ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-30 18:47:06 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
54,399 Commits 10 Branches 76 Tags 899 MiB
b3e8d58151
Commit Graph

54399 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Dávid Benko
535f4a5bff odhcp6c: update to latest git HEAD 
9212bfc odhcp6c: fix IA discard when T1 > 0 and T2 = 0

Signed-off-by: Dávid Benko <davidbenko@davidbenko.dev>
(cherry picked from commit f920908626)
 2022-07-31 17:12:47 +02:00
Michael Pratt
5a7bcd6977 firewall3: update file hash 
the hash and timestamp of the remote copy of the archive
has changed since last bump
meaning the remote archive copy was recreated

Signed-off-by: Michael Pratt <mcpratt@pm.me>
(cherry picked from commit ba7da73680)
 2022-07-31 17:12:47 +02:00
Claudiu Beznea
c5f0eab222 uboot-at91: fix build on buildbots 
Buidbots are throwing the following compile error:

In file included from tools/aisimage.c:9:
include/image.h:1133:12: fatal error: openssl/evp.h: No such file or directory
            ^~~~~~~~~~~~~~~
compilation terminated.

Fix it by passing `UBOOT_MAKE_FLAGS` variable to make.

Suggested-by: Petr Štetiar <ynezz@true.cz>
Fixes: 6d5611af28 ("uboot-at91: update to linux4sam-2022.04")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
(cherry picked from commit 95a24b5479)
 2022-07-31 17:12:47 +02:00
Claudiu Beznea
972b833e91 uboot-at91: update to linux4sam-2022.04 
Update uboot-at91 to linux4sam-2022.04. As linux4sam-2022.04 is based on
U-Boot v2022.01 which contains commit
93b196532254 ("Makefile: Only build dtc if needed") removed also the DTC
variable passed to MAKE to force the compilation of DTC.

Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
(cherry picked from commit 6d5611af28)
 2022-07-31 17:12:47 +02:00
Claudiu Beznea
39810995fb at91bootstrap: update at91bootstrap v4 targets to v4.0.3 
Update AT91Bootstrap v4 capable targets to v4.0.3.

Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
(cherry picked from commit 859f5f9aec)
 2022-07-31 17:12:47 +02:00
Jo-Philipp Wich
8b6b73d0e8 wolfssl: make shared again 
Disable the usage of target specific CPU crypto instructions by default
to allow the package being shared again. Since WolfSSL does not offer
a stable ABI or a long term support version suitable for OpenWrt release
timeframes, we're forced to frequently update it which is greatly
complicated by the package being nonshared.

People who want or need CPU crypto instruction support can enable it in
menuconfig while building custom images for the few platforms that support
them.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 0063e3421d)
 2022-07-30 17:22:16 +02:00
John Audia
7ca89e1187 kernel: bump 5.10 to 5.10.134 
All patches automatically rebased.

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 7be62b1187)
 2022-07-30 17:22:16 +02:00
John Audia
1db4f5cba3 x86: update defconfig for 5.10.133 
Add some new/missing symbols relating to speculative execution mitigations[1].

1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/arch/x86/Kconfig?id=v5.10.133&id2=v5.10.132

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 56760c0b13)
 2022-07-30 17:22:16 +02:00
John Audia
762703d397 kernel: bump 5.10 to 5.10.133 
All patches automatically rebased.

Build system: x86_64
Build-tested: ipq806x/R7800

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 913f160ac6)
 2022-07-30 17:22:16 +02:00
John Audia
aedcbaae37 kernel: bump 5.10 to 5.10.132 
All patches automatically rebased.

The following patch was replaced by a similar version upstream:
 bcm27xx/patches-5.10/950-0036-tty-amba-pl011-Add-un-throttle-support.patch

Signed-off-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit 7d3c0928de)
 2022-07-30 17:21:47 +02:00
Paul Spooren
a409bd7705 octeon: add SUPPORTED_DEVICES to er/erlite 
Using the BOARD_NAME variable results for both er and erlite devices to
identify themselfs as `er` and `erlite` (via `ubus call system board`).

This is problematic when devices search for firmware upgrades since the
OpenWrt profile is actually called `ubnt_edgerouter` and
`ubnt_edgerouter-lite`.

By adding the `SUPPORTED_DEVICE` a mapping is created to point devices
called `er` or `erlite` to the corresponding profile.

FIXES: https://github.com/openwrt/asu/issues/348

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 2a07270180)
 2022-07-29 15:12:49 +02:00
Rafał Miłecki
e0d3dc5de1 uboot-bcm4908: include SoC in output files 
This fixes problem of overwriting BCM4908 U-Boot and DTB files by
BCM4912 ones. That bug didn't allow booting BCM4908 devices.

Fixes: f4c2dab544 ("uboot-bcm4908: add BCM4912 build")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit a8e1e30543)
 2022-07-28 00:50:13 +02:00
Rafał Miłecki
066547b974 bcm4908: build bootfs image per-SoC 
In theory we could have just 1 bootfs image for all devices as each
device has its own entry in the "configurations" node. It doesn't work
well with default configuration though.

If something goes wrong U-Boot SPL can be interrupted (by pressing A) to
enter its minimalistic menu. It allows ignoring boardid. In such case
bootfs default configuration is used.

For above reason each SoC family (BCM4908, BCM4912) should have its own
bootfs built. It allows each of them to have working default
configuration.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 6ae2f7ff47)
 2022-07-28 00:50:13 +02:00
Daniel Kestrel
506432a783 lantiq: fix network port GPIO settings for Fritzbox 3390 
There are forum reports that 2 LAN ports are not working, the
GPIO settings are adjusted to fix the problem.

Signed-off-by: Daniel Kestrel <kestrel1974@t-online.de>
(cherry picked from commit 0f301b0b1d)
 2022-07-23 00:16:20 +02:00
Christian Lamparter
ee27a2b706 ipq806x: Archer VR2600: fix switch ports numbering 
The order of LAN ports shown in Luci is reversed compared to what is
written on the case of the device.  Fix the order so that they match.

Fixes: #10275
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 69ea671320)
 2022-07-23 00:16:20 +02:00
Christian Lamparter
f2c12b8940 layerscape: update PKG_HASH / PKG_MIRROR_HASH 
The change of the PKG_VERSION caused the hash of the package to
change. This is because the PKG_VERSION is present in the
internal directory structure of the archive.

Fixes: 038d5bdab1 ("layerscape: use semantic versions for LSDK")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit e879cccaa2)
(cherry picked from commit d4391ef073)
 2022-07-23 00:11:21 +02:00
Christian Lamparter
bddfd3f7ed sdk: add spidev-test to the bundle of userspace sources 
moves and extends the current facilities, which have been
added some time ago for the the usbip utility, to support
more utilites that are shipped with the Linux kernel tree
to the SDK.

this allows to drop all the hand-waving and code for
failed previous attempts to mitigate the SDK build failures.

Fixes: bdaaf66e28 ("utils/spidev_test: build package directly from Linux")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit b479db9062)
 2022-07-22 22:26:26 +02:00
Sander Vanheule
396dc89ee7 realtek: correct egress frame port verification 
Destination switch ports for outgoing frame can range from 0 to
CPU_PORT-1.

Refactor the code to only generate egress frame CPU headers when a valid
destination port number is available, and make the code a bit more
consistent between different switch generations. Change the dest_port
argument's type to 'unsigned int', since only positive values are valid.

This fixes the issue where egress frames on switch port 0 did not
receive a VLAN tag, because they are sent out without a CPU header.
Also fixes a potential issue with invalid (negative) egress port numbers
on RTL93xx switches.

Reported-by: Arınç ÜNAL <arinc.unal@xeront.com>
Suggested-by: Birger Koblitz <mail@birger-koblitz.de>
Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit 1773264a0c)
 2022-07-21 20:59:51 +02:00
Sander Vanheule
f8a44c22d4 realtek: correct egress frame priority assignment 
Priority values passed to the egress (TX) frame header initialiser are
invalid when smaller than 0, and should not be assigned to the frame.
Queue assignment is then left to the switch core logic.

Current code for RTL83xx forces the passed priority value to be
positive, by always masking it to the lower bits, resulting in the
priority always being set and enabled. RTL93xx code doesn't even check
the value and unconditionally assigns the (32 bit) value to the (5 bit)
QID field without masking.

Fix priority assignment by only setting the AS_QID/AS_PRI flag when a
valid value is passed, and properly mask the value to not overflow the
QID/PRI field.

For RTL839x, also assign the priority to the right part of the frame
header. Counting from the leftmost bit, AS_PRI and PRI are in bits 36
and 37-39. The means they should be assigned to the third 16 bit value,
containing bits 32-47.

Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit 0b35a08a05)
 2022-07-21 20:59:51 +02:00
Sander Vanheule
4da0b5a786 realtek: fix egress L2 learning on rtl839x 
The flag to enable L2 address learning on egress frames is in CPU header
bit 40, with bit 0 being the leftmost bit of the header. This
corresponds to BIT(7) in the third 16-bit value of the header.

Correctly set L2LEARNING by fixing the off-by-one error.

Fixes: 9eab76c84e ("realtek: Improve TX CPU-Tag usage")
Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit d6165ea75b)
 2022-07-21 20:59:51 +02:00
Sander Vanheule
8614b8eb5f realtek: fix egress port mask on rtl839x 
The flag to enable the outgoing port mask is in CPU header bit 43, with
bit 0 being the leftmost bit of the header. This corresponds to BIT(4)
in the third 16-bit value of the header.

Correctly set AS_DPM by fixing the off-by-one error.

Fixes: 9eab76c84e ("realtek: Improve TX CPU-Tag usage")
Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit d9516cacb0)
 2022-07-21 20:59:51 +02:00
Wenli Looi
c240fed242
ramips: add support for Netgear WAX202 
Netgear WAX202 is an 802.11ax (Wi-Fi 6) router.

Specifications:
* SoC: MT7621A
* RAM: 512 MiB NT5CC256M16ER-EK
* Flash: NAND 128 MiB F59L1G81MB-25T
* Wi-Fi:
  * MT7915D: 2.4/5 GHz (DBDC)
* Ethernet: 4x 1GbE
  * Switch: SoC built-in
* USB: None
* UART: 115200 baud (labeled on board)

Load addresses (same as ipTIME AX2004M):
* stock
  * 0x80010000: FIT image
  * 0x81001000: kernel image -> entry
* OpenWrt
  * 0x80010000: FIT image
  * 0x82000000: uncompressed kernel+relocate image
  * 0x80001000: relocated kernel image -> entry

Installation:
* Flash the factory image through the stock web interface, or TFTP to
  the bootloader. NMRP can be used to TFTP without opening the case.
* Note that the bootloader accepts both encrypted and unencrypted
  images, while the stock web interface only accepts encrypted ones.

Revert to stock firmware:
* Flash the stock firmware to the bootloader using TFTP/NMRP.

References in WAX202 GPL source:
https://www.downloads.netgear.com/files/GPL/WAX202_V1.0.5.1_Source.rar

* openwrt/target/linux/ramips/dts/mt7621-ax-nand-wax202.dts
  DTS file for this device.

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
(cherry picked from commit 0f068e7c4a)
 2022-07-21 16:58:18 +02:00
Wenli Looi
d5858c6d97
image: add support for Netgear encrypted image 
Netgear encrypted image is used in various devices including WAX202,
WAX206, and EX6400v3. This image format also requires a dummy squashfs4
image which is added here as well.

References in WAX202 GPL source:
https://www.downloads.netgear.com/files/GPL/WAX202_V1.0.5.1_Source.rar

* openwrt/bootloader/u-boot-mt7621-2018.09-gitb178829-20200526/board/ralink/common/dual_image.c
  Bootloader code that verifies the presence of a squashfs4 image, thus
  a dummy image is added here.

* openwrt/tools/imgencoder/src/gj_enc.c
  Contains code that generates the encrypted image. There is support for
  adding an RSA signature, but it does not look like the signature is
  verified by the stock firmware or bootloader.

* openwrt/tools/imgencoder/src/imagekey.h
  Contains the encryption key and IV. It appears the same key/IV is used
  for other Netgear devices including WAX206 and EX6400v3.

Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
(cherry picked from commit efca76ffce)
 2022-07-21 16:58:00 +02:00
Hauke Mehrtens
a1068f77c9 wolfssl: Do not activate HW acceleration on armvirt by default 
The armvirt target is also used to run OpenWrt in lxc on other targets
like a Raspberry Pi. If we set WOLFSSL_HAS_CPU_CRYPTO by default the
wolfssl binray is only working when the CPU supports the hardware crypto
extension.

Some targets like the Raspberry Pi do not support the ARM CPU crypto
extension, compile wolfssl without it by default. It is still possible
to activate it in custom builds.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit d1b5d17d03)
 2022-07-20 18:12:52 +02:00
Jianhui Zhao
dbe19b1041 libpcap: fix PKG_CONFIG_DEPENDS for rpcapd 
This fix allows trigger a rerun of Build/Configure when
rpcapd was selected.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
(cherry picked from commit 6902af4f30)
 2022-07-20 18:12:52 +02:00
Pascal Ernster
a12eb71c88 wolfssl: WOLFSSL_HAS_WPAS requires WOLFSSL_HAS_DH 
Without this, WOLFSSL_HAS_DH can be disabled even if WOLFSSL_HAS_WPAS is
enabled, resulting in an "Anonymous suite requires DH" error when trying
to compile wolfssl.

Signed-off-by: Pascal Ernster <git@hardfalcon.net>
Reviewed-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 21825af2da)
 2022-07-20 18:12:52 +02:00
Hauke Mehrtens
41fa086e6f kernel: Refresh kernel patches 
No manual changes needed.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 2022-07-19 21:36:44 +02:00
John Audia
aa237757e0 kernel: bump 5.10 to 5.10.131 
All patches automatically rebased.

Signed-off-by: John Audia <therealgraysky@proton.me>
 2022-07-19 21:36:36 +02:00
John Audia
a51f54b41d kernel: bump 5.10 to 5.10.130 
All patches automatically rebased.

Build system: x86_64
Build-tested: ipq806x/R7800

Signed-off-by: John Audia <therealgraysky@proton.me>
 2022-07-19 21:31:04 +02:00
John Audia
f14122f8e6 kernel: bump 5.10 to 5.10.129 
All patches automatically rebased.

Build system: x86_64
Build-tested: ipq806x/R7800

Signed-off-by: John Audia <therealgraysky@proton.me>
 2022-07-19 21:31:04 +02:00
John Audia
73ef008ea6 kernel: bump 5.10 to 5.10.128 
No patches needed to be rebased, just updated checksums

Signed-off-by: John Audia <therealgraysky@proton.me>
 2022-07-19 21:31:04 +02:00
Rui Salvaterra
cb9a69807e firewall3: bump to latest git HEAD 
4cd7d4f Revert "firewall3: support table load on access on Linux 5.15+"
50979cc firewall3: remove unnecessary fw3_has_table

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
(cherry-picked from commit 435d7a052b)
Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
 2022-07-19 21:30:56 +02:00
John Audia
8ccd657629
mt7622: remove 300 MHz from dts 
Due to the bug described here[1], remove the 300 MHz clock to avoid a low
voltage condition that can cause a hang when rebooting the RT3200/E8450.

This solution is probably better than the script-based work-around[2].

1. https://forum.openwrt.org/t/belkin-rt3200-linksys-e8450-wifi-ax-discussion/94302/1490
2. https://github.com/openwrt/openwrt/pull/5025

Signed-off-by: John Audia <therealgraysky@proton.me>
Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
Tested-by: John Audia <therealgraysky@proton.me>
(cherry picked from commit d0d6b8e183)
[ fix the conflict by apply the patch to kernel 5.10 ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 2022-07-19 14:35:18 +02:00
Rafał Miłecki
606fc4cd81 bcm4908: use upstream-accepted watchdog patches 
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 864fdf2bf3)
 2022-07-18 19:09:02 +02:00
Rafał Miłecki
7eda42a3f3 bcm4908: backport latest DT patches 
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 001856fa51)
 2022-07-18 19:04:24 +02:00
Rafał Miłecki
187f5147d3 kernel: update leds-bcm63138 driver 
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit bb2a2b1dbe)
 2022-07-18 19:04:18 +02:00
Rafał Miłecki
f1fc90e5a1 kernel: backport LEDs driver for BCMBCA devices 
This includes BCM63xx and BCM4908 families.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit d9ab1e56d8)
 2022-07-18 08:13:50 +02:00
Josef Schlehofer
a8001815a6 opkg: update to 2022-02-24 
Changes:
9c44557 opkg_remove: avoid remove pkg repeatly with option --force-removal-of-dependent-packages
2edcfad libopkg: set 'const' attribute for argv

This should fix the CI error in the packages repository, which happens with perl.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit e21fea9289)
 2022-07-17 15:15:11 +02:00
Christian Lamparter
479890083d firmware: intel-microcode: update to 20220510 
Debians' changelog by Henrique de Moraes Holschuh <hmh@debian.org>:

 * New upstream microcode datafile 20220419
  * Fixes errata APLI-11 in Atom E3900 series processors
  * Updated Microcodes:
    sig 0x000506ca, pf_mask 0x03, 2021-11-16, rev 0x0028, size 16384

 * New upstream microcode datafile 20220510
  * Fixes INTEL-SA-000617, CVE-2022-21151:
    Processor optimization removal or modification of security-critical
    code may allow an authenticated user to potentially enable information
    disclosure via local access (closes: #1010947)
  * Fixes several errata (functional issues) on Xeon Scalable, Atom C3000,
    Atom E3900
  * New Microcodes:
    sig 0x00090672, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992
    sig 0x00090675, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992
    sig 0x000906a3, pf_mask 0x80, 2022-03-24, rev 0x041c, size 212992
    sig 0x000906a4, pf_mask 0x80, 2022-03-24, rev 0x041c, size 212992
    sig 0x000b06f2, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992
    sig 0x000b06f5, pf_mask 0x03, 2022-03-03, rev 0x001f, size 212992
  * Updated Microcodes:
    sig 0x00030679, pf_mask 0x0f, 2019-07-10, rev 0x090d, size 52224
    sig 0x000406e3, pf_mask 0xc0, 2021-11-12, rev 0x00f0, size 106496
    sig 0x00050653, pf_mask 0x97, 2021-11-13, rev 0x100015d, size 34816
    sig 0x00050654, pf_mask 0xb7, 2021-11-13, rev 0x2006d05, size 43008
    sig 0x00050656, pf_mask 0xbf, 2021-12-10, rev 0x4003302, size 37888
    sig 0x00050657, pf_mask 0xbf, 2021-12-10, rev 0x5003302, size 37888
    sig 0x0005065b, pf_mask 0xbf, 2021-11-19, rev 0x7002501, size 29696
    sig 0x000506c9, pf_mask 0x03, 2021-11-16, rev 0x0048, size 17408
    sig 0x000506e3, pf_mask 0x36, 2021-11-12, rev 0x00f0, size 109568
    sig 0x000506f1, pf_mask 0x01, 2021-12-02, rev 0x0038, size 11264
    sig 0x000606a6, pf_mask 0x87, 2022-03-30, rev 0xd000363, size 294912
    sig 0x000706a1, pf_mask 0x01, 2021-11-22, rev 0x003a, size 75776
    sig 0x000706a8, pf_mask 0x01, 2021-11-22, rev 0x001e, size 75776
    sig 0x000706e5, pf_mask 0x80, 2022-03-09, rev 0x00b0, size 112640
    sig 0x000806a1, pf_mask 0x10, 2022-03-26, rev 0x0031, size 34816
    sig 0x000806c1, pf_mask 0x80, 2022-02-01, rev 0x00a4, size 109568
    sig 0x000806c2, pf_mask 0xc2, 2021-12-07, rev 0x0026, size 97280
    sig 0x000806d1, pf_mask 0xc2, 2021-12-07, rev 0x003e, size 102400
    sig 0x000806e9, pf_mask 0x10, 2021-11-12, rev 0x00f0, size 105472
    sig 0x000806e9, pf_mask 0xc0, 2021-11-12, rev 0x00f0, size 105472
    sig 0x000806ea, pf_mask 0xc0, 2021-11-12, rev 0x00f0, size 105472
    sig 0x000806eb, pf_mask 0xd0, 2021-11-15, rev 0x00f0, size 105472
    sig 0x000806ec, pf_mask 0x94, 2021-11-17, rev 0x00f0, size 105472
    sig 0x00090661, pf_mask 0x01, 2022-02-03, rev 0x0016, size 20480
    sig 0x000906c0, pf_mask 0x01, 2022-02-19, rev 0x24000023, size 20480
    sig 0x000906e9, pf_mask 0x2a, 2021-11-12, rev 0x00f0, size 108544
    sig 0x000906ea, pf_mask 0x22, 2021-11-15, rev 0x00f0, size 104448
    sig 0x000906eb, pf_mask 0x02, 2021-11-12, rev 0x00f0, size 105472
    sig 0x000906ec, pf_mask 0x22, 2021-11-15, rev 0x00f0, size 104448
    sig 0x000906ed, pf_mask 0x22, 2021-11-16, rev 0x00f0, size 104448
    sig 0x000a0652, pf_mask 0x20, 2021-11-16, rev 0x00f0, size 96256
    sig 0x000a0653, pf_mask 0x22, 2021-11-15, rev 0x00f0, size 97280
    sig 0x000a0655, pf_mask 0x22, 2021-11-16, rev 0x00f0, size 96256
    sig 0x000a0660, pf_mask 0x80, 2021-11-15, rev 0x00f0, size 96256
    sig 0x000a0661, pf_mask 0x80, 2021-11-16, rev 0x00f0, size 96256
    sig 0x000a0671, pf_mask 0x02, 2022-03-09, rev 0x0053, size 103424

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 2747a94f09)
 2022-07-17 14:28:31 +02:00
Dustin Lundquist
c5ee4b7863 openssl: bump to 1.1.1q 
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]

  *) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
     implementation would not encrypt the entirety of the data under some
     circumstances.  This could reveal sixteen bytes of data that was
     preexisting in the memory that wasn't written.  In the special case of
     "in place" encryption, sixteen bytes of the plaintext would be revealed.

     Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
     they are both unaffected.
     (CVE-2022-2097)
     [Alex Chernyakhovsky, David Benjamin, Alejandro Sedeño]

Signed-off-by: Dustin Lundquist <dustin@null-ptr.net>
(cherry picked from commit 3899f68b54)
 2022-07-17 14:28:31 +02:00
Eneas U de Queiroz
ade7c6db1e
wolfssl: bump to 5.4.0 
This version fixes two vulnerabilities:
-CVE-2022-34293[high]: Potential for DTLS DoS attack
-[medium]: Ciphertext side channel attack on ECC and DH operations.

The patch fixing x86 aesni build has been merged upstream.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 9710fe70a6)
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 2022-07-16 22:26:51 +02:00
Tomasz Maciej Nowak
409534860f ath79: bsap18x0: pad rootfs image 
This image is supposed to be written with help of bootloader to the
flash, but as it stands, it's not aligned to block size and RedBoot will
happily create non-aligned partition size in FIS directory. This could
lead to kernel to mark the partition as read-only, therefore pad the
image to block erase size boundary.

Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(cherry picked from commit 9decd2a843)
 2022-07-15 15:22:08 +02:00
Tomasz Maciej Nowak
1be4cad669 ath79: ja76pf2: use nvmem cells to specify MAC addresses 
The bootloader on this board hid the partition containig MAC addresses
and prevented adding this space to FIS directory, therefore those had to
be stored in RedBoot configuration as aliases to be able to assigne them
to proper interfaces. Now that fixed partition size are used instead of
redboot-fis parser, the partition containig MAC addresses could be
specified, and with marking it as nvmem cell, we can assign them without
userspace involvement.

Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(cherry picked from commit b52719b71a)
 2022-07-15 15:22:08 +02:00
Tomasz Maciej Nowak
94530067ad ath79: move image check for devices with RedBoot 
Don't comence the switch to RAMFS when the image format is wrong. This
led to rebooting the device, which could lead to false impression that
upgrade succeded.
Being here, factor out the code responsible for upgrading RedBoot
devices to separate file.

Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(cherry picked from commit 5897c52e78)
 2022-07-15 15:22:08 +02:00
Tomasz Maciej Nowak
8e09f9ffc3 ath79: switch some RedBoot based devices to OKLI loader 
After the kernel has switched version to 5.10, JA76PF2 and
RouterStations lost the capability to sysupgrade the OpenWrt version.
The cause is the lack of porting the patches responsible for partial
flash erase block writing and these boards FIS directory and RedBoot
config partitions share the same erase block. Because of that the FIS
directory can't be updated to accommodate kernel/rootfs partition size
changes. This could be remedied by bootloader update, but it is very
intrusive and could potentially lead to non-trivial recovery procedure,
if something went wrong. The less difficult option is to use OpenWrt
kernel loader, which will let us use static partition sizes and employ
mtd splitter to dynamically adjust kernel and rootfs partition sizes.
On sysupgrade from ath79 19.07 or 21.02 image, which still let to modify
FIS directory, the loader will be written to kernel partition, while the
kernel+rootfs to rootfs partition.

The caveats are:
* image format changes, no possible upgrade from ar71xx target images
* downgrade to any older OpenWrt version will require TFTP recovery or
  usage of bootloader command line interface

To downgrade to 19.07 or 21.02, or to upgrade if one is already on
OpenWrt with kernel 5.10, for RouterStations use TFTP recovery
procedure. For JA76PF2 use instructions from this commit message:
commit 0cc87b3bac ("ath79: image: disable sysupgrade images for routerstations and ja76pf2"),
replacing kernel image with loader (loader.bin suffix) and rootfs
image with firmware (firmware.bin suffix).

Fixes: b10d604459 ("kernel: add linux 5.10 support")
Fixes: 15aa53d7ee ("ath79: switch to Kernel 5.10")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
(mkubntimage was moved to generic-ubnt.mk)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit 5c142aad7b)
 2022-07-15 15:22:07 +02:00
Ronny Kotzschmar
01b8cd3200
rockchip: reliably distribute net interrupts 
On the NanoPI R4S it takes an average of 3..5 seconds for the network devices
to appear in '/proc/interrupts'.
Wait up to 10 seconds to ensure that the distribution of the interrupts
really happens.

Signed-off-by: Ronny Kotzschmar <ro.ok@me.com>
(cherry picked from commit 9b00e97956)
 2022-07-15 07:05:16 +02:00
Eneas U de Queiroz
4fb05e45df
wolfssl: re-enable AES-NI by default for x86_64 
Apply an upstream patch that removes unnecessary CFLAGs, avoiding
generation of incompatible code.

Commit 0bd5367233 is reverted so the
accelerated version builds by default on x86_64.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 639419ec4f)
 2022-07-15 07:03:31 +02:00
Felix Fietkau
ec9f82fa18 mac80211: fix AQL issue with multicast traffic 
Exclude multicast from pending AQL budget

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 9f1d622328)
 2022-07-13 10:36:16 +02:00
Markus Stockhausen
945b13e369 realtek: build sane factory images for DGS-1210 models 
During upload of firmware images the WebUI and CLI patch process
extracts a version information from the uploaded file and stores it
onto the jffs2 partition. To be precise it is written into the
flash.txt or flash2.txt files depending on the selected target image.
This data is not used anywhere else. The current OpenWrt factory
image misses this label. Therefore version information shows only
garbage. Fix this.

Before:
DGS-1210-20> show firmware information
IMAGE ONE:
Version      : xfo/QE~WQD"A\Scxq...
Size         : 5505185 Bytes

After:
DGS-1210-20> show firmware information
IMAGE ONE:
Version      : OpenWrt
Size         : 5505200 Bytes

Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
(cherry picked from commit fae3ac3560)
 2022-07-08 22:10:16 -03:00
Markus Stockhausen
3fbf45bd09 realtek: build factory images for all DGS-1210 models 
Currently we build factory images only for DGS-1210-28 model. Relax
that constraint and take care about all models. Tested on DGS-1210-20
and should work on other models too because of common flash layout.

Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
(cherry picked from commit 2b49ec3a28)
 2022-07-08 22:10:10 -03:00