openwrt/openwrt.git
7 months agobuild: package-ipkg: avoid calling wildcard twice
Eneas U de Queiroz [Thu, 20 Feb 2020 21:29:02 +0000 (18:29 -0300)]
build: package-ipkg: avoid calling wildcard twice

Instead of calling $(wildcard) to check if the removal list is empty,
then calling it again to actually remove the files, define a function so
that the arguments are expanded only once when it gets called.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 40acc13ca72ca7d2815dc5d94549d5dc48e16e98)

7 months agokernel: bump 4.14 to 4.14.224
Koen Vandeputte [Mon, 8 Mar 2021 08:59:46 +0000 (09:59 +0100)]
kernel: bump 4.14 to 4.14.224

Refreshed all patches.

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Compile-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
7 months agokernel: bump 4.14 to 4.14.223
Koen Vandeputte [Fri, 5 Mar 2021 08:22:20 +0000 (09:22 +0100)]
kernel: bump 4.14 to 4.14.223

Refreshed all patches.

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
7 months agowolfssl: bump to v4.7.0-stable
Eneas U de Queiroz [Sun, 21 Feb 2021 21:33:30 +0000 (18:33 -0300)]
wolfssl: bump to v4.7.0-stable

Biggest fix for this version is CVE-2021-3336, which has already been
applied here.  There are a couple of low severity security bug fixes as
well.

Three patches are no longer needed, and were removed; the one remaining
was refreshed.

This tool shows no ABI changes:
https://abi-laboratory.pro/index.php?view=objects_report&l=wolfssl&v1=4.6.0&v2=4.7.0

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit d1dfb577f1c0d5b1f1fa35000c9ad7abdb7d10ed)

7 months agohostapd: P2P: Fix a corner case in peer addition based on PD Request
Stefan Lippers-Hollmann [Sat, 27 Feb 2021 22:55:08 +0000 (23:55 +0100)]
hostapd: P2P: Fix a corner case in peer addition based on PD Request

p2p_add_device() may remove the oldest entry if there is no room in the
peer table for a new peer. This would result in any pointer to that
removed entry becoming stale. A corner case with an invalid PD Request
frame could result in such a case ending up using (read+write) freed
memory. This could only by triggered when the peer table has reached its
maximum size and the PD Request frame is received from the P2P Device
Address of the oldest remaining entry and the frame has incorrect P2P
Device Address in the payload.

Fix this by fetching the dev pointer again after having called
p2p_add_device() so that the stale pointer cannot be used.

This fixes the following security vulnerabilities/bugs:

- CVE-2021-27803 - A vulnerability was discovered in how p2p/p2p_pd.c
  in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision
  discovery requests. It could result in denial of service or other
  impact (potentially execution of arbitrary code), for an attacker
  within radio range.

Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
(cherry picked from commit 1ca5de13a153061feae260864d73d96f7c463785)

7 months agobuild: fix checks for GCC11
Petr Štetiar [Mon, 1 Mar 2021 12:29:19 +0000 (13:29 +0100)]
build: fix checks for GCC11

Fedora 34 already uses GCC11.

Reported-by: Marcin Juszkiewicz <marcin-openwrt@juszkiewicz.com.pl>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit cae69d558135456976b8fc6cb08530d1358cf6d5)

7 months agoRevert "base-files: source functions.sh in /lib/functions/system.sh"
Adrian Schmutzler [Mon, 1 Mar 2021 21:28:13 +0000 (22:28 +0100)]
Revert "base-files: source functions.sh in /lib/functions/system.sh"

This reverts commit 86aeac4fc98f42ac0ce7e0dcf1cb240e16b28f8f.

The reverted commit introduced a cyclic dependency between
/lib/functions.sh and /lib/functions/system.sh. Further details
are found in 282e8173509a ("base-files: do not source system.sh
in functions.sh"), which was applied to master some time ago and
is included in 21.02.

With the current age of 19.07 branch, it seems safer to revert this
mostly cosmetic feature than investing further time into disentangling
the dependencies.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
7 months agokernel: bump 4.14 to 4.14.222
Koen Vandeputte [Thu, 25 Feb 2021 08:18:53 +0000 (09:18 +0100)]
kernel: bump 4.14 to 4.14.222

Refreshed all patches.

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
8 months agobase-files: source functions.sh in /lib/functions/system.sh
Adrian Schmutzler [Fri, 13 Mar 2020 15:56:53 +0000 (16:56 +0100)]
base-files: source functions.sh in /lib/functions/system.sh

The file /lib/functions/system.sh depends on find_mtd_index() and
find_mtd_part() located in /lib/function.sh, so let's source that
file.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(backported from commit ae636effd24a7637cefca58a143063f395c82d05)

8 months agohostapd: backport ignoring 4addr mode enabling error
Raphaël Mélotte [Wed, 17 Feb 2021 14:58:16 +0000 (15:58 +0100)]
hostapd: backport ignoring 4addr mode enabling error

This is a backport of the upstream commit 58bbbb598144 ("nl80211: Ignore
4addr mode enabling error if it was already enabled").

 nl80211_set_4addr_mode() could fail when trying to enable 4addr mode on
 an interface that is in a bridge and has 4addr mode already enabled.
 This operation would not have been necessary in the first place and this
 failure results in disconnecting, e.g., when roaming from one backhaul
 BSS to another BSS with Multi AP.

 Avoid this issue by ignoring the nl80211 command failure in the case
 where 4addr mode is being enabled while it has already been enabled.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
[bump PKG_RELEASE, more verbose commit description]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit fb860b4e418c28a0f388f215e5acce103dcee1bf)

8 months agoramips: remove factory image for TP-Link Archer C20 v1
Stijn Segers [Thu, 18 Feb 2021 23:53:26 +0000 (00:53 +0100)]
ramips: remove factory image for TP-Link Archer C20 v1

Similarly to the Archer C2 v1, the Archer C20 v1 will brick when one
tries to flash an OpenWrt factory image through the TP-Link web UI.
The wiki page contains an explicit warning about this [1].

Disable the factory image altogether since it serves no purpose.

[1] https://openwrt.org/toh/tp-link/tp-link_archer_c20_v1#installation

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
(backported from commit 0265cba40ad4f2b8ff4473ada123c35b53ffd97a)

8 months agolantiq: fritz7320: enable USB power supply
Mathias Kresin [Wed, 17 Feb 2021 22:37:54 +0000 (23:37 +0100)]
lantiq: fritz7320: enable USB power supply

The USB ports if a FRIZZ!Box 7320 do not supply power to connected
devices.

Add the GPIOs enabling USB power as regulator, to enable USB power
supply as soon as the USB driver is loaded.

Fixes FS#3624

Signed-off-by: Mathias Kresin <dev@kresin.me>
(cherry picked from commit 6e4e97b2256327bb380ee2a83da9a1ddf657e395)

8 months agoopenssl: bump to 1.1.1j
Eneas U de Queiroz [Wed, 17 Feb 2021 02:21:36 +0000 (23:21 -0300)]
openssl: bump to 1.1.1j

This fixes 4 security vulnerabilities/bugs:

- CVE-2021-2839 - SSLv2 vulnerability. Openssl 1.1.1 does not support
  SSLv2, but the affected functions still exist. Considered just a bug.

- CVE-2021-2840 - calls EVP_CipherUpdate, EVP_EncryptUpdate and
  EVP_DecryptUpdate may overflow the output length argument in some
  cases where the input length is close to the maximum permissable
  length for an integer on the platform. In such cases the return value
  from the function call will be 1 (indicating success), but the output
  length value will be negative.

- CVE-2021-2841 - The X509_issuer_and_serial_hash() function attempts to
  create a unique hash value based on the issuer and serial number data
  contained within an X509 certificate. However it was failing to
  correctly handle any errors that may occur while parsing the issuer
  field (which might occur if the issuer field is maliciously
  constructed). This may subsequently result in a NULL pointer deref and
  a crash leading to a potential denial of service attack.

- Fixed SRP_Calc_client_key so that it runs in constant time. This could
  be exploited in a side channel attack to recover the password.

The 3 CVEs above are currently awaiting analysis.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 482c9ff289c65480c8e7340e1740db24c62f91df)

8 months agoOpenWrt v19.07.7: revert to branch defaults
Hauke Mehrtens [Tue, 16 Feb 2021 22:30:33 +0000 (23:30 +0100)]
OpenWrt v19.07.7: revert to branch defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
8 months agoOpenWrt v19.07.7: adjust config defaults v19.07.7
Hauke Mehrtens [Tue, 16 Feb 2021 22:30:28 +0000 (23:30 +0100)]
OpenWrt v19.07.7: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
8 months agokernel: bump 4.14 to 4.14.221
Koen Vandeputte [Mon, 15 Feb 2021 14:01:33 +0000 (15:01 +0100)]
kernel: bump 4.14 to 4.14.221

Refreshed all patches.

Remove upstreamed hunk in:
- 302-dts-support-layerscape.patch

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
8 months agoramips: ethernet: Disable TSO support to improve stability
Baptiste Jonglez [Mon, 15 Feb 2021 09:12:59 +0000 (10:12 +0100)]
ramips: ethernet: Disable TSO support to improve stability

Stability of this Ethernet driver has been a long-standing issue, with
many people reporting frequent "transmit queue timeouts" and even
occasional crashes.

Disabling TSO in the driver helps with stability, although it is likely a
workaround and might not fix the issue completely.

There is a slight slowdown in forwarding performance for TCP packets
(75 kpps vs. 80 kpps with comparable CPU utilization), but this is still
enough to forward close to 1 Gbit/s of full-sized packets across multiple
flows.

Master is using a different ethernet driver, so this is not a backport.
Because of this different driver, the upcoming 21.02 release does not seem
to be affected by these stability issues.

Thanks to mrakotiq for the initial patch.

Fixes: FS#2628
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
8 months agomt76: update to the latest version
David Bauer [Mon, 15 Feb 2021 00:21:18 +0000 (01:21 +0100)]
mt76: update to the latest version

5c768de mt76: mt76x0: disable GTK offloading

Signed-off-by: David Bauer <mail@david-bauer.net>
8 months agoramips: mark toggle input on EX6150 as a switch
Kurt Roeckx [Sun, 14 Feb 2021 13:28:20 +0000 (14:28 +0100)]
ramips: mark toggle input on EX6150 as a switch

The Netgear EX6150 has an Access Point/Extender switch. Set it as
an EV_SW. Otherwise when it's set to Access Point, it will trigger
failsafe mode during boot.

Fixes: FS#3590
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
(cherry picked from commit 539966554d6d0686dc8ce62e39ff9e8f4e2d4e74)

8 months agomac80211: Remove 357-mac80211-optimize-skb-resizing.patch
Hauke Mehrtens [Sun, 14 Feb 2021 18:41:40 +0000 (19:41 +0100)]
mac80211: Remove 357-mac80211-optimize-skb-resizing.patch

This patch was adapted to apply on top of some stable changes, but we
are not sure if this is working correctly. Felix suggested to remove
this patch for now.

Fixes: 0a59e2a76e6d ("mac80211: Update to version 4.19.161-1")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
8 months agoramips: remove factory image for TP-Link Archer C2 v1
Stijn Segers [Sat, 13 Feb 2021 09:39:42 +0000 (10:39 +0100)]
ramips: remove factory image for TP-Link Archer C2 v1

Initial commit 8375623a0640 ("ramips: add support for TP-Link Archer
C2") contains detailed installation instructions, which do not mention
a factory image. From what I can see, no support to install OpenWrt
through the vendor web interface has been added since. The factory
image is also conspicuously absent from the device page in the wiki.
Yet, it is available for download.

I bricked my Archer C2 loading the factory image through the web UI.
Serial showed this error during bootloop:

  Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover

This patch disables the undocumented factory image so users won't get
tricked into thinking easy web UI flashing actually works.

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
(backported from commit ad5e29d38a48ce6ffbcabaf5d83bc76a64dfbe56)

8 months agoath79: fix USB power GPIO for TP-Link TL-WR810N v1
Adrian Schmutzler [Sat, 2 Jan 2021 14:05:13 +0000 (15:05 +0100)]
ath79: fix USB power GPIO for TP-Link TL-WR810N v1

The TP-Link TL-WR810N v1 is known to cause soft-brick on ath79 and
work fine for ar71xx [1]. On closer inspection, the only apparent
difference is the GPIO used for the USB regulator, which deviates
between the two targets.

This applies the value from ar71xx to ath79.

Tested successfully by a forum user.

[1] https://forum.openwrt.org/t/tp-link-tl-wr810n-v1-ath79/48267

Fixes: cdbf2de77768 ("ath79: Add support for TP-Link WR810N")
Fixes: FS#3522

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 6934d30cf8d95bc8652b4dcd8180d14e5e8e2417)

8 months agowolfssl: Backport fix for CVE-2021-3336
Hauke Mehrtens [Mon, 8 Feb 2021 23:53:09 +0000 (00:53 +0100)]
wolfssl: Backport fix for CVE-2021-3336

This should fix CVE-2021-3336:
DoTls13CertificateVerify in tls13.c in wolfSSL through 4.6.0 does not
cease processing for certain anomalous peer behavior (sending an
ED22519, ED448, ECC, or RSA signature without the corresponding
certificate).

The patch is backported from the upstream wolfssl development branch.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 1f559cafe5cc1193a5962d40a2d938c66c783171)

8 months agobcm63xx: sprom: override the PCI device ID
Daniel González Cabanelas [Fri, 5 Feb 2021 18:59:54 +0000 (19:59 +0100)]
bcm63xx: sprom: override the PCI device ID

The PCI device ID detected by the wifi drivers on devices using a fallback
SPROM is wrong. Currently the chipnum is used for this parameter.

Most SSB based Broadcom wifi chips are 2.4 and 5GHz capable. But on
devices without a physical SPROM, the only one way to detect if the device
suports both bands or only the 5GHz band, is by reading the device ID from
the fallback SPROM.

In some devices, this may lead to a non working wifi on a 5GHz-only card,
or in the best case a working 2.4GHz-only in a dual band wifi card.

The offset for the deviceid in SSB SPROMs is 0x0008, whereas in BCMA is
0x0060. This is true for any SPROM version.

Override the PCI device ID with the one defined at the fallback SPROM, to
detect the correct wifi card model and allow using the 5GHz band if
supported.

The patch has been tested with the following wifi radios:

BCM43222: b43: both 2.4/5GHz working
          brcm-wl: both 2.4/5GHz working

BCM43225: b43: 2.4GHz, working
 brcmsmac: working
 brcm-wl: it lacks support

BCM43217: b43: 2.4GHz, working
 brcmsmac: it lacks support
 brcm-wl: it lacks support

Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Backported from a0e0e621ca

8 months agokernel: bump 4.14 to 4.14.219
Koen Vandeputte [Thu, 4 Feb 2021 16:20:28 +0000 (17:20 +0100)]
kernel: bump 4.14 to 4.14.219

Refreshed all patches.

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
8 months agobcm63xx: R5010UNv2: fix flash partitions for 16MB flash
Daniel González Cabanelas [Mon, 22 Jun 2020 19:44:44 +0000 (21:44 +0200)]
bcm63xx: R5010UNv2: fix flash partitions for 16MB flash

The router Nucom R5010UN v2 has the partitions defined for a 8MB flash,
but the flash chip is 16MB size. We are wasting half of the flash.

Fix it and use generic names for partitions.

Fixes: 474cde61234c ("brcm63xx: probe SPI flash through DT")

Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
(cherry picked from commit cef9e5a49f496b64449fca6814fc1b66a45601c3)

8 months agohostapd: fix P2P group information processing vulnerability
Daniel Golle [Thu, 4 Feb 2021 01:01:36 +0000 (01:01 +0000)]
hostapd: fix P2P group information processing vulnerability

A vulnerability was discovered in how wpa_supplicant processing P2P
(Wi-Fi Direct) group information from active group owners.
This issue was discovered by fuzz testing of wpa_supplicant by Google's
OSS-Fuzz.

https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vulnerability.txt

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[added the missing patch]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry-picked from commit 7c8c4f1be648aff9f1072ee27a2cc8f6a4a788ef)

8 months agoopkg: update to latest git HEAD of branch openwrt-19.07
Baptiste Jonglez [Sun, 31 Jan 2021 15:40:40 +0000 (16:40 +0100)]
opkg: update to latest git HEAD of branch openwrt-19.07

c5dccea libopkg: fix md5sum calculation
7cad0c0 opkg_verify_integrity: better logging and error conditions
14d6480 download: purge cached packages that have incorrect checksum
456efac download: factor out the logic for building cache filenames
b145030 libopkg: factor out checksum and size verification
74bac7a download: remove compatibility with old cache naming scheme

Fixes: FS#2690

Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
8 months agokernel: bump 4.14 to 4.14.218
Koen Vandeputte [Mon, 1 Feb 2021 09:35:34 +0000 (10:35 +0100)]
kernel: bump 4.14 to 4.14.218

Refreshed all patches.

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
8 months agowolfssl: enable HAVE_SECRET_CALLBACK
Felix Fietkau [Sat, 2 Jan 2021 13:36:03 +0000 (14:36 +0100)]
wolfssl: enable HAVE_SECRET_CALLBACK

Fixes wpad-wolfssl build

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 55e23f2c02ae95e84613ed7d1cbf8aba557b8682)

8 months agowolfssl: Fix hostapd build with wolfssl 4.6.0
Hauke Mehrtens [Fri, 1 Jan 2021 21:04:18 +0000 (22:04 +0100)]
wolfssl: Fix hostapd build with wolfssl 4.6.0

This fixes the following build problem in hostapd:
mipsel-openwrt-linux-musl/bin/ld: /builder/shared-workdir/build/tmp/ccN4Wwer.ltrans7.ltrans.o: in function `crypto_ec_point_add':
<artificial>:(.text.crypto_ec_point_add+0x170): undefined reference to `ecc_projective_add_point'
mipsel-openwrt-linux-musl/bin/ld: <artificial>:(.text.crypto_ec_point_add+0x18c): undefined reference to `ecc_map'
mipsel-openwrt-linux-musl/bin/ld: /builder/shared-workdir/build/tmp/ccN4Wwer.ltrans7.ltrans.o: in function `crypto_ec_point_to_bin':
<artificial>:(.text.crypto_ec_point_to_bin+0x40): undefined reference to `ecc_map'

Fixes: ba40da9045f7 ("wolfssl: Update to v4.6.0-stable")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit e7d0d2e9dcaa0ff1197fb7beee139b6a5bd35c79)

8 months agowolfssl: Update to v4.6.0-stable
Eneas U de Queiroz [Tue, 29 Dec 2020 17:49:20 +0000 (14:49 -0300)]
wolfssl: Update to v4.6.0-stable

This version fixes a large number of bugs and fixes CVE-2020-36177.

Full changelog at:
https://www.wolfssl.com/docs/wolfssl-changelog/
or, as part of the version's README.md:
https://github.com/wolfSSL/wolfssl/blob/v4.6.0-stable/README.md

Due a number of API additions, size increases from 374.7K to 408.8K for
arm_cortex_a9_vfpv3-d16.  The ABI does not change from previous version.

Backported patches were removed; remaining patch was refreshed.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
[added reference to CVE]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit ba40da9045f77feb04abe63eb8a92f13f9efe471)

8 months agomvebu: omnia: make initramfs image usable out of the box
Petr Štetiar [Sat, 30 Jan 2021 12:32:43 +0000 (13:32 +0100)]
mvebu: omnia: make initramfs image usable out of the box

Currently it's not possible to boot the device with just initramfs image
without additional effort as the initramfs image doesn't contain device
tree.  Fix it by producing FIT based image which could be booted with
following commands:

 setenv bootargs earlyprintk console=ttyS0,115200
 tftpboot ${kernel_addr_r} openwrt-mvebu-cortexa9-cznic_turris-omnia-initramfs-kernel.bin
 bootm ${kernel_addr_r}

Acked-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Reviewed-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry-picked from commit 337ff74894110b35b61118918b7eb30bb6e60756)

8 months agomt76: update to the latest version
David Bauer [Mon, 1 Feb 2021 12:08:51 +0000 (13:08 +0100)]
mt76: update to the latest version

4ba1709 mt76: mt7603: add additional EEPROM chip ID

Signed-off-by: David Bauer <mail@david-bauer.net>
8 months agowireguard: Fix compile with kernel 4.14.217
Hauke Mehrtens [Fri, 29 Jan 2021 20:12:43 +0000 (21:12 +0100)]
wireguard: Fix compile with kernel 4.14.217

Backport a patch from wireguard to fix a compile problem with kernel
4.14.217.

Fixes: 2ecb22dc51a5 ("kernel: bump 4.14 to 4.14.217")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agokernel: bump 4.14 to 4.14.217
Hauke Mehrtens [Mon, 25 Jan 2021 22:17:22 +0000 (23:17 +0100)]
kernel: bump 4.14 to 4.14.217

Refreshed all patches.

Compile-tested on: ipq40xx, lantiq/xrx200, x86/64, ipq806x
Runtime-tested on: ipq40xx, lantiq/xrx200, x86/64

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agodnsmasq: backport fixes
Hauke Mehrtens [Sat, 23 Jan 2021 19:28:00 +0000 (20:28 +0100)]
dnsmasq: backport fixes

This should fix some error messages shown in the log like this one:
dnsmasq[16020]: failed to send packet: Network unreachable
dnsmasq[16020]: failed to send packet: Address family not supported by protocol

Fixes: e87c0d934c54 ("dnsmasq: Update to version 2.83")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agonetifd: fix IPv6 routing loop on point-to-point links
Hans Dedecker [Thu, 21 Jan 2021 20:02:41 +0000 (21:02 +0100)]
netifd: fix IPv6 routing loop on point-to-point links

753c351 interface-ip: add unreachable route if address is offlink

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
9 months agoodhcp6c: fix IPv6 routing loop on point-to-point links
Hans Dedecker [Thu, 21 Jan 2021 19:57:56 +0000 (20:57 +0100)]
odhcp6c: fix IPv6 routing loop on point-to-point links

64e1b4e ra: fix routing loop on point to point links
f16afb7 ra: align ifindex resolving

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
9 months agokernel: bump 4.14 to 4.14.216
Koen Vandeputte [Mon, 18 Jan 2021 14:34:52 +0000 (15:34 +0100)]
kernel: bump 4.14 to 4.14.216

Refreshed all patches.

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
9 months agoimagebuilder: pass IB=1 on checking requirements
Paul Spooren [Wed, 10 Jun 2020 02:24:29 +0000 (22:24 -0400)]
imagebuilder: pass IB=1 on checking requirements

The patch 4a1a58a3  build, imagebuilder: Do not require libncurses-dev
was supposed to remove libncurses as a requirement for the ImageBuilder.
However as the IB=1 is only exported during building, not for checking
requirements, it did never actually work.

This commit export IB=1 to the requirement check.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 4f3806364011aa3aef26fcab2e7b71837a777bcc)

9 months agoOpenWrt v19.07.6: revert to branch defaults
Hauke Mehrtens [Tue, 19 Jan 2021 14:12:28 +0000 (15:12 +0100)]
OpenWrt v19.07.6: revert to branch defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agoOpenWrt v19.07.6: adjust config defaults v19.07.6
Hauke Mehrtens [Tue, 19 Jan 2021 14:12:19 +0000 (15:12 +0100)]
OpenWrt v19.07.6: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agodnsmasq: Backport some security updates
Hauke Mehrtens [Mon, 11 Jan 2021 00:03:03 +0000 (01:03 +0100)]
dnsmasq: Backport some security updates

This fixes the following security problems in dnsmasq:
* CVE-2020-25681:
  Dnsmasq versions before 2.83 is susceptible to a heap-based buffer
  overflow in sort_rrset() when DNSSEC is used. This can allow a remote
  attacker to write arbitrary data into target device's memory that can
  lead to memory corruption and other unexpected behaviors on the target
  device.
* CVE-2020-25682:
  Dnsmasq versions before 2.83 is susceptible to buffer overflow in
  extract_name() function due to missing length check, when DNSSEC is
  enabled. This can allow a remote attacker to cause memory corruption
  on the target device.
* CVE-2020-25683:
  Dnsmasq version before 2.83 is susceptible to a heap-based buffer
  overflow when DNSSEC is enabled. A remote attacker, who can create
  valid DNS replies, could use this flaw to cause an overflow in a heap-
  allocated memory. This flaw is caused by the lack of length checks in
  rtc1035.c:extract_name(), which could be abused to make the code
  execute memcpy() with a negative size in get_rdata() and cause a crash
  in Dnsmasq, resulting in a Denial of Service.
* CVE-2020-25684:
  A lack of proper address/port check implemented in Dnsmasq version <
  2.83 reply_query function makes forging replies easier to an off-path
  attacker.
* CVE-2020-25685:
  A lack of query resource name (RRNAME) checks implemented in Dnsmasq's
  versions before 2.83 reply_query function allows remote attackers to
  spoof DNS traffic that can lead to DNS cache poisoning.
* CVE-2020-25686:
  Multiple DNS query requests for the same resource name (RRNAME) by
  Dnsmasq versions before 2.83 allows for remote attackers to spoof DNS
  traffic, using a birthday attack (RFC 5452), that can lead to DNS
  cache poisoning.
* CVE-2020-25687:
  Dnsmasq versions before 2.83 is vulnerable to a heap-based buffer
  overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A
  remote attacker, who can create valid DNS replies, could use this flaw
  to cause an overflow in a heap-allocated memory. This flaw is caused
  by the lack of length checks in rtc1035.c:extract_name(), which could
  be abused to make the code execute memcpy() with a negative size in
  sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of
  Service.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agouboot-at91: Add PKG_MIRROR_HASH to fix download
Hauke Mehrtens [Mon, 18 Jan 2021 20:52:48 +0000 (21:52 +0100)]
uboot-at91: Add PKG_MIRROR_HASH to fix download

The referenced commit is gone, but we already have this file on our
mirror, use that one by providing the correct mirror hash.

I generated a tar.xz file with the given git commit hash using a random
fork on github and it generated the same tar.xz file as found on our
mirror so this looks correct.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 20a7c9d5c9d87595aa73ad39e95132df545a60ca)

9 months agoat91bootstrap: Add PKG_MIRROR_HASH to fix download
Hauke Mehrtens [Mon, 18 Jan 2021 20:50:26 +0000 (21:50 +0100)]
at91bootstrap: Add PKG_MIRROR_HASH to fix download

The referenced commit is gone, but we already have this file on our
mirror, use that one by providing the correct mirror hash.

I generated a tar.xz file with the given git commit hash using a random
fork on github and it generated the same tar.xz file as found on our
mirror so this looks correct.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit a141e7a00e3ad8442831ed87766451a6114afdf9)

9 months agombedtls: update to 2.16.9
Rosen Penev [Mon, 4 Jan 2021 00:28:43 +0000 (16:28 -0800)]
mbedtls: update to 2.16.9

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit f13b623f5e53a72b65f45cbaf56c73df35e70ed2)

9 months agokernel: bump 4.14 to 4.14.215
Hauke Mehrtens [Sun, 17 Jan 2021 14:42:22 +0000 (15:42 +0100)]
kernel: bump 4.14 to 4.14.215

Refreshed all patches.

Compile-tested on: ipq40xx, lantiq/xrx200, x86/64, ipq806x
Runtime-tested on: ipq40xx, lantiq/xrx200, x86/64

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agokernel: bump 4.14 to 4.14.214
Hauke Mehrtens [Sat, 9 Jan 2021 20:44:53 +0000 (21:44 +0100)]
kernel: bump 4.14 to 4.14.214

Refreshed all patches.

Removed patches because included in upstream:
- 499-mtd-parser-cmdline-Fix-parsing-of-part-names-with-co.patch
- 0071-2-PCI-qcom-Fixed-IPQ806x-PCIE-reset-changes.patch

Compile-tested on: ipq40xx, lantiq/xrx200, x86/64, ipq806x
Runtime-tested on: ipq40xx, lantiq/xrx200, x86/64

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agoglibc: update to latest 2.27 commit
Hauke Mehrtens [Thu, 31 Dec 2020 17:22:49 +0000 (18:22 +0100)]
glibc: update to latest 2.27 commit

daf88b1dd1 Add NEWS entry for CVE-2020-6096 (bug 25620)
b29853702e arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620]
bad8d5ff60 arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620]
d64ad0a517 Fix use-after-free in glob when expanding ~user (bug 25414)
34ce87638c Fix array overflow in backtrace on PowerPC (bug 25423)
0df8ecff9e misc/test-errno-linux: Handle EINVAL from quotactl
26f5442ec1 <string.h>: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232]
4b64a4245c intl/tst-gettext: fix failure with newest msgfmt
dc7f51bda9 aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
8edc96aa33 aarch64: add HWCAP_ATOMICS to HWCAP_IMPORTANT
599ebfacc0 aarch64: Remove HWCAP_CPUID from HWCAP_IMPORTANT

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
9 months agobuild/prereq: merge ifndef IB block together
Paul Spooren [Wed, 30 Dec 2020 04:19:08 +0000 (18:19 -1000)]
build/prereq: merge ifndef IB block together

Multiple prereq checks are only required within the build system but not
for the ImageBuilder. These checks are excluded by using ifndef IB.

This commit merges the three ifndef IB blocks together.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit cc9d5b5a488d3a43068f621a1ef184f06e43bede)

9 months agobuild, imagebuilder: Do not require compilers
Sven Roederer [Sun, 27 Sep 2020 21:07:38 +0000 (23:07 +0200)]
build, imagebuilder: Do not require compilers

The buildroot and SDK both require the compilers (gcc, g++) to be
installed on the host system, however the ImageBuilder uses precompiled
binaries.

This patch changes the prerequirements checks to skip the checking for
the compilers if running as ImageBuilder. A similar change has been
made for libncurses-dev in 4a1a58a3e2d2.

Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
Acked-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit ae12a747cae3df16d84b7dc92f39427948d4e8e2)

9 months agobuild, imagebuilder: Do not require libncurses-dev
Paul Spooren [Tue, 14 Apr 2020 21:14:47 +0000 (11:14 -1000)]
build, imagebuilder: Do not require libncurses-dev

The buildroot and SDK both require `libncurses-dev` to be installed on
the system, however the ImageBuilder uses precompiled binaries.

This patch changes the prerequirements checks to skip the
`libncurses-dev` part if running as ImageBuilder.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 4a1a58a3e2d2360950ff23a05f1f55b779174d6a)

10 months agobuild/json: add filesystem information
Paul Spooren [Mon, 14 Dec 2020 00:36:17 +0000 (14:36 -1000)]
build/json: add filesystem information

Some images are created using different filesystems, most popular
squashfs and ext4. To allow downstream projects to distinguesh between
those, add the `filesystem` information to created json files.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit bc0ffff36a0bd8043e958913f574cb8d2a79e93d)

10 months agoath79: image: fix initramfs for safeloader devices
Petr Štetiar [Wed, 17 Jun 2020 21:48:32 +0000 (23:48 +0200)]
ath79: image: fix initramfs for safeloader devices

Currently it's not possible to tftpboot initramfs image on archer-c7-v5
as the image contains tplink-v1-header which leads to:

 ath> bootm
 ## Booting image at 81000000 ...
 Bad Magic Number

as U-Boot expects uImage wrapped image. This is caused by following
inheritance issue:

  define Device/Init
    KERNEL_INITRAMFS = $$(KERNEL)

  define Device/tplink-v1
    KERNEL := kernel-bin | append-dtb | lzma
    KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | tplink-v1-header

  define Device/tplink-safeloader
    $(Device/tplink-v1)

  define Device/tplink-safeloader-uimage
    $(Device/tplink-safeloader)
    KERNEL := kernel-bin | append-dtb | lzma | uImageArcher lzma

  define Device/tplink_archer-c7-v5
    $(Device/tplink-safeloader-uimage)

where tplink-v1 defines KERNEL_INITRAMFS with tplink-v1-header and it's
then used by all devices inheriting from tplink-safeloader. Fix this by
overriding KERNEL_INITRAMFS to KERNEL variable again.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit ceeece9ffaa5a3a336505332c39794d76c08b2ca)

10 months agokernel: bump 4.14 to 4.14.212
Hauke Mehrtens [Wed, 16 Dec 2020 20:23:55 +0000 (21:23 +0100)]
kernel: bump 4.14 to 4.14.212

Refreshed all patches.

Removed patches because included in upstream:
- 315-v5.10-usbnet-ipeth-fix-connectivity-with-ios-14.patch

Compile-tested on: ipq40xx, ath79, x86/64
Runtime-tested on: ipq40xx, ath79

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
10 months agowireless-regdb: Update to version 2020.11.20
Hauke Mehrtens [Wed, 16 Dec 2020 16:23:59 +0000 (17:23 +0100)]
wireless-regdb: Update to version 2020.11.20

9efa1da wireless-regdb: update regulatory rules for Egypt (EG)
ede87f5 wireless-regdb: restore channel 12 & 13 limitation in the US
5bcafa3 wireless-regdb: Update regulatory rules for Croatia (HR)
4e052f1 wireless-regdb: Update regulatory rules for Pakistan (PK) on 5GHz
f9dfc58 wireless-regdb: update 5.8 GHz regulatory rule for GB
c19aad0 wireless-regdb: Update regulatory rules for Kazakhstan (KZ)
07057d3 wireless-regdb: update regulatory database based on preceding changes

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 94d1b2508c38e21a5d1a45a4d80db2905bf1537c)

10 months agowireless-regdb: bump to latest release 2020-04-29
Petr Štetiar [Wed, 29 Apr 2020 21:11:05 +0000 (23:11 +0200)]
wireless-regdb: bump to latest release 2020-04-29

Update to latest release.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 493eef5b279a0455b76bfacabdec3af8bf642385)

10 months agoopenssl: update to 1.1.1i
Eneas U de Queiroz [Fri, 11 Dec 2020 11:39:35 +0000 (08:39 -0300)]
openssl: update to 1.1.1i

Fixes: CVE-2020-1971, defined as high severity, summarized as:
NULL pointer deref in GENERAL_NAME_cmp function can lead to a DOS
attack.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 882ca13d923796438fd06badeb00dc95b7eb1467)

10 months agomac80211: Update to version 4.19.161-1
Hauke Mehrtens [Sat, 5 Dec 2020 23:17:59 +0000 (00:17 +0100)]
mac80211: Update to version 4.19.161-1

The removed patches were applied upstream.

The changes to 357-mac80211-optimize-skb-resizing.patch are more
complex. I think the patch already took care of the new changes done
upstream.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
10 months agoramips: enable LED VCC for Asus RT-AC51U
Davide Fioravanti [Sun, 29 Sep 2019 18:52:37 +0000 (20:52 +0200)]
ramips: enable LED VCC for Asus RT-AC51U

Previously only the power LED was working.
With this patch all leds except 5GHz are working.

Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
[rephrased commit title, drop status property]
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 67d019ac94015707926235a3ac0aa6bb12cee8c2)

10 months agogeneric: ipeth: fix iOS 14 tethering
David Bauer [Sun, 29 Nov 2020 18:14:05 +0000 (19:14 +0100)]
generic: ipeth: fix iOS 14 tethering

This fixes tethering with devices using iOS 14. Prior to this patch,
connections to remote endpoints were not possible while data transfers
between the OpenWrt device and the iOS endpoints worked fine.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f64496f30f2ef97124dc4e13a48ee0de9d51832e)

10 months agoOpenWrt v19.07.5: revert to branch defaults
Hauke Mehrtens [Sun, 6 Dec 2020 23:51:12 +0000 (00:51 +0100)]
OpenWrt v19.07.5: revert to branch defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
10 months agoOpenWrt v19.07.5: adjust config defaults v19.07.5
Hauke Mehrtens [Sun, 6 Dec 2020 23:51:00 +0000 (00:51 +0100)]
OpenWrt v19.07.5: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
10 months agotools: always create $STAGING_DIR/usr/{include,lib}
Andre Heider [Thu, 20 Aug 2020 06:06:37 +0000 (08:06 +0200)]
tools: always create $STAGING_DIR/usr/{include,lib}

rules.mk always passes these as -I/-L to the toolchain.

Fixes rare errors like:
cc1: error: staging_dir/target-aarch64_cortex-a53_musl/usr/include: No such file or directory [-Werror=missing-include-dirs]

Signed-off-by: Andre Heider <a.heider@gmail.com>
Acked-by: Paul Spooren <mail@aparcar.org>
Acked-by: Rosen Penev <rosenp@gmail.com>
[fixed merge conflict]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit b0cb305236524095bfd899449b0ad8eb821cb3bb)

10 months agotoolchain: kernel-headers: kernel Git tree mirror hash
Petr Štetiar [Sat, 21 Nov 2020 14:59:50 +0000 (15:59 +0100)]
toolchain: kernel-headers: kernel Git tree mirror hash

Allow setting of mirror hash for Git kernel tree.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 796d51834c5be85771d26e433fd509cd3bef72e3)

10 months agotoolchain: kernel-headers: fix check target for kernel Git tree
Petr Štetiar [Sat, 21 Nov 2020 15:05:08 +0000 (16:05 +0100)]
toolchain: kernel-headers: fix check target for kernel Git tree

Currently the check target fails if the kernel Git tree is used:

 $ make toolchain/kernel-headers/{download,check}

  make[2]: Entering directory 'toolchain/kernel-headers'
  Makefile:105: *** ERROR: Unknown pack format for file openwrt/tmp/dl/.  Stop.
  make[2]: Leaving directory 'toolchain/kernel-headers'
  toolchain/Makefile:100: recipe for target 'toolchain/kernel-headers/check' failed

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit bb7ba6b6a81d1fb7ac6075edfd8e8b713dd61db2)

10 months agodownload.pl: properly cleanup intermediate .hash file
Petr Štetiar [Fri, 27 Nov 2020 20:56:30 +0000 (21:56 +0100)]
download.pl: properly cleanup intermediate .hash file

It seems like after a build the /dl dir seems to now contain a .hash
file for each source file due to inproper cleanup so fix it by removing
those intermediate files before leaving the download action.

Fixes: 4e19cbc55335 ("download: handle possibly invalid local tarballs")
Reported-by: Hannu Nyman <hannu.nyman@iki.fi>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 52a5d0d27f2557db99fc5435fbd7783b649cb9b2)

10 months agodownload: handle possibly invalid local tarballs
Petr Štetiar [Thu, 19 Nov 2020 15:32:46 +0000 (16:32 +0100)]
download: handle possibly invalid local tarballs

Currently it's assumed, that already downloaded tarballs are always
fine, so no checksum checking is performed and the tarball is used even
if it might be corrupted.

From now on, we're going to always check the downloaded tarballs before
considering them valid.

Steps to reproduce:

 1. Remove cached tarball

   rm dl/libubox-2020-08-06-9e52171d.tar.xz

 2. Download valid tarball again

   make package/libubox/download

 3. Invalidate the tarball

   sed -i 's/PKG_MIRROR_HASH:=../PKG_MIRROR_HASH:=ff/' package/libs/libubox/Makefile

 4. Now compile with corrupt tarball source

   make package/libubox/{clean,compile}

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 4e19cbc553350b8146985367ba46514cf50e3393)

10 months agocmake.mk,rules.mk: fix host builds using CMake and ccache
Petr Štetiar [Fri, 27 Nov 2020 21:50:32 +0000 (22:50 +0100)]
cmake.mk,rules.mk: fix host builds using CMake and ccache

Commit f98878e4c17d ("cmake.mk: set C/CXX compiler for host builds as
well") has introduced regression as it didn't taken usage of ccache into
the account so fix it by handling ccache use cases as well.

In order to get this working we need to export HOSTCXX_NOCACHE in
rules.mk as well.

Fixes: f98878e4c17d ("cmake.mk: set C/CXX compiler for host builds as well")
Reported-by: Ansuel Smith <ansuelsmth@gmail.com>
Tested-by: Ansuel Smith <ansuelsmth@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 524fb5646eec6147aadfdd508219f39bcf8ba8fc)

10 months agocmake.mk: set C/CXX compiler for host builds as well
Rosen Penev [Thu, 26 Nov 2020 00:08:57 +0000 (16:08 -0800)]
cmake.mk: set C/CXX compiler for host builds as well

Without this, cmake will use whatever CC/CXX is set to, which could be
clang. In that case, at least libjson-c/host will fail to compile.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit f98878e4c17d5f11e78994b4fc456e6b60b2660f)

10 months agomvebu: fixup Turris Omnia U-Boot environment
Klaus Kudielka [Fri, 27 Dec 2019 13:26:37 +0000 (14:26 +0100)]
mvebu: fixup Turris Omnia U-Boot environment

Fixup dfa357a3de "mvebu: base-files: Update Turris Omnia U-Boot
environment" which should have included this file as well.

By rebasing the initial patch this file somehow disappeared.

Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Reviewed-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
Tested-by: W. Michael Petullo <mike@flyn.org> (Turris Omnia "2020")
Tested-by: Klaus Kudielka <klaus.kudielka@gmail.com> (Turris Omnia)
[explain fixup in commit message]
Signed-off-by: Paul Spooren <mail@aparcar.org>
(backported from commit 485ce5bbe5cc33526e56817694a79a7d94160e01)
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
10 months agomvebu: base-files: Update Turris Omnia U-Boot environment
Klaus Kudielka [Fri, 27 Dec 2019 13:26:37 +0000 (14:26 +0100)]
mvebu: base-files: Update Turris Omnia U-Boot environment

Move the update procedure from sysupgrade to first boot, which is much
more convenient in the sysupgrade case (otherwise the environment is
always one generation behind).

Check whether we have an old U-Boot release installed, and update the
environment only if necessary.

Some notes on the U-Boot environment:

The first 9 lines are a copy of the default environment of the old U-Boot
release - only modified, to run "distro_bootcmd", in case "mmcboot" fails
to boot the factory OS.

The remaining 16 lines are a backport of the default environment of the
new U-Boot release (shipped with CZ11NIC23). The main entry point is
"distro_bootcmd", which eventually sources boot.scr. This way, we have
a unified boot protocol for all Turris Omnia revisions so far.

This commit also fixes a shortcoming of previous Turris Omnia support:

Users may install OpenWrt with the Turris Omnia in factory state
(i.e. invalid environment store). In that case, neither fw_setenv, nor
U-Boot itself, would import the default environment from the image -
screwing up the rescue system, at least!

Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Reviewed-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
Tested-by: W. Michael Petullo <mike@flyn.org> (Turris Omnia "2020")
Tested-by: Klaus Kudielka <klaus.kudielka@gmail.com> (Turris Omnia)
(cherry picked from commit dfa357a3def512c13f22371d24138b6e8093be18)

10 months agomvebu: Add turris-omnia.bootscript
Klaus Kudielka [Mon, 23 Dec 2019 07:34:49 +0000 (08:34 +0100)]
mvebu: Add turris-omnia.bootscript

In contrast to the U-Boot version shipped with older versions of Turris
Omnia (CZ11NIC13, CZ11NIC20), the version shipped with Turris Omnia 2019
(CZ11NIC23) relies on the existence of /boot.scr.

Consequently, add a suitable boot script to the sysupgrade image.

Flash instructions for Turris Omnia 2019:
- Download openwrt-...-sysupgrade.img.gz, gunzip it, and copy the resulting
  .img file to the root of a USB flash drive (FAT32 or ext2/3/4).
- Enter a rescue shell: Either via 5-LED reset and ssh root@192.168.1.1
  on LAN port 4, or via 7-LED reset and the serial console.
- Insert the USB drive and mount it:
  mkdir /mnt; mount /dev/sda1 /mnt
- Flash the OpenWrt image to eMMC:
  dd if=/mnt/openwrt-...-sysupgrade.img of=/dev/mmcblk0 bs=4096 conv=fsync
- Reboot.

Flash instructions using a temporary "medkit" installation were written for
the older versions of Turris Omnia, and will *not* work on the Turris Omnia
2019.

Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Reviewed-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
Tested-by: W. Michael Petullo <mike@flyn.org> (Turris Omnia "2020")
(cherry picked from commit afd4375a33840fa949c898fb6bc603e8645edd61)

10 months agouboot-envtools: mvebu: update uci defaults for Turris Omnia
Klaus Kudielka [Fri, 27 Dec 2019 18:15:31 +0000 (19:15 +0100)]
uboot-envtools: mvebu: update uci defaults for Turris Omnia

On the Turris Omnia 2019, u-boot environment is located at 0xF0000, instead
of 0xC0000. The switch happened with u-boot-omnia package version 2019-04-2
(May 10, 2019).

Check the installed u-boot release, and set the default accordingly.

Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
[bump PKG_RELEASE, use lower case for hex offset]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 04d3b517dc3301e0148a2ce811ffc136568b04bd)

10 months agokernel: backport GD25Q256 support from 4.15
Kuan-Yi Li [Fri, 20 Nov 2020 12:11:23 +0000 (20:11 +0800)]
kernel: backport GD25Q256 support from 4.15

Backport below changes for GigaDevice GD25Q256 support from v4.15:

  e27072851bf7 mtd: spi-nor: add a quad_enable callback in struct flash_info
  65153846b18c mtd: spi-nor: add support for GD25Q256

This chip is used on newer Quad-E4G boards.

Before:

[    2.366493] m25p80 spi0.0: unrecognized JEDEC id bytes: c8, 40, 19
[    2.372853] m25p80: probe of spi0.0 failed with error -2

After:

[    2.371722] m25p80 spi0.0: gd25q256 (32768 Kbytes)
[    2.376694] 5 fixed-partitions partitions found on MTD device spi0.0
[    2.383043] Creating 5 MTD partitions on "spi0.0":
[    2.387824] 0x000000000000-0x000000030000 : "u-boot"
[    2.394138] 0x000000030000-0x000000031000 : "u-boot-env"
[    2.400608] 0x000000031000-0x000000040000 : "config"
[    2.406830] 0x000000040000-0x000000050000 : "factory"
[    2.413169] 0x000000050000-0x000002000000 : "firmware"

Signed-off-by: Kuan-Yi Li <kyli@abysm.org>
10 months agokernel: bump 4.14 to 4.14.209
Hauke Mehrtens [Sat, 28 Nov 2020 22:02:21 +0000 (23:02 +0100)]
kernel: bump 4.14 to 4.14.209

Refreshed all patches.

Altered patches:
- 804-i2c-support-layerscape.patch

Compile-tested on: ipq40xx, ath79, layerscape/armv8_64b
Runtime-tested on: ipq40xx, ath79

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
10 months agowireguard-tools: fix category/description in menuconfig
Alberto Bursi [Tue, 17 Nov 2020 07:58:40 +0000 (08:58 +0100)]
wireguard-tools: fix category/description in menuconfig

wireguard-tools is trying to import the menuconfig section
from the wireguard package, but since it's not anymore in
the same makefile this seems to fail and wireguard-tools
ends up in "extra packages" category instead with other
odds and ends.

Same for the description, it's trying to import it from the
wireguard package but it fails so it only shows the line
written in this makefile.

remove the broken imports and add manually the entries
and description they were supposed to load

Fixes: ea980fb9c6de ("wireguard: bump to 20191226")

Signed-off-by: Alberto Bursi <bobafetthotmail@gmail.com>
[fix trailing whitespaces, add Fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit a4d52522c7fbc47a04215b8f04a2e1f7cf7aafea)

10 months agoipq40xx: disable double-tagging for PSGMII devices
David Bauer [Sat, 28 Nov 2020 11:38:22 +0000 (12:38 +0100)]
ipq40xx: disable double-tagging for PSGMII devices

This commit disables the double tagging recently backported to 19.07.

Operating the switch on the S-Tag had the advantage of being able to
have separate VLANs for the same C-VID on LAN and WAN. However, this
broke the ability to configure C-TAG modifications on the switch. Also
performance took a significant toll.

Fixes: commit 8c191712558c ("ipq40xx: fix ethernet vlan double tagging")

Signed-off-by: David Bauer <mail@david-bauer.net>
11 months agotcpdump: patch CVE-2020-8037
Jan Pavlinec [Wed, 25 Nov 2020 01:04:00 +0000 (02:04 +0100)]
tcpdump: patch CVE-2020-8037

This PR backports upstream fix for CVE-2020-8037.  This fix is only
relevant for tcpdump package, tcpdump-mini is not affeted by this issue.

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
[added missing commit description]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 5bb3cc749ee0d08d82acda3c084ff759f3829a91)

11 months agokernel: mtd: parser: cmdline: Fix parsing of part-names with colons
Sven Eckelmann [Sun, 22 Nov 2020 00:17:35 +0000 (01:17 +0100)]
kernel: mtd: parser: cmdline: Fix parsing of part-names with colons

Some devices (especially QCA ones) are already using hardcoded partition
names with colons in it. The OpenMesh A62 for example provides following
mtd relevant information via cmdline:

  root=31:11 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(custom),64k(0:KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) rootfsname=rootfs rootwait

The change to split only on the last colon between mtd-id and partitions
will cause newpart to see following string for the first partition:

  KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive)

Such a partition list cannot be parsed and thus the device fails to boot.

Avoid this behavior by making sure that the start of the first part-name
("(") will also be the last byte the mtd-id split algorithm is using for
its colon search.

Fixes: 9c718b5478ac ("kernel: bump 4.14 to 4.14.200")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
(backported from commit 223eec7e81f8506592fc89cf79a2f14360f5c57b)

11 months agoar71xx,ath79: refresh 910-unaligned_access_hacks.patch
Petr Štetiar [Tue, 24 Nov 2020 08:21:12 +0000 (09:21 +0100)]
ar71xx,ath79: refresh 910-unaligned_access_hacks.patch

Commit c9c7b4b3945c ("kernel: add netfilter-actual-sk patch") has
touched net/ipv6/netfilter/ip6table_mangle.c which in turn has affected
910-unaligned_access_hacks.patch so the patch needs to be refreshed.

Fixes: c9c7b4b3945c ("kernel: add netfilter-actual-sk patch")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
11 months agomusl: handle wcsnrtombs destination buffer overflow (CVE-2020-28928)
Petr Štetiar [Fri, 20 Nov 2020 12:13:27 +0000 (13:13 +0100)]
musl: handle wcsnrtombs destination buffer overflow (CVE-2020-28928)

The wcsnrtombs function in all musl libc versions up through 1.2.1 has
been found to have multiple bugs in handling of destination buffer
size when limiting the input character count, which can lead to
infinite loop with no forward progress (no overflow) or writing past
the end of the destination buffera.

This function is not used internally in musl and is not widely used,
but does appear in some applications. The non-input-limiting form
wcsrtombs is not affected.

All users of musl 1.2.1 and prior versions should apply the attached
patch, which replaces the overly complex and erroneous implementation.
The upcoming 1.2.2 release will adopt this new implementation.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 4d4ef1058c0f10aa2fa4070cd6b9db4d48b94148)

11 months agokernel: add netfilter-actual-sk patch
Aaron Goodman [Sun, 15 Nov 2020 04:51:38 +0000 (23:51 -0500)]
kernel: add netfilter-actual-sk patch

Backport of linux kernel commit 46d6c5a to 4.14 kernel.

netfilter: use actual socket sk rather than skb sk when routing harder

Signed-off-by: Aaron Goodman <aaronjg@stanford.edu>
11 months agouhttpd: update to 19.07 Git HEAD
Jo-Philipp Wich [Fri, 20 Nov 2020 21:50:57 +0000 (22:50 +0100)]
uhttpd: update to 19.07 Git HEAD

3abcc89 client: fix spurious keepalive connection timeouts

Fixes: FS#3443
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
11 months agoscripts: download.pl: retry download using filename
David Bauer [Wed, 18 Nov 2020 15:02:23 +0000 (16:02 +0100)]
scripts: download.pl: retry download using filename

With this commit, the download script will try downloading source files
using the filename instead of the url-filename in case the previous
download attempt using the url-filename failed.

This is required, as the OpenWrt sources mirrors serve files using the
filename files might be renamed to after downloading. If the original
mirror for a file where url-filename and filename do not match goes
down, the download failed prior to this patch.

Further improvement can be done by performing this only for the
OpenWrt sources mirrors.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit d36999389890fb952fc7cc8c0db8e1bbb671af12)

11 months agolayerscape: Fix check after kernel update
Hauke Mehrtens [Thu, 5 Nov 2020 22:42:51 +0000 (23:42 +0100)]
layerscape: Fix check after kernel update

The fsl_destroy_mc_io() function was moved, add the new checks to the
moved copy and not just remove it.

Fixes: ac5297340e64 ("kernel: bump 4.14 to 4.14.206")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
11 months agokernel: bump 4.14 to 4.14.206
Koen Vandeputte [Tue, 10 Nov 2020 14:33:17 +0000 (15:33 +0100)]
kernel: bump 4.14 to 4.14.206

Refreshed all patches.

Altered patches:
- 210-dwc2_defaults.patch
- 708-mc-bus-support-layerscape.patch

Fixes:
- CVE-2020-25656

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
11 months agoath79: remove wmac mtd-mac-address for UniFi AC family
Roger Pueyo Centelles [Thu, 24 Oct 2019 13:29:14 +0000 (15:29 +0200)]
ath79: remove wmac mtd-mac-address for UniFi AC family

The MAC address for the wmac 2.4 GHz radio of the Ubiquiti UniFi AC
family of devices is actually embedded in the mtd-cal-data, so there
is no need for mtd-mac-address (which was incorrectly forcing wmac
to have the same MAC as eth0). This makes it coherent with the stock
firmware and the ar71xx target:

 · XX:XX:XX:X0:XX:XX eth0
 · XX:XX:XX:X1:XX:XX ath0/wlan1 (2.4 GHz)
 · XX:XX:XX:X2:XX:XX ath1/wlan0 (5 GHz)

Checked on a UniFi AC Mesh, a UniFi AC LR and a UniFi Lite.

Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>
(cherry picked from commit 20ace70db65c3f1cb6a842d3092ac2eb7be81b5a)

11 months agofeeds: add freifunk feed
Sven Roederer [Mon, 11 May 2020 19:29:10 +0000 (21:29 +0200)]
feeds: add freifunk feed

Read the freifunk packages, that have been moved from the LuCI feed
into its own feed in January 2019.
Use openwrt-19.07 branch of that repository for openwrt-19.07.

Signed-off-by: Sven Roederer <freifunk@it-solutions.geroedel.de>
(cherry picked from commit 221f97ff4737f012c90feb086bc1c2ed86c6001b)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
11 months agoath79: use correct firmware name for UniFi AP
David Bauer [Sat, 31 Oct 2020 15:41:04 +0000 (16:41 +0100)]
ath79: use correct firmware name for UniFi AP

The Ubiquiti UniFi AP does not have a AHB connected radio but a PCI one.
Also the EEPROM ist only 0x440 bytes of length.

Reported-by: Martin Weinelt <martin@darmstadt.freifunk.net>
Tested-by: Martin Weinelt <martin@darmstadt.freifunk.net>
Signed-off-by: David Bauer <mail@david-bauer.net>
(backported from commit 4c5eb1040f94871626f6a533242c3a9c068d5bb6)
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
11 months agoramips: fix logic level for DIR-645 buttons
David Bauer [Wed, 26 Aug 2020 13:39:54 +0000 (15:39 +0200)]
ramips: fix logic level for DIR-645 buttons

The D-Link DIR-645 currently uses an incorrect logic level for its
buttons.

Correct them in order to prevent unintentional activation of failsafe
mode.

Reported-by: Perry Melange <isprotejesvalkata@gmail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 929e8f0f553637076f2612fb1c2225c5cee1f7ab)

11 months agoath79: fix LED labels for PowerCloud CAP324
Adrian Schmutzler [Sun, 27 Sep 2020 13:51:18 +0000 (15:51 +0200)]
ath79: fix LED labels for PowerCloud CAP324

The order of function and color in the labels in inverted for the
LAN LEDs. Fix it.

Fixes: 915966d86121 ("ath79: Port PowerCloud Systems CAP324 support")

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 96023cd4ba66c33e77d9df562dda44b0a1ba1ac9)

11 months agouci: Backport security fixes
Hauke Mehrtens [Tue, 27 Oct 2020 23:16:38 +0000 (00:16 +0100)]
uci: Backport security fixes

This packports two security fixes from master.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit f9005d4f80dee3dcc257d4613cbc46668faad094)

11 months agouboot-envtools: mvebu: fix config for mainline u-boot
Andre Heider [Sat, 12 Sep 2020 08:28:21 +0000 (10:28 +0200)]
uboot-envtools: mvebu: fix config for mainline u-boot

Mainline u-boot dynamically passes the mtd partitions via devicetree:
$ cat /proc/mtd
dev:    size   erasesize  name
mtd0: 003f0000 00001000 "firmware"
mtd1: 00010000 00001000 "u-boot-env"

Add support for this setup.

Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit 60c9a27cbcc6ba00d75b4b592f507237dbfb460f)

11 months agomvebu: Add bootscript for espressobin to support mainline firmware
Andre Heider [Sat, 12 Sep 2020 07:32:41 +0000 (09:32 +0200)]
mvebu: Add bootscript for espressobin to support mainline firmware

The generic bootscript is tailored around a downstream firmware and
doesn't work on a firmware built from mainline components.

Add a bootscript which:
* sets $console since mainline u-boot doesn't do that
* uses distro boot variables, so OpenWRT can be booted off any supported
  device when using a mainline firmware
* sets missing distro boot variables for the downstream firmware

Booting with a downstream firmware is unchanged.
Booting with a mainline firmware now works.

Signed-off-by: Andre Heider <a.heider@gmail.com>
(cherry picked from commit c43b45863e38fb18a486601c1601f1485d649c0b)

12 months agokernel: bump 4.14 to 4.14.202
Koen Vandeputte [Mon, 19 Oct 2020 11:00:32 +0000 (13:00 +0200)]
kernel: bump 4.14 to 4.14.202

Refreshed all patches.

Compile-tested on: ar71xx, cns3xxx, imx6, x86_64
Runtime-tested on: ar71xx, cns3xxx, imx6, x86_64

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
12 months agofirmware: intel-microcode: update to 20200616
Tan Zien [Tue, 8 Sep 2020 15:52:23 +0000 (23:52 +0800)]
firmware: intel-microcode: update to 20200616

intel-microcode (3.20200616.1)

  * New upstream microcode datafile 20200616
    + Downgraded microcodes (to a previously shipped revision):
      sig 0x000406e3, pf_mask 0xc0, 2019-10-03, rev 0x00d6, size 101376
      sig 0x000506e3, pf_mask 0x36, 2019-10-03, rev 0x00d6, size 101376
  * Works around hangs on boot on Skylake-U/Y and Skylake Xeon E3,
  * This update *removes* the SRBDS mitigations from the above processors
  * Note that Debian had already downgraded 0x406e3 in release 3.20200609.2

intel-microcode (3.20200609.2)

  * REGRESSION FIX: 0x406e3: rollback to rev 0xd6 and document regression
    * Microcode rollbacks (closes: LP#1883002)
      sig 0x000406e3, pf_mask 0xc0, 2019-10-03, rev 0x00d6, size 101376
    * THIS REMOVES THE SECURITY FIXES FOR SKYLAKE-U/Y PROCESSORS
    * Avoid hangs on boot on (some?) Skylake-U/Y processors,
  * ucode-blacklist: blacklist models 0x8e and 0x9e from late-loading,
    just in case.  Note that Debian does not do late loading by itself.
    Refer to LP#1883002 for the report, 0x806ec hangs upon late load.

intel-microcode (3.20200609.1)

  * SECURITY UPDATE
    * For most processors: SRBDS and/or VRDS, L1DCES mitigations depending
      on the processor model
    * For Skylake HEDT and Skylake Xeons with signature 0x50654: VRDS and
      L1DCES mitigations, plus mitigations described in the changelog entry
      for package release 3.20191112.1.
    * Expect some performance impact, the mitigations are enabled by
      default.  A Linux kernel update will be issued that allows one to
      selectively disable the mitigations.
  * New upstream microcode datafile 20200609
    * Implements mitigation for CVE-2020-0543 Special Register Buffer Data
      Sampling (SRBDS), INTEL-SA-00320, CROSSTalk
    * Implements mitigation for CVE-2020-0548 Vector Register Data Sampling
      (VRDS), INTEL-SA-00329
    * Implements mitigation for CVE-2020-0549 L1D Cache Eviction Sampling
      (L1DCES), INTEL-SA-00329
    * Known to fix the regression introduced in release 2019-11-12 (sig
      0x50564, rev. 0x2000065), which would cause several systems with
      Skylake Xeon, Skylake HEDT processors to hang while rebooting
    * Updated Microcodes:
      sig 0x000306c3, pf_mask 0x32, 2019-11-12, rev 0x0028, size 23552
      sig 0x000306d4, pf_mask 0xc0, 2019-11-12, rev 0x002f, size 19456
      sig 0x00040651, pf_mask 0x72, 2019-11-12, rev 0x0026, size 22528
      sig 0x00040661, pf_mask 0x32, 2019-11-12, rev 0x001c, size 25600
      sig 0x00040671, pf_mask 0x22, 2019-11-12, rev 0x0022, size 14336
      sig 0x000406e3, pf_mask 0xc0, 2020-04-27, rev 0x00dc, size 104448
      sig 0x00050653, pf_mask 0x97, 2020-04-24, rev 0x1000157, size 32768
      sig 0x00050654, pf_mask 0xb7, 2020-04-24, rev 0x2006906, size 34816
      sig 0x00050656, pf_mask 0xbf, 2020-04-23, rev 0x4002f01, size 52224
      sig 0x00050657, pf_mask 0xbf, 2020-04-23, rev 0x5002f01, size 52224
      sig 0x000506e3, pf_mask 0x36, 2020-04-27, rev 0x00dc, size 104448
      sig 0x000806e9, pf_mask 0x10, 2020-04-27, rev 0x00d6, size 103424
      sig 0x000806e9, pf_mask 0xc0, 2020-04-27, rev 0x00d6, size 103424
      sig 0x000806ea, pf_mask 0xc0, 2020-04-27, rev 0x00d6, size 103424
      sig 0x000806eb, pf_mask 0xd0, 2020-04-27, rev 0x00d6, size 103424
      sig 0x000806ec, pf_mask 0x94, 2020-04-23, rev 0x00d6, size 103424
      sig 0x000906e9, pf_mask 0x2a, 2020-04-23, rev 0x00d6, size 103424
      sig 0x000906ea, pf_mask 0x22, 2020-04-27, rev 0x00d6, size 102400
      sig 0x000906eb, pf_mask 0x02, 2020-04-23, rev 0x00d6, size 103424
      sig 0x000906ec, pf_mask 0x22, 2020-04-27, rev 0x00d6, size 102400
      sig 0x000906ed, pf_mask 0x22, 2020-04-23, rev 0x00d6, size 103424
  * Restores the microcode-level fixes that were reverted by release
    3.20191115.2 for sig 0x50654 (Skylake Xeon, Skylake HEDT)

intel-microcode (3.20200520.1)

  * New upstream microcode datafile 20200520
    + Updated Microcodes:
      sig 0x000206d6, pf_mask 0x6d, 2020-03-04, rev 0x0621, size 18432
      sig 0x000206d7, pf_mask 0x6d, 2020-03-24, rev 0x071a, size 19456

intel-microcode (3.20200508.1)

  * New upstream microcode datafile 20200508
    + Updated Microcodes:
      sig 0x000706e5, pf_mask 0x80, 2020-03-12, rev 0x0078, size 107520
    * Likely fixes several critical errata on IceLake-U/Y causing system
      hangs

intel-microcode (3.20191115.2)

  * Microcode rollbacks (closes: #946515, LP#1854764):
    sig 0x00050654, pf_mask 0xb7, 2019-07-31, rev 0x2000064, size 33792
  * Avoids hangs on warm reboots (cold boots work fine) on HEDT and
    Xeon processors with signature 0x50654.

intel-microcode (3.20191115.1)

  * New upstream microcode datafile 20191115
    + Updated Microcodes:
      sig 0x000406e3, pf_mask 0xc0, 2019-10-03, rev 0x00d6, size 101376
      sig 0x000506e3, pf_mask 0x36, 2019-10-03, rev 0x00d6, size 101376
      sig 0x000806e9, pf_mask 0x10, 2019-10-15, rev 0x00ca, size 100352
      sig 0x000806e9, pf_mask 0xc0, 2019-09-26, rev 0x00ca, size 100352
      sig 0x000806ea, pf_mask 0xc0, 2019-10-03, rev 0x00ca, size 100352
      sig 0x000806eb, pf_mask 0xd0, 2019-10-03, rev 0x00ca, size 100352
      sig 0x000806ec, pf_mask 0x94, 2019-10-03, rev 0x00ca, size 100352
      sig 0x000906e9, pf_mask 0x2a, 2019-10-03, rev 0x00ca, size 100352
      sig 0x000906ea, pf_mask 0x22, 2019-10-03, rev 0x00ca, size 99328
      sig 0x000906eb, pf_mask 0x02, 2019-10-03, rev 0x00ca, size 100352
      sig 0x000906ec, pf_mask 0x22, 2019-10-03, rev 0x00ca, size 99328
      sig 0x000906ed, pf_mask 0x22, 2019-10-03, rev 0x00ca, size 100352
      sig 0x000a0660, pf_mask 0x80, 2019-10-03, rev 0x00ca, size 91136

intel-microcode (3.20191113.1)

  * New upstream microcode datafile 20191113
    + SECURITY UPDATE, refer to the 3.20191112.1 changelog entry for details
      Adds microcode update for CFL-S (Coffe Lake Desktop)
      INTEL-SA-00270, CVE-2019-11135, CVE-2019-0117
    + Updated Microcodes (previously removed):
      sig 0x000906ec, pf_mask 0x22, 2019-08-14, rev 0x00c6, size 99328

intel-microcode (3.20191112.1)

  * New upstream microcode datafile 20191112
    + SECURITY UPDATE
      - Implements MDS mitigation (TSX TAA), INTEL-SA-00270, CVE-2019-11135
      - Implements TA Indirect Sharing mitigation, and improves the
        MDS mitigation (VERW)
      - Fixes FIVR (Xeon Voltage Modulation) vulnerability, INTEL-SA-00271,
        CVE-2019-11139
      - Fixes SGX vulnerabilities and errata (including CVE-2019-0117)
    + CRITICAL ERRATA FIXES
      - Fixes Jcc conditional jump macro-fusion erratum (Skylake+, except
        Ice Lake), causes a 0-3% typical perforance hit (can be as bad
        as 10%).  But ensures the processor will actually jump where it
        should, so don't even *dream* of not applying this fix.
      - Fixes AVX SHUF* instruction implementation flaw erratum
    + Removed Microcodes:
      sig 0x000906ec, pf_mask 0x22, 2019-02-14, rev 0x00ae, size 98304
    + New Microcodes:
      sig 0x000406d8, pf_mask 0x01, 2019-09-16, rev 0x012d, size 84992
      sig 0x00050656, pf_mask 0xbf, 2019-09-05, rev 0x400002c, size 51200
      sig 0x00060663, pf_mask 0x80, 2018-04-17, rev 0x002a, size 87040
      sig 0x000706a8, pf_mask 0x01, 2019-08-29, rev 0x0016, size 74752
      sig 0x000706e5, pf_mask 0x80, 2019-09-05, rev 0x0046, size 102400
      sig 0x000a0660, pf_mask 0x80, 2019-08-27, rev 0x00c6, size 91136
    + Updated Microcodes:
      sig 0x000406e3, pf_mask 0xc0, 2019-08-14, rev 0x00d4, size 101376
      sig 0x00050654, pf_mask 0xb7, 2019-09-05, rev 0x2000065, size 34816
      sig 0x00050657, pf_mask 0xbf, 2019-09-05, rev 0x500002c, size 51200
      sig 0x000506e3, pf_mask 0x36, 2019-08-14, rev 0x00d4, size 101376
      sig 0x000706a1, pf_mask 0x01, 2019-08-28, rev 0x0032, size 73728
      sig 0x000806e9, pf_mask 0x10, 2019-08-14, rev 0x00c6, size 99328
      sig 0x000806e9, pf_mask 0xc0, 2019-08-14, rev 0x00c6, size 100352
      sig 0x000806ea, pf_mask 0xc0, 2019-08-14, rev 0x00c6, size 99328
      sig 0x000806eb, pf_mask 0xd0, 2019-08-14, rev 0x00c6, size 100352
      sig 0x000806ec, pf_mask 0x94, 2019-08-14, rev 0x00c6, size 100352
      sig 0x000906e9, pf_mask 0x2a, 2019-08-14, rev 0x00c6, size 100352
      sig 0x000906ea, pf_mask 0x22, 2019-08-14, rev 0x00c6, size 99328
      sig 0x000906eb, pf_mask 0x02, 2019-08-14, rev 0x00c6, size 100352
      sig 0x000906ed, pf_mask 0x22, 2019-08-14, rev 0x00c6, size 99328
    + Updated Microcodes (previously removed):
      sig 0x00050653, pf_mask 0x97, 2019-09-09, rev 0x1000151, size 32768

Signed-off-by: Tan Zien <nabsdh9@gmail.com>
(cherry picked from commit e826e007658911df91385935e74621889abbda24)

12 months agofirmware: amd64-microcode: update to 20191218
Tan Zien [Tue, 8 Sep 2020 15:41:44 +0000 (23:41 +0800)]
firmware: amd64-microcode: update to 20191218

amd64-microcode (3.20191218.1)

  * New microcode update packages from AMD upstream:
    + Removed Microcode updates (known to cause issues):
      sig 0x00830f10, patch id 0x08301025, 2019-07-11
  * README: update for new release

amd64-microcode (3.20191021.1)

  * New microcode update packages from AMD upstream:
    + New Microcodes:
      sig 0x00830f10, patch id 0x08301025, 2019-07-11
    + Updated Microcodes:
      sig 0x00800f12, patch id 0x08001250, 2019-04-16
      sig 0x00800f82, patch id 0x0800820d, 2019-04-16

amd64-microcode (3.20181128.1)

  * New microcode update packages from AMD upstream:
    + New Microcodes:
      sig 0x00800f82, patch id 0x0800820b, 2018-06-20

Signed-off-by: Tan Zien <nabsdh9@gmail.com>
(cherry picked from commit 182c7d955f872cb712f6d16d4b5cc0824bf4cc67)

12 months agofirewall: options: fix parsing of boolean attributes
Hauke Mehrtens [Wed, 30 Sep 2020 21:19:02 +0000 (23:19 +0200)]
firewall: options: fix parsing of boolean attributes

Boolean attributes were parsed the same way as string attributes,
so a value of { "bool_attr": "true" } would be parsed correctly, but
{ "bool_attr": true } (without quotes) was parsed as false.

Fixes FS#3284

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7f676b5ed6a2bcd6786a0fcb6a6db3ddfeedf795)