The WPS button now uses a gpio-keys-polled node, which pulls in
kmod-input-gpio-keys-polled, so it appears in the build .config.
Add it to the expected package list in 005-build-config.t.
Fixed: PCF-2655
Signed-off-by: Tim Hsu <tim.hsu@wnc.com.tw>
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org> [rebased]
WPS button moved from the gpio-keys edge-IRQ node to a separate gpio-keys-polled node to avoid the GPIO12 pad-leakage IRQ storm.
015-platform.t still read soc@0/gpio_keys/button@1, which no longer exists, so the WPS label and linux,code checks failed.
Point both at soc@0/gpio_keys_polled/button@1; reset stays at gpio_keys/button@2 and linux,code is unchanged (0x0211).
Fixed: PCF-2655
Signed-off-by: Tim Hsu <tim.hsu@wnc.com.tw>
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org> [rebased]
On Freedom boards, GPIO12 (WPS button) pad leakage lets the pin
linger near the switching threshold during cold boot, so the mainline
gpio-keys edge IRQ (IRQ36) storms at hundreds of thousands to millions
of edges per second, all pinned to CPU0.
CPU0 gets wedged in hardirq context, stops reporting RCU quiescent states,
and the resulting rcu_preempt stall blocks any driver bring-up that waits on synchronize_rcu(),
stalling i2c-mux/expander/LED probe and locking the board up.
Move the WPS button to a separate gpio-keys-polled node so it no longer requests an edge IRQ,
decoupling it from the pad leakage entirely.
Fixes: PCF-2655
Signed-off-by: Tim Hsu <tim.hsu@wnc.com.tw>
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org> [rebased, removed PCI fix]
ForceSolicitPolicy is now a standard TR-181 parameter with no vendor
prefix. Update the cram test accordingly.
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
DROP BEFORE MERGE.
Pins feed_prplos at feed-prplos !1014, which reverts ethernet-manager
v1.38.1 back to v1.37.0. The pinned commit is exactly one revert on top
of 7ad2df9d, the revision this branch already carried, so the only
delta in the resulting image is the ethernet-manager version.
Since v1.38.1 landed, every "run test MXL25641-HDK-6 with system on
eMMC" job on latest-24.10 dies at DUT bring-up: check_network --network
lan times out after 180s with the LAN datamodel reporting Status="Up"
while every ping to the test host returns "Destination Host
Unreachable". v1.38.1 pulls in tr181-ethernet 220eb0a7c, which writes
speed/duplex, EEE and EDPD to the PHY on every link-up and applies EDPD
for the first time; a PHY with EEE/EDPD newly applied shows carrier but
passes no traffic.
This commit only exists to prove that on CI. Drop it and let prplbot
bump feed_prplos normally once the revert has landed on feed main.
Integrates:
- 7f0c9c5: ("Revert "tr181-ethernet: preserve configured energy settings across init and link changes"", 2026-06-17)
Refernces: PCF-2584
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
prplbot deleted some changes made in prpl-core file.
Readd thise changes to fix the briken version.
- Add IPsec support and netmodel-ipsec
- Add wireguard, netmodel-wireguard and libwireguard
- Add netmodel-tuntap and tr181-tuntap
References: PCF-2467, PCF-2023, PCF-2469, Feat-150
Signed-off-by: Hela Saadani <hela.saadani_ext@softathome.com>
Integrates following changes:
- libamxp: Correctly set CoreDump flag based on WCOREDUMP status (ed282fc1)
References: PPW-1141
Signed-off-by: prplbot <bot@prplfoundation.org>
Signed-off-by: FAOUZI YAHYA <faouzi.yahya_ext@softathome.com>
Testing Various valid combinations on 6GHz PrivateVAP
side-effect: default value of MLDUnitSetting changes behavior of PWHM
i.e. new parameter:
Radio.{i}.IEEE80211be.MLDUnitSetting=Assumed
is expected to invalidate current apmld tests
Reset it to Required, the value that keeps old pwhm behavior
OBUSPA:
Prefix IEEE80211be.MLDUnitSetting with X_PRPLWARE-COM_
and add it to obuspa.expected datamodel dump
testbed.yml : increase timeout by 2min (nominal execution time : 1m50s)
Issue: PPM-3545
Signed-off-by: Iacob Juc <iacob.juc_ext@softathome.com>
Issue:
With the introduction of cache services and a configurable removal timeout (PPW-1676),
services are no longer removed immediately when they are no longer detected.
Instead, a timer is started based on the new RemoveServiceTimeout parameter.
If the service is rediscovered before the timer expires, it remains in the data model.
The default timeout value is set to 300000 ms (5 minutes).
Fix:
The fix involves modifying the cram test to lower the RemoveServiceTimeout to 5000 ms (5 second)
for quicker testing.
Tracked-by: PPW-1676
Signed-off-by: Yousfi Neji <yousfi.neji_ext@softathome.com>
Integrates following changes:
- tr181-dnssd: increase maximum Service instance limit (d9b67836)
- tr181-dnssd: fix reserved bit count in intf_flags struct (03118b63)
- tr181-dnssd: rename misspelled files and clean up events handler (f08cb7ea)
- tr181-dnssd: avoid unnecessary copy of service_htable (85fcc6ec)
- tr181-dnssd: implement DNSSD.Scan data model (7057dd18)
- tr181-dnssd: cache services with configurable removal timeout (e5b1e471)
- tr181-dnssd: remove stale services on IP address change (06dfe2e1)
- tr181-dnssd: fix IP version detection using IPAddresses (443985b5)
- tr181-dnssd: expose IPAddresses in Scan event notification (959fb531)
- tr181-dnssd: fix NULL Host when TR-181 path lookup fails (8628544e)
- tr181-dnssd: remove @version tags from non standard parameters (241462e7)
- tr181-dnssd: implement DNSSD.Scan data model (160ea637)
- tr181-dnssd: remove stale services on IP address change (c23d7ce2)
References: PPW-1676
Signed-off-by: prplbot <bot@prplfoundation.org>
signed-off-by: Hela Saadani <hela.saadani_ext@softathome.com>
prpl_core.yml now pulls strongswan-default and sixteen strongswan
modules for the IPsec datamodel. They drag in dependencies nothing
selects explicitly -- strongswan-ipsec via mod-stroke, and libgcrypt
plus libgpg-error via mod-gcrypt -- so every board that ships strongswan
sees a wider package set than its expected output records.
Refresh the expectations for the three boards that build strongswan:
- 005-build-config.t on mxl25641-hdk-6, wnc-freedom and urx851-b0-dk.
urx851-b0-dk has no hardware test job, so its copy of the same
expected output would have drifted unnoticed until the board is
exercised again; keep the three in sync.
- 011-tls.t on mxl25641-hdk-6 and wnc-freedom. The grep pattern and the
version-tolerant libopenssl / libustream-openssl regexes are left
untouched; only strongswan-mod-openssl is added. Enumerating the whole
strongswan package set belongs in 005-build-config.t, not in a test
whose subject is the single TLS library.
The same module set also widens what charon advertises through the IPsec
root object. Rather than track those capability strings, 133-tr181-ipsec.t
now asserts only that the datamodel starts with no entries, so the
expectation no longer moves with the strongswan module selection.
Also drop CONFIG_VERSION_CODE_FILENAMES from the wnc-freedom expected
build config. The symbol is no longer emitted, which is OpenWrt base
drift rather than a VPN change, but the expectation cannot pass while it
is listed.
References: FEAT-150, PCF-2467
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
The .swu firmware image (~80MB) and temporary PEM keys generated during
the wrong-key test were never removed from DUT /tmp, leaving the
partition nearly full for the tests that run afterwards.
Delete the .swu image and the generated PEM files at the end of the
test.
References: PCF-2469, PPW-2134
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
With VPN features the rootfs is now too smal, increase it to make more
rooms as this is mainly use for qemu system where roots don't have hard
constrain.
References: PCF-2469, PCF-2467, PCF-2294, PCF-2023
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
Add initial cram tests for tr181-ipsec, including an end-to-end test with
IKEv2 certificate authentication: a dedicated strongSwan charon instance
runs inside a network namespace (with a private /var/run tmpfs to isolate
it from the CPE charon) behind a veth pair emulating the WAN link, so the
test is self-contained and is not tied to a specific board. Certificates
are generated on the DUT: a self-signed one for the CPE, and for the peer
an end entity certificate issued by a dedicated CA, since
IKEv2RemoteAuthenticationMethod designates the authority the peer is
validated against rather than the peer certificate itself. They are
imported through /etc/config/autocert into Security.Certificate, and
referenced from an IPsec.Profile/Filter pair. The end-to-end test verifies
the IKEv2 SA and Child SA come up and that protected traffic flows.
References: PCF-2469, FEAT-150
Signed-off-by: Alin Nastac <alin.nastac@softathome.com>
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
Add initial cram tests for tr181-wireguard, including an end-to-end tunnel
test: the remote peer lives in a network namespace behind a veth pair
emulating the WAN link and is configured with wireguard-tools, so the
test is self-contained and is not tied to a specific board. The
end-to-end test drives the CPE side through the data
model (WireGuard.Tunnel/Peer + IP.Interface + Firewall.Service), verifies
the handshake on the peer, ping in both directions, a short iperf3 session
and the NetModel flags.
Implements: PCF-2023
References: FEAT-150
Signed-off-by: Patrick Havelange <patrick.havelange_ext@softathome.com>
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
Add CRAM tests for tr181-gre, including an end-to-end tunnel test: the
remote peer lives in a network namespace behind a veth pair emulating
the WAN link, so the test is self-contained and is not tied to a
specific board. The end-to-end test drives the tunnel
through the data model (GRE.Tunnel + Interface + IP.Interface), verifies
the kernel route, reply behaviour with and without a peer return route,
the UseSequenceNumber/UseChecksum toggles and runs a short iperf3 session
through the tunnel.
References: PCF-2294, FEAT-150
Signed-off-by: Khaled Hasni <khaled.hasni_ext@softathome.com>
Signed-off-by: Alexandre Fiset <alexandre.fiset@softathome.com>
Cram supplies each generated test script to the shell through standard
input. The shared SSH command inherits that input and consumes the
remaining script, leaving the shell at EOF inside a quoted command.
Commit 5fd42aa540 ("ci: cram: use legacy SCP protocol for remote
copies") rewrote CRAM_REMOTE_COMMAND while adding legacy SCP support and
dropped the -n option added for PCF-2222. Job 15640024463 then failed
130-periodicfileupload.t with:
/bin/sh: 152: Syntax error: Unterminated quoted string (no-eol)
Job 15640024462 leaked this salt marker in the same test:
CRAM1 (no-eol)
Restore -n so SSH reads from /dev/null instead of the generated test
script.
Assisted-by: codex:gpt-5.6-sol
Assisted-by: claude:opus-5:1m-context
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Fixes: 5fd42aa540 ("ci: cram: use legacy SCP protocol for remote copies")
References: PCF-2222
Quote expanded command substitutions in remote logger commands
to ensure the expanded value is passed as a single literal
argument and prevent remote shell interpretation of special
characters.
Closes: PPW-1315
Signed-off-by: Houssem Dafdouf <houssem.dafdouf_ext@softathome.com>
Currently, the 036-lcm-usp-restrictions test fails during the
TrustedProvider model validation; this happened because
TrustedProvider required some time (up to 5 seconds) to register its model:
da53b18a65/src/main.c (L159)
New version of TrustedProvider service registers data model over ODL and
amxrt mechanism and does not contain the registration timeouts.
Fixes: PPW-2037
References: FEAT-28, FEAT-120
Signed-off-by: Mykola Hlukhenkyi <m.hlukhenkyi@inango-systems.com>
Signed-off-by: Artem Trokhymchuk <a.trokhymchuk@inango-systems.com>
Debian 13 ships pyOpenSSL without the deprecated X509Req API used by
servefile certificate generation.
Generate a short-lived certificate with openssl and pass it to both
HTTPS server instances.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PPW-1258
The Debian 13 testbed image runs cram as an unprivileged user, so its
ping process cannot open a raw socket with the executor capabilities.
Use the existing passwordless sudo setup for the host-side probe.
GitLab runner hostnames are not present in the container hosts file,
so sudo also emits a lookup warning before the asserted ping result.
Discard stderr while retaining the ping and grep exit behavior.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PPW-1258
The separately released testbed image can update MiniDLNA without
changing the behavior under test. Matching one package version makes
the DUT discovery test fail whenever that host-side fixture changes.
Keep the server description fields exact, but match the MiniDLNA
version with a cram glob. This verifies that the DUT discovers the
fixture without coupling the expectation to a Debian package version.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PPW-1258
OpenSSH in the Debian 13 testbed container uses SFTP for scp transfers
by default, while the DUT images do not provide an SFTP server.
Force the legacy SCP protocol in the shared cram copy command, the
security certificate fixture, and the remaining direct scp calls so
every test can stage its helper files and packages.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Fixes: 854ef0eafb ("ci: cram: add new LCM tests")
References: PPW-1258
The shared testbed setup installs MiniDLNA, Avahi, and dbus before
every cram and CDRouter job. This adds network and package mirror
dependencies to hardware tests and allows the runtime environment to
drift independently of the selected image.
The separately released testbed image now carries these packages,
together with the Python dependencies used by cram. Remove the runtime
apt update and install command so jobs consume only the image contents.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Fixes: 6792ba6b95 ("PROVISORY: ci: testbed: install minidlna and avahi packages at runtime")
References: PPW-1258
The testbed setup rewrites the Debian mirror to archive.debian.org
before installing runtime cram dependencies. This was needed for the
old Buster container, but Debian 13 uses current mirrors and stores its
configuration in deb822 files instead of /etc/apt/sources.list.
Both focused cram jobs stop at the first rewrite before DUT bring-up:
```text
$ sudo sed -i 's|http://deb.debian.org/debian|http://archive.debian.org/debian|g' /etc/apt/sources.list 2>/dev/null
Running after_script
```
Remove both obsolete rewrites and let apt use the sources supplied by
the versioned Debian 13 testbed image.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Fixes: 6792ba6b95 ("PROVISORY: ci: testbed: install minidlna and avahi packages at runtime")
References: PPW-1258
Debian 13 marks its system Python environment as externally managed,
so cram-time pip installs fail before the tests can exercise the DUT.
Python 3.13 also removed cgi, which the preinstalled servefile 0.5.4
still imports.
Use async-upnp-client, servefile, scapy, and legacy cgi from the
testbed image. Remove the per-test pip calls and PATH overrides, and
document that scapy is an image dependency. Preserve the newer
CABundle fixture setup from the source change.
The later 018-dhcpv4-client-options.t test reintroduced the same pip
call, so give it the same treatment.
Assisted-by: codex:gpt-5
Assisted-by: claude:opus-5:orchestrator
Assisted-by: codex:gpt-5.6-sol:medium-fast
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PPW-1258
ntpsec-ntpdate 1.2.3 reports successful queries as a timestamp
followed by numeric offset and uncertainty values instead of the
former textual offset wording.
Match the numeric ntpsec query format so the time test accepts the
output provided by the Debian 13 testbed image.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PPW-1258
The testbed container now has its own prpl Foundation project, release
pipeline, and versioned registry image. Keeping the old Debian Buster
image in prplos leaves two sources for the same CI runtime and continues
to expose obsolete build, test, and deploy jobs.
Remove the in-tree Dockerfile and its CI job definitions. Drop the root
include because the testbed and CDRouter templates now consume the
external containers/testbed release directly.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PPW-1258
The testbed and CDRouter templates currently derive their image from the
designated prplos branch. This couples image changes to an in-tree build
and prevents consumers from using the separately released container.
Use the released ci/containers/testbed v1.3.0 image in both templates,
pinning it to its published immutable manifest digest. This keeps cram
and CDRouter on the same Debian 13 environment with the runtime test
dependencies preinstalled, while every pipeline pulls the exact released
content.
The previous image declared /home/testbed as a volume. GitLab's Docker
executor replaced it with an empty, root-owned, persistent runner cache
that shadowed the writable home created in the image. OpenSSH resolves
~/.ssh through the passwd database instead of $HOME, so redirecting HOME
could not make bare ssh read the host key written by ssh-keyscan.
The v1.3.0 image drops that volume. Remove the ineffective HOME
overrides while retaining the .ssh directory setup that ssh-keyscan
needs.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PPW-1258
Cram tests conventionally define R directly from CRAM_REMOTE_COMMAND.
Commit 43f1696033 ("ci: cram: periodicfileupload tests sometimes fails
(PPW-1766)") introduced a sed pipeline for this test.
The substitution only matches ssh when it has a leading space, while
CRAM_REMOTE_COMMAND begins with ssh. The pipeline is therefore a silent
no-op.
Keeping a per-test rewrite would duplicate the stdin handling. The
preceding "ci: cram: keep remote commands off the script stdin" puts
ssh -n into CRAM_REMOTE_COMMAND at its source for every test.
Restore the canonical alias so this test follows the suite convention
and relies on the centralized remote command definition.
References: PCF-2222, PPW-1766
Assisted-by: claude:opus-5:orchestrator
Assisted-by: codex:gpt-5.6-sol:medium-fast
Fixes: 43f1696033 ("ci: cram: periodicfileupload tests sometimes fails (PPW-1766)")
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Cram supplies the complete generated test script through the shell's
stdin. SSH inherits that input from the shared remote-command alias and
drains the script beyond the shell's read-ahead buffer. The shell then
reaches EOF in the middle of a quoted command near byte 8,192:
```text
/bin/sh: 74: Syntax error: Unterminated quoted string
```
This is independent of the Python interpreter. Freedom job 15484314070
failed the 49-command probe at chunk 0036 under Python 3.14.6. With the
same probe and firmware, job 15484856804 passed all 49 chunks under
Python 3.13 after adding the SSH stdin protection.
Pass -n to the shared SSH command so it reads from /dev/null instead of
the test script. Apply the same safe default to the MXL fallback alias.
Assisted-by: codex:gpt-5
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
References: PCF-2222
