up", and "bandwidth-down"
Signed-off-by: Firas Shaari <firas.shaari@shaariconsultancy.com>
Specifications:
SoC: MediaTek MT7981BA
RF Chipset: MT7976DA @2.4GHz 2T2R
MT7976DA @5ghz 2T2R
RAM: 512MB DDR4 RAM
Flash: SPI-NAND 256 MiB
Ethernet: 2 x 1GbE PHY
Reset Button
Power Source: DC IN 12v, Standard PoE 802.3af/at
LED Indicator: 1 x single color LED (GPIO Control)
Fixes: WIFI-14312
Signed-off-by: steven.lin <steven.lin@senao.com>
f0dfb40 Include DHCP VSI information in state message
44da3d6 Add config for vendor-class and request-options
a21635b always request option 43 and 224 when doing DHCP
Signed-off-by: John Crispin <john@phrozen.org>
Specifications:
SoC: MediaTek MT7986A
RF Chipset: MT7976G @2.4GHz 4T4R
MT7976A @5ghz 4T4R
RAM: 1GB DDR4 RAM (2x 512MB)
Flash: SPI-NAND 256 MiB
Ethernet: 1x 2.5GbE PHY
Reset Button
Power Source: DC IN 12v, Standard PoE 802.3af/at
LED Indicator: 4 x single color LED (GPIO Control)
Fixes: WIFI-13983
Signed-off-by: Steven Lin <steven.lin@senao.com>
baeef76 Revert "ucentral-schema: add support for configuring snmpd service using ucentral."
684a1aa firewall: upon up NAT'ed port 53 for ipv6
83a30b4 enable reconf for mpsk interfaces
Signed-off-by: John Crispin <john@phrozen.org>
42e59d5 Add system-password to the schema
8b3701b ucentral-schema: add support for configuring snmpd service using ucentral.
Signed-off-by: John Crispin <john@phrozen.org>
The device was not re-initialized if ony radio settings get updated without the
device settings changing.
Fixes: WIFI-14050
Signed-off-by: John Crispin <john@phrozen.org>
a626097 add schema for RRM based on Channel Utilization
39aed21 captive: allow loading the web-root from an external http server
37e3895 add multi-psk2-radius
Signed-off-by: John Crispin <john@phrozen.org>
Add controllable power LED support for -
CIG WF186W, CIG WF186H, CIG WF188N, CIG WF196, Edgecore EAP101 and
Edgecore EAP102 and Edgecore EAP104
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
To handle this, invoke hapd_subscriber.subscribe after the interface is created.
Also dont delete the interface from ifaces as ifaces should always contain the
configured ports (from uci config) per ieee8021x.uc design.
Deleting interfaces from ifaces will lead to ieee8021x.uc crashes.
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
Fix configurations for the WPA2 Enterprise example with 802.11r enabled for fast transitioning.
Signed-off-by: Firas Shaari <fshaari-c@telecominfraproject.com>
Fix null pointer dereference issue during Authentication stage and
add sanity check in mt7915_sta_statistics
Signed-off-by: John Crispin <john@phrozen.org>
In the bootcount script there was no entry for Edgecore EAP104 to
set the bootcount. This commit adds support for Edgecore EAP104 in
bootcount script to set the environment variable correctly
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
ubootenv_size is computed dynamically similar to ipq807x.
This resolves the issue where fw_setenv fails with the following error.
MTD erase error on /dev/mtd13: Invalid argument
Error: can't write fw_env to flash
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
In the backports driver the tx stats are updated in ieee80211_8023_xmit.
However in AP mode the packets are transmitted in ieee80211_8023_xmit_ap.
ieee80211_8023_xmit is not hit in case of AP mode. Update the stats just
before calling ieee80211_8023_xmit_ap
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
Enabling CPTCFG_ATH11K_MEM_PROFILE_512M will change the layout of
struct hal_rx_desc_ipq8074. This broke monitor mode. Fix it by not modifying
the struct even if the 512MB profile is enabled.
Fixes: WIFI-12102
Signed-off-by: John Crispin <john@phrozen.org>
This commit is an improvement over previous
commit 3598a243b3 which added a
fix for traffic disruption when vlan id of the lan port is
changed on devices with internal switches such as fap655,
CIG_WF186w,EAP-104.
This commit reconfigures the vlans for the mpsk clients on the
switch using the ucentral-event subsystem by tracking the
netifd_add events.
Fixes: WIFI-13797
Signed-off-by: joydeepbenison <joydeep.ghosh@benisontech.com>
ieee8021x
---------
1. Handle link_up events and update hostapd config
2. For certains scenarios, we need to remove and add
instead of reload (reload did not work).
Consider the following scenario -
Say on CIG 186w as an example
eth0.4086 interface exists with some non-ieee8021x config.
Push ieee8021x config. In general the flow is that
reload_config is called followed by invocation of services (from ucentral-schema)
Services inovation does n't wait until the configi reloaded ie in this context
ieee8021x service is invoked much before the network interfaces are recreated.
That is not correct. To handle this, we capture link-up events
and remove the existing interface (in hostapd as shown below) and add again
3. For swconfig platforms, the names contain a dot. Handle that gracefully in
ubus_unsub_object while adding hostapd interface
4. Add better logging using log.syslog
hostapd
---------
In case of swconfig switches, the basename of the interface should be based on the last dot.
Earlier it was done based on the first dot, which would result in incorrect basename.
For example if the interface name is eth0.4087 then the vlan->ifname would be eth0.4087. (A dot at the end) .
Before this patch, the basename was returned as eth0. It should be eth0.4087
Also fixed the return code by adding a default value of 0 and removed an unncessary check
for if_add before ubus add call.
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
when roaming between 2 radios the following error messages would show up in the logs
[681066.503943] ath11k c000000.wifi: Failed to add peer: 38:f9:d3:bf:b2:d4 for VDEV: 1
[681066.503979] ath11k c000000.wifi: Failed to add station: 38:f9:d3:bf:b2:d4 for VDEV: 1
Signed-off-by: John Crispin <john@phrozen.org>
dcd571e allow only psc on 6GHz auto channel selection
310095a captive: handle /logoff and /logout paths
7aceedc ratelimit: reload the service rather than restarting it
ce41668 fingerprint: add missing allow_wan option to render code
721568b Merge pull request #17 from Telecominfraproject/WIFI-431-fix-update-internal-schema-validation
7d05e70 more AFC fixes
Signed-off-by: John Crispin <john@phrozen.org>
Fixes WIFI-13428 : traffic disruption for FAP655,CIG_WF186w,EAP-104 for MPSK Clients when vlan id
of the lan port is modified . This Commit configures the dynamic vlans
on the switch of fap655 again after reset.
Signed-off-by: joydeepbenison <joydeep.ghosh@benisontech.com>
During CSA with DFS channels, disable, enable interface
is a part of the algorithm.
When interface was enabled old operating class before switch
and new channel were used causing mismatch in
configured_fixed_chan_to_freq function.
Example of log when switch from channel 157 to 108 was triggered:
"Could not convert op_class 124 channel 108 to operating frequency"
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Add options to trigger CSA with DFS channels, without
this patch ubus request was rejected:
ubus call hostapd.wlan0 switch_chan '{"freq":5260,"bcn_count":10}'
Command failed: Operation not supported
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
During CSA with DFS channels, disable, enable interface
is a part of the algorithm.
When interface was enabled old operating class before switch
and new channel were used causing mismatch in
configured_fixed_chan_to_freq function.
Example of log when switch from channel 157 to 108 was triggered:
"Could not convert op_class 124 channel 108 to operating frequency"
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Add options to trigger CSA with DFS channels, without
this patch ubus request was rejected:
ubus call hostapd.wlan0 switch_chan '{"freq":5260,"bcn_count":10}'
Command failed: Operation not supported
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Add filtering the same vlans before adding to
the vlan config. The issue was detected during
connection many WiFi client using dynamic vlans
on the network.
Fixes: WIFI-13538
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Define the blue sys LED from the device tree as the POWER LED for the
CyberTAN EWW631-B1 platform. This allows LED control through uCentral
Signed-off-by: Paul White <paul@shasta.cloud>
Fixes: WIFI-13435
Signed-off-by: John Crispin <john@phrozen.org>
6704b5b83e9d smp: fix minor spelling typos
a0c5a18fa2a5 zcbor: upgrade zcbor to 0.7.0
52aee9047ec2 zcbor/smp: replace auto-generated code with zcbor functions
09606bc8e449 smp: print {en,de}code error with 'zcbor_peek_error'
b91c19ef5106 umcumgr/smp: allow disabling 'confirm' and 'test' commands
5849f7a503cd smp: restore timeout value for select()
45d9523c0c13 umcumgr: use 'stderr' for 'usage' only if error occurred
28d0044ab5b3 umcumgr: introduce support for TI serial bootloader
db34a3645b21 umcumgr: add support for 'dump' in TI serial bootloader mode
df3f235bcb3c smp: fix images list print
bde8686bac61 zcbor: upgrade zcbor to 0.8.1
ed34b2816f2b smp: adapt to changes introduced in zcbor 0.8.0
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This exports MCU/USB related pins in sysfs using 'gpio-export' on the
EdgeCore {E,O}AP102 boards as:
- mcu-enable
- usb-rear-power
- usb-side-power
- usb-hub-enable
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds configuration for pins connected with nRF52840 MCU (reset and
one apparently used by device vendor for DTM enable) and related to USB
(GL850G HUB reset and rear/side ports power) on the EdgeCore {E,O}AP102.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This change focuses on the I/O related cleanups for EdgeCore {E,O}AP102
DTS files. List of changes:
1. Remove 'usb_mux_sel' pinctrl mux
Defined label isn't used as reference in any other node and defined
GPIO isn't used as well.
2. Remove 'pci@20000000', related PHY and pinctrl mux nodes
{E,O}AP102 doesn't use of any of the IPQ8071A PCIe buses.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This was lost during kernel v4.4 to v5.4 migration. Bring back correct
pin configuration (only 2-pin) and UART node used by the on-board MCU.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The bootcount wasn't getting reset to 0 upon a successful boot,
resulting in falling back to the previous firmware version after three
reboots of the AP.
Fixes: WIFI-13359
Signed-off-by: Paul White <paul@shasta.cloud>
This adds a workaround to fix an issue with 802.1x + DVLANs on platforms
where LAN ports are through an integrated switch (swconfig).
Netifd is tracking the wired ports as part of a bridge-vlan: either a
static one, or 4090 for the default untagged bridge. When hostapd
authorizes the wired port, netifd is automatically adding this bridge
vlan as PVID untagged to the port. The vlan_add event then adds the
dynamic VLAN as untagged to the same port. The result is that the
port is operating on the PVID bridge vlan, and not the dynamic VLAN.
Fixing this in netifd is going to be complex and take time, so this
change includes a workaround. When a wired client is authorized
using a dynamic VLAN, ucentral-event takes the following actions:
- Remove the bridge VLAN from the port
bridge vlan del dev <port> vid <bridge-vlan>
- Modify the dynamic VLAN to PVID
bridge vlan add dev <port> vid <dynamic-vlan> pvid untagged
Fixes: WIFI-13358
Signed-off-by: Paul White <paul@shasta.cloud>
There are use cases where it's helpful to know the vlan_id assigned to a
client (dynamic VLAN) when consuming the sta-authorized ubus event
Signed-off-by: Paul White <paul@shasta.cloud>
When an uplink interface is created for a DVLAN due to swconfig support,
add this new interface to dhcpsnoop
Signed-off-by: Paul White <paul@shasta.cloud>
Added the new ubus command 'add_devices' which takes the same devies
JSON schema data as the 'config' command does. This is needed, for
example, to add dynamic VLAN uplink devices once they are created
Signed-off-by: Paul White <paul@shasta.cloud>
3093a56 track upstream vlans created by swconfig
605ed2f bridge-vlan: add wan port only behind swconfig
bfd4a07 Fix state/interface.ssid.yml
Fixes: WIFI-13316
Signed-off-by: John Crispin <john@phrozen.org>
f19b1e8 add support for the "fixedconfig" command
ca090c4 add default settings section to connect message
Signed-off-by: John Crispin <john@phrozen.org>
Since QC only supports IPQ5018 + QCN9000 combination perfectly in kernel
4.4, thus remove OptimCloud D series support in ipq807x_v5.4 and migrate
to ipq807x
Signed-off-by: HaiBac <mail@bacnh.com>
Export MCU related 'reset' and 'serial bootloader' pins in sysfs using
'gpio-export' as 'mcu-enable' and 'mcu-bootloader'.
Default configuration of MCU related pins will keep MCU in reset state,
with the serial bootloader enabled.
While at it, fix also trailing white space error in 'gpio_keys' node.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds configuration for 'reset' and 'serial bootloader' dedicated
pins connected to the on-board CC2652R MCU.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Export MCU related 'reset' and 'serial bootloader' pins in sysfs using
'gpio-export' as 'mcu-enable' and 'mcu-bootloader'.
Default configuration of MCU related pins will keep MCU in reset state,
with the serial bootloader enabled.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds configuration for 'reset' and 'serial bootloader' dedicated
pins connected to the on-board CC2652R MCU. While at it, drop probably
unused 'ble_coex_grant' pin configuration node.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
if the interface is down due to ip-collide detection, config apply
fail as the dnsmasq init script would loop endlessly.
Signed-off-by: John Crispin <john@phrozen.org>
7b4cb42 always enable rrm until the new data model is added
3d9bd65 add channel utilization and assoc count to wifi scan results
Signed-off-by: John Crispin <john@phrozen.org>
This reverts commit 8111566f35.
After switching to 'OpenWrt 23.05' release tree we no longer need
separate BlueZ 5.66 package as it's available in upstream feed.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Drop 'phy_led_pins' node which duplicates configuration for 'gpio46',
used in different place ('led_cloud' node). This solves below error:
'pin GPIO_46 already requested by 1000000.pinctrl; cannot claim for leds'
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
41e3b03 revert "public_ip_lookup" patch
a711d79 add wifi-bands to admin-ui
a83832d trigger ucentral-state reload once apply is complete
cbb858d add admin-ui support
a1ff9ba unify the state uci file
aae470c set default port for uhttpd
acb08a4 trigger health/state via the new state daemon
Signed-off-by: John Crispin <john@phrozen.org>
# example com-wr.sh /dev/ttyMSM1 1 "\x01\x1D\xFC\x01\x00" | hexdump.sh --> send "\x01\x1D\xFC\x01\x00" to /dev/ttyMSM1 and then hexdump receive data until 100ms timeout
#command example "\x7E\x03\xD0\xAF und normaler Text"
cc2562-wr.sh /dev/ttyMSM1 3"\x01\x1D\xFC\x01\x00" > /dev/null # this command dealy time must >= 3, if small then 3, the following commands will be something wrong
setState(SBL_PORT_ERROR,"No response from device. Device may not be in bootloader mode. Reset device and try again.\nIf problem persists, check connection and baud rate.\n");
# ELTT2 - Infineon Embedded Linux TPM Toolbox 2 for TPM 2.0
All information in this document is Copyright (c) 2014-2022, Infineon Technologies AG <br>
All rights reserved.
# 1. Welcome
Welcome to Embedded Linux TPM Toolbox 2 (ELTT2). ELTT2 is a single-file executable program intended for testing, performing diagnosis and basic state changes of the Infineon Technologies TPM 2.0.
## 1.1 Prerequisites
To build and run ELTT2 you need GCC and a Linux system capable of hosting a TPM.
ELTT2 may run on many other little-endian hardware and software configurations capable of running Linux and hosting a TPM, but this has not been tested.
ELTT2 does not support machines with a big-endian CPU.
## 1.2 Getting Started
A TPM 2.0 evaluation board can be ordered in the [Hitex Webshop](https://www.ehitex.de/evaluation-boards/infineon/2564/iridium-9670-tpm2.0-spi).
In order to execute ELTT2, you need to compile it first:
1. Switch to the directory with the ELTT2 source code
2. Compile the source code by typing the following command:
make
Due to hardware (and thus TPM) access restrictions for normal users, ELTT2 requires root (aka superuser or administrator) privileges. They can be obtained e.g. by using the 'sudo' command on Debian Linux derivates.
The Infineon [TPM 2.0 Application Note](https://www.infineon.com/dgdl/Infineon-App-Note-SLx9670-TPM2.0_Embedded_RPi_DI_SLx-AN-v01_20-EN.pdf?fileId=5546d46267c74c9a01684b96e69f5d7b) shows how the TPM device driver can be set up (e.g. for Linux Kernel 4.14).
# 2. Usage of ELTT2
## 2.1 Generic Usage
ELTT2 is operated as follows:
Call: `./eltt2 <option(s)>`
For example: `./eltt2 -g` or `./eltt2 -gc`
For getting an overview of the possible commands, run `./eltt2 -h`
Some options require the TPM to be in a specific state. This state is shown in brackets ("[]") behind each command line option in the list below:
\[-\]: none <br>
\[\*\]: the TPM platform hierarchy authorization value is not set (i.e., empty buffer) <br>
\[l\]: the required PCR bank is allocated <br>
\[u\]: started <br>
To get the TPM into the required state, call ELTT2 with the corresponding commands ("x" for a state means that whether this state is required or not depends on the actual command or the command parameters sent eventually to the TPM).
With the "-a" command you can hash given data with the SHA-1/256/384 hash algorithm. This hash sequence sends 3 commands \[start, update, complete\] to the TPM and allows to hash an arbitrary amount of data. For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -a 41624364` Hash given data with SHA-1 hash algorithm. <br>
or <br>
`./eltt2 -a sha1 41624364` Hash given data with SHA-1 hash algorithm. <br>
`./eltt2 -a sha256 41624364` Hash given data with SHA-256 hash algorithm. <br>
`./eltt2 -a sha384 41624364` Hash given data with SHA-384 hash algorithm. <br>
`-A`: <br>
With the "-A" command you can hash given data with the SHA-256 hash algorithm. This hash sequence sends 3 commands \[start, update, complete\] to the TPM and allows to hash an arbitrary amount of data. For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -A 41624364`
`-b`: <br>
With the "-b" command you can enter your own TPM command bytes and read the TPM response. For example, use the following command to send a TPM2_Startup with startup type CLEAR to the TPM: <br>
`./eltt2 -b 80010000000C000001440000`
`-c`: <br>
With the "-c" command you can read the clock values of the TPM.
`-d`: <br>
With the "-d" command you can issue a TPM shutdown. It has 2 options: <br>
`./eltt2 -d` <br>
or <br>
`./eltt2 -d clear` send a TPM2_Shutdown command with shutdown type CLEAR to the TPM. <br>
`./eltt2 -d state` send a TPM2_Shutdown command with shutdown type STATE to the TPM. <br>
`-e`: <br>
With the "-e" command you can extend bytes in the selected PCR with SHA-1/256/384. To do so, you have to enter the index of PCR in hexadecimal that you like to extend and the digest you want to extend the selected PCR with. Note that you can only extend PCRs with index 0 to 16 and PCR 23 and that the digest must have a length of 20/32/48 bytes (will be padded with 0 if necessary). The TPM then builds an SHA-1/256/384 hash over the PCR data in the selected PCR and the digest you provided and writes the result back to the selected PCR. For example, use the following command to extend PCR 23 (0x17) with the byte sequence {0x41, 0x62, 0x43, 0x64, 0x00, ... (will be filled with 0x00)}: <br>
`./eltt2 -e 17 41624364` Extend bytes in PCR 23 with SHA-1. <br>
or <br>
`./eltt2 -e sha1 17 41624364` Extend bytes in PCR 23 with SHA-1. <br>
`./eltt2 -e sha256 17 41624364` Extend bytes in PCR 23 with SHA-256. <br>
`./eltt2 -e sha384 17 41624364` Extend bytes in PCR 23 with SHA-384. <br>
`-E`: <br>
With the "-E" command you can extend bytes in the selected PCR with SHA-256. To do so, you have to enter the index of PCR in hexadecimal that you like to extend and the digest you want to extend the selected PCR with. Note that you can only extend PCRs with index 0 to 16 and PCR 23 and that the digest must have a length of 32 bytes (will be padded with 0 if necessary). The TPM then builds an SHA-256 hash over the PCR data in the selected PCR and the digest you provided and writes the result back to the selected PCR. For example, use the following command to extend PCR 23 (0x17) with the byte sequence {0x41, 0x62, 0x43, 0x64, 0x00, ... (will be filled with 0x00)}: <br>
`./eltt2 -E 17 41624364`
`-g`: <br>
With the "-g" command you can read the TPM's fixed properties.
`-v`: <br>
With the "-v" command you can read the TPM's variable properties.
`-G`: <br>
With the "-G" command you can get a given amount of random bytes. Note that you can only request a maximum amount of 32 random bytes at once. For example, use the following command to get 20 (0x14) random bytes: <br>
`./eltt2 -G 14`
`-l`: <br>
With the "-l" command you can allocate the SHA-1/256/384 PCR bank. Take note of two things. Firstly, the command requires a platform authorization value and it is set to an empty buffer; hence the command cannot be used if the TPM platform authorization value is set (e.g., by UEFI). Secondly, when the command is executed successfully a TPM reset has to follow for it to take effect. For example, use the following command to allocate a PCR bank: <br>
With the "-r" command you can read data from a selected SHA-1/256/384 PCR. For example, use the following command to read data from PCR 23 (0x17): <br>
`./eltt2 -r 17` Read data from SHA-1 PCR 23. <br>
or <br>
`./eltt2 -r sha1 17` Read data from SHA-1 PCR 23. <br>
`./eltt2 -r sha256 17` Read data from SHA-256 PCR 23. <br>
`./eltt2 -r sha384 17` Read data from SHA-384 PCR 23. <br>
`-R`: <br>
With the "-R" command you can read data from a selected SHA-256 PCR. For example, use the following command to read data from PCR 23 (0x17): <br>
`./eltt2 -R 17`
`-s`: <br>
With the "-s" command you can hash given data with the SHA-1/256/384 hash algorithm. This command only allows a limited amount of data to be hashed (depending on the TPM's maximum input buffer size). For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -s 41624364` Hash given data with SHA-1 hash algorithm. <br>
or <br>
`./eltt2 -s sha1 41624364` Hash given data with SHA-1 hash algorithm. <br>
`./eltt2 -s sha256 41624364` Hash given data with SHA-256 hash algorithm. <br>
`./eltt2 -s sha384 41624364` Hash given data with SHA-384 hash algorithm. <br>
`-S`: <br>
With the "-S" command you can hash given data with the SHA-256 hash algorithm. This command only allows a limited amount of data to be hashed (depending on the TPM input buffer size). For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -S 41624364`
`-t`: <br>
With the "-t" command you can issue a TPM selftest. It has 3 options: <br>
`./eltt2 -t` <br>
or<br>
`./eltt2 -t not_full` Perform a partial TPM2_Selftest to test previously untested TPM capabilities. <br>
`./eltt2 -t full` Perform a full TPM2_Selftest to test all TPM capabilities. <br>
`./eltt2 -t incremental` Perform a test of selected algorithms.
`-T`: <br>
With the "-T" command you can read the results of a previously run selftest.
`-u`: <br>
With the "-u" command you can issue a TPM startup command. It has 2 options: <br>
`./eltt2 -u` <br>
or <br>
`./eltt2 -u clear` send a TPM2_Startup with startup type CLEAR to the TPM. <br>
`./eltt2 -u state` send a TPM2_Startup with startup type STATE to the TPM.
`-z`: <br>
With the "-z" command you can reset a selected PCR. Note that you can only reset PCRs 16 and 23. For example, use the following command to reset PCR 23 (0x17): <br>
`./eltt2 -z 17`
## 2.2 Examples:
In order to work with the TPM, perform the following steps:
- Send the TPM2_Startup command: `./eltt2 -u`
# 3. If you have questions
If you have any questions or problems, please read the section "FAQ and
Troubleshooting" in this document.
In case you still have questions, contact your local Infineon
Representative.
Further information is available at <https://www.infineon.com/tpm>.
# 4. FAQ and Troubleshooting
If you encounter any error, please make sure that
- the TPM is properly connected.
- the TPM driver is loaded, i.e. check that "/dev/tpm0" exists. In case of driver loading problems (e.g. shown by "Error opening device"), reboot your system and try to load the driver again.
- ELTT2 has been started with root permissions. Please note that ELTT2 needs root permissions for all commands.
- the TPM is started. (See section 2.2 in this document on how to do this.)
The following list shows the most common errors and their solution:
The ELTT2 response is "Error opening the device.":
- You need to load a TPM driver before you can work with ELTT2.
- You need to start ELTT2 with root permissions.
The ELTT2 responds with error code 0x100.
- You need to send the TPM2_Startup command, or you did send it twice. In
case you have not sent it yet, do so with `./eltt2 -u`.
The TPM does not change any of the permanent flags shown by sending the "-g"
command , e.g. after a force clear.
- The TPM requires a reset in order to change any of the permanent flags.
Press the reset button or disconnect the TPM to do so.
The value of a PCR does not change after sending PCR extend or reset.
- With the application permissions you cannot modify every PCR. For more
details, please refer to the description for the different PCR commands
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.