Jo-Philipp Wich [Fri, 14 Oct 2022 15:32:28 +0000 (17:32 +0200)]
firewall4: update to latest Git HEAD
4fbf6d7 ruleset.uc: log forwarded traffic not matched by zone policies c7201a3 main.uc: reintroduce set reload restriction 756f1e2 ruleset: fix emitting set_mark/set_xmark rules with masks 3db4741 ruleset: properly handle zone names starting with a digit 43d8ef5 fw4: fix formatting of default log prefix 592ba45 main.uc: remove uneeded/wrong set reload restrictions b0a6bff tests: fix testcases 145e159 fw4: recognize `option log` and `option counter` in `config nat` sections ce050a8 fw4: fall back to device if l3_device is not available in ifstatus
4ae7072 fs: use `getline()` for line wise read operations 21ace5e lexer: fixes for regex literal parsing 00965fa lib: implement slice() function 76d396d main: implement print mode 7bbba78 compiler: optimize function return opcode generation a45f2a3 lexer: improve regex literal handling d64d5d6 vm: maintain export symbol tables per program f4b4ded uloop: task: gracefully handle absent output callback a58fe47 ubus: hold reference to underlying connection until deferred is concluded e23b58a lib: uc_system(): retry waitpid() on EINTR cc4eb79 ubus: support obtaining numeric error code 01c412c ubus: add toplevel constants for ubus status codes 8e240fa ubus: allow object method call handlers to return a numeric status code 5cdddd3 lib: add limit support to split() and replace() 0ba9c3e fs: add optional third permission argument to fs.open() c1f7b3b lib: remove fixed capture group limit in match() and regex replace()
Kernel loaders like the lzma-loader currently don't track changes to
their sources. This can lead to an old version of a loader to be used
when a build tree is not clean between builds.
As the loaders are tiny and the build times are insignificant, simply
force rebuilding them on every build to avoid this problem.
mpc85xx: add SPI kernel loader for TP-Link TL-WDR4900 v1
Similar to the lzma-loader on our MIPS targets, the spi-loader acts as
a second-stage loader that will then load and start the actual kernel.
As the TL-WDR4900 uses SPI-NOR and the P1010 family does not have support
for memory mapping of this type of flash, this loader needs to contain a
basic driver for the FSL ESPI controller.
UART Console
------------
NWA50AX:
Available below the rubber cover next to the ethernet port.
NWA55AXE:
Available on the board when disassembling the device.
Settings: 115200 8N1
Layout:
<12V> <LAN> GND-RX-TX-VCC
Logic-Level is 3V3. Don't connect VCC to your UART adapter!
Installation Web-UI
-------------------
Upload the Factory image using the devices Web-Interface.
As the device uses a dual-image partition layout, OpenWrt can only
installed on Slot A. This requires the current active image prior
flashing the device to be on Slot B.
If the currently installed image is started from Slot A, the device will
flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case
and the device will return to the ZyXEL firmware upon next boot.
If this happens, first install a ZyXEL firmware upgrade of any version
and install OpenWrt after that.
Installation TFTP
-----------------
This installation routine is especially useful in case
* unknown device password (NWA55AXE lacks reset button)
* bricked device
Attach to the UART console header of the device. Interrupt the boot
procedure by pressing Enter.
The bootloader has a reduced command-set available from CLI, but more
commands can be executed by abusing the atns command.
Boot a OpenWrt initramfs image available on a TFTP server at
192.168.1.66. Rename the image to owrt.bin
Uwe Kleine-König [Fri, 14 Oct 2022 10:23:07 +0000 (12:23 +0200)]
busybox: nslookup: ensure unique transaction IDs for the DNS queries
On machines with a coarse monotonic clock (here: TP-Link RE200 powered
by a MediaTek MT7620A) it can happen that the two DNS requests (for A
and AAAA) share the same transaction ID. If this happens the second
reply is wrongly dropped and nslookup reports "No answer".
Fix this by ensuring that the transaction IDs are unique.
Signed-off-by: Uwe Kleine-König <uwe@kleine-koenig.org>
(cherry picked from commit 63e5ba8e69f03a584b707520db0a0821eda3024f) Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Stijn Tintel [Wed, 19 Jan 2022 13:44:58 +0000 (15:44 +0200)]
ramips: move mt7621_nand driver to files
The patch was rejected by upstream. The mtk_nand driver should be
modified to support the mt7621 flash controller instead. As there is no
newer version to backport, or no upstream version to fix bugs, let's
move the driver to the files dir under the ramips target. This makes it
easier to make changes to the driver while waiting for mt7621 support to
land in mtk_nand.
Nick Hainke [Fri, 19 Aug 2022 16:59:36 +0000 (18:59 +0200)]
ath79: add low_mem to tiny image
Devices with SMALL_FLASH enabled have "SQUASHFS_BLOCK_SIZE=1024" in
their config. This significantly increases the cache memory required by
squashfs [0]. This commit enables low_mem leading to a much better
performance because the SQUASHFS_BLOCK_SIZE is reduced to 256.
Example Nanostation M5 (XM):
The image size increases by 128 KiB. However, the memory statisitcs look
much better:
Nick Hainke [Sat, 25 Dec 2021 08:19:52 +0000 (09:19 +0100)]
ath79: move ubnt-xm to tiny
ath79 has was bumped to 5.10. With this, as with every kernel change,
the kernel has become larger. However, although the kernel gets bigger,
there are still enough flash resources. But the RAM reaches its capacity
limits. The tiny image comes with fewer kernel flags enabled and
fewer daemons.
Improves: 15aa53d7ee65 ("ath79: switch to Kernel 5.10")
Tested-by: Robert Foss <me@robertfoss.se> Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit f4415f7635164ec07ddc22f56df93555804b5767)
Petr Štetiar [Thu, 29 Sep 2022 16:45:40 +0000 (18:45 +0200)]
treewide: fix security issues by bumping all packages using libwolfssl
As wolfSSL is having hard time maintaining ABI compatibility between
releases, we need to manually force rebuild of packages depending on
libwolfssl and thus force their upgrade. Otherwise due to the ABI
handling we would endup with possibly two libwolfssl libraries in the
system, including the patched libwolfssl-5.5.1, but still have
vulnerable services running using the vulnerable libwolfssl-5.4.0.
So in order to propagate update of libwolfssl to latest stable release
done in commit ec8fb542ec3e4 ("wolfssl: fix TLSv1.3 RCE in uhttpd by
using 5.5.1-stable (CVE-2022-39173)") which fixes several remotely
exploitable vulnerabilities, we need to bump PKG_RELEASE of all
packages using wolfSSL library.
Petr Štetiar [Wed, 28 Sep 2022 09:28:06 +0000 (11:28 +0200)]
wolfssl: fix TLSv1.3 RCE in uhttpd by using 5.5.1-stable (CVE-2022-39173)
Fixes denial of service attack and buffer overflow against TLS 1.3
servers using session ticket resumption. When built with
--enable-session-ticket and making use of TLS 1.3 server code in
wolfSSL, there is the possibility of a malicious client to craft a
malformed second ClientHello packet that causes the server to crash.
This issue is limited to when using both --enable-session-ticket and TLS
1.3 on the server side. Users with TLS 1.3 servers, and having
--enable-session-ticket, should update to the latest version of wolfSSL.
Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France"
for research on tlspuffin.
Josef Schlehofer [Wed, 14 Sep 2022 13:23:45 +0000 (15:23 +0200)]
uboot-mvebu: backport LibreSSL patches for older version of LibreSSL
If you would like to compile the newest version of U-boot together with the stable
OpenWrt version, which does not have LibreSSL >= 3.5, which was updated
in the master branch by commit 5451b03b7ceb2315445c683fe174e28bbdd49c2f
("tools/libressl: bump to v3.5.3"), then you need these two patches to
fix it. They are backported from U-boot repository.
This should be backported to stable OpenWrt versions.
Reported-by: Michal Vasilek <michal.vasilek@nic.cz> Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 185541f50ff59c0a5e0663ad612f0f5eb31926cf)
Josef Schlehofer [Wed, 14 Sep 2022 13:19:56 +0000 (15:19 +0200)]
uboot-mvebu: backport patch to fix compilation on non glibc system
This issue was reported by @paper42, who is using Void Linux with musl
to compile OpenWrt and its packages and found out it is not possible to
compile U-boot for Turris Omnia (neither any other).
It fixes following output:
```
HOSTCC tools/kwboot
tools/kwboot.c: In function 'kwboot_tty_change_baudrate':
tools/kwboot.c:662:6: error: 'struct termios' has no member named 'c_ospeed'
662 | tio.c_ospeed = tio.c_ispeed = baudrate;
| ^
tools/kwboot.c:662:21: error: 'struct termios' has no member named 'c_ispeed'
662 | tio.c_ospeed = tio.c_ispeed = baudrate;
| ^
tools/kwboot.c:690:31: error: 'struct termios' has no member named 'c_ospeed'
690 | if (!_is_within_tolerance(tio.c_ospeed, baudrate, 3))
| ^
tools/kwboot.c:693:31: error: 'struct termios' has no member named 'c_ispeed'
693 | if (!_is_within_tolerance(tio.c_ispeed, baudrate, 3))
|
```
Tested-by: Michal Vasilek <michal.vasilek@nic.cz> Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9c7472950b01c5b3a461f4e29b3b62bac9e35b46)
Mark King [Sun, 25 Sep 2022 20:53:52 +0000 (21:53 +0100)]
ramips: enable LZMA loader to fix Linksys RE6500 boot
At some point after 21.02.3 and before 22.03.0, the size limits of the
Linksys RE6500 were reached and prevent booting from the 22.03.0 release
or builds of current SNAPSHOT. This patch allows builds of master to boot
again and has been tested on my device.
toolchain: Include ./include/fortify for external musl toolchain
When building with an external toolcahin with musl also include
./include/fortify by default. This is also done when we build with the
internal toolchain using musl libc.
Without this extra include the fortify source feature is not working
when using an external musl toolchain. All binaries were compiled
without fortify source when an external musl toolchain was used. All
binaries release done by the OpenWrt project use the internal toolcahin
where fortify source is working.
toolchain: Select USE_SSTRIP with external musl toolchain
When we use the internal toolchain USE_SSTRIP will be selected by
default for musl libc and USE_STRIP when glibc is used. Do the same when
an external toolchain is used. USE_GLIBC will also be set for external
toolchain builds based on the EXTERNAL_TOOLCHAIN_LIBC_USE_GLIBC setting.
Openwrt now supports only glibc and musl. Add support for musl and
rework the libc check to handle the new config flags and correctly
compile package basend on that.
scripts: ext-toolchain: actually probe libc type on config generation
Currently we never call probe_cc before config generation, this cause
the script to never actually detect the correct libc type.
Call probe_cc before config generation to correctl set the .config file.
scripts: ext-toolchain: add option to overwrite config
It can be useful to overwrite an already generated config.
Option are simply added at the end of the config and make defconfig
will overwrite the relevant option with the new one.
scripts: ext-toolchain: fix wrong prefix in print_config generation
The parsed prefix in print_config is wrong and this produce broken
generated .config that won't work with any external toolchain.
Currently the prefix from a CC of
'arm-openwrt-linux-muslgnueabi-gcc-12.1.0'
produce a prefix
'arm-openwrt-linux-muslgnueabi-gcc-'
This is wrong as the real prefix should be
'arm-openwrt-linux-muslgnueabi-'
This is probably caused by a change in how the toolchain is now handled
that now append also the gcc version. Probably in ancient days the
version wasn't part of the name and the prefix generation stripped the
'-gcc' instead of the gcc version.
Fix this and correctly strip the gcc version and the gcc suffix to
correctly call toolchain bins.
rules_mk: don't include wrapped bin with external toolchains
Don't add wrapped bin to the TARGET_PATH as it does cause compilation
error.
cmake.mk will use the "command -v" and will use the wrapped bin instead
of the external toolchain bin as they have the same name and command
will select the first result.
Vincent Wiemann [Mon, 28 Dec 2020 15:00:13 +0000 (16:00 +0100)]
rules_mk: use gcc versions for external toolchain
When using the OpenWrt toolchain as an external toolchain the build
failed due to missing LTO support. By choosing the GCC wrappers of
the tools this commit makes sure that the LTO-enabled executables
are being used.
Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>
[ wrap the commit description to 72 char ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 2555ffb4536e2727465e9a0d426ad3c4f1ef003a)
Nick Hainke [Sun, 11 Sep 2022 06:15:52 +0000 (08:15 +0200)]
Makefile: fix stray \ warnings with grep-3.8
We simply grep for "/usr". So no need for "-E" or "\/". Furthermore, in
the new grep versions this creates warnings.
As written in the grep-3.8 announcement:
Regular expressions with stray backslashes now cause warnings, as
their unspecified behavior can lead to unexpected results.
For example, '\a' and 'a' are not always equivalent
<https://bugs.gnu.org/39678>.
Fixes warnings in the form of:
grep: warning: stray \ before /
Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit a29d3bc48c40c6a2a93ae1806bea2ac26455cdbb)
[ fix conflict error ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Felix Fietkau [Sun, 18 Sep 2022 04:27:09 +0000 (06:27 +0200)]
build: fix including modules.mk for targets pulled in from feeds
Fixes: ebc36ebb2349 ("scripts/feeds: install targets to target/linux/feeds and support overriding") Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 00094efec33f07c9dc16cce23be492430c40b3cc)
Backports Linux kernel patch [1] for kernel 5.10 where it applies cleanly.
This was tested on CZ.NIC Turris 1.1 router running OpenWrt 22.03
release.
Before:
- In /var/log/messages:
```
[ 16.392988] lm90 0-004c: cannot request IRQ 48
[ 16.398280] lm90: probe of 0-004c failed with error -22
```
- Sensors does not work:
```
root@turris:~# sensors
No sensors found!
Make sure you loaded all the kernel drivers you need.
Try sensors-detect to find out which these are.
```
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 2f496c34b6dfbedbfbff8d2ade5d629f096e40bd)
(c&p commit ID from openwrt's master) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
When the v1 and v2 variants of the U6LR were introduced, the board
network config was not adapted to the new device names. Due to this, the
wrong network config is applied during initial boot. The resulting
config has lan, wan and a switch, while this device only has a single
ethernet interface without a switch.
Fix this by using a wildcard that matches all the variants.
Fixes: 15a02471bb85 ("mediatek: new target mt7622-ubnt-unifi-6-lr-v1") Fixes: 5c8d3893a78f ("mediatek: new target ubnt_unifi-6-lr-v1-ubootmod") Fixes: 31d86a1a1192 ("mediatek: add Ubiquiti UniFi 6 LR v2 targets") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Acked-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 117f41ee95ec445dce5ab9332bc27a6311747c0d)
Daniel Golle [Thu, 28 Jul 2022 11:40:12 +0000 (13:40 +0200)]
mac80211: rt2x00: experimental improvements for MT7620 wifi
Serge Vasilugin reports:
To improve mt7620 built-in wifi performance some changes:
1. Correct BW20/BW40 switching (see comments with mark (1))
2. Correct TX_SW_CFG1 MAC reg from v3 of vendor driver see
https://gitlab.com/dm38/padavan-ng/-/blob/master/trunk/proprietary/rt_wifi/rtpci/3.0.X.X/mt76x2/chips/rt6352.c#L531
3. Set bbp66 for all chains.
4. US_CYC_CNT init based on Programming guide, default value was 33 (pci),
set chipset bus clock with fallback to cpu clock/3.
5. Don't overwrite default values for mt7620.
6. Correct some typos.
7. Add support for external LNA:
a) RF and BBP regs never be corrected for this mode
b) eLNA is driven the same way as ePA with mt7620's pin PA
but vendor driver explicitly pin PA to gpio mode (for forrect calibration?)
so I'm not sure that request for pa_pin in dts-file will be enough
First 5 changes (really 2) improve performance for boards w/o eLNA/ePA.
Changes 7 add support for eLNA
Configuration w/o eLAN/ePA and with eLNA show results
tx/rx (from router point of view) for each stream:
35-40/30-35 Mbps for HT20
65-70/60-65 Mbps for HT40
Yes. Max results for 2T2R client is 140-145/135-140
with peaks 160/150, It correspond to mediatek driver results.
Boards with ePA untested.
Daniel Golle [Sun, 11 Sep 2022 19:24:05 +0000 (20:24 +0100)]
mediatek: fix ledbar of UniFi 6 LR when running custom U-Boot
The RGB LED of the UniFi 6 LR v1 doesn't work when using the Openwrt-
built U-Boot. This is because the vendor loader resets the ledbar
controller while our U-Boot doesn't care.
Add reset-gpio so the ledbar driver in Linux will always reset the
ledbar controller.
Sven Wegener [Sat, 12 Jun 2021 19:56:22 +0000 (21:56 +0200)]
mediatek: add led count
The LEDs connected to the MCU are so-called smart LEDs and their signal is
daisy-chained. Because of this, the MCU needs to be told how many LEDs are
connected. It also means the LEDs could be individually controlled, if the MCU
has a command for this.
Sven Wegener [Sat, 12 Jun 2021 19:56:22 +0000 (21:56 +0200)]
mediatek: add initialization after reset
During GPIO initialization the pin state flips and triggers a reset of
the ledbar MCU. It needs to be moved through an initialization sequence
before working correctly.
Sven Wegener [Sat, 12 Jun 2021 19:56:21 +0000 (21:56 +0200)]
mediatek: cast literal value to char
Or the comparison against a signed char is always true, because the
literal 0xaa is treated as an unsigned int, to which the signed char is
casted during comparison. 0xaa is above the positive values of a signed
char and negative signed char values result in values larger than 0xaa
when casted to unsigned int.
Daniel Golle [Thu, 8 Sep 2022 01:44:30 +0000 (02:44 +0100)]
mediatek: bpi-r64: make initramfs/recovery optional
Only include recovery image in SD card image generated for the
BananaPi BPi-R64 if building with CONFIG_TARGET_ROOTFS_INITRAMFS
This allows to build images larger than 32 MB (the limit for
initramfs/recovery image) by deselecting initramfs.
Thats all happening due to '' was passed as an argument, which got later
expanded to http://.
In the context of a list constructor '' is not nothing, it is an empty
string element. So fix it by using () as it will yield "nothing" and
thus not introduce an empty string element.
Remove flags from wget and curl instructing them to ignore bad server
certificates. Although other mechanisms can protect against malicious
modifications of downloads, other vectors of attack may be available
to an adversary.
TLS certificate verification can be disabled by turning oof the
"Enable TLS certificate verification during package download" option
enabled by default in the "Global build settings" in "make menuconfig"
Signed-off-by: Josh Roys <roysjosh@gmail.com>
[ add additional info on how to disable this option ] Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 90c6e3aedf167b0ae1baf376e7800a631681e69a)
projects / thirdparty / openwrt.git / log
