Joe Mullally [Mon, 30 Aug 2021 21:35:05 +0000 (22:35 +0100)]
ath79: Move TPLink WPA8630Pv2 to ath79-tiny target
These devices only have 6MiB available for firmware, which is not
enough for recent release images, so move these to the tiny target.
Note for users sysupgrading from the previous ath79-generic snapshot
images:
The tiny target kernel has a 4Kb flash erase block size instead
of the generic target's 64kb. This means the JFFS2 overlay partition
containing settings must be reformatted with the new block size or else
there will be data corruption.
To do this, backup your settings before upgrading, then during the
sysupgrade, de-select "Keep Settings". On the CLI, use "sysupgrade -n".
If you forget to do this and your system becomes unstable after
upgrading, you can do this to format the partition and recover:
* Reboot
* Press RESET when Power LED blinks during boot to enter Failsafe mode
* SSH to 192.168.1.1
* Run "firstboot" and reboot
Signed-off-by: Joe Mullally <jwmullally@gmail.com> Tested-by: Robert Högberg <robert.hogberg@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> [commit message facelift]
(cherry picked from commit 44e1e5d) Signed-off-by: Petr Štetiar <ynezz@true.cz>
bcm27xx: add AMP2 to HifiBerry DAC+ / DAC+ Pro package
According to the vendor [1] these HATs share the same DT overlay:
hifiberry-dacplus. The PCM512x-compatible control unit is attached to
I2C, so the additional snd-soc-pcm512x-i2c kernel module is required.
Also explicitly note the Amp2 support to reduce confusion for those
users.
Flashing:
TFTP boot initramfs image and then perform sysupgrade. Follow common
MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.
Note: following 781d4bfb397cdd12ee0151eb66c577f470e3377d
The network setup avoids using the integrated switch and connects the
single Ethernet port directly. This way, link speed (10/100 Mbps) is
properly reported by eth0.
- QCA9533 (650 MHz), 64 or 128MB RAM, 16MB SPI NOR
- 2x 10/100 Mbps Ethernet, with 802.3at PoE support (WAN)
- 2T2R 802.11b/g/n 2.4GHz
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
Signed-off-by: Clemens Hopfer <openwrt@wireloss.net> Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry-picked from commit a05dcb07241aa83a4416b56201e31b4af8518981)
[switch to mtd-mac-address instead of nvmem-cells]
- QCA9563 (775MHz), 128MB RAM, 16MB SPI NOR
- 2T2R 802.11b/g/n 2.4GHz
- 2T2R 802.11n/ac 5GHz
- 2x 10/100/1000 Mbps Ethernet, with 802.3at PoE support (WAN port)
LED for 5 GHz WLAN is currently not supported as it is connected directly
to the QCA9882 radio chip.
Flash instructions:
If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):
In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:
1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
seconds, recovery mode should start downloading image from server
(unfortunately, there is no visible indication that recovery got
enabled - in case of problems check TFTP server logs)
- CVE-2022-25640: A TLS v1.3 server who requires mutual authentication
can be bypassed. If a malicious client does not send the
certificate_verify message a client can connect without presenting a
certificate even if the server requires one.
- CVE-2022-25638: A TLS v1.3 client attempting to authenticate a TLS
v1.3 server can have its certificate heck bypassed. If the sig_algo in
the certificate_verify message is different than the certificate
message checking may be bypassed.
Tony Ambardar [Mon, 12 Apr 2021 23:46:22 +0000 (16:46 -0700)]
bpftools: fix feature override for masking clang
Rename feature variable clang-bpf-global-var following upstream changes.
This restores the HAVE_CLANG feature override and should avoid rare build
errors where a recent host clang and BTF-enabled host kernel are present.
Fixes: 23be333401f0 ("bpftools: update to 5.10.10") Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
(cherry picked from commit cf20f1bb5f0479c2509dd651d08e235a3b9e8755)
Michael Pratt [Sat, 11 Sep 2021 02:06:10 +0000 (22:06 -0400)]
ramips: fix reboot for remaining 32 MB boards
The following devices have a Winbond W25Q256FV flash chip,
which does not have the RESET pin enabled by default,
and otherwise would require setting a bit in a status register.
Before moving to Linux 5.4, we had the patch:
0053-mtd-spi-nor-add-w25q256-3b-mode-switch.patch
which kept specific flash chips with explicit 3-byte and 4-byte address modes
to stay in 3-byte address mode while idle (after an erase or write)
by using a custom flag SPI_NOR_4B_READ_OP that was part of the patch.
this was obsoleted by the patch:
481-mtd-spi-nor-rework-broken-flash-reset-support.patch
which uses the newer upstream flag SNOR_F_BROKEN_RESET
for devices with a flash chip that cannot be hardware reset with RESET pin
and therefore must be left in 3-byte address mode when idle.
The new patch requires that the DTS of affected devices
have the property "broken-flash-reset", which was not yet added for most of them.
This commit adds the property for remaining affected devices in ramips target,
specifically because of the flash chip model.
However, it is possible that there are other devices
where the flash chip uses an explicit 4-byte address mode
and the RESET pin is not connected to the SOC on the board,
and those DTS would also need this property.
Ref: 22d982ea0033 ("ramips: add support for switching between 3-byte and 4-byte addressing")
Ref: dfa521f12953 ("generic: spi-nor: rework broken-flash-reset") Signed-off-by: Michael Pratt <mcpratt@pm.me>
[pepe2k@gmail.com: backported to 21.02] Fixes: #9655, #9636, #9547 Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
(backported from commit 74516f4357d281f093f0daac01c4c5c239acc443)
Petr Štetiar [Thu, 24 Mar 2022 05:52:37 +0000 (06:52 +0100)]
imagebuilder: fix broken image generation with external targets
When using external targets there is a symlink being created for the
target under target/linux which then becomes dangling under Image
Builder. Fix it by dereferencing the possible symlink.
Tested on IB with external target, ipq40xx and mvebu.
ath79: fix label MAC address for Ubiquiti UniFi AP Outdoor+
The label has the MAC address of eth0, not the WLAN PHY address. We can
merge the definition back into ar7241_ubnt_unifi.dtsi, as both DTS
derived from it use the same interface for their label MAC addresses
after all.
This turned out this is an issue with upstream changing
ATA_TAG_INTERNAL's value from 31 to 32 during 4.18 release.
Update "SATA_DWC_QCMD_MAX" to account for that.
Marek Behún [Sat, 8 Jan 2022 18:56:02 +0000 (19:56 +0100)]
mvebu: SFP backports for GPON modules
This backports the following upstream Linux patches
net: sfp: add mode quirk for GPON module Ubiquiti U-Fiber Instant
net: sfp: relax bitrate-derived mode check
net: sfp: cope with SFPs that set both LOS normal and LOS inverted
for 5.4 for mvebu platform.
Josef Schlehofer [Sun, 20 Mar 2022 22:28:41 +0000 (23:28 +0100)]
cypress-firmware: drop several packages
1. Drop package: cypress-firmware-4359-pcie
This binary is no longer provided and there are not many details what
happened.
2. Drop package: cypress-firmware-4359-sdio
This binary is no longer provided, but in this case, to compare it with
PCIe package mention as first, there was added
support in Linux-firmware [1], but no sign of firmware file.
4. Drop package: cypress-firmware-89459-pcie [2]
According to Infineon: "CYW89459 is an automotive Wi-Fi chip which is not
supported in the broad market community."
Josef Schlehofer [Wed, 16 Mar 2022 12:14:57 +0000 (13:14 +0100)]
cypress-firmware: update it to version 5.4.18-2021_0812
- Binary files were renamed to cyfmac from brcmfmac, but the files needs
to be on the router with the previous naming
[ 6.656165] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
[ 6.665182] brcmfmac mmc1:0001:1: Direct firmware load for brcm/brcmfmac43455-sdio.bin failed with error -2
[ 6.674928] brcmfmac mmc1:0001:1: Falling back to sysfs fallback for: brcm/brcmfmac43455-sdio.bin
- Cypress were acquired by Infineon Technologies
Thus change the project URL and switch to download files from their
GitHub repository. This is much better than the previous solution, which
requires finding new threads on their community forum about new driver
updates, and it will be necessary to change the URL each time.
Unfortunately, it seems that there is not published changelog, but
according to this forum thread [1], be careful by opening the link from
solution since it contains ending bracket ), it brings fixes for various
security vulnerabilities, which were fixed in 7_45_234.
Fixes:
- FragAttacks
- Kr00k
Also add LICENSE file
Run tested on Seeedstudio router powered by Raspberry Pi 4 CM with
package cypress-firmware-43455-sdio.
Petr Štetiar [Thu, 24 Mar 2022 05:45:04 +0000 (06:45 +0100)]
zlib: backport security fix for a reproducible crash in compressor
Tavis has just reported, that he was recently trying to track down a
reproducible crash in a compressor. Believe it or not, it really was a
bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs.
Tavis has reported it upstream, but it turns out the issue has been
public since 2018, but the patch never made it into a release. As far as
he knows, nobody ever assigned it a CVE.
Petr Štetiar [Tue, 8 Mar 2022 09:41:24 +0000 (10:41 +0100)]
sunxi: cortexa7: fix ethernet link detection on a20-olinuxino-lime2
a20-olinuxino-lime2 is currently having hard time with link detection of
certain 1000Mbit partners due to usage of generic PHY driver, probably
due to following missing workaround introduced in upstream in commit 3aed3e2a143c ("net: phy: micrel: add Asym Pause workaround"):
The Micrel KSZ9031 PHY may fail to establish a link when the Asymmetric
Pause capability is set. This issue is described in a Silicon Errata
(DS80000691D or DS80000692D), which advises to always disable the
capability. This patch implements the workaround by defining a KSZ9031
specific get_feature callback to force the Asymmetric Pause capability
bit to be cleared.
This fixes issues where the link would not come up at boot time, or when
the Asym Pause bit was set later on.
As a20-olinuxino-lime2 has Micrel KSZ9031RNXCC-TR Gigabit PHY since
revision H, so we need to use Micrel PHY driver on those devices.
Felix Fietkau [Sun, 17 Oct 2021 14:05:34 +0000 (16:05 +0200)]
ramips: remove kmod-mt7663-firmware-sta from device packages
This firmware should only be used for mobile devices (e.g. laptops), where
AP mode functionality is typically not used. This firmware supports a lot
of power saving offload functionality at the expense of AP mode support.
Backport patches 381a730182f1 ("net: dsa: Move VLAN filtering syncing out of dsa_switch_bridge_leave") 108dc8741c20 ("net: dsa: Avoid cross-chip syncing of VLAN filtering")
from upstream (currently in net-next) to fix null-pointer dereference.
Signed-off-by: Marek Behún <marek.behun@nic.cz> Signed-off-by: Petr Štetiar <ynezz@true.cz> [master commit detail]
Martin Weinelt [Fri, 25 Jun 2021 22:01:07 +0000 (00:01 +0200)]
hostapd: report bssid, ssid and channel over ubus
Imports a function from iw to convert frequencies to channel numbers.
Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
[fix potential out of bounds read] Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 398df6275674b637bc950e4f946f84c2bc5e09ff)
David Bauer [Wed, 21 Oct 2020 18:50:01 +0000 (20:50 +0200)]
hostapd: ubus: add notification for BSS transition response
To allow steering daemons to be aware of the STA-decided transition
target, publish WNM transition responses to ubus. This way, steerings
daemons can learn about STA-chosen targets and send a better selection
of transition candidates.
David Bauer [Sat, 5 Dec 2020 19:17:35 +0000 (20:17 +0100)]
hostapd: ubus: add BSS transtiton request method
The existing wnm_disassoc_imminent ubus method only supports issuing a
bss transition request with the disassoc imminent flag set.
For use-cases, where the client is requested to roam to another BSS
without a pending disassoc, this existing method is not suitable.
Add a new bss_transition_request ubus method, which provides a more
universal way to dispatch a transition request. It takes the following
arguments:
Required:
addr: String - MAC-address of the STA to send the request to (colon-seperated)
Optional:
abridged - Bool - Indicates if the abridged flag is set
disassociation_imminent: Bool - Whether or not the disassoc_imminent
flag is set
disassociation_timer: I32 - number of TBTTs after which the client will
be disassociated
validity_period: I32 - number of TBTTs after which the beacon
candidate list (if included) will be invalid
neighbors: blob-array - Array of strings containing neighbor reports as
hex-string
Martin Schiller [Wed, 16 Mar 2022 14:04:56 +0000 (15:04 +0100)]
openssl: bump to 1.1.1n
This is a bugfix release. Changelog:
*) Fixed a bug in the BN_mod_sqrt() function that can cause it to loop
forever for non-prime moduli. (CVE-2022-0778)
*) Add ciphersuites based on DHE_PSK (RFC 4279) and ECDHE_PSK
(RFC 5489) to the list of ciphersuites providing Perfect Forward
Secrecy as required by SECLEVEL >= 3.
Daniel Golle [Sun, 28 Feb 2021 19:26:07 +0000 (19:26 +0000)]
tools: add xxd (from vim)
U-Boot requires xxd to create the default environment from an external
file as done in uboot-mediatek.
Build xxd (only, not the rest of vim) as part of tools to make sure it
is present on the buildhost.
Reported-by: David Bauer <mail@david-bauer.net> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c4dd2441e7875c9550820f8380b3e41ca619ef27)
Rafał Miłecki [Tue, 1 Mar 2022 17:46:27 +0000 (18:46 +0100)]
base-files: call "sync" after initial setup
OpenWrt uses a lot of (b)ash scripts for initial setup. This isn't the
best solution as they almost never consider syncing files / data. Still
this is what we have and we need to try living with it.
Without proper syncing OpenWrt can easily get into an inconsistent state
on power cut. It's because:
1. Actual (flash) inode and data writes are not synchronized
2. Data writeback can take up to 30 seconds (dirty_expire_centisecs)
3. ubifs adds extra 5 seconds (dirty_writeback_centisecs) "delay"
Some possible cases (examples) for new files:
1. Power cut during 5 seconds after write() can result in all data loss
2. Power cut happening between 5 and 35 seconds after write() can result
in empty file (inode flushed after 5 seconds, data flush queued)
Above affects e.g. uci-defaults. After executing some migration script
it may get deleted (whited out) without generated data getting actually
written. Power cut will result in missing data and deleted file.
There are three ways of dealing with that:
1. Rewriting all user-space init to proper C with syncs
2. Trying bash hacks (like creating tmp files & moving them)
3. Adding sync and hoping for no power cut during critical section
This change introduces the last solution that is the simplest. It
reduces time during which things may go wrong from ~35 seconds to
probably less than a second. Of course it applies only to IO operations
performed before /etc/init.d/boot . It's probably the stage when the
most new files get created.
All later changes are usually done using smarter C apps (e.g. busybox or
uci) that creates tmp files and uses rename() that is expected to be
atomic.
This driver is needed to boot from CompactFlash on the Siemens Futro S400.
The device has an AMD NX1500 CPU, which seems to be unsupported by the
geode subtarget, so it must use legacy.
Rafał Miłecki [Fri, 4 Mar 2022 15:03:26 +0000 (16:03 +0100)]
bcm4908: support "rootfs_data" on U-Boot devices
1. Create "rootfs_data" dynamicaly
U-Boot firmware images can contain only 2 UBI volumes: bootfs (container
with U-Boot + kernel + DTBs) and rootfs (e.g. squashfs). There is no way
to include "rootfs_data" UBI volume or make firmware file tell U-Boot to
create one.
For that reason "rootfs_data" needs to be created dynamically. Use
preinit script to handle that. Fire it right before "mount_root" one.
2. Relate "rootfs_data" to flashed firmware
As already explained flashing new firmware with U-Boot will do nothing
to the "rootfs_data". It could result in new firmware reusing old
"rootfs_data" overlay UBI volume and its file. Users expect a clean
state after flashing firmware (even if flashing the same one).
Solve that by reading flash counter of running firmware and storing it
in "rootfs_data" UBI volume. Every mismatch will result in wiping old
data.
For debugging purposes, we need to know if users are using modified
U-boot versions or not. Currently, the U-boot version is somehow
stripped. This is a little bit problematic when there are
backported/wip/to-upstream patches.
To make it more confusing, there was (before this commit) two U-boot
versioning. U-boot compiled by OpenWrt build bots are missing ``Build:``
This is also the case when the U-boot is compiled locally.
In both cases, it is not clear to U-boot developers if it is an unmodified
build. This is also caused that there is a missing ``.git`` file from
U-boot folder, and so there is no history. It leads to that it can not
contain suffix ``-dirty`` (uncommitted modifications) or even something
else like number of commits, etc. [1]
When U-boot is compiled as it should be, the version should look like
this: ``U-Boot 2022.04-rc1-01173-g278195ea1f (Feb 11 2022 - 14:46:50 +0100)``
The date is not changed daily when there are new OpenWrt builds.
This commit adds OpenWrt specific version, which could be verified by
using strings.
* In some situations the X.509 verifier would discard an error on an
unverified certificate chain, resulting in an authentication bypass.
Thanks to Ilya Shipitsin and Timo Steinlein for reporting.
```
Marek Behún [Thu, 15 Jul 2021 18:48:33 +0000 (20:48 +0200)]
uboot-envtools: mvebu: update uci defaults for Turris Omnia
From version 2021.09 U-Boot will fixup Turris Omnia's DTB before
booting, separating U-Boot's environment into separate MTD partition
"u-boot-env" [1].
Check if "u-boot-env" MTD partition exists and set the uci defaults
accordingly.
Petr Štetiar [Mon, 28 Feb 2022 13:59:16 +0000 (14:59 +0100)]
ipq806x: base-files: asrock: fix bootcount include
Fixes following warning message during image building process:
Finalizing root filesystem...
root-ipq806x/lib/upgrade/asrock.sh: line 1: /lib/functions.sh: No such file or directory
Enabling boot
root-ipq806x/lib/upgrade/asrock.sh: line 1: /lib/functions.sh: No such file or directory
Enabling bootcount
Fixes #9350
Fixes: 98b86296e67d ("ipq806x: add support for ASRock G10") Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit fc317a190c930c9c338bd07c2e323b6b9eaa1f07)
John Crispin [Thu, 3 Jun 2021 13:57:07 +0000 (15:57 +0200)]
hostapd: fix radius problem due to invalid attributes
The offending commit caused the configuration file to contain:
radius_auth_req_attr=
radius_acct_req_attr=
which cause hostapd to add an ATTR of type 0 into the messages.
Petr Štetiar [Tue, 22 Feb 2022 19:00:28 +0000 (20:00 +0100)]
wolfssl: fix API breakage of SSL_get_verify_result
Backport fix for API breakage of SSL_get_verify_result() introduced in
v5.1.1-stable. In v4.8.1-stable SSL_get_verify_result() used to return
X509_V_OK when used on LE powered sites or other sites utilizing
relaxed/alternative cert chain validation feature. After an update to
v5.1.1-stable that API calls started returning X509_V_ERR_INVALID_CA
error and thus rendered all such connection attempts imposible:
$ docker run -it openwrt/rootfs:x86_64-21.02.2 sh -c "wget https://letsencrypt.org"
Downloading 'https://letsencrypt.org'
Connecting to 18.159.128.50:443
Connection error: Invalid SSL certificate
Fixes: #9283
References: https://github.com/wolfSSL/wolfssl/issues/4879 Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit b9251e3b407592f3114e739231088c3d27663c4c)
Chuanhong Guo [Mon, 21 Feb 2022 02:22:02 +0000 (03:22 +0100)]
ramips: mt7621: do memory detection on KSEG1
It's reported that current memory detection code occasionally detects
larger memory under some bootloaders.
Current memory detection code tests whether address space wraps around
on KSEG0, which is unreliable because it's cached.
Rewrite memory size detection to perform the same test on KSEG1 instead.
While at it, this patch also does the following two things:
1. use a fixed pattern instead of a random function pointer as the magic
value.
2. add an additional memory write and a second comparison as part of the
test to prevent possible smaller memory detection result due to
leftover values in memory.
Fixes: 6d91ddf517 ("ramips: mt7621: add support for memory detection") Reported-by: Rui Salvaterra <rsalvaterra@gmail.com> Tested-by: Rui Salvaterra <rsalvaterra@gmail.com> Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
(cherry picked from commit 2f024b79331141e2a62c9bf3601c803b26bde77b)
[backport for OpenWrt 21.02 as it was reproducible with Kernel 5.4, see [1]]
[1]: https://forum.openwrt.org/t/113081 Tested-by: Dimitri Souza <dimitri.souza@gmail.com> [mt7621/archer-c6-v3] Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
Felix Fietkau [Wed, 16 Feb 2022 20:25:13 +0000 (21:25 +0100)]
ramips: fix NAND flash driver ECC bit position mask
The bit position mask was accidentally made too wide, overlapping with the LSB
from the byte position mask. This caused ECC calculation to fail for odd bytes
Signed-off-by: Chad Monroe <chad.monroe@smartrg.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 918d4ab41ea34358c747aab5471bbb0a2a786dd8)
Felix Fietkau [Wed, 13 Oct 2021 14:36:16 +0000 (16:36 +0200)]
tools/fakeroot: explicitly pass CPP variable
For some reason, the generated configure script fails to properly set up
the internal preprocessor command variable, causing the host OS check for
Darwin to fail after the last update.
Explicitly setting CPP fixes this issue
Hauke Mehrtens [Sat, 12 Feb 2022 22:13:47 +0000 (23:13 +0100)]
tcpdump: Fix CVE-2018-16301
This fixes the following security problem:
The command-line argument parser in tcpdump before 4.99.0 has a buffer
overflow in tcpdump.c:read_infile(). To trigger this vulnerability the
attacker needs to create a 4GB file on the local filesystem and to
specify the file name as the value of the -F command-line argument of
tcpdump.
Hauke Mehrtens [Sat, 12 Feb 2022 21:31:50 +0000 (22:31 +0100)]
glibc: update to latest 2.33 HEAD
14f2867b57 Fix failing nss/tst-nss-files-hosts-long with local resolver d27d1e4d13 posix: Fix attribute access mode on getcwd [BZ #27476] 4b95183785 S390: Add PCI_MIO and SIE HWCAPs 6090cf1330 elf: Replace nsid with args.nsid [BZ #27609] 9edf29fd72 s390: Use long branches across object boundaries (jgh instead of jh) 94c91ce231 support: Add xpthread_kill f9592d65f2 nptl: Do not set signal mask on second setjmp return [BZ #28607] 1cc490adca powerpc64[le]: Fix CFI and LR save address for asm syscalls [BZ #28532] c76a0ba878 gconv: Do not emit spurious NUL character in ISO-2022-JP-3 (bug 28524) c493f6a0e4 powerpc64[le]: Allocate extra stack frame on syscall.S 55b99e9ed0 powerpc: Fix unrecognized instruction errors with recent GCC a51b76b71e x86: use default cache size if it cannot be determined [BZ #28784] f10e992e8d socket: Add the __sockaddr_un_set function 4653cd9e36 CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542) dae9a8e7f6 sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542) 4f4452721d <shlib-compat.h>: Support compat_symbol_reference for _ISOMAC 0f70b829f8 CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768) 5cab4e3f3a powerpc: Fix unrecognized instruction errors with recent binutils ac148bdd88 elf: Fix glibc-hwcaps priorities with cache flags mismatches [BZ #27046] e081bafcb1 support: Add helpers to create paths longer than PATH_MAX e41e5b97e3 realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770] f63cb3cf72 tst-realpath-toolong: Fix hurd build 46a70c49ba support: Add xclone bcdde07537 getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999) 41980af2d7 realpath: Avoid overwriting preexisting error (CVE-2021-3998) 48d9161e02 Linux: Detect user namespace support in io/tst-getcwd-smallbuff 06ce5fbd6d support: Fix xclone build failures on ia64 and hppa d251ad533e aarch64: align stack in clone [BZ #27939] 3d52239b30 x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ# 28755] 86c153d092 NEWS: Add a bug fix entry for BZ #28755 6b7b6c7514 test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655] a744a0a3fe test-strnlen.c: Check that strnlen won't go beyond the maximum length f0a2b67147 x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP 9cee072f8f x86-64: Add ifunc-avx2.h functions with 256-bit EVEX 06d1aed51b x86-64: Add strcpy family functions with 256-bit EVEX 1697e739ef x86-64: Add memmove family functions with 256-bit EVEX 47bf9f38bb x86-64: Add memset family functions with 256-bit EVEX 15bae38c8b x86-64: Add memcmp family functions with 256-bit EVEX 0598a25cbe x86-64: Add AVX optimized string/memory functions for RTM 82f1ba9af7 x86: Add string/memory function tests in RTM region 763cea698b x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions d49105cc7a x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions 31dd3e3cb3 x86-64: Fix ifdef indentation in strlen-evex.S 902af2f5ee NEWS: Add a bug fix entry for BZ #27457 e09c377806 x86: Optimize memchr-avx2.S 453ed0a0f2 x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974] b72b89705e x86: Optimize strlen-avx2.S 355afae940 x86: Optimize memchr-evex.S 3dea108f60 x86-64: Fix an unknown vector operation in memchr-evex.S 5697e2dda8 x86-64: Move strlen.S to multiarch/strlen-vec.S 3ac5a7fe8b x86-64: Add wcslen optimize for sse4.1 cef3bffade x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974] 8a3a0177c7 x86: Optimize strlen-evex.S 2b00ee820a String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974] 25941de34e NEWS: Add a bug fix entry for BZ #27974 3e2a15c666 x86-64: Require BMI2 for __strlen_evex and __strnlen_evex 5cb6edb6cd x86: Copy IBT and SHSTK usable only if CET is enabled 0a5f5e2dc1 x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033] 54fdfa2b33 x86: Black list more Intel CPUs for TSX [BZ #27398] 1b8f2456b9 x86: Use CHECK_FEATURE_PRESENT to check HLE [BZ #27398] 260360e89b x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064] 1956ad4930 x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064] 78d25827ae Linux: Simplify __opensock and fix race condition [BZ #28353] 9495d729f6 hurd if_index: Explicitly use AF_INET for if index discovery 55446dd8a2 socket: Do not use AF_NETLINK in __opensock
CFLAG -DWOLFSSL_ALT_CERT_CHAINS replaced to --enable-altcertchains
configure option
The size of the ipk changed on aarch64 like this:
491341 libwolfssl4.8.1.31258522_4.8.1-stable-7_aarch64_cortex-a53.ipk
520322 libwolfssl5.1.1.31258522_5.1.1-stable-1_aarch64_cortex-a53.ipk
Tested-by: Alozxy <alozxy@users.noreply.github.com> Acked-by: Eneas U de Queiroz <cotequeiroz@gmail.com> Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit 93d91197b98463277b601ec2653351666a4ca4bd)
Hauke Mehrtens [Sat, 29 Jan 2022 10:56:27 +0000 (11:56 +0100)]
mbedtls: Update to version 2.16.12
This fixes the following security problems:
* Zeroize several intermediate variables used to calculate the expected
value when verifying a MAC or AEAD tag. This hardens the library in
case the value leaks through a memory disclosure vulnerability. For
example, a memory disclosure vulnerability could have allowed a
man-in-the-middle to inject fake ciphertext into a DTLS connection.
* Fix a double-free that happened after mbedtls_ssl_set_session() or
mbedtls_ssl_get_session() failed with MBEDTLS_ERR_SSL_ALLOC_FAILED
(out of memory). After that, calling mbedtls_ssl_session_free()
and mbedtls_ssl_free() would cause an internal session buffer to
be free()'d twice. CVE-2021-44732
The sizes of the ipk changed on MIPS 24Kc like this:
182454 libmbedtls12_2.16.11-2_mips_24kc.ipk
182742 libmbedtls12_2.16.12-1_mips_24kc.ipk
Hauke Mehrtens [Sat, 12 Feb 2022 16:01:04 +0000 (16:01 +0000)]
kernel: bump 5.4 to 5.4.179
Many changes were done in drivers/pinctrl/bcm/pinctrl-bcm2835.c between
5.4.171 and 5.4.179.
The following 3 patches do not apply any more:
* target/linux/bcm27xx/patches-5.4/950-0316-pinctrl-bcm2835-Add-support-for-BCM2711-pull-up-func.patch
This was already integrated in kernel v5.4-rc1, it was never needed.
* target/linux/bcm27xx/patches-5.4/950-0328-Revert-pinctrl-bcm2835-Pass-irqchip-when-adding-gpio.patch
* target/linux/bcm27xx/patches-5.4/950-0362-pinctrl-bcm2835-Change-init-order-for-gpio-hogs.patch
I think these were done to fix the problem which was really fixed in
commit 75278f1aff5e ("pinctrl: bcm2835: Change init order for gpio
hogs") from v5.4.175
target/linux/generic/backport-5.4/716-v5.5-net-sfp-move-fwnode-parsing-into-sfp-bus-layer.patch
Move fwnode_device_is_available to the same position as in kernel 5.10.
target/linux/layerscape/patches-5.4/302-dts-0083-arm64-ls1028a-qds-correct-bus-of-rtc.patch
Applied in commit 65816c1034769e714edb70f59a33bc5472d9e55f ("arm64: dts:
ls1028a-qds: move rtc node to the correct i2c bus")
Sven Eckelmann [Mon, 23 Nov 2020 12:41:34 +0000 (13:41 +0100)]
ath79: Add support for OpenMesh OM5P-AC v2
Device specifications:
======================
* Qualcomm/Atheros QCA9558 ver 1 rev 0
* 720/600/200 MHz (CPU/DDR/AHB)
* 128 MB of RAM
* 16 MB of SPI NOR flash
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2T2R 2.4 GHz Wi-Fi (11n)
* 2T2R 5 GHz Wi-Fi (11ac)
* 4x GPIO-LEDs (3x wifi, 1x power)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default))
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* TI tmp423 (package kmod-hwmon-tmp421) for temperature monitoring
* 2x ethernet
- eth0
+ AR8035 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 802.3af POE
+ used as LAN interface
- eth1
+ AR8031 ethernet PHY (RGMII)
+ 10/100/1000 Mbps Ethernet
+ 18-24V passive POE (mode B)
+ used as WAN interface
* 12-24V 1A DC
* internal antennas
This device support is based on the partially working stub from commit 53c474abbdfe ("ath79: add new OF only target for QCA MIPS silicon").
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console must be used to access the u-boot shell during bootup.
It can then be used to first boot up the initramfs image from a TFTP server
(here with the IP 192.168.1.21):
Paul Spooren [Wed, 13 Oct 2021 01:36:33 +0000 (15:36 -1000)]
imagebuilder: fix local packages/ folder
This commit fixes commit "2999f810ff: build,IB: include kmods only in
local builds" which cause the local packages/ folder only to be added
for local builds but no longer for ImageBuilder created by the Buildbot.
The commits intention was to use remote kmods repositories rather than
storing them locally. Accidentally the entire handling of the local
`packages/` was removed.
Re-add the folder and include a README describing what it can be used
for.
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 15e55a2190ba087679b24b8844a51a6e4d512cf3) Fixes: #5068 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Karel Kočí [Mon, 21 Jun 2021 09:42:25 +0000 (11:42 +0200)]
ustream-ssl: variants conflict with each other
This adds conflicts between variants of libustream pacakge.
They provide the same file and thus it should not be possible to install
them side by side.
Koen Vandeputte [Wed, 12 Jan 2022 15:11:15 +0000 (16:11 +0100)]
ath79: rb912: fix pll init issues
It was reported that some rb912 boards (ar934x) have issues with some ethernet speeds.
Investigation shows that the board failed to adapt the ethernet pll values as shown here:
[ 5.284359] ag71xx 19000000.eth: failed to read pll-handle property
added custom prints in code and triggering a link switch:
[ 62.821446] Atheros AG71xx: fast reset
[ 62.826442] Atheros AG71xx: update pll 2
[ 62.830494] Atheros AG71xx: no pll regmap!
Comparison with another very similar board (rb922 - QCA955x) showed a missing
reference clock frequency in dts, which seems to cause a pll init issue.
Unfortunately, no errors are printed when this occurs.
Adding the frequency property fixes the pll init as it can be parsed now
by the ethernet driver.
kernel: backport workaround for Realtek RTL8672 and RTL9601C chips
Adds support for GPON SFP modules based on the Realtek RTL8672 and
RTL9601C chips, including but not limited to:
* V-SOL V2801F
* C-Data FD511GX-RM0
* OPTON GP801R
* BAUDCOM BD-1234-SFM
* CPGOS03-0490 v2.0
* Ubiquiti U-Fiber Instant
* EXOT EGS1
Keith T. Garner [Wed, 5 May 2021 14:04:15 +0000 (09:04 -0500)]
kernel: add kmod-leds-uleds
The allows userspace LEDs to be created and controlled. This can be useful
for testing triggers and can also be used to implement virtual LEDs.
Signed-off-by: Keith T. Garner <kgarner@kgarner.com>
[squash fixup commit and improve option wording] Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 6a37286c2add96dba42fdd285162228eb55a99f1)
*) Avoid loading of a dynamic engine twice.
*) Fixed building on Debian with kfreebsd kernels
*) Prioritise DANE TLSA issuer certs over peer certs
*) Fixed random API for MacOS prior to 10.12
Rafał Miłecki [Wed, 8 Dec 2021 11:21:48 +0000 (12:21 +0100)]
bcm4908: sysupgrade: add pkgtb format support
BCM4908 devices with U-Boot use pkgtb firmware format. It's based on
U-Boot's FIT: DTB with configurations, images & embedded data.
This format contains bootfs, rootfs and optionally a first stage U-Boot
loader. Contained images need to be extracted & flashed.
Broadcom used two sets of firmwares: main & backup. It uses UBI volumes
"metadata1" & "metadata2" for storing U-Boot env variables with info
about flashed images.
projects / thirdparty / openwrt.git / log
