210991d fw4: prefer /dev/stdin if available
4e5e322 fw4: make `fw4 restart` behavior more robust
221040e ruleset: emit time ranges when both start and stop times are specified
30a7d47 fw4: fix datetime parsing
fb9a6b2 ruleset: correct mangle_output chain type
6dd2617 fw4: fix logic flaw in testing hw flow offloading support
c7c9c84 fw4: ensure that negative bitcounts are properly translated
c4a78ed fw4: fix typo in emitted set types
Fixes: #9764, #9923, #9927, #9935, #9955
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The current reworked version cause kernel panic when the value is changes and
an interface is up. Following the tcp_be_liberal impelementation,
reimplement this to permit a safe change of this value without any
panic.
This has been tested with a QSDK package where tcp_no_window_check is used.
Fixes: 92fb51bc98 ("generic: 5.15: standardize tcp_no_window_check pending patch")
Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
On uniprocessor builds, for_each_cpu(cpu, mask) will assume 'mask'
always contains exactly one CPU, and ignore the actual mask contents.
This causes the loop to run, even when it shouldn't on an empty mask,
and tries to access an uninitialised pointer.
Fix this by wrapping the loop in a cpumask_empty() check, to ensure it
will not run on uniprocessor builds if the CPU mask is empty.
Fixes: af6cd37f42 ("realtek: replace RTL93xx GPIO patches")
Reported-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Reported-by: Robert Marko <robimarko@gmail.com>
Tested-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
The label MAC address for DIR-825 Rev. B1 is the WAN address located
at 0xffb4 in `caldata`, which equals LAN MAC at 0xffa0 incremented by 1.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
The UniFi 6 Lite as well as the Tenbay T-MB5EU do not have the third
background-radar chain. For the Tenbay, the connector is present,
however no antenna is connected to it.
Signed-off-by: David Bauer <mail@david-bauer.net>
Add ieee80211_rx_check_bss_color_collision routine in order to introduce
BSS color collision detection in mac80211 if it is not supported in HW/FW
(e.g. for mt7915 chipset).
Add IEEE80211_HW_DETECTS_COLOR_COLLISION flag to let the driver notify
BSS color collision detection is supported in HW/FW. Set this for ath11k
which apparently didn't need this code.
Tested-by: Peter Chiu <Chui-Hao.Chiu@mediatek.com>
Co-developed-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/a05eeeb1841a84560dc5aaec77894fcb69a54f27.1648204871.git.lorenzo@kernel.org
[clarify commit message a bit, move flag to mac80211]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
Currently malta configures the first Ethernet device as WAN interface.
If it finds a second one it will configure it as LAN.
This commit reverses it to match armvirt and x86. If there is only one
network device it will be configured as LAN device now. If we find two
network devices the 2. one will be WAN.
If no board.d network configuration is given it will be configured in
package/base-files/files/etc/board.d/99-default_network
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
[minor typos]
Signed-off-by: Paul Spooren <mail@aparcar.org>
Buidbots are currently choking on the following compile error:
In file included from tools/aisimage.c:9:
include/image.h:1133:12: fatal error: openssl/evp.h: No such file or directory
# include <openssl/evp.h>
^~~~~~~~~~~~~~~
compilation terminated.
This is caused by a complete overriding of make flags which are provided
correctly in `UBOOT_MAKE_FLAGS` variable, but currently overriden
instead of extended. This then leads to the usage of build host include
dirs, which are not available.
Fix it by extending `UBOOT_MAKE_FLAGS` variable in all device recipes.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Some dst in IPv6 flow offload table become invalid after the table is created.
So check_dst is needed in packet path.
Signed-off-by: Ritaro Takenaka <ritarot634@gmail.com>
[Add patch for kernel 5.15 too and rename file]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Avoid shipping ath10k board file in Mikrotik initram images
Most will only ever need to use these initram images once—to initially
load OpenWrt, but fix these images for more consistent Wi-Fi performance
between the initram and installed squashfs images.
OpenWrt BUILDBOT config ignores -cut packages in the initram images build.
This results in BUILDBOT initram images including the linux-firmware
qca4019 board-2.bin, and (initram image booted) Mikrotik devices loading
a generic BDF, rather than the intended BDF data loaded
from NOR as an api 1 board_file.
buildbot snapshot booted as initram image:
cat /etc/openwrt_version
r19679-810eac8c7f
dmesg | grep ath10k | grep -E board\|BDF
[ 9.794556] ath10k_ahb a000000.wifi: Loading BDF type 0
[ 9.807192] ath10k_ahb a000000.wifi: board_file api 2 bmi_id 0:16
crc32 11892f9b
[ 12.457105] ath10k_ahb a800000.wifi: Loading BDF type 0
[ 12.464945] ath10k_ahb a800000.wifi: board_file api 2 bmi_id 0:17
crc32 11892f9b
CC: Robert Marko <robimarko@gmail.com>
Fixes: 5eee67a72f ("ipq40xx: mikrotik: dont include ath10k-board-qca4019 by default")
Signed-off-by: John Thomson <git@johnthomson.fastmail.com.au>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Original patch: https://github.com/cifsd-team/ksmbd-tools/issues/227
adapted for ksmbd kernel module v3.4.3 by me.
Fixes crash in v3.4.3 only. Use original patch when updating to v3.4.4
as this one will fail hunk #1.
Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
ucidef_set_bridge_device is needed for DGND3700v2 network config since VLAN 1
must be used for the switch to be correctly configured.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
4b4849cf5e5a interface-ip: unify host and proto route handling
507c0513d176 interface-ip: add support for excluding interfaces in host route lookup
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Patches to support the SoC's GPIO controller for RTL930x and RTL931x
devices have been accepted upstream. Replace the current preliminary
patch with the upstream ones, excluding devictree binding changes.
The updated patches add GPIO IRQ balancing support on RTL930x, but this
cannot be used until these devices also support SMP.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
86ca9c6 devstatus: prints to terminal
95de949 deal with /rom/dev/console label inconsistencies
ab6b6ee uci: hack to deal with potentially mislabeled char files
acf9172 dnsmasq this can't be right
021db5b luci-app-tinyproxy
cf3a9c4 support/secmark: removes duplicate loopback rules
eeb2610 dhcp servers: recv dhcp client packets
d5a5fc3 more support/secmark "fixes"
35d8604 update support secmark
4c155c0 packets these were caused by labeling issues with loopback
fad35a5 nftables reads routing table
f9c5a04 umurmur: kill an mumur instance that does not run as root
10a10c6 mmc stordev make this consistent
ab3ec5b Makefile: sort with LC_ALL=C
b34eaa5 fwenv rules
8c2960f adds rfkill nodedev and some mmc partitions to stordev
5a9ffe9 rcboot runs fwenv with a transition
9954bf6 dnsmasq in case of tcp
ab66468 dnsmasq try this
5bfcb88 dnsmasq stubby not sure why this is happening
863f549 luci not sure why it recv and send server packets
d5cddb0 uhttpd sends sigkill luci cgi
44cc04d stubby: it does not maintain anything in there
db730b4 Adds stubby
ccbcf0e tor simplify network access
a308065 tor basic
a9c0163 znc loose ends
327a9af acme: allow acme_cleanup.sh to restart znc
4015614 basic znc
7ef14a2 support/secmark: clarify some things
3107afe README: todo qrencode
943035a README and secmark doc
4c90937 ttyd: fix that socket leak again
3239adf dnsmasq icmp packets and fix a tty leak issue
b41d38f Makefile: optimize
95d05b1 sandbox dontaudit ttyd leak
0b7d670 rpcd: reads mtu
e754bf1 opkg-lists try this
35fb530 opkg-lists: custom
4328754 opkg try to address mislabeled /tmp/opkg-lists
3e2385c rcnftqos
95eae2d ucode
c86d366 luci diagnostics
e10b443 rpcd packets and wireguard/luci
a25e020 igmpproxt packets
0106f00 luci
dcef79c nftqos related
3c9bc90 related to nft-qos and luci
f8502d4 dnsmasq more related to /usr/lib/dnsmasq/dhcp-script.sh
29a4271 dnsmasq: related to /usr/lib/dnsmasq/dhcp-script.sh
0c5805a some nft-qos
1100b41 adds a label for /tmp/.ujailnoafile
e141a83 initscript: i labeled ujail procd.execfile
a3b0302 Makefile: adds a default target + packets target
6a3f8ef label usign as opkg and label fwtool and sysupgrade
04d1cc7 sysupgrade: i meant don't do the fc spec
763bec0 sysupgrade: dont do /tmp/sysupgrade.img
af2306f adds a failsafe.tmpfile and labels validate_firmware_image
5b15760 fwenv: comment doesnt make sense
370ac3b fwenv: executes shell
67e3fcb fwenv: adds fw_setsys
544d211 adds procd execfile module to label procd related exec files
99d5f13 rclocalconffile: treat /etc/rc.button like /etc/rc.local
4dfd662 label uclient-fetch the same as wget
75d8212 osreleasemiscfile: adds /etc/device_info
0c1f116 adds a rcbuttonconffile for /etc/rc.button (base-files)
ccd23f8 adds a syslog.conffile for /etc/syslog.conf (busybox)
f790600 adds a libattr.conffile for /etc/xattr.conf
fcc028e fwenv: adds fwsys
1255470 xtables: various iptables alternatives
a7c4035 Revert "sqm: runs xtables, so also allow nftables"
0d331c3 sqm: runs xtables, so also allow nftables
f34076b acme: will run nftables in the near future
6217046 allow ssl.read types to read /tmp/etc/ssl/engines.cnf
d0deea3 fixes dns packets
8399efc Revert "sandbox: see if dontauditing this affects things"
73d716a sandbox: see if dontauditing this affects things
b5ee097 sandbox: also allow readinherited dropbear pipes
12ee46b iwinfo traverses /tmp/run/wpa_supplicant
4a4d724 agent.cil: also reads inherited dropbear pipes
d48013f support/secmark: i tightened my dns packet policy
645ad9e dns packets redone
4790b25 dnsnetpacket: fix obj macro template
d9fafff redo dns packets
0a68498 ttyd: leaks a netlink route socket
1d2e6be .gitattributes: remove todo
e1bb954 usbutil: reads bus sysfile symlinks
d275a32 support/secmark: clean it up a little
af5ce12 Makefile: exclude packet types in default make target
3caacdf support/secmark: document tunable/boolean
e3dd3e6 invalidpacketselinuxbool: make it build-time again
54f0ccf odhcpd packet fix
4a864ba contrib/secmark: add a big FAT warning
bead937 contrib/secmark: adds note about secmark support
146ae16 netpacket remove test
2ce9899 dns packets, odhcp6c raw packet, 4123 ntpnts for netnod
070a45f chrony and unbound packets
eba894f rawip socket packets cannot be labeled
656ae0b adds isakmp (500), ipsec-nat-t (4500) and rawip packet types
35325db adds igmp packet type
5cf444c adds icmp packet type
2e41304 sandbox some more packet access for sandbox net
12caad6 packet accesses
b8eb9a8 adds a trunkload of packet types
a42a336 move rules related to invalid netpeers and ipsec associations
a9e40e0 xtables/nftables allow relabelto all packet types
aa5a52c README: adds item to wish list
3a96eec experiment: simple label based packet filtering
26d6f95 nftables reads/writes fw pipes
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
Update the name of for the Ubiquiti NanoBeam M5 to match the
auto-generated one at runtime. Otherwise sysupgrade complains about
mismatching device names.
This also required renaming the DTS.
Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
Ubiquiti NanoBeam M5 devices are CPE equipment for customer locations
with one Ethernet port and a 5 GHz 300Mbps wireless interface.
Specificatons:
- Atheros AR9342
- 535 MHz CPU
- 64 MB RAM
- 8 MB Flash
- 1x 10/100 Mbps Ethernet with passive PoE input (24 V)
- 6 LEDs of which four are rssi
- 1 reset button
- UART (4-pin) header on PCB
Notes:
The device was supported by OpenWrt in ar71xx.
Flash instructions (web/ssh/tftp):
Loading the image via ssh vias a stock firmware prior "AirOS 5.6".
Downgrading stock is possible.
* Flashing is possible via AirOS software update page:
The "factory" ROM image is recognized as non-native and then installed correctly.
AirOS warns to better be familiar with the recovery procedure.
* Flashing can be done via ssh, which is becoming difficult due to legacy
keyexchange methods.
This is an exempary ssh-config:
KexAlgorithms +diffie-hellman-group1-sha1
HostKeyAlgorithms ssh-rsa
PubkeyAcceptedKeyTypes ssh-rsa
User ubnt
The password is ubnt.
Connecting via IPv6 link local worked best for me.
1. scp the factory image to /tmp
2. fwupdate.real -m /tmp/firmware_image_file.bin -d
* Alternatively tftp is possible:
1. Configure PC with static IP 192.168.1.2/24.
2. Enter the rescue mode. Power off the device, push the reset button on
the device (or the PoE) and keep it pressed.
Power on the device, while still pushing the reset button.
3. When all the leds blink at the same time, release the reset button.
4. Upload the firmware image file via TFTP:
tftp 192.168.1.20
tftp> bin
tftp> trace
Packet tracing on.
tftp> put firmware_image.bin
Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me>
The MikroTik hAP (product code RB951Ui-2nD) is
an indoor 2.4Ghz AP with a 2 dBi integrated antenna built around the
Atheros QCA9531 SoC.
Specifications:
- SoC: Atheros QCA9531
- RAM: 64 MB
- Storage: 16 MB NOR - Winbond 25Q128FVSG
- Wireless: Atheros QCA9530 (SoC) 802.11b/g/n 2x2
- Ethernet: Atheros AR934X switch, 5x 10/100 ports,
10-28 V passive PoE in port 1, 500 mA PoE out on port 5
- 8 user-controllable LEDs:
· 1x power (green)
· 1x user (green)
· 4x LAN status (green)
· 1x WAN status (green)
· 1x PoE power status (red)
See https://mikrotik.com/product/RB951Ui-2nD for more details.
Notes:
The device was already supported in the ar71xx target.
Flashing:
TFTP boot initramfs image and then perform sysupgrade. Follow common
MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Maciej Krüger <mkg20001@gmail.com>
The MikroTik RB952Ui-5ac2nD (sold as hAP ac lite) is an indoor 2.4Ghz
and 5GHz AP/router with a 2 dBi integrated antenna.
See https://mikrotik.com/product/RB952Ui-5ac2nD for more details.
Specifications:
- SoC: QCA9533
- RAM: 64MB
- Storage: 16MB NOR
- Wireless: QCA9533 802.11b/g/n 2x2 / QCA9887 802.11a/n/ac 2x2
- Ethernet: AR934X switch, 5x 10/100 ports,
10-28 V passive PoE in port 1, 500 mA PoE out on port 5
- 6 user-controllable LEDs:
- 1x user (green)
- 5x port status (green)
Flashing:
TFTP boot initramfs image and then perform sysupgrade. The "Internet"
port (port number 1) must be used to upload the TFTP image, then
connect to any other port to access the OpenWRT system.
Follow common MikroTik procedure as in
https://openwrt.org/toh/mikrotik/common.
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
c22eeef fw4: support negative CIDR bit notation
628d791 hotplug: reliably handle interfaces with ubus zone hints
d005293 fw4: store zone associations from ubus in statefile as well
b268225 fw4: filter non hw-offload capable devices when resolving lower devices
57984e0 fw4: always resolve lower flowtable devices
7782017 tests: fix mocked `fd.read("line")` api
72b196d config: remove restictions on DHCPv6 allow rule
f0cc317 fw4: refactor family selection for forwarding rules
b0b8122 treewide: use modern syntax
05995f1 fw4: fix emitting device jump rules for family restricted zones
b479815 fw4: fix family auto-selection for config nat rules
2816a82 ruleset: ensure that family-agnostic ICMP rules cover ICMPv6 as well
2379c3d tests: add test coverage for zone family selection logic
Fixes: #5066, #9611, #9765, #9854
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
A devent amount of patches have been upstreamed, so maintaining linux 5.10 on
this target makes no sense.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
- Use the same order for /etc/board.d/02_network and
/lib/preinit/05_set_preinit_iface_brcm2708.
- Add missing RPi 400 and CM4 to /lib/preinit/05_set_preinit_iface_brcm2708.
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Since MikroTik subtarget now uses dynamic BDF loading its crucial that it
doesnt include the board-2.bin at all which is provided by the
ath10k-board-qca4019 package.
So to resolve this dont include the ath10k-board-qca4019 package on the
MikroTik subtarget.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Since we now provide the BDF-s for MikroTik IPQ40xx devices on the fly,
there is noneed to include package and ship them like we do now.
This also resolves the performance issues that happen as MikroTik
changes the boards and ships them under the same revision but they
actually ship with and require a different BDF.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Since we now can pass the API 1 BDF-s aka board.bin to the ath10k
driver per radio lets use that to provide the BDF-s for MikroTik devices.
This also resolves the performance issues that happen as MikroTik changes
the boards and ships them under the same revision but they actually ship
with and require a different BDF.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Some ath10k IPQ40xx devices like the MikroTik hAP ac2 and ac3 require the
BDF-s to be extracted from the device storage instead of shipping packaged
API 2 BDF-s.
This is required as MikroTik has started shipping boards that require BDF-s
to be updated, as otherwise their WLAN performance really suffers.
This is however impossible as the devices that require this are release under
the same revision and its not possible to differentiate them from devices
using the older BDF-s.
In OpenWrt we are extracting the calibration data during runtime and we are
able to extract the BDF-s in the same manner, however we cannot package the
BDF-s to API 2 format on the fly and can only use API 1 to provide BDF-s on
the fly.
This is an issue as the ath10k driver explicitly looks only for the board.bin
file and not for something like board-bus-device.bin like it does for pre-cal
data.
Due to this we have no way of providing correct BDF-s on the fly, so lets
extend the ath10k driver to first look for BDF-s in the board-bus-device.bin
format, for example: board-ahb-a800000.wifi.bin
If that fails, look for the default board file name as defined previously.
So, backport the upstream ath10k patch.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Update ath10k-ct to the latest version which includes the backported
ath10k commit for requesting API 1 BDF-s with a unique name like caldata.
Signed-off-by: Robert Marko <robimarko@gmail.com>
This is only effective for host build of normal packages, not tools.
Fixes: ad79b92719 ("elfutils: move host build to tools")
Reported-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Building all of the components results in strip being installed in
staging_dir/host/bin. This strip binary will take precedence over
binutils strip that is installed in the toolchain directory.
This will not work on host systems that do not have libdw installed, as
we do not set HOST_LDFLAGS to override rpath to staging_dir/host/lib.
However, rather than overriding rpath, we should just avoid using
elfutils strip entirely.
Override the SUBDIRS variable in the Makefile to only build and install
the libraries we require for dwarves and frr.
Fixes the following build failure in toolchain/gdb:
strip: error while loading shared libraries: libdw.so.1: cannot open shared object file: No such file or directory
Fixes: ad79b92719 ("elfutils: move host build to tools")
Reported-by: Dominick Grift <dominick.grift@defensec.nl>
Reported-by: Lucian Cristian <lucian.cristian@gmail.com>
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Some buildbots fail to build elfutils due to m4 being missing. Add m4 as
a dependency for elfutils to fix this.
Fixes: ad79b92719 ("elfutils: move host build to tools")
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
This is required to use BPF maps of type BPF_MAP_TYPE_PERF_EVENT_ARRAY
for sending data from BPF programs to user-space for post-processing
or logging.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Remove redundant target-level entries, noting that these settings will be
configured from "Kernel build options" of Kconfig.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
[remove from new configs introduced after patch submission]
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Generate BTF (BPF Type Format) information from DWARF debug info. This is
embedded in the kernel and exported via sysfs as /sys/kernel/btf/vmlinux.
BTF data enhances kernel portability and introspection for BPF programs.
Selecting this also enables the dwarves host package which provides the
pahole tool used for BTF encoding.
Test using: "bpftool btf dump file /sys/kernel/btf/vmlinux format c"
This needs to depend on KERNEL_DEBUG_INFO_REDUCED not being set,
otherwise we can enable both KERNEL_DEBUG_INFO_BTF and
KERNEL_DEBUG_INFO_REDUCED, which will result in undefined behaviour.
Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
[split DEBUG_INFO_REDUCED into separate commit, add dependency]
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Add DEBUG_INFO_REDUCED as a kernel config option and remove it from the
kernel configs. This is in preparation of the upcoming option to enable
BTF typeinfo, which is incompatible with DEBUG_INFO_REDUCED.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
We currently enable DEBUG_INFO_REDUCED for all targets via the generic
kernel config. There is only one subtarget, layerscape/armv8_64b, that
overrides this setting. As there is no explanation for this in the
commit message that introduced this, and question to its author went
unanswered, let's simply drop this symbol from the subtarget config.
This way, we have consistency across the tree, and we do not have to
introduce a special case when moving this symbol to an OpenWrt kernel
config option.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
