From f25dc537238673c641eca6e7ce566476b839c46a Mon Sep 17 00:00:00 2001 From: Sven Roederer Date: Fri, 7 May 2021 21:35:20 +0200 Subject: [PATCH 01/18] imagebuilder: unset BINARY_FOLDER and DOWNLOAD_FOLDER in final archive Using these config-options to customize the folders used at build-time makes these folder settings appear in generated archive. This causes the imagebuilder to be not portable, as it's going to use the build-time folders on the new systems. Errors look like: mkdir: cannot create directory '/mnt/build': Permission denied Makefile:116: recipe for target '_call_image' failed make[2]: *** [_call_image] Error 1 Makefile:241: recipe for target 'image' failed make[1]: *** [image] Error 2 The build-time settings of these folders are passed into the archives via .config file. The expected behavior is that after unpacking the imagebuilder acts like these settings have their defaults, using intree folders. So unset the build-time settings. Signed-off-by: Sven Roederer (cherry picked from commit 6967903b01ea9f7c9f70d0185c3da276801dd78f) --- target/imagebuilder/Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/target/imagebuilder/Makefile b/target/imagebuilder/Makefile index f9c08776a8..0580e41c57 100644 --- a/target/imagebuilder/Makefile +++ b/target/imagebuilder/Makefile @@ -29,6 +29,8 @@ $(BIN_DIR)/$(IB_NAME).tar.xz: clean mkdir -p $(IB_KDIR) $(IB_LDIR) $(PKG_BUILD_DIR)/staging_dir/host/lib \ $(PKG_BUILD_DIR)/target $(PKG_BUILD_DIR)/scripts $(IB_DTSDIR) -cp $(TOPDIR)/.config $(PKG_BUILD_DIR)/.config + $(SED) 's/^CONFIG_BINARY_FOLDER=.*/# CONFIG_BINARY_FOLDER is not set/' $(PKG_BUILD_DIR)/.config + $(SED) 's/^CONFIG_DOWNLOAD_FOLDER=.*/# CONFIG_DOWNLOAD_FOLDER is not set/' $(PKG_BUILD_DIR)/.config $(CP) -L \ $(INCLUDE_DIR) $(SCRIPT_DIR) \ $(TOPDIR)/rules.mk \ From 930e9c06216079823b9b047d7643d6da2a916009 Mon Sep 17 00:00:00 2001 From: Sven Roederer Date: Fri, 7 May 2021 21:35:21 +0200 Subject: [PATCH 02/18] sdk: unset BINARY_FOLDER and DOWNLOAD_FOLDER in final archives Using these config-options to customize the folders used at build-time makes these folder settings appear in generated archive. This causes the SDK to be not portable, as it's going to use the build-time folders on the new systems. The errors vary from passing the build, disk out-of-space to permission denied. The build-time settings of these folders are passed into the archive via Config.build. The expected behavior is that the SDK acts after unpacking like these settings have their defaults, using intree folders. So just filter these folders out when running convert-config.pl to create Config.build. This addresses the same issue that's fixed in the previous commit for the imagebuilder. Signed-off-by: Sven Roederer (cherry picked from commit 1e4b191ac8901328a726ebdc09ebe35da4363521) --- target/sdk/convert-config.pl | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/target/sdk/convert-config.pl b/target/sdk/convert-config.pl index f73744af09..08189df95c 100755 --- a/target/sdk/convert-config.pl +++ b/target/sdk/convert-config.pl @@ -9,7 +9,13 @@ while (<>) { chomp; next if /^CONFIG_SIGNED_PACKAGES/; - if (/^CONFIG_([^=]+)=(.*)$/) { + if (/^CONFIG_((BINARY)|(DOWNLOAD))_FOLDER=(.*)$/) { + # We don't want to preserve the build setting of + # BINARY_FOLDER and DOWNLOAD_FOLDER. + $var = "$1_FOLDER"; + $val = '""'; + $type = "string"; + } elsif (/^CONFIG_([^=]+)=(.*)$/) { $var = $1; $val = $2; From f001bd226c27b2866b842fa8f9aa33511fcea5b6 Mon Sep 17 00:00:00 2001 From: Baptiste Jonglez Date: Mon, 3 May 2021 12:39:47 +0200 Subject: [PATCH 03/18] ipq40xx: fix hard_config partition size on MikroTik hAP-ac2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The routerbootparts driver dynamically discovers the location of MikroTik partitions, but it cannot determine their size (except by extending them up to the start of the next discovered partition). The hard_config partition has a default size of 0x1000 in the driver, while it actually takes 0x2000 on the hAP-ac2. Set the correct size in the hAP-ac2 DTS. On most devices, this isn't a problem as the actual data fits in 0x1000 bytes. However, some devices have larger data that doesn't fit in 0x1000 bytes. In any case, all devices seen so far have enough space for a 0x2000 hard_config partition before the start of the dtb_config partition. With the current 0x1000 size: 0x00000000e000-0x00000000f000 : "hard_config" 0x000000010000-0x000000017bbc : "dtb_config" With this patch extending the size to 0x2000: 0x00000000e000-0x000000010000 : "hard_config" 0x000000010000-0x000000017bbc : "dtb_config" Other ipq40xx boards may need the same fix but it needs testing. References: https://forum.openwrt.org/t/support-for-mikrotik-hap-ac2/23333/324 Acked-by: Thibaut VARÈNE Signed-off-by: Baptiste Jonglez (cherry picked from commit 979f4063668185182db7bd2ad4efe6010047765e) --- .../ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts | 1 + 1 file changed, 1 insertion(+) diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts index e1e6326ae9..d03409b556 100644 --- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts +++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-hap-ac2.dts @@ -191,6 +191,7 @@ hard_config { read-only; + size = <0x2000>; }; dtb_config { From ceeaf0b63d33685beb96bdb7509ef9ed05b93b02 Mon Sep 17 00:00:00 2001 From: Shiji Yang Date: Wed, 5 May 2021 19:48:01 +0800 Subject: [PATCH 04/18] ramips: fix mac addresses of Youku YK1 MAC addresses read from official firmware value location Wlan xx 71 de factory@0x04 Lan xx 71 dd factory@0x28 Wan xx 71 df factory@0x2e Label xx 71 dd factory@0x28 Signed-off-by: Shiji Yang [fix sorting in 02_network, redact commit message] Signed-off-by: Adrian Schmutzler (cherry picked from commit e57e460dc75836d3227e7370b9e64a0eabc9d91d) --- target/linux/ramips/dts/mt7620a_youku_yk1.dts | 3 ++- target/linux/ramips/mt7620/base-files/etc/board.d/02_network | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/target/linux/ramips/dts/mt7620a_youku_yk1.dts b/target/linux/ramips/dts/mt7620a_youku_yk1.dts index 86e2031aa6..61da408f27 100644 --- a/target/linux/ramips/dts/mt7620a_youku_yk1.dts +++ b/target/linux/ramips/dts/mt7620a_youku_yk1.dts @@ -12,6 +12,7 @@ led-failsafe = &led_power; led-running = &led_power; led-upgrade = &led_power; + label-mac-device = ðernet; }; leds { @@ -114,7 +115,7 @@ ðernet { pinctrl-names = "default"; - mtd-mac-address = <&factory 0x4>; + mtd-mac-address = <&factory 0x28>; mediatek,portmap = "llllw"; }; diff --git a/target/linux/ramips/mt7620/base-files/etc/board.d/02_network b/target/linux/ramips/mt7620/base-files/etc/board.d/02_network index 398d275dae..919102b130 100755 --- a/target/linux/ramips/mt7620/base-files/etc/board.d/02_network +++ b/target/linux/ramips/mt7620/base-files/etc/board.d/02_network @@ -255,7 +255,6 @@ ramips_setup_macs() sanlinking,d240|\ vonets,var11n-300|\ wrtnode,wrtnode|\ - youku,yk1|\ zbtlink,zbt-ape522ii|\ zbtlink,zbt-wa05|\ zbtlink,zbt-we2026|\ @@ -339,7 +338,8 @@ ramips_setup_macs() lenovo,newifi-y1|\ lenovo,newifi-y1s|\ ohyeah,oy-0001|\ - wavlink,wl-wn530hg4) + wavlink,wl-wn530hg4|\ + youku,yk1) wan_mac=$(mtd_get_mac_binary factory 0x2e) ;; linksys,e1700) From 25d81e9c76b3c7bf30f5268a2d4cd84f2d787296 Mon Sep 17 00:00:00 2001 From: Hans Dedecker Date: Wed, 28 Apr 2021 20:48:01 +0200 Subject: [PATCH 05/18] glibc: update to latest 2.33 HEAD (bug 27744) 3f5080aedd nptl: Do not build nptl/tst-pthread-gdb-attach as PIE 36783141cf nptl: Check for compatible GDB in nptl/tst-pthread-gdb-attach ea299b62e8 nptl_db: Support different libpthread/ld.so load orders (bug 27744) 162df872f0 x86: tst-cpu-features-supports.c: Update AMX check Signed-off-by: Hans Dedecker (cherry picked from commit 2fc20886ec70d55a4e445689a849cfd1fab07750) --- toolchain/glibc/common.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk index 549778a440..16f03c3c29 100644 --- a/toolchain/glibc/common.mk +++ b/toolchain/glibc/common.mk @@ -12,8 +12,8 @@ PKG_RELEASE:=2 PKG_SOURCE_PROTO:=git PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION) -PKG_SOURCE_VERSION:=12ff80b312c11b0284df7a1c5cb9be6418f85228 -PKG_MIRROR_HASH:=84b7715886320794f9787976b20c868f5d6967e0ab08e6c821a8d42103c0721b +PKG_SOURCE_VERSION:=3f5080aedd164c1f92a53552dd3e0b82ac6d2bd3 +PKG_MIRROR_HASH:=93b1f5dad3deeca05c4a897aa553f0f4423cde68c5640cc333166dc78d112bf4 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz From c99f03749365c9887ca05c502e68979a2b495d1e Mon Sep 17 00:00:00 2001 From: Rui Salvaterra Date: Wed, 21 Apr 2021 12:09:17 +0100 Subject: [PATCH 06/18] mac80211/rtl: backport a rtl8192cu AP mode fix Running USB devices in AP mode is never a good idea. That said, fix the TIM issue in rtl8192cu [1], allowing these devices to "work" in AP mode. [1] https://patchwork.kernel.org/project/linux-wireless/patch/20210419065956.6085-1-pkshih@realtek.com/ Signed-off-by: Rui Salvaterra (cherry picked from commit eeda8652f1655d4f9c11e9c9f51ddcd3377d119a) --- ...ent-set_tim-by-update-beacon-content.patch | 118 ++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch diff --git a/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch b/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch new file mode 100644 index 0000000000..3daf65e967 --- /dev/null +++ b/package/kernel/mac80211/patches/rtl/002-v5.13-rtlwifi-implement-set_tim-by-update-beacon-content.patch @@ -0,0 +1,118 @@ +Date: Mon, 19 Apr 2021 14:59:56 +0800 +From: Ping-Ke Shih +To: +CC: , , + +Subject: [PATCH] rtlwifi: implement set_tim by update beacon content + +Once beacon content is changed, we update the content to wifi card by +send_beacon_frame(). Then, STA with PS can wake up properly to receive its +packets. + +Since we update beacon content to PCI wifi devices every beacon interval, +the only one usb device, 8192CU, needs to update beacon content when +mac80211 calling set_tim. + +Reported-by: Maciej S. Szmigiero +Signed-off-by: Ping-Ke Shih +Tested-by: Maciej S. Szmigiero +--- + drivers/net/wireless/realtek/rtlwifi/core.c | 32 +++++++++++++++++++++ + drivers/net/wireless/realtek/rtlwifi/core.h | 1 + + drivers/net/wireless/realtek/rtlwifi/usb.c | 3 ++ + drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 + + 4 files changed, 37 insertions(+) + +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -1018,6 +1018,25 @@ static void send_beacon_frame(struct iee + } + } + ++void rtl_update_beacon_work_callback(struct work_struct *work) ++{ ++ struct rtl_works *rtlworks = ++ container_of(work, struct rtl_works, update_beacon_work); ++ struct ieee80211_hw *hw = rtlworks->hw; ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct ieee80211_vif *vif = rtlpriv->mac80211.vif; ++ ++ if (!vif) { ++ WARN_ONCE(true, "no vif to update beacon\n"); ++ return; ++ } ++ ++ mutex_lock(&rtlpriv->locks.conf_mutex); ++ send_beacon_frame(hw, vif); ++ mutex_unlock(&rtlpriv->locks.conf_mutex); ++} ++EXPORT_SYMBOL_GPL(rtl_update_beacon_work_callback); ++ + static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, + struct ieee80211_bss_conf *bss_conf, +@@ -1747,6 +1766,18 @@ static void rtl_op_flush(struct ieee8021 + rtlpriv->intf_ops->flush(hw, queues, drop); + } + ++static int rtl_op_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta, ++ bool set) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); ++ ++ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192CU) ++ schedule_work(&rtlpriv->works.update_beacon_work); ++ ++ return 0; ++} ++ + /* Description: + * This routine deals with the Power Configuration CMD + * parsing for RTL8723/RTL8188E Series IC. +@@ -1903,6 +1934,7 @@ const struct ieee80211_ops rtl_ops = { + .sta_add = rtl_op_sta_add, + .sta_remove = rtl_op_sta_remove, + .flush = rtl_op_flush, ++ .set_tim = rtl_op_set_tim, + }; + EXPORT_SYMBOL_GPL(rtl_ops); + +--- a/drivers/net/wireless/realtek/rtlwifi/core.h ++++ b/drivers/net/wireless/realtek/rtlwifi/core.h +@@ -60,5 +60,6 @@ void rtl_bb_delay(struct ieee80211_hw *h + bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb); + bool rtl_btc_status_false(void); + void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igval); ++void rtl_update_beacon_work_callback(struct work_struct *work); + + #endif +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -807,6 +807,7 @@ static void rtl_usb_stop(struct ieee8021 + + tasklet_kill(&rtlusb->rx_work_tasklet); + cancel_work_sync(&rtlpriv->works.lps_change_work); ++ cancel_work_sync(&rtlpriv->works.update_beacon_work); + + flush_workqueue(rtlpriv->works.rtl_wq); + +@@ -1033,6 +1034,8 @@ int rtl_usb_probe(struct usb_interface * + rtl_fill_h2c_cmd_work_callback); + INIT_WORK(&rtlpriv->works.lps_change_work, + rtl_lps_change_work_callback); ++ INIT_WORK(&rtlpriv->works.update_beacon_work, ++ rtl_update_beacon_work_callback); + + rtlpriv->usb_data_index = 0; + init_completion(&rtlpriv->firmware_loading_complete); +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2487,6 +2487,7 @@ struct rtl_works { + + struct work_struct lps_change_work; + struct work_struct fill_h2c_cmd; ++ struct work_struct update_beacon_work; + }; + + struct rtl_debug { From f49d4aebe207ff951de54debecccfd85f78cf83a Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sat, 3 Apr 2021 20:02:54 +0200 Subject: [PATCH 07/18] kernel: Activate FORTIFY_SOURCE for MIPS kernel 5.4 CONFIG_FORTIFY_SOURCE=y is already set in the generic kernel configuration, but it is not working for MIPS on kernel 5.4, support for MIPS was only added with kernel 5.5, other architectures like aarch64 support FORTIFY_SOURCE already since some time. This patch adds support for FORTIFY_SOURCE to MIPS with kernel 5.4, kernel 5.10 already supports this and needs no changes. This backports one patch from kernel 5.5 and one fix from 5.8 to make fortify source also work on our kernel 5.4. The changes are not compatible with the 306-mips_mem_functions_performance.patch patch which was also removed with kernel 5.10, probably because of the same problems. I think it is not needed anyway as the compiler should automatically optimize the calls to memset(), memcpy() and memmove() even when not explicitly telling the compiler to use the build in variant. This increases the size of an uncompressed kernel by less than 1 KB. Acked-by: Rosen Penev Signed-off-by: Hauke Mehrtens (cherry picked from commit 9ffa2f8193a43b9044fcfd0e16b204e989b0d941) --- .../ath25/patches-5.4/107-ar5312_gpio.patch | 2 +- .../0032-MIPS-ath79-sanitize-symbols.patch | 2 +- ...22-MIPS-BCM63XX-switch-to-IRQ_DOMAIN.patch | 2 +- ...-Kconfig-Add-ARCH_HAS_FORTIFY_SOURCE.patch | 32 ++++++ ...11-MIPS-Fix-exception-handler-memcpy.patch | 107 ++++++++++++++++++ .../301-mips_image_cmdline_hack.patch | 2 +- ...CPU_MIPS64-for-remaining-MIPS64-CPUs.patch | 2 +- .../300-mips_expose_boot_raw.patch | 4 +- .../306-mips_mem_functions_performance.patch | 106 ----------------- .../lantiq/patches-5.4/0152-lantiq-VPE.patch | 2 +- ...122-mips-ralink-enable-zboot-support.patch | 2 +- .../105-mt7621-memory-detect.patch | 4 +- 12 files changed, 150 insertions(+), 117 deletions(-) create mode 100644 target/linux/generic/backport-5.4/310-mips-Kconfig-Add-ARCH_HAS_FORTIFY_SOURCE.patch create mode 100644 target/linux/generic/backport-5.4/311-MIPS-Fix-exception-handler-memcpy.patch delete mode 100644 target/linux/generic/pending-5.4/306-mips_mem_functions_performance.patch diff --git a/target/linux/ath25/patches-5.4/107-ar5312_gpio.patch b/target/linux/ath25/patches-5.4/107-ar5312_gpio.patch index cd7b27d636..7b8c9650cc 100644 --- a/target/linux/ath25/patches-5.4/107-ar5312_gpio.patch +++ b/target/linux/ath25/patches-5.4/107-ar5312_gpio.patch @@ -202,7 +202,7 @@ +subsys_initcall(ar5312_gpio_init); --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -189,6 +189,7 @@ config ATH25 +@@ -190,6 +190,7 @@ config ATH25 select CEVT_R4K select CSRC_R4K select DMA_NONCOHERENT diff --git a/target/linux/ath79/patches-5.4/0032-MIPS-ath79-sanitize-symbols.patch b/target/linux/ath79/patches-5.4/0032-MIPS-ath79-sanitize-symbols.patch index 14dddd5147..9fa199a204 100644 --- a/target/linux/ath79/patches-5.4/0032-MIPS-ath79-sanitize-symbols.patch +++ b/target/linux/ath79/patches-5.4/0032-MIPS-ath79-sanitize-symbols.patch @@ -15,7 +15,7 @@ Signed-off-by: John Crispin --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -217,6 +217,8 @@ config ATH79 +@@ -218,6 +218,8 @@ config ATH79 select SYS_SUPPORTS_BIG_ENDIAN select SYS_SUPPORTS_MIPS16 select SYS_SUPPORTS_ZBOOT_UART_PROM diff --git a/target/linux/bcm63xx/patches-5.4/322-MIPS-BCM63XX-switch-to-IRQ_DOMAIN.patch b/target/linux/bcm63xx/patches-5.4/322-MIPS-BCM63XX-switch-to-IRQ_DOMAIN.patch index 8f50dd689b..eff4af025e 100644 --- a/target/linux/bcm63xx/patches-5.4/322-MIPS-BCM63XX-switch-to-IRQ_DOMAIN.patch +++ b/target/linux/bcm63xx/patches-5.4/322-MIPS-BCM63XX-switch-to-IRQ_DOMAIN.patch @@ -14,7 +14,7 @@ Signed-off-by: Jonas Gorski --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -291,6 +291,9 @@ config BCM63XX +@@ -292,6 +292,9 @@ config BCM63XX select SYNC_R4K select DMA_NONCOHERENT select IRQ_MIPS_CPU diff --git a/target/linux/generic/backport-5.4/310-mips-Kconfig-Add-ARCH_HAS_FORTIFY_SOURCE.patch b/target/linux/generic/backport-5.4/310-mips-Kconfig-Add-ARCH_HAS_FORTIFY_SOURCE.patch new file mode 100644 index 0000000000..e02f103543 --- /dev/null +++ b/target/linux/generic/backport-5.4/310-mips-Kconfig-Add-ARCH_HAS_FORTIFY_SOURCE.patch @@ -0,0 +1,32 @@ +From a8d2bb0559b5fefa5173ff4e7496cc6250db2c8a Mon Sep 17 00:00:00 2001 +From: Dmitry Korotin +Date: Thu, 12 Sep 2019 22:53:45 +0000 +Subject: [PATCH] mips: Kconfig: Add ARCH_HAS_FORTIFY_SOURCE + +FORTIFY_SOURCE detects various overflows at compile and run time. +(6974f0c4555e ("include/linux/string.h: +add the option of fortified string.h functions) + +ARCH_HAS_FORTIFY_SOURCE means that the architecture can be built and +run with CONFIG_FORTIFY_SOURCE. + +Since mips can be built and run with that flag, +select ARCH_HAS_FORTIFY_SOURCE as default. + +Signed-off-by: Dmitry Korotin +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +--- + arch/mips/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -7,6 +7,7 @@ config MIPS + select ARCH_CLOCKSOURCE_DATA + select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST + select ARCH_HAS_UBSAN_SANITIZE_ALL ++ select ARCH_HAS_FORTIFY_SOURCE + select ARCH_SUPPORTS_UPROBES + select ARCH_USE_BUILTIN_BSWAP + select ARCH_USE_CMPXCHG_LOCKREF if 64BIT diff --git a/target/linux/generic/backport-5.4/311-MIPS-Fix-exception-handler-memcpy.patch b/target/linux/generic/backport-5.4/311-MIPS-Fix-exception-handler-memcpy.patch new file mode 100644 index 0000000000..5a6725c7a0 --- /dev/null +++ b/target/linux/generic/backport-5.4/311-MIPS-Fix-exception-handler-memcpy.patch @@ -0,0 +1,107 @@ +From e01c91a360793298c9e1656a61faceff01487a43 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Sat, 23 May 2020 23:50:34 +0800 +Subject: [PATCH] MIPS: Fix exception handler memcpy() + +The exception handler subroutines are declared as a single char, but +when copied to the required addresses the copy length is 0x80. + +When range checks are enabled for memcpy() this results in a build +failure, with error messages such as: + +In file included from arch/mips/mti-malta/malta-init.c:15: +In function 'memcpy', + inlined from 'mips_nmi_setup' at arch/mips/mti-malta/malta-init.c:98:2: +include/linux/string.h:376:4: error: call to '__read_overflow2' declared with attribute error: detected read beyond size of object passed as 2nd parameter + 376 | __read_overflow2(); + | ^~~~~~~~~~~~~~~~~~ + +Change the declarations to use type char[]. + +Signed-off-by: Ben Hutchings +Signed-off-by: YunQiang Su +Signed-off-by: Thomas Bogendoerfer +--- + arch/mips/loongson64/common/init.c | 4 ++-- + arch/mips/mti-malta/malta-init.c | 8 ++++---- + arch/mips/pistachio/init.c | 8 ++++---- + 3 files changed, 10 insertions(+), 10 deletions(-) + +--- a/arch/mips/loongson64/common/init.c ++++ b/arch/mips/loongson64/common/init.c +@@ -18,10 +18,10 @@ unsigned long __maybe_unused _loongson_a + static void __init mips_nmi_setup(void) + { + void *base; +- extern char except_vec_nmi; ++ extern char except_vec_nmi[]; + + base = (void *)(CAC_BASE + 0x380); +- memcpy(base, &except_vec_nmi, 0x80); ++ memcpy(base, except_vec_nmi, 0x80); + flush_icache_range((unsigned long)base, (unsigned long)base + 0x80); + } + +--- a/arch/mips/mti-malta/malta-init.c ++++ b/arch/mips/mti-malta/malta-init.c +@@ -90,24 +90,24 @@ static void __init console_config(void) + static void __init mips_nmi_setup(void) + { + void *base; +- extern char except_vec_nmi; ++ extern char except_vec_nmi[]; + + base = cpu_has_veic ? + (void *)(CAC_BASE + 0xa80) : + (void *)(CAC_BASE + 0x380); +- memcpy(base, &except_vec_nmi, 0x80); ++ memcpy(base, except_vec_nmi, 0x80); + flush_icache_range((unsigned long)base, (unsigned long)base + 0x80); + } + + static void __init mips_ejtag_setup(void) + { + void *base; +- extern char except_vec_ejtag_debug; ++ extern char except_vec_ejtag_debug[]; + + base = cpu_has_veic ? + (void *)(CAC_BASE + 0xa00) : + (void *)(CAC_BASE + 0x300); +- memcpy(base, &except_vec_ejtag_debug, 0x80); ++ memcpy(base, except_vec_ejtag_debug, 0x80); + flush_icache_range((unsigned long)base, (unsigned long)base + 0x80); + } + +--- a/arch/mips/pistachio/init.c ++++ b/arch/mips/pistachio/init.c +@@ -83,12 +83,12 @@ phys_addr_t mips_cdmm_phys_base(void) + static void __init mips_nmi_setup(void) + { + void *base; +- extern char except_vec_nmi; ++ extern char except_vec_nmi[]; + + base = cpu_has_veic ? + (void *)(CAC_BASE + 0xa80) : + (void *)(CAC_BASE + 0x380); +- memcpy(base, &except_vec_nmi, 0x80); ++ memcpy(base, except_vec_nmi, 0x80); + flush_icache_range((unsigned long)base, + (unsigned long)base + 0x80); + } +@@ -96,12 +96,12 @@ static void __init mips_nmi_setup(void) + static void __init mips_ejtag_setup(void) + { + void *base; +- extern char except_vec_ejtag_debug; ++ extern char except_vec_ejtag_debug[]; + + base = cpu_has_veic ? + (void *)(CAC_BASE + 0xa00) : + (void *)(CAC_BASE + 0x300); +- memcpy(base, &except_vec_ejtag_debug, 0x80); ++ memcpy(base, except_vec_ejtag_debug, 0x80); + flush_icache_range((unsigned long)base, + (unsigned long)base + 0x80); + } diff --git a/target/linux/generic/hack-5.4/301-mips_image_cmdline_hack.patch b/target/linux/generic/hack-5.4/301-mips_image_cmdline_hack.patch index da0aa34250..ada65cd2a0 100644 --- a/target/linux/generic/hack-5.4/301-mips_image_cmdline_hack.patch +++ b/target/linux/generic/hack-5.4/301-mips_image_cmdline_hack.patch @@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -1158,6 +1158,10 @@ config SYNC_R4K +@@ -1159,6 +1159,10 @@ config SYNC_R4K config MIPS_MACHINE def_bool n diff --git a/target/linux/generic/pending-5.4/103-MIPS-select-CPU_MIPS64-for-remaining-MIPS64-CPUs.patch b/target/linux/generic/pending-5.4/103-MIPS-select-CPU_MIPS64-for-remaining-MIPS64-CPUs.patch index 3b04316692..4e7a532156 100644 --- a/target/linux/generic/pending-5.4/103-MIPS-select-CPU_MIPS64-for-remaining-MIPS64-CPUs.patch +++ b/target/linux/generic/pending-5.4/103-MIPS-select-CPU_MIPS64-for-remaining-MIPS64-CPUs.patch @@ -25,7 +25,7 @@ Signed-off-by: Jason A. Donenfeld --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -2036,7 +2036,8 @@ config CPU_MIPS32 +@@ -2037,7 +2037,8 @@ config CPU_MIPS32 config CPU_MIPS64 bool diff --git a/target/linux/generic/pending-5.4/300-mips_expose_boot_raw.patch b/target/linux/generic/pending-5.4/300-mips_expose_boot_raw.patch index 476ae501d6..7b9ae65c60 100644 --- a/target/linux/generic/pending-5.4/300-mips_expose_boot_raw.patch +++ b/target/linux/generic/pending-5.4/300-mips_expose_boot_raw.patch @@ -9,7 +9,7 @@ Acked-by: Rob Landley --- --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -1068,9 +1068,6 @@ config FW_ARC +@@ -1069,9 +1069,6 @@ config FW_ARC config ARCH_MAY_HAVE_PC_FDC bool @@ -19,7 +19,7 @@ Acked-by: Rob Landley config CEVT_BCM1480 bool -@@ -3043,6 +3040,18 @@ choice +@@ -3044,6 +3041,18 @@ choice bool "Extend builtin kernel arguments with bootloader arguments" endchoice diff --git a/target/linux/generic/pending-5.4/306-mips_mem_functions_performance.patch b/target/linux/generic/pending-5.4/306-mips_mem_functions_performance.patch deleted file mode 100644 index 611aa0314f..0000000000 --- a/target/linux/generic/pending-5.4/306-mips_mem_functions_performance.patch +++ /dev/null @@ -1,106 +0,0 @@ -From: Felix Fietkau -Subject: [PATCH] mips: allow the compiler to optimize memset, memcmp, memcpy for better performance and (in some instances) smaller code - -lede-commit: 07e59c7bc7f375f792ec9734be42fe4fa391a8bb -Signed-off-by: Felix Fietkau ---- - arch/mips/boot/compressed/Makefile | 3 ++- - arch/mips/include/asm/string.h | 38 ++++++++++++++++++++++++++++++++++++++ - arch/mips/lib/Makefile | 2 +- - arch/mips/lib/memcmp.c | 22 ++++++++++++++++++++++ - 4 files changed, 63 insertions(+), 2 deletions(-) - create mode 100644 arch/mips/lib/memcmp.c - ---- a/arch/mips/boot/compressed/Makefile -+++ b/arch/mips/boot/compressed/Makefile -@@ -23,7 +23,8 @@ KBUILD_CFLAGS := $(filter-out -pg, $(KBU - KBUILD_CFLAGS := $(filter-out -fstack-protector, $(KBUILD_CFLAGS)) - - KBUILD_CFLAGS := $(KBUILD_CFLAGS) -D__KERNEL__ \ -- -DBOOT_HEAP_SIZE=$(BOOT_HEAP_SIZE) -D"VMLINUX_LOAD_ADDRESS_ULL=$(VMLINUX_LOAD_ADDRESS)ull" -+ -DBOOT_HEAP_SIZE=$(BOOT_HEAP_SIZE) -D"VMLINUX_LOAD_ADDRESS_ULL=$(VMLINUX_LOAD_ADDRESS)ull" \ -+ -D__ZBOOT__ - - KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__ASSEMBLY__ \ - -DBOOT_HEAP_SIZE=$(BOOT_HEAP_SIZE) \ ---- a/arch/mips/include/asm/string.h -+++ b/arch/mips/include/asm/string.h -@@ -19,4 +19,42 @@ extern void *memcpy(void *__to, __const_ - #define __HAVE_ARCH_MEMMOVE - extern void *memmove(void *__dest, __const__ void *__src, size_t __n); - -+#ifndef __ZBOOT__ -+#define memset(__s, __c, len) \ -+({ \ -+ size_t __len = (len); \ -+ void *__ret; \ -+ if (__builtin_constant_p(len) && __len >= 64) \ -+ __ret = memset((__s), (__c), __len); \ -+ else \ -+ __ret = __builtin_memset((__s), (__c), __len); \ -+ __ret; \ -+}) -+ -+#define memcpy(dst, src, len) \ -+({ \ -+ size_t __len = (len); \ -+ void *__ret; \ -+ if (__builtin_constant_p(len) && __len >= 64) \ -+ __ret = memcpy((dst), (src), __len); \ -+ else \ -+ __ret = __builtin_memcpy((dst), (src), __len); \ -+ __ret; \ -+}) -+ -+#define memmove(dst, src, len) \ -+({ \ -+ size_t __len = (len); \ -+ void *__ret; \ -+ if (__builtin_constant_p(len) && __len >= 64) \ -+ __ret = memmove((dst), (src), __len); \ -+ else \ -+ __ret = __builtin_memmove((dst), (src), __len); \ -+ __ret; \ -+}) -+ -+#define __HAVE_ARCH_MEMCMP -+#define memcmp(src1, src2, len) __builtin_memcmp((src1), (src2), (len)) -+#endif -+ - #endif /* _ASM_STRING_H */ ---- a/arch/mips/lib/Makefile -+++ b/arch/mips/lib/Makefile -@@ -5,7 +5,7 @@ - - lib-y += bitops.o csum_partial.o delay.o memcpy.o memset.o \ - mips-atomic.o strncpy_user.o \ -- strnlen_user.o uncached.o -+ strnlen_user.o uncached.o memcmp.o - - obj-y += iomap_copy.o - obj-$(CONFIG_PCI) += iomap-pci.o ---- /dev/null -+++ b/arch/mips/lib/memcmp.c -@@ -0,0 +1,22 @@ -+/* -+ * copied from linux/lib/string.c -+ * -+ * Copyright (C) 1991, 1992 Linus Torvalds -+ */ -+ -+#include -+#include -+ -+#undef memcmp -+int memcmp(const void *cs, const void *ct, size_t count) -+{ -+ const unsigned char *su1, *su2; -+ int res = 0; -+ -+ for (su1 = cs, su2 = ct; 0 < count; ++su1, ++su2, count--) -+ if ((res = *su1 - *su2) != 0) -+ break; -+ return res; -+} -+EXPORT_SYMBOL(memcmp); -+ diff --git a/target/linux/lantiq/patches-5.4/0152-lantiq-VPE.patch b/target/linux/lantiq/patches-5.4/0152-lantiq-VPE.patch index f8c2343e19..2aff479024 100644 --- a/target/linux/lantiq/patches-5.4/0152-lantiq-VPE.patch +++ b/target/linux/lantiq/patches-5.4/0152-lantiq-VPE.patch @@ -1,6 +1,6 @@ --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -2378,6 +2378,12 @@ config MIPS_VPE_LOADER +@@ -2379,6 +2379,12 @@ config MIPS_VPE_LOADER Includes a loader for loading an elf relocatable object onto another VPE and running it. diff --git a/target/linux/ramips/patches-5.4/0122-mips-ralink-enable-zboot-support.patch b/target/linux/ramips/patches-5.4/0122-mips-ralink-enable-zboot-support.patch index 76615ed491..34617898c8 100644 --- a/target/linux/ramips/patches-5.4/0122-mips-ralink-enable-zboot-support.patch +++ b/target/linux/ramips/patches-5.4/0122-mips-ralink-enable-zboot-support.patch @@ -16,7 +16,7 @@ Signed-off-by: Thomas Bogendoerfer --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -625,6 +625,7 @@ config RALINK +@@ -626,6 +626,7 @@ config RALINK select SYS_SUPPORTS_32BIT_KERNEL select SYS_SUPPORTS_LITTLE_ENDIAN select SYS_SUPPORTS_MIPS16 diff --git a/target/linux/ramips/patches-5.4/105-mt7621-memory-detect.patch b/target/linux/ramips/patches-5.4/105-mt7621-memory-detect.patch index 08b4b0de29..277d2aa43c 100644 --- a/target/linux/ramips/patches-5.4/105-mt7621-memory-detect.patch +++ b/target/linux/ramips/patches-5.4/105-mt7621-memory-detect.patch @@ -71,13 +71,13 @@ Signed-off-by: Chuanhong Guo + phys_addr_t size; + + for (size = 32 * SZ_1M; size < 256 * SZ_1M; size <<= 1) { -+ if (!memcmp(dm, dm + size, sizeof(detect_magic))) ++ if (!__builtin_memcmp(dm, dm + size, sizeof(detect_magic))) + break; + } + + if ((size == 256 * SZ_1M) && + (CPHYSADDR(dm + size) < MT7621_LOWMEM_MAX_SIZE) && -+ memcmp(dm, dm + size, sizeof(detect_magic))) { ++ __builtin_memcmp(dm, dm + size, sizeof(detect_magic))) { + add_memory_region(MT7621_LOWMEM_BASE, MT7621_LOWMEM_MAX_SIZE, + BOOT_MEM_RAM); + add_memory_region(MT7621_HIGHMEM_BASE, MT7621_HIGHMEM_SIZE, From 0e49178f93e73ac1dec68ef39a8e38115478d17d Mon Sep 17 00:00:00 2001 From: Nick Hainke Date: Sat, 8 May 2021 09:38:58 +0200 Subject: [PATCH 08/18] busybox: update to 1.33.1 Remove backports: - 001-backport1330fix-ash-make-strdup-copy.patch - 002-backport1330fix-traceroute.patch - 005-backport-CVE-2021-28831.patch Remove upstreamed: - 010-fix-wrong-variable.patch Signed-off-by: Nick Hainke [don't use $(AUTORELEASE) for now] Signed-off-by: Paul Spooren (cherry picked from commit 6713fe030fca32fc3d5ad9761f3b2f96501aedd6) --- package/utils/busybox/Makefile | 6 +-- ...backport1330fix-ash-make-strdup-copy.patch | 40 -------------- .../002-backport1330fix-traceroute.patch | 26 ---------- .../patches/005-backport-CVE-2021-28831.patch | 52 ------------------- .../patches/010-fix-wrong-variable.patch | 11 ---- 5 files changed, 3 insertions(+), 132 deletions(-) delete mode 100644 package/utils/busybox/patches/001-backport1330fix-ash-make-strdup-copy.patch delete mode 100644 package/utils/busybox/patches/002-backport1330fix-traceroute.patch delete mode 100644 package/utils/busybox/patches/005-backport-CVE-2021-28831.patch delete mode 100644 package/utils/busybox/patches/010-fix-wrong-variable.patch diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile index b69e718a35..475a154fa3 100644 --- a/package/utils/busybox/Makefile +++ b/package/utils/busybox/Makefile @@ -8,14 +8,14 @@ include $(TOPDIR)/rules.mk PKG_NAME:=busybox -PKG_VERSION:=1.33.0 -PKG_RELEASE:=4 +PKG_VERSION:=1.33.1 +PKG_RELEASE:=1 PKG_FLAGS:=essential PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 PKG_SOURCE_URL:=https://www.busybox.net/downloads \ http://sources.buildroot.net -PKG_HASH:=d568681c91a85edc6710770cebc1e80e042ad74d305b5c2e6d57a5f3de3b8fbd +PKG_HASH:=12cec6bd2b16d8a9446dd16130f2b92982f1819f6e1c5f5887b6db03f5660d28 PKG_BUILD_DEPENDS:=BUSYBOX_CONFIG_PAM:libpam PKG_BUILD_PARALLEL:=1 diff --git a/package/utils/busybox/patches/001-backport1330fix-ash-make-strdup-copy.patch b/package/utils/busybox/patches/001-backport1330fix-ash-make-strdup-copy.patch deleted file mode 100644 index b495227d9f..0000000000 --- a/package/utils/busybox/patches/001-backport1330fix-ash-make-strdup-copy.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 67cc582d4289c5de521d11b08307c8ab26ee1e28 Mon Sep 17 00:00:00 2001 -From: Denys Vlasenko -Date: Sun, 3 Jan 2021 10:55:39 +0100 -Subject: ash: make a strdup copy of $HISTFILE for line editing - -Otherwise if $HISTFILE is unset or reassigned, bad things can happen. - -function old new delta -ash_main 1210 1218 +8 - -Signed-off-by: Denys Vlasenko ---- - shell/ash.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/shell/ash.c b/shell/ash.c -index f16d7fb6a..ecbfbf091 100644 ---- a/shell/ash.c -+++ b/shell/ash.c -@@ -14499,7 +14499,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv) - - if (sflag || minusc == NULL) { - #if MAX_HISTORY > 0 && ENABLE_FEATURE_EDITING_SAVEHISTORY -- if (iflag) { -+ if (line_input_state) { - const char *hp = lookupvar("HISTFILE"); - if (!hp) { - hp = lookupvar("HOME"); -@@ -14513,7 +14513,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv) - } - } - if (hp) -- line_input_state->hist_file = hp; -+ line_input_state->hist_file = xstrdup(hp); - # if ENABLE_FEATURE_SH_HISTFILESIZE - hp = lookupvar("HISTFILESIZE"); - line_input_state->max_history = size_from_HISTFILESIZE(hp); --- -cgit v1.2.1 - diff --git a/package/utils/busybox/patches/002-backport1330fix-traceroute.patch b/package/utils/busybox/patches/002-backport1330fix-traceroute.patch deleted file mode 100644 index eb03094eee..0000000000 --- a/package/utils/busybox/patches/002-backport1330fix-traceroute.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 89358a7131d3e75c74af834bb117b4fad7914983 Mon Sep 17 00:00:00 2001 -From: Denys Vlasenko -Date: Tue, 2 Feb 2021 13:48:21 +0100 -Subject: traceroute: fix option parsing - -Signed-off-by: Denys Vlasenko ---- - networking/traceroute.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/networking/traceroute.c b/networking/traceroute.c -index 3f1a9ab46..29f5e480b 100644 ---- a/networking/traceroute.c -+++ b/networking/traceroute.c -@@ -896,7 +896,7 @@ traceroute_init(int op, char **argv) - - op |= getopt32(argv, "^" - OPT_STRING -- "\0" "-1:x-x" /* minimum 1 arg */ -+ "\0" "-1" /* minimum 1 arg */ - , &tos_str, &device, &max_ttl_str, &port_str, &nprobes_str - , &source, &waittime_str, &pausemsecs_str, &first_ttl_str - ); --- -cgit v1.2.1 - diff --git a/package/utils/busybox/patches/005-backport-CVE-2021-28831.patch b/package/utils/busybox/patches/005-backport-CVE-2021-28831.patch deleted file mode 100644 index 7637679a69..0000000000 --- a/package/utils/busybox/patches/005-backport-CVE-2021-28831.patch +++ /dev/null @@ -1,52 +0,0 @@ -From f25d254dfd4243698c31a4f3153d4ac72aa9e9bd Mon Sep 17 00:00:00 2001 -From: Samuel Sapalski -Date: Wed, 3 Mar 2021 16:31:22 +0100 -Subject: decompress_gunzip: Fix DoS if gzip is corrupt - -On certain corrupt gzip files, huft_build will set the error bit on -the result pointer. If afterwards abort_unzip is called huft_free -might run into a segmentation fault or an invalid pointer to -free(p). - -In order to mitigate this, we check in huft_free if the error bit -is set and clear it before the linked list is freed. - -Signed-off-by: Samuel Sapalski -Signed-off-by: Peter Kaestle -Signed-off-by: Denys Vlasenko ---- - archival/libarchive/decompress_gunzip.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - ---- a/archival/libarchive/decompress_gunzip.c -+++ b/archival/libarchive/decompress_gunzip.c -@@ -220,10 +220,20 @@ static const uint8_t border[] ALIGN1 = { - * each table. - * t: table to free - */ -+#define BAD_HUFT(p) ((uintptr_t)(p) & 1) -+#define ERR_RET ((huft_t*)(uintptr_t)1) - static void huft_free(huft_t *p) - { - huft_t *q; - -+ /* -+ * If 'p' has the error bit set we have to clear it, otherwise we might run -+ * into a segmentation fault or an invalid pointer to free(p) -+ */ -+ if (BAD_HUFT(p)) { -+ p = (huft_t*)((uintptr_t)(p) ^ (uintptr_t)(ERR_RET)); -+ } -+ - /* Go through linked list, freeing from the malloced (t[-1]) address. */ - while (p) { - q = (--p)->v.t; -@@ -289,8 +299,6 @@ static unsigned fill_bitbuffer(STATE_PAR - * or a valid pointer to a Huffman table, ORed with 0x1 if incompete table - * is given: "fixed inflate" decoder feeds us such data. - */ --#define BAD_HUFT(p) ((uintptr_t)(p) & 1) --#define ERR_RET ((huft_t*)(uintptr_t)1) - static huft_t* huft_build(const unsigned *b, const unsigned n, - const unsigned s, const struct cp_ext *cp_ext, - unsigned *m) diff --git a/package/utils/busybox/patches/010-fix-wrong-variable.patch b/package/utils/busybox/patches/010-fix-wrong-variable.patch deleted file mode 100644 index 1b6fa7be61..0000000000 --- a/package/utils/busybox/patches/010-fix-wrong-variable.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/libbb/update_passwd.c -+++ b/libbb/update_passwd.c -@@ -48,7 +48,7 @@ static void check_selinux_update_passwd( - bb_simple_error_msg_and_die("SELinux: access denied"); - } - if (ENABLE_FEATURE_CLEAN_UP) -- freecon(context); -+ freecon(seuser); - } - #else - # define check_selinux_update_passwd(username) ((void)0) From c287500a656e43da45b203fb3c4463d9089c5986 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Thu, 13 May 2021 22:37:30 +0200 Subject: [PATCH 09/18] mvebu: Remove patch only needed for kernel 5.10 Kernel 5.10 is not supported by OpenWrt 21.02, remove this patch. Fixes: d530ff37bf33 ("mvebu: armada 370: dts: fix the crypto engine") Signed-off-by: Hauke Mehrtens --- ...317-armada-370-dts-fix-crypto-engine.patch | 29 ------------------- 1 file changed, 29 deletions(-) delete mode 100644 target/linux/mvebu/patches-5.10/317-armada-370-dts-fix-crypto-engine.patch diff --git a/target/linux/mvebu/patches-5.10/317-armada-370-dts-fix-crypto-engine.patch b/target/linux/mvebu/patches-5.10/317-armada-370-dts-fix-crypto-engine.patch deleted file mode 100644 index 19378870ef..0000000000 --- a/target/linux/mvebu/patches-5.10/317-armada-370-dts-fix-crypto-engine.patch +++ /dev/null @@ -1,29 +0,0 @@ ---- a/arch/arm/boot/dts/armada-370.dtsi -+++ b/arch/arm/boot/dts/armada-370.dtsi -@@ -234,7 +234,7 @@ - clocks = <&gateclk 23>; - clock-names = "cesa0"; - marvell,crypto-srams = <&crypto_sram>; -- marvell,crypto-sram-size = <0x7e0>; -+ marvell,crypto-sram-size = <0x800>; - }; - }; - -@@ -255,12 +255,17 @@ - * cpuidle workaround. - */ - idle-sram@0 { -+ status = "disabled"; - reg = <0x0 0x20>; - }; - }; - }; - }; - -+&coherencyfab { -+ broken-idle; -+}; -+ - /* - * Default UART pinctrl setting without RTS/CTS, can be overwritten on - * board level if a different configuration is used. From 9d21eccc6b763a1e2f0a0ed0bcb4561ea0ed68ff Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sat, 15 May 2021 16:21:46 +0200 Subject: [PATCH 10/18] kernel: bump 5.4 to 5.4.119 Removed because in upstream generic/backport-5.4/050-gro-fix-napi_gro_frags-Fast-GRO-breakage-due-to-IP-a.patch ath79/patches-5.4/0050-spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch ramips/patches-5.4/999-fix-pci-init-mt7620.patch Manually rebased ath79/patches-5.4/0033-spi-ath79-drop-pdata-support.patch All others updated automatically. Compile-tested on: x86/64, ath79/generic Runtime-tested on: x86/64, ath79/generic Signed-off-by: Hauke Mehrtens --- include/kernel-version.mk | 4 +- .../802-usb-xhci-force-msi-renesas-xhci.patch | 2 +- .../0033-spi-ath79-drop-pdata-support.patch | 5 +- ...-spi-master-setup-and-cleanup-assign.patch | 28 ------- ...th79-Implement-the-spi_mem-interface.patch | 2 +- ...043-MMC-added-alternative-MMC-driver.patch | 8 +- ...hci_fixup_endpoint-for-interval-adju.patch | 4 +- ...ce-quirks-for-Freeway-Airmouse-T3-an.patch | 2 +- ...ore-event-ring-segment-table-entries.patch | 4 +- ...-use-default-DMA-address-translation.patch | 2 +- ...add-V4L2_CTRL_TYPE_AREA-control-type.patch | 4 +- ...finitions-for-HEVC-stateless-decodin.patch | 2 +- ...uapi-hevc-Add-scaling-matrix-control.patch | 2 +- ...-0504-mmc-sdhci-Silence-MMC-warnings.patch | 4 +- ...CS_HIGH-if-GPIO-descriptors-are-used.patch | 4 +- ...te-SPI_CS_HIGH-warning-to-KERN_DEBUG.patch | 2 +- ...ls-Add-helper-to-register-properties.patch | 2 +- ...support-for-performing-fake-doorbell.patch | 4 +- ...cmnand-support-v2.1-v2.2-controllers.patch | 2 +- ...rcmnand-fix-OOB-R-W-with-Hamming-ECC.patch | 6 +- ..._frags-Fast-GRO-breakage-due-to-IP-a.patch | 75 ------------------- ...25519-support-assemblers-with-no-adx.patch | 2 +- .../generic/hack-5.4/204-module_strip.patch | 4 +- .../generic/hack-5.4/902-debloat_proc.patch | 2 +- ...-mtd-core-add-get_mtd_device_by_node.patch | 2 +- .../0001-MIPS-lantiq-add-pcie-driver.patch | 2 +- ...T-PHY-add-led-support-for-intel-xway.patch | 4 +- ...5-usb-dwc3-add-otg-properties-update.patch | 2 +- ...host-xhci-add-EH-SINGLE_STEP_SET_FEA.patch | 2 +- ...-host-xhci-add-.bus_suspend-override.patch | 2 +- ...l-armada-37xx-Set-pcie_reset_pin-to-.patch | 2 +- ...l-armada-37xx-Move-PCIe-comphy-handl.patch | 2 +- ...l-armada-37xx-Move-PCIe-max-link-spe.patch | 2 +- .../patches-5.4/999-fix-pci-init-mt7620.patch | 21 ------ .../300-mips-add-rtl838x-platform.patch | 2 +- 35 files changed, 47 insertions(+), 172 deletions(-) delete mode 100644 target/linux/ath79/patches-5.4/0050-spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch delete mode 100644 target/linux/generic/backport-5.4/050-gro-fix-napi_gro_frags-Fast-GRO-breakage-due-to-IP-a.patch delete mode 100644 target/linux/ramips/patches-5.4/999-fix-pci-init-mt7620.patch diff --git a/include/kernel-version.mk b/include/kernel-version.mk index e14b1a2bd4..b038d2cd85 100644 --- a/include/kernel-version.mk +++ b/include/kernel-version.mk @@ -6,9 +6,9 @@ ifdef CONFIG_TESTING_KERNEL KERNEL_PATCHVER:=$(KERNEL_TESTING_PATCHVER) endif -LINUX_VERSION-5.4 = .117 +LINUX_VERSION-5.4 = .119 -LINUX_KERNEL_HASH-5.4.117 = 4e989b5775830092e5c76b5cca65ebff862ad0c87d0b58c3a20d415c3d4ec770 +LINUX_KERNEL_HASH-5.4.119 = 71e7decf1e8149a8aed88d30df4f2a62a6c6b168111de6b261685ac7c0ecb2a0 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1)))) sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1))))))) diff --git a/target/linux/apm821xx/patches-5.4/802-usb-xhci-force-msi-renesas-xhci.patch b/target/linux/apm821xx/patches-5.4/802-usb-xhci-force-msi-renesas-xhci.patch index 9d474f2d62..f248407fdb 100644 --- a/target/linux/apm821xx/patches-5.4/802-usb-xhci-force-msi-renesas-xhci.patch +++ b/target/linux/apm821xx/patches-5.4/802-usb-xhci-force-msi-renesas-xhci.patch @@ -23,7 +23,7 @@ produce a noisy warning. xhci->quirks |= XHCI_RESET_ON_RESUME; --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c -@@ -423,10 +423,14 @@ static int xhci_try_enable_msi(struct us +@@ -427,10 +427,14 @@ static int xhci_try_enable_msi(struct us free_irq(hcd->irq, hcd); hcd->irq = 0; diff --git a/target/linux/ath79/patches-5.4/0033-spi-ath79-drop-pdata-support.patch b/target/linux/ath79/patches-5.4/0033-spi-ath79-drop-pdata-support.patch index 8fd99bd333..162a82bda3 100644 --- a/target/linux/ath79/patches-5.4/0033-spi-ath79-drop-pdata-support.patch +++ b/target/linux/ath79/patches-5.4/0033-spi-ath79-drop-pdata-support.patch @@ -52,7 +52,7 @@ Signed-off-by: John Crispin unsigned long rate; int ret; -@@ -152,16 +150,10 @@ static int ath79_spi_probe(struct platfo +@@ -152,15 +150,9 @@ static int ath79_spi_probe(struct platfo master->dev.of_node = pdev->dev.of_node; platform_set_drvdata(pdev, sp); @@ -60,8 +60,7 @@ Signed-off-by: John Crispin - master->use_gpio_descriptors = true; master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32); - master->setup = spi_bitbang_setup; - master->cleanup = spi_bitbang_cleanup; + master->flags = SPI_MASTER_GPIO_SS; - if (pdata) { - master->bus_num = pdata->bus_num; - master->num_chipselect = pdata->num_chipselect; diff --git a/target/linux/ath79/patches-5.4/0050-spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch b/target/linux/ath79/patches-5.4/0050-spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch deleted file mode 100644 index a57ac24f29..0000000000 --- a/target/linux/ath79/patches-5.4/0050-spi-ath79-remove-spi-master-setup-and-cleanup-assign.patch +++ /dev/null @@ -1,28 +0,0 @@ -From b142b1beb199f62d47370c98a3dd8e13f792e9c0 Mon Sep 17 00:00:00 2001 -From: David Bauer -Date: Thu, 27 Feb 2020 23:03:20 +0100 -Subject: [PATCH] spi: ath79: remove spi-master setup and cleanup assignment - -This removes the assignment of setup and cleanup functions for the ath79 -target. Assigning the setup-method will lead to 'setup_transfer' not -being assigned in spi_bitbang_init. - -Also drop the redundant cleanup assignment, as this also happens in -spi_bitbang_init. - -Signed-off-by: David Bauer ---- - drivers/spi/spi-ath79.c | 2 -- - 1 file changed, 2 deletions(-) - ---- a/drivers/spi/spi-ath79.c -+++ b/drivers/spi/spi-ath79.c -@@ -152,8 +152,6 @@ static int ath79_spi_probe(struct platfo - - master->use_gpio_descriptors = true; - master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32); -- master->setup = spi_bitbang_setup; -- master->cleanup = spi_bitbang_cleanup; - - sp->bitbang.master = master; - sp->bitbang.chipselect = ath79_spi_chipselect; diff --git a/target/linux/ath79/patches-5.4/410-spi-ath79-Implement-the-spi_mem-interface.patch b/target/linux/ath79/patches-5.4/410-spi-ath79-Implement-the-spi_mem-interface.patch index 2a6b9857fb..51a71c6ef2 100644 --- a/target/linux/ath79/patches-5.4/410-spi-ath79-Implement-the-spi_mem-interface.patch +++ b/target/linux/ath79/patches-5.4/410-spi-ath79-Implement-the-spi_mem-interface.patch @@ -58,7 +58,7 @@ Signed-off-by: Luiz Angelo Daros de Luca static int ath79_spi_probe(struct platform_device *pdev) { struct spi_master *master; -@@ -163,6 +197,7 @@ static int ath79_spi_probe(struct platfo +@@ -164,6 +198,7 @@ static int ath79_spi_probe(struct platfo ret = PTR_ERR(sp->base); goto err_put_master; } diff --git a/target/linux/bcm27xx/patches-5.4/950-0043-MMC-added-alternative-MMC-driver.patch b/target/linux/bcm27xx/patches-5.4/950-0043-MMC-added-alternative-MMC-driver.patch index 4f5e392d78..a9f99add60 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0043-MMC-added-alternative-MMC-driver.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0043-MMC-added-alternative-MMC-driver.patch @@ -222,7 +222,7 @@ Signed-off-by: Yaroslav Rosomakho static inline int mmc_blk_part_switch(struct mmc_card *card, unsigned int part_type); -@@ -2868,6 +2875,7 @@ static int mmc_blk_probe(struct mmc_card +@@ -2884,6 +2891,7 @@ static int mmc_blk_probe(struct mmc_card { struct mmc_blk_data *md, *part_md; char cap_str[10]; @@ -230,7 +230,7 @@ Signed-off-by: Yaroslav Rosomakho /* * Check that the card supports the command class(es) we need. -@@ -2875,7 +2883,16 @@ static int mmc_blk_probe(struct mmc_card +@@ -2891,7 +2899,16 @@ static int mmc_blk_probe(struct mmc_card if (!(card->csd.cmdclass & CCC_BLOCK_READ)) return -ENODEV; @@ -248,7 +248,7 @@ Signed-off-by: Yaroslav Rosomakho card->complete_wq = alloc_workqueue("mmc_complete", WQ_MEM_RECLAIM | WQ_HIGHPRI, 0); -@@ -2890,9 +2907,14 @@ static int mmc_blk_probe(struct mmc_card +@@ -2906,9 +2923,14 @@ static int mmc_blk_probe(struct mmc_card string_get_size((u64)get_capacity(md->disk), 512, STRING_UNITS_2, cap_str, sizeof(cap_str)); @@ -279,7 +279,7 @@ Signed-off-by: Yaroslav Rosomakho } --- a/drivers/mmc/core/host.c +++ b/drivers/mmc/core/host.c -@@ -397,15 +397,30 @@ struct mmc_host *mmc_alloc_host(int extr +@@ -434,15 +434,30 @@ struct mmc_host *mmc_alloc_host(int extr { int err; struct mmc_host *host; diff --git a/target/linux/bcm27xx/patches-5.4/950-0219-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch b/target/linux/bcm27xx/patches-5.4/950-0219-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch index f6eac15a53..49f714991c 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0219-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0219-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch @@ -15,7 +15,7 @@ Signed-off-by: Jonathan Bell --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c -@@ -1464,6 +1464,103 @@ command_cleanup: +@@ -1468,6 +1468,103 @@ command_cleanup: } /* @@ -119,7 +119,7 @@ Signed-off-by: Jonathan Bell * non-error returns are a promise to giveback() the urb later * we drop ownership so next owner (or urb unlink) can get it */ -@@ -5345,6 +5442,7 @@ static const struct hc_driver xhci_hc_dr +@@ -5357,6 +5454,7 @@ static const struct hc_driver xhci_hc_dr .endpoint_reset = xhci_endpoint_reset, .check_bandwidth = xhci_check_bandwidth, .reset_bandwidth = xhci_reset_bandwidth, diff --git a/target/linux/bcm27xx/patches-5.4/950-0280-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch b/target/linux/bcm27xx/patches-5.4/950-0280-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch index 8cf51706b2..e486942ffd 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0280-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0280-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch @@ -33,7 +33,7 @@ Signed-off-by: Jonathan Bell #define USB_VENDOR_ID_BELKIN 0x050d #define USB_DEVICE_ID_FLIP_KVM 0x3201 -@@ -1258,6 +1261,9 @@ +@@ -1259,6 +1262,9 @@ #define USB_VENDOR_ID_XAT 0x2505 #define USB_DEVICE_ID_XAT_CSR 0x0220 diff --git a/target/linux/bcm27xx/patches-5.4/950-0293-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/bcm27xx/patches-5.4/950-0293-xhci-Use-more-event-ring-segment-table-entries.patch index 4b4766f739..20bab47514 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0293-xhci-Use-more-event-ring-segment-table-entries.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0293-xhci-Use-more-event-ring-segment-table-entries.patch @@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c -@@ -2503,9 +2503,11 @@ int xhci_mem_init(struct xhci_hcd *xhci, +@@ -2512,9 +2512,11 @@ int xhci_mem_init(struct xhci_hcd *xhci, * Event ring setup: Allocate a normal ring, but also setup * the event ring segment table (ERST). Section 4.9.3. */ @@ -36,7 +36,7 @@ Signed-off-by: Jonathan Bell if (!xhci->event_ring) goto fail; if (xhci_check_trb_in_td_math(xhci) < 0) -@@ -2518,7 +2520,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, +@@ -2527,7 +2529,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, /* set ERST count with the number of entries in the segment table */ val = readl(&xhci->ir_set->erst_size); val &= ERST_SIZE_MASK; diff --git a/target/linux/bcm27xx/patches-5.4/950-0440-x86-PCI-sta2x11-use-default-DMA-address-translation.patch b/target/linux/bcm27xx/patches-5.4/950-0440-x86-PCI-sta2x11-use-default-DMA-address-translation.patch index 51fd4be35e..539f5e1c0b 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0440-x86-PCI-sta2x11-use-default-DMA-address-translation.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0440-x86-PCI-sta2x11-use-default-DMA-address-translation.patch @@ -31,7 +31,7 @@ Signed-off-by: Christoph Hellwig --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig -@@ -708,7 +708,6 @@ config X86_SUPPORTS_MEMORY_FAILURE +@@ -709,7 +709,6 @@ config X86_SUPPORTS_MEMORY_FAILURE config STA2X11 bool "STA2X11 Companion Chip Support" depends on X86_32_NON_STANDARD && PCI diff --git a/target/linux/bcm27xx/patches-5.4/950-0482-media-add-V4L2_CTRL_TYPE_AREA-control-type.patch b/target/linux/bcm27xx/patches-5.4/950-0482-media-add-V4L2_CTRL_TYPE_AREA-control-type.patch index 4d7440b999..2accf3d3b7 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0482-media-add-V4L2_CTRL_TYPE_AREA-control-type.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0482-media-add-V4L2_CTRL_TYPE_AREA-control-type.patch @@ -39,7 +39,7 @@ Signed-off-by: Mauro Carvalho Chehab default: return -EINVAL; } -@@ -2423,6 +2429,9 @@ static struct v4l2_ctrl *v4l2_ctrl_new(s +@@ -2431,6 +2437,9 @@ static struct v4l2_ctrl *v4l2_ctrl_new(s case V4L2_CTRL_TYPE_VP8_FRAME_HEADER: elem_size = sizeof(struct v4l2_ctrl_vp8_frame_header); break; @@ -49,7 +49,7 @@ Signed-off-by: Mauro Carvalho Chehab default: if (type < V4L2_CTRL_COMPOUND_TYPES) elem_size = sizeof(s32); -@@ -4087,6 +4096,18 @@ int __v4l2_ctrl_s_ctrl_string(struct v4l +@@ -4098,6 +4107,18 @@ int __v4l2_ctrl_s_ctrl_string(struct v4l } EXPORT_SYMBOL(__v4l2_ctrl_s_ctrl_string); diff --git a/target/linux/bcm27xx/patches-5.4/950-0492-media-v4l-Add-definitions-for-HEVC-stateless-decodin.patch b/target/linux/bcm27xx/patches-5.4/950-0492-media-v4l-Add-definitions-for-HEVC-stateless-decodin.patch index e08d2481ed..effff9b748 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0492-media-v4l-Add-definitions-for-HEVC-stateless-decodin.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0492-media-v4l-Add-definitions-for-HEVC-stateless-decodin.patch @@ -820,7 +820,7 @@ Signed-off-by: Mauro Carvalho Chehab default: return -EINVAL; } -@@ -2434,6 +2532,15 @@ static struct v4l2_ctrl *v4l2_ctrl_new(s +@@ -2442,6 +2540,15 @@ static struct v4l2_ctrl *v4l2_ctrl_new(s case V4L2_CTRL_TYPE_VP8_FRAME_HEADER: elem_size = sizeof(struct v4l2_ctrl_vp8_frame_header); break; diff --git a/target/linux/bcm27xx/patches-5.4/950-0495-media-uapi-hevc-Add-scaling-matrix-control.patch b/target/linux/bcm27xx/patches-5.4/950-0495-media-uapi-hevc-Add-scaling-matrix-control.patch index c63a0a8bbc..403bf61c12 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0495-media-uapi-hevc-Add-scaling-matrix-control.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0495-media-uapi-hevc-Add-scaling-matrix-control.patch @@ -106,7 +106,7 @@ Signed-off-by: Jernej Skrabec case V4L2_CTRL_TYPE_AREA: area = p; if (!area->width || !area->height) -@@ -2541,6 +2548,9 @@ static struct v4l2_ctrl *v4l2_ctrl_new(s +@@ -2549,6 +2556,9 @@ static struct v4l2_ctrl *v4l2_ctrl_new(s case V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS: elem_size = sizeof(struct v4l2_ctrl_hevc_slice_params); break; diff --git a/target/linux/bcm27xx/patches-5.4/950-0504-mmc-sdhci-Silence-MMC-warnings.patch b/target/linux/bcm27xx/patches-5.4/950-0504-mmc-sdhci-Silence-MMC-warnings.patch index 38349280bb..8acdba434e 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0504-mmc-sdhci-Silence-MMC-warnings.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0504-mmc-sdhci-Silence-MMC-warnings.patch @@ -22,7 +22,7 @@ Signed-off-by: Maxime Ripard #define MAX_TUNING_LOOP 40 -@@ -2756,7 +2756,7 @@ static void sdhci_timeout_timer(struct t +@@ -2758,7 +2758,7 @@ static void sdhci_timeout_timer(struct t spin_lock_irqsave(&host->lock, flags); if (host->cmd && !sdhci_data_line_cmd(host->cmd)) { @@ -31,7 +31,7 @@ Signed-off-by: Maxime Ripard mmc_hostname(host->mmc)); sdhci_dumpregs(host); -@@ -2778,7 +2778,7 @@ static void sdhci_timeout_data_timer(str +@@ -2780,7 +2780,7 @@ static void sdhci_timeout_data_timer(str if (host->data || host->data_cmd || (host->cmd && sdhci_data_line_cmd(host->cmd))) { diff --git a/target/linux/bcm27xx/patches-5.4/950-0646-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch b/target/linux/bcm27xx/patches-5.4/950-0646-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch index 42d22c3003..6ee6a275c3 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0646-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0646-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch @@ -23,7 +23,7 @@ Signed-off-by: Phil Elwell --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c -@@ -3115,6 +3115,7 @@ static int __spi_validate_bits_per_word( +@@ -3110,6 +3110,7 @@ static int __spi_validate_bits_per_word( */ int spi_setup(struct spi_device *spi) { @@ -31,7 +31,7 @@ Signed-off-by: Phil Elwell unsigned bad_bits, ugly_bits; int status; -@@ -3132,6 +3133,14 @@ int spi_setup(struct spi_device *spi) +@@ -3127,6 +3128,14 @@ int spi_setup(struct spi_device *spi) (SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL | SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL))) return -EINVAL; diff --git a/target/linux/bcm27xx/patches-5.4/950-0690-SQUASH-spi-Demote-SPI_CS_HIGH-warning-to-KERN_DEBUG.patch b/target/linux/bcm27xx/patches-5.4/950-0690-SQUASH-spi-Demote-SPI_CS_HIGH-warning-to-KERN_DEBUG.patch index e4b2e7ed2a..fee107876a 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0690-SQUASH-spi-Demote-SPI_CS_HIGH-warning-to-KERN_DEBUG.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0690-SQUASH-spi-Demote-SPI_CS_HIGH-warning-to-KERN_DEBUG.patch @@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c -@@ -3127,8 +3127,8 @@ int spi_setup(struct spi_device *spi) +@@ -3122,8 +3122,8 @@ int spi_setup(struct spi_device *spi) if (ctlr->use_gpio_descriptors && ctlr->cs_gpiods && ctlr->cs_gpiods[spi->chip_select] && !(spi->mode & SPI_CS_HIGH)) { diff --git a/target/linux/bcm27xx/patches-5.4/950-0908-media-v4l2-ctrls-Add-helper-to-register-properties.patch b/target/linux/bcm27xx/patches-5.4/950-0908-media-v4l2-ctrls-Add-helper-to-register-properties.patch index cf637cea04..a61aa5335f 100644 --- a/target/linux/bcm27xx/patches-5.4/950-0908-media-v4l2-ctrls-Add-helper-to-register-properties.patch +++ b/target/linux/bcm27xx/patches-5.4/950-0908-media-v4l2-ctrls-Add-helper-to-register-properties.patch @@ -29,7 +29,7 @@ Signed-off-by: Laurent Pinchart #define dprintk(vdev, fmt, arg...) do { \ if (!WARN_ON(!(vdev)) && ((vdev)->dev_debug & V4L2_DEV_DEBUG_CTRL)) \ -@@ -4578,3 +4579,42 @@ __poll_t v4l2_ctrl_poll(struct file *fil +@@ -4589,3 +4590,42 @@ __poll_t v4l2_ctrl_poll(struct file *fil return 0; } EXPORT_SYMBOL(v4l2_ctrl_poll); diff --git a/target/linux/bcm53xx/patches-5.4/180-usb-xhci-add-support-for-performing-fake-doorbell.patch b/target/linux/bcm53xx/patches-5.4/180-usb-xhci-add-support-for-performing-fake-doorbell.patch index 483a9c0c75..5427d7368e 100644 --- a/target/linux/bcm53xx/patches-5.4/180-usb-xhci-add-support-for-performing-fake-doorbell.patch +++ b/target/linux/bcm53xx/patches-5.4/180-usb-xhci-add-support-for-performing-fake-doorbell.patch @@ -90,7 +90,7 @@ it on BCM4708 family. /* * Reset a halted HC. * -@@ -604,10 +647,20 @@ static int xhci_init(struct usb_hcd *hcd +@@ -608,10 +651,20 @@ static int xhci_init(struct usb_hcd *hcd static int xhci_run_finished(struct xhci_hcd *xhci) { @@ -114,7 +114,7 @@ it on BCM4708 family. xhci->shared_hcd->state = HC_STATE_RUNNING; xhci->cmd_ring_state = CMD_RING_STATE_RUNNING; -@@ -617,6 +670,10 @@ static int xhci_run_finished(struct xhci +@@ -621,6 +674,10 @@ static int xhci_run_finished(struct xhci xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Finished xhci_run for USB3 roothub"); return 0; diff --git a/target/linux/bcm63xx/patches-5.4/026-v5.8-mtd-rawnand-brcmnand-support-v2.1-v2.2-controllers.patch b/target/linux/bcm63xx/patches-5.4/026-v5.8-mtd-rawnand-brcmnand-support-v2.1-v2.2-controllers.patch index b48f4b9b2a..fe86584d0d 100644 --- a/target/linux/bcm63xx/patches-5.4/026-v5.8-mtd-rawnand-brcmnand-support-v2.1-v2.2-controllers.patch +++ b/target/linux/bcm63xx/patches-5.4/026-v5.8-mtd-rawnand-brcmnand-support-v2.1-v2.2-controllers.patch @@ -183,7 +183,7 @@ Link: https://lore.kernel.org/linux-mtd/20200522121524.4161539-6-noltari@gmail.c nand_writereg(ctrl, acc_control_offs, tmp); brcmnand_set_sector_size_1k(host, cfg->sector_size_1k); -@@ -2524,6 +2589,8 @@ const struct dev_pm_ops brcmnand_pm_ops +@@ -2530,6 +2595,8 @@ const struct dev_pm_ops brcmnand_pm_ops EXPORT_SYMBOL_GPL(brcmnand_pm_ops); static const struct of_device_id brcmnand_of_match[] = { diff --git a/target/linux/bcm63xx/patches-5.4/434-nand-brcmnand-fix-OOB-R-W-with-Hamming-ECC.patch b/target/linux/bcm63xx/patches-5.4/434-nand-brcmnand-fix-OOB-R-W-with-Hamming-ECC.patch index c3bb1ae1e8..f39beb9980 100644 --- a/target/linux/bcm63xx/patches-5.4/434-nand-brcmnand-fix-OOB-R-W-with-Hamming-ECC.patch +++ b/target/linux/bcm63xx/patches-5.4/434-nand-brcmnand-fix-OOB-R-W-with-Hamming-ECC.patch @@ -19,9 +19,9 @@ Signed-off-by: Álvaro Fernández Rojas --- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c +++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c -@@ -2426,6 +2426,12 @@ static int brcmnand_attach_chip(struct n - - ret = brcmstb_choose_ecc_layout(host); +@@ -2432,6 +2432,12 @@ static int brcmnand_attach_chip(struct n + chip->ecc.read_oob = brcmnand_read_oob_raw; + } + /* If OOB is written with ECC enabled it will cause ECC errors */ + if (is_hamming_ecc(host->ctrl, &host->hwcfg)) { diff --git a/target/linux/generic/backport-5.4/050-gro-fix-napi_gro_frags-Fast-GRO-breakage-due-to-IP-a.patch b/target/linux/generic/backport-5.4/050-gro-fix-napi_gro_frags-Fast-GRO-breakage-due-to-IP-a.patch deleted file mode 100644 index 17e9e34589..0000000000 --- a/target/linux/generic/backport-5.4/050-gro-fix-napi_gro_frags-Fast-GRO-breakage-due-to-IP-a.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 3007b05df4301aad179acc6ca1c3645785576df6 Mon Sep 17 00:00:00 2001 -From: Alexander Lobakin -Date: Mon, 19 Apr 2021 12:53:06 +0000 -Subject: gro: fix napi_gro_frags() Fast GRO breakage due to IP - alignment check - -Commit 7ad18ff6449cbd6beb26b53128ddf56d2685aa93 upstream. - -Commit 38ec4944b593 ("gro: ensure frag0 meets IP header alignment") -did the right thing, but missed the fact that napi_gro_frags() logics -calls for skb_gro_reset_offset() *before* pulling Ethernet header -to the skb linear space. -That said, the introduced check for frag0 address being aligned to 4 -always fails for it as Ethernet header is obviously 14 bytes long, -and in case with NET_IP_ALIGN its start is not aligned to 4. - -Fix this by adding @nhoff argument to skb_gro_reset_offset() which -tells if an IP header is placed right at the start of frag0 or not. -This restores Fast GRO for napi_gro_frags() that became very slow -after the mentioned commit, and preserves the introduced check to -avoid silent unaligned accesses. - -From v1 [0]: - - inline tiny skb_gro_reset_offset() to let the code be optimized - more efficively (esp. for the !NET_IP_ALIGN case) (Eric); - - pull in Reviewed-by from Eric. - -[0] https://lore.kernel.org/netdev/20210418114200.5839-1-alobakin@pm.me - -Fixes: 38ec4944b593 ("gro: ensure frag0 meets IP header alignment") -Reviewed-by: Eric Dumazet -Signed-off-by: Alexander Lobakin -Signed-off-by: David S. Miller ---- - net/core/dev.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -5395,7 +5395,7 @@ static struct list_head *gro_list_prepar - return head; - } - --static void skb_gro_reset_offset(struct sk_buff *skb) -+static inline void skb_gro_reset_offset(struct sk_buff *skb, u32 nhoff) - { - const struct skb_shared_info *pinfo = skb_shinfo(skb); - const skb_frag_t *frag0 = &pinfo->frags[0]; -@@ -5407,7 +5407,7 @@ static void skb_gro_reset_offset(struct - if (skb_mac_header(skb) == skb_tail_pointer(skb) && - pinfo->nr_frags && - !PageHighMem(skb_frag_page(frag0)) && -- (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) { -+ (!NET_IP_ALIGN || !((skb_frag_off(frag0) + nhoff) & 3))) { - NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0); - NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int, - skb_frag_size(frag0), -@@ -5640,7 +5640,7 @@ gro_result_t napi_gro_receive(struct nap - skb_mark_napi_id(skb, napi); - trace_napi_gro_receive_entry(skb); - -- skb_gro_reset_offset(skb); -+ skb_gro_reset_offset(skb, 0); - - ret = napi_skb_finish(napi, skb, dev_gro_receive(napi, skb)); - trace_napi_gro_receive_exit(ret); -@@ -5733,7 +5733,7 @@ static struct sk_buff *napi_frags_skb(st - napi->skb = NULL; - - skb_reset_mac_header(skb); -- skb_gro_reset_offset(skb); -+ skb_gro_reset_offset(skb, hlen); - - if (unlikely(skb_gro_header_hard(skb, hlen))) { - eth = skb_gro_header_slow(skb, hlen, 0); diff --git a/target/linux/generic/backport-5.4/080-wireguard-0052-crypto-x86-curve25519-support-assemblers-with-no-adx.patch b/target/linux/generic/backport-5.4/080-wireguard-0052-crypto-x86-curve25519-support-assemblers-with-no-adx.patch index 513025552d..cd507b1e44 100644 --- a/target/linux/generic/backport-5.4/080-wireguard-0052-crypto-x86-curve25519-support-assemblers-with-no-adx.patch +++ b/target/linux/generic/backport-5.4/080-wireguard-0052-crypto-x86-curve25519-support-assemblers-with-no-adx.patch @@ -24,7 +24,7 @@ Signed-off-by: Jason A. Donenfeld --- a/arch/x86/Makefile +++ b/arch/x86/Makefile -@@ -197,9 +197,10 @@ avx2_instr :=$(call as-instr,vpbroadcast +@@ -198,9 +198,10 @@ avx2_instr :=$(call as-instr,vpbroadcast avx512_instr :=$(call as-instr,vpmovm2b %k1$(comma)%zmm5,-DCONFIG_AS_AVX512=1) sha1_ni_instr :=$(call as-instr,sha1msg1 %xmm0$(comma)%xmm1,-DCONFIG_AS_SHA1_NI=1) sha256_ni_instr :=$(call as-instr,sha256msg1 %xmm0$(comma)%xmm1,-DCONFIG_AS_SHA256_NI=1) diff --git a/target/linux/generic/hack-5.4/204-module_strip.patch b/target/linux/generic/hack-5.4/204-module_strip.patch index a207a11ee5..22bb1ac33a 100644 --- a/target/linux/generic/hack-5.4/204-module_strip.patch +++ b/target/linux/generic/hack-5.4/204-module_strip.patch @@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau config MODULES_TREE_LOOKUP --- a/kernel/module.c +++ b/kernel/module.c -@@ -3224,9 +3224,11 @@ static int setup_load_info(struct load_i +@@ -3252,9 +3252,11 @@ static int setup_load_info(struct load_i static int check_modinfo(struct module *mod, struct load_info *info, int flags) { @@ -125,7 +125,7 @@ Signed-off-by: Felix Fietkau if (flags & MODULE_INIT_IGNORE_VERMAGIC) modmagic = NULL; -@@ -3247,6 +3249,7 @@ static int check_modinfo(struct module * +@@ -3275,6 +3277,7 @@ static int check_modinfo(struct module * mod->name); add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK); } diff --git a/target/linux/generic/hack-5.4/902-debloat_proc.patch b/target/linux/generic/hack-5.4/902-debloat_proc.patch index 7d6c2b2d6e..f8ee3f083b 100644 --- a/target/linux/generic/hack-5.4/902-debloat_proc.patch +++ b/target/linux/generic/hack-5.4/902-debloat_proc.patch @@ -396,7 +396,7 @@ Signed-off-by: Felix Fietkau } --- a/net/ipv4/route.c +++ b/net/ipv4/route.c -@@ -409,6 +409,9 @@ static struct pernet_operations ip_rt_pr +@@ -410,6 +410,9 @@ static struct pernet_operations ip_rt_pr static int __init ip_rt_proc_init(void) { diff --git a/target/linux/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch b/target/linux/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch index b6e36410e7..a173381820 100644 --- a/target/linux/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch +++ b/target/linux/generic/pending-5.4/495-mtd-core-add-get_mtd_device_by_node.patch @@ -17,7 +17,7 @@ Reviewed-by: Miquel Raynal --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c -@@ -1050,6 +1050,44 @@ out_unlock: +@@ -1053,6 +1053,44 @@ out_unlock: } EXPORT_SYMBOL_GPL(get_mtd_device_nm); diff --git a/target/linux/lantiq/patches-5.4/0001-MIPS-lantiq-add-pcie-driver.patch b/target/linux/lantiq/patches-5.4/0001-MIPS-lantiq-add-pcie-driver.patch index cb482bc522..702424ec45 100644 --- a/target/linux/lantiq/patches-5.4/0001-MIPS-lantiq-add-pcie-driver.patch +++ b/target/linux/lantiq/patches-5.4/0001-MIPS-lantiq-add-pcie-driver.patch @@ -4133,7 +4133,7 @@ Signed-off-by: John Crispin + --- a/arch/mips/pci/pci-legacy.c +++ b/arch/mips/pci/pci-legacy.c -@@ -308,3 +308,30 @@ char *__init pcibios_setup(char *str) +@@ -313,3 +313,30 @@ char *__init pcibios_setup(char *str) return pcibios_plat_setup(str); return str; } diff --git a/target/linux/lantiq/patches-5.4/0023-NET-PHY-add-led-support-for-intel-xway.patch b/target/linux/lantiq/patches-5.4/0023-NET-PHY-add-led-support-for-intel-xway.patch index 5a668b6f56..fb8d975110 100644 --- a/target/linux/lantiq/patches-5.4/0023-NET-PHY-add-led-support-for-intel-xway.patch +++ b/target/linux/lantiq/patches-5.4/0023-NET-PHY-add-led-support-for-intel-xway.patch @@ -13,7 +13,7 @@ Signed-off-by: John Crispin --- a/drivers/net/phy/intel-xway.c +++ b/drivers/net/phy/intel-xway.c -@@ -145,6 +145,51 @@ +@@ -157,6 +157,51 @@ #define PHY_ID_PHY11G_VR9_1_2 0xD565A409 #define PHY_ID_PHY22F_VR9_1_2 0xD565A419 @@ -65,7 +65,7 @@ Signed-off-by: John Crispin static int xway_gphy_config_init(struct phy_device *phydev) { int err; -@@ -183,6 +228,7 @@ static int xway_gphy_config_init(struct +@@ -204,6 +249,7 @@ static int xway_gphy_config_init(struct phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED2H, ledxh); phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LED2L, ledxl); diff --git a/target/linux/layerscape/patches-5.4/820-usb-0005-usb-dwc3-add-otg-properties-update.patch b/target/linux/layerscape/patches-5.4/820-usb-0005-usb-dwc3-add-otg-properties-update.patch index 848be9b5fe..ab96306774 100644 --- a/target/linux/layerscape/patches-5.4/820-usb-0005-usb-dwc3-add-otg-properties-update.patch +++ b/target/linux/layerscape/patches-5.4/820-usb-0005-usb-dwc3-add-otg-properties-update.patch @@ -54,7 +54,7 @@ Signed-off-by: Peter Chen * All 3.1 IP version constants are greater than the 3.0 IP --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c -@@ -3558,6 +3558,10 @@ int dwc3_gadget_init(struct dwc3 *dwc) +@@ -3568,6 +3568,10 @@ int dwc3_gadget_init(struct dwc3 *dwc) dwc->gadget.sg_supported = true; dwc->gadget.name = "dwc3-gadget"; dwc->gadget.lpm_capable = true; diff --git a/target/linux/layerscape/patches-5.4/820-usb-0015-MLK-17380-4-usb-host-xhci-add-EH-SINGLE_STEP_SET_FEA.patch b/target/linux/layerscape/patches-5.4/820-usb-0015-MLK-17380-4-usb-host-xhci-add-EH-SINGLE_STEP_SET_FEA.patch index 0334e72d9e..58cccfff5e 100644 --- a/target/linux/layerscape/patches-5.4/820-usb-0015-MLK-17380-4-usb-host-xhci-add-EH-SINGLE_STEP_SET_FEA.patch +++ b/target/linux/layerscape/patches-5.4/820-usb-0015-MLK-17380-4-usb-host-xhci-add-EH-SINGLE_STEP_SET_FEA.patch @@ -174,7 +174,7 @@ Signed-off-by: Peter Chen * bursts that are required to move all packets in this TD. Only SuperSpeed --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c -@@ -5372,6 +5372,7 @@ static const struct hc_driver xhci_hc_dr +@@ -5384,6 +5384,7 @@ static const struct hc_driver xhci_hc_dr .disable_usb3_lpm_timeout = xhci_disable_usb3_lpm_timeout, .find_raw_port_number = xhci_find_raw_port_number, .clear_tt_buffer_complete = xhci_clear_tt_buffer_complete, diff --git a/target/linux/layerscape/patches-5.4/820-usb-0018-MLK-18794-1-usb-host-xhci-add-.bus_suspend-override.patch b/target/linux/layerscape/patches-5.4/820-usb-0018-MLK-18794-1-usb-host-xhci-add-.bus_suspend-override.patch index 2f1d183853..3f805756fa 100644 --- a/target/linux/layerscape/patches-5.4/820-usb-0018-MLK-18794-1-usb-host-xhci-add-.bus_suspend-override.patch +++ b/target/linux/layerscape/patches-5.4/820-usb-0018-MLK-18794-1-usb-host-xhci-add-.bus_suspend-override.patch @@ -24,7 +24,7 @@ Signed-off-by: Peter Chen --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c -@@ -5393,6 +5393,8 @@ void xhci_init_driver(struct hc_driver * +@@ -5405,6 +5405,8 @@ void xhci_init_driver(struct hc_driver * drv->check_bandwidth = over->check_bandwidth; if (over->reset_bandwidth) drv->reset_bandwidth = over->reset_bandwidth; diff --git a/target/linux/mvebu/patches-5.4/020-arm64-dts-marvell-armada-37xx-Set-pcie_reset_pin-to-.patch b/target/linux/mvebu/patches-5.4/020-arm64-dts-marvell-armada-37xx-Set-pcie_reset_pin-to-.patch index 87247b63ad..9eeddaeba1 100644 --- a/target/linux/mvebu/patches-5.4/020-arm64-dts-marvell-armada-37xx-Set-pcie_reset_pin-to-.patch +++ b/target/linux/mvebu/patches-5.4/020-arm64-dts-marvell-armada-37xx-Set-pcie_reset_pin-to-.patch @@ -82,7 +82,7 @@ Signed-off-by: Gregory CLEMENT pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>; --- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -@@ -317,7 +317,7 @@ +@@ -318,7 +318,7 @@ pcie_reset_pins: pcie-reset-pins { groups = "pcie1"; diff --git a/target/linux/mvebu/patches-5.4/021-arm64-dts-marvell-armada-37xx-Move-PCIe-comphy-handl.patch b/target/linux/mvebu/patches-5.4/021-arm64-dts-marvell-armada-37xx-Move-PCIe-comphy-handl.patch index e92393ff6f..0c7830cb47 100644 --- a/target/linux/mvebu/patches-5.4/021-arm64-dts-marvell-armada-37xx-Move-PCIe-comphy-handl.patch +++ b/target/linux/mvebu/patches-5.4/021-arm64-dts-marvell-armada-37xx-Move-PCIe-comphy-handl.patch @@ -47,7 +47,7 @@ Signed-off-by: Gregory CLEMENT status = "disabled"; --- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -@@ -493,6 +493,7 @@ +@@ -494,6 +494,7 @@ <0 0 0 2 &pcie_intc 1>, <0 0 0 3 &pcie_intc 2>, <0 0 0 4 &pcie_intc 3>; diff --git a/target/linux/mvebu/patches-5.4/022-arm64-dts-marvell-armada-37xx-Move-PCIe-max-link-spe.patch b/target/linux/mvebu/patches-5.4/022-arm64-dts-marvell-armada-37xx-Move-PCIe-max-link-spe.patch index ad918bef88..04002480cc 100644 --- a/target/linux/mvebu/patches-5.4/022-arm64-dts-marvell-armada-37xx-Move-PCIe-max-link-spe.patch +++ b/target/linux/mvebu/patches-5.4/022-arm64-dts-marvell-armada-37xx-Move-PCIe-max-link-spe.patch @@ -34,7 +34,7 @@ Signed-off-by: Gregory CLEMENT /* enabled by U-Boot if PCIe module is present */ --- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -@@ -493,6 +493,7 @@ +@@ -494,6 +494,7 @@ <0 0 0 2 &pcie_intc 1>, <0 0 0 3 &pcie_intc 2>, <0 0 0 4 &pcie_intc 3>; diff --git a/target/linux/ramips/patches-5.4/999-fix-pci-init-mt7620.patch b/target/linux/ramips/patches-5.4/999-fix-pci-init-mt7620.patch deleted file mode 100644 index 7c00d4c9ae..0000000000 --- a/target/linux/ramips/patches-5.4/999-fix-pci-init-mt7620.patch +++ /dev/null @@ -1,21 +0,0 @@ ---- a/arch/mips/pci/pci-mt7620.c -+++ b/arch/mips/pci/pci-mt7620.c -@@ -32,6 +32,7 @@ - #define PPLL_CFG1 0x9c - - #define PPLL_DRV 0xa0 -+#define PPLL_LD BIT(23) - #define PDRV_SW_SET BIT(31) - #define LC_CKDRVPD BIT(19) - #define LC_CKDRVOHZ BIT(18) -@@ -239,8 +240,8 @@ static int mt7620_pci_hw_init(struct pla - rt_sysc_m32(0, RALINK_PCIE0_CLK_EN, RALINK_CLKCFG1); - mdelay(100); - -- if (!(rt_sysc_r32(PPLL_CFG1) & PDRV_SW_SET)) { -- dev_err(&pdev->dev, "MT7620 PPLL unlock\n"); -+ if (!(rt_sysc_r32(PPLL_CFG1) & PPLL_LD)) { -+ dev_err(&pdev->dev, "MT7620 PPLL is unlocked, aborting init\n"); - reset_control_assert(rstpcie0); - rt_sysc_m32(RALINK_PCIE0_CLK_EN, 0, RALINK_CLKCFG1); - return -1; diff --git a/target/linux/realtek/patches-5.4/300-mips-add-rtl838x-platform.patch b/target/linux/realtek/patches-5.4/300-mips-add-rtl838x-platform.patch index e946a5b1a0..ecc77b2a73 100644 --- a/target/linux/realtek/patches-5.4/300-mips-add-rtl838x-platform.patch +++ b/target/linux/realtek/patches-5.4/300-mips-add-rtl838x-platform.patch @@ -10,7 +10,7 @@ platforms += sgi-ip27 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -630,6 +630,26 @@ config RALINK +@@ -631,6 +631,26 @@ config RALINK select ARCH_HAS_RESET_CONTROLLER select RESET_CONTROLLER From 5869423d2169b95e49cde2dcc3892b94d84097d9 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Wed, 12 May 2021 14:28:37 +0200 Subject: [PATCH 11/18] mac80211: backport upstream fixes for FragAttacks From the patch series description: Several security issues in the 802.11 implementations were found by Mathy Vanhoef (New York University Abu Dhabi), who has published all the details at https://papers.mathyvanhoef.com/usenix2021.pdf Specifically, the following CVEs were assigned: * CVE-2020-24586 - Fragmentation cache not cleared on reconnection * CVE-2020-24587 - Reassembling fragments encrypted under different keys * CVE-2020-24588 - Accepting non-SPP A-MSDU frames, which leads to payload being parsed as an L2 frame under an A-MSDU bit toggling attack * CVE-2020-26139 - Forwarding EAPOL from unauthenticated sender * CVE-2020-26140 - Accepting plaintext data frames in protected networks * CVE-2020-26141 - Not verifying TKIP MIC of fragmented frames * CVE-2020-26142 - Processing fragmented frames as full frames * CVE-2020-26143 - Accepting fragmented plaintext frames in protected networks * CVE-2020-26144 - Always accepting unencrypted A-MSDU frames that start with RFC1042 header with EAPOL ethertype * CVE-2020-26145 - Accepting plaintext broadcast fragments as full frames * CVE-2020-26146 - Reassembling encrypted fragments with non-consecutive packet numbers * CVE-2020-26147 - Reassembling mixed encrypted/plaintext fragments In general, the scope of these attacks is that they may allow an attacker to * inject L2 frames that they can more or less control (depending on the vulnerability and attack method) into an otherwise protected network; * exfiltrate (some) network data under certain conditions, this is specific to the fragmentation issues. A subset of these issues is known to apply to the Linux IEEE 802.11 implementation (mac80211). Where it is affected, the attached patches fix the issues, even if not all of them reference the exact CVE IDs. In addition, driver and/or firmware updates may be necessary, as well as potentially more fixes to mac80211, depending on how drivers are using it. Specifically, for Intel devices, firmware needs to be updated to the most recently released versions (which was done without any reference to the security issues) to address some of the vulnerabilities. To have a single set of patches, I'm also including patches for the ath10k and ath11k drivers here. We currently don't have information about how other drivers are, if at all, affected. Signed-off-by: Felix Fietkau --- .../ath/080-ath10k_thermal_config.patch | 2 +- ...PN-replay-protection-for-fragmented-.patch | 180 ++++++++++ ...fragments-with-multicast-DA-for-PCIe.patch | 66 ++++ ...fragments-with-multicast-DA-for-SDIO.patch | 40 +++ ...-which-has-discard-flag-set-by-firmw.patch | 54 +++ ...IP-Michael-MIC-verification-for-PCIe.patch | 48 +++ ...first-subframe-of-A-MSDU-before-proc.patch | 109 ++++++ .../patches/ath/402-ath_regd_optional.patch | 2 +- .../ath/551-ath9k_ubnt_uap_plus_hsr.patch | 2 +- ...h10k-increase-rx-buffer-size-to-2048.patch | 2 +- ...rolling-support-for-various-chipsets.patch | 2 +- .../602-rt2x00-introduce-rt2x00eeprom.patch | 2 +- ...1-assure-all-fragments-are-encrypted.patch | 69 ++++ ...-mixed-key-and-fragment-cache-attack.patch | 87 +++++ ...y-handle-A-MSDUs-that-start-with-an-.patch | 66 ++++ ...-mitigate-A-MSDU-aggregation-attacks.patch | 40 +++ ...mac80211-drop-A-MSDUs-on-old-ciphers.patch | 54 +++ ...80211-add-fragment-cache-to-sta_info.patch | 313 ++++++++++++++++++ ...heck-defrag-PN-against-current-frame.patch | 109 ++++++ ...-prevent-attacks-on-TKIP-WEP-as-well.patch | 62 ++++ ...-accept-forward-invalid-EAPOL-frames.patch | 94 ++++++ ...protection-against-mixed-key-and-fra.patch | 68 ++++ .../500-mac80211_configure_antenna_gain.patch | 2 +- 23 files changed, 1466 insertions(+), 7 deletions(-) create mode 100644 package/kernel/mac80211/patches/ath/300-ath10k-add-CCMP-PN-replay-protection-for-fragmented-.patch create mode 100644 package/kernel/mac80211/patches/ath/301-ath10k-drop-fragments-with-multicast-DA-for-PCIe.patch create mode 100644 package/kernel/mac80211/patches/ath/302-ath10k-drop-fragments-with-multicast-DA-for-SDIO.patch create mode 100644 package/kernel/mac80211/patches/ath/303-ath10k-drop-MPDU-which-has-discard-flag-set-by-firmw.patch create mode 100644 package/kernel/mac80211/patches/ath/304-ath10k-Fix-TKIP-Michael-MIC-verification-for-PCIe.patch create mode 100644 package/kernel/mac80211/patches/ath/305-ath10k-Validate-first-subframe-of-A-MSDU-before-proc.patch create mode 100644 package/kernel/mac80211/patches/subsys/380-mac80211-assure-all-fragments-are-encrypted.patch create mode 100644 package/kernel/mac80211/patches/subsys/381-mac80211-prevent-mixed-key-and-fragment-cache-attack.patch create mode 100644 package/kernel/mac80211/patches/subsys/382-mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch create mode 100644 package/kernel/mac80211/patches/subsys/383-cfg80211-mitigate-A-MSDU-aggregation-attacks.patch create mode 100644 package/kernel/mac80211/patches/subsys/384-mac80211-drop-A-MSDUs-on-old-ciphers.patch create mode 100644 package/kernel/mac80211/patches/subsys/385-mac80211-add-fragment-cache-to-sta_info.patch create mode 100644 package/kernel/mac80211/patches/subsys/386-mac80211-check-defrag-PN-against-current-frame.patch create mode 100644 package/kernel/mac80211/patches/subsys/387-mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch create mode 100644 package/kernel/mac80211/patches/subsys/388-mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch create mode 100644 package/kernel/mac80211/patches/subsys/389-mac80211-extend-protection-against-mixed-key-and-fra.patch diff --git a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch b/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch index de6f9d9bb0..55d48daa79 100644 --- a/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch +++ b/package/kernel/mac80211/patches/ath/080-ath10k_thermal_config.patch @@ -37,7 +37,7 @@ void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature); --- a/local-symbols +++ b/local-symbols -@@ -142,6 +142,7 @@ ATH10K_SNOC= +@@ -143,6 +143,7 @@ ATH10K_SNOC= ATH10K_DEBUG= ATH10K_DEBUGFS= ATH10K_SPECTRAL= diff --git a/package/kernel/mac80211/patches/ath/300-ath10k-add-CCMP-PN-replay-protection-for-fragmented-.patch b/package/kernel/mac80211/patches/ath/300-ath10k-add-CCMP-PN-replay-protection-for-fragmented-.patch new file mode 100644 index 0000000000..0ce49b22ab --- /dev/null +++ b/package/kernel/mac80211/patches/ath/300-ath10k-add-CCMP-PN-replay-protection-for-fragmented-.patch @@ -0,0 +1,180 @@ +From: Wen Gong +Date: Tue, 11 May 2021 20:02:52 +0200 +Subject: [PATCH] ath10k: add CCMP PN replay protection for fragmented + frames for PCIe + +PN replay check for not fragmented frames is finished in the firmware, +but this was not done for fragmented frames when ath10k is used with +QCA6174/QCA6377 PCIe. mac80211 has the function +ieee80211_rx_h_defragment() for PN replay check for fragmented frames, +but this does not get checked with QCA6174 due to the +ieee80211_has_protected() condition not matching the cleared Protected +bit case. + +Validate the PN of received fragmented frames within ath10k when CCMP is +used and drop the fragment if the PN is not correct (incremented by +exactly one from the previous fragment). This applies only for +QCA6174/QCA6377 PCIe. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 + +Cc: stable@vger.kernel.org +Signed-off-by: Wen Gong +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/drivers/net/wireless/ath/ath10k/htt.h ++++ b/drivers/net/wireless/ath/ath10k/htt.h +@@ -846,6 +846,7 @@ enum htt_security_types { + + #define ATH10K_HTT_TXRX_PEER_SECURITY_MAX 2 + #define ATH10K_TXRX_NUM_EXT_TIDS 19 ++#define ATH10K_TXRX_NON_QOS_TID 16 + + enum htt_security_flags { + #define HTT_SECURITY_TYPE_MASK 0x7F +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -1746,16 +1746,87 @@ static void ath10k_htt_rx_h_csum_offload + msdu->ip_summed = ath10k_htt_rx_get_csum_state(msdu); + } + ++static u64 ath10k_htt_rx_h_get_pn(struct ath10k *ar, struct sk_buff *skb, ++ u16 offset, ++ enum htt_rx_mpdu_encrypt_type enctype) ++{ ++ struct ieee80211_hdr *hdr; ++ u64 pn = 0; ++ u8 *ehdr; ++ ++ hdr = (struct ieee80211_hdr *)(skb->data + offset); ++ ehdr = skb->data + offset + ieee80211_hdrlen(hdr->frame_control); ++ ++ if (enctype == HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2) { ++ pn = ehdr[0]; ++ pn |= (u64)ehdr[1] << 8; ++ pn |= (u64)ehdr[4] << 16; ++ pn |= (u64)ehdr[5] << 24; ++ pn |= (u64)ehdr[6] << 32; ++ pn |= (u64)ehdr[7] << 40; ++ } ++ return pn; ++} ++ ++static bool ath10k_htt_rx_h_frag_pn_check(struct ath10k *ar, ++ struct sk_buff *skb, ++ u16 peer_id, ++ u16 offset, ++ enum htt_rx_mpdu_encrypt_type enctype) ++{ ++ struct ath10k_peer *peer; ++ union htt_rx_pn_t *last_pn, new_pn = {0}; ++ struct ieee80211_hdr *hdr; ++ bool more_frags; ++ u8 tid, frag_number; ++ u32 seq; ++ ++ peer = ath10k_peer_find_by_id(ar, peer_id); ++ if (!peer) { ++ ath10k_dbg(ar, ATH10K_DBG_HTT, "invalid peer for frag pn check\n"); ++ return false; ++ } ++ ++ hdr = (struct ieee80211_hdr *)(skb->data + offset); ++ if (ieee80211_is_data_qos(hdr->frame_control)) ++ tid = ieee80211_get_tid(hdr); ++ else ++ tid = ATH10K_TXRX_NON_QOS_TID; ++ ++ last_pn = &peer->frag_tids_last_pn[tid]; ++ new_pn.pn48 = ath10k_htt_rx_h_get_pn(ar, skb, offset, enctype); ++ more_frags = ieee80211_has_morefrags(hdr->frame_control); ++ frag_number = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG; ++ seq = (__le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4; ++ ++ if (frag_number == 0) { ++ last_pn->pn48 = new_pn.pn48; ++ peer->frag_tids_seq[tid] = seq; ++ } else { ++ if (seq != peer->frag_tids_seq[tid]) ++ return false; ++ ++ if (new_pn.pn48 != last_pn->pn48 + 1) ++ return false; ++ ++ last_pn->pn48 = new_pn.pn48; ++ } ++ ++ return true; ++} ++ + static void ath10k_htt_rx_h_mpdu(struct ath10k *ar, + struct sk_buff_head *amsdu, + struct ieee80211_rx_status *status, + bool fill_crypt_header, + u8 *rx_hdr, +- enum ath10k_pkt_rx_err *err) ++ enum ath10k_pkt_rx_err *err, ++ u16 peer_id, ++ bool frag) + { + struct sk_buff *first; + struct sk_buff *last; +- struct sk_buff *msdu; ++ struct sk_buff *msdu, *temp; + struct htt_rx_desc *rxd; + struct ieee80211_hdr *hdr; + enum htt_rx_mpdu_encrypt_type enctype; +@@ -1768,6 +1839,7 @@ static void ath10k_htt_rx_h_mpdu(struct + bool is_decrypted; + bool is_mgmt; + u32 attention; ++ bool frag_pn_check = true; + + if (skb_queue_empty(amsdu)) + return; +@@ -1866,6 +1938,24 @@ static void ath10k_htt_rx_h_mpdu(struct + } + + skb_queue_walk(amsdu, msdu) { ++ if (frag && !fill_crypt_header && is_decrypted && ++ enctype == HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2) ++ frag_pn_check = ath10k_htt_rx_h_frag_pn_check(ar, ++ msdu, ++ peer_id, ++ 0, ++ enctype); ++ ++ if (!frag_pn_check) { ++ /* Discard the fragment with invalid PN */ ++ temp = msdu->prev; ++ __skb_unlink(msdu, amsdu); ++ dev_kfree_skb_any(msdu); ++ msdu = temp; ++ frag_pn_check = true; ++ continue; ++ } ++ + ath10k_htt_rx_h_csum_offload(msdu); + ath10k_htt_rx_h_undecap(ar, msdu, status, first_hdr, enctype, + is_decrypted); +@@ -2071,7 +2161,8 @@ static int ath10k_htt_rx_handle_amsdu(st + ath10k_htt_rx_h_unchain(ar, &amsdu, &drop_cnt, &unchain_cnt); + + ath10k_htt_rx_h_filter(ar, &amsdu, rx_status, &drop_cnt_filter); +- ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status, true, first_hdr, &err); ++ ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status, true, first_hdr, &err, 0, ++ false); + msdus_to_queue = skb_queue_len(&amsdu); + ath10k_htt_rx_h_enqueue(ar, &amsdu, rx_status); + +@@ -3027,7 +3118,7 @@ static int ath10k_htt_rx_in_ord_ind(stru + ath10k_htt_rx_h_ppdu(ar, &amsdu, status, vdev_id); + ath10k_htt_rx_h_filter(ar, &amsdu, status, NULL); + ath10k_htt_rx_h_mpdu(ar, &amsdu, status, false, NULL, +- NULL); ++ NULL, peer_id, frag); + ath10k_htt_rx_h_enqueue(ar, &amsdu, status); + break; + case -EAGAIN: diff --git a/package/kernel/mac80211/patches/ath/301-ath10k-drop-fragments-with-multicast-DA-for-PCIe.patch b/package/kernel/mac80211/patches/ath/301-ath10k-drop-fragments-with-multicast-DA-for-PCIe.patch new file mode 100644 index 0000000000..7288c66612 --- /dev/null +++ b/package/kernel/mac80211/patches/ath/301-ath10k-drop-fragments-with-multicast-DA-for-PCIe.patch @@ -0,0 +1,66 @@ +From: Wen Gong +Date: Tue, 11 May 2021 20:02:53 +0200 +Subject: [PATCH] ath10k: drop fragments with multicast DA for PCIe + +Fragmentation is not used with multicast frames. Discard unexpected +fragments with multicast DA. This fixes CVE-2020-26145. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 + +Cc: stable@vger.kernel.org +Signed-off-by: Wen Gong +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -1768,6 +1768,16 @@ static u64 ath10k_htt_rx_h_get_pn(struct + return pn; + } + ++static bool ath10k_htt_rx_h_frag_multicast_check(struct ath10k *ar, ++ struct sk_buff *skb, ++ u16 offset) ++{ ++ struct ieee80211_hdr *hdr; ++ ++ hdr = (struct ieee80211_hdr *)(skb->data + offset); ++ return !is_multicast_ether_addr(hdr->addr1); ++} ++ + static bool ath10k_htt_rx_h_frag_pn_check(struct ath10k *ar, + struct sk_buff *skb, + u16 peer_id, +@@ -1839,7 +1849,7 @@ static void ath10k_htt_rx_h_mpdu(struct + bool is_decrypted; + bool is_mgmt; + u32 attention; +- bool frag_pn_check = true; ++ bool frag_pn_check = true, multicast_check = true; + + if (skb_queue_empty(amsdu)) + return; +@@ -1946,13 +1956,20 @@ static void ath10k_htt_rx_h_mpdu(struct + 0, + enctype); + +- if (!frag_pn_check) { +- /* Discard the fragment with invalid PN */ ++ if (frag) ++ multicast_check = ath10k_htt_rx_h_frag_multicast_check(ar, ++ msdu, ++ 0); ++ ++ if (!frag_pn_check || !multicast_check) { ++ /* Discard the fragment with invalid PN or multicast DA ++ */ + temp = msdu->prev; + __skb_unlink(msdu, amsdu); + dev_kfree_skb_any(msdu); + msdu = temp; + frag_pn_check = true; ++ multicast_check = true; + continue; + } + diff --git a/package/kernel/mac80211/patches/ath/302-ath10k-drop-fragments-with-multicast-DA-for-SDIO.patch b/package/kernel/mac80211/patches/ath/302-ath10k-drop-fragments-with-multicast-DA-for-SDIO.patch new file mode 100644 index 0000000000..85d9ce65e2 --- /dev/null +++ b/package/kernel/mac80211/patches/ath/302-ath10k-drop-fragments-with-multicast-DA-for-SDIO.patch @@ -0,0 +1,40 @@ +From: Wen Gong +Date: Tue, 11 May 2021 20:02:54 +0200 +Subject: [PATCH] ath10k: drop fragments with multicast DA for SDIO + +Fragmentation is not used with multicast frames. Discard unexpected +fragments with multicast DA. This fixes CVE-2020-26145. + +Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049 + +Cc: stable@vger.kernel.org +Signed-off-by: Wen Gong +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -2617,6 +2617,13 @@ static bool ath10k_htt_rx_proc_rx_frag_i + rx_desc = (struct htt_hl_rx_desc *)(skb->data + tot_hdr_len); + rx_desc_info = __le32_to_cpu(rx_desc->info); + ++ hdr = (struct ieee80211_hdr *)((u8 *)rx_desc + rx_hl->fw_desc.len); ++ ++ if (is_multicast_ether_addr(hdr->addr1)) { ++ /* Discard the fragment with multicast DA */ ++ goto err; ++ } ++ + if (!MS(rx_desc_info, HTT_RX_DESC_HL_INFO_ENCRYPTED)) { + spin_unlock_bh(&ar->data_lock); + return ath10k_htt_rx_proc_rx_ind_hl(htt, &resp->rx_ind_hl, skb, +@@ -2624,8 +2631,6 @@ static bool ath10k_htt_rx_proc_rx_frag_i + HTT_RX_NON_TKIP_MIC); + } + +- hdr = (struct ieee80211_hdr *)((u8 *)rx_desc + rx_hl->fw_desc.len); +- + if (ieee80211_has_retry(hdr->frame_control)) + goto err; + diff --git a/package/kernel/mac80211/patches/ath/303-ath10k-drop-MPDU-which-has-discard-flag-set-by-firmw.patch b/package/kernel/mac80211/patches/ath/303-ath10k-drop-MPDU-which-has-discard-flag-set-by-firmw.patch new file mode 100644 index 0000000000..03bce4231b --- /dev/null +++ b/package/kernel/mac80211/patches/ath/303-ath10k-drop-MPDU-which-has-discard-flag-set-by-firmw.patch @@ -0,0 +1,54 @@ +From: Wen Gong +Date: Tue, 11 May 2021 20:02:55 +0200 +Subject: [PATCH] ath10k: drop MPDU which has discard flag set by firmware + for SDIO + +When the discard flag is set by the firmware for an MPDU, it should be +dropped. This allows a mitigation for CVE-2020-24588 to be implemented +in the firmware. + +Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049 + +Cc: stable@vger.kernel.org +Signed-off-by: Wen Gong +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -2312,6 +2312,11 @@ static bool ath10k_htt_rx_proc_rx_ind_hl + fw_desc = &rx->fw_desc; + rx_desc_len = fw_desc->len; + ++ if (fw_desc->u.bits.discard) { ++ ath10k_dbg(ar, ATH10K_DBG_HTT, "htt discard mpdu\n"); ++ goto err; ++ } ++ + /* I have not yet seen any case where num_mpdu_ranges > 1. + * qcacld does not seem handle that case either, so we introduce the + * same limitiation here as well. +--- a/drivers/net/wireless/ath/ath10k/rx_desc.h ++++ b/drivers/net/wireless/ath/ath10k/rx_desc.h +@@ -1282,7 +1282,19 @@ struct fw_rx_desc_base { + #define FW_RX_DESC_UDP (1 << 6) + + struct fw_rx_desc_hl { +- u8 info0; ++ union { ++ struct { ++ u8 discard:1, ++ forward:1, ++ any_err:1, ++ dup_err:1, ++ reserved:1, ++ inspect:1, ++ extension:2; ++ } bits; ++ u8 info0; ++ } u; ++ + u8 version; + u8 len; + u8 flags; diff --git a/package/kernel/mac80211/patches/ath/304-ath10k-Fix-TKIP-Michael-MIC-verification-for-PCIe.patch b/package/kernel/mac80211/patches/ath/304-ath10k-Fix-TKIP-Michael-MIC-verification-for-PCIe.patch new file mode 100644 index 0000000000..da9d6802bd --- /dev/null +++ b/package/kernel/mac80211/patches/ath/304-ath10k-Fix-TKIP-Michael-MIC-verification-for-PCIe.patch @@ -0,0 +1,48 @@ +From: Wen Gong +Date: Tue, 11 May 2021 20:02:56 +0200 +Subject: [PATCH] ath10k: Fix TKIP Michael MIC verification for PCIe + +TKIP Michael MIC was not verified properly for PCIe cases since the +validation steps in ieee80211_rx_h_michael_mic_verify() in mac80211 did +not get fully executed due to unexpected flag values in +ieee80211_rx_status. + +Fix this by setting the flags property to meet mac80211 expectations for +performing Michael MIC validation there. This fixes CVE-2020-26141. It +does the same as ath10k_htt_rx_proc_rx_ind_hl() for SDIO which passed +MIC verification case. This applies only to QCA6174/QCA9377 PCIe. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 + +Cc: stable@vger.kernel.org +Signed-off-by: Wen Gong +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -1974,6 +1974,11 @@ static void ath10k_htt_rx_h_mpdu(struct + } + + ath10k_htt_rx_h_csum_offload(msdu); ++ ++ if (frag && !fill_crypt_header && ++ enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA) ++ status->flag &= ~RX_FLAG_MMIC_STRIPPED; ++ + ath10k_htt_rx_h_undecap(ar, msdu, status, first_hdr, enctype, + is_decrypted); + +@@ -1991,6 +1996,11 @@ static void ath10k_htt_rx_h_mpdu(struct + + hdr = (void *)msdu->data; + hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED); ++ ++ if (frag && !fill_crypt_header && ++ enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA) ++ status->flag &= ~RX_FLAG_IV_STRIPPED & ++ ~RX_FLAG_MMIC_STRIPPED; + } + } + diff --git a/package/kernel/mac80211/patches/ath/305-ath10k-Validate-first-subframe-of-A-MSDU-before-proc.patch b/package/kernel/mac80211/patches/ath/305-ath10k-Validate-first-subframe-of-A-MSDU-before-proc.patch new file mode 100644 index 0000000000..0bdbed78d5 --- /dev/null +++ b/package/kernel/mac80211/patches/ath/305-ath10k-Validate-first-subframe-of-A-MSDU-before-proc.patch @@ -0,0 +1,109 @@ +From: Sriram R +Date: Tue, 11 May 2021 20:02:57 +0200 +Subject: [PATCH] ath10k: Validate first subframe of A-MSDU before + processing the list + +In certain scenarios a normal MSDU can be received as an A-MSDU when +the A-MSDU present bit of a QoS header gets flipped during reception. +Since this bit is unauthenticated, the hardware crypto engine can pass +the frame to the driver without any error indication. + +This could result in processing unintended subframes collected in the +A-MSDU list. Hence, validate A-MSDU list by checking if the first frame +has a valid subframe header. + +Comparing the non-aggregated MSDU and an A-MSDU, the fields of the first +subframe DA matches the LLC/SNAP header fields of a normal MSDU. +In order to avoid processing such frames, add a validation to +filter such A-MSDU frames where the first subframe header DA matches +with the LLC/SNAP header pattern. + +Tested-on: QCA9984 hw1.0 PCI 10.4-3.10-00047 + +Cc: stable@vger.kernel.org +Signed-off-by: Sriram R +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -2108,14 +2108,62 @@ static void ath10k_htt_rx_h_unchain(stru + ath10k_unchain_msdu(amsdu, unchain_cnt); + } + ++static bool ath10k_htt_rx_validate_amsdu(struct ath10k *ar, ++ struct sk_buff_head *amsdu) ++{ ++ u8 *subframe_hdr; ++ struct sk_buff *first; ++ bool is_first, is_last; ++ struct htt_rx_desc *rxd; ++ struct ieee80211_hdr *hdr; ++ size_t hdr_len, crypto_len; ++ enum htt_rx_mpdu_encrypt_type enctype; ++ int bytes_aligned = ar->hw_params.decap_align_bytes; ++ ++ first = skb_peek(amsdu); ++ ++ rxd = (void *)first->data - sizeof(*rxd); ++ hdr = (void *)rxd->rx_hdr_status; ++ ++ is_first = !!(rxd->msdu_end.common.info0 & ++ __cpu_to_le32(RX_MSDU_END_INFO0_FIRST_MSDU)); ++ is_last = !!(rxd->msdu_end.common.info0 & ++ __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU)); ++ ++ /* Return in case of non-aggregated msdu */ ++ if (is_first && is_last) ++ return true; ++ ++ /* First msdu flag is not set for the first msdu of the list */ ++ if (!is_first) ++ return false; ++ ++ enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0), ++ RX_MPDU_START_INFO0_ENCRYPT_TYPE); ++ ++ hdr_len = ieee80211_hdrlen(hdr->frame_control); ++ crypto_len = ath10k_htt_rx_crypto_param_len(ar, enctype); ++ ++ subframe_hdr = (u8 *)hdr + round_up(hdr_len, bytes_aligned) + ++ crypto_len; ++ ++ /* Validate if the amsdu has a proper first subframe. ++ * There are chances a single msdu can be received as amsdu when ++ * the unauthenticated amsdu flag of a QoS header ++ * gets flipped in non-SPP AMSDU's, in such cases the first ++ * subframe has llc/snap header in place of a valid da. ++ * return false if the da matches rfc1042 pattern ++ */ ++ if (ether_addr_equal(subframe_hdr, rfc1042_header)) ++ return false; ++ ++ return true; ++} ++ + static bool ath10k_htt_rx_amsdu_allowed(struct ath10k *ar, + struct sk_buff_head *amsdu, + struct ieee80211_rx_status *rx_status) + { +- /* FIXME: It might be a good idea to do some fuzzy-testing to drop +- * invalid/dangerous frames. +- */ +- + if (!rx_status->freq) { + ath10k_dbg(ar, ATH10K_DBG_HTT, "no channel configured; ignoring frame(s)!\n"); + return false; +@@ -2126,6 +2174,11 @@ static bool ath10k_htt_rx_amsdu_allowed( + return false; + } + ++ if (!ath10k_htt_rx_validate_amsdu(ar, amsdu)) { ++ ath10k_dbg(ar, ATH10K_DBG_HTT, "invalid amsdu received\n"); ++ return false; ++ } ++ + return true; + } + diff --git a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch index bf87d3551a..3c9180b113 100644 --- a/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch +++ b/package/kernel/mac80211/patches/ath/402-ath_regd_optional.patch @@ -82,7 +82,7 @@ help --- a/local-symbols +++ b/local-symbols -@@ -85,6 +85,7 @@ ADM8211= +@@ -86,6 +86,7 @@ ADM8211= ATH_COMMON= WLAN_VENDOR_ATH= ATH_DEBUG= diff --git a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch b/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch index acb9ad443c..cd2bdbf1a0 100644 --- a/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch +++ b/package/kernel/mac80211/patches/ath/551-ath9k_ubnt_uap_plus_hsr.patch @@ -371,7 +371,7 @@ --- a/local-symbols +++ b/local-symbols -@@ -112,6 +112,7 @@ ATH9K_WOW= +@@ -113,6 +113,7 @@ ATH9K_WOW= ATH9K_RFKILL= ATH9K_CHANNEL_CONTEXT= ATH9K_PCOEM= diff --git a/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch b/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch index abce361673..8f7a60eec8 100644 --- a/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch +++ b/package/kernel/mac80211/patches/ath/922-ath10k-increase-rx-buffer-size-to-2048.patch @@ -26,7 +26,7 @@ Forwarded: https://patchwork.kernel.org/patch/11367055/ --- a/drivers/net/wireless/ath/ath10k/htt.h +++ b/drivers/net/wireless/ath/ath10k/htt.h -@@ -2242,7 +2242,7 @@ struct htt_rx_chan_info { +@@ -2243,7 +2243,7 @@ struct htt_rx_chan_info { * Should be: sizeof(struct htt_host_rx_desc) + max rx MSDU size, * rounded up to a cache line size. */ diff --git a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch index ac46e35b67..5e74687826 100644 --- a/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch +++ b/package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch @@ -114,7 +114,7 @@ v13: ath10k_core-$(CONFIG_DEV_COREDUMP) += coredump.o --- a/local-symbols +++ b/local-symbols -@@ -145,6 +145,7 @@ ATH10K_DEBUG= +@@ -146,6 +146,7 @@ ATH10K_DEBUG= ATH10K_DEBUGFS= ATH10K_SPECTRAL= ATH10K_THERMAL= diff --git a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch index e74d9a9aa0..1c52132da6 100644 --- a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch +++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch @@ -1,6 +1,6 @@ --- a/local-symbols +++ b/local-symbols -@@ -332,6 +332,7 @@ RT2X00_LIB_FIRMWARE= +@@ -333,6 +333,7 @@ RT2X00_LIB_FIRMWARE= RT2X00_LIB_CRYPTO= RT2X00_LIB_LEDS= RT2X00_LIB_DEBUGFS= diff --git a/package/kernel/mac80211/patches/subsys/380-mac80211-assure-all-fragments-are-encrypted.patch b/package/kernel/mac80211/patches/subsys/380-mac80211-assure-all-fragments-are-encrypted.patch new file mode 100644 index 0000000000..69398459f1 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/380-mac80211-assure-all-fragments-are-encrypted.patch @@ -0,0 +1,69 @@ +From: Mathy Vanhoef +Date: Tue, 11 May 2021 20:02:42 +0200 +Subject: [PATCH] mac80211: assure all fragments are encrypted + +Do not mix plaintext and encrypted fragments in protected Wi-Fi +networks. This fixes CVE-2020-26147. + +Previously, an attacker was able to first forward a legitimate encrypted +fragment towards a victim, followed by a plaintext fragment. The +encrypted and plaintext fragment would then be reassembled. For further +details see Section 6.3 and Appendix D in the paper "Fragment and Forge: +Breaking Wi-Fi Through Frame Aggregation and Fragmentation". + +Because of this change there are now two equivalent conditions in the +code to determine if a received fragment requires sequential PNs, so we +also move this test to a separate function to make the code easier to +maintain. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathy Vanhoef +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2204,6 +2204,16 @@ ieee80211_reassemble_find(struct ieee802 + return NULL; + } + ++static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc) ++{ ++ return rx->key && ++ (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && ++ ieee80211_has_protected(fc); ++} ++ + static ieee80211_rx_result debug_noinline + ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + { +@@ -2248,12 +2258,7 @@ ieee80211_rx_h_defragment(struct ieee802 + /* This is the first fragment of a new frame. */ + entry = ieee80211_reassemble_add(rx->sdata, frag, seq, + rx->seqno_idx, &(rx->skb)); +- if (rx->key && +- (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || +- rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || +- rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || +- rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && +- ieee80211_has_protected(fc)) { ++ if (requires_sequential_pn(rx, fc)) { + int queue = rx->security_idx; + + /* Store CCMP/GCMP PN so that we can verify that the +@@ -2295,11 +2300,7 @@ ieee80211_rx_h_defragment(struct ieee802 + u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; + int queue; + +- if (!rx->key || +- (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP && +- rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 && +- rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP && +- rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256)) ++ if (!requires_sequential_pn(rx, fc)) + return RX_DROP_UNUSABLE; + memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); + for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { diff --git a/package/kernel/mac80211/patches/subsys/381-mac80211-prevent-mixed-key-and-fragment-cache-attack.patch b/package/kernel/mac80211/patches/subsys/381-mac80211-prevent-mixed-key-and-fragment-cache-attack.patch new file mode 100644 index 0000000000..de0f89a5b0 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/381-mac80211-prevent-mixed-key-and-fragment-cache-attack.patch @@ -0,0 +1,87 @@ +From: Mathy Vanhoef +Date: Tue, 11 May 2021 20:02:43 +0200 +Subject: [PATCH] mac80211: prevent mixed key and fragment cache attacks + +Simultaneously prevent mixed key attacks (CVE-2020-24587) and fragment +cache attacks (CVE-2020-24586). This is accomplished by assigning a +unique color to every key (per interface) and using this to track which +key was used to decrypt a fragment. When reassembling frames, it is +now checked whether all fragments were decrypted using the same key. + +To assure that fragment cache attacks are also prevented, the ID that is +assigned to keys is unique even over (re)associations and (re)connects. +This means fragments separated by a (re)association or (re)connect will +not be reassembled. Because mac80211 now also prevents the reassembly of +mixed encrypted and plaintext fragments, all cache attacks are prevented. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathy Vanhoef +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -97,6 +97,7 @@ struct ieee80211_fragment_entry { + u8 rx_queue; + bool check_sequential_pn; /* needed for CCMP/GCMP */ + u8 last_pn[6]; /* PN of the last fragment if CCMP was used */ ++ unsigned int key_color; + }; + + +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -799,6 +799,7 @@ int ieee80211_key_link(struct ieee80211_ + struct ieee80211_sub_if_data *sdata, + struct sta_info *sta) + { ++ static atomic_t key_color = ATOMIC_INIT(0); + struct ieee80211_key *old_key; + int idx = key->conf.keyidx; + bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; +@@ -850,6 +851,12 @@ int ieee80211_key_link(struct ieee80211_ + key->sdata = sdata; + key->sta = sta; + ++ /* ++ * Assign a unique ID to every key so we can easily prevent mixed ++ * key and fragment cache attacks. ++ */ ++ key->color = atomic_inc_return(&key_color); ++ + increment_tailroom_need_count(sdata); + + ret = ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +--- a/net/mac80211/key.h ++++ b/net/mac80211/key.h +@@ -128,6 +128,8 @@ struct ieee80211_key { + } debugfs; + #endif + ++ unsigned int color; ++ + /* + * key config, must be last because it contains key + * material as variable length member +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2265,6 +2265,7 @@ ieee80211_rx_h_defragment(struct ieee802 + * next fragment has a sequential PN value. + */ + entry->check_sequential_pn = true; ++ entry->key_color = rx->key->color; + memcpy(entry->last_pn, + rx->key->u.ccmp.rx_pn[queue], + IEEE80211_CCMP_PN_LEN); +@@ -2302,6 +2303,11 @@ ieee80211_rx_h_defragment(struct ieee802 + + if (!requires_sequential_pn(rx, fc)) + return RX_DROP_UNUSABLE; ++ ++ /* Prevent mixed key and fragment cache attacks */ ++ if (entry->key_color != rx->key->color) ++ return RX_DROP_UNUSABLE; ++ + memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); + for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { + pn[i]++; diff --git a/package/kernel/mac80211/patches/subsys/382-mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch b/package/kernel/mac80211/patches/subsys/382-mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch new file mode 100644 index 0000000000..3fdabde219 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/382-mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch @@ -0,0 +1,66 @@ +From: Mathy Vanhoef +Date: Tue, 11 May 2021 20:02:44 +0200 +Subject: [PATCH] mac80211: properly handle A-MSDUs that start with an + RFC 1042 header + +Properly parse A-MSDUs whose first 6 bytes happen to equal a rfc1042 +header. This can occur in practice when the destination MAC address +equals AA:AA:03:00:00:00. More importantly, this simplifies the next +patch to mitigate A-MSDU injection attacks. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathy Vanhoef +Signed-off-by: Johannes Berg +--- + +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -5628,7 +5628,7 @@ unsigned int ieee80211_get_mesh_hdrlen(s + */ + int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, + const u8 *addr, enum nl80211_iftype iftype, +- u8 data_offset); ++ u8 data_offset, bool is_amsdu); + + /** + * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3 +@@ -5640,7 +5640,7 @@ int ieee80211_data_to_8023_exthdr(struct + static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr, + enum nl80211_iftype iftype) + { +- return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0); ++ return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0, false); + } + + /** +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2696,7 +2696,7 @@ __ieee80211_rx_h_amsdu(struct ieee80211_ + if (ieee80211_data_to_8023_exthdr(skb, ðhdr, + rx->sdata->vif.addr, + rx->sdata->vif.type, +- data_offset)) ++ data_offset, true)) + return RX_DROP_UNUSABLE; + + ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -541,7 +541,7 @@ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen) + + int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr, + const u8 *addr, enum nl80211_iftype iftype, +- u8 data_offset) ++ u8 data_offset, bool is_amsdu) + { + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; + struct { +@@ -629,7 +629,7 @@ int ieee80211_data_to_8023_exthdr(struct + skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)); + tmp.h_proto = payload.proto; + +- if (likely((ether_addr_equal(payload.hdr, rfc1042_header) && ++ if (likely((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) && + tmp.h_proto != htons(ETH_P_AARP) && + tmp.h_proto != htons(ETH_P_IPX)) || + ether_addr_equal(payload.hdr, bridge_tunnel_header))) diff --git a/package/kernel/mac80211/patches/subsys/383-cfg80211-mitigate-A-MSDU-aggregation-attacks.patch b/package/kernel/mac80211/patches/subsys/383-cfg80211-mitigate-A-MSDU-aggregation-attacks.patch new file mode 100644 index 0000000000..8ea78dca84 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/383-cfg80211-mitigate-A-MSDU-aggregation-attacks.patch @@ -0,0 +1,40 @@ +From: Mathy Vanhoef +Date: Tue, 11 May 2021 20:02:45 +0200 +Subject: [PATCH] cfg80211: mitigate A-MSDU aggregation attacks + +Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the +destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP) +header, and if so dropping the complete A-MSDU frame. This mitigates +known attacks, although new (unknown) aggregation-based attacks may +remain possible. + +This defense works because in A-MSDU aggregation injection attacks, a +normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means +the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042 +header. In other words, the destination MAC address of the first A-MSDU +subframe contains the start of an RFC1042 header during an aggregation +attack. We can detect this and thereby prevent this specific attack. +For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi +Through Frame Aggregation and Fragmentation". + +Note that for kernel 4.9 and above this patch depends on "mac80211: +properly handle A-MSDUs that start with a rfc1042 header". Otherwise +this patch has no impact and attacks will remain possible. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathy Vanhoef +Signed-off-by: Johannes Berg +--- + +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -775,6 +775,9 @@ void ieee80211_amsdu_to_8023s(struct sk_ + remaining = skb->len - offset; + if (subframe_len > remaining) + goto purge; ++ /* mitigate A-MSDU aggregation injection attacks */ ++ if (ether_addr_equal(eth.h_dest, rfc1042_header)) ++ goto purge; + + offset += sizeof(struct ethhdr); + last = remaining <= subframe_len + padding; diff --git a/package/kernel/mac80211/patches/subsys/384-mac80211-drop-A-MSDUs-on-old-ciphers.patch b/package/kernel/mac80211/patches/subsys/384-mac80211-drop-A-MSDUs-on-old-ciphers.patch new file mode 100644 index 0000000000..1b5084c37d --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/384-mac80211-drop-A-MSDUs-on-old-ciphers.patch @@ -0,0 +1,54 @@ +From: Johannes Berg +Date: Tue, 11 May 2021 20:02:46 +0200 +Subject: [PATCH] mac80211: drop A-MSDUs on old ciphers + +With old ciphers (WEP and TKIP) we shouldn't be using A-MSDUs +since A-MSDUs are only supported if we know that they are, and +the only practical way for that is HT support which doesn't +support old ciphers. + +However, we would normally accept them anyway. Since we check +the MMIC before deaggregating A-MSDUs, and the A-MSDU bit in +the QoS header is not protected in TKIP (or WEP), this enables +attacks similar to CVE-2020-24588. To prevent that, drop A-MSDUs +completely with old ciphers. + +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -6,7 +6,7 @@ + * Copyright 2007-2010 Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2020 Intel Corporation ++ * Copyright (C) 2018-2021 Intel Corporation + */ + + #include +@@ -2753,6 +2753,23 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx + if (is_multicast_ether_addr(hdr->addr1)) + return RX_DROP_UNUSABLE; + ++ if (rx->key) { ++ /* ++ * We should not receive A-MSDUs on pre-HT connections, ++ * and HT connections cannot use old ciphers. Thus drop ++ * them, as in those cases we couldn't even have SPP ++ * A-MSDUs or such. ++ */ ++ switch (rx->key->conf.cipher) { ++ case WLAN_CIPHER_SUITE_WEP40: ++ case WLAN_CIPHER_SUITE_WEP104: ++ case WLAN_CIPHER_SUITE_TKIP: ++ return RX_DROP_UNUSABLE; ++ default: ++ break; ++ } ++ } ++ + return __ieee80211_rx_h_amsdu(rx, 0); + } + diff --git a/package/kernel/mac80211/patches/subsys/385-mac80211-add-fragment-cache-to-sta_info.patch b/package/kernel/mac80211/patches/subsys/385-mac80211-add-fragment-cache-to-sta_info.patch new file mode 100644 index 0000000000..b536126d38 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/385-mac80211-add-fragment-cache-to-sta_info.patch @@ -0,0 +1,313 @@ +From: Johannes Berg +Date: Tue, 11 May 2021 20:02:47 +0200 +Subject: [PATCH] mac80211: add fragment cache to sta_info + +Prior patches protected against fragmentation cache attacks +by coloring keys, but this shows that it can lead to issues +when multiple stations use the same sequence number. Add a +fragment cache to struct sta_info (in addition to the one in +the interface) to separate fragments for different stations +properly. + +This then automatically clear most of the fragment cache when a +station disconnects (or reassociates) from an AP, or when client +interfaces disconnect from the network, etc. + +On the way, also fix the comment there since this brings us in line +with the recommendation in 802.11-2016 ("An AP should support ..."). +Additionally, remove a useless condition (since there's no problem +purging an already empty list). + +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -50,12 +50,6 @@ struct ieee80211_local; + #define IEEE80211_ENCRYPT_HEADROOM 8 + #define IEEE80211_ENCRYPT_TAILROOM 18 + +-/* IEEE 802.11 (Ch. 9.5 Defragmentation) requires support for concurrent +- * reception of at least three fragmented frames. This limit can be increased +- * by changing this define, at the cost of slower frame reassembly and +- * increased memory use (about 2 kB of RAM per entry). */ +-#define IEEE80211_FRAGMENT_MAX 4 +- + /* power level hasn't been configured (or set to automatic) */ + #define IEEE80211_UNSET_POWER_LEVEL INT_MIN + +@@ -88,19 +82,6 @@ extern const u8 ieee80211_ac_to_qos_mask + + #define IEEE80211_MAX_NAN_INSTANCE_ID 255 + +-struct ieee80211_fragment_entry { +- struct sk_buff_head skb_list; +- unsigned long first_frag_time; +- u16 seq; +- u16 extra_len; +- u16 last_frag; +- u8 rx_queue; +- bool check_sequential_pn; /* needed for CCMP/GCMP */ +- u8 last_pn[6]; /* PN of the last fragment if CCMP was used */ +- unsigned int key_color; +-}; +- +- + struct ieee80211_bss { + u32 device_ts_beacon, device_ts_presp; + +@@ -912,9 +893,7 @@ struct ieee80211_sub_if_data { + + char name[IFNAMSIZ]; + +- /* Fragment table for host-based reassembly */ +- struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX]; +- unsigned int fragment_next; ++ struct ieee80211_fragment_cache frags; + + /* TID bitmap for NoAck policy */ + u16 noack_map; +@@ -2329,4 +2308,7 @@ u32 ieee80211_calc_expected_tx_airtime(s + #define debug_noinline + #endif + ++void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache); ++void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache); ++ + #endif /* IEEE80211_I_H */ +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -8,7 +8,7 @@ + * Copyright 2008, Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright (c) 2016 Intel Deutschland GmbH +- * Copyright (C) 2018-2020 Intel Corporation ++ * Copyright (C) 2018-2021 Intel Corporation + */ + #include + #include +@@ -679,16 +679,12 @@ static void ieee80211_set_multicast_list + */ + static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata) + { +- int i; +- + /* free extra data */ + ieee80211_free_keys(sdata, false); + + ieee80211_debugfs_remove_netdev(sdata); + +- for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) +- __skb_queue_purge(&sdata->fragments[i].skb_list); +- sdata->fragment_next = 0; ++ ieee80211_destroy_frag_cache(&sdata->frags); + + if (ieee80211_vif_is_mesh(&sdata->vif)) + ieee80211_mesh_teardown_sdata(sdata); +@@ -2038,8 +2034,7 @@ int ieee80211_if_add(struct ieee80211_lo + sdata->wdev.wiphy = local->hw.wiphy; + sdata->local = local; + +- for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) +- skb_queue_head_init(&sdata->fragments[i].skb_list); ++ ieee80211_init_frag_cache(&sdata->frags); + + INIT_LIST_HEAD(&sdata->key_list); + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2133,19 +2133,34 @@ ieee80211_rx_h_decrypt(struct ieee80211_ + return result; + } + ++void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(cache->entries); i++) ++ skb_queue_head_init(&cache->entries[i].skb_list); ++} ++ ++void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(cache->entries); i++) ++ __skb_queue_purge(&cache->entries[i].skb_list); ++} ++ + static inline struct ieee80211_fragment_entry * +-ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, ++ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache, + unsigned int frag, unsigned int seq, int rx_queue, + struct sk_buff **skb) + { + struct ieee80211_fragment_entry *entry; + +- entry = &sdata->fragments[sdata->fragment_next++]; +- if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) +- sdata->fragment_next = 0; ++ entry = &cache->entries[cache->next++]; ++ if (cache->next >= IEEE80211_FRAGMENT_MAX) ++ cache->next = 0; + +- if (!skb_queue_empty(&entry->skb_list)) +- __skb_queue_purge(&entry->skb_list); ++ __skb_queue_purge(&entry->skb_list); + + __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ + *skb = NULL; +@@ -2160,14 +2175,14 @@ ieee80211_reassemble_add(struct ieee8021 + } + + static inline struct ieee80211_fragment_entry * +-ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, ++ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache, + unsigned int frag, unsigned int seq, + int rx_queue, struct ieee80211_hdr *hdr) + { + struct ieee80211_fragment_entry *entry; + int i, idx; + +- idx = sdata->fragment_next; ++ idx = cache->next; + for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { + struct ieee80211_hdr *f_hdr; + struct sk_buff *f_skb; +@@ -2176,7 +2191,7 @@ ieee80211_reassemble_find(struct ieee802 + if (idx < 0) + idx = IEEE80211_FRAGMENT_MAX - 1; + +- entry = &sdata->fragments[idx]; ++ entry = &cache->entries[idx]; + if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || + entry->rx_queue != rx_queue || + entry->last_frag + 1 != frag) +@@ -2217,6 +2232,7 @@ static bool requires_sequential_pn(struc + static ieee80211_rx_result debug_noinline + ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + { ++ struct ieee80211_fragment_cache *cache = &rx->sdata->frags; + struct ieee80211_hdr *hdr; + u16 sc; + __le16 fc; +@@ -2238,6 +2254,9 @@ ieee80211_rx_h_defragment(struct ieee802 + goto out_no_led; + } + ++ if (rx->sta) ++ cache = &rx->sta->frags; ++ + if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) + goto out; + +@@ -2256,7 +2275,7 @@ ieee80211_rx_h_defragment(struct ieee802 + + if (frag == 0) { + /* This is the first fragment of a new frame. */ +- entry = ieee80211_reassemble_add(rx->sdata, frag, seq, ++ entry = ieee80211_reassemble_add(cache, frag, seq, + rx->seqno_idx, &(rx->skb)); + if (requires_sequential_pn(rx, fc)) { + int queue = rx->security_idx; +@@ -2284,7 +2303,7 @@ ieee80211_rx_h_defragment(struct ieee802 + /* This is a fragment for a frame that should already be pending in + * fragment cache. Add this fragment to the end of the pending entry. + */ +- entry = ieee80211_reassemble_find(rx->sdata, frag, seq, ++ entry = ieee80211_reassemble_find(cache, frag, seq, + rx->seqno_idx, hdr); + if (!entry) { + I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -4,7 +4,7 @@ + * Copyright 2006-2007 Jiri Benc + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright (C) 2015 - 2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2020 Intel Corporation ++ * Copyright (C) 2018-2021 Intel Corporation + */ + + #include +@@ -393,6 +393,8 @@ struct sta_info *sta_info_alloc(struct i + + u64_stats_init(&sta->rx_stats.syncp); + ++ ieee80211_init_frag_cache(&sta->frags); ++ + sta->sta_state = IEEE80211_STA_NONE; + + /* Mark TID as unreserved */ +@@ -1103,6 +1105,8 @@ static void __sta_info_destroy_part2(str + + ieee80211_sta_debugfs_remove(sta); + ++ ieee80211_destroy_frag_cache(&sta->frags); ++ + cleanup_single_sta(sta); + } + +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -3,7 +3,7 @@ + * Copyright 2002-2005, Devicescape Software, Inc. + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright(c) 2015-2017 Intel Deutschland GmbH +- * Copyright(c) 2020 Intel Corporation ++ * Copyright(c) 2020-2021 Intel Corporation + */ + + #ifndef STA_INFO_H +@@ -439,6 +439,33 @@ struct ieee80211_sta_rx_stats { + }; + + /* ++ * IEEE 802.11-2016 (10.6 "Defragmentation") recommends support for "concurrent ++ * reception of at least one MSDU per access category per associated STA" ++ * on APs, or "at least one MSDU per access category" on other interface types. ++ * ++ * This limit can be increased by changing this define, at the cost of slower ++ * frame reassembly and increased memory use while fragments are pending. ++ */ ++#define IEEE80211_FRAGMENT_MAX 4 ++ ++struct ieee80211_fragment_entry { ++ struct sk_buff_head skb_list; ++ unsigned long first_frag_time; ++ u16 seq; ++ u16 extra_len; ++ u16 last_frag; ++ u8 rx_queue; ++ bool check_sequential_pn; /* needed for CCMP/GCMP */ ++ u8 last_pn[6]; /* PN of the last fragment if CCMP was used */ ++ unsigned int key_color; ++}; ++ ++struct ieee80211_fragment_cache { ++ struct ieee80211_fragment_entry entries[IEEE80211_FRAGMENT_MAX]; ++ unsigned int next; ++}; ++ ++/* + * The bandwidth threshold below which the per-station CoDel parameters will be + * scaled to be more lenient (to prevent starvation of slow stations). This + * value will be scaled by the number of active stations when it is being +@@ -531,6 +558,7 @@ struct ieee80211_sta_rx_stats { + * @status_stats.last_ack_signal: last ACK signal + * @status_stats.ack_signal_filled: last ACK signal validity + * @status_stats.avg_ack_signal: average ACK signal ++ * @frags: fragment cache + */ + struct sta_info { + /* General information, mostly static */ +@@ -639,6 +667,8 @@ struct sta_info { + + struct cfg80211_chan_def tdls_chandef; + ++ struct ieee80211_fragment_cache frags; ++ + /* keep last! */ + struct ieee80211_sta sta; + }; diff --git a/package/kernel/mac80211/patches/subsys/386-mac80211-check-defrag-PN-against-current-frame.patch b/package/kernel/mac80211/patches/subsys/386-mac80211-check-defrag-PN-against-current-frame.patch new file mode 100644 index 0000000000..fb2747a609 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/386-mac80211-check-defrag-PN-against-current-frame.patch @@ -0,0 +1,109 @@ +From: Johannes Berg +Date: Tue, 11 May 2021 20:02:48 +0200 +Subject: [PATCH] mac80211: check defrag PN against current frame + +As pointed out by Mathy Vanhoef, we implement the RX PN check +on fragmented frames incorrectly - we check against the last +received PN prior to the new frame, rather than to the one in +this frame itself. + +Prior patches addressed the security issue here, but in order +to be able to reason better about the code, fix it to really +compare against the current frame's PN, not the last stored +one. + +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -227,8 +227,15 @@ struct ieee80211_rx_data { + */ + int security_idx; + +- u32 tkip_iv32; +- u16 tkip_iv16; ++ union { ++ struct { ++ u32 iv32; ++ u16 iv16; ++ } tkip; ++ struct { ++ u8 pn[IEEE80211_CCMP_PN_LEN]; ++ } ccm_gcm; ++ }; + }; + + struct ieee80211_csa_settings { +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2318,7 +2318,6 @@ ieee80211_rx_h_defragment(struct ieee802 + if (entry->check_sequential_pn) { + int i; + u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; +- int queue; + + if (!requires_sequential_pn(rx, fc)) + return RX_DROP_UNUSABLE; +@@ -2333,8 +2332,8 @@ ieee80211_rx_h_defragment(struct ieee802 + if (pn[i]) + break; + } +- queue = rx->security_idx; +- rpn = rx->key->u.ccmp.rx_pn[queue]; ++ ++ rpn = rx->ccm_gcm.pn; + if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) + return RX_DROP_UNUSABLE; + memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -3,6 +3,7 @@ + * Copyright 2002-2004, Instant802 Networks, Inc. + * Copyright 2008, Jouni Malinen + * Copyright (C) 2016-2017 Intel Deutschland GmbH ++ * Copyright (C) 2020-2021 Intel Corporation + */ + + #include +@@ -167,8 +168,8 @@ ieee80211_rx_h_michael_mic_verify(struct + + update_iv: + /* update IV in key information to be able to detect replays */ +- rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32; +- rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16; ++ rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip.iv32; ++ rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip.iv16; + + return RX_CONTINUE; + +@@ -294,8 +295,8 @@ ieee80211_crypto_tkip_decrypt(struct iee + key, skb->data + hdrlen, + skb->len - hdrlen, rx->sta->sta.addr, + hdr->addr1, hwaccel, rx->security_idx, +- &rx->tkip_iv32, +- &rx->tkip_iv16); ++ &rx->tkip.iv32, ++ &rx->tkip.iv16); + if (res != TKIP_DECRYPT_OK) + return RX_DROP_UNUSABLE; + +@@ -552,6 +553,8 @@ ieee80211_crypto_ccmp_decrypt(struct iee + } + + memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN); ++ if (unlikely(ieee80211_is_frag(hdr))) ++ memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN); + } + + /* Remove CCMP header and MIC */ +@@ -782,6 +785,8 @@ ieee80211_crypto_gcmp_decrypt(struct iee + } + + memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN); ++ if (unlikely(ieee80211_is_frag(hdr))) ++ memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN); + } + + /* Remove GCMP header and MIC */ diff --git a/package/kernel/mac80211/patches/subsys/387-mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch b/package/kernel/mac80211/patches/subsys/387-mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch new file mode 100644 index 0000000000..bc582a6cc2 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/387-mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch @@ -0,0 +1,62 @@ +From: Johannes Berg +Date: Tue, 11 May 2021 20:02:49 +0200 +Subject: [PATCH] mac80211: prevent attacks on TKIP/WEP as well + +Similar to the issues fixed in previous patches, TKIP and WEP +should be protected even if for TKIP we have the Michael MIC +protecting it, and WEP is broken anyway. + +However, this also somewhat protects potential other algorithms +that drivers might implement. + +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2284,6 +2284,7 @@ ieee80211_rx_h_defragment(struct ieee802 + * next fragment has a sequential PN value. + */ + entry->check_sequential_pn = true; ++ entry->is_protected = true; + entry->key_color = rx->key->color; + memcpy(entry->last_pn, + rx->key->u.ccmp.rx_pn[queue], +@@ -2296,6 +2297,9 @@ ieee80211_rx_h_defragment(struct ieee802 + sizeof(rx->key->u.gcmp.rx_pn[queue])); + BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != + IEEE80211_GCMP_PN_LEN); ++ } else if (rx->key && ieee80211_has_protected(fc)) { ++ entry->is_protected = true; ++ entry->key_color = rx->key->color; + } + return RX_QUEUED; + } +@@ -2337,6 +2341,14 @@ ieee80211_rx_h_defragment(struct ieee802 + if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) + return RX_DROP_UNUSABLE; + memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); ++ } else if (entry->is_protected && ++ (!rx->key || !ieee80211_has_protected(fc) || ++ rx->key->color != entry->key_color)) { ++ /* Drop this as a mixed key or fragment cache attack, even ++ * if for TKIP Michael MIC should protect us, and WEP is a ++ * lost cause anyway. ++ */ ++ return RX_DROP_UNUSABLE; + } + + skb_pull(rx->skb, ieee80211_hdrlen(fc)); +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -455,7 +455,8 @@ struct ieee80211_fragment_entry { + u16 extra_len; + u16 last_frag; + u8 rx_queue; +- bool check_sequential_pn; /* needed for CCMP/GCMP */ ++ u8 check_sequential_pn:1, /* needed for CCMP/GCMP */ ++ is_protected:1; + u8 last_pn[6]; /* PN of the last fragment if CCMP was used */ + unsigned int key_color; + }; diff --git a/package/kernel/mac80211/patches/subsys/388-mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch b/package/kernel/mac80211/patches/subsys/388-mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch new file mode 100644 index 0000000000..9a0b78def1 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/388-mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch @@ -0,0 +1,94 @@ +From: Johannes Berg +Date: Tue, 11 May 2021 20:02:50 +0200 +Subject: [PATCH] mac80211: do not accept/forward invalid EAPOL frames + +EAPOL frames are used for authentication and key management between the +AP and each individual STA associated in the BSS. Those frames are not +supposed to be sent by one associated STA to another associated STA +(either unicast for broadcast/multicast). + +Similarly, in 802.11 they're supposed to be sent to the authenticator +(AP) address. + +Since it is possible for unexpected EAPOL frames to result in misbehavior +in supplicant implementations, it is better for the AP to not allow such +cases to be forwarded to other clients either directly, or indirectly if +the AP interface is part of a bridge. + +Accept EAPOL (control port) frames only if they're transmitted to the +own address, or, due to interoperability concerns, to the PAE group +address. + +Disable forwarding of EAPOL (or well, the configured control port +protocol) frames back to wireless medium in all cases. Previously, these +frames were accepted from fully authenticated and authorized stations +and also from unauthenticated stations for one of the cases. + +Additionally, to avoid forwarding by the bridge, rewrite the PAE group +address case to the local MAC address. + +Cc: stable@vger.kernel.org +Co-developed-by: Jouni Malinen +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2541,13 +2541,13 @@ static bool ieee80211_frame_allowed(stru + struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; + + /* +- * Allow EAPOL frames to us/the PAE group address regardless +- * of whether the frame was encrypted or not. ++ * Allow EAPOL frames to us/the PAE group address regardless of ++ * whether the frame was encrypted or not, and always disallow ++ * all other destination addresses for them. + */ +- if (ehdr->h_proto == rx->sdata->control_port_protocol && +- (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || +- ether_addr_equal(ehdr->h_dest, pae_group_addr))) +- return true; ++ if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol)) ++ return ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || ++ ether_addr_equal(ehdr->h_dest, pae_group_addr); + + if (ieee80211_802_1x_port_control(rx) || + ieee80211_drop_unencrypted(rx, fc)) +@@ -2572,8 +2572,28 @@ static void ieee80211_deliver_skb_to_loc + cfg80211_rx_control_port(dev, skb, noencrypt); + dev_kfree_skb(skb); + } else { ++ struct ethhdr *ehdr = (void *)skb_mac_header(skb); ++ + memset(skb->cb, 0, sizeof(skb->cb)); + ++ /* ++ * 802.1X over 802.11 requires that the authenticator address ++ * be used for EAPOL frames. However, 802.1X allows the use of ++ * the PAE group address instead. If the interface is part of ++ * a bridge and we pass the frame with the PAE group address, ++ * then the bridge will forward it to the network (even if the ++ * client was not associated yet), which isn't supposed to ++ * happen. ++ * To avoid that, rewrite the destination address to our own ++ * address, so that the authenticator (e.g. hostapd) will see ++ * the frame, but bridge won't forward it anywhere else. Note ++ * that due to earlier filtering, the only other address can ++ * be the PAE group address. ++ */ ++ if (unlikely(skb->protocol == sdata->control_port_protocol && ++ !ether_addr_equal(ehdr->h_dest, sdata->vif.addr))) ++ ether_addr_copy(ehdr->h_dest, sdata->vif.addr); ++ + /* deliver to local stack */ + if (rx->list) + #if LINUX_VERSION_IS_GEQ(4,19,0) +@@ -2617,6 +2637,7 @@ ieee80211_deliver_skb(struct ieee80211_r + if ((sdata->vif.type == NL80211_IFTYPE_AP || + sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && + !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && ++ ehdr->h_proto != rx->sdata->control_port_protocol && + (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { + if (is_multicast_ether_addr(ehdr->h_dest) && + ieee80211_vif_get_num_mcast_if(sdata) != 0) { diff --git a/package/kernel/mac80211/patches/subsys/389-mac80211-extend-protection-against-mixed-key-and-fra.patch b/package/kernel/mac80211/patches/subsys/389-mac80211-extend-protection-against-mixed-key-and-fra.patch new file mode 100644 index 0000000000..17809263e9 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/389-mac80211-extend-protection-against-mixed-key-and-fra.patch @@ -0,0 +1,68 @@ +From: Wen Gong +Date: Tue, 11 May 2021 20:02:51 +0200 +Subject: [PATCH] mac80211: extend protection against mixed key and + fragment cache attacks + +For some chips/drivers, e.g., QCA6174 with ath10k, the decryption is +done by the hardware, and the Protected bit in the Frame Control field +is cleared in the lower level driver before the frame is passed to +mac80211. In such cases, the condition for ieee80211_has_protected() is +not met in ieee80211_rx_h_defragment() of mac80211 and the new security +validation steps are not executed. + +Extend mac80211 to cover the case where the Protected bit has been +cleared, but the frame is indicated as having been decrypted by the +hardware. This extends protection against mixed key and fragment cache +attack for additional drivers/chips. This fixes CVE-2020-24586 and +CVE-2020-24587 for such cases. + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1 + +Cc: stable@vger.kernel.org +Signed-off-by: Wen Gong +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +--- + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2239,6 +2239,7 @@ ieee80211_rx_h_defragment(struct ieee802 + unsigned int frag, seq; + struct ieee80211_fragment_entry *entry; + struct sk_buff *skb; ++ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); + + hdr = (struct ieee80211_hdr *)rx->skb->data; + fc = hdr->frame_control; +@@ -2297,7 +2298,9 @@ ieee80211_rx_h_defragment(struct ieee802 + sizeof(rx->key->u.gcmp.rx_pn[queue])); + BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != + IEEE80211_GCMP_PN_LEN); +- } else if (rx->key && ieee80211_has_protected(fc)) { ++ } else if (rx->key && ++ (ieee80211_has_protected(fc) || ++ (status->flag & RX_FLAG_DECRYPTED))) { + entry->is_protected = true; + entry->key_color = rx->key->color; + } +@@ -2342,13 +2345,19 @@ ieee80211_rx_h_defragment(struct ieee802 + return RX_DROP_UNUSABLE; + memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); + } else if (entry->is_protected && +- (!rx->key || !ieee80211_has_protected(fc) || ++ (!rx->key || ++ (!ieee80211_has_protected(fc) && ++ !(status->flag & RX_FLAG_DECRYPTED)) || + rx->key->color != entry->key_color)) { + /* Drop this as a mixed key or fragment cache attack, even + * if for TKIP Michael MIC should protect us, and WEP is a + * lost cause anyway. + */ + return RX_DROP_UNUSABLE; ++ } else if (entry->is_protected && rx->key && ++ entry->key_color != rx->key->color && ++ (status->flag & RX_FLAG_DECRYPTED)) { ++ return RX_DROP_UNUSABLE; + } + + skb_pull(rx->skb, ieee80211_hdrlen(fc)); diff --git a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch index 5d5dcd51ad..eb967f77d7 100644 --- a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch +++ b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch @@ -87,7 +87,7 @@ CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd) --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h -@@ -1403,6 +1403,7 @@ struct ieee80211_local { +@@ -1390,6 +1390,7 @@ struct ieee80211_local { int dynamic_ps_forced_timeout; int user_power_level; /* in dBm, for all interfaces */ From 43e4ba586336383b34698a00d4588a17b853922f Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Mon, 10 May 2021 12:36:42 +0200 Subject: [PATCH 12/18] mt76: update to the latest version Includes fix for CVE-2020-24588 186af01047b2 mt76: mt7921: introduce MCU_EVENT_LP_INFO event parsing 93b5c28c97d5 mt76: mt7921: add rcu section in mt7921_mcu_tx_rate_report a8e89c5a1d1f mt76: testmode: add support to send larger packet a0cc9a9e3877 mt76: mt7915: rework mt7915_tm_set_tx_len() c8b96630324e mt76: mt7915: fix rate setting of tx descriptor in testmode 22fd2958c42a mt76: mt7615: fix memleak when mt7615_unregister_device() 7401e0db3143 mt76: mt7915: fix memleak when mt7915_unregister_device() c3656268b3f6 mt76: mt7915: only free skbs after mt7915_dma_reset() when reset happens 0ce955b04ba8 mt76: mt7615: only free skbs after mt7615_dma_reset() when reset happens b03d1e62acf7 mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() 5ac02e22fb03 mt76: flush tx status queue on DMA reset c71f609b398a mt76: sync with upstream changes 23ecadd4af77 mt76: mt7615: fix hardware error recovery for mt7663 57a899ee3c3c mt76: mt7615: fix entering driver-own state on mt7663 42a2dddb706b mt76: mt7615: load ROM patch before checking patch semaphore status cf0e406af84a mt76: mt7915: add support for applying pre-calibration data 459940ccbc58 mt76: mt7921: move hw configuration in mt7921_register_device 0a094b11f3c0 mt76: improve mcu error logging bf536832e37d mt76: mt7921: run mt7921_mcu_fw_log_2_host holding mt76 mutex 7616f4f78163 mt76: mt7921: add wifisys reset support in debugfs e620bd881ef5 mt76: mt7921: abort uncompleted scan by wifi reset e8dacf59ab1c mt76: mt7915: rework the flow of txpower setting c8c78e577236 mt76: mt7915: directly read per-rate tx power from registers 1622bf4f8705 mt76: mt7921: add mt7921_dma_cleanup in mt7921_unregister_device ef96fafad8a9 mt76: Convert to DEFINE_SHOW_ATTRIBUTE 90e4bfea2948 mt76: mt7921: do not use 0 as NULL pointer 0a139d7f5966 mt76: connac: move mcu_update_arp_filter in mt76_connac module de26c73ce3c2 mt76: mt7921: remove leftover function declaration 1c0b6cb4f942 mt76: mt7921: fix a race between mt7921_mcu_drv_pmctrl and mt7921_mcu_fw_pmctrl 2923e3e2b8e4 mt76: mt7663: fix a race between mt7615_mcu_drv_pmctrl and mt7615_mcu_fw_pmctrl 74d0fdaa7a99 mt76: connac: introduce wake counter for fw_pmctrl synchronization 28c87e09a5ea mt76: mt7921: rely on mt76_connac_pm_ref/mt76_connac_pm_unref in tx path 36f664edc7db mt76: mt7663: rely on mt76_connac_pm_ref/mt76_connac_pm_unref in tx path 51b3d1a9a2b7 mt76: dma: add the capability to define a custom rx napi poll routine 4f1339c9fb72 mt76: mt7921: rely on mt76_connac_pm_ref/mt76_connac_pm_unref in tx/rx napi 1bc5e67a60be mt76: mt7663: rely on mt76_connac_pm_ref/mt76_connac_pm_unref in tx/rx napi 325f7b451c03 mt76: connac: unschedule ps_work in mt76_connac_pm_wake 12115052a02f mt76: connac: check wake refcount in mcu_fw_pmctrl e5d28e3cef66 mt76: connac: remove MT76_STATE_PM in mac_tx_free 475112a3cdcc mt76: mt7921: get rid of useless MT76_STATE_PM in mt7921_mac_work 112998f32d85 mt76: connac: alaways wake the device before scanning 4334f3e2fc43 mt76: mt7615: rely on pm refcounting in mt7615_led_set_config 0562380659ad mt76: connac: do not run mt76_txq_schedule_all directly acfa78df5708 mt76: connac: use waitqueue for runtime-pm ca74a4cd0722 mt76: remove MT76_STATE_PM in tx path 0c2d3e74852e mt76: mt7921: add awake and doze time accounting 45e0eefffe9f mt76: mt7921: enable sw interrupts fd2ff641166f mt76: mt7615: Fix a dereference of pointer sta before it is null checked 7e2521468767 mt76: mt7921: move mt7921_dma_reset in dma.c c9dd6b1fa171 mt76: mt7921: introduce mt7921_wpdma_reset utility routine 2ac7c7e9c568 mt76: mt7921: introduce mt7921_dma_{enable,disable} utilities 662a89f2b9d1 mt76: mt7921: introduce mt7921_wpdma_reinit_cond utility routine 614efe9e9180 mt76: connac: introduce mt76_connac_mcu_set_deep_sleep utility 0dbb16ef39d8 mt76: mt7921: enable deep sleep when the device suspends 3c19f569cc70 mt76: mt7921: fix possible invalid register access ade1f5aad4c6 mt76: move token_lock, token and token_count in mt76_dev 8d5c456be1ff mt76: move token utilities in mt76 common module fb04d9df5e52 mt76: mt7915: do not read rf value from efuse in flash mode 2126b2176336 mt76: mt7921: get rid of mcu_reset function pointer d325b7eff1b1 mt76: mt7921: improve doze opportunity 2ae25c7e547e mt76: mt7663: add awake and doze time accounting 349bbb9d6f13 mt76: connac: unschedule mac_work before going to sleep 98a235004dea mt76: mt7921: mt7921_stop should put device in fw_own state 63d80b9ab251 mt76: mt7921: introduce mt7921_mcu_sta_add routine 3c5bf837fdbd mt76: mt7615: fix a precision vs width bug in printk ded14da5eacc mt76: mt7915: fix a precision vs width bug in printk aaf0d254f9ea mt76: mt7921: fix a precision vs width bug in printk 757af5c67d32 mt76: move mt76_token_init in mt76_alloc_device ed41ed73a495 mt76: mt7921: reinit wpdma during drv_own if necessary 92fb81e085c6 mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report 53d915a23bc9 mt76: connac: do not schedule wake_work if the runtime-pm is disabled 23fe1bdcf15a mt76: connac: do not schedule mac_work if the device is not running e5b19336c58e mt76: mt7615: do not set MT76_STATE_PM at bootstrap 0fc2136a61dd mt76_connac_mcu: move mt76_connac_mcu_update_arp_filter outside of CONFIG_PM e693f3e23e06 mt76: mt7915: add MSI support 5231e7300fa4 mt7915: disable ASPM 554b50dabf54 mt76: connac: fix uninitialized HT A-MPDU setting field in STA_REC_PHY 43b9c0a838bb mt76: mt7921: fix max aggregation subframes setting 5a387a0a3004 mt76: mt7921: enable rx hw de-amsdu c8cbcb87be07 mt76: connac: add missing configuration in mt76_connac_mcu_wtbl_hdr_trans_tlv 55921e57b380 mt76: mt7921: enable rx header traslation offload 01441f67d8b2 mt76: mt7921: enable rx csum offload c9ab76dd93a0 mt76: mt7915: move mt7915_queue_rx_skb to mac.c caedb4c4ee41 mt76: mt7615: fix fixed-rate tx status reporting c6ae95d43e6d mt76: improve tx status codepath 27d468d094e6 mt76: mt7915: rework tx rate reporting 3b4ca5b09e2c mt76: mt7615: avoid use of ieee80211_tx_info_clear_status e1f07d7f1cb9 mt76: mt7603: avoid use of ieee80211_tx_info_clear_status 18513ba5fbc2 mt76: mt7915: add support for tx status reporting 35f189cf81b2 mt76: mt7915: fix uninitialized variable in MSI error handling 9e928ac1ea9b mt76: dma: use ieee80211_tx_status_ext to free packets when tx fails 628eee9c386c mt76: fill queue entry wcid for all skbs with a station a9bc4d94b7a1 mt76: intialize tx queue entry wcid to 0xffff by default 998ca8af7d17 mt76: mt7915: fix tssi indication field of DBDC NICs 7dd24b3cfacf mt76: mt7915: fix a signedness bug in mt7915_mcu_apply_tx_dpd() 535025d65d8d mt76: mt7915: cleanup mt7915_mcu_sta_rate_ctrl_tlv() ff8bbe22dd87 mt76: mt7915: add .set_bitrate_mask() callback c7dd54a22e30 mt76: connac: skip wtbl reset on sta disconnect 3511fd430356 mt76: validate rx A-MSDU subframes aedc3145de6e mt76: fix possible NULL pointer dereference in mt76_tx 5c2baab92cd0 mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb() af21659ee834 mt76: mt76x0: use dev_debug instead of dev_err for hw_rf_ctrl e423c16f16f7 mt76: mt7615: free irq if mt7615_mmio_probe fails f2d0da8da9b7 mt76: mt7663: enable hw rx header translation d2713a5d9de9 mt76: mt7921: fix mt7921_wfsys_reset sequence ce5f32d84f33 mt76: mt7921: Don't alter Rx path classifier 8ab8c7747197 mt76: connac: fw_own rely on all packet memory all being free a747b0bb4956 mt76: mt7921: enable deep sleep at runtime 2e6e999509b1 mt76: mt7921: add deep sleep control to runtime-pm knob 30bcb2338ce2 mt76: connac: fix WoW with disconnetion and bitmap pattern 56518f4a126e mt76: mt7921: consider the invalid value for to_rssi e969ab10a034 mt76: mt7921: add back connection monitor support 28b162366d09 mt76: fix calling mt76_get_of_eeprom with an offset for pre-cal data 9d736545bb5a mt76: mt7915: disable pre-calibration support for now Signed-off-by: Felix Fietkau (cherry-picked from commit f62aa9e7816fd0601a7997d87c89767939a6afcf) --- package/kernel/mt76/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile index e9e95fa9b3..5104c3ec53 100644 --- a/package/kernel/mt76/Makefile +++ b/package/kernel/mt76/Makefile @@ -8,9 +8,9 @@ PKG_LICENSE_FILES:= PKG_SOURCE_URL:=https://github.com/openwrt/mt76 PKG_SOURCE_PROTO:=git -PKG_SOURCE_DATE:=2021-04-11 -PKG_SOURCE_VERSION:=bf45b30d891961dd7c4139dddb58b909ea2c2b5a -PKG_MIRROR_HASH:=431cecf80dafa986e805f809522721c2bb26289867d6770695d49baf8b471bea +PKG_SOURCE_DATE:=2021-05-15 +PKG_SOURCE_VERSION:=9d736545bb5ac9707e60b7900b7d6b290492e24d +PKG_MIRROR_HASH:=8fd98f488579c18cfd8c442cff1796dcd70e2ecbc59c5d5b92ee8c0f06efafcf PKG_MAINTAINER:=Felix Fietkau PKG_BUILD_PARALLEL:=1 From dee89d42ede83fbd4f554a027635ecd04dec1e23 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Tue, 23 Feb 2021 13:16:23 +0000 Subject: [PATCH 13/18] procd: update to git HEAD 2be57ed cosmetics: provide compatible system info on Aarch64 37eed13 system: expose if system was booted from initramfs Signed-off-by: Daniel Golle (cherry-picked from commit 5f1bd952785e3257199879248e0b82216757b0b6) --- package/system/procd/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile index fff9faa1bf..30d5adf427 100644 --- a/package/system/procd/Makefile +++ b/package/system/procd/Makefile @@ -12,9 +12,9 @@ PKG_RELEASE:=$(AUTORELEASE) PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git -PKG_SOURCE_DATE:=2021-02-08 -PKG_SOURCE_VERSION:=08938fe1cbc06eeaafa39448057368391d165272 -PKG_MIRROR_HASH:=efc3deac56057e929789d44742858b2a16d976f6bfa0a2036e413d10afcaeee4 +PKG_SOURCE_DATE:=2021-02-23 +PKG_SOURCE_VERSION:=37eed131e9967a35f47bacb3437a9d3c8a57b3f4 +PKG_MIRROR_HASH:=2b0131ff9055ccf987cbeb5f36c2c2585dc780999df6be312fbbbcd61ce676d4 CMAKE_INSTALL:=1 PKG_LICENSE:=GPL-2.0 From f9b0215e282c8d8a0e6b0f64d450fb0e77132d03 Mon Sep 17 00:00:00 2001 From: Piotr Dymacz Date: Sun, 16 May 2021 23:48:04 +0200 Subject: [PATCH 14/18] ramips: fix SUPPORTED_DEVICES for ALFA Network devices Vendor firmware expects model name without manufacturer name inside 'supported_devices' part of metadata. This allows direct upgrade to OpenWrt from vendor's GUI. Signed-off-by: Piotr Dymacz (cherry picked from commit cf3f1f82eaa95c72b3b2620c6da15a81f8d57ba7) --- target/linux/ramips/image/mt7620.mk | 3 +++ target/linux/ramips/image/mt7621.mk | 1 + target/linux/ramips/image/mt76x8.mk | 1 + 3 files changed, 5 insertions(+) diff --git a/target/linux/ramips/image/mt7620.mk b/target/linux/ramips/image/mt7620.mk index f8905ad2b7..949c09662f 100644 --- a/target/linux/ramips/image/mt7620.mk +++ b/target/linux/ramips/image/mt7620.mk @@ -33,6 +33,7 @@ define Device/alfa-network_ac1200rm DEVICE_VENDOR := ALFA Network DEVICE_MODEL := AC1200RM DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci uboot-envtools + SUPPORTED_DEVICES += ac1200rm endef TARGET_DEVICES += alfa-network_ac1200rm @@ -43,6 +44,7 @@ define Device/alfa-network_r36m-e4g DEVICE_MODEL := R36M-E4G DEVICE_PACKAGES := kmod-i2c-ralink kmod-usb2 kmod-usb-ohci uboot-envtools \ uqmi + SUPPORTED_DEVICES += r36m-e4g endef TARGET_DEVICES += alfa-network_r36m-e4g @@ -53,6 +55,7 @@ define Device/alfa-network_tube-e4g DEVICE_MODEL := Tube-E4G DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci uboot-envtools uqmi -iwinfo \ -kmod-rt2800-soc -wpad-basic-wolfssl + SUPPORTED_DEVICES += tube-e4g endef TARGET_DEVICES += alfa-network_tube-e4g diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk index a55f9bceb7..a8f558326d 100644 --- a/target/linux/ramips/image/mt7621.mk +++ b/target/linux/ramips/image/mt7621.mk @@ -111,6 +111,7 @@ define Device/alfa-network_quad-e4g DEVICE_MODEL := Quad-E4G DEVICE_PACKAGES := kmod-ata-ahci kmod-sdhci-mt7620 kmod-usb3 uboot-envtools \ -wpad-basic-wolfssl + SUPPORTED_DEVICES += quad-e4g endef TARGET_DEVICES += alfa-network_quad-e4g diff --git a/target/linux/ramips/image/mt76x8.mk b/target/linux/ramips/image/mt76x8.mk index 7ba2acacb8..315d4f8d74 100644 --- a/target/linux/ramips/image/mt76x8.mk +++ b/target/linux/ramips/image/mt76x8.mk @@ -34,6 +34,7 @@ define Device/alfa-network_awusfree1 DEVICE_VENDOR := ALFA Network DEVICE_MODEL := AWUSFREE1 DEVICE_PACKAGES := uboot-envtools + SUPPORTED_DEVICES += awusfree1 endef TARGET_DEVICES += alfa-network_awusfree1 From 003fbfbf94083da5b9419a3d784223e322a82e86 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sat, 15 May 2021 00:00:39 +0200 Subject: [PATCH 15/18] openwrt-keyring: Only copy sign key for 21.02 Instead of adding all public signature keys from the openwrt-keyring repository only add the key which is used to sign the OpenWrt 21.02 feeds. If one of the other keys would be compromised this would not affect users of 21.02 release builds. Signed-off-by: Hauke Mehrtens --- package/system/openwrt-keyring/Makefile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/package/system/openwrt-keyring/Makefile b/package/system/openwrt-keyring/Makefile index 6f3aa65622..390144e4be 100644 --- a/package/system/openwrt-keyring/Makefile +++ b/package/system/openwrt-keyring/Makefile @@ -3,7 +3,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openwrt-keyring -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/keyring.git @@ -32,7 +32,8 @@ Build/Compile= define Package/openwrt-keyring/install $(INSTALL_DIR) $(1)/etc/opkg/keys/ - $(INSTALL_DATA) $(PKG_BUILD_DIR)/usign/* $(1)/etc/opkg/keys/ + # Public usign key for 21.02 release builds + $(INSTALL_DATA) $(PKG_BUILD_DIR)/usign/2f8b0b98e08306bf $(1)/etc/opkg/keys/ endef $(eval $(call BuildPackage,openwrt-keyring)) From b62fa7453a864c555fbae0ea78cb76e27d0a0a96 Mon Sep 17 00:00:00 2001 From: Baptiste Jonglez Date: Thu, 13 May 2021 19:50:22 +0200 Subject: [PATCH 16/18] busybox: disable PREFER_IPV4_ADDRESS PREFER_IPV4_ADDRESS is broken on IPv6-only hosts, as it causes busybox utilities (ping, traceroute, ntpd) to forcibly use the A record instead of the AAAA record when resolving a DNS name. This obviously fails when there is no IPv4 connectivity. Since IPv6-only hosts or routers will only become more common over time, disable PREFER_IPV4_ADDRESS to support this use-case. As a side-effect, disabling PREFER_IPV4_ADDRESS changes the default resolution behaviour of busybox utilities on dual-stack hosts. Busybox utilities now simply use the order given by getaddrinfo(), so they will now prefer IPv6 addresses when resolving a name with both A and AAAA records if there is IPv6 connectivity. This is in line with RFC 6724. PREFER_IPV4_ADDRESS was likely intended to work around naive implementations of getaddrinfo() that could return AAAA records first, even on an IPv4-only host. But both musl (since 1.1.3) and glibc correctly implement RFC 6724 for getaddrinfo() and check connectivity to determine the correct order in which to return records. On IPv4-only hosts, getaddrinfo() will return A records first, so there is no need for the PREFER_IPV4_ADDRESS hack. See also: https://bugs.busybox.net/show_bug.cgi?id=12381 Fixes: FS#84 Fixes: FS#2608 References: https://github.com/openwrt/openwrt/pull/4167 Signed-off-by: Alexander Traud Signed-off-by: Baptiste Jonglez (cherry picked from commit 7fea9d9f5dd282a7049d77cc6b75e0a703ead26c) --- package/utils/busybox/Config-defaults.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/utils/busybox/Config-defaults.in b/package/utils/busybox/Config-defaults.in index 04148df267..168c73b24c 100644 --- a/package/utils/busybox/Config-defaults.in +++ b/package/utils/busybox/Config-defaults.in @@ -2192,7 +2192,7 @@ config BUSYBOX_DEFAULT_FEATURE_UNIX_LOCAL default n config BUSYBOX_DEFAULT_FEATURE_PREFER_IPV4_ADDRESS bool - default y + default n config BUSYBOX_DEFAULT_VERBOSE_RESOLUTION_ERRORS bool default y From bc2225fe734373e76ace10d7f70ff93993b7f29d Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sat, 3 Apr 2021 19:04:53 +0200 Subject: [PATCH 17/18] uclient: update to Git version 2021-04-03 83efca2 tests: fix possibly longer start of HTTP server 64e00d6 uclient-fetch: document missing options Signed-off-by: Hauke Mehrtens (cherry picked from commit 1371910b76f021486810b18f371b3dc528d952ea) --- package/libs/uclient/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libs/uclient/Makefile b/package/libs/uclient/Makefile index 43d00a2299..419aff15e1 100644 --- a/package/libs/uclient/Makefile +++ b/package/libs/uclient/Makefile @@ -5,9 +5,9 @@ PKG_RELEASE=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/uclient.git -PKG_MIRROR_HASH:=532016a283722f21dd450e388060af0db765972956eee288c7cabf102c8303d0 -PKG_SOURCE_DATE:=2020-12-10 -PKG_SOURCE_VERSION:=2c843b2bc04c34403d9a6b4de025447e4b5d8aa4 +PKG_MIRROR_HASH:=b0f6ee3bc8e63e8408338c6ff4f214f2f83997a57802062401bdc82931ba9b73 +PKG_SOURCE_DATE:=2021-04-03 +PKG_SOURCE_VERSION:=64e00d6db4c3fc98ec3e8526072abadb7ed9ec0e CMAKE_INSTALL:=1 PKG_BUILD_DEPENDS:=ustream-ssl From bbbc01ede5ee8d7f8e3c13fd37504ead5f42fe56 Mon Sep 17 00:00:00 2001 From: Baptiste Jonglez Date: Fri, 14 May 2021 23:40:40 +0200 Subject: [PATCH 18/18] uclient: update to Git version 2021-05-14 6a6011d uclient-http: set eof mark when content-length is 0 19571e4 tests: fix help usage test for uclient built with sanitizer c5fc04b tests: fix help usage test Signed-off-by: Baptiste Jonglez (cherry picked from commit 1ec6fc4dcba16045a6bfcc493bdbe892de1265a9) --- package/libs/uclient/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libs/uclient/Makefile b/package/libs/uclient/Makefile index 419aff15e1..398a27bb98 100644 --- a/package/libs/uclient/Makefile +++ b/package/libs/uclient/Makefile @@ -5,9 +5,9 @@ PKG_RELEASE=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/uclient.git -PKG_MIRROR_HASH:=b0f6ee3bc8e63e8408338c6ff4f214f2f83997a57802062401bdc82931ba9b73 -PKG_SOURCE_DATE:=2021-04-03 -PKG_SOURCE_VERSION:=64e00d6db4c3fc98ec3e8526072abadb7ed9ec0e +PKG_MIRROR_HASH:=7c443cac02a734dd312c65618f4de17248d188317f30a9fac192c1503b3d5c05 +PKG_SOURCE_DATE:=2021-05-14 +PKG_SOURCE_VERSION:=6a6011df3429ffa5958d12b1327eeda4fd9daa47 CMAKE_INSTALL:=1 PKG_BUILD_DEPENDS:=ustream-ssl