[RyanTheTide]

WPA2 PSK-SHA256 now keeps optional/required MFP policy on the host, validates
AP RSN admission and writes AKM 0x0400 at EA/0x40 body +0x14.
BIP-CMAC-128 is advertised; firmware owns the handshake, IGTK installation
and BIP verification. No host key command or PMF readback bit is invented.

Rebased onto current aurora-wip (f1c31a0c9f1b2428a7458ad6b965673814c3d6ab),
retaining linux#646's driver changes and MAINTAINERS coverage. The clean
t-3573 SPEC supplies the fixed J700 antenna matrix and exact channel/BW map.
Finite TPE is projected independently for SISO/CDD/MIMO in signed half-dB,
with sentinel preservation and checked arithmetic.

“Admitted” below means the driver permits and submits the association.
New firmware paths have not been qualified on hardware by this task.

AP/request configuration	Change from aurora-wip	Behavior today
2.4/5 GHz WPA2-CCMP, selected PSK-SHA256 (AKM 6), binary PMK, AP MFPC and BIP-CMAC-128; host MFP optional or required	New	Admitted with AKM 0x0400; required cannot downgrade. iwd/firmware/IGTK/BIP qualification remains.
2.4/5 GHz legacy PSK (AKM 2), AP does not require PMF; host MFP disabled or optional	Existing path retained; host RSN admission added	Admitted without PMF. Optional never promotes AKM 2 to AKM 6.
2.4/5 GHz SAE or OWE with supported credentials/policy	Unchanged	Existing firmware-owned association and admission paths.
6 GHz existing v2 VLP channel, HE Regulatory Info 2, SAE-H2E or OWE with required MFP; finite, all-0x7f, absent or unsupported TPE	Unchanged	Still admitted under the original country/channel gates. No new strict TPE check, pre-EA class SET or 60-byte TPE is added to this join. AP-wide 160 MHz announcements retain the existing station negotiation at <=80 MHz.
6 GHz LPI, HE Info 0, 20/40/80 MHz, valid HE layout, applicable default-client TPE with finite or all-0x7f effective limits; SAE-H2E or OWE, required MFP	New	Admitted when the v4 LP mask, every occupied channel and gain map permit it. Publishes 0x1a LP pages, projected 60-byte TPE, then EA/40.
6 GHz v4-only VLP channel, HE Info 2, same supported layout/security/TPE requirements	New	Admitted with 0x2a VLP pages and projected TPE before EA/40. Uses the same J700 matrix as LPI.
New class path with missing applicable TPE, malformed/duplicate HE, insufficient bandwidth bounds, PSD no-transmit -128, unsupported extended PSD, missing gain-map cell or unrepresentable projection	New admission gate	Refused before class publication. These TPE refusals do not apply to the existing v2 VLP row.
SP/AFC, reserved Regulatory Info, forbidden country/class/channel; new-class AP layouts wider than 80 MHz	Unsupported	Refused. No SP fallback, AFC, 160/320 MHz station operation or guessed gain is added.
6 GHz WPA2/OPEN, non-required MFP, or SAE hunting-and-pecking only	Unchanged refusal	Refused.
Required MFP with AKM 2; AKM 6 with MFP disabled; required PMF against non-MFPC AP; unsupported explicit group-management cipher	New WPA2-PMF admission	Refused. Only BIP-CMAC-128 is advertised; omitted management suite uses its standard CMAC default.

The no-regression comparison covers 12010e055535 and current aurora-wip:
neither parses VLP TPE before joining. When v2 and v4 coexist, the driver
keeps v2's base/CID5d/CID95 pages, numeric clamp over the original VLP channel
set, and both cached 1020-byte post-CID6b association pages. v4 is retained
as a hashed class sidecar for LP/additional channels. KUnit proves finite
VLP selection, absent TPE, AP-wide 160 MHz, original page bytes/CIDs, both
file lifetimes and the unchanged legacy numeric clamp.

Legacy directed discovery remains available on legacy VLP channels; newly
added class-only channels scan passively. New class connections revalidate
AP information, close data admission on changed policy, and restore the idle
country policy plus all-0x7f TPE after peer/DMA retirement. Partial SET
failure closes RF admission until checked reset. Command submission is not
firmware acknowledgment or active-class readback.

The installer branch is unchanged. It can be installed independently:
older kernels ignore policy-v4/ and continue using the retained v1/v2
packages. Using the installer's LPI/v4 data requires this kernel consumer;
WPA2-PMF does not depend on the installer change. The kernel's LPI path
requires valid bound v4 packages, produced by this installer or the public
packaging tool. Retain v1/v2 and the known-good kernel for rollback.

Final validation on kernel commit 6156b0c17bc35fe4c26ffd42f59df8814e0c0c06:

• Fleet11-configured Wi-Fi module rebuild, W=1: pass, no warnings.
• KUnit driver/test rebuild, W=1: pass, no warnings.
• ARM64 QEMU KUnit: 68/68 pass across seven suites.
• Strict checkpatch including SPDX: 0 errors, 0 warnings, 0 checks
  (2796 lines checked).
• Public class-package tests: 8/8; legacy VLP packaging: 25/25; association
  event/wait/calibration controls: 30 pass, all four mutations rejected.
• Unchanged installer: prior 16-test synthetic suite pass retained; not rerun.
• Wi-Fi and Bluetooth companion rebuilt for AArch64; both exact vermagic
  7.3.0-aurora-fleet11 SMP preempt mod_unload aarch64.

All heavy gates used /srv/aurora/fast/buildslot with eight build jobs.
The task checkout, build/KUnit outputs and temporary build dependencies were
deleted after bundle/module verification. Shared fleet11 inputs were retained.

Local branches, bundles, fleet11-vermagic Wi-Fi/Bluetooth modules,
UNRESOLVED.md and the controller-only owner commands are delivered for
review. The reviewer opens and merges. No push, PR, merge, hardware access
or messages to other people were performed. Build trees are removed after
verified packaging; failures and prior delivery evidence are retained.

🤖 Generated with Claude Code