The swconfig kernel infrastructure fails to do any permissions checks when
changing settings. As such an ordinary user account on a device with a
switch can change switch settings without any special permissions.
Routers generally have few non-admin users so this isn't a big hole, but it
is a security hole. Likely the greatest danger is for multifunction devices
which have a lot of extra daemons, compromising a low-security daemon would
allow one to modify switch settings and cause the router/switch to appear to
lock-up (or cause other sorts of troublesome nyetwork behavior).
Implement a check for CAP_NET_ADMIN in swconfig_set_attr() and deny any
requests originating from user contexts lacking this capability.
Reported-by: Elliott Mitchell <ehem+openwrt@m5p.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Combine all bus operations for one MMD access in one function.
Protecting all these bus operations with one lock also helps
to avoid potential issues due to bus operations intercepting
the register and data write.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48914
The default TTL for address resolution table entries is 5 minutes
for all members of the AR8216 family. This can cause issues if
e.g. Wifi clients roam to another AP and their MAC appears on
another switch port suddenly. Then the client may not be reachable
until the old ARL entry expires.
I would have expected the switch to invalidate old entries if it
detects the same MAC on another port. But that's not the case.
Therefore make the TTL for ARL entries configurable.
The effective TTL will always be a multiple of 7 seconds.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48913
The line before includes the port number anyway so there's no need
to duplicate the port number in the MIB info header.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48912
The decimal values especially for TxByte and RxGoodByte are hard to read
once bigger amounts of data have been transferred.
Therefore complement the decimal values with info in GiB / MiB / KiB.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48911
For unused switch ports all MIB values are zero. Displaying ~40 empty
MIB counters is just confusing and makes it hard to read the output of
swconfig dev <dev> show.
Therefore, if all MIB counters for a port are zero, just display
an info that the MIB counters are empty.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48910
This patch adds speed_mask special file to LEDs connected to switch ports
via 'switch' trigger. It allows to choose which speeds to signal when link
is up. If router has more than one LED per port, they may light up
differently depending on how fast connection is. Default setting is 'all
speeds' so backward compatibility with system scripts (for example uci) is
maintained.
Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
SVN-Revision: 48775
This patch changes swconfig_trig_port_mask_store() handler to utilize
kstrtoul() function instead of call to obsolete simple_strtoul(). Thanks
to this change, new handler takes less memory and makes port_mask special
file accept not only hexadecimal, but also decimal and octal numbers.
Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
SVN-Revision: 48774
Seama format has 2 similar headers: container (seal) header and entity
header. The first one has size always set to 0 and doesn't contain MD5
digest.
When dealing with Seama on a flash we deal directly with an entity. You
can see mtdsplit_parse_seama reads from offset 0 and expects entity to
be there. Seama container is used by bootloader / interface only which
extract entity out of it and flash it.
That said we should fix our header struct. This is important as we
calculate possible rootfs offset assuming it may be placed right after
Seama entity. So far calculate offset was always 16B too low.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48754
When dealing with Broadcom hardware we can simply use swconfig's generic
helper, we just need to do some validation of requested state.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48623
Thanks to this change swconfig can access port PHYs e.g. when setting
port link state with a generic helper.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48622
It's quite common for switches to have PHY per port so adding a generic
helper setting link state will help many drivers. It just needs an API
to access PHYs which this patch also adds.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48621
Some D-Link routers (e.g. DIR-885L) have NAND and use Seama format. It
means OpenWrt will want to have UBI in Sseama entity and should be able
to detect it.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48600
Our mtdsplit parsers may want to create partition with name choice based
on partition file system (e.g. SquashFS vs. JFFS2). This patch allows
passing extra argument pointing to variable that will be set properly.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48598
Rename kernel_size variable as it includes whole entity size, not just a
kernel size. Also update comments to match it and describe better what
are we checking/looking for.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48480
Directly return the return value of genl_register_family_with_ops()
instead of storing it in a temporary variable, then returning it.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 48472
BCM531x5 has two pontential cpu ports, and header mode can be enabled
independently on both.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 48302
This add support for IGMP Snooping on atheros switches (disabled by default),
which avoids flooding the network with multicast data.
Tested on TL-WDR4300: disabling IGMP Snooping results in multicast flooding
on each specific port, enabling it back again prevents each port from
receiving all multicast packets.
Partially based on: http://patchwork.ozlabs.org/patch/418122/
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
SVN-Revision: 48268
On most image types the rootfs ends at an erase-block. However, at least
with brnImages this is not the case: while the partitions are aligned
with the erase-block size there is a 12 byte footer at the end of the
partition which must not be touched by any filesystem. This lead to a
rootfs_data partition which was not aligned properly (and thus ended up
being readonly):
0x000000480000-0x00000085a800 : "rootfs_data" (128 KiB EB)
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
SVN-Revision: 48263
This allows splitting EVA images (usually found in fritz devices). The
firmware will be split into a kernel and a separate rootfs partition.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
SVN-Revision: 48262
This adds brnImage (used with the brnboot bootloader) firmware parsing
support. brnboot verifies the integrity of the firmware stored on the
"Code Image" partitions by looking at the 12 byte footer at the very end
of the partition. This footer contains the checksum of the original
brnImage (kernel + rootfs/squashfs) and must not be touched (by our JFFS2
rootfs_data - otherwise the image will not be bootable anymore).
Big thanks to Mathias Kresin for analyzing the brnImage structure and
finding out the information how to keep images valid even when adding a
nested rootfs_data partition.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
SVN-Revision: 48261
Some switches can force link speed for a port. Let's add API that will
allow drivers to export this feature.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48142
This fixes regression introduced in my recent ledtrig-netdev commit.
Events triggered by different interfaces were stopping timer so it
wasn't working for tx/rx mode.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48072
The ppp0 interface is renamed after the connection is established. Due
to a missing NETDEV_REGISTER event, the ledtrig-netdev isn't aware of
the renamed interface and literally ignores the device
(no tx/rx indication, led isn't switched off with 'ifdown wan').
Signed-off-by: Mathias Kresin <openwrt@kresin.me>
SVN-Revision: 48048
As explained earlier, using SWITCH_TYPE_LINK gives more flexibility,
it doesn't require e.g. string parsing to read some data.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47999
So far we were sending link data as a string. It got some drawbacks:
1) Didn't allow writing clean user space apps reading link state. It was
needed to do some screen scraping.
2) Forced whole PORT_LINK communication to be string based. Adding
support for *setting* port link required passing string and parting
it in the kernel space.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47997
Previously switching to non-existing device (interface) could result in
leaving LED on.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47990
We may just delete timer on every trigger update and then start it again
if needed. This will let us avoid both: races and locking in frequently
called timer callback.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47987
Read/write lock was adding useless complexity, there wasn't any real
gain in case of this driver.
Also switch to _bh variants to avoid deadlocks.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47986
All supported kernels require patching ledtrig-netdev in the same way,
so it's safe to just move these changes to the base version of this
driver. We needed these patches for some old kernels 2.6.36 and 3.11.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47962
In r45970 the MAC swap handling was made opt-in, however some boards
have been forgotten during the conversion. Since the reference design
uses this MAC swapping, and pretty much all known boards using this chip
seem to do so too, enabling the swapping is a more reasonable default
than leaving it disabled.
Change the code to still allow boards to opt-out of this.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 47956
Kernel 3.14 added aditional genphy_soft_reset phy reset to phy_init_hw in drivers/net/phy/phy_device.c
Since adm6996 does in driver soft reset and doesn't use BMCR_RESET for soft reset
add dummy soft_reset callback to adm6996 driver, like it is done in ar8216.
This fixes ticket #20147
Signed-off-by: Andrej Vlasic <andrej.vlasic0@gmail.com>
SVN-Revision: 47272
The previous "link" and "status" functions were non-standard,
and thus less useful for parsing.
Signed-off-by: Claudio Leite <leitec@staticky.com>
SVN-Revision: 46864
This also clears any bootloader-set FDB defaults. This had
caused issues creating port-based VLANs when mappings
overlapped previous VLANs. Packets destined to a port
not in the default port group flooded all ports.
Tested on a 88E6171 (Linksys EA4500) and 88E6172 ('1900AC)
Signed-off-by: Claudio Leite <leitec@staticky.com>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
SVN-Revision: 46699
If a link goes down, don't flush the complete ARL table.
Only flush the entries for the respective port.
Don't touch ARL table if a link goes up.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 46381
Adds functions for flushing ARL table entries per port.
Successfully tested on AR8327. Implementation for AR8216/AR8236/AR8316
is based on the AR8236 datasheet and assumes that the three chips
share a common ATU register layout.
Compile-tested only for AR8216/AR8236/AR8316.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 46380
Adds the chip-specific part of reading ARL table for AR8216/AR8236/AR8316.
It's based on the AR8236 datasheet and compile-tested only as I couldn't
find datasheets for AR8216/AR8316 and don't own devices with these chips.
The existing ar8216_atu_flush implementation was used for all three
chip types, therefore I guess they share a common ATU register layout.
More testing would be appreciated.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 46379
The position of the nvram header file on brcm47xx changed with kernel
version 4.1.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 46170
On two tested devices: Netgear R6250 (BCM53011 rev 2) and Luxul XWC-1000
(BCM53011 rev 3) it was possible to use port 7 and eth1 (instead of port
5 and eth0). It seems BCM53011 just like BCM53012 has 8 ports and
usually 3 of them are connected to the SoC.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 46104
AR8337 supports a configuration bit to swap MAC0 and MAC6.
Currently this is set in general if an AR8337 is detected and causes
issues with devices using an AR8334 (internally an AR8337, just
less chip pins).
And it might even cause issues with AR8337-based devices with
different board designs.
Swapping the MAC's however isn't needed for AR8337 in general.
It's just needed in case of certain board designs (affected devices
seem to be based on Atheros reference board AP135/136-010).
Therefore this configuration bit should be moved to platform data.
The patch includes the needed changes to the device initialization
code of affected devices. Hopefully I didn't miss any ..
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 45970
On device reset the sizes for the vlan and port tables were wrongly
calculated based on the pointer size instead of the struct size. This
causes buffer overruns on 64 bit targets, resulting in panics.
Fix this by dereferencing the pointers.
Reported-by: Fedor Konstantinov <blmink@mink.su>
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 45938
At least on my b53 chip, the mask is 3 bits wide, and because
of this some STP states are not set properly and discarded when read.
Maybe for some other chips it makes sense to have just 2 bits width,
but I don't have other versions around to test/validate.
If that's the case then maybe we could add another STP state mask.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 45937
