staging/stintel/package, branch master

wifi-scripts: write the hostapd width values for 6 GHz 320 MHz

2026-10-28T15:29:45Z

For EHT320, device_htmode_append() writes eht_oper_chwidth=7 and he_oper_chwidth=3. In enum oper_chan_width of hostapd these are 8640 MHz and 80+80 MHz, not 320 MHz and the 160 MHz that the HE comment asks for. hostapd replaces both with the width of op_class 137 in setup_interface2(), so only readers of the config such as hostapd.uc see the wrong values. Write 9 (320 MHz) and 2 (160 MHz), the values hostapd sets for op_class 137 in hostapd_set_oper_chwidth(), like mac80211.sh already does for eht_oper_chwidth. Signed-off-by: Felix Fietkau

wifi-scripts: iwinfo: wait for the results of the scan it triggered

2026-10-28T15:29:45Z

scan() took the next NL80211_CMD_NEW_SCAN_RESULTS that nl80211.waitfor() returned. The ucode nl80211 event socket stays subscribed for the life of the process, so in a long running caller the results of an earlier scan, or of a scan on another interface of the wiphy, were already queued. scan() then returned within milliseconds, dumped the cache before its own scan had finished, and left that scan running, so a scan on another radio of a multi-radio wiphy failed with EBUSY. Drop the queued scan events before the trigger, and wait for the event of the interface that was scanned. Signed-off-by: John Crispin Signed-off-by: Felix Fietkau

hostapd: ucode: fix the width and the result of switch_channel

2026-10-28T15:29:45Z

switch_channel() takes the width from oper_chwidth and falls back to the current width of the interface. freq_info() did not return it, so a config change of the width alone made a channel switch with the old width and the new centre frequency, which the kernel refuses, and the radio restarted instead. Return oper_chwidth from freq_info(). start() reads the same field, so a start with a frequency from wpa_supplicant now also takes the width of the config, which matches the centre frequency that freq_info() computes for it. switch_channel() also returned the result of the last BSS only. mac80211 does not finalise a channel switch that only part of the BSSes of a radio take part in, so stop at the first BSS that fails and let the caller restart the radio. Signed-off-by: John Crispin Signed-off-by: Felix Fietkau

hostapd: fix the config channel switch on a multi-radio wiphy

2026-10-28T15:29:45Z

mac80211 refuses to bring up an interface while any interface of the wiphy is in a channel switch (ieee80211_check_concurrent_iface()), and cfg80211 runs one scan per wiphy. On a multi-radio wiphy such as the mt7996, the radios share both limits: - A config change that switches the channel of one radio and restarts another radio failed the restart with EBUSY, and the AP stayed down until the next config change. - While ACS ran on one radio, the 20/40 MHz coexistence scan of another radio got EBUSY each second, and after 15 s hostapd starts that AP at 20 MHz. Hold a pending interface setup back in steps of 100 ms while another AP of the same wiphy is in a channel switch, an ACS or a coexistence scan, for 30 s at most. Also fix three cases of the config channel switch: - iface_freq_info() took the oper_chwidth values of hostapd as the width argument of freq_info() and ignored op_class. The EHT320 config of wifi-scripts got 320 MHz only because its he_oper_chwidth=3 (80+80 MHz) equals the freq_info() width of 320 MHz. Take the width from op_class where the config has one, as hostapd does, and map the oper_chwidth values otherwise. Restart for 80+80 MHz, which freq_info() lacks. - A config change of the channel and of a BSS ran the channel switch and then reloaded the BSS, which stops the BSS during the switch. Restart instead. - radio_base() dropped [HT40+] and [HT40-], so a change between HT20 and HT40 on the same channel was not applied. Keep [HT40] without the sign. Signed-off-by: John Crispin Signed-off-by: Felix Fietkau

ucode: update to Git HEAD (2026-10-28)

2026-10-28T14:57:22Z

d41981561d7f types: keep tostring exceptions pending during stringification 94562341453a vm: invoke standard library functions internally a357bc0fd001 compiler: add typeof operator and throw statement 0de223bb2e49 vm, debug: show which function I_STCALL invokes 6004c5aad287 lexer: add a raw text skipper to find the end of a bracketed expression e915e50fa79c compiler: add destructuring declarations and assignments a250f159019d rtnl: look up the port attributes by the kind of the master 90b756787ff8 rtnl: decode the slave data of a port with the port attributes f14b11ba2378 rtnl: send the port data of a link without a link kind 961af31de74a tests: ffi: add calls with complex arguments and return values 3f379cd7d5ed ubus: ignore a channel request after the channel was lost Signed-off-by: Felix Fietkau

mt76: update to Git HEAD (2026-10-28)

2026-10-28T14:56:09Z

5e697c3982d7 wifi: mt76: mt7603: validate MCU response length 19901c7f3cc9 wifi: mt76: mt7915: validate MCU response lengths 0720e321afee wifi: mt76: mt7915: validate MURU statistics response bbb18d7844e9 wifi: mt76: mt7915: validate EEPROM response length 7264a8a110c4 wifi: mt76: mt7915: validate free-block response length 8c534f59b4a9 wifi: mt76: mt7915: validate channel MIB response length fa6b2367e281 wifi: mt76: mt7915: validate RX rate response length 07f248fe9830 wifi: mt76: mt7915: validate WED TX statistics response f76151f8d04f wifi: mt76: mt7915: validate RF register response length 0d218afcbddb wifi: mt76: mt76x02: keep A-MSDU subframe buffers at even addresses 558c6aee6891 wifi: mt76: mt76x02: sync the group key PN before a restart db39c8d4d6d9 wifi: mt76: fix NULL dereference reading napi_threaded in debugfs 6dcc00bb44c5 wifi: mt76: mt7925: deduplicate MLD support code in mt7925_mac_link_sta_add 859b54fabce0 wifi: mt76: mt7925: do not reset WPDMA before stopping NAPI on reset 2bb98336d469 wifi: mt76: mt7996: clamp VHT/HE beamforming NSS d2712ce4ed84 wifi: mt76: mt7996: clamp EHT beamforming NSS d973f6ec9a3d wifi: mt76: mt7921: validate MCU response lengths 1618141fbd29 wifi: mt76: mt7921: validate EEPROM response length 1fe8a56213ce wifi: mt76: mt7921: validate TX power response length 759e140bc76a wifi: mt76: mt7921: validate testmode query response e06a746261e0 wifi: mt76: mt7925: validate MCU response lengths ae20af438c32 wifi: mt76: mt7925: validate register query response ad5b05038a34 wifi: mt76: mt7925: validate EEPROM response length d0a80080eed9 wifi: mt76: mt7925: validate temperature response length 06deecb57b96 wifi: mt76: mt7925: validate TX power response length a73af3f06db4 wifi: mt76: mt7925: validate radio status response 487aa470cada wifi: mt76: mt792x: bound firmware release-info parsing a13a2be996e3 wifi: mt76: mt7996: validate MCU response lengths e0670ce95e40 wifi: mt76: mt7996: validate EEPROM response lengths 8f71d66ad74e wifi: mt76: mt7996: validate free-block response length 90e7c0007d7f wifi: mt76: mt7996: validate channel MIB response length e1e90bbe363c wifi: mt76: mt7996: validate temperature response length f99c91725472 wifi: mt76: mt7996: validate RF register response length 8127e3ff88ff wifi: mt76: mt76x02: keep stations registered during watchdog recovery 247c4d987c39 wifi: mt76: honour the more-data flag when releasing buffered frames f75d4f05974d wifi: mt76: mt76x02: serialise wcid drop mask updates 4af6beb07b88 wifi: mt76: mt76x02: clear the wcid drop mask for all powersave responses 304aa9be68dd wifi: mt76: mt7996: stop radios after add failure 1295868b85d3 wifi: mt76: mt7921: validate CLC event length 04bf44cd2cb5 wifi: mt76: mt7921: validate NIC capability TLV payload lengths 3c0806b4dfae wifi: mt76: mt7925: validate NIC capability TLV lengths cb8537008b58 wifi: mt76: mt7925: free the MCU event when linearising fails cd0c5fdf01b3 wifi: mt76: mt7996: validate radar, thermal and WED RRO event lengths ba86572bd0d4 wifi: mt76: connac: validate the RAM firmware region table 3ecd7e69dbc9 wifi: mt76: mt7996: validate the RAM firmware region table 2871dc0e2b72 wifi: mt76: mt7925: validate CLC firmware regions and records 35d9c038be88 wifi: mt76: connac: validate the ROM patch section table 8356461aee79 wifi: mt76: mt7996: validate the ROM patch section table d4c9872bbd9c wifi: mt76: mt792x: use mt76_connac2_fw_check() 8a8c857798f5 wifi: mt76: mt7996: add scan dwell time hw cap 451f47376280 wifi: mt76: mt7996: take the link of an 802.3 frame from its station b4dd3d4f6d27 wifi: mt76: mt7996: do not update beacons while CSA is active d343a85da6fe wifi: mt76: mt7996: only remove a BMC STA_REC that was added 46ed43b905d5 wifi: mt76: mt7996: pass the puncturing bitmap to the firmware 49892ef42067 wifi: mt76: abort a scan when the chanctx changes 1507666f034f wifi: mt76: set the channel again when the chanctx puncturing changes ab907b18ddc9 wifi: mt76: mt7996: advertise preamble puncturing support d55666f37245 wifi: mt76: mt7996: keep scan and ROC links out of the MLD group fde06f678c30 wifi: mt76: mt7996: factor the vif link teardown out of remove_interface 25dbe41cf7c9 wifi: mt76: mt7996: destroy station links before the MLD group is freed fecc93e7f1ed wifi: mt76: mt7996: send MLD link operations for an AP MLD only 78084e732159 wifi: mt76: mt7996: set up a vif link again on another radio 1e1ca91c2b70 wifi: mt76: mt7996: describe an MLD peer with the PEER_MLD command 43008928840b wifi: mt76: mt7915: honour the valid flag in efuse block reads a60235641e8f wifi: mt76: mt7996: skip MLD address translation for encap offload frames 1152058aee06 wifi: mt76: mt7921: honour the valid flag in efuse block reads 2356292ae38f wifi: mt76: mt7915: upload the CSA beacon only once 801f6a53f2f1 wifi: mt76: read the chanctx of a link once 47665de41b5d wifi: mt76: restart the beacon monitor of a link that gets a chanctx again 9c4ada3a37eb wifi: mt76: publish the beacon monitor interval after its timestamp ba30cf5adb2b wifi: mt76: mt7996: keep rx header translation off while a monitor runs 6611f0126ccd wifi: mt76: mt7996: apply monitor mode again after a full reset 59b149d24e27 wifi: mt76: check the RX PN of an MLD peer once per peer d8d24d7cbf5d wifi: mt76: mt7996: send no MLD_SETUP when station links only go away 46b67e5b7c49 wifi: mt76: mt7996: keep a unicast management frame on its MLO link d7e3bee841a5 wifi: mt76: mt7996: pass the default DSCP map to the firmware 6428114db709 wifi: mt76: mt7996: write the TXD of stream classified 802.3 frames 2b926d2d7776 wifi: mt76: mt7996: support SCS and MSCS 7f2f67eebb54 wifi: mt76: mt7996: implement the flow offload flush op eb9e675d4cfc wifi: mt76: mt7996: implement the flow offload idle op 238538d7d1cf wifi: mt76: answer the flow priority query f349872e5149 firmware: update mt7990, mt7992 and mt7996 firmware to 202607 0936617dc529 wifi: mt76: mt7996: write the TXD of 802.3 frames with an explicit UP Signed-off-by: Felix Fietkau

wifi-scripts: write ftm_responder only for a radio with an FTM responder

2026-10-28T14:50:50Z

iface_rrm() appends ftm_responder to the BSS config with no feature check, so iface_ftm() only decides about lci and civic. A UCI ftm_responder=1 thus always reaches hostapd, which then sets the FTM responder bit of the Extended Capabilities element from the config alone, also where the driver has no FTM responder. Leave ftm_responder to iface_ftm(), which writes it, lci and civic where the phy sets NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER, as hostapd.sh does. Fixes: 218f3884d2fb ("wifi-scripts: add ucode based scripts") Signed-off-by: Felix Fietkau

wifi-scripts: read the FTM responder and background radar feature bits

2026-10-28T14:50:50Z

hostapd.uc tests NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER as bit 33 and NL80211_EXT_FEATURE_RADAR_BACKGROUND as bit 61. In nl80211.h they are 32 and 60; bits 33 and 61 are AIRTIME_FAIRNESS and POWERED_ADDR_CHANGE. The values had no effect until commit 28c6f5e6f7b8 ("wifi-scripts: fix extended-feature bit test"). Since then mt76 radios, which set AIRTIME_FAIRNESS, read as FTM responders, and mac80211_hwsim, which has an FTM responder, does not. Every mac80211 radio sets POWERED_ADDR_CHANGE, so every 5 GHz radio reads as capable of background radar. Use the values of nl80211.h. Fixes: 218f3884d2fb ("wifi-scripts: add ucode based scripts") Signed-off-by: Felix Fietkau

hostapd: send a link-agnostic action frame to a non-MLD STA on its link

2026-10-28T14:46:21Z

hapd_drv_send_action() sends the action frames that IEEE Std 802.11be-2024, 35.3.14 makes link-agnostic (Robust AV Streaming SCS and MSCS, WNM BSS Transition Management and WNM Sleep Mode) with link ID -1 to every station of an AP MLD. For a station that is not a non-AP MLD, the SA and the BSSID are the link address of the BSS, and cfg80211_mlme_mgmt_tx() refuses the frame with -EINVAL where that address is not the address of the interface. A non-MLO station on such a link gets no SCS Response and no MSCS Response. The rule of 35.3.14 holds between an AP MLD and a non-AP MLD only. Add patch 196, which sends these frames to a non-MLD station of the BSS on the link of the BSS, as hostapd_drv_sta_disassoc() does with patch 187. A destination without an entry in the BSS keeps link ID -1. Patches 834 and 853 are refreshed on top of it. Signed-off-by: Felix Fietkau

hostapd: free the taxonomy copy of the association frame

2026-10-28T14:46:20Z

handle_assoc() keeps a copy of each (Re)Association Request frame in sta->assoc_frame_taxonomy for the get_sta_ies ubus method, but ap_free_sta() frees only probe_ie_taxonomy and assoc_ie_taxonomy. Each freed station that sent a (Re)Association Request thus leaks the copy of its last request. A request of a station that is still present frees the previous copy in taxonomy_sta_info_assoc_frame(). Free the copy in ap_free_sta() with the other taxonomy data, and refresh the later patches whose hunks the two lines shift. Fixes: 79cd45ddeeb5 ("hostapd: add association frame to taxonomy data") Signed-off-by: Felix Fietkau