Commit Graph

51079 Commits

Author SHA1 Message Date
Daniel Golle
17e9553284 tools: add xxd (from vim)
U-Boot requires xxd to create the default environment from an external
file as done in uboot-mediatek.
Build xxd (only, not the rest of vim) as part of tools to make sure it
is present on the buildhost.

Reported-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c4dd2441e7)
2022-03-15 18:50:26 +01:00
Rafał Miłecki
f44f8b07b0 base-files: call "sync" after initial setup
OpenWrt uses a lot of (b)ash scripts for initial setup. This isn't the
best solution as they almost never consider syncing files / data. Still
this is what we have and we need to try living with it.

Without proper syncing OpenWrt can easily get into an inconsistent state
on power cut. It's because:
1. Actual (flash) inode and data writes are not synchronized
2. Data writeback can take up to 30 seconds (dirty_expire_centisecs)
3. ubifs adds extra 5 seconds (dirty_writeback_centisecs) "delay"

Some possible cases (examples) for new files:
1. Power cut during 5 seconds after write() can result in all data loss
2. Power cut happening between 5 and 35 seconds after write() can result
   in empty file (inode flushed after 5 seconds, data flush queued)

Above affects e.g. uci-defaults. After executing some migration script
it may get deleted (whited out) without generated data getting actually
written. Power cut will result in missing data and deleted file.

There are three ways of dealing with that:
1. Rewriting all user-space init to proper C with syncs
2. Trying bash hacks (like creating tmp files & moving them)
3. Adding sync and hoping for no power cut during critical section

This change introduces the last solution that is the simplest. It
reduces time during which things may go wrong from ~35 seconds to
probably less than a second. Of course it applies only to IO operations
performed before /etc/init.d/boot . It's probably the stage when the
most new files get created.

All later changes are usually done using smarter C apps (e.g. busybox or
uci) that creates tmp files and uses rename() that is expected to be
atomic.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Acked-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
(cherry picked from commit 9851d4b6ce)
2022-03-14 08:51:02 +01:00
Rafał Miłecki
e8a806c49e bcm4908: include U-Boot in images
This is a step forward in adding support for devices with U-Boot.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 34fd5e325a)
2022-03-14 08:51:02 +01:00
Rafał Miłecki
45b3f2aa0f uboot-bcm4908: add package with BCM4908 U-Boot
New BCM4908 devices come with U-Boot instead of CFE. Firmwares for such
devices has to include U-Boot.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 0d45e1ea96)
2022-03-14 08:51:01 +01:00
Matthias Schiffer
604274c24b
x86: legacy: enable pata_sis driver
This driver is needed to boot from CompactFlash on the Siemens Futro S400.
The device has an AMD NX1500 CPU, which seems to be unsupported by the
geode subtarget, so it must use legacy.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit c8350dfb3c)
2022-03-10 23:32:59 +01:00
Rafał Miłecki
13c9f1f37d bcm4908: support "rootfs_data" on U-Boot devices
1. Create "rootfs_data" dynamicaly

U-Boot firmware images can contain only 2 UBI volumes: bootfs (container
with U-Boot + kernel + DTBs) and rootfs (e.g. squashfs). There is no way
to include "rootfs_data" UBI volume or make firmware file tell U-Boot to
create one.

For that reason "rootfs_data" needs to be created dynamically. Use
preinit script to handle that. Fire it right before "mount_root" one.

2. Relate "rootfs_data" to flashed firmware

As already explained flashing new firmware with U-Boot will do nothing
to the "rootfs_data". It could result in new firmware reusing old
"rootfs_data" overlay UBI volume and its file. Users expect a clean
state after flashing firmware (even if flashing the same one).

Solve that by reading flash counter of running firmware and storing it
in "rootfs_data" UBI volume. Every mismatch will result in wiping old
data.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 93259e8ca2)
2022-03-07 14:48:02 +01:00
Rafał Miłecki
e12ffac02d bcm4908: fix USB PHY support
This fixes problem with USB PHY not handling some USB 3.0 devices.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 0dbcefdd52)
2022-03-07 14:48:02 +01:00
Josef Schlehofer
f1e1daa6e8 u-boot.mk: add LOCALVERSION (explicitly specify OpenWrt build)
For debugging purposes, we need to know if users are using modified
U-boot versions or not. Currently, the U-boot version is somehow
stripped. This is a little bit problematic when there are
backported/wip/to-upstream patches.

To make it more confusing, there was (before this commit) two U-boot
versioning. U-boot compiled by OpenWrt build bots are missing ``Build:``
This is also the case when the U-boot is compiled locally.

Example:
```
U-Boot SPL 2022.01 (Jan 27 2022 - 00:24:34 +0000)
U-Boot 2022.01 (Jan 27 2022 - 00:24:34 +0000)
```

On the other hand, if you run full build, you can at least see, where it
was compiled. Notice added ``Build:``.

Example:
```
U-Boot 2022.01 (Jan 27 2022 - 00:24:34 +0000), Build: jenkins-turris-os-packages-burstlab-omnia-216
```

In both cases, it is not clear to U-boot developers if it is an unmodified
build. This is also caused that there is a missing ``.git`` file from
U-boot folder, and so there is no history. It leads to that it can not
contain suffix ``-dirty`` (uncommitted modifications) or even something
else like number of commits, etc. [1]

When U-boot is compiled as it should be, the version should look like
this: ``U-Boot 2022.04-rc1-01173-g278195ea1f (Feb 11 2022 - 14:46:50 +0100)``
The date is not changed daily when there are new OpenWrt builds.

This commit adds OpenWrt specific version, which could be verified by
using strings.

```
$ strings bin/targets/mvebu/cortexa9/u-boot-omnia/u-boot-spl.kwb | grep -E "OpenWrt*"
U-Boot SPL 2022.01-OpenWrt-r18942+54-cbfce92367 (Feb 21 2022 - 13:17:34 +0000)
arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 11.2.0 r18942+54-cbfce92367) 11.2.0
2022.01-OpenWrt-r18942+54-cbfce92367
U-Boot 2022.01-OpenWrt-r18942+54-cbfce92367 (Feb 21 2022 - 13:17:34 +0000)
```

[1] https://u-boot.readthedocs.io/en/latest/develop/version.html

Reported-by: Pali Rohár <pali@kernel.org>
Suggested-by: Karel Kočí <karel.koci@nic.cz>
[rebased for OpenWrt 21.02]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d6aa9d9e07)
2022-03-06 20:56:23 +01:00
Josef Schlehofer
0327104686 tools/libressl: update to version 3.4.2
Release notes:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.4.2-relnotes.txt

```
It includes the following security fix

  * In some situations the X.509 verifier would discard an error on an
    unverified certificate chain, resulting in an authentication bypass.
    Thanks to Ilya Shipitsin and Timo Steinlein for reporting.
```

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 495c4f4e19)
2022-03-06 20:56:23 +01:00
Rosen Penev
8ed3b5b04b tools/libressl: update to 3.4.1
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 03bb3412a2)
2022-03-06 20:56:23 +01:00
Rosen Penev
2736a5df94 tools/libressl: update to 3.3.4
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit f78ad901e1)
2022-03-06 20:56:23 +01:00
Rosen Penev
49b2e6365d tools/libressl: update to 3.3.3
Fix wrong FPIC variable usage. Fixes compilation under sparc64 host.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit bf4dbbb55e)
2022-03-06 20:56:23 +01:00
Hauke Mehrtens
2d69d098e0 kernel: bump 5.4 to 5.4.182
The following patch was integrated upstream:
  target/linux/bcm4908/patches-5.4/180-i2c-brcmstb-fix-support-for-DSL-and-CM-variants.patch

All other updated automatically.

The new config option CONFIG_BPF_UNPRIV_DEFAULT_OFF is now handled too.

Compile-tested on: lantiq/xrx200, armvirt/64
Runtime-tested on: lantiq/xrx200, armvirt/64

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-03-06 20:55:26 +01:00
Marek Behún
7bd583e5f3 uboot-envtools: mvebu: update uci defaults for Turris Omnia
From version 2021.09 U-Boot will fixup Turris Omnia's DTB before
booting, separating U-Boot's environment into separate MTD partition
"u-boot-env" [1].

Check if "u-boot-env" MTD partition exists and set the uci defaults
accordingly.

[1] https://lists.denx.de/pipermail/u-boot/2021-July/455017.html

Signed-off-by: Marek Behún <marek.behun@nic.cz>
(cherry picked from commit 713be75439)
2022-03-02 13:29:32 +01:00
Petr Štetiar
b2896d413e ipq806x: base-files: asrock: fix bootcount include
Fixes following warning message during image building process:

 Finalizing root filesystem...
 root-ipq806x/lib/upgrade/asrock.sh: line 1: /lib/functions.sh: No such file or directory
 Enabling boot
 root-ipq806x/lib/upgrade/asrock.sh: line 1: /lib/functions.sh: No such file or directory
 Enabling bootcount

Fixes #9350

Fixes: 98b86296e6 ("ipq806x: add support for ASRock G10")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit fc317a190c)
2022-02-28 15:21:32 +01:00
Sungbo Eo
952de38ef4 Revert "ramips: increase spi-max-frequency for ipTIME mt7620 devices"
This reverts commit 13a185bf8a.

There was a report that one A1004ns device fails to detect its flash
chip correctly:

[    1.470297] spi-nor spi0.0: unrecognized JEDEC id bytes: e0 10 0c 40 10 08
[    1.484110] spi-nor: probe of spi0.0 failed with error -2

It also uses a different flash chip model:
* in my hand: Winbond W25Q128FVSIG (SOIC-8)
* reported: Macronix MX25L12845EMI-10G (SOP-16)

Reducing spi-max-frequency solved the detection failure. Hence revert.

Reported-by: Koasing <koasing@gmail.com>
Tested-by: Koasing <koasing@gmail.com>
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 9968a909c2)
2022-02-27 21:40:32 +09:00
John Crispin
abf8209d7f hostapd: fix radius problem due to invalid attributes
The offending commit caused the configuration file to contain:
  radius_auth_req_attr=
  radius_acct_req_attr=
which cause hostapd to add an ATTR of type 0 into the messages.

hostapd: RADIUS message: code=4 (Accounting-Request) identifier=0 length=93
hostapd:    Attribute 40 (Acct-Status-Type) length=6
hostapd:       Value: 7
hostapd:    Attribute 30 (Called-Station-Id) length=28
hostapd:       Value: 'C4-41-1E-F5-2D-55:OpenWifi'
hostapd:    Attribute 61 (NAS-Port-Type) length=6
hostapd:       Value: 19
hostapd:    Attribute 0 (?Unknown?) length=3    <----------------
hostapd:    Attribute 55 (Event-Timestamp) length=6
hostapd:       Value: 1622726457
hostapd:    Attribute 41 (Acct-Delay-Time) length=6
hostapd:       Value: 0
hostapd:    Attribute 44 (Acct-Session-Id) length=18
hostapd:       Value: '9B5961E7235AAEC6'

Closes: #9315
Fixes: ce7a170414 ("hostapd: add additional radius options")
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [pkg version bump]
(cherry picked from commit 96e9c81aab)
2022-02-26 09:27:15 +01:00
Petr Štetiar
610b2cff60 ipq806x: base-files: asrock: fix bootcount include
Fixes following error while executing the init script on the buildhost:

 Enabling boot
 ./etc/init.d/bootcount: line 5: /lib/upgrade/asrock.sh: No such file or directory
 Enabling bootcount

While at it fix following shellcheck issue:

 base-files/etc/init.d/bootcount line 11:
    if [ $? -eq 0 ]; then
         ^-- SC2181: Check exit code directly with e.g. 'if mycmd;', not indirectly with $?.

Fixes: #9345
Cc: Ansuel Smith <ansuelsmth@gmail.com>
Cc: Pawel Dembicki <paweldembicki@gmail.com>
Cc: Christian Lamparter <chunkeey@gmail.com>
Fixes: 98b86296e6 ("ipq806x: add support for ASRock G10")
References: https://gitlab.com/ynezz/openwrt/-/jobs/1243290743#L1444
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit ce8af0ace0)
2022-02-26 07:40:43 +01:00
Petr Štetiar
b99d7aecc8 wolfssl: fix API breakage of SSL_get_verify_result
Backport fix for API breakage of SSL_get_verify_result() introduced in
v5.1.1-stable.  In v4.8.1-stable SSL_get_verify_result() used to return
X509_V_OK when used on LE powered sites or other sites utilizing
relaxed/alternative cert chain validation feature. After an update to
v5.1.1-stable that API calls started returning X509_V_ERR_INVALID_CA
error and thus rendered all such connection attempts imposible:

 $ docker run -it openwrt/rootfs:x86_64-21.02.2 sh -c "wget https://letsencrypt.org"
 Downloading 'https://letsencrypt.org'
 Connecting to 18.159.128.50:443
 Connection error: Invalid SSL certificate

Fixes: #9283
References: https://github.com/wolfSSL/wolfssl/issues/4879
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit b9251e3b40)
2022-02-22 20:29:39 +01:00
Chuanhong Guo
7612ecb201 ramips: mt7621: do memory detection on KSEG1
It's reported that current memory detection code occasionally detects
larger memory under some bootloaders.
Current memory detection code tests whether address space wraps around
on KSEG0, which is unreliable because it's cached.

Rewrite memory size detection to perform the same test on KSEG1 instead.
While at it, this patch also does the following two things:
1. use a fixed pattern instead of a random function pointer as the magic
   value.
2. add an additional memory write and a second comparison as part of the
   test to prevent possible smaller memory detection result due to
   leftover values in memory.

Fixes: 6d91ddf517 ("ramips: mt7621: add support for memory detection")
Reported-by: Rui Salvaterra <rsalvaterra@gmail.com>
Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
(cherry picked from commit 2f024b7933)
[backport for OpenWrt 21.02 as it was reproducible with Kernel 5.4, see [1]]
[1]: https://forum.openwrt.org/t/113081
Tested-by: Dimitri Souza <dimitri.souza@gmail.com> [mt7621/archer-c6-v3]
Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
2022-02-22 20:48:46 +08:00
Šimon Bořek
7fc336484b rpcd: backport 802.11ax support
Backport of commit 7a560a1a5769 ("iwinfo: add 802.11ax HE support").

enables 802.11ax capability detection through ubus in OpenWrt 21.02
(e.g. with MT7915E 802.11ax PCI Express Wireless Network Adapter)

Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
[commit message facelift, use openwrt-21.02 branch]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2022-02-19 10:01:03 +01:00
Hauke Mehrtens
d1c15c41d9 OpenWrt v21.02.2: revert to branch defaults
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-02-17 19:00:44 +01:00
Hauke Mehrtens
30e2782e06 OpenWrt v21.02.2: adjust config defaults
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-02-17 19:00:30 +01:00
Felix Fietkau
bf0c965af0 ramips: fix NAND flash driver ECC bit position mask
The bit position mask was accidentally made too wide, overlapping with the LSB
from the byte position mask. This caused ECC calculation to fail for odd bytes

Signed-off-by: Chad Monroe <chad.monroe@smartrg.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 918d4ab41e)
2022-02-16 21:29:10 +01:00
Felix Fietkau
adb65008c8 kernel: backport fix for initializing skb->cb in the bridge code to 5.4
Fixes issues with proxyarp

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit dabc78b644)
2022-02-16 20:38:59 +01:00
Rosen Penev
b7af850bd2 tools/mtools: update to 4.0.35
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from commit aae4bf7c62)
2022-02-16 20:38:47 +01:00
Felix Fietkau
5d553d8767 tools/fakeroot: fix unresolved symbols on arm64 macOS
The $INODE64 symbol variants are not present, since the base system
always uses 64-bit file offsets

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 53ebacacf9)
2022-02-16 20:38:47 +01:00
Sergey V. Lobanov
c8d6a7c84e tools/fakeroot: fix build on MacOS arm64
Added patch for MacOS without 32 bit inodes support
(__DARWIN_ONLY_64_BIT_INO_T is true)

This patch based on discussion https://github.com/archmac/bootstrap/issues/4

Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry-picked from commit 8fedc17d01)
2022-02-16 20:38:47 +01:00
Felix Fietkau
83bf22ba2e tools/fakeroot: explicitly pass CPP variable
For some reason, the generated configure script fails to properly set up
the internal preprocessor command variable, causing the host OS check for
Darwin to fail after the last update.
Explicitly setting CPP fixes this issue

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 48e209e5c5)
2022-02-16 20:38:47 +01:00
Rafał Miłecki
230ec4c69c bcm4908: backport watchdog and I2C changes
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 923cc869a6)
2022-02-16 09:15:52 +01:00
Rafał Miłecki
87b9ba9ed9 bcm4908: backport first 5.18 DTS changes
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit da8b720b0e)
2022-02-16 09:15:52 +01:00
Rafał Miłecki
e6a718239f bcm4908: backport bcm_sf2 patch for better LED registers support
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 840f07e532)
2022-02-16 09:15:52 +01:00
Rafał Miłecki
e6aaa061d0 bcm4908: backport BCM4908 pinctrl driver
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit b014589167)
2022-02-16 09:15:48 +01:00
Hauke Mehrtens
59e7ae8d65 tcpdump: Fix CVE-2018-16301
This fixes the following security problem:
The command-line argument parser in tcpdump before 4.99.0 has a buffer
overflow in tcpdump.c:read_infile(). To trigger this vulnerability the
attacker needs to create a 4GB file on the local filesystem and to
specify the file name as the value of the -F command-line argument of
tcpdump.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 8f5875c4e2)
2022-02-13 00:23:30 +01:00
Hauke Mehrtens
de948a0bce glibc: update to latest 2.33 HEAD
14f2867b57 Fix failing nss/tst-nss-files-hosts-long with local resolver
d27d1e4d13 posix: Fix attribute access mode on getcwd [BZ #27476]
4b95183785 S390: Add PCI_MIO and SIE HWCAPs
6090cf1330 elf: Replace nsid with args.nsid [BZ #27609]
9edf29fd72 s390: Use long branches across object boundaries (jgh instead of jh)
94c91ce231 support: Add xpthread_kill
f9592d65f2 nptl: Do not set signal mask on second setjmp return [BZ #28607]
1cc490adca powerpc64[le]: Fix CFI and LR save address for asm syscalls [BZ #28532]
c76a0ba878 gconv: Do not emit spurious NUL character in ISO-2022-JP-3 (bug 28524)
c493f6a0e4 powerpc64[le]: Allocate extra stack frame on syscall.S
55b99e9ed0 powerpc: Fix unrecognized instruction errors with recent GCC
a51b76b71e x86: use default cache size if it cannot be determined [BZ #28784]
f10e992e8d socket: Add the __sockaddr_un_set function
4653cd9e36 CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542)
dae9a8e7f6 sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)
4f4452721d <shlib-compat.h>: Support compat_symbol_reference for _ISOMAC
0f70b829f8 CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)
5cab4e3f3a powerpc: Fix unrecognized instruction errors with recent binutils
ac148bdd88 elf: Fix glibc-hwcaps priorities with cache flags mismatches [BZ #27046]
e081bafcb1 support: Add helpers to create paths longer than PATH_MAX
e41e5b97e3 realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770]
f63cb3cf72 tst-realpath-toolong: Fix hurd build
46a70c49ba support: Add xclone
bcdde07537 getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999)
41980af2d7 realpath: Avoid overwriting preexisting error (CVE-2021-3998)
48d9161e02 Linux: Detect user namespace support in io/tst-getcwd-smallbuff
06ce5fbd6d support: Fix xclone build failures on ia64 and hppa
d251ad533e aarch64: align stack in clone [BZ #27939]
3d52239b30 x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ# 28755]
86c153d092 NEWS: Add a bug fix entry for BZ #28755
6b7b6c7514 test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655]
a744a0a3fe test-strnlen.c: Check that strnlen won't go beyond the maximum length
f0a2b67147 x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP
9cee072f8f x86-64: Add ifunc-avx2.h functions with 256-bit EVEX
06d1aed51b x86-64: Add strcpy family functions with 256-bit EVEX
1697e739ef x86-64: Add memmove family functions with 256-bit EVEX
47bf9f38bb x86-64: Add memset family functions with 256-bit EVEX
15bae38c8b x86-64: Add memcmp family functions with 256-bit EVEX
0598a25cbe x86-64: Add AVX optimized string/memory functions for RTM
82f1ba9af7 x86: Add string/memory function tests in RTM region
763cea698b x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions
d49105cc7a x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions
31dd3e3cb3 x86-64: Fix ifdef indentation in strlen-evex.S
902af2f5ee NEWS: Add a bug fix entry for BZ #27457
e09c377806 x86: Optimize memchr-avx2.S
453ed0a0f2 x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974]
b72b89705e x86: Optimize strlen-avx2.S
355afae940 x86: Optimize memchr-evex.S
3dea108f60 x86-64: Fix an unknown vector operation in memchr-evex.S
5697e2dda8 x86-64: Move strlen.S to multiarch/strlen-vec.S
3ac5a7fe8b x86-64: Add wcslen optimize for sse4.1
cef3bffade x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974]
8a3a0177c7 x86: Optimize strlen-evex.S
2b00ee820a String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974]
25941de34e NEWS: Add a bug fix entry for BZ #27974
3e2a15c666 x86-64: Require BMI2 for __strlen_evex and __strnlen_evex
5cb6edb6cd x86: Copy IBT and SHSTK usable only if CET is enabled
0a5f5e2dc1 x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033]
54fdfa2b33 x86: Black list more Intel CPUs for TSX [BZ #27398]
1b8f2456b9 x86: Use CHECK_FEATURE_PRESENT to check HLE [BZ #27398]
260360e89b x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064]
1956ad4930 x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064]
78d25827ae Linux: Simplify __opensock and fix race condition [BZ #28353]
9495d729f6 hurd if_index: Explicitly use AF_INET for if index discovery
55446dd8a2 socket: Do not use AF_NETLINK in __opensock

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-02-13 00:23:30 +01:00
Hauke Mehrtens
0c0db6e66b hostapd: Apply SAE/EAP-pwd side-channel attack update 2
This fixes some recent security problems in hostapd.
See here for details: https://w1.fi/security/2022-1
* CVE-2022-23303
* CVE-2022-23304

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-02-13 00:23:30 +01:00
Sergey V. Lobanov
5b13b0b02c wolfssl: update to 5.1.1-stable
Bump from 4.8.1-stable to 5.1.1-stable

Detailed release notes: https://github.com/wolfSSL/wolfssl/releases

Upstreamed patches:
001-Maths-x86-asm-change-asm-snippets-to-get-compiling.patch -
 fa8f23284d
002-Update-macro-guard-on-SHA256-transform-call.patch -
 f447e4c1fa

Refreshed patches:
100-disable-hardening-check.patch
200-ecc-rng.patch

CFLAG -DWOLFSSL_ALT_CERT_CHAINS replaced to --enable-altcertchains
configure option

The size of the ipk changed on aarch64 like this:
491341 libwolfssl4.8.1.31258522_4.8.1-stable-7_aarch64_cortex-a53.ipk
520322 libwolfssl5.1.1.31258522_5.1.1-stable-1_aarch64_cortex-a53.ipk

Tested-by: Alozxy <alozxy@users.noreply.github.com>
Acked-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit 93d91197b9)
2022-02-13 00:23:08 +01:00
Sergey V. Lobanov
7d376e6e52 libs/wolfssl: add SAN (Subject Alternative Name) support
x509v3 SAN extension is required to generate a certificate compatible with
chromium-based web browsers (version >58)

It can be disabled via unsetting CONFIG_WOLFSSL_ALT_NAMES

Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit dfd695f4b9)
2022-02-12 20:27:27 +01:00
Stan Grishin
5ea2e1d5ba wolfssl: enable ECC Curve 25519 by default
* fixes https://github.com/openwrt/packages/issues/16652
 see https://github.com/openwrt/packages/issues/16674#issuecomment-934983898

Signed-off-by: Stan Grishin <stangri@melmac.net>
(cherry picked from commit 05a7af9ca0)
2022-02-12 20:25:48 +01:00
Hauke Mehrtens
4108d02a29 ustream-ssl: update to Git version 2022-01-16
868fd88 ustream-openssl: wolfSSL: Add compatibility for wolfssl >= 5.0

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit e74529552c)
2022-02-12 20:02:21 +01:00
Hauke Mehrtens
32d50a1281 mbedtls: Update to version 2.16.12
This fixes the following security problems:
* Zeroize several intermediate variables used to calculate the expected
  value when verifying a MAC or AEAD tag. This hardens the library in
  case the value leaks through a memory disclosure vulnerability. For
  example, a memory disclosure vulnerability could have allowed a
  man-in-the-middle to inject fake ciphertext into a DTLS connection.
* Fix a double-free that happened after mbedtls_ssl_set_session() or
  mbedtls_ssl_get_session() failed with MBEDTLS_ERR_SSL_ALLOC_FAILED
  (out of memory). After that, calling mbedtls_ssl_session_free()
  and mbedtls_ssl_free() would cause an internal session buffer to
  be free()'d twice. CVE-2021-44732

The sizes of the ipk changed on MIPS 24Kc like this:
182454 libmbedtls12_2.16.11-2_mips_24kc.ipk
182742 libmbedtls12_2.16.12-1_mips_24kc.ipk

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 57f38e2c82)
2022-02-12 19:42:08 +01:00
Hauke Mehrtens
c6ddf8d502 kernel: bump 5.4 to 5.4.179
Many changes were done in drivers/pinctrl/bcm/pinctrl-bcm2835.c between
5.4.171 and 5.4.179.
The following 3 patches do not apply any more:
* target/linux/bcm27xx/patches-5.4/950-0316-pinctrl-bcm2835-Add-support-for-BCM2711-pull-up-func.patch
  This was already integrated in kernel v5.4-rc1, it was never needed.

* target/linux/bcm27xx/patches-5.4/950-0328-Revert-pinctrl-bcm2835-Pass-irqchip-when-adding-gpio.patch
* target/linux/bcm27xx/patches-5.4/950-0362-pinctrl-bcm2835-Change-init-order-for-gpio-hogs.patch
I think these were done to fix the problem which was really fixed in
commit 75278f1aff5e ("pinctrl: bcm2835: Change init order for gpio
hogs") from v5.4.175

target/linux/generic/backport-5.4/716-v5.5-net-sfp-move-fwnode-parsing-into-sfp-bus-layer.patch
Move fwnode_device_is_available to the same position as in kernel 5.10.

target/linux/layerscape/patches-5.4/302-dts-0083-arm64-ls1028a-qds-correct-bus-of-rtc.patch
Applied in commit 65816c1034769e714edb70f59a33bc5472d9e55f ("arm64: dts:
ls1028a-qds: move rtc node to the correct i2c bus")

Compile-tested: lantiq/xrx200, bcm27xx/bcm2710
Run-tested: lantiq/xrx200

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-02-12 19:41:39 +01:00
Sven Eckelmann
a4c0c031b8 ath79: Add support for OpenMesh OM5P-AC v2
Device specifications:
======================

* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/200 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
  - 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* 4x GPIO-LEDs (3x wifi, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
  - eth0
    + AR8035 ethernet PHY (RGMII)
    + 10/100/1000 Mbps Ethernet
    + 802.3af POE
    + used as LAN interface
  - eth1
    + AR8031 ethernet PHY (RGMII)
    + 10/100/1000 Mbps Ethernet
    + 18-24V passive POE (mode B)
    + used as WAN interface
* 12-24V 1A DC
* internal antennas

This device support is based on the partially working stub from commit
53c474abbd ("ath79: add new OF only target for QCA MIPS silicon").

Flashing instructions:
======================

Various methods can be used to install the actual image on the flash.
Two easy ones are:

ap51-flash
----------

The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.

initramfs from TFTP
-------------------

The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):

   setenv serverip 192.168.1.21
   setenv ipaddr 192.168.1.1
   tftpboot 0c00000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr

The actual sysupgrade image can then be transferred (on the LAN port) to the
device via

  scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/

On the device, the sysupgrade must then be started using

  sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin

Signed-off-by: Sven Eckelmann <sven@narfation.org>
(cherry picked from commit 1699c1dc7f)
2022-02-11 00:28:52 +01:00
Paul Spooren
6d266ef158 imagebuilder: fix local packages/ folder
This commit fixes commit "2999f810ff: build,IB: include kmods only in
local builds" which cause the local packages/ folder only to be added
for local builds but no longer for ImageBuilder created by the Buildbot.

The commits intention was to use remote kmods repositories rather than
storing them locally. Accidentally the entire handling of the local
`packages/` was removed.

Re-add the folder and include a README describing what it can be used
for.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 15e55a2190)
Fixes: #5068
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-02-10 20:06:04 +01:00
Rafał Miłecki
97b95ef8b9
uci: update to the latest master
4b3db11 cli: add option for changing save path

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 05a4273058)
2022-01-23 11:30:30 +01:00
Daniel Golle
1472a8fa42 procd: update to git HEAD
945d0d7 utils: fix C style in header file
 2cfc26f inittab: detect active console from kernel if no console= specified

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit ffeb37047e)
2022-01-18 15:09:15 +01:00
Daniel Golle
015f170fe6 procd: update to git HEAD
64e9f3a procd: fix compilation with newer musl

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1cd4a02c8e)
2022-01-18 15:09:15 +01:00
Karel Kočí
cd5ba0cfbb ustream-ssl: variants conflict with each other
This adds conflicts between variants of libustream pacakge.
They provide the same file and thus it should not be possible to install
them side by side.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit 219e17a350)
2022-01-16 16:28:46 +01:00
David Bauer
6eced97ce4 lantiq: flag FritzBox 7360 family buttons active-low
All buttons of the FritzBox 7360 family are active-low, not active-high.
Corrent the GPIO flag. This fixes release triggers upon push of a button.

Reported-by: Jan-Niklas Burfeind <git@aiyionpri.me>
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 3154537864)
2022-01-15 22:49:28 +01:00
Matthias Schiffer
b59f3b08b4
firmware-utils: tplink-safeloader: fix Archer A7v5 factory flashing from vendor fw > v1.1.x
Apply the same fix that was previously done for the Archer C7v5 to the
A7v5 as well to make the web UI accept our images again.

This is a backport of firmware-utils
commit 84dbf8ee49f522d3a4528763c9473cf3dd7c8c52.

Tested-by: Luflosi <luflosi@luflosi.de>
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
2022-01-14 23:15:05 +01:00