Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2218364/?format=api
{ "id": 2218364, "url": "http://patchwork.ozlabs.org/api/patches/2218364/?format=api", "web_url": "http://patchwork.ozlabs.org/project/hostap/patch/20260401054901.3780435-17-peddolla.reddy@oss.qualcomm.com/", "project": { "id": 22, "url": "http://patchwork.ozlabs.org/api/projects/22/?format=api", "name": "HostAP Development", "link_name": "hostap", "list_id": "hostap.lists.infradead.org", "list_email": "hostap@lists.infradead.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260401054901.3780435-17-peddolla.reddy@oss.qualcomm.com>", "list_archive_url": null, "date": "2026-04-01T05:48:54", "name": "[RFC,16/23] PR: Add dedicated interface for PASN with custom MAC address", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "ea4c3de2d6e3aea7dfce27fbf739a92572549299", "submitter": { "id": 93026, "url": "http://patchwork.ozlabs.org/api/people/93026/?format=api", "name": "Peddolla Harshavardhan Reddy", "email": "peddolla.reddy@oss.qualcomm.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/hostap/patch/20260401054901.3780435-17-peddolla.reddy@oss.qualcomm.com/mbox/", "series": [ { "id": 498276, "url": "http://patchwork.ozlabs.org/api/series/498276/?format=api", "web_url": "http://patchwork.ozlabs.org/project/hostap/list/?series=498276", "date": "2026-04-01T05:48:44", "name": "PR: Add nl80211 support and ranging for Proximity Detection", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/498276/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2218364/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2218364/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=lists.infradead.org header.i=@lists.infradead.org\n header.a=rsa-sha256 header.s=bombadil.20210309 header.b=Fqgms1mQ;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256\n header.s=qcppdkim1 header.b=n1yByt6D;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com\n header.a=rsa-sha256 header.s=google header.b=fV3NyJVI;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=none (no SPF record) smtp.mailfrom=lists.infradead.org\n (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org;\n envelope-from=hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from bombadil.infradead.org (bombadil.infradead.org\n [IPv6:2607:7c80:54:3::133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4flvH44Ml5z1yGH\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 01 Apr 2026 16:50:56 +1100 (AEDT)", "from localhost ([::1] helo=bombadil.infradead.org)\n\tby bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1w7oT8-0000000E1Kq-3mcp;\n\tWed, 01 Apr 2026 05:50:23 +0000", "from mx0b-0031df01.pphosted.com ([205.220.180.131])\n\tby bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1w7oSt-0000000E0ug-2n7T\n\tfor hostap@lists.infradead.org;\n\tWed, 01 Apr 2026 05:50:13 +0000", "from pps.filterd (m0279872.ppops.net [127.0.0.1])\n\tby mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id\n 6314O7CO1562629\n\tfor <hostap@lists.infradead.org>; Wed, 1 Apr 2026 05:50:06 GMT", "from mail-pl1-f199.google.com (mail-pl1-f199.google.com\n [209.85.214.199])\n\tby mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4d8va3r9ge-1\n\t(version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT)\n\tfor <hostap@lists.infradead.org>; Wed, 01 Apr 2026 05:50:05 +0000 (GMT)", "by mail-pl1-f199.google.com with SMTP id\n d9443c01a7336-2b0c92ff4ebso67855115ad.2\n for <hostap@lists.infradead.org>;\n Tue, 31 Mar 2026 22:50:05 -0700 (PDT)", "from hu-peddolla-hyd.qualcomm.com ([202.46.23.25])\n by smtp.gmail.com with ESMTPSA id\n d9443c01a7336-2b24268aa4fsm129919665ad.36.2026.03.31.22.50.02\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 31 Mar 2026 22:50:03 -0700 (PDT)" ], "DKIM-Signature": [ "v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=lists.infradead.org; s=bombadil.20210309; h=Sender:\n\tContent-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:\n\tList-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:\n\tMessage-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description:\n\tResent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:\n\tList-Owner; bh=vGSwoM2NmyOnd6cXxc7ppeLGGUf7hJ50f8mg86KIrY0=; b=Fqgms1mQ8s7kTu\n\tCnGKPlQasKWo+n4xBrhy63KEYo1lz99wqgsZL8h25SB+gUXbb6ClutuecRd7eplkdegCd094ghn4N\n\tL+vz9grdkquerbJNdTsBwPBY4CeVMy/8Jk8sYDrGXKmACIsyk82rZMrkuSNsimm34Qr6wTL87h3Ac\n\tpWEucSPEqsILndCVllr75hF08odruzKJQMrlk6CkbyhR4008bLV6Lw2uPWvXX6NO97OR+w9FWw6k4\n\tTGJB3KHJFUQV+pvEBz2dF83b7ZRXM83JLiQvnWuMzksWLmJXoifAiG9+5pf+Vo4Z1NPLU/XhStSd0\n\te+fo8IFWPPOeviLASyig==;", "v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h=\n\tcc:content-transfer-encoding:content-type:date:from:in-reply-to\n\t:message-id:mime-version:references:subject:to; s=qcppdkim1; bh=\n\tSQLXvbvF1zyVQ1nVtnZZb6fCT2728DrvDFXGgXy1hBM=; b=n1yByt6DRQr41kQp\n\ta5P79RQLRJY0xXG0Mbb69Q9/VzlqXoC49uQOS7ZYB/9yohKK0lw9RXh3yzKSHG+Q\n\tq0JCK3bE4EjDPr3pNZ436B6CoPRMvI3eDvz3AIJ6zjp4pHgmeNSdsKMwvHh9fFUn\n\t99IHHI/VnMVKV80vi7k9A4ccISyoXMgrADQmcPKd1HVN93qnfcL0cQOltx4T7m74\n\t3e02VUmEZ7iNiUGLAzToVhJs7IJueOqlasABQNuuSG3wJiHKH1pjkkQMgdXjDlD0\n\thMzvvgC5x26I6x3MrbJcwgZCUNHuvtJnhsMfwaChKSxePPcep3MHu0G710VdZRoH\n\tlqGtMA==", "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=oss.qualcomm.com; s=google; t=1775022605; x=1775627405;\n darn=lists.infradead.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=SQLXvbvF1zyVQ1nVtnZZb6fCT2728DrvDFXGgXy1hBM=;\n b=fV3NyJVIt/6I7EMSNRD9wPlbNwOAPNJgutB6BsDQcqXb718ixOZXD6PXbT/f8CAia9\n oOv+Q1BKi9VnVHfoJ/WyDlBXv0zYqsfmrbfMZphvMxZ6YMbw6iGmuOK7nvv0g1J7NiMP\n O7XYxPGe/mL6Y4/UZYZ2g9NhSmFge4xBidhUYsfJP2XZXm1NdZGnRSD7fr6OrfQDw+Yd\n KEI9WfMX6Bhxej7+nIMt1WhJzzWLqACCkksMRYSsiOxoTYGrhJiQluogQAZ3mpbffKte\n dS0c6QmH3P8kmbPaC6Hj6oMx8d7DE+VwBsBsGMW+F96LFI/syy7Z3jtM3mtVVURjjGyl\n yHxg==" ], "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775022605; x=1775627405;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=SQLXvbvF1zyVQ1nVtnZZb6fCT2728DrvDFXGgXy1hBM=;\n b=qlfSJ6QV8k899RwczPDYp5xSQ+fnsbbrMey9Tp8dN+988ggWUFEa7LxMtdky9ME5E5\n 5rGnfx9EotvfLRFG8omdTXKEo5zYXb2UEbkoyGh8ap3O0yUy3keL0byokxROLtHLPYSp\n nuNVikjQ9PHQJsPAGOxPEniNjW4iAq+EczAwRrVSbJZV7pn7+VgEHpVP/KRrj1Bgk3gB\n 6ycxvNSpszWEvwP5f4aMYpD0e0Rhhi89t+u0wHZc8rge1E3zZ4mQ9vrSf79sRGHmT/n0\n X2v7qd4PPo6vIDPydFO0/Pb00AMfRnt2nWMUQwptfyPV6cDcU+Cw6AdM2srw0QlNpezw\n BKFg==", "X-Gm-Message-State": "AOJu0YzRtJWKPhkiQRwlX9C9KbdnJz9rxv0PLfliZgF1b5+pYWaXJXqb\n\twxUYTbjDWZPP5KmdswjML/b9wQF8J7veT4qwYXxBfL3+iVpQuFl+o7CkFybvT8M+CBhK03UtoRk\n\tKX6SHr8B7oR/vfD1H3iPfmY0r2JecRXIOSvmvsHY+Zk/oGb0dLWQMIDa3+iyK5X0aL+1OLpo=", "X-Gm-Gg": "ATEYQzzIpC7ksxl+CJTlESWJTZ0Q5TdBpbqDbLVMVfFkidPuDYfpcOFGwsP4wI0JKQk\n\txTPIEyR9RZrvY4wnRRimALcIWzj66CIVUXFK8OpdNIvqAs7QZrqdxUKhPL4joY8axBJaDieR0vd\n\tzwvqz16/eoWqRDTsgFHpnMH2MzB/kEBufNGlbNpRSJLkW/p8FPPDiN716mP/IxOJUCnXTHvDdKj\n\tBRTfayHH93o0EM9z8kFzQb9PCZGx9NtOSZaNYziezzrg9c9soRbisCGa/A4nFiy4bSc/hLqfddm\n\tEe3oR3TxnKJUfa5jN50OfKL2D5RMPgk49WEJS/TzorizW3UHAxNnVxjVHDz4//R4NFWFcB7Pw1d\n\t4YGBxhGuePcIpZPMo3omuGBD0WuSgPJWTzWoGj5bF6IjRQU3+bir04dM=", "X-Received": [ "by 2002:a17:903:384f:b0:2b2:57ee:c04e with SMTP id\n d9443c01a7336-2b269add3fcmr21625685ad.18.1775022604660;\n Tue, 31 Mar 2026 22:50:04 -0700 (PDT)", "by 2002:a17:903:384f:b0:2b2:57ee:c04e with SMTP id\n d9443c01a7336-2b269add3fcmr21625435ad.18.1775022604009;\n Tue, 31 Mar 2026 22:50:04 -0700 (PDT)" ], "From": "Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>", "To": "hostap@lists.infradead.org", "Cc": "vjakkam@qti.qualcomm.com", "Subject": "[RFC PATCH 16/23] PR: Add dedicated interface for PASN with custom\n MAC address", "Date": "Wed, 1 Apr 2026 11:18:54 +0530", "Message-Id": "<20260401054901.3780435-17-peddolla.reddy@oss.qualcomm.com>", "X-Mailer": "git-send-email 2.34.1", "In-Reply-To": "<20260401054901.3780435-1-peddolla.reddy@oss.qualcomm.com>", "References": "<20260401054901.3780435-1-peddolla.reddy@oss.qualcomm.com>", "MIME-Version": "1.0", "X-Proofpoint-GUID": "VAVPOgQ_KtGNSFB_0ikiFcKUUr0ZUqIO", "X-Proofpoint-ORIG-GUID": "VAVPOgQ_KtGNSFB_0ikiFcKUUr0ZUqIO", "X-Authority-Analysis": "v=2.4 cv=B/C0EetM c=1 sm=1 tr=0 ts=69ccb20d cx=c_pps\n a=JL+w9abYAAE89/QcEU+0QA==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17\n a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10\n a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22\n a=EUspDBNiAAAA:8 a=MKG9o4V8JaccK7WyVMsA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10\n a=324X-CrmTo6CU4MGRt3R:22", "X-Proofpoint-Spam-Details-Enc": "AW1haW4tMjYwNDAxMDA0NyBTYWx0ZWRfXzUtRkMTYqfbe\n 0Jnd59uRpVezmR1M1PSj4uMRoQVgp3U3MdZLJ+M4T22Iq5ddasQ7bOxgnGVy7/U1ZpLA+ITa5h7\n fJMrokTGh3/MvpLaUi7uxW7iCOosnfnGQwGOB0RYuFM3GNGyIIt4xYmdrUJIvvgAzQM63JOQjXP\n Nbofos4rrvpRF4dG2pjHg9r1fyDS0p76bZ6mMXVR0JU3Lt/hnsMZ3r2w+1B07lU1lpMtZKW9S2M\n KB3hgxQkmFIQGk+3vi7jaXX8PIllCF6zTWfpDMXgfBuV33OX584iQ9tCykoW8/uO8Sp8k2dn12a\n XoAAzmEHHID+MJrQOecVewxgxVp5EbFKmG8jfsaJI4IrjgoR/EIgi7G++UfbqxMjAf+lMq+GMbW\n EPJ4qS1AYgJM+hGStL/cIKZg7jb+yqVuHtn0oXQkTkZjMnVn32KB+6Ovfl3eYR0X3f3KYfkV7rs\n k08o0XjpHuW+19XLB2A==", "X-Proofpoint-Virus-Version": "vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49\n definitions=2026-04-01_02,2026-03-31_02,2025-10-01_01", "X-Proofpoint-Spam-Details": "rule=outbound_notspam policy=outbound score=0\n spamscore=0 priorityscore=1501 bulkscore=0 phishscore=0 malwarescore=0\n lowpriorityscore=0 adultscore=0 clxscore=1015 impostorscore=0 suspectscore=0\n classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0\n reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2604010047", "X-CRM114-Version": "20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 ", "X-CRM114-CacheID": "sfid-20260331_225008_177293_CE600802 ", "X-CRM114-Status": "GOOD ( 32.33 )", "X-Spam-Score": "0.2 (/)", "X-Spam-Report": "Spam detection software,\n running on the system \"bombadil.infradead.org\",\n has NOT identified this incoming email as spam. The original\n message has been attached to this so you can view it or label\n similar future email. If you have any questions, see\n the administrator of that system for details.\n Content preview: When PR PASN is triggered with a custom source address, the\n existing code has no way to create a virtual interface carrying that MAC.\n Using the main interface directly prevents the driver from transmi [...]\n Content analysis details: (0.2 points, 5.0 required)\n pts rule name description\n ---- ----------------------\n --------------------------------------------------\n -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low\n trust\n [205.220.180.131 listed in list.dnswl.org]\n 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record\n -0.0 SPF_PASS SPF: sender matches SPF record\n 0.1 DKIM_SIGNED Message has a DKIM or DK signature,\n not necessarily valid\n -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from\n envelope-from domain\n -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from\n author's\n domain\n -0.1 DKIM_VALID Message has at least one valid DKIM or DK\n signature\n 1.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The\n query to Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [205.220.180.131 listed in\n sa-trusted.bondedsender.org]\n 1.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to\n Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [205.220.180.131 listed in\n sa-accredit.habeas.com]\n -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%\n [score: 0.0000]\n 1.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to\n Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [205.220.180.131 listed in\n bl.score.senderscore.com]", "X-BeenThere": "hostap@lists.infradead.org", "X-Mailman-Version": "2.1.34", "Precedence": "list", "List-Id": "<hostap.lists.infradead.org>", "List-Unsubscribe": "<http://lists.infradead.org/mailman/options/hostap>,\n <mailto:hostap-request@lists.infradead.org?subject=unsubscribe>", "List-Archive": "<http://lists.infradead.org/pipermail/hostap/>", "List-Post": "<mailto:hostap@lists.infradead.org>", "List-Help": "<mailto:hostap-request@lists.infradead.org?subject=help>", "List-Subscribe": "<http://lists.infradead.org/mailman/listinfo/hostap>,\n <mailto:hostap-request@lists.infradead.org?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Sender": "\"Hostap\" <hostap-bounces@lists.infradead.org>", "Errors-To": "hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org" }, "content": "When PR PASN is triggered with a custom source address, the\nexisting code has no way to create a virtual interface carrying\nthat MAC. Using the main interface directly prevents the driver\nfrom transmitting PASN frames with the requested address.\n\nCreate a dedicated kernel virtual interface (WPA_IF_PD) with the\nrequested MAC. For the initiator role the interface is created before\nqueuing the radio work. For the responder role, ROC is started on the\nexisting interface to receive the incoming PASN Auth1 frame, and the\ndedicated interface is created lazily on first M1 reception. A new\npr_mgmt flag mirrors nan_mgmt to suppress L2, TDLS, notify and\nP2P initialisation on the management-only interface.\n\nSigned-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>\n---\n wpa_supplicant/events.c | 4 +\n wpa_supplicant/pr_supplicant.c | 320 +++++++++++++++++++++++++++++-\n wpa_supplicant/pr_supplicant.h | 10 +\n wpa_supplicant/wpa_supplicant.c | 3 +-\n wpa_supplicant/wpa_supplicant_i.h | 24 +++\n 5 files changed, 358 insertions(+), 3 deletions(-)", "diff": "diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c\nindex 721b1aa23..3d05df2e3 100644\n--- a/wpa_supplicant/events.c\n+++ b/wpa_supplicant/events.c\n@@ -7255,6 +7255,10 @@ void wpa_supplicant_event(void *ctx, enum wpa_event_type event,\n #endif /* CONFIG_DPP */\n \t\twpas_nan_usd_cancel_remain_on_channel_cb(\n \t\t\twpa_s, data->remain_on_channel.freq);\n+#ifdef CONFIG_PR\n+\t\twpas_pr_cancel_remain_on_channel_cb(\n+\t\t\twpa_s, data->remain_on_channel.freq);\n+#endif /* CONFIG_PR */\n \t\tbreak;\n \tcase EVENT_EAPOL_RX:\n \t\twpa_supplicant_rx_eapol(wpa_s, data->eapol_rx.src,\ndiff --git a/wpa_supplicant/pr_supplicant.c b/wpa_supplicant/pr_supplicant.c\nindex fef1e278b..f265966e2 100644\n--- a/wpa_supplicant/pr_supplicant.c\n+++ b/wpa_supplicant/pr_supplicant.c\n@@ -21,6 +21,9 @@\n \n #ifdef CONFIG_PASN\n static void wpas_pr_pasn_timeout(void *eloop_ctx, void *timeout_ctx);\n+\n+/* Duration (ms) for the ROC started when acting as PASN responder */\n+#define PR_PASN_RESPONDER_ROC_DURATION 5000\n #endif /* CONFIG_PASN */\n \n \n@@ -306,6 +309,7 @@ static void wpas_pr_pasn_set_keys(void *ctx, const u8 *own_addr,\n \n \tos_memset(¶ms, 0, sizeof(params));\n \tparams.ifname = wpa_s->ifname;\n+\tparams.own_addr = own_addr;\n \tparams.alg = wpa_cipher_to_alg(cipher);\n \tparams.addr = peer_addr;\n \tparams.key_idx = 0;\n@@ -336,6 +340,7 @@ static void wpas_pr_pasn_clear_keys(void *ctx, const u8 *own_addr,\n \n \tos_memset(¶ms, 0, sizeof(params));\n \tparams.ifname = wpa_s->ifname;\n+\tparams.own_addr = own_addr;\n \tparams.alg = WPA_ALG_NONE;\n \tparams.addr = peer_addr;\n \tparams.key_idx = 0;\n@@ -505,6 +510,27 @@ void wpas_pr_deinit(struct wpa_supplicant *wpa_s)\n }\n \n \n+void wpas_pr_pd_stop(struct wpa_supplicant *wpa_s)\n+{\n+\tif (is_zero_ether_addr(wpa_s->pd_addr)) {\n+\t\twpa_printf(MSG_DEBUG, \"PR: pd_stop: no active PD wdev\");\n+\t\treturn;\n+\t}\n+\n+\twpa_printf(MSG_DEBUG, \"PR: Stopping PD wdev addr=\" MACSTR,\n+\t\t MAC2STR(wpa_s->pd_addr));\n+\n+\twpa_drv_pd_stop(wpa_s);\n+\tos_memset(wpa_s->pd_addr, 0, ETH_ALEN);\n+\twpa_printf(MSG_DEBUG, \"PR: PD wdev stopped\");\n+}\n+\n+void wpas_pr_cleanup_interface(struct wpa_global *global)\n+{\n+\tif (global->pr_init_wpa_s)\n+\t\twpas_pr_pd_stop(global->pr_init_wpa_s);\n+}\n+\n void wpas_pr_update_dev_addr(struct wpa_supplicant *wpa_s)\n {\n \tpr_set_dev_addr(wpa_s->global->pr, wpa_s->own_addr);\n@@ -537,6 +563,40 @@ void wpas_pr_set_dev_ik(struct wpa_supplicant *wpa_s, const u8 *dik,\n \n #ifdef CONFIG_PASN\n \n+static int wpas_pr_start_pd(struct wpa_supplicant *wpa_s, const u8 *src_addr)\n+{\n+\tu8 pd_addr[ETH_ALEN];\n+\n+\tif (!src_addr || is_zero_ether_addr(src_addr)) {\n+\t\twpa_printf(MSG_ERROR, \"PR: Invalid MAC address for PD wdev\");\n+\t\treturn -1;\n+\t}\n+\n+\tif (!is_zero_ether_addr(wpa_s->pd_addr)) {\n+\t\twpa_printf(MSG_ERROR,\n+\t\t\t \"PR: PD wdev already active addr=\" MACSTR,\n+\t\t\t MAC2STR(wpa_s->pd_addr));\n+\t\treturn -1;\n+\t}\n+\n+\twpa_printf(MSG_DEBUG,\n+\t\t \"PR: Creating PD wdev with MAC \" MACSTR,\n+\t\t MAC2STR(src_addr));\n+\n+\tos_memset(pd_addr, 0, ETH_ALEN);\n+\tif (wpa_drv_pd_start(wpa_s, src_addr, pd_addr) < 0) {\n+\t\twpa_printf(MSG_ERROR, \"PR: Failed to create PD wdev\");\n+\t\treturn -1;\n+\t}\n+\n+\tos_memcpy(wpa_s->pd_addr, pd_addr, ETH_ALEN);\n+\tpr_set_dev_addr(wpa_s->global->pr, pd_addr);\n+\n+\twpa_printf(MSG_DEBUG,\n+\t\t \"PR: PD wdev created addr=\" MACSTR, MAC2STR(pd_addr));\n+\treturn 0;\n+}\n+\n struct wpa_pr_pasn_auth_work {\n \tu8 peer_addr[ETH_ALEN];\n \tu8 auth_mode;\n@@ -551,6 +611,12 @@ struct wpa_pr_pasn_auth_work {\n };\n \n \n+struct wpa_pr_pasn_roc_work {\n+\tunsigned int freq;\n+\tu8 src_addr[ETH_ALEN];\n+};\n+\n+\n static void wpas_pr_pasn_free_auth_work(struct wpa_pr_pasn_auth_work *awork)\n {\n \tif (!awork)\n@@ -569,6 +635,128 @@ static void wpas_pr_pasn_cancel_auth_work(struct wpa_supplicant *wpa_s)\n }\n \n \n+/**\n+ * wpas_pr_pasn_roc_work_done - Complete the PR responder ROC radio work item\n+ * @wpa_s: Pointer to wpa_supplicant data\n+ *\n+ * Idempotent helper: frees the work context, calls radio_work_done(), and\n+ * clears pr_roc_work. Safe to call even if pr_roc_work is already NULL.\n+ */\n+static void wpas_pr_pasn_roc_work_done(struct wpa_supplicant *wpa_s)\n+{\n+\tstruct wpa_pr_pasn_roc_work *rwork;\n+\n+\tif (!wpa_s->pr_roc_work)\n+\t\treturn;\n+\n+\trwork = wpa_s->pr_roc_work->ctx;\n+\tos_free(rwork);\n+\twpa_s->pr_roc_work->ctx = NULL;\n+\tradio_work_done(wpa_s->pr_roc_work);\n+\twpa_s->pr_roc_work = NULL;\n+}\n+\n+\n+/**\n+ * wpas_pr_pasn_roc_start_cb - Radio work callback to start the responder ROC\n+ * @work: Radio work item\n+ * @deinit: Non-zero if the work item is being cancelled/deinitialized\n+ *\n+ * Called by the radio work scheduler when it is safe to start the\n+ * remain-on-channel operation for the PR PASN responder. On success the\n+ * driver is asked to stay on @freq for PR_PASN_RESPONDER_ROC_DURATION ms so\n+ * that the incoming M1 frame can be received.\n+ */\n+static void wpas_pr_pasn_roc_start_cb(struct wpa_radio_work *work, int deinit)\n+{\n+\tstruct wpa_supplicant *wpa_s = work->wpa_s;\n+\tstruct wpa_pr_pasn_roc_work *rwork = work->ctx;\n+\n+\tif (deinit) {\n+\t\tif (work->started) {\n+\t\t\t/*\n+\t\t\t * ROC was already started but the work is being\n+\t\t\t * cancelled (e.g., interface removal). Cancel the\n+\t\t\t * driver ROC and clear the channel state.\n+\t\t\t */\n+\t\t\twpa_s->pr_roc_work = NULL;\n+\t\t\twpa_drv_cancel_remain_on_channel(wpa_s);\n+\t\t\twpa_s->off_channel_freq = 0;\n+\t\t\twpa_s->roc_waiting_drv_freq = 0;\n+\t\t}\n+\t\t/*\n+\t\t * Clear responder state regardless of whether the work was\n+\t\t * started or not — the ROC will never fire now.\n+\t\t */\n+\t\twpa_s->pr_responder_mode = false;\n+\t\tos_memset(wpa_s->pr_responder_src_addr, 0, ETH_ALEN);\n+\t\tos_free(rwork);\n+\t\twork->ctx = NULL;\n+\t\treturn;\n+\t}\n+\n+\twpa_s->pr_roc_work = work;\n+\n+\twpa_printf(MSG_DEBUG,\n+\t\t \"PR PASN: Starting ROC on \" MACSTR\n+\t\t \" at freq %u ms for responder role\",\n+\t\t MAC2STR(rwork->src_addr), rwork->freq);\n+\n+\tif (wpa_drv_remain_on_channel(wpa_s, rwork->freq,\n+\t\t\t\t PR_PASN_RESPONDER_ROC_DURATION,\n+\t\t\t\t rwork->src_addr) < 0) {\n+\t\twpa_printf(MSG_ERROR,\n+\t\t\t \"PR PASN: Failed to start ROC for responder\");\n+\t\twpa_s->pr_responder_mode = false;\n+\t\tos_memset(wpa_s->pr_responder_src_addr, 0, ETH_ALEN);\n+\t\tos_free(rwork);\n+\t\twork->ctx = NULL;\n+\t\tradio_work_done(work);\n+\t\twpa_s->pr_roc_work = NULL;\n+\t\treturn;\n+\t}\n+\n+\twpa_s->off_channel_freq = 0;\n+\twpa_s->roc_waiting_drv_freq = rwork->freq;\n+}\n+\n+\n+/**\n+ * wpas_pr_cancel_remain_on_channel_cb - ROC cancel/expiry callback for PR\n+ * @wpa_s: Pointer to wpa_supplicant data\n+ * @freq: Frequency (MHz) on which the ROC was running\n+ *\n+ * Called by the event dispatcher whenever the driver signals that a\n+ * remain-on-channel operation has ended (either because it expired or was\n+ * explicitly cancelled). If the PR responder ROC work item is still live\n+ * (i.e., M1 has not yet been received), the responder state is cleared and\n+ * the radio work item is completed so the radio is released.\n+ */\n+void wpas_pr_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,\n+\t\t\t\t\t unsigned int freq)\n+{\n+\twpa_printf(MSG_DEBUG,\n+\t\t \"PR PASN: Remain on channel cancel for %u MHz\", freq);\n+\n+\tif (!wpa_s->pr_roc_work)\n+\t\treturn;\n+\n+\t/*\n+\t * ROC expired or was cancelled before M1 arrived. Clear the\n+\t * responder state so we do not leave stale flags behind.\n+\t */\n+\tif (wpa_s->pr_responder_mode) {\n+\t\twpa_printf(MSG_DEBUG,\n+\t\t\t \"PR PASN: ROC expired before M1 received, \"\n+\t\t\t \"clearing responder state\");\n+\t\twpa_s->pr_responder_mode = false;\n+\t\tos_memset(wpa_s->pr_responder_src_addr, 0, ETH_ALEN);\n+\t}\n+\n+\twpas_pr_pasn_roc_work_done(wpa_s);\n+}\n+\n+\n static void wpas_pr_pasn_timeout(void *eloop_ctx, void *timeout_ctx)\n {\n \tstruct wpa_supplicant *wpa_s = eloop_ctx;\n@@ -577,6 +765,16 @@ static void wpas_pr_pasn_timeout(void *eloop_ctx, void *timeout_ctx)\n \t\twpas_pr_pasn_cancel_auth_work(wpa_s);\n \t\twpa_s->pr_pasn_auth_work = NULL;\n \t}\n+\n+\t/*\n+\t * Stop the PD wdev only after radio_work_done() has\n+\t * fully returned. Calling wpas_pr_pd_stop() from inside\n+\t * the radio-work deinit callback would trigger a re-entrant\n+\t * radio_remove_works() → radio_work_free() on the same work item,\n+\t * causing a use-after-free / SIGSEGV.\n+\t */\n+\twpas_pr_pd_stop(wpa_s);\n+\n \twpa_printf(MSG_DEBUG, \"PR: PASN timed out\");\n }\n \n@@ -594,6 +792,7 @@ static void wpas_pr_pasn_auth_start_cb(struct wpa_radio_work *work, int deinit)\n \t\t\teloop_cancel_timeout(wpas_pr_pasn_timeout, wpa_s, NULL);\n \n \t\twpas_pr_pasn_free_auth_work(awork);\n+\t\twork->ctx = NULL;\n \t\treturn;\n \t}\n \n@@ -618,6 +817,15 @@ fail:\n \twpas_pr_pasn_free_auth_work(awork);\n \twork->ctx = NULL;\n \tradio_work_done(work);\n+\t/*\n+\t * Clean up the PR interface only after radio_work_done() has\n+\t * completed. Calling wpas_pr_pd_stop() before\n+\t * radio_work_done() would trigger radio_remove_works() →\n+\t * radio_work_free() on this work item while it is still live,\n+\t * causing a use-after-free when radio_work_done() later tries to\n+\t * free it again.\n+\t */\n+\twpas_pr_pd_stop(wpa_s);\n }\n \n \n@@ -629,12 +837,61 @@ int wpas_pr_initiate_pasn_auth(struct wpa_supplicant *wpa_s,\n {\n \tstruct wpa_pr_pasn_auth_work *awork;\n \n+\tif (pasn_role == PR_ROLE_PASN_RESPONDER &&\n+\t src_addr && !is_zero_ether_addr(src_addr)) {\n+\t\tstruct wpa_pr_pasn_roc_work *rwork;\n+\n+\t\twpa_printf(MSG_DEBUG,\n+\t\t\t \"PR PASN: Scheduling ROC on \" MACSTR\n+\t\t\t \" at freq %d for responder role\",\n+\t\t\t MAC2STR(src_addr), freq);\n+\n+\t\trwork = os_zalloc(sizeof(*rwork));\n+\t\tif (!rwork)\n+\t\t\treturn -1;\n+\n+\t\trwork->freq = freq;\n+\t\tos_memcpy(rwork->src_addr, src_addr, ETH_ALEN);\n+\n+\t\t/*\n+\t\t * Store state so wpas_pr_pasn_auth_rx can create the\n+\t\t * PD interface when M1 arrives.\n+\t\t */\n+\t\twpa_s->pr_responder_mode = true;\n+\t\tos_memcpy(wpa_s->pr_responder_src_addr, src_addr, ETH_ALEN);\n+\t\tif (radio_add_work(wpa_s, freq, \"pr-pasn-roc\", 0,\n+\t\t\t\t wpas_pr_pasn_roc_start_cb, rwork) < 0) {\n+\t\t\twpa_printf(MSG_ERROR,\n+\t\t\t\t \"PR PASN: Failed to schedule ROC for responder\");\n+\t\t\tos_free(rwork);\n+\t\t\twpa_s->pr_responder_mode = false;\n+\t\t\tos_memset(wpa_s->pr_responder_src_addr, 0, ETH_ALEN);\n+\t\t\treturn -1;\n+\t\t}\n+\n+\t\treturn 0;\n+\t}\n+\n+\t/*\n+\t * PASN initiator role: create the PD wdev if src_addr is provided,\n+\t * then queue the radio work to send M1.\n+\t */\n+\tif (src_addr && !is_zero_ether_addr(src_addr)) {\n+\t\tif (wpas_pr_start_pd(wpa_s, src_addr) < 0) {\n+\t\t\twpa_printf(MSG_ERROR,\n+\t\t\t\t \"PR PASN: Failed to create PD wdev\");\n+\t\t\treturn -1;\n+\t\t}\n+\t}\n+\n \twpas_pr_pasn_cancel_auth_work(wpa_s);\n \twpa_s->pr_pasn_auth_work = NULL;\n \n \tawork = os_zalloc(sizeof(*awork));\n-\tif (!awork)\n+\tif (!awork) {\n+\t\twpas_pr_pd_stop(wpa_s);\n \t\treturn -1;\n+\t}\n \n \tawork->freq = freq;\n \tos_memcpy(awork->peer_addr, peer_addr, ETH_ALEN);\n@@ -646,6 +903,7 @@ int wpas_pr_initiate_pasn_auth(struct wpa_supplicant *wpa_s,\n \tif (!radio_add_work(wpa_s, freq, \"pr-pasn-start-auth\", 1,\n \t\t\t wpas_pr_pasn_auth_start_cb, awork)) {\n \t\twpas_pr_pasn_free_auth_work(awork);\n+\t\twpas_pr_pd_stop(wpa_s);\n \t\treturn -1;\n \t}\n \n@@ -660,7 +918,13 @@ int wpas_pr_pasn_auth_tx_status(struct wpa_supplicant *wpa_s, const u8 *data,\n {\n \tstruct pr_data *pr = wpa_s->global->pr;\n \n-\tif (!wpa_s->pr_pasn_auth_work)\n+\t/*\n+\t * For the PASN responder role no radio work item is created, but we\n+\t * still need to process the TX status of the M2 frame sent on the\n+\t * parent interface via the PD wdev.\n+\t */\n+\tif (!wpa_s->pr_pasn_auth_work &&\n+\t is_zero_ether_addr(wpa_s->pd_addr))\n \t\treturn -1;\n \n \treturn pr_pasn_auth_tx_status(pr, data, data_len, acked);\n@@ -672,9 +936,61 @@ int wpas_pr_pasn_auth_rx(struct wpa_supplicant *wpa_s,\n \t\t\t int freq)\n {\n \tstruct pr_data *pr = wpa_s->global->pr;\n+\tu16 auth_transaction;\n \n \tif (!pr)\n \t\treturn -2;\n+\n+\twpa_printf(MSG_DEBUG, \"AUTH RX CALLED \");\n+\n+\t/*\n+\t * Responder path: when we are waiting for PASN M1 on the parent\n+\t * interface ROC, create the PD wdev on first receipt of Auth1 before\n+\t * handing the frame to the common layer.\n+\t */\n+\tif (wpa_s->pr_responder_mode &&\n+\t len >= offsetof(struct ieee80211_mgmt, u.auth.variable)) {\n+\t\tauth_transaction =\n+\t\t\tle_to_host16(mgmt->u.auth.auth_transaction);\n+\n+\t\tif (auth_transaction == WLAN_AUTH_TR_SEQ_PASN_AUTH1) {\n+\t\t\twpa_printf(MSG_DEBUG,\n+\t\t\t\t \"PR PASN: M1 received in responder mode, \"\n+\t\t\t\t \"creating PD wdev\");\n+\n+\t\t\tif (wpas_pr_start_pd(wpa_s,\n+\t\t\t\t\t wpa_s->pr_responder_src_addr) < 0) {\n+\t\t\t\twpa_printf(MSG_ERROR,\n+\t\t\t\t\t \"PR PASN: Failed to create PD wdev \"\n+\t\t\t\t\t \"for responder\");\n+\t\t\t\treturn -1;\n+\t\t\t}\n+\n+\t\t\t/*\n+\t\t\t * Cancel ROC on the listening interface; the dedicated\n+\t\t\t * PR interface will handle all subsequent frames.\n+\t\t\t * Then complete the radio work item so the radio is\n+\t\t\t * released for other operations.\n+\t\t\t *\n+\t\t\t * wpas_pr_cancel_remain_on_channel_cb() may also fire\n+\t\t\t * asynchronously when the driver processes the cancel\n+\t\t\t * request, but wpas_pr_pasn_roc_work_done() is\n+\t\t\t * idempotent (no-op if pr_roc_work is already NULL).\n+\t\t\t */\n+\t\t\twpa_drv_cancel_remain_on_channel(wpa_s);\n+\t\t\twpa_s->off_channel_freq = 0;\n+\t\t\twpa_s->roc_waiting_drv_freq = 0;\n+\t\t\twpas_pr_pasn_roc_work_done(wpa_s);\n+\n+\t\t\t/* Clear responder mode - PD wdev is now active */\n+\t\t\twpa_s->pr_responder_mode = false;\n+\t\t\tos_memset(wpa_s->pr_responder_src_addr, 0, ETH_ALEN);\n+\n+\t\t\twpa_printf(MSG_DEBUG,\n+\t\t\t\t \"PR PASN: PD wdev created, processing M1\");\n+\t\t}\n+\t}\n+\n \treturn pr_pasn_auth_rx(pr, mgmt, len, freq);\n }\n \ndiff --git a/wpa_supplicant/pr_supplicant.h b/wpa_supplicant/pr_supplicant.h\nindex ee40a9251..254924aac 100644\n--- a/wpa_supplicant/pr_supplicant.h\n+++ b/wpa_supplicant/pr_supplicant.h\n@@ -17,6 +17,8 @@ int wpas_pr_init(struct wpa_global *global, struct wpa_supplicant *wpa_s,\n \t\t const struct wpa_driver_capa *capa);\n void wpas_pr_flush(struct wpa_supplicant *wpa_s);\n void wpas_pr_deinit(struct wpa_supplicant *wpa_s);\n+void wpas_pr_cleanup_interface(struct wpa_global *global);\n+void wpas_pr_pd_stop(struct wpa_supplicant *wpa_s);\n void wpas_pr_update_dev_addr(struct wpa_supplicant *wpa_s);\n void wpas_pr_clear_dev_iks(struct wpa_supplicant *wpa_s);\n void wpas_pr_set_dev_ik(struct wpa_supplicant *wpa_s, const u8 *dik,\n@@ -36,6 +38,8 @@ int wpas_pr_pasn_auth_tx_status(struct wpa_supplicant *wpa_s, const u8 *data,\n int wpas_pr_pasn_auth_rx(struct wpa_supplicant *wpa_s,\n \t\t\t const struct ieee80211_mgmt *mgmt, size_t len,\n \t\t\t int freq);\n+void wpas_pr_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,\n+\t\t\t\t\t unsigned int freq);\n \n #else /* CONFIG_PR */\n \n@@ -98,6 +102,12 @@ static inline int wpas_pr_pasn_auth_rx(struct wpa_supplicant *wpa_s,\n \treturn 0;\n }\n \n+static inline void\n+wpas_pr_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,\n+\t\t\t\t unsigned int freq)\n+{\n+}\n+\n #endif /* CONFIG_PR */\n \n #endif /* PR_SUPPLICANT_H */\ndiff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c\nindex bd7910ea9..36c439f82 100644\n--- a/wpa_supplicant/wpa_supplicant.c\n+++ b/wpa_supplicant/wpa_supplicant.c\n@@ -7958,7 +7958,8 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,\n \t\treturn -1;\n \n #ifdef CONFIG_TDLS\n-\tif (!iface->p2p_mgmt && !iface->nan_mgmt && wpa_tdls_init(wpa_s->wpa))\n+\tif (!iface->p2p_mgmt && !iface->nan_mgmt &&\n+\t wpa_tdls_init(wpa_s->wpa))\n \t\treturn -1;\n #endif /* CONFIG_TDLS */\n \ndiff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h\nindex 26ae918ba..cb6c76a7d 100644\n--- a/wpa_supplicant/wpa_supplicant_i.h\n+++ b/wpa_supplicant/wpa_supplicant_i.h\n@@ -140,6 +140,7 @@ struct wpa_interface {\n \t * nan_mgmt - Interface used for NAN management (NAN Device operations)\n \t */\n \tbool nan_mgmt;\n+\n };\n \n /**\n@@ -308,6 +309,9 @@ struct wpa_global {\n \tstruct wpa_supplicant *p2p_group_formation;\n \tstruct wpa_supplicant *p2p_invite_group;\n \tstruct wpa_supplicant *pr_init_wpa_s;\n+\n+\t/* PR/PD operation state is maintained on the owning wpa_s instance. */\n+\n \tu8 p2p_dev_addr[ETH_ALEN];\n \tstruct os_reltime p2p_go_wait_client;\n \tstruct dl_list p2p_srv_bonjour; /* struct p2p_srv_bonjour */\n@@ -1675,6 +1679,7 @@ struct wpa_supplicant {\n \tstruct wpa_radio_work *p2p_pasn_auth_work;\n #endif /* CONFIG_P2P */\n \tstruct wpa_radio_work *pr_pasn_auth_work;\n+\tstruct wpa_radio_work *pr_roc_work;\n #endif /* CONFIG_PASN */\n \n \tbool is_6ghz_enabled;\n@@ -1736,6 +1741,25 @@ struct wpa_supplicant {\n \tu8 pmkid_anonce[NONCE_LEN];\n \tbool pmkid_anonce_set;\n #endif /* CONFIG_PMKSA_PRIVACY */\n+\n+\tu8 pd_addr[ETH_ALEN];\n+\n+\t/**\n+\t * pr_responder_mode - Waiting for PASN M1 as responder\n+\t *\n+\t * Set when ROC has been started on this interface to listen for an\n+\t * incoming PASN Auth1 frame. Cleared once the dedicated PR interface\n+\t * is created on M1 reception.\n+\t */\n+\tbool pr_responder_mode;\n+\n+\t/**\n+\t * pr_responder_src_addr - Source MAC address used for responder ROC\n+\t *\n+\t * Stored when responder mode is activated so that the dedicated PR\n+\t * interface can be created with the same address when M1 arrives.\n+\t */\n+\tu8 pr_responder_src_addr[ETH_ALEN];\n };\n \n \n", "prefixes": [ "RFC", "16/23" ] }