staging/xback, branch master

ustream-ssl: build after mbedtls when only uclient needs it

2026-11-04T13:09:16Z

uclient build-depends on ustream-ssl. With none of the libustream packages selected, ustream-ssl is built for uclient alone, as its default variant, mbedtls. The dependency of that variant on mbedtls only applies when libustream-mbedtls is selected, so nothing orders the two: when ustream-ssl configures before mbedtls is installed, CMake fails with mbedtls_library, mbedx509_library and mbedcrypto_library set to NOTFOUND. Builds of several trees on one jobserver hit this. Build after mbedtls unless an openssl or wolfssl variant is selected. Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

gdb: build only gdbserver when gdb is not selected

2026-11-04T11:22:42Z

Selecting gdbserver alone builds all of gdb, and the build dependencies of the gdb package pull in gmp, mpfr, ncurses, readline and zlib, while gdbserver uses none of them. On ath79 that took 1245 s of CPU and 249 s on 8 threads, most of it in a serial chain that tends to end the build. Make the libraries of gdb depend on its own selection, so that they are no longer build dependencies of gdbserver, and configure without gdb, bfd, opcodes, libctf, libsframe, libbacktrace and libdecnumber when gdb is not selected. gdbserver then builds from gdbsupport, gnulib and libiberty alone: 132 s of CPU and 39 s. The binary and the runtime dependencies of both packages stay the same, and selecting gdb as well reconfigures for the full build. Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

tools/ninja: support the pipe-based jobserver of GNU Make

2026-11-04T10:32:56Z

Since the update to 1.13.1, ninja uses its own jobserver client instead of the patch OpenWrt carried. That client only implements the fifo form of GNU Make 4.4 and later. GNU Make 4.3, the version of Ubuntu 22.04 and 24.04 and of Debian 12, passes its jobserver as a pair of pipe descriptors, which ninja ignores with "Pipe-based protocol is not supported!". Every ninja build then runs as many jobs as there are CPUs plus two, whatever -j the build was started with: tools/cmake and all CMake and Meson packages. Building several trees at -j6 on a 32 thread host ran 34 compilers per tree in tools/cmake, filling 30 GB of RAM and 39 GB of swap. Support the pipe form on Linux: open new non-blocking file descriptions of the inherited pipe through /proc/self/fd, so that make's own descriptors stay blocking. With make -j4, tools/cmake now runs at most 4 compilers at once, and two ninjas under one make share its 4 slots. Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

kernel: rmnet: expand the ingress headroom only when it is needed

2026-11-03T17:17:07Z

Add a pending patch (sent upstream, not accepted yet): for an Ethernet type real device, rmnet_map_ingress_handler() reallocated the head of every frame to push ETH_HLEN, also when the headroom was already there. Applies with zero fuzz to 6.18.60 (the upstream patch needed fuzz: its context has a data race annotation 6.18 does not have). Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

kernel: rmnet: allocate deaggregated packets with netdev_alloc_skb()

2026-11-03T17:17:06Z

Add a pending patch (sent upstream, not accepted yet): every packet split out of an aggregated QMAP frame got a kmalloc'ed head from alloc_skb(). netdev_alloc_skb() takes it from the per-CPU page fragment cache, with NET_SKB_PAD headroom, and a head_frag buffer GRO and TCP coalescing can merge as a fragment. Applies with zero fuzz to 6.18.60. Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

kernel: rmnet: use the monotonic clock for tx aggregation

2026-11-03T17:17:06Z

Add a pending patch (sent upstream, not accepted yet): rmnet's uplink aggregation decides on the wall clock (ktime_get_real_ts64()) whether traffic is sparse and when a frame has waited long enough. A clock step by NTP or GNSS then flushes needlessly or keeps the bypass check meaningless; use ktime_get() instead, which is also cheaper. Applies with zero fuzz to 6.18.60. Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

hostapd: enable the bgscan modules in the full wpa_supplicant config

2026-11-02T09:13:56Z

The full config, which the full and mesh wpa_supplicant variants are built with, leaves CONFIG_BGSCAN_SIMPLE and CONFIG_BGSCAN_LEARN off. A bgscan parameter in a network block is then accepted but does nothing: the station never scans in the background, and moves to another AP of its network only after it lost the current one. Seen on stations with bgscan="simple:30:-75:300:...": three hours of wpa_supplicant debug output without a single background scan, on test boards and on stations in the field alike (no bgscan code in the binary). An rb922 station (QCA988X, 10.1-ct firmware) that went an hour with heavy traffic and no scan also got into a state where its firmware no longer left the channel for a scan; with a scan every 10 minutes it ran 100 minutes of the same traffic without that. Enable both modules (bgscan learn is what a "learn" bgscan parameter asks for). They add 8 kB to the wpa_supplicant binary (mips_24kc). Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

hostapd: AP: restart the inactivity timer when a STA authenticates again

2026-11-02T09:13:56Z

A STA that roams to another AP with FT does not tell the AP it leaves, so that AP times it out: it disassociates the STA after a failed poll and deauthenticates and removes it AP_DEAUTH_DELAY (1 s) later. When the STA comes back in that second, its Authentication frame is accepted, but nothing stops the timer: it removes the STA before the Reassociation Request frame arrives, which is then rejected as a Class 2 frame from a STA that is not authenticated. The STA has to start over without FT, which takes 1-2 s instead of tens of milliseconds. Restart the timer as for a new STA when an existing STA authenticates. Seen on two rb922 roaming APs (ap_max_inactivity=30) with a station roaming between them every 46 s: 1 of 90 roams took 1.7 s, with "deauthenticated due to inactivity (timer DEAUTH/REMOVE)" between the FT authentication and "Station tried to associate before authentication". A new hwsim test that holds the Reassociation Request frame until the timer has expired fails without this patch in every run that gets that timing, and passes with it; the ap_ft module shows no change. The bug is still in upstream hostap (checked on 2026-10-30). Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

hostapd: bgscan simple: scan right away on beacon loss

2026-11-02T09:13:56Z

bgscan simple only logs a beacon loss report. A station whose AP goes out of range, or stops sending beacons, looks for another AP only at its next scan interval, which can be minutes away when the signal was above the threshold until then. Meanwhile it stays with an AP it does not hear, as long as that AP still acknowledges the frames the kernel sends to probe it. Scan right away on beacon loss, like on a further signal drop, unless the last background scan was less than 10 seconds ago. An AP that is not seen in that scan makes wpa_supplicant move to another AP of the network. Seen on field stations with bgscan simple:30:-75:300: up to 22 beacon loss reports in 15 hours, most of them without a disconnection, and no scan for minutes after them. The hwsim bgscan tests pass, and the full hwsim run shows no change against the unpatched package. Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte

hostapd: backport FT and nl80211 robustness fixes

2026-11-02T09:13:56Z

Backport from upstream hostap, all after the 2026-08-07 snapshot: fcae90b60 FT: Fix off-by-2 buffer bounds check in wpa_ft_process_rdie() f6e620ec6 FT: Ignore request requests without any resource descriptors ebe890e18 FT: Do not allow RIC related items to consume all available room 6daa7ff84 Check buffer room when writing Timeout Interval element 396a62817 FT: Ignore request descriptors with invalid or incomplete element(s) 741d70dd8 FT: Do not process RIC-Request in initial MD association 8a2611102 nl80211: Verify frame length before reading auth_alg The FT fixes bound what a station can make an AP write into its (Re)Association Response; roaming APs here run 802.11r FT-PSK. 6daa7ff84 uses buf + buflen in send_assoc_resp(): the end pointer of upstream 0eb84a59d is not in this snapshot. Built for ath79 (all hostapd variants of the tree); the patches apply on top of the full patch set. Assisted-by: Claude Opus 5.5 Signed-off-by: Koen Vandeputte