Commit Graph

57399 Commits

Author SHA1 Message Date
Nick Hainke
638a10e175
generic: 5.15: add patch fixing compiling mvebu with gcc-13
Fixes errors in the form of:
drivers/ata/libahci.c: In function 'ahci_led_store':
././include/linux/compiler_types.h:334:45: error: call to '__compiletime_assert_363' declared with attribute error: BUILD_BUG_ON failed: sizeof(_s) > sizeof(long)
  334 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |                                             ^
././include/linux/compiler_types.h:315:25: note: in definition of macro '__compiletime_assert'
  315 |                         prefix ## suffix();                             \
      |                         ^~~~~~
././include/linux/compiler_types.h:334:9: note: in expansion of macro '_compiletime_assert'
  334 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |         ^~~~~~~~~~~~~~~~~~~
./include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert'
   39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
      |                                     ^~~~~~~~~~~~~~~~~~
./include/linux/build_bug.h:50:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
   50 |         BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
      |         ^~~~~~~~~~~~~~~~
./include/linux/nospec.h:62:9: note: in expansion of macro 'BUILD_BUG_ON'
   62 |         BUILD_BUG_ON(sizeof(_s) > sizeof(long));                        \
      |         ^~~~~~~~~~~~
drivers/ata/libahci.c:1143:23: note: in expansion of macro 'array_index_nospec'
 1143 |                 pmp = array_index_nospec(pmp, EM_MAX_SLOTS);
      |                       ^~~~~~~~~~~~~~~~~~

Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-05-05 15:46:38 +02:00
Nick Hainke
a6d689632c
toolchain: gcc: backport patch for gcc 13 fixing access path analysis
While improving access path analysis a typo happened. Now it can happen
that gcc misscompiles. The patch is fixing the issue. However, also
other gcc versions 10.2+ are affected. They also should be bumped or the
fix should be backported.

For more bug information have a look at:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109585

Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-05-05 15:46:38 +02:00
Nick Hainke
29128b0bd4
toolchain: gcc: add support for GCC 13
Release Notes:
https://gcc.gnu.org/pipermail/gcc-announce/2023/000175.html

Manually Refreshed:
- 910-mbsd_multi.patch
- 970-macos_arm64-building-fix.patch

Automatically Refreshed:
- 010-documentation.patch
- 230-musl_libssp.patch
- 300-mips_Os_cpu_rtx_cost_model.patch
- 820-libgcc_pic.patch
- 840-armv4_pass_fix-v4bx_to_ld.patch
- 850-use_shared_libgcc.patch
- 870-ppc_no_crtsavres.patch
- 920-specs_nonfatal_getenv.patch

Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-05-05 15:46:37 +02:00
Nick Hainke
1e88a16248
toolchain: gcc: copy patches from 12.x to 13.x
This simplifies the gcc bump patch review.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-05-05 15:46:34 +02:00
Paul Spooren
c6419d1946
lantiq: switch to Kernel 5.15 by default
Getting ready for the next release.

Signed-off-by: Paul Spooren <mail@aparcar.org>
2023-05-04 07:00:37 +02:00
Nick Hainke
9464e9e209
lantiq: xway: use capital letters in Fritz!Box name
Rename to Fritz!Box to keep naming uniform.

Fixes: ceac4ae3b4 ("lantiq: xway: add support for AVM FRITZ!Box 7330")
Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-05-04 06:09:11 +02:00
Yuu Toriyama
97d20525b2
wireless-regdb: update to 2023.05.03
Changes:
  43f81b4 wireless-regdb: update regulatory database based on preceding changes
  66f245d wireless-regdb: Update regulatory rules for Hong Kong (HK)
  e78c450 wireless-regdb: update regulatory rules for India (IN)
  1647bb6 wireless-regdb: Update regulatory rules for Russia (RU). Remove DFS requirement.
  c076f21 Update regulatory info for Russia (RU) on 6GHz

Signed-off-by: Yuu Toriyama <PascalCoffeeLake@gmail.com>
2023-05-04 06:08:24 +02:00
Michael Pratt
d167adbc44
gettext-full: bootstrap to local gnulib source
Using the local gnulib source during autogen.sh
allows for fine-grained control over the macros
and source files for use with gettext
but part of gnulib instead of gettext,
without having to wait for a release
or deal with gnulib as a git submodule.

This is an alternative to running autoreconf.

It also removes the need to patch macros
in the case where there is a conflict
between the source and our aclocal directory.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:31 +02:00
Michael Pratt
09f8f21ae3
tools/coreutils: bootstrap to local gnulib source
Using the local gnulib source during bootstrap
allows for fine-grained control over the macros
and source files for use with coreutils
but part of gnulib instead of coreutils,
without having to wait for a release
or deal with gnulib as a git submodule.

In this case, the execution of autotools
must be skipped by force.
Autoconf and Automake during bootstrap on coreutils
only works right when using directly checked-out source.

There is a symbol in gnulib, @GNULIB_TIME@
that is not yet defined in coreutils source,
so we use the backup of lib/time.in.h instead
of the one provided by gnulib source.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:30 +02:00
Michael Pratt
87e902fcdc
tools/libtool: bootstrap to local gnulib source
Using the local gnulib source during bootstrap
allows for fine-grained control over the macros
and source files for use with libtool
but part of gnulib instead of libtool,
without having to wait for a release
or deal with gnulib as a git submodule.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:30 +02:00
Michael Pratt
d95d5d2a3a
gettext-full: link to local libxml2
Some users have reported that gettext builds
are attempting to link to libxml2
while it was supposed to be configured
to use it's own built-in substitute.

Configure gettext to require and link
to our local libxml2 explicitly.

Add a patch to revert upstream commit 87927a4e2
which forces libtextstyle to use the built-in libxml,
no matter what the configuration is,
making that option configurable again
after the configure script is regenerated.

Reported-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:30 +02:00
Michael Pratt
f7fbe77115
gettext-full: set gperf as build prerequisite
Require gperf to be built before gettext.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:29 +02:00
Michael Pratt
9b0b46985c
libxml2: add from packages feed
Add libxml2 which can be used to build gettext
instead of the old built-in substitute for it.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:29 +02:00
Michael Pratt
2070a2ca27
gperf: add from packages feed
Add gperf which is required for building gettext
after using the autogen.sh script.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:29 +02:00
Michael Pratt
ca8577f930
gettext-full: override SUBDIRS variable with Makefile
Instead of editing the SUBDIRS variable with a patch,
it can be overriden at the end of the command line when invoking Make.

This tool has a series of recursive Makefiles in each subdirectory,
therefore SUBDIRS is set to a pattern of Make functions
so that the result is variable depending on the current subdirectory
that Make is being invoked in.

Some of the subdirectories don't have a Makefile and are just storing files
for another subdirectory Makefile target,
therefore we have to place a fake Makefile that does nothing.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:29 +02:00
Michael Pratt
4437434b8a
tools/gengetopt: override SUBDIRS variable with Makefile
Instead of editing the SUBDIRS variable with a patch,
it can be overriden at the end of the command line when invoking Make.

This tool has a series of recursive Makefiles in each subdirectory,
therefore SUBDIRS is set to a pattern of Make functions
so that the result is variable depending on the current subdirectory
that Make is being invoked in.

By eliminating the patch, autoreconf is no longer required.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:28 +02:00
Michael Pratt
e764a909e3
tools/flex: override SUBDIRS variable with Makefile
Instead of editing the SUBDIRS variable with a patch,
it can be overriden at the end of the command line when invoking Make.

Skip the build for po files as well, which is causing a conflict
depending on the version of gettext detected, and macros present.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:28 +02:00
Michael Pratt
89a8269c10
tools/automake: move file requirements to higher strictness
GNU standards requires certain files at the top-level directory
of a package that automake is used with, mostly documentation.

If one of these files happens to be missing, autoreconf would fail.

Move these file requirements to the more strict 'GNITS' setting.

Link: https://www.gnu.org/software/automake/manual/html_node/Strictness.html
Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:28 +02:00
Michael Pratt
d39c6cd29b
tools/missing-macros: bump version of makeinfo alternative script
Some new releases of GNU tools are checking for a higher version
of makeinfo than what our scripted alternative shows
when working with checked-out sources instead of releases.

Since this is a "fake" makeinfo we can also just fake the version.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:27 +02:00
Michael Pratt
e4977f614f
tools/missing-macros: prefer macros provided by gnulib source
These 7 macro files are provided by gnulib,
so we can now replace these statically stored copies
with the latest copy from GNU sources.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:27 +02:00
Michael Pratt
fe33d5ba13
tools: add gnulib source
By having a local copy of gnulib, we can:
import the latest macro fixes into any package,
get rid of some statically stored macros that were otherwise missing,
bootstrap GNU tools with the latest relevant source
without having to wait for a release or rely on git submodules,
and possibly more...

The patch assists in bootstrapping by ignoring
the building of po files using gettext,
and also to allow a user-defined path to a program
to include parameters.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:27 +02:00
Michael Pratt
c52d938481
autotools: add list of fake paths to tools
A list that can be used by some packages in order
to force the skipping of every execution of autoreconf.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:26 +02:00
Michael Pratt
ffd7c05aa7
prereq-build: add check for true and false
Some uses cases, like with autotools, need a path for 'true'
if we use them to force something to skip.

This will work by default on Linux hosts,
and require MacOS hosts to get coreutils,
which is currently installed in the CI
for 'macos-latest' host.

In the future, prereq stage can be reworked
to search for the actual binary
instead of relying on env.

Signed-off-by: Michael Pratt <mcpratt@pm.me>
2023-05-04 06:07:23 +02:00
Aleksander Jan Bajkowski
0c117e1f6c
lantiq: xrx200: mark subtarget as source-only
The current problems blocking the switch to the kernel 5.15 are
related to the GSWIP driver. This driver is only used by the
xrx200 subtarget. The other subtargets are unaffected by this
problem.

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
2023-05-04 05:55:02 +02:00
Aleksander Jan Bajkowski
8469e1968b
Revert "lantiq: mark source only"
This reverts commit c306385474.

It should be sufficient to disable only the xrx200 subtarget.

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
2023-05-04 05:54:51 +02:00
Tony Ambardar
3d66f55161 kernel: improve handling of CONFIG_IO_URING
Kernel setting CONFIG_IO_URING supports high-performance I/O for file
access and servers, generally for more performant platforms, and adds
~45 KB to kernel sizes. The need for this on less "beefy" devices is
questionable, as is the size cost considering many platforms have kernel
size limits which require tricky repartitioning if outgrown. The size
cost is also large relative to the ~180 KB bump expected between major
OpenWRT kernel releases.

No OpenWrt packages have hard dependencies on this; samba4 and mariadb
can take advantage if available (+KERNEL_IO_URING:liburing) but
otherwise build and work fine.

Since CONFIG_IO_URING is already managed via the KERNEL_IO_URING setting
in Config-kernel.in (default Y), remove it from those target configs
which unconditionally enable it, and update the defaults to enable it
conditionally only on more powerful 64-bit x86 and arm devices. It may
still be manually enabled as needed for high-performance custom builds.

Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
2023-05-03 10:26:17 -07:00
Tony Ambardar
3980dfcd05 kernel: fix handling of CONFIG_DYNAMIC_DEBUG
Since CONFIG_DYNAMIC_DEBUG is already managed via the KERNEL_DYNAMIC_DEBUG
setting in Config-kernel.in (default N), remove or disable it in target
configs which unconditionally enable it, along with the related setting
CONFIG_DYNAMIC_DEBUG_CORE. This saves several KB in the kernels for
ipq40xx, ipq806x, filogic, mt7622, qoriq, and sunxi.

Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
2023-05-03 10:26:17 -07:00
John Audia
4fa9ec125a
kernel: bump 5.15 to 5.15.110
All patches automatically rebased.

Build system: x86_64
Build-tested: bcm2711/RPi4B, ramips/tplink_archer-a6-v3, filogic/xiaomi_redmi-router-ax6000-ubootmod
Run-tested: bcm2711/RPi4B, ramips/tplink_archer-a6-v3, filogic/xiaomi_redmi-router-ax6000-ubootmod

Signed-off-by: John Audia <therealgraysky@proton.me>
2023-05-03 16:32:26 +02:00
Nick Hainke
3cac52f9a1
ipq40xx: convert AVM FRITZ!Repeater 3000 to DSA
Convert the repeater to DSA.

Signed-off-by: Nick Hainke <vincent@systemli.org>
2023-05-03 16:16:19 +02:00
Hauke Mehrtens
467aa08f8a
kernel: Activate CONFIG_SLAB_FREELIST_RANDOM
This activates CONFIG_SLAB_FREELIST_RANDOM.
This option make the free list less predictable. This makes it harder to
exploit heap based security vulnerabilities.

This adds a little bit more code to the kernel and a small additional
compute overhead.

This option is activated in Debian by default.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-05-03 15:13:26 +02:00
Paul Spooren
626f5f77f7
omap: mark source only
The target is currently broken with Kernel 5.15 and no one in sight to
fix it. Instead of stalling the next release indefinitely, make it
source only and see if someone steps up to fix it.

Signed-off-by: Paul Spooren <paul.spooren@rhebo.com>
2023-05-03 14:49:44 +02:00
Paul Spooren
c306385474
lantiq: mark source only
The target is currently broken with Kernel 5.15 and no one in sight to
fix it. Instead of stalling the next release indefinitely, make it
source only and see if someone steps up to fix it.

Signed-off-by: Paul Spooren <paul.spooren@rhebo.com>
2023-05-03 14:47:55 +02:00
Chukun Pan
6c9b526e84 uboot-mediatek: fixes build when nmbm enabled
The image_header_t typedef has been removed from
uboot v2023.01 [1], replaced with legacy struct.

[1] f3543e6944

Fixes: 3d5c542 ("uboot-mediatek: update to U-Boot 2023.01")
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-05-02 18:17:09 +01:00
Chukun Pan
ab8ead3e2d uboot-mediatek: fix CONFIG_TEXT_BASE variable
CONFIG_SYS_TEXT_BASE has been renamed to CONFIG_TEXT_BASE
in uboot v2023.01 [1], fixes all this variable.

[1] 984639039f

Fixes: 3d5c5427 ("uboot-mediatek: update to U-Boot 2023.01")
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-05-02 18:17:09 +01:00
Chukun Pan
5b0b464e49 uboot-mediatek: remove duplicate config in mt7986
Some config was written twice by mistake, fix it.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
2023-05-02 18:17:09 +01:00
Felix Baumann
e38de40f8d ramips: mt7621: add support for Cudy X6 v2
Rename existing device to v1 and create common .dtsi
Difference to v1: 16MB Flash

Specifications:

SoC: MediaTek MT7621
RAM: 256 MB
Flash: 16 MB (SPI NOR, XM25QH128C on my device)
WiFi: MediaTek MT7915E
Switch: 1 WAN, 4 LAN (Gigabit)
Buttons: Reset, WPS
LEDs: Two Power LEDs (blue and red; together they form purple)
Power: DC 12V 1A center positive
Serial: 115200 8N1
        C440 - (3V3 - GND - RX - TX) - C41 | v1 and v2
               (P   - G   - R  - T)        | v2 labels them on the board
Installation:

Download and flash the manufacturer's built OpenWrt image available at
http://www.cudytech.com/openwrt_software_download
Install the new OpenWrt image via luci (System -> Backup/Flash firmware)
Be sure to NOT keep settings.

Recovery:

Loads only signed manufacture firmware due to bootloader RSA verification
Serve tftp-recovery image as /recovery.bin on 192.168.1.88/24
Connect to any lan ethernet port
Power on the device while holding the reset button
Wait at least 8 seconds before releasing reset button for image to
download

MAC addresses as verified by OEM firmware:

use   address             source
LAN   f4:a4:54:86:75:a2   label
WAN   f4:a4:54:86:75:a3   label + 1
2g    f4:a4:54:86:75:a2   label
5g    f6:a4:54:b6:75:a2   label + LA-Bit set + 4th oktet increased

The label MAC address is found in bdinfo 0xde00.

Signed-off-by: Felix Baumann <felix.bau@gmx.de>
2023-05-02 18:24:52 +02:00
Jan Hoffmann
cf8d861978 realtek: hpe_1920-8g: add phy-handle for SFP ports
The switch driver actually expects every port to have a PHY handle, and
several branches in the code determine if a port is valid by checking
for a non-zero phy field.

Signed-off-by: Jan Hoffmann <jan@3e8.eu>
2023-04-30 21:59:26 +02:00
Daniel Golle
3221128639 mediatek: no longer hard-code WAN PHY of Netgear WAX206
The RealTek 2.5G PHY providing the WAN port of the Netgear WAX206 has
previously been hard-coded in the device tree. Now that the PHY can be
probed correctly also via Clause-45 MDIO, use that instead.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-04-30 17:27:00 +01:00
Daniel Golle
28b3a5e6b5 generic: net: phy: realtek: detect early version of RTL8221B
Early versions (?) of the RTL8221B PHY cannot be identified in a regular
Clause-45 bus scan as the PHY doesn't report the implemented MMDs
correctly but returns 0 instead.
Implement custom identify function using the PKGID instead of iterating
over the implemented MMDs to work-around this problem.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-04-30 17:27:00 +01:00
John Audia
45f5115253 kernel: bump 5.15 to 5.15.109
Removed upstreamed:
	backport-5.15/743-v6.3-0005-net-dsa-b53-mmap-add-phy-ops.patch[1]

All other patches automatically rebased.

1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.15.109&id=357fa038d93d0e9159a0f0d45bae0f8654e2ade5

Build system: x86_64
Build-tested: bcm2711/RPi4B, ramips/tplink_archer-a6-v3, filogic/xiaomi_redmi-router-ax6000-ubootmod
Run-tested: bcm2711/RPi4B, ramips/tplink_archer-a6-v3, filogic/xiaomi_redmi-router-ax6000-ubootmod

Signed-off-by: John Audia <therealgraysky@proton.me>
2023-04-30 00:02:47 +02:00
John Audia
80c1105b03 kernel: bump 5.10 to 5.10.179
All patches automatically rebased.

Signed-off-by: John Audia <therealgraysky@proton.me>
2023-04-30 00:01:12 +02:00
Mikhail Zhilkin
4a043dc9d4 ramips: add factory image for TP-Link EC330-G5u v1
This commit adds factory.bin image for TP-Link EC330-G5u v1. This allows
to install OpenWrt without connecting a serial cable (UART).

Installation using factory image
--------------------------------

Tested with "3.16.0 0.9.1 v6037.0 Build 191016 Rel.30619nb" TP-Link
firmware.

1.  Login to the router web interface (http://192.168.0.1/ by default) and
    save running config to "conf.bin" file
2.  Open configuration file in any TP-Link config editor (e.g.
    https://jahed.github.io/tp-link-config-editor/)
3.  Find "DeviceInfo" section and insert a new string "<Description
    val="Modem Router`telnetd -p 1023 -l login`" />" according to the
    following example:
       <DeviceInfo>
          ...
          <Description val="Modem Router`telnetd -p 1023 -l login`" />
          ...
       </DeviceInfo>
4.  Save configuration file and upload changed configuration using stock
    firmware interface
5.  Login using telnet to IP:192.168.0.1 (Username:admin, password:1234)
6.  Run "cat /proc/mtd | grep mtd7"
       a. If the result is 'mtd7: 03000000 00020000 "rootfs" 03400000',
          then install stock firmware using web interface to toggle booted
          firmware image from "os1" to "os0"
       b. If the result is 'mtd7: 03000000 00020000 "rootfs" 00400000',
          then all is ok, go to the next step
7.  Set up a tftp server with OpenWrt factory.bin image (IP:192.168.0.100
    in this example)
8.  Login using telnet to 192.168.0.1
9.  Download OpenWrt factory.bin image from the tftp server:
       cd /tmp
       tftp -g -r factory.bin 192.168.0.100
10. Write OpenWrt factory.bin image:
       dd if=/tmp/factory.bin of=/dev/mtdblock1
11. Power cycle the router

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-04-29 22:34:51 +02:00
Mikhail Zhilkin
15e21d373b ramips: TP-Link EC330-G5u v1: switch to mac-address-ascii
The TP-Link EC330-G5u v1 router has MAC address that stored in factory mtd
in ascii format. This commit makes the router use of "mac-address-ascii"
in dts.

After the change:
1. All MAC addresses are explicitly assigned in dts (the workarounds in
   network scripts are no longer needed);
2. gmac0 (eth0) MAC address is no longer random.

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
2023-04-29 22:34:51 +02:00
Antonio Vázquez
c31319b669 ramips: lzma-loader: Refactor loader
* Delete unused lantiq makefile
* Delete redundant makefiles and unify them into the main makefile
* Refactor and unify board code into a single file
* Add support and review subtarget specific board support

Signed-off-by: Antonio Vázquez <antoniovazquezblanco@gmail.com>
2023-04-29 22:32:27 +02:00
Rani Hod
e4c7703d2a ramips: add support for D-Link DAP-1620 B1
The DAP-1620 rev B is a wall-plug AC1300 repeater.

Specifications:
- MT7621AT, 256 MiB RAM, 16 MiB SPI NOR
- MT7615DN 2x2 802.11n +2x2 802.11ac (DBDC)
- Ethernet: 1 port 10/100/1000
- Status LEDs (1x red+green)
- LED RSSI bargraph (2x green, 1x red+green)

Installation:
- Keep reset button pressed during plug-in
- Web Recovery Updater is at 192.168.0.50
- Upload factory.bin, confirm flashing
  (seems to work best with Chromium-based browsers)

Revert to OEM firmware:
- tail -c+117 DAP1620B1_FW212B03.bin | \
  openssl aes-256-cbc -d -md md5 -out decrypted.bin \
  -k 905503a4e0c3cd3c1ce062246de427a68962347e
- flash decrypted.bin via D-Link Web Recovery

Signed-off-by: Rani Hod <rani.hod@gmail.com>
2023-04-29 22:05:20 +02:00
Hauke Mehrtens
829a50d242 bcm27xx: Deactivate CONFIG_OABI_COMPAT
This deactivates the kernel option CONFIG_OABI_COMPAT.

The old arm OABI is not needed any more, we compile all applications for
the new ARM EABI.

This reduces the attack surface of the kernel syscall interface.

On all other targets CONFIG_OABI_COMPAT is already deactivated.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-04-29 21:56:53 +02:00
Hauke Mehrtens
7815c55f7d kernel: Deactivate CONFIG_COMPAT
This deactivates the CONFIG_COMPAT kernel option.
With CONFIG_COMPAT the kernel will provide syscall interfaces for arm32
binaries in addition to the interfaces needed for arm64 binaries.

In OpenWrt the complete userspace is compiled for this specific
architecture and support for 32 bit ARM applications is not needed.
This reduces the size and the attack surface for the systems.

On all other targets CONFIG_COMPAT is already deactivated.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-04-29 21:56:53 +02:00
Hauke Mehrtens
0fc3a4aa10 kernel: Deactivate CONFIG_LEGACY_PTYS
The legacy (BSD) PTY support could open security problems in a system,
We do not need them in OpenWrt, deactivate this option in all targets.

Debian also deactivates this option.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-04-29 21:56:53 +02:00
Hauke Mehrtens
ca5555d27e kernel: Activate CONFIG_ARM64_SW_TTBR0_PAN
This activates the CONFIG_ARM64_SW_TTBR0_PAN option for all arm64
kernels by default.

The CONFIG_ARM64_SW_TTBR0_PAN option prevents the kernel form accessing
user space memory directly. This makes it harder to exploit the kernel.

This is activated by default and was already activate on all other arm64
targets before.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-04-29 21:56:53 +02:00
Hauke Mehrtens
626b37d70a kernel: Activate CONFIG_HARDENED_USERCOPY for all targets
This activates CONFIG_HARDENED_USERCOPY for the remaining targets. This
adds additional checks in the copy_from_user() and copy_to_user()
functions.

This was not activated for ARCHS38 before because of a bug in the Linux
kernel 5.4 till 5.14, which as fixed and is described here:
https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/15

I do not know why this was deactivated for mt7629 and rockchip.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-04-29 21:56:53 +02:00