**SPECIFICATIONS:**
SOC: Qualcomm IPQ6018 (64-bit quad-core ARM Cortex-A53 @ 1.8Ghz)
Flash: SPI NOR 8MB + NAND 128MB
Memory: 1GB
2.4GHz Frequency Band: 2.4GHz ~ 2.484GHz (802.11 b/g/n/ax)
5GHz Frequency Band: 5.150GHz～5.850GHz (802.11 a/n/ac/ax)
Wireless Speed: 2.4GHz: 574Mbps, 5GHz: 1201Mbps
**BACKUP YOUR STOCK FIRMWARE:**
- Put openwrt-*-initramfs-kernel.bin to your TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli and exec these commands:
```
tftpboot <your_tftp_server_ip>:initramfs.bin
bootm
```
- Once boot completed and you get the openwrt shell execute below commands:
```
device=<device_name>
mkdir -p /tmp/fw_backup; cd /tmp/fw_backup
rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
dd if=/dev/${rootfs} of=rootfs_${rootfs} bs=1M
dd if=/dev/${rootfs_1} of=rootfs_1_${rootfs_1} bs=1M
cp /sys/firmware/fdt fdt.dtb
md5sum * > md5sum
tar -cvzf /tmp/${device}.tar.gz .
sum=$(md5sum /tmp/${device}.tar.gz | cut -d' ' -f1)
mv /tmp/${device}.tar.gz /tmp/${device}_${sum}.tar.gz
echo "stock fw backup saved to: /tmp/${device}_${sum}.tar.gz"
```
- Upload/save your backup to a safe place.
**STOCK FIRMWARE RECOVERY:**
- Boot initramfs image
- Upload your backed-up stock fw tarball to the device
using scp or download it from the device using wget.
- Enter device ssh cli or tty and exec:
```
cd /tmp && wget <your_web_server_ip>/${stock_fw_backup}.tar.gz`
tar -xpzf ${stock_fw_backup}.tar.gz
rootfs=$(cat /proc/mtd | grep \"rootfs\" | cut -d: -f1)
rootfs_1=$(cat /proc/mtd | grep \"rootfs_1\" | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f /tmp/rootfs_${rootfs}
ubiformat /dev/${rootfs_1} -y -f /tmp/rootfs_1_${rootfs_1}
reboot
```
**INSTALLATION:**
1. initramfs method
- Put openwrt-*-initramfs-kernel.bin to your TFTP server and rename it to initramfs.bin
- Enable serial console and enter to u-boot cli and exec these commands:
```
tftpboot <your_tftp_server_ip>:initramfs.bin
bootm
```
- Once boot completed and you get the openwrt shell execute below commands:
```
cd /tmp && wget <your_web_server_ip>/factory.ubi`
export rootfs=$(cat /proc/mtd | grep rootfs | cut -d: -f1)
export rootfs_1=$(cat /proc/mtd | grep rootfs_1 | cut -d: -f1)
ubiformat /dev/${rootfs} -y -f factory.ubi
ubiformat /dev/${rootfs_1} -y -f factory.ubi
reboot
```
2. u-boot nand-factory.bin image method
- Put openwrt-*-squashfs-nand-factory.bin to your TFTP server and enter u-boot cli and exec these commands:
```
tftpboot <your_tftp_server_ip>:factory.bin
#After downloading is finished:
imxtract 0x44000000 ubi
flash rootfs
flash rootfs_1
reset
```
Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
During 802.11r Fast Transition roaming, when a client moves between
APs (e.g., wlan0 to wlan1) with the same dynamic VLAN assignment, the
vlan_add handler's refcount mechanism prevented the new WiFi interface
from being added to the bridge.
When wlan0-v100 and wlan1-v100 exist simultaneously with VLAN ID 100,
the refcount becomes 2, causing vlan_add to exit early for wlan1-v100.
This left wlan1-v100 out of the bridge VLAN table, breaking connectivity
after roaming despite correct VLAN assignment via RADIUS and RRB frames.
Fix by detecting WiFi VLAN interfaces (wlan*-v*) and always adding them
to the bridge regardless of refcount. The refcount mechanism now only
controls WAN port VLAN configuration, which should only occur once per
VLAN ID.
Also reorganise vlan_add/vlan_remove to check swconfig early for clarity.
Signed-off-by: John Crispin <john@phrozen.org>
Enable CONFIG_LEDS_TRIGGER_HEARTBEAT to allow LED heartbeat
functionality when device goes offline. Without this kernel option,
the LED trigger mechanism was unavailable, preventing the LED from
flashing to indicate offline status.
Fixes: WIFI-14646
Signed-off-by: John Crispin <john@phrozen.org>
When a station roams between bands on the same VLAN, the vlan_remove
event from the old band can arrive after the vlan_add event from the
new band, causing the VLAN to be incorrectly deleted whilst still in use.
Add reference counting that tracks how many interfaces are using each
VLAN ID. Only create VLAN devices on the first reference and only
remove them when the last reference is dropped.
On startup, initialise refcounts from current station state to handle
daemon restarts correctly.
Signed-off-by: John Crispin <john@phrozen.org>
676e155 dhcp_inject: fix a syntax issue in dhcp_inject
e594c44 captive.uam.mac-auth: the default was wrong
Signed-off-by: John Crispin <john@phrozen.org>
LAN switch exposes single eth1 instead of per-port interfaces for RAP750W-311A.
Using VLAN to separate LAN to each physical port for RAP750W-311A.
Fixes: WIFI-15163
Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
make openwrt/profiles relative so moving or renaming the repo directory won't break the symlink
Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
Changelog:
- Fix MAC address assignment for Ethernet ports
- Fix Ethernet port configuration (was not working in the current DTS
because GPIOs 23 and 24, used for LEDs, are RGMII2 pins)
- Add package kmod-7915-firmware to enable Wi-Fi
Signed-off-by: Shubham Vishwakarma <shubhamvis98@fossfrog.in>
Set max_ap_assoc at wiphy init instead of vif init for mt7915.
Hard code max_ap_assoc to 128 for EAP112 in wifi_max_user.uc
Fixes WIFI-15027
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
100c045 Fix cloud cannot show association list when WDS-AP in state.uc
168f6a4 dhcp_inject: Support multiple upstream
Signed-off-by: John Crispin <john@phrozen.org>
Introduce a blocklist mechanism to avoid retrying failed discovery
methods within the same discovery cycle. Each time a method fails
validation, it is added to the blacklist. The blacklist is cleared
once the device transitions to ONLINE or after all discovery methods
have been attempted.
This prevents repeated attempts of failing methods and ensures the
discovery process progresses more reliably.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
In cases where gateway.json exists, the discovery method may be unset.
Writing an empty value to discovery.state.json is not useful, so
avoid updating the file in this case.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Always obtain EST certificates before starting the discovery process.
This ensures certificates are already available from the EST server, since
the FQDN may be provided via DHCP discovery or another discovery method,
and requires valid certificates to proceed.
Fixes: WIFI-15123
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Commit 2e4972e9ad ("ipq53xx: Add KERNEL_IPQ_MEM_PROFILE for IPQ53XX")
introduced KERNEL_IPQ_MEM_PROFILE but didn't set it for all IPQ53xx
boards, causing them to boot with incorrect RAM size settings.
This adds CONFIG_KERNEL_IPQ_MEM_PROFILE=0 to the affected board profiles:
- cig_wf189, cig_wf189h, cig_wf189w, cig_wf672
- edgecore_eap105
- sonicfi_rap7110c-341x
Signed-off-by: John Crispin <john@phrozen.org>
Reverse byte order in non-OUI part of MAC address to prevent overlap
when MBSSID is enabled. Swaps bytes 3 and 5 and masks lower nibble
of byte 5 before applying index XOR.
Signed-off-by: John Crispin <john@phrozen.org>
Ensure that LEDs are configured to be ON before attempting to change their state.
Previously, if the LED was configured to be OFF, it would still enter a double-blink
state when the cloud connection was lost, and then switch to solid ON upon
reconnection—ignoring the configured OFF state.
This update changes that behavior:
- If LEDs are configured OFF, they will remain OFF even during cloud
disconnection (no double-blink).
- After temporary state changes (e.g., during factory reset), the LED will
return to its configured state (either OFF or ON).
Signed-off-by: Paul White <paul@shasta.cloud>
The MIB loop cnt variable was defined as a static variable in the function that
implements the loop, however this function can be called for more than one switch
on some platforms. This results in a race condition that leads to memory
corruption and kernel crashes.
The fix moves the loop cnt variable to the passed in switch handle, this way
there is one per switch chip. Thix fix was identified by looking at newer
versions of the qca-ssdk software package from QCA.
Signed-off-by: Paul White <paul@shasta.cloud>
A scenario was seen where UCI config was not flushed to disk before
an AP power-cycle after uci-defaults was completed. Since these
scripts are deleted after being ran once, there is no way to recover
without a factory reset.
Adding this sync operation proved to help avoid this situation from
happening
Signed-off-by: Paul White <paul@shasta.cloud>
Adds support for recording the method used to discover the cloud
controller (e.g. DHCP, FLASH, OpenLAN).
The selected method records the current date and time along
with the discovery method into "/etc/ucentral/discovery.state.json".
The date is stored in epoch format.
Fixed: WIFI-14966
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
cloud_discovery will not start if the CN does not match the devices serial.
an error will be written to syslog
---
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: The certificate used has a CN that does not match the serial of the device
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
Wed Aug 6 14:23:23 2025 user.notice root: ERROR
---
Signed-off-by: John Crispin <john@phrozen.org>
The daemon will check the vailidity of the operational certificate once and hour.
If the certificate is valid for less than three days, a reenrollment is attempted.
Once the reenroll happened the connection to the cloud controller will be restarted.
Fixes: WIFI-14900
Fixes: WIFI-14694
Signed-off-by: John Crispin <john@phrozen.org>
The updated flow:
- Mount /dev/mtdblock* (the certificates partition) to /mnt
- Copy its contents to /certificates
- Unmount /mnt
- Extract the PKI 2.0 certificates into /certificates
Fixes: WIFI-14904
Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
To fix EMI and avoid Ethernet RX stuck after reboot for Zyxel NWA130BE.
Ethernet Rx stuck was sometimes happened when we do stress reboot,
need to adjust the amplitude level of SGMII for CPU and QCA8385 side.
And those settings come from the result that Zyxel HW team and Manufacturer
co-work to fine tune for NWA130BE.
Signed-off-by: YenLin Pan <YenLin.Pan@zyxel.com.tw>
92fb3c1 WIFI-14901: Add rrm_chanutil status to health.uc (when it fails) and save health metric in /tmp/ucentral.health
6313892 WIFI-14906: Add 'sync' after file generation in Cloud discovery process
Signed-off-by: John Crispin <john@phrozen.org>
This patch enhances WPA3 encryption support in netifd by introducing GCMP-256
cipher handling for wireless interfaces operating on the 6 GHz band with HE/EHT
modes.
Fixes: WIFI-14594
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
b971b73 Support HaLow Mesh on EAP112
7d28320 Fix in ucode script of config_raw to add multiple UCI sections via config-raw object of the schema
1453f2e chanUtil per radio shall be obtained from the policy_chanutil.uc script
fa26853 enable multiple bssid by default on 6G
Signed-off-by: John Crispin <john@phrozen.org>
Rate limiting was not applied on WiFi-7 devices because their
hostapd interface names use the phy* prefix instead of wlan*.
This patch extends the match pattern to include both wlan* and phy*.
Fixes: WIFI-14884
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
1. For EAP112 LTE module (Quectel EM60 series), when username and password is configured, it is required to update the context with the QICSGP AT command.
2. Use a handler function to check if the AT command is stuck and retry.
Fixes: WIFI-14545
Signed-off-by: Sebastian Huang <sebastian_huang@accton.com>
Description:
A missing ;; in the 02_network file for the ipq50xx target caused
improper network configuration across all ipq50xx platforms
(e.g., Edgecore EAP104, Cybertan RAP630C-311G).
This resulted in loss of Internet connectivity.
Fix:
Added the missing ;; in the appropriate case block.
Tests Performed:
Verified on Edgecore EAP104. Network configuration was applied
correctly and Internet connectivity was restored.
Fixes: WIFI-14847
Signed-off-by: Venkat Chimata <venkat@nearhop.com>
1. Copy modemmanager to feeds/ucentral.
2. Add function to find the device sysfs path when protocol is "wwan".
3. Call ifup when modem is ready for connection.
4. Add trigger to restart modemmanager when network uci is updated.
Fixes: WIFI-14751
Signed-off-by: Sebastian Huang <sebastian_huang@accton.com>
* Reduce the i2c frequency to enable the encryption chip to be recognized
* Add USB xr Serial driver and init gps uart param
* Factory reset when switching wifi mode
* SFP gpio should be input mode
Fixes: WIFI-14789
Signed-off-by: Justin.Guo <guoxijun@actiontec.com>
1.Change the WiFi temperature threshold.
2.Use single antenna when temperature is too high.
Fixes: WIFI-14788
Signed-off-by: Justin.Guo <guoxijun@actiontec.com>
2819f87 HaLow: fix channel 8/24/40 cannot be set
3b04c09 HaLow: set default channel to avoid HaLow not working when no channel set by JSON
Signed-off-by: John Crispin <john@phrozen.org>
2b8a58b dont crash if udevmand does not reply
985f3cb WIFI-14588: Cloud Package Manager
Fixes: WIFI-14752
Signed-off-by: John Crispin <john@phrozen.org>
Support user to control PSE on/off (chip: tps23861) via ucentral config file.
Use uci-default to write poe's uci default file.
Fixes: WIFI-14724
Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
125a148 add PoE support for client ports
17b6c18 Cloud Package Manager
a86b8b0 Fix typo in enhanced MPSK property name
57852ed update schema.json to 4.1.0
e155483 command: update upgrade and factory commands to handle new operational certs
Signed-off-by: John Crispin <john@phrozen.org>
If MPSK is enabled on any interface, `ssid.mpsk` should be true.
Prevents overwriting true with a false value when multiple interfaces
share the same SSID.
Also allow handling of the 'reload' event even when MPSK is not enabled,
to ensure config reloads are not skipped, e.g. when configuration is empty.
Fixes: WIFI-14484
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
After roaming to EAP105, the roaming frames were exchanged successfully,
but the STA sent a deauthentication frame to the AP with an "INVALID IE" error.
The RSNXE subfield in the FTIE was set in the Reassociation Response frame.
The STA validated the Reassociation frame and was unable to process the
RSNXE subfield.
Modified SAE options (sae_pwe=4 and sae_require_pmf=0).
Fixes: WIFI-14544
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
A printk() was previously introduced that is passing the log level as the first argument
instead of prefixing the format with the level. Given this code path, this is causing a
kernel fault and CPU reboot without any kernel panic/stack trace, since it's crashing
inside of printk().
CPU:0 ts:206871944795 ffffffc008dcf828 ffffffc008dfe914 cleanup_module [batman_adv] <- cfg80211_vendor_cmd_reply+0x7ff4/0xa064 [cfg80211]
CPU:0 ts:206871944800 ffffffc0108e69d0 ffffffc008dcf80c printk <- cleanup_module+0xb22c/0xa20 [batman_adv]
CPU:0 ts:206871944802 ffffffc0101173c0 ffffffc0108e6a08 vprintk_func <- printk+0x60/0x6c
CPU:0 ts:206871944806 ffffffc010115e44 ffffffc0101160ec vprintk_emit <- vprintk_default+0x4c/0x60
CPU:0 ts:206871944809 ffffffc0101172d0 ffffffc010115e88 __printk_safe_enter <- vprintk_emit+0x84/0x29c
CPU:0 ts:206871944812 ffffffc010115c20 ffffffc010115ec4 vprintk_store <- vprintk_emit+0xc0/0x29c
CPU:0 ts:206871944816 ffffffc0100a53a4 ffffffc010080fb4 do_translation_fault <- do_mem_abort+0x54/0xb0
CPU:0 ts:206871944819 ffffffc0100a4eb4 ffffffc0100a5448 do_page_fault <- do_translation_fault+0xc8/0xe0
CPU:0 ts:206871944821 ffffffc0100a4d08 ffffffc0100a5038 __do_kernel_fault <- do_page_fault+0x1a8/0x4f0
CPU:0 ts:206871944837 ffffffc0100a4c88 ffffffc0100a4df0 die_kernel_fault <- __do_kernel_fault+0x110/0x1b0
After applying the fix, we can see this code path is being hit:
[26799.175166] cfg80211_calculate_bitrate_he: invalid rate->nss: 0
This still doesn't fix the original issue triggering this code path, which is why a nss value
of 0 is being reported.
Fixes: eb9cbaec7 ("ipq807x: Shorten the kernel backtrace warning msg for ieee80211_bss_get_elem")
Fixes: WIFI-14677
Signed-off-by: Paul White <paul@shasta.cloud>
Fix the case where firmware crashes when STA sends AUTH with same
MAC address to multiple SSIDs on the same radio.
Fixes: WIFI-13276
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
When using psk2-radius in combination with enhanced MPSK,
the passphrase was not properly propagated to user scripts
via the ucode interface, because the PSK field was not set
in the connected station context.
This patch fixes that by copying the passphrase into the
psk field.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
For the Edgecore EAP-105 platform, configure the 2.4GHz, 5GHz,
and 6GHz WLAN interfaces to use MAC addresses derived
from the base WAN MAC address.
Fixes: WIFI-14624
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
* While Roaming the AP couldn't find the wildcard R0KH and R1KH ids,
which are required by Fast transistion.
* Issue caused by the placement of conf parser in the invalid location.
Fixes: WIFI-14544
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
9710867 (HEAD -> main, origin/main, origin/HEAD) make the MTU configurable on GRE tunnels
4dd0904 SSH IdleTimeout can be configured from JSON config
6faaa1f HaLow: Extend ucentral schema & state for HaLow
Signed-off-by: John Crispin <john@phrozen.org>
6faaa1f HaLow: Extend ucentral schema & state for HaLow
aa9cac5 dhcp_inject: Use same keyword "dhcp-inject" in config file
Signed-off-by: John Crispin <john@phrozen.org>
1. porting MorseMicro HaLow driver to support HaLow on EAP112
2. Only support FCC regulation because of hardware limitation
3. Add /etc/init.d/halow-gpio-reset to initialize HaLow chip in early stage
4. Add /etc/uci-defaults/aaa-fix-phy0-to-morse to correct the default uci for HaLow radio.
Signed-off-by: Ian Chen <ian77_chen@accton.com>
* add "limit_rtlphy_10g_ablity" in DTS , no side effect on other product.
* disable 10G capability if DTS defined limit_rtlphy_10g_ablity , no side effect on other product.
* revert the last 0006-qca-ssdk-Fix-10G-rtl-phy-driver-for-c45-mdio-read-wr.patch and based on 0005 patch.
Fixes: WIFI-14567
Signed-off-by: Ken Shi <xshi@actiontec.com>
Added check when parsing ssid info retrieved from iwinfo.
Program will exit if expected interface count and iwinfo entry count mismatch.
Fixes: WIFI-14564
Signed-off-by: alex18_huang <alex18_huang@accton.com>
The main reason was adding missed functionality for Radius
configuration which caused rejecting WiFi clients on
authentication level.
Still some changes not included:
* AFC,
* hs20_release,
* multiple_bssid,
* he_co_locate
Fixes: WIFI-14459
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
- avoid calculated Channel Utilization value to be 'infinity' from cycle_count_delta being '0'
Fixes: WIFI-14536
Signed-off-by: Tanya Singh <tanya_singh@accton.com>
Program sometimes did not setup tc qdisc on some interfaces when creating SSID with dhcpinject enabled initially.
Added delayed startup.
Fixes: WIFI-14522
Signed-off-by: alex18_huang <alex18_huang@accton.com>
The bug was in the upstream hostapd codebase, backport/rebase the fix
--> ba150059d1ec964add8f29eb2c92dd6dfde97308
Fixes: WIFI-14508
Signed-off-by: John Crispin <john@phrozen.org>
246873b add max-inactivity to ssid config
3b5a5c4 Allow option 82 DHCP fields to be transparently injected into client DHCP requests
Signed-off-by: John Crispin <john@phrozen.org>
During roaming validation, an issue was detected with
the ASSOC-REJECT event, which had a status code of 55.
To resolve this, the SNonce from the Auth Request Frame
was copied, and the random ANonce is now used
only when expired.
Fixes: WIFI-14326
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Fix removing rhash when station is roaming between radios and
apply logic from opensource driver during adding/removing
peer.
Fixes: 7374c39d ("ath11k: fix STA roaming between radios")
Fixes: WIFI-14457
Signed-off-by: Arif Alam <arif.alam@netexperience.com>
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
1. Integrated WiFi boarddata
2. Integrated LEDs
3. sysupgrade changes are integrated
4. Network ports are enumerated
5. A new profile is added under profiles
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
c2338ad snmp: fix schema/yaml syntax
50c4ead set schema version to 4.0.0
d8260f8 add property that allows disabling MPSK
Signed-off-by: John Crispin <john@phrozen.org>
1c11c1b WIFI-14284: Use swconfig to get the correct port to VLAN ID mapping for statistics
Fixes: WIFI-14284
Signed-off-by: John Crispin <john@phrozen.org>
d2ff805 Change realtime events type from enum to string
a518b02 schema, ssid: add mpsk-radius encryption
Signed-off-by: John Crispin <john@phrozen.org>
Add casting center frequency to int, previosly was used
string.
{
"dev": "wlan1",
"wiphy_freq": "5180",
"measurement_duration": "70",
"center_freq1": "518030",
"scan_ssids": [
""
],
"scan_flags": 4
}
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Update scan module to support WiFi 7 devices
which have virtual phys defined. Scanning on
the different virtual phys but on the same physical
phy isn't allowed.
Add NL CBs to notify about scanning progress.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Need to unblock chandef as scanning definitions which
is used by TIP modules for scanning trigger.
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Invalid logical operator was used for checking null
pointers in channel_switch function: AND instead OR
Fixes: 7477963b ("ucentral-event: add channel switch handler")
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Broadcast / Multciast transmission is not working in DVLAN mode in the driver.
If we send the frames as unicast frames, it works. This is a workaround for now.
Need to rollback once we add a clean fix.
Fixes: WIFI-14441
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
Add channel switch handler to update hapd object
with new frequency and channel info.
Fixes: WIFI-14336
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
"bandwidth_up", and "bandwidth_down" had typos. The correct attributes are
"bandwidth-up", and "bandwidth-down"
Signed-off-by: Firas Shaari <firas.shaari@shaariconsultancy.com>
Specifications:
SoC: MediaTek MT7981BA
RF Chipset: MT7976DA @2.4GHz 2T2R
MT7976DA @5ghz 2T2R
RAM: 512MB DDR4 RAM
Flash: SPI-NAND 256 MiB
Ethernet: 2 x 1GbE PHY
Reset Button
Power Source: DC IN 12v, Standard PoE 802.3af/at
LED Indicator: 1 x single color LED (GPIO Control)
Fixes: WIFI-14312
Signed-off-by: steven.lin <steven.lin@senao.com>
f0dfb40 Include DHCP VSI information in state message
44da3d6 Add config for vendor-class and request-options
a21635b always request option 43 and 224 when doing DHCP
Signed-off-by: John Crispin <john@phrozen.org>
Specifications:
SoC: MediaTek MT7986A
RF Chipset: MT7976G @2.4GHz 4T4R
MT7976A @5ghz 4T4R
RAM: 1GB DDR4 RAM (2x 512MB)
Flash: SPI-NAND 256 MiB
Ethernet: 1x 2.5GbE PHY
Reset Button
Power Source: DC IN 12v, Standard PoE 802.3af/at
LED Indicator: 4 x single color LED (GPIO Control)
Fixes: WIFI-13983
Signed-off-by: Steven Lin <steven.lin@senao.com>
baeef76 Revert "ucentral-schema: add support for configuring snmpd service using ucentral."
684a1aa firewall: upon up NAT'ed port 53 for ipv6
83a30b4 enable reconf for mpsk interfaces
Signed-off-by: John Crispin <john@phrozen.org>
42e59d5 Add system-password to the schema
8b3701b ucentral-schema: add support for configuring snmpd service using ucentral.
Signed-off-by: John Crispin <john@phrozen.org>
The device was not re-initialized if ony radio settings get updated without the
device settings changing.
Fixes: WIFI-14050
Signed-off-by: John Crispin <john@phrozen.org>
a626097 add schema for RRM based on Channel Utilization
39aed21 captive: allow loading the web-root from an external http server
37e3895 add multi-psk2-radius
Signed-off-by: John Crispin <john@phrozen.org>
Add controllable power LED support for -
CIG WF186W, CIG WF186H, CIG WF188N, CIG WF196, Edgecore EAP101 and
Edgecore EAP102 and Edgecore EAP104
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
To handle this, invoke hapd_subscriber.subscribe after the interface is created.
Also dont delete the interface from ifaces as ifaces should always contain the
configured ports (from uci config) per ieee8021x.uc design.
Deleting interfaces from ifaces will lead to ieee8021x.uc crashes.
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
Fix configurations for the WPA2 Enterprise example with 802.11r enabled for fast transitioning.
Signed-off-by: Firas Shaari <fshaari-c@telecominfraproject.com>
Fix null pointer dereference issue during Authentication stage and
add sanity check in mt7915_sta_statistics
Signed-off-by: John Crispin <john@phrozen.org>
In the bootcount script there was no entry for Edgecore EAP104 to
set the bootcount. This commit adds support for Edgecore EAP104 in
bootcount script to set the environment variable correctly
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
ubootenv_size is computed dynamically similar to ipq807x.
This resolves the issue where fw_setenv fails with the following error.
MTD erase error on /dev/mtd13: Invalid argument
Error: can't write fw_env to flash
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
In the backports driver the tx stats are updated in ieee80211_8023_xmit.
However in AP mode the packets are transmitted in ieee80211_8023_xmit_ap.
ieee80211_8023_xmit is not hit in case of AP mode. Update the stats just
before calling ieee80211_8023_xmit_ap
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
Enabling CPTCFG_ATH11K_MEM_PROFILE_512M will change the layout of
struct hal_rx_desc_ipq8074. This broke monitor mode. Fix it by not modifying
the struct even if the 512MB profile is enabled.
Fixes: WIFI-12102
Signed-off-by: John Crispin <john@phrozen.org>
This commit is an improvement over previous
commit 3598a243b3 which added a
fix for traffic disruption when vlan id of the lan port is
changed on devices with internal switches such as fap655,
CIG_WF186w,EAP-104.
This commit reconfigures the vlans for the mpsk clients on the
switch using the ucentral-event subsystem by tracking the
netifd_add events.
Fixes: WIFI-13797
Signed-off-by: joydeepbenison <joydeep.ghosh@benisontech.com>
ieee8021x
---------
1. Handle link_up events and update hostapd config
2. For certains scenarios, we need to remove and add
instead of reload (reload did not work).
Consider the following scenario -
Say on CIG 186w as an example
eth0.4086 interface exists with some non-ieee8021x config.
Push ieee8021x config. In general the flow is that
reload_config is called followed by invocation of services (from ucentral-schema)
Services inovation does n't wait until the configi reloaded ie in this context
ieee8021x service is invoked much before the network interfaces are recreated.
That is not correct. To handle this, we capture link-up events
and remove the existing interface (in hostapd as shown below) and add again
3. For swconfig platforms, the names contain a dot. Handle that gracefully in
ubus_unsub_object while adding hostapd interface
4. Add better logging using log.syslog
hostapd
---------
In case of swconfig switches, the basename of the interface should be based on the last dot.
Earlier it was done based on the first dot, which would result in incorrect basename.
For example if the interface name is eth0.4087 then the vlan->ifname would be eth0.4087. (A dot at the end) .
Before this patch, the basename was returned as eth0. It should be eth0.4087
Also fixed the return code by adding a default value of 0 and removed an unncessary check
for if_add before ubus add call.
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
when roaming between 2 radios the following error messages would show up in the logs
[681066.503943] ath11k c000000.wifi: Failed to add peer: 38:f9:d3:bf:b2:d4 for VDEV: 1
[681066.503979] ath11k c000000.wifi: Failed to add station: 38:f9:d3:bf:b2:d4 for VDEV: 1
Signed-off-by: John Crispin <john@phrozen.org>
dcd571e allow only psc on 6GHz auto channel selection
310095a captive: handle /logoff and /logout paths
7aceedc ratelimit: reload the service rather than restarting it
ce41668 fingerprint: add missing allow_wan option to render code
721568b Merge pull request #17 from Telecominfraproject/WIFI-431-fix-update-internal-schema-validation
7d05e70 more AFC fixes
Signed-off-by: John Crispin <john@phrozen.org>
Fixes WIFI-13428 : traffic disruption for FAP655,CIG_WF186w,EAP-104 for MPSK Clients when vlan id
of the lan port is modified . This Commit configures the dynamic vlans
on the switch of fap655 again after reset.
Signed-off-by: joydeepbenison <joydeep.ghosh@benisontech.com>
During CSA with DFS channels, disable, enable interface
is a part of the algorithm.
When interface was enabled old operating class before switch
and new channel were used causing mismatch in
configured_fixed_chan_to_freq function.
Example of log when switch from channel 157 to 108 was triggered:
"Could not convert op_class 124 channel 108 to operating frequency"
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Add options to trigger CSA with DFS channels, without
this patch ubus request was rejected:
ubus call hostapd.wlan0 switch_chan '{"freq":5260,"bcn_count":10}'
Command failed: Operation not supported
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
During CSA with DFS channels, disable, enable interface
is a part of the algorithm.
When interface was enabled old operating class before switch
and new channel were used causing mismatch in
configured_fixed_chan_to_freq function.
Example of log when switch from channel 157 to 108 was triggered:
"Could not convert op_class 124 channel 108 to operating frequency"
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Add options to trigger CSA with DFS channels, without
this patch ubus request was rejected:
ubus call hostapd.wlan0 switch_chan '{"freq":5260,"bcn_count":10}'
Command failed: Operation not supported
Fixes: WIFI-13385
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Add filtering the same vlans before adding to
the vlan config. The issue was detected during
connection many WiFi client using dynamic vlans
on the network.
Fixes: WIFI-13538
Signed-off-by: Marek Kwaczynski <marek@shasta.cloud>
Define the blue sys LED from the device tree as the POWER LED for the
CyberTAN EWW631-B1 platform. This allows LED control through uCentral
Signed-off-by: Paul White <paul@shasta.cloud>
Fixes: WIFI-13435
Signed-off-by: John Crispin <john@phrozen.org>
6704b5b83e9d smp: fix minor spelling typos
a0c5a18fa2a5 zcbor: upgrade zcbor to 0.7.0
52aee9047ec2 zcbor/smp: replace auto-generated code with zcbor functions
09606bc8e449 smp: print {en,de}code error with 'zcbor_peek_error'
b91c19ef5106 umcumgr/smp: allow disabling 'confirm' and 'test' commands
5849f7a503cd smp: restore timeout value for select()
45d9523c0c13 umcumgr: use 'stderr' for 'usage' only if error occurred
28d0044ab5b3 umcumgr: introduce support for TI serial bootloader
db34a3645b21 umcumgr: add support for 'dump' in TI serial bootloader mode
df3f235bcb3c smp: fix images list print
bde8686bac61 zcbor: upgrade zcbor to 0.8.1
ed34b2816f2b smp: adapt to changes introduced in zcbor 0.8.0
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This exports MCU/USB related pins in sysfs using 'gpio-export' on the
EdgeCore {E,O}AP102 boards as:
- mcu-enable
- usb-rear-power
- usb-side-power
- usb-hub-enable
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds configuration for pins connected with nRF52840 MCU (reset and
one apparently used by device vendor for DTM enable) and related to USB
(GL850G HUB reset and rear/side ports power) on the EdgeCore {E,O}AP102.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This change focuses on the I/O related cleanups for EdgeCore {E,O}AP102
DTS files. List of changes:
1. Remove 'usb_mux_sel' pinctrl mux
Defined label isn't used as reference in any other node and defined
GPIO isn't used as well.
2. Remove 'pci@20000000', related PHY and pinctrl mux nodes
{E,O}AP102 doesn't use of any of the IPQ8071A PCIe buses.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This was lost during kernel v4.4 to v5.4 migration. Bring back correct
pin configuration (only 2-pin) and UART node used by the on-board MCU.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The bootcount wasn't getting reset to 0 upon a successful boot,
resulting in falling back to the previous firmware version after three
reboots of the AP.
Fixes: WIFI-13359
Signed-off-by: Paul White <paul@shasta.cloud>
This adds a workaround to fix an issue with 802.1x + DVLANs on platforms
where LAN ports are through an integrated switch (swconfig).
Netifd is tracking the wired ports as part of a bridge-vlan: either a
static one, or 4090 for the default untagged bridge. When hostapd
authorizes the wired port, netifd is automatically adding this bridge
vlan as PVID untagged to the port. The vlan_add event then adds the
dynamic VLAN as untagged to the same port. The result is that the
port is operating on the PVID bridge vlan, and not the dynamic VLAN.
Fixing this in netifd is going to be complex and take time, so this
change includes a workaround. When a wired client is authorized
using a dynamic VLAN, ucentral-event takes the following actions:
- Remove the bridge VLAN from the port
bridge vlan del dev <port> vid <bridge-vlan>
- Modify the dynamic VLAN to PVID
bridge vlan add dev <port> vid <dynamic-vlan> pvid untagged
Fixes: WIFI-13358
Signed-off-by: Paul White <paul@shasta.cloud>
There are use cases where it's helpful to know the vlan_id assigned to a
client (dynamic VLAN) when consuming the sta-authorized ubus event
Signed-off-by: Paul White <paul@shasta.cloud>
When an uplink interface is created for a DVLAN due to swconfig support,
add this new interface to dhcpsnoop
Signed-off-by: Paul White <paul@shasta.cloud>
Added the new ubus command 'add_devices' which takes the same devies
JSON schema data as the 'config' command does. This is needed, for
example, to add dynamic VLAN uplink devices once they are created
Signed-off-by: Paul White <paul@shasta.cloud>
3093a56 track upstream vlans created by swconfig
605ed2f bridge-vlan: add wan port only behind swconfig
bfd4a07 Fix state/interface.ssid.yml
Fixes: WIFI-13316
Signed-off-by: John Crispin <john@phrozen.org>
f19b1e8 add support for the "fixedconfig" command
ca090c4 add default settings section to connect message
Signed-off-by: John Crispin <john@phrozen.org>
Since QC only supports IPQ5018 + QCN9000 combination perfectly in kernel
4.4, thus remove OptimCloud D series support in ipq807x_v5.4 and migrate
to ipq807x
Signed-off-by: HaiBac <mail@bacnh.com>
Export MCU related 'reset' and 'serial bootloader' pins in sysfs using
'gpio-export' as 'mcu-enable' and 'mcu-bootloader'.
Default configuration of MCU related pins will keep MCU in reset state,
with the serial bootloader enabled.
While at it, fix also trailing white space error in 'gpio_keys' node.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds configuration for 'reset' and 'serial bootloader' dedicated
pins connected to the on-board CC2652R MCU.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Export MCU related 'reset' and 'serial bootloader' pins in sysfs using
'gpio-export' as 'mcu-enable' and 'mcu-bootloader'.
Default configuration of MCU related pins will keep MCU in reset state,
with the serial bootloader enabled.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds configuration for 'reset' and 'serial bootloader' dedicated
pins connected to the on-board CC2652R MCU. While at it, drop probably
unused 'ble_coex_grant' pin configuration node.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
if the interface is down due to ip-collide detection, config apply
fail as the dnsmasq init script would loop endlessly.
Signed-off-by: John Crispin <john@phrozen.org>
7b4cb42 always enable rrm until the new data model is added
3d9bd65 add channel utilization and assoc count to wifi scan results
Signed-off-by: John Crispin <john@phrozen.org>
This reverts commit 8111566f35.
After switching to 'OpenWrt 23.05' release tree we no longer need
separate BlueZ 5.66 package as it's available in upstream feed.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Drop 'phy_led_pins' node which duplicates configuration for 'gpio46',
used in different place ('led_cloud' node). This solves below error:
'pin GPIO_46 already requested by 1000000.pinctrl; cannot claim for leds'
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
41e3b03 revert "public_ip_lookup" patch
a711d79 add wifi-bands to admin-ui
a83832d trigger ucentral-state reload once apply is complete
cbb858d add admin-ui support
a1ff9ba unify the state uci file
aae470c set default port for uhttpd
acb08a4 trigger health/state via the new state daemon
Signed-off-by: John Crispin <john@phrozen.org>
When a MPSK VLAN netdev is created on the cig.wf186w board, this script
will configure switch0 via swconfig for the corresponding VLAN
Signed-off-by: Paul White <paul@shasta.cloud>
81a786d add radius support to the ieee8021x service
ee0a87c ethernet port UCI sections should be named to prevent duplicate sections
Signed-off-by: John Crispin <john@phrozen.org>
Let qca thermald support IPQ50xx platform and has cooling function to limit the
duty cycle of tx queues
Signed-off-by: wingate5678 <wingate.chi@cybertan.com.tw>
19f4910 allow setting proto: none on ipv4 interfaces
3f98df2 Fix definitions, to match other schema yml definitions
Signed-off-by: John Crispin <john@phrozen.org>
5255152 use logical names instead of linux netdev ones inside state messages
f129469 remove outdated test cases
57e1ff5 149 is not a 160mhz channel
Signed-off-by: John Crispin <john@phrozen.org>
9797d7e allow using a shared service->captive for multiple instances
ad7eb8e rename strict-isolation -> strict-forwarding
43c44c1 force spotfilter off prior to config apply
11fffcf captive: fix credentials configuration
Signed-off-by: John Crispin <john@phrozen.org>
This commit fixes a bug where the SSID value would be set to "unknown"
in spotfilter data when the hostapd call returned without SSID data; but
this value was not propagated internally, resulting in a null value
being used in other parts of the portal code. Furthermore, if the
hostapd call returned null data, the spotfilter assignment correctly
handled this case but not the subsequent internal assignment, resulting
in a potential null dereference and crash.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This commit removes CONNMARK marking of all authenticated clients
packets. In client_kick() we now delete all conntrack entries for the
client.
This simplifies firewall.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Default firewall rules apply to unauthenticated clients, there is no
need to specifically fwmark their packets. This reduces the firewall
complexity and makes very clear what happens "by default".
Add a preliminary README with a sample firewall illustrating this setup.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This file is run by /etc/init.d/uspot, uses /etc/config/uspot and
basically handles uspot state (beyond mere accounting).
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Avoid again having the init and exit stages of a specific subsystem
spread across multiple modules.
We no longer need to lowercase the MAC address and can use the
spotfilter native (uppercase) format for ratelimit calls.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
When a client is removed, call ratelimit client_delete to remove any
lingering related bandwidth limits.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Now that accounting is entirely handled in accounting.uc, the rest of
the system no longer needs to carry around that information.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This commit introduces an "acct_start" ubus endpoint for accounting.uc
that is used to register a new client and start accounting.
This moves the entirety of accounting management under accounting.uc,
instead of having e.g. the RADIUS Start call separate in handler-uam.uc.
Furthermore, accounting.uc no longer needs to poll for new clients: they
are now registered from portal.allow_client().
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
RFC[1] says that Acct-Session-Id should be an UTF-8-encoded string.
Increase uniqueness by using hex values instead of decimal ones.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
The RFC[1] says about Acct-Status-Type:
It MAY be used by the client to mark the start of accounting (for
example, upon booting) by specifying Accounting-On and to mark the
end of accounting (for example, just before a scheduled reboot) by
specifying Accounting-Off.
The RFC errata[2] further specifies that Accounting-On and
Accounting-Off messages apply to the whole NAS.
The RFC also mandates that[3]:
Either NAS-IP-Address or NAS-Identifier MUST be present in a
RADIUS Accounting-Request. It SHOULD contain a NAS-Port or NAS-
Port-Type attribute or both unless the service does not involve a
port or the NAS does not distinguish among its ports.
And[4]:
An Accounting-Request packet MUST have an Acct-Session-Id.
The Acct-Session-Id SHOULD contain UTF-8 encoded 10646 characters.
Finally the freeRADIUS recommendations here[5] suggest that:
1. Acct-Status-Type = Accounting-On should not be used to indicate
sub-system reboot.
2. IANA should allocate two new values for Acct-Status-Type:
Subsystem-On, and Subsystem-Off. These values have meaning similar
to Accounting-On and Accounting-Off, except that they apply to a
subystem of the NAS.
3. NASes should use these new values to indicate subsystem on/off.
4. The Called-Station-Id attribute should contain values unique to each
subsystem.
5. The NAS should signal that the entire system has rebooted by using
the existing Accounting-On and Accounting-Off values, with a value
for Called-Station-Id that is global to the NAS, or to omit it
entirely.
In order to reconcile all this, this commit implements Accounting-On and
Accounting-Off requests as follows:
- When accounting.uc is started, it loops through each uspot interface
and keeps track of the acct_server seen for each interface. Then for
each interface that do not use a previously seen server, it generates
a unique session ID, and sends an Accounting-On request to the
RADIUS server, using this session ID and the configured NAS-ID.
- When accounting.uc stops, it sends an Accounting-Off request for each
uspot interface for which an Accounting-On message was previously sent,
using the same global session ID.
If/when the Subsystem-On/Subsystem-Off values are implemented, this
commit can be revisited to simply lift the restriction on unique servers
and change the acct_type value accordingly.
Finally, it appears that while NAS-ID is provided in the request thus
making NAS-IP unnecessary, libradcli still includes this field in the
request. Likewise, it also insists on sending a NAS-Port attribute.
[1]: https://datatracker.ietf.org/doc/html/rfc2866#section-5.1
[2]: https://www.rfc-editor.org/errata_search.php?rfc=2866
[3]: https://datatracker.ietf.org/doc/html/rfc2866#section-4.1
[4]: https://datatracker.ietf.org/doc/html/rfc2866#section-5.5
[5]: https://freeradius.org/rfc/acct_status_type_subsystem.html
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
In order to send RADIUS accounting requests at the NAS level (for e.g.
Accounting-On/Off), radius_init() and radius_call() are made to accept a
null mac argument.
For radius_call() we fall back to the acct_session value (which is
required to be present per RFC) to construct the temporary file name.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
NAS-ID is a mandatory setting in configuration. This will be useful to
support Accounting-Off frames.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Now that accounting.uc no longer needs the per-client radius server
information, there is no reason to publish these sensitive secrets in
cleartext in spotfiler data.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Address RADIUS accounting server from the global settings, and call
client_interim() only if accounting is globally enabled for that
interface.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Before this commit, interface-wide settings (mainly radius) were stored
per client, resulting in duplicate data.
This commit runs a first pass that renames the "clients" global variable
to "interfaces" which is expected to have the following content:
interfaces {
settings {},
clients {},
}
Thus the settings are stored per interface now, and the list of clients
belonging to that interface is stored within the object.
This change enables us to also remove direct calls to uci configuration
in the code and thus we no longer need to store it locally.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
If a client "disappears" from wireless, spotfilter eventually wipes
their state data before the accounting removal occurs. Thus in
radius_acct(), the ubus call returns empty and no RADIUS accounting Stop
frame is sent in this condition, leaving a dangling accounting for the
client.
This commit solves this issue by maintaining a local copy of the most
recent accounting data and sending that when the live data is no longer
available.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Instead of running one timer per client, handle interim reports in the
main loop through a simple comparison between current time and expected
time of next report.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This enables CONNMARK'ing allowed traffic, and is used by accounting to
selectively delete conntrack entries on client removal.
To be used with the following fw4 config:
config include
option type 'nftables'
option path '/usr/share/uspot/firewall.nft'
option position 'chain-post'
option chain 'mangle_postrouting'
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Per RFC: https://www.rfc-editor.org/rfc/rfc2869.html#section-2.1
It is also possible to statically configure an interim value on the
NAS itself. Note that a locally configured value on the NAS MUST
override the value found in an Access-Accept.
Don't start the interim reporting timer if no interval is configured.
Also add the config option to the documented config template
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
There is no point in setting up the interim timer if the relevant radius
data is not available. Furthermore, the return value check would only
fail if the client was unknown to spotfilter at the query time, which
isn't a failure to *send* data.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
When looping through known clients:
- removal of client in spotfilter list is checked first
- checks for known client existence are redundant by construction
Also format the max_total check similarly to the timeout one
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
radius_stop() had nothing to do with RADIUS.
Simplify the function prototype by handling spotfilter args internally.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
By construction:
- interface is one of clients[] keys
- clients[] is built from config uspot 'interface'
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This commit introduces a helper function "ratelimit_client()", invoked
from allow_client(), which parses the radius reply for known
ratelimiting attributes:
- WISPr-Bandwidth-Max-{Up,Down}
- ChilliSpot-Bandwidth-Max-{Up,Down}
WISPr attributes are expressed in bits/s, ChilliSpot in kbits/s.
If none of the attributes are present, the function is a NOP.
If any of the -Up or -Down is missing, the corresponding limit is not
set. NB: ratelimit currently does not support setting only up OR down
ratelimiting if defaults are not set.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
1. Using rtl8367c.c file for rtl8367S switch driver to support vlan
2. Configure eth0.1 as WAN and eth0.2 as LAN
3. Add mdio read/write in smi driver followed 5.4 kernel driver
4. add mido clock setting followed 5.4 kernel driver for 186w board
5. Add eth and wifi mac address allocation based of BaseMacAddress
6. Update new bdf for 2G radio
Fixes: WIFI-12650
Signed-off-by: Ken <xshi@actiontec.com>
27b1d45 cmd_upgrade: create /ucentral.upgrade
7109e62 add captive portal devices to the bridger block list
Signed-off-by: John Crispin <john@phrozen.org>
/openwrt/build_dir/target-arm_cortex-a7_musl_eabi/uspot/radius.c:264:4: error: label at end of compound statement
default:
^
Signed-off-by: John Crispin <john@phrozen.org>
This is required per documentation and may result in segfault if not
used.
Also remove the "servers" settings which is unnecessary in the context
of a single server.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Streamline the code to make it easier to extend supported attributes,
and to clarify code flow. Improve error checking.
Add licensing information (with permission from John Crispin, original
author).
NB: a few things are still hardcoded toward the end of radius(), to be
revisited.
Cc: John Crispin <john@phrozen.org>
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This carries over two Chilli options used during mac authentication:
- macpasswd, which sets a static password when performing mac-auth
- macsuffix, which allows suffixing the mac address provided as username
These options are implemented in config uspot section as:
- option mac_passwd 'password'
- option mac_suffix 'suffix'
If unset, this commit is a NOP.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
If debug is disabled, this commit deletes the temporary json files
passed to radius-client.
Furthermore, to reduce the risk of collision, use a different prefix in
accounting.uc ('uacct') vs common.uc ('acct').
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
For basic uspot setups, this commit implements a 'generate' verb to
uspot /usr/bin/captive that takes a config uspot section name, and
parses the following extra options to generate the relevant spotfilter
config:
option generate_spotfilter (bool) # if unset/false, generate is a NOP
option interface 'name' # config/network interface name to redirect to
option client_autoremove (bool) # if set/true, sets client_autoremove
list wl_hosts '*.example.com' # optional list of whitelist hostnames
list wl_addrs '1.2.3.4' # optional list of whitelist IPs
"captive generate" is called in spotfilter.init to optionally (depending
on 'generate_spotfilter') create the required spotfilter-XXX.json before
starting spotfilter.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
The current uspot config uses a single named section to assign ifnames
to uspot interfaces like so:
config devices 'devices'
option wlanc0 'hotspot1'
option wlanc1 'hotspot1'
Where 'wlanc0' and 'wlanc1' are physical ifnames.
Code in common.uc also hardcodes a check to match ifnames with 'wlanc*'.
This comit gets rid of the "config device" sections and accepts in the
"config uspot" sections e.g.:
option ifname 'wlanc0'
or
list ifname 'wlanc0'
list ifname 'wlanc1'
The listed devices are then associated with the current uspot config
exactly as they were with the previous configuration system.
The hardcoded check in common.uc is also removed, allowing arbitrary
ifnames to be used.
Malformed sections are ignored with a warning. Subsequent duplicate
entries for a given ifname are be ignored with a warning.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This commit moves session id creation outside of radius_init() and
stores the identifier in ctx and client data, making it available to
various handlers.
The id is added to the list of uam_url parameters to be sent to the
backend.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
Because _md[32] is defined as "char" instead of "unsigned char" in
uc_md5() and sprintf() is used instead of snprintf(), the resulting
string can be malformed (padded with FF for negative values) and
can overflow the target buffer, producing strings like:
21FFFF0D12FFFF6A48651050FFFF4CFFFFFFBA
FFFFFF16FF3EFF7C6560FFFF6BFFFFFFFFFFE7
The same issue affects the hex_to_str() helper function which uc_md5()
does not use.
This commit addresses these issues by:
- refactoring hex_to_str():
- accept a const void * input buffer internally cast to uchar
- use snprintf() and the correct format length modifier 'hh'
- use hex_to_str() in uc_md5()
- adjust uses in other callers to pass sizeof(inbuf)/2 instead of a
hardcoded number
str_to_hex() is also refactored with the same guidelines to simplify the
code and minimally address sscanf() failures by ending conversion.
While there, document these two helpers.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
This adds support for dual-image ('rootfs' partitions rotation), for
the YunCore AX840 board. Implementation details are included in the
'base-files' patch this commit adds:
0060-base-files-minimal-support-for-QCA-runtime-failsafe.patch
Fixes: WIFI-12537
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This is required for dual-image support ('rootfs' partitions rotation)
used for example on the YunCore AX840.
Fixes: WIFI-12537
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
a94e2df added the support to remove old public IP file once it is connected successfully to controller
Fixes: WIFI-12474
Signed-off-by: John Crispin <john@phrozen.org>
0af4f34 Added support of retrieval of public IP if not existed and reporting in state msg
Fixes: WIFI-12474
Signed-off-by: John Crispin <john@phrozen.org>
In case of MCU with multiple firmware slots support, change of active
slot requires reset. This obviously results in MCU entering the serial
recovery mode in bootloader, with 5 sec timeout, which in case of UART
based MCUs isn't automatically detected and handled in the same way as
USB based devices (hotplug).
Starting host side support script when the MCU is waiting for MCUmgr
commands during recovery is wrong. This fixes the problem by requesting
UART based MCU to boot the firmware after active slot change followed by
reset. While at it, change also how single slot type MCUs are handled
during upgrade (always request reset after the upgrade).
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This includes shell script for host side support of the 'hci_uart' MCU
firmware type. The script calls 'btattach' with matching tty interface
and baud rate as arguments, resulting in new Bluetooth HCI controller
registration in the system. Both UART and USB interfaces are supported.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds support for executing a host side support script per firmware
type (in our case, full MCU firmware name is a combination of two terms:
'version__type', e.g. 'zephyr-v3.3.x__hci_uart') which currently runs on
the MCU. Additionally, support for calling the init script with 'stop'
argument is included.
The host side support scripts will be placed in '/etc/mcu.d/' and should
have executable flag set and be named after the firmware type, with 'sh'
extension (e.g. 'hci_uart.sh'). This solution assumes also that PID of a
running, related service will be stored in '/var/run/mcu.SN.pid' where
'SN' is the associated MCU serial number.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
In case of some of the MCU firmware types, additional setup on the host
side is required before the target application can be used. Example of
such a requirement is a BLE HCI controller on UART bus (firmware type:
'hci_uart') which, before can be registered in system, needs to be
attached to Bluetooth stack (with e.g. 'btattach').
This includes code for generating hidden packages under 'mcu-firmware'
with all the files required for host side support (stored in directory
with the same name as firmware type, under local 'files' directory),
for a selected MCU firmware. For example, below tree:
./feeds/mcu/mcu-firmware/files/hci_uart/etc/...
would result in creation of new package 'zephyr-hci_uart-host-support',
included in dependencies lists for all MCU firmware versions of the
'hci_uart' type, with everything from '.../files/hci_uart/'.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This reduces amount of helper functions and fixes also global variables
handle inside 'mcu.sh' and 'mcu.hotplug' shell scripts. While at it,
provide additional debug information when fetching images list and
system information.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This includes simple upgrade (downgrade) capability in the MCU support
package. If hash of firmware installed on the MCU doesn't match the one
available on host's local file system, it will get upgraded.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Copy 'bluez' package from OpenWrt's packages master branch to 'ucentral'
feed so that we can use latest version and add custom, local changes.
Keep this within 'ucentral' feeds directory to override version provided
by community based 'packages' feed from OpenWrt 21.02.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
54453a6 cmd_script: custom scripts with no uri failed to send the stdout to the server
Fixes: WIFI-12358
Signed-off-by: John Crispin <john@phrozen.org>
In case of some types of MCU firmware, additional tools, daemons, kernel
drivers, etc. are required on the host side. For example, for Bluetooth
HCI controller, at least kernel module and BlueZ should be included.
This adds a simple recipe which generates dependencies list per firmware
type/name and for existing 'hci_usb' and 'hci_uart', selects 3 packages:
'bluez-daemon', 'kmod-bluetooth' and 'kmod-crypto-user'.
Kernel crypto interface in user space has to be also included because
the BlueZ isn't able to create static address for LE-only controller
without it, which results in no registration of new BT interface:
bluetoothd[668]: src/adapter.c:get_static_addr() Failed to open crypto
bluetoothd[668]: No Bluetooth address for index 0
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This includes default configuration for the on-board Nordic nRF52833 MCU
in CIG WF-196. A Zephyr based sample 'hci_uart' firmware is selected.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Include Zephyr v3.3.x based Bluetooth LE HCI UART firmware package in
default packages list for the CIG WF-196. This brings initial support
for the on-board nRF52833 MCU.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This includes default configuration for the on-board Nordic nRF52840 MCU
in EdgeCore EAP102. A Zephyr based sample 'hci_usb' firmware is selected.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Include Zephyr v3.3.x based Bluetooth LE HCI USB firmware package in
default packages list for the EdgeCore EAP102. This brings initial
support for the on-board nRF52840 MCU.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds Zephyr firmware builds from custom git branch based on the
latest's upstream branch name 'main': 'main__mcu-on-wifi-boards'.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The new 'mcu-firmware' package will provide binary firmware dedicated
for MCU embedded on Wi-Fi boards (and also standalone, e.g. USB based),
supported by the OpenWrt/OpenWiFi projects. Currently, only Zephyr RTOS
based sample firmware ('BLE HCI controller' and 'hello world') files are
provided, for Wi-Fi boards and one standalone development module, listed
below:
- CIG WF-196 (Nordic nRF52833, UART bus)
- EdgeCore EAP102 (Nordic nRF52840, USB bus)
- Nordic nRF52840 Dongle (Nordic nRF52840, USB bus)
Different firmware types planned in future include Nordic's nRF Connect
SDK, OpenThread and others.
The Zephyr based firmware comes from a custom fork available in GitLab:
'https://gitlab.com/pepe2k/zephyr' (firmware in this package were built
from a v3.3.0 release based branch 'zephyr-v3.3.x__mcu-on-wifi-boards').
MCU firmware from this package is compatible only with OpenWrt/OpenWiFi
generic MCU support stack which, among others, assumes availability of
compatible bootloader (MCUboot is currently the only one supported) and
e.g. multiple firmware slots. MCUboot fork development takes part in git
repository hosted in GitLab: 'https://gitlab.com/pepe2k/mcuboot/'.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds support for creating initial MCU configuration with use of
'uci-defaults' in a same was as for example 'uboot-envtools' package.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
On device running OpenWiFi with uCentral, additional copy of the initial
UCI configuration will be generated in '/etc/config-shadow/'. As part of
the MCU configuration is done during runtime, after the 'config-shadow'
is created, we should update it as well to keep everything in sync.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This introduces new package 'mcu' which is a collection of shell based
scripts used as glue code for generic MCU configuration and management.
The scripts are responsible for communicating with embedded MCU running
compatible MCUboot bootloader version over MCUmgr/SMP protocol.
The communication is realized based on usage of the introduced earlier
dedicated CLI tool called 'umcumgr.
The most important function of this package is a simple MCU's firmware
management (checking firmware available in the MCU's internal flash,
uploading new and selecting active on multi-firmware slot capable MCU).
This solution requires MCU running modified version of MCUboot,
available in GitLab: https://gitlab.com/pepe2k/mcuboot
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The 'umcumgr' is a simple command line tool for MCU firmware management
over MCUmgr/SMP protocol. It will be used together with MCUboot running
on the on-board (or external, e.g. in form of a dongle) MCU.
While at it, add also dedicated 'mcu.yml' profile file.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This backports more fixes for the Bluetooth subsystem from 4.9.
They were found missing during some initial Bluetooth LE testing.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This backports an essential fix for Bluetooth LE-only HCI devices from
kernel 4.9: 39385cb5f327 ("Bluetooth: Fix using the correct source
address type").
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
86dc187 the developer mode indication should be in the top level of the capa dictionary
f4aca9b indicate secure-rtty by default
Signed-off-by: John Crispin <john@phrozen.org>
2ee157f fix health.uc: the events patch left a stray sprintf( breaking compile
ac9e8cf capabilities: add developer mode info to restrictions
Signed-off-by: John Crispin <john@phrozen.org>
This exports USB related pins in sysfs using 'gpio-export' as:
- usb-rear-power
- usb-side-power
- usb-hub-enable (renamed from 'usb-enable')
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This adds few more pin configs for USB (rear and side ports power) and
MCU (reserved pin, apparently used by device vendor for DTM enable).
While at it, align labels and nodes names with staging branch.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This change focuses on the I/O related cleanups for the CIG WF-196 DTS
file. Most of the removed definitions come from QCA reference files and
should have been adjusted for a custom board. List of changes:
1. Drop 'btcoex' pinctrl mux define
WF-196 includes nRF52833 MCU which doesn't have dedicated PTA coex
hardware interface (see [1] for software based solution in Nordic's
nRF Connect SDK). Based on the real hardware research, defined pins
from 'btcoex' mux aren't routed to nRF52833 MCU.
2. Drop 'spi_3' pinctrl mux define
Defined label isn't used as reference in any other node and defined
GPIOs most likely aren't used as well.
3. Drop GPIO 46 and 47 from hsuart pinctrl mux define
It turned out that only UART TX and RX lines are routed between the
main SOC (IPQ8072A) and the MCU (nRF52833).
While at it, fix also some broken indentation and redundant new lines.
[1] https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrfxlib/mpsl/doc/bluetooth_coex.html
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
8c71638 fix listing mesh interfaces inside state
c3f6981 sysupgrade: GW sends FWsignature and not signature
94543ee state: cleanup and document the data model
6056d32 state: add [ avg, max ] cpu thermal sensor
900ce67 add phy temperature to state messages
Signed-off-by: John Crispin <john@phrozen.org>
ProblemStatement: On EAP104, "fw_setenv" fails with the error "MTD erase error on /dev/mtd10: Invalid argument"
RootCause: uboot-envtools expects hex format for the number of sectors while the config file (/etc/fw_env.config) contains a decimal number format for the number of sectors. This leads to out-of-boundary size calculation within the function "environment_end()".
Solution: Update the scripts to write a hex value instead of a decimal value in the config file.
Reference for the expected format from the config file: Please check the function "get_config" in the file "fw_env.c", where the function uses sscanf to read the parameters from the config file.
Fixes: WIFI-12189
Signed-off-by: Ravi Vaishnav <ravi.vaishnav@netexperience.com>
config_get is issued with a default (120) parameter, which makes a check for 0
a redundant.
It can be safely removed, as the check for "[ "$interval" -eq 0 ]" is
always non-zero.
Fixes 396e2bd06c ("ucentral-client: cleanup health parameter")
Tested on virtual Wlan-AP img: no syntax error occured.
Signed-off-by: Oleksandr Mazur <cahbua@gmail.com>
9dc66d7 fix listing mesh interfaces inside state
ad84690 only set port counter if they are available
Fixes: WIFI-11994
Signed-off-by: John Crispin <john@phrozen.org>
c6ba7ce add diagnostic script support
5d70069 cmd_script: add an additional return json when upload was triggered
Signed-off-by: John Crispin <john@phrozen.org>
* Update checkout action version and replace set-output command
* Put whole echo statement in double quotes
* Replace set-output commands in action as well
Signed-off-by: Johann Hoffmann <johann.hoffmann@mailbox.org>
This adds configuration for reset pins connected with nRF52840 MCU and
the GL850G USB HUB on the EdgeCore EAP102.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This change focuses on the I/O related cleanups for the EdgeCore EAP102
DTS file. Most of the removed definitions come from QCA reference files
and should have been adjusted for a custom board. List of changes:
1. Drop 'btcoex' pinctrl mux define
EAP102 includes nRF52840 MCU which doesn't have dedicated PTA coex
hardware interface (see [1] for software based solution in Nordic's
nRF Connect SDK). Based on the real hardware research, defined pins
from 'btcoex' mux aren't routed to nRF52840 MCU.
2. Drop 'hsuart' pinctrl mux define and 'serial_blsp2' node
Only one UART interface is used on the EAP102.
3. Drop 'usb_mux_sel' pinctrl mux
Defined label isn't use as reference in any other node and defined
GPIO most likely isn't used as well.
4. Disable 'pcie0' and remove 'pcie0' pinctrl mux
EAP102 doesn't use of any of the IPQ8071A PCIe buses.
[1] https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrfxlib/mpsl/doc/bluetooth_coex.html
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This fixes size of the caldata for ipq60xx based boards and moves the
YunCore AX840 to correct case block (the board is IPQ60xx based, so
the driver looks for ath11k/IPQ6018/hw1.0/caldata.bin,
not ath11k/IPQ8074/hw2.0/caldata.bin). Without this fix, the driver
isn't able to fetch caldata:
[ 16.792551] ath11k c000000.wifi: qmi failed to load CAL data file:caldata.bin
Signed-off-by: Isaev Ruslan <legale.legale@gmail.com>
Backups are gzipped, include the missing 'z' parameter in 'tar' call.
While at it, make 'grep' call quiet (add 'q' parameter).
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
f941f47 healthcheck: set 60s as the minimum interval
85495ab wifi.iface was not converting 6G channels correctly
Signed-off-by: John Crispin <john@phrozen.org>
8d4384b add session-timeout to captive support
516829a add client kick threshold support
5a5085b add uci_section to wifi uci
Signed-off-by: John Crispin <john@phrozen.org>
Rekeying PTK for STA 2e:54:0a:55:25:c6 but driver can't safely do that.
Rekeying PTK for STA 48:26:2c:3e:b0:f4 but driver can't safely do that.
ath11k c000000.wifi: failed to flush transmit queue 0
Fixes: WIFI-11004
Signed-off-by: John Crispin <john@phrozen.org>
329dffa add captive portal info to state messages
f3ee560 start the uspot service if captive is enabled
7da0185 allow defining the format of MAC sent to AAA in captive mode
2dfbeff rename wlancaptive -> wlanc, netdev name got too long when creating the IFB device
1784f7e add 'none' mode to wifi-steering
abeb712 broadband: the DNS was not getting applied in static configuration
0fbe7d5 various captive portal improvements
Fixes: WIFI-10665
Signed-off-by: John Crispin <john@phrozen.org>
Mesh++ S618 has below products based on Qualcomm IPQ6018:
* cp03-c1
* cp01-c1
These are Wi-Fi 6 (IEEE 80211.ax) dual band 2x2 mesh routers.
Fixes: WIFI-10561
Signed-off-by: Krishna <krishna@meshplusplus.com>
Signed-off-by: Edward Cheung <edward@meshplusplus.com>
Signed-off-by: Alex Ballmer <alexb@meshplusplus.com>
QCA is still backporting the old OpenWrt hack for BR_HOOK to newer kernels.
This change was identified as a source for bugs and also caused performance
problems in certain scenarios.
And since OpenWrt is now building the bridge as part of the kernel and the
br-netfilter code as module, the build of the QCA kernel fork will also
fail because the kernel binary is depending on a module:
net/built-in.o: in function `BR_HOOK':
net/bridge/br_private.h:929: undefined reference to `br_netfilter_run_hooks'
net/bridge/br_private.h:929: undefined reference to `br_netfilter_run_hooks'
net/bridge/br_private.h:929: undefined reference to `br_netfilter_run_hooks'
net/bridge/br_private.h:929: undefined reference to `br_netfilter_run_hooks'
net/bridge/br_private.h:929: undefined reference to `br_netfilter_run_hooks'
net/built-in.o:net/bridge/br_private.h:929: more undefined references to `br_netfilter_run_hooks' follow
Just getting rid of this patch (as OpenWrt did) is therefore the best
option.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
a074cc0 improve dhcp probe on GRE tunnels
2a66b4c enable the noscan flag on radios to make 40MHz work
4c36050 improve ipv4 wifi client reporting in bridge mode
aed8805 remove openflow support
4597721 add dhcp discovery on gre tunnel interface
Fixes: WIFI-7838
Fixes: WIFI-10549
Fixes: WIFI-10538
Signed-off-by: John Crispin <john@phrozen.org>
sk_buff's cb should be cleared in the entry point for both incoming and outgoing packets at each layer.
At bridge, it is already handled in the outgoing path, but not in the incoming path. We have seen cases
where proxyarp_replied was 1 on sk_buffs coming from the WLAN driver and they were getting dropped in
forwarding path.
Fixes: WIFI-10552
Signed-off-by: Venkat Chimata <venkata@shasta.cloud>
Device specifications:
======================
* Qualcomm IPQ6000
* 256 MB of RAM
* 64 MB of SPI NOR flash
- 2x 28 MB available; but one of the 28 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11ax)
* 2T2R 5 GHz Wi-Fi (11ax)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board
* 2x ethernet
- eth0
+ 1000 Mbps Ethernet
+ used as LAN interface
- eth1
+ 1000 Mbps Ethernet
+ 802.3at POE
+ used as WAN interface
* 12 2A DC
* internal antennas
This device is not exported via a profile in TIP because there were
concerns about the 256MB limitations. But the actual OpenWrt support is
still added for interested parties.
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
setenv bootargs 'console=ttyMSM0,115200n8 rootfstype=squashfs,jffs2 board=PAX1800 root=31:10 mtdparts=spi32766.0:768k(0:SBL1),64k(0:MIBIB),1664k(0:QSEE),64k(0:DEVCFG),128k(0:RPM),64k(0:CDT),64k(0:APPSBLENV),640k(0:APPSBL),256k(0:ART),28672k(inactive),28672k(inactive2),64k(custom),64k(0:KEYS),2304k(0:WIFIFW)'
tftpboot <filename-of-initramfs-kernel>.bin && bootm
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
If it already looks to the system that the flashing of the image data
failed, it is not a good idea to inform the u-boot to switch the inactive
(newly flashed) partition to the active one
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
======================
* Qualcomm IPQ6000
* 512 MB of RAM
* 64 MB of SPI NOR flash
- 2x 28 MB available; but one of the 28 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11ax)
* 2T2R 5 GHz Wi-Fi (11ax)
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board
* 2x ethernet
- eth0
+ 1000 Mbps Ethernet
+ used as LAN interface
- eth1
+ 1000 Mbps Ethernet
+ 802.3at POE
+ used as WAN interface
* 12 2A DC
* internal antennas
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
setenv bootargs 'console=ttyMSM0,115200n8 rootfstype=squashfs,jffs2 board=PAX1800v2 root=31:10 mtdparts=spi32766.0:768k(0:SBL1),64k(0:MIBIB),1664k(0:QSEE),64k(0:DEVCFG),128k(0:RPM),64k(0:CDT),64k(0:APPSBLENV),640k(0:APPSBL),256k(0:ART),28672k(inactive),28672k(inactive2),64k(custom),64k(0:KEYS),2304k(0:WIFIFW)'
tftpboot <filename-of-initramfs-kernel>.bin && bootm
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann <sven@narfation.org>
The toolchain path will not automatically be copied to OpenWrt. So the
build will still fail on recent Debian unstable version. Instead, it must
be applied during the setup.py process via the normal patch procedure.
Reported-by: Marek Lindner <marek.lindner@plasma-cloud.com>
Fixes: 6f6b40a94f ("toolchain/gcc: fix building gcc 5.5 on newer systems")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
29cfbca owe: hide the encrypted BSS
ec4284b expose PMKSA caching via the data model
Fixes: WIFI-10235
Fixes: WIFI-10233
Signed-off-by: John Crispin <john@phrozen.org>
257185a state: make sure that snooped IP addresses are also shown inside the clients table
7f157d8 qos: use fn_match instead of regex
6a68c03 wireguard-overlay: use correct default port for vxlan
Fixes: WIFI-7838
Fixes: WIFI-7208
Signed-off-by: John Crispin <john@phrozen.org>
fc8fdcf point radsec proxy at the correct radius accounting server
886a650 Add missing paramters to uC state schema
c8b15b7 chain the radius vendor attributes inside a single AVP
Fixes: WIFI-7687
Fixes: WIFI-9620
Signed-off-by: John Crispin <john@phrozen.org>
548ce37 point radsec proxy at the correct radius accounting server
c49ce29 Add missing paramters to uC state schema
1c55872 chain the radius vendor attributes inside a single AVP
Signed-off-by: John Crispin <john@phrozen.org>
Running mkfs.ext4 on a partition that already contains an ext4
filesystem asks for input:
mke2fs 1.45.6 (20-Mar-2020)
/dev/mmcblk0p9 contains a ext4 file system
created on Sat Jun 11 12:23:42 2022
Proceed anyway? (y,N) y
This breaks the ability to run sysupgrade non-interactively. Add the -F
switch to force ext4 creation to fix this.
Fixes: WIFI-9419
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Running dd if=/dev/zero to a partition will always throw an ENOSPC error
when reaching the end of the partition. Silence those errors to avoid
confusion.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* Update to latest version of dhcpsnoop
* always snoop all upstream interfaces
* add snooped leases to state
Fixes: WIFI-7838
Signed-off-by: John Crispin <john@phrozen.org>
The active status of the switch button in the DTS configuration
is the opposite of that marked on the product housing.
The switch button should be activated at high GPIO level.
Fixes: WIFI-8042
Signed-off-by: GL.iNet-Xinfa.Deng <xinfa.deng@gl-inet.com>
This will allow the AP to send radius requests via the websocket
to the gateway for routing to the correct AAA.
Fixes: WIFI-7328
Signed-off-by: John Crispin <john@phrozen.org>
If another host has not set a status, for example when autochannel is
disabled, it will not show host_info when remote_hosts is called. This
fix adds a check for this condition.
Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
4829132 properly honour mac addresses that are inside board.json
ba9a2ee various 6G improvements
0a05052 interface: fix wan side STA-only interfaces
Signed-off-by: John Crispin <john@phrozen.org>
The uptime value in the uchannel state contains the uptime at the time
the script was last executed. This is a rather confusing name, and
possibly this is what lead to WIFI-7613. Rename it to executed to avoid
confusion in the future.
Keep the original name in the usteerd node status, as it is unclear what
impact this has, and could lead to breakage elsewhere.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Once the uchannel.uc script sets its status to waiting, it becomes
defunct. The next invocation of the script will compare uptime to
state.uptime, and if the difference is less than 12h, it will change
state.uptime to the current uptime and return. As the script runs every
5 minutes, the difference will always be less than 12h.
Fix this by comparing uptime against state.changed rather than
state.uptime.
Fixes: WIFI-7613
Fixes: 670bc9d2e2 ("ucentral: development update")
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
The uchannel instance of the usteer init script contains a typo, causing
the following error when autochannel is enabled:
/etc/rc.common: line 147: procd_close_instancea: not found
Fixes: WIFI-7577
Fixes: c467a62af3 ("usteer: update to latest HEAD")
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Changes made in OpenWrt supported targets to Include Indio's UM-325AC AP which is an indoor WiFi5 AP based on ipq4019 chipset.
Signed-off-by: Sohail Ahmad <sohail@indionetworks.com>
fb537b9 enhance healthcheck to provide verbose error messages
2b65900 sysinfo: add helper tool to monitor memory consumption per service/instance
Signed-off-by: John Crispin <john@phrozen.org>
Commit 97d35a552ec5b6ddf7923dd2f9a8eb973526acea of musl introduced the
macros __LITTLE_ENDIAN and __BIG_ENDIAN in alltypes.h. These are pulled
into the compilation of batman-adv. This has the side effect that the
function is_multicast_ether_addr of etherdevice.h in Linux kernel is
compiled as the big endian version and so fails to work properly on
little endian devices.
This commits prevents pulling in header files of musl libc similar to
OpenWRT commit 9ac47ee46918c45b91f4e4d1fa76b1e26b9d57fe
Origin: upstream, https://git.openwrt.org/?p=feed/routing.git;a=commit;h=47436b04fd32cf3b6e6b46c25cb9c1fff3a995fd
Signed-off-by: Hendrik Borghorst <hendrikborghorst@gmail.com>
(cherry picked from commit 523821c1959cb288b55b7fcc8761c83f6ff48c4d)
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Because we have an another similar device named gl-axt1800,
so we put the common functions in a dtsi file. And we'll
submit a PR for gl-axt1800 soon.
Hardware:
* SoC: Qcom IPQ6000
* RAM: DDR3L 512MB
* Flash: 128MB Nand
* Ethernet: 5x GbE
* WLAN: 2x2 2.4GHz 600Mbps + 2x2 5GHz 1200Mbps (builtin + builtin)
* LEDS: 1x white, 1x blue
* Buttons: 1x switch, 1x reset
* USB: 1x 3.0(Type-A)
* Power: 12VDC, 1.5A
Installation:
* from qsdk to openwifi:
upgrade "openwrt-ipq807x-glinet_ax1800-squashfs-nand-factory.bin" via web ui
without keep config.
* upgrade "openwrt-ipq807x-glinet_ax1800-squashfs-sysupgrade.tar" if you are already in openwifi.
Signed-off-by: Jianhui Zhao <jianhui.zhao@gl-inet.com>
4532c47 fix downstream bridges with no eth ports
04edaef ntp: open firewall port if ntpd is enabled
bf11105 fix led-active restart
c95667a a failed apply should return the error code 2
72e225e capabilities: add label_macaddr to capabilities
Signed-off-by: John Crispin <john@phrozen.org>
5f769a0 wifisca: add CSA support
9eb55fd state: fix carier state wehn the device is not up
cf8f383 add radios DAE support
ad6ac65 move radius auth mac acl property into the authentication node
7bc2f00 improve wifi scanning
f8f458a always use the systems hostname when streaming the syslog
b2dc0b7 add radius based mac-filters
34671ba ass priority to syslog data model
d7d73d8 fix carrier state reporting NaN
0a49566 add new wifi-scanning code
8f5beb1 add versioning to the state messages
8968d62 counters were not correctly added inside state messages
77b57b8 generate-reader.uc: fix validation of hostname labels with two characters
311bf98 fix radius proxy server settings
fa9ad34 add unit.hostname support
c101acd state: properly split telemetry and state messages
8da20fd renderer.uc: make code scanning radio aware
404a9a3 renderer: restructure and extend documentation
8ecb351 jsdoc: add proper ucode->JS transpiler
ca4ef47 templates: broadband.uc: fix deprecated syntax
Signed-off-by: John Crispin <john@phrozen.org>
e3b71c6 fix a memory leak
* Silence the warning by adding the -p switch to mkdir.
Fixes: WIFI-6190
Fixes: WIFI-6761
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Signed-off-by: John Crispin <john@phrozen.org>
b4e8fc8 add connection watchdog
48e89d8 send a success message if the config had already been applied.
9bb8cfe properly decrement the event counter when deleting entries
2e53c8f add event_dump_all support to uboot
7ebeaca add ping command handler
Signed-off-by: John Crispin <john@phrozen.org>
Some older units did not have a stable serial number when connecting
to the GW. Fix this by explicitly setting the label_mac, this allows
the uci-defaults script to correctly pick up the right MAC.
Fixes: WIFI-5834
Signed-off-by: John Crispin <john@phrozen.org>
The timeout of 75s was a little to shart and would sometimes cause
5G interfaces to not enable ratelimit correctly. Increasing the
timeout to 120s makes the flow more reliable.
Fixes: WIFI-5701
Signed-off-by: John Crispin <john@phrozen.org>
Re-enabling support for enabling configuring rnr_beacon and he_co_locate flag in hostapd config files.
Signed-off-by: Sharadanand Karanjkar <sk@simonwunderlich.de>
Instead of generically mentioning a missing dependency the host
dependency can also be explained by defining a `warning`.
Warning messages are collected and printed at the end.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Instead of installing the package directly use the qosify profile which
automatically handles the host dependency clang/llvm.
Signed-off-by: Paul Spooren <mail@aparcar.org>
In case clang/llvm is available as a host dependency, modify the
configuration to use it. In case it is not available build clang/llvm
(takes ~30min).
Signed-off-by: Paul Spooren <mail@aparcar.org>
In case a package/image requres specific host dependencies it is
possible to define entries in the `host_dependencies` array. Each entry
is an object containing at least `name` and `which`. The `which` array
contains tools to be checked in the current `PATH`.
Optionally the two options `success_diffconfig` and
`fallback_diffconfig` can be set. The former is optionally added in case
the tool is found. The latter is added if the dependency is not
available.
If the dependecy is not available and no `fallback_diffconfig` is set,
the config generation is considered impossible and stopped.
Signed-off-by: Paul Spooren <mail@aparcar.org>
dbb2aaf fix dns only classifiers and add missing class-selectors
4d2c297 qos: split class selector into its own yml
728c6f4 qos: add bulk detection support to data-model/renderer
f5a4651 wmm: fix qos_map_set generation
b958719 update qos/fqdn matching
Signed-off-by: John Crispin <john@phrozen.org>
Requires a recent linux installation. Older systems without python 3.7 will have trouble. See this link for details: https://openwrt.org/docs/guide-developer/quickstart-build-images
OpenWrt-based access point network operating system (AP NOS) for TIP OpenWiFi.
Read more at [openwifi.tip.build](https://openwifi.tip.build/).
# example com-wr.sh /dev/ttyMSM1 1 "\x01\x1D\xFC\x01\x00" | hexdump.sh --> send "\x01\x1D\xFC\x01\x00" to /dev/ttyMSM1 and then hexdump receive data until 100ms timeout
#command example "\x7E\x03\xD0\xAF und normaler Text"
cc2562-wr.sh /dev/ttyMSM1 3"\x01\x1D\xFC\x01\x00" > /dev/null # this command dealy time must >= 3, if small then 3, the following commands will be something wrong
setState(SBL_PORT_ERROR,"No response from device. Device may not be in bootloader mode. Reset device and try again.\nIf problem persists, check connection and baud rate.\n");
# ELTT2 - Infineon Embedded Linux TPM Toolbox 2 for TPM 2.0
All information in this document is Copyright (c) 2014-2022, Infineon Technologies AG <br>
All rights reserved.
# 1. Welcome
Welcome to Embedded Linux TPM Toolbox 2 (ELTT2). ELTT2 is a single-file executable program intended for testing, performing diagnosis and basic state changes of the Infineon Technologies TPM 2.0.
## 1.1 Prerequisites
To build and run ELTT2 you need GCC and a Linux system capable of hosting a TPM.
ELTT2 may run on many other little-endian hardware and software configurations capable of running Linux and hosting a TPM, but this has not been tested.
ELTT2 does not support machines with a big-endian CPU.
## 1.2 Getting Started
A TPM 2.0 evaluation board can be ordered in the [Hitex Webshop](https://www.ehitex.de/evaluation-boards/infineon/2564/iridium-9670-tpm2.0-spi).
In order to execute ELTT2, you need to compile it first:
1. Switch to the directory with the ELTT2 source code
2. Compile the source code by typing the following command:
make
Due to hardware (and thus TPM) access restrictions for normal users, ELTT2 requires root (aka superuser or administrator) privileges. They can be obtained e.g. by using the 'sudo' command on Debian Linux derivates.
The Infineon [TPM 2.0 Application Note](https://www.infineon.com/dgdl/Infineon-App-Note-SLx9670-TPM2.0_Embedded_RPi_DI_SLx-AN-v01_20-EN.pdf?fileId=5546d46267c74c9a01684b96e69f5d7b) shows how the TPM device driver can be set up (e.g. for Linux Kernel 4.14).
# 2. Usage of ELTT2
## 2.1 Generic Usage
ELTT2 is operated as follows:
Call: `./eltt2 <option(s)>`
For example: `./eltt2 -g` or `./eltt2 -gc`
For getting an overview of the possible commands, run `./eltt2 -h`
Some options require the TPM to be in a specific state. This state is shown in brackets ("[]") behind each command line option in the list below:
\[-\]: none <br>
\[\*\]: the TPM platform hierarchy authorization value is not set (i.e., empty buffer) <br>
\[l\]: the required PCR bank is allocated <br>
\[u\]: started <br>
To get the TPM into the required state, call ELTT2 with the corresponding commands ("x" for a state means that whether this state is required or not depends on the actual command or the command parameters sent eventually to the TPM).
With the "-a" command you can hash given data with the SHA-1/256/384 hash algorithm. This hash sequence sends 3 commands \[start, update, complete\] to the TPM and allows to hash an arbitrary amount of data. For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -a 41624364` Hash given data with SHA-1 hash algorithm. <br>
or <br>
`./eltt2 -a sha1 41624364` Hash given data with SHA-1 hash algorithm. <br>
`./eltt2 -a sha256 41624364` Hash given data with SHA-256 hash algorithm. <br>
`./eltt2 -a sha384 41624364` Hash given data with SHA-384 hash algorithm. <br>
`-A`: <br>
With the "-A" command you can hash given data with the SHA-256 hash algorithm. This hash sequence sends 3 commands \[start, update, complete\] to the TPM and allows to hash an arbitrary amount of data. For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -A 41624364`
`-b`: <br>
With the "-b" command you can enter your own TPM command bytes and read the TPM response. For example, use the following command to send a TPM2_Startup with startup type CLEAR to the TPM: <br>
`./eltt2 -b 80010000000C000001440000`
`-c`: <br>
With the "-c" command you can read the clock values of the TPM.
`-d`: <br>
With the "-d" command you can issue a TPM shutdown. It has 2 options: <br>
`./eltt2 -d`<br>
or <br>
`./eltt2 -d clear` send a TPM2_Shutdown command with shutdown type CLEAR to the TPM. <br>
`./eltt2 -d state` send a TPM2_Shutdown command with shutdown type STATE to the TPM. <br>
`-e`: <br>
With the "-e" command you can extend bytes in the selected PCR with SHA-1/256/384. To do so, you have to enter the index of PCR in hexadecimal that you like to extend and the digest you want to extend the selected PCR with. Note that you can only extend PCRs with index 0 to 16 and PCR 23 and that the digest must have a length of 20/32/48 bytes (will be padded with 0 if necessary). The TPM then builds an SHA-1/256/384 hash over the PCR data in the selected PCR and the digest you provided and writes the result back to the selected PCR. For example, use the following command to extend PCR 23 (0x17) with the byte sequence {0x41, 0x62, 0x43, 0x64, 0x00, ... (will be filled with 0x00)}: <br>
`./eltt2 -e 17 41624364` Extend bytes in PCR 23 with SHA-1. <br>
or <br>
`./eltt2 -e sha1 17 41624364` Extend bytes in PCR 23 with SHA-1. <br>
`./eltt2 -e sha256 17 41624364` Extend bytes in PCR 23 with SHA-256. <br>
`./eltt2 -e sha384 17 41624364` Extend bytes in PCR 23 with SHA-384. <br>
`-E`: <br>
With the "-E" command you can extend bytes in the selected PCR with SHA-256. To do so, you have to enter the index of PCR in hexadecimal that you like to extend and the digest you want to extend the selected PCR with. Note that you can only extend PCRs with index 0 to 16 and PCR 23 and that the digest must have a length of 32 bytes (will be padded with 0 if necessary). The TPM then builds an SHA-256 hash over the PCR data in the selected PCR and the digest you provided and writes the result back to the selected PCR. For example, use the following command to extend PCR 23 (0x17) with the byte sequence {0x41, 0x62, 0x43, 0x64, 0x00, ... (will be filled with 0x00)}: <br>
`./eltt2 -E 17 41624364`
`-g`: <br>
With the "-g" command you can read the TPM's fixed properties.
`-v`: <br>
With the "-v" command you can read the TPM's variable properties.
`-G`: <br>
With the "-G" command you can get a given amount of random bytes. Note that you can only request a maximum amount of 32 random bytes at once. For example, use the following command to get 20 (0x14) random bytes: <br>
`./eltt2 -G 14`
`-l`: <br>
With the "-l" command you can allocate the SHA-1/256/384 PCR bank. Take note of two things. Firstly, the command requires a platform authorization value and it is set to an empty buffer; hence the command cannot be used if the TPM platform authorization value is set (e.g., by UEFI). Secondly, when the command is executed successfully a TPM reset has to follow for it to take effect. For example, use the following command to allocate a PCR bank: <br>
With the "-r" command you can read data from a selected SHA-1/256/384 PCR. For example, use the following command to read data from PCR 23 (0x17): <br>
`./eltt2 -r 17` Read data from SHA-1 PCR 23. <br>
or <br>
`./eltt2 -r sha1 17` Read data from SHA-1 PCR 23. <br>
`./eltt2 -r sha256 17` Read data from SHA-256 PCR 23. <br>
`./eltt2 -r sha384 17` Read data from SHA-384 PCR 23. <br>
`-R`: <br>
With the "-R" command you can read data from a selected SHA-256 PCR. For example, use the following command to read data from PCR 23 (0x17): <br>
`./eltt2 -R 17`
`-s`: <br>
With the "-s" command you can hash given data with the SHA-1/256/384 hash algorithm. This command only allows a limited amount of data to be hashed (depending on the TPM's maximum input buffer size). For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -s 41624364` Hash given data with SHA-1 hash algorithm. <br>
or <br>
`./eltt2 -s sha1 41624364` Hash given data with SHA-1 hash algorithm. <br>
`./eltt2 -s sha256 41624364` Hash given data with SHA-256 hash algorithm. <br>
`./eltt2 -s sha384 41624364` Hash given data with SHA-384 hash algorithm. <br>
`-S`: <br>
With the "-S" command you can hash given data with the SHA-256 hash algorithm. This command only allows a limited amount of data to be hashed (depending on the TPM input buffer size). For example, use the following command to hash the byte sequence {0x41, 0x62, 0x43, 0x64}: <br>
`./eltt2 -S 41624364`
`-t`: <br>
With the "-t" command you can issue a TPM selftest. It has 3 options: <br>
`./eltt2 -t`<br>
or<br>
`./eltt2 -t not_full` Perform a partial TPM2_Selftest to test previously untested TPM capabilities. <br>
`./eltt2 -t full` Perform a full TPM2_Selftest to test all TPM capabilities. <br>
`./eltt2 -t incremental` Perform a test of selected algorithms.
`-T`: <br>
With the "-T" command you can read the results of a previously run selftest.
`-u`: <br>
With the "-u" command you can issue a TPM startup command. It has 2 options: <br>
`./eltt2 -u`<br>
or <br>
`./eltt2 -u clear` send a TPM2_Startup with startup type CLEAR to the TPM. <br>
`./eltt2 -u state` send a TPM2_Startup with startup type STATE to the TPM.
`-z`: <br>
With the "-z" command you can reset a selected PCR. Note that you can only reset PCRs 16 and 23. For example, use the following command to reset PCR 23 (0x17): <br>
`./eltt2 -z 17`
## 2.2 Examples:
In order to work with the TPM, perform the following steps:
- Send the TPM2_Startup command: `./eltt2 -u`
# 3. If you have questions
If you have any questions or problems, please read the section "FAQ and
Troubleshooting" in this document.
In case you still have questions, contact your local Infineon
Representative.
Further information is available at <https://www.infineon.com/tpm>.
# 4. FAQ and Troubleshooting
If you encounter any error, please make sure that
- the TPM is properly connected.
- the TPM driver is loaded, i.e. check that "/dev/tpm0" exists. In case of driver loading problems (e.g. shown by "Error opening device"), reboot your system and try to load the driver again.
- ELTT2 has been started with root permissions. Please note that ELTT2 needs root permissions for all commands.
- the TPM is started. (See section 2.2 in this document on how to do this.)
The following list shows the most common errors and their solution:
The ELTT2 response is "Error opening the device.":
- You need to load a TPM driver before you can work with ELTT2.
- You need to start ELTT2 with root permissions.
The ELTT2 responds with error code 0x100.
- You need to send the TPM2_Startup command, or you did send it twice. In
case you have not sent it yet, do so with `./eltt2 -u`.
The TPM does not change any of the permanent flags shown by sending the "-g"
command , e.g. after a force clear.
- The TPM requires a reset in order to change any of the permanent flags.
Press the reset button or disconnect the TPM to do so.
The value of a PCR does not change after sending PCR extend or reset.
- With the application permissions you cannot modify every PCR. For more
details, please refer to the description for the different PCR commands
# Facebook Wi-Fi v2.0 Reference Implementation for OpenWrt
## Getting started
Case studies for OEM customers are available at the official page of [Facebook Wi-Fi](https://www.facebook.com/facebook-wifi).
For OEM engineers, start by reading the init script in [files/etc/init.d/fbwifi](https://github.com/facebookincubator/fbc_owrt_feed/blob/master/fbwifi/files/etc/init.d/fbwifi)
To enable Facebook Wi-Fi, configure the gateway_token in `/etc/config/fbwifi`, and run `fbwifi enable`.
To disable Facebook Wi-Fi, run `fbwifi disable`.
## Contents
The 'files' subdirectory contains two subdirectories, one for the fbwifi
package that implements the Facebook Wi-Fi v2.0 standard for OpenWrt, and
another one containing a LuCI application to configure Facebook Wi-Fi.
The folder structures follow *nix conventions:
- 'etc' is the boot time scripts and configuration
- 'usr' contains procedural scripts, lua common code module and GUI prototype for luci
- 'www' contains the HTTP endpoints as CGI handlers
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
