git.openwrt.org Git - openwrt/staging/hauke.git/log

firewall: config: remove restictions on DHCPv6 allow rule

Remove restrictions on source and destination addresses, which aren't
specified on RFC8415, and for some reason in openwrt are configured
to allow both link-local and ULA addresses.
As cleared out in issue #5066 there are some ISPs that use Gloabal
Unicast addresses, so fix this rule to allow them.

Fixes: #5066
Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
[rebase onto firewall3, clarify subject, bump PKG_RELEASE]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 65258f5d6093809c541050256646795bc0a460a9)

fstools: update to git HEAD

9e11b37 fstools: remove SELinux restorecon hack

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 4509b790f09183b2ac757371f6d79052f232e4cd)

procd: update to git HEAD

652e6df init: restore SELinux labels after policy is loaded

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit fb011118664756ee33bf16a39bf6e73d02cc2d3f)

base-files: simplify restorecon logic

Remove forgotten redundant selinuxenabled call and skip the whole
thing in case $IPKG_INSTROOT is set as labels are anyway applied only
later on in fakeroot when squashfs is created.

Fixes: 6d7272852e ("base-files: add missing $IPKG_INSTROOT to restorecon call")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 7b07c3cff57f057d6780d34adeb23c06123732db)

selinux-policy: update to version 1.1

try to clean up some labeling inconsistencies
iwinfo loose ends
ucode loose ends
Makefile: adjust mintesttgt (adds blockmount/blockd)
nftables: reads inherited netifd pipe
ucode: reads inherited netifd pipes
mountroot: fowner
sandbox: writes inherited dropbear pipes
unbound related to /tmp/etc/ssl
unbound loose ends
adds a sslconftmpfile for /tmp/etc/ssl
README: maintain a wish list in the README
iwinfo: netifd forgot write
gptfdisk loose ends
iwinfo: netifd wpad reads/writes inherited netifd fifo files
netifd (mac80211.sh) executes iwinfo
luci: executes wireguard
luci-cgi: audits xtables execute access
rcuhttpd: lists ssl certfile dirs
iwinfo, wifi,nftables usage of ttyd pty if available
urandomseed: seedrng needs cap_sys_admin
iwinfo iwinfo, nftables and some chronyd rules related to ntp nts server
nftables, wifi and adds iwinfo skel
nftables, rpcd, ucode
nftables, ucode and seedrng ucode, fw3/nftables, luci
adds ucode skel and some fw3/nftables related
urandomseed: some seedrng rules
fw3 adds some support for fw4
urandomseed: /etc/seedrng is for seed.credit
hotplugcal: runs ucode which is interpreter like
adds a nftables skeleton and makes xtables optional
agent: allow all agents to write inherited dropbear pipes
urandomseed: this seems to be replaced by seedrng
kmodloader: label /etc/modules.conf kmodloader.conffile
Revert "shelexecfile: remove auditallow rule"
Makefile: sort the modules to process by secilc
Moves back to git.defensec.nl
unbound odhcpd (ip) reads net proc
tcp dump
shelexecfile: remove auditallow rule
rrd.cil: fixes indent
Target rddtool from cgi-io instead of runnit it without transition
rrd.cil related
rrd, rpcd, cgiio clean ups related to luci-app-statistics
Rules for rrd files and luci-statistics
unboundcontrol ordering
Several missing permissions
blockmount, dnsmasq, hotplugcall, rpcd, unbound
adds mctp_socket (linux 5.15)
ip: forgot tc-tiny type transition to go along with the fc spec
ip: adds a fc spec for tc-tiny (called by sqm)
adds ttyACM fc spec and various assorted loose ends
.gitattributes: do not export the github workflows
workflow use selinux 3.3

project moved back to https://git.defensec.nl/selinux-policy.git

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
(cherry picked from commit 43794570986e33770d9039399d16a665f6c7c495)

base-files: add missing $IPKG_INSTROOT to restorecon call

Update to overlooked v2 version of Dominick Grift's patch.

Fixes: 5109bd164c ("base-files: address sed in-place without SELinux awareness")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 6d7272852e0b2634b2fa93a131ea8659ec87f079)

base-files: address sed in-place without SELinux awareness

sed(1) in busybox does not support this functionality:
https://git.savannah.gnu.org/cgit/sed.git/tree/sed/execute.c#n598

This causes /etc/group to become mislabeled when a package requests
that a uid/gid be added on OpenWrt with SELinux

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[move restorecon inside lock]
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
(cherry picked from commit 5109bd164c8f2273329483f990188fb36cf3ad68)

fstools: update to git HEAD

f0fc66a libfstools: check for overlay mounting errors
128ecaf Update / fix extroot comments
8a0ba3b libfstools: get rid of "extroot_prefix" global variable
649cd3f libfstools: use variable for overlay mount-point
922f1b3 libfstools: avoid segfault in find_mount_point
ce5eacb libfstools: mtd: improve error handling
898b328 blockd: restore device_move semantics
0917d22 block: don't probe mtdblock on NAND (with legacy exceptions)

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 4e8d095013fb822eaa4fd6b4512a434fc17ac901)

ipq40xx: fix BDF file for pcie wifi chip on the GL.Inet GL-B2200

After the switch to pre-calibration, ath10k would fail to initialize
the PCIE Wi-Fi on the GL-B200 as follows:

ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142)
ath10k_pci 0000:01:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[...]
ath10k_pci 0000:01:00.0: failed to fetch board data for bus=pci,bmi-chip-id=0,bmi-board-id=16,variant=GL-B2200 from ath10k/QCA9888/hw2.0/board-2.bin
ath10k_pci 0000:01:00.0: failed to fetch board-2.bin or board.bin from ath10k/QCA9888/hw2.0
ath10k_pci 0000:01:00.0: failed to fetch board file: -12
ath10k_pci 0000:01:00.0: could not probe fw (-12)

Repackage the BDF file after renaming relevant fields and files to
allow for the Wi-Fi interface to start again.

Fixes: 80d34d9d593 ("ipq40xx: document pcie wifi chip on the GL.Inet GL-B2200")
CC: Christian Lamparter <chunkeey@gmail.com>
CC: Robert Marko <robimarko@gmail.com>
Reviewed-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
(cherry picked from commit e3f9af4fb6e4ba8bf54cb4240f318ad32260a6fa)

kernel: bump 5.10 to 5.10.113

All patches automatically rebased.

Build system: x86_64
Build-tested: bcm2711/RPi4B, mt7622/RT3200
Run-tested: bcm2711/RPi4B, mt7622/RT3200

Signed-off-by: John Audia <graysky@archlinux.us>
(cherry picked from commit e08942e76a162962892020a0f7e52ef751ec68e4)

kernel: bump 5.10 to 5.10.112

Manually rebased:
ath79/patches-5.10/901-phy-mdio-bitbang-prevent-rescheduling-during-command.patch

All other patches automatically rebased.

Build system: x86_64
Build-tested: bcm2711/RPi4B, mt7622/RT3200
Run-tested: bcm2711/RPi4B, mt7622/RT3200

Signed-off-by: John Audia <graysky@archlinux.us>
(cherry picked from commit cab20be008591f89dd89c4e444cdf022fa7f57eb)

f2fs-tools: fix resize.f2fs (#9800)

resolve issue
- https://github.com/openwrt/openwrt/issues/9800
add the upstream patch:
- f2fs-tools.git/patch/?id=f056fbeff08d30a6d9acdb9e06704461ceee3500

Signed-off-by: Kerma Gérald <gandalf@gk2.net>
(cherry picked from commit 1aac1b36d3cf44c8bfa8d4a6d8df6e815fc06529)

ath79: add USB power control for GL-AR300M series

Add USB power control in DTS for GL.iNet models:
- AR300M;
- AR300M-Ext;
- AR300M16;
- AR300M16-Ext.

Signed-off-by: PtilopsisLeucotis <PtilopsisLeucotis@yandex.com>
(cherry picked from commit 6e9c814022e41a7cfa4db3b1a41e257fd1515bea)

mpc85xx: Fix output location of padded dtb

In commit 7e614820a892 ("mpc85xx: add support for Extreme Networks
WS-AP3825i"), we borrowed a recipe convention from apm821xx for device
tree blob padding. Unfortunately, in the apm821xx target, the image
recipes name the device tree blob differently, meaning that in
mpc85xx, the padded dtb is never consumed.

Change the definition of `Build/dtb` so that it outputs the padded dtb
to the correct location for it to be consumed.

Also, rename the recipe to `Build/pad-dtb`, so it is clear we
are building and padding the device tree blob.

This change fixes Github issue #9779 [1].

[1]: https://github.com/openwrt/openwrt/issues/9779

Fixes: 7e614820a892 ("mpc85xx: add support for Extreme Networks WS-AP3825i")
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
(cherry picked from commit 1d06277407d3e294589ecde46328303a9f3803fd)

build: don't remove BUILD_LOG_DIR in _clean

targetclean should not remove BUILD_LOG

Fixes: db34b93331e9 (add a version that can be bumped to force toolchain/target rebuild)
Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
(cherry picked from commit aeaa816cd2bd22de165c71a41d8d198a9235e971)

dnsmasq: add logfacility file to jail mounts

If logfacility is a path to a file it needs to be r/w mounted in the
sandbox as well for dnsmasq to work.

Reported-by: @iointerrupt
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 2b5fa44f60165d66d74131778df0b64b706887e2)

ath79: ubnt: drop swconfig on ac-{lite,lr,mesh}

These don't have switches that could be configured using swconfig.

Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
(cherry picked from commit 089eb02abcd7512c6d182953560eb2453ef144ca)

bcm63xx: fix description fix name case

The `Description` should be capital.

Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
(cherry picked from commit b8ed98b10004d5de25c1b4b2d2b59b15fc04f794)

ath79: ZTE MF286R: add comgt-ncm to DEVICE_PACKAGES

When adding support to the router's built-in modem, this required
package was omitted, because it was already enabled in the image
configuration in use for testing, and this went unnoticed.
In result, the modem still isn't fully supported in official images.
As it is the primary WAN interface, add the missing package.

Fixes: e02fb42c53ba ("comgt: support ZTE MF286R modem")
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
(cherry picked from commit 8a1003c5986514d7a78f78b3ee94003837d82582)

ramips: zbt-wg2626: Add the reset gpio for PCIe port 1

The 2.4GHz interface doesn't come up properly with the log showing:

mt7621-pci 1e140000.pcie: pcie1 no card, disable it (RST & CLK)

As seen on other MT7621 boards this is caused by a missing reset GPIO.
The MT7621 dtsi set GPIO 19 as PCIe reset GPIO, which on this board
reset the 5GHz interface on port 0. Add GPIO 8 to the PCIe reset GPIO
list to also reset the 2.4GHz interface on port 1.

Signed-off-by: Alban Bedel <albeu@free.fr>
(cherry picked from commit f953a1a4bfba2fa70c12bb80938aa66481a673b6)

ipq40xx: 5.10: fix ar40xx driver

This commit is completely based on the work of adron-s:
https://github.com/openwrt/openwrt/pull/4721#issuecomment-1101108651

The commit fixes the data corruption on TX packets. Packets are
transmitted, but their contents are replaced with zeros. This error is
caused by the lack of guard (50 ms) intervals between calibration phases.
This error is treated by adding mdelay(50) to the calibration function
code. In the original qca-ssda code [0], these mdelays were existing, but
in the ar41xx.c they are gone.

Tested on:
- Fritz!Box 4040
- Fritz!Box 7530
- Mikrotik SXTsq 5AC
- ZyXEL NBG6617

- [0] https://git.codelinaro.org/clo/qsdk/oss/lklm/qca-ssdk/-/blob/NHSS.QSDK.11.4/src/init/ssdk_init.c#L2072

Suggested-by: Serhii Serhieiev <adron@mstnt.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit ab7e53e5cce703c7a62efbe1d41fb94c2228a178)

ucode: reorder BuildPackage calls

Ensure that the libucode recipe is processed before the ucode one in
order to reliably encode the ABI version into ucode's libucode dependency.

Fixes: #9788
Ref: https://forum.openwrt.org/t/fw4-wont-start-after-upgrade/126308
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 573ce80ca612b0f642b7cbd5d9d33d89b7e96670)

iwinfo: update to latest HEAD

dc6847e iwinfo: nl80211: omit A-hwmode on non-5GHz hardware

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f757a8a09885e3c8bb76371e037b8c0731111980)

uboot-envtools: add WS-AP3825i config

Add configuration to use uboot-envtools with the Extreme Networks
WS-AP3825i.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit fb7ff6b027d1c69e97e6d39e688a969c164065c8)

mpc85xx: set WS-AP3825i mac-address in preinit

The bootloader does seem to not correctly patch in the MAC address for
eth0 / eth1 in some cases. While the root cause is not known, manually
applying the MAC-Address in preinit does not hurt.

Reported-by: Tom Herbers <freifunk@tomherbers.de>
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit c6d52515e009d96e0afbe77310bf172f113d0eef)

mpc85xx: define reset-delay for WS-AP3825i eth PHY

The WS-AP3825i uses Atheros PHYs which according to the datasheet
require the reset to be asserted for at least 1 ms.

This fixes broken eth1 upon soft-reboot. eth0 is no affected, as the
ifup / ifdown cycle in preinit prevents this issue from happening when
the system is ready.

Reported-by: Tom Herbers <freifunk@tomherbers.de>
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 8b3c313515c1ae37be9d61a4e92c4bf4b43f605f)

firewall4: update to latest Git HEAD

fc83d46 ruleset: set auto-merge directive for interval sets
9bce873 fw4: fix skipping invalid ipset entries
425ea8a fw4: fix applying zone flags for source bound rules
a378883 fw4: fix emitting family specific redirect rules without any addrs
11feddf fw4: bracketize IPv6 addresses in dnat addr:port notation
9972f7d fw4: ensure to capitalize weekday names
fde8070 treewide: forward compatibility changes

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commits 1a35ac99905adc35059489d6e19c7de42ef4cc01 and
af02a12d7ccb64a3abbd9683dd22275b538f6d50)

ucode: update to latest Git HEAD

e14b099 syntax: implement support for ES6 template literals
111cf06 vm: stop executing bytecode on return of nested calls
33f1e0b treewide: move json-c compat shims into internal header file
e0e9431 vm: move unhandled exception reporting out of `uc_vm_execute_chunk()`
2b59140 vm: fix callframe double free on unhanded exceptions
7d7e950 main: abort when failing to load a preload library
1032a67 lib: let `json()` accept input objects implementing `read()` method
5ee68d5 fs: implement `fs.readfile()` and `fs.writefile()`
df6b861 ci: debian: change path before attempting to invoke Git operations
dfaf05a ci: debian: automatically update changelog from Git tag
34f3c45 ci: fix YAML syntax of Debian workflow
e956bcf fs: fix off-by-one in fs.dirname() function
6fc4b6c .gitignore: fix overmatching patterns, blacklist cram .venv
7c2e082 build: remove legacy json-c check
77942af build: add polyfills for older libjson-c versions
0b4aaa3 CI: build Debian package
f404285 debian: Add package definition
a37f654 types: fix escape sequence encoding of high byte values in JSON strings
aae5312 Update README.md
8134e25 build: fix symlink install target
87c7296 treewide: replace some leftover "utpl" occurrences, update .gitignore
7d27ad5 build: only stage ucc symlink if compile support is enabled
171402f lib: add date and time related functions
8b5dc60 lib: provide API function to obtain stdlib function implementations
eb0d2f1 main: turn ucode into multicall executable
28ee7e1 uloop: add support for tasks
753dea9 CI: build on macOS
668c5c0 lib: add argument position support (`%m$`) to `sprintf()` and `printf()`
ab46fdf treewide: remove legacy json-c include directives
b8f49b1 tests: 21_regex_literals: generalize syntax error test case
fd2e5e7 tests: 16_sort: fix logic flaw exposed on OS X
2c71bf2 tests: run_tests.sh: pass dummy value to `-T` flag
55c4a90 lib: disallow zero padding for %s formats
0d05cb5 tests: run_tests.sh: use greadlink if available
271e520 resolv: make OS X compatible
d13c320 fs: avoid Linux specific sys/sysmacros.h include on OS X
33397a3 uloop: use execvp() on OS X
bafdc8f lib: add naive sigtimedwait() stub for OS X
ada1585 build: consolidate CMakeLists.txt and cover OS X deviations
befbb69 include: add OS X compatible endian.h header
49838a8 include: rename include guards to avoid clashes with system headers
91f65de nl80211: add missing attributes and correct some attribute flags
b4a1fd5 lib: adjust require(), render() and include() raw mode semantics
4618807 main: rework CLI frontend
73dcd78 lib: fix potential integer underflow on empty render output
c402551 vm: fix crash on object literals with non-string computed properties
efe8a02 syntax: support add new operators
078d686 ubus: add event support
6c66c83 ubus: refactor error and argument handling
1cb04f9 ubus: add object publishing, notify and subscribe support
0e85974 uloop: clear errno before integer conversion attempts
05bd7ed types: treat resource type prototypes as GC roots
a2a26ca lib: introduce uloop binding
6b6d01f vm: release this context on exception in managed method call
1af23a9 tests: fix proto() testcase
4ce69a8 fs: implement access(), mkstemp(), file.flush() and proc.flush()

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commits cef3e6a69c4751189e946cf2ff0e00304f9fff6e,
0400774a1001835b912ecf2097bba1306deba9f8 and
c59704334c4a01bc18ab489f86d4ca7d2ea3cb8f)

iwinfo: update to latest HEAD

a479b9b devices: remove whitespace
562d015 iwinfo: nl80211: fix hwmode parsing for multi-band NICs

Signed-off-by: David Bauer <mail@david-bauer.net>

uboot-mediatek: remove '0x' prefix from pstore node

Remove '0x' prefix from pstore node in dts, just like it was done
for the device tree used by Linux on MT7622.
This change is done in preparation to update U-Boot to 2022.04.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 810b48e79389a54b9b332fa2834360602a9734f3)

mediatek: mt7622: remove '0x' prefix from pstore address in dts

Adresses of device tree nodes are typically noted without the '0x'
prefix. While having the '0x' prefix doesn't hurt when using Linux,
more recent versions of U-Boot will add a duplicate ramoops node as a
simple string compare is used to check if the node is already present.

Remove the '0x' prefix to avoid the kernel warning resulting from
U-Boot adding a dupplicate pstore/ramoops node.

See also https://lists.denx.de/pipermail/u-boot/2022-April/481810.html

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit fc245338d6e02e61fa7ecbd1a828aed97cdbef88)

OpenWrt v22.03.0-rc1: revert to branch defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

OpenWrt v22.03.0-rc1: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

wolfssl: fix compilation with /dev/crypto

This is trivial fix of a duplicate definition of 'int ret'.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>

kernel: add missing config symbols

MPLS feature symbols are normally only set when kmod-mpls is enabled, but the
CONFIG_MPLS symbol they depend on could also have been selected by openvswitch
instead

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 92add80414c2f39ba8fd0d221d0f37e75fb19951)

netfilter: move nf-log modules into separate packages

Both legacy iptables and nftables require nf-log modules for rule logging,
so move them into a separate package both firewall implementations can
depend on.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit bea01fa57f5c9c333138bbbc5c9f83b9d7553fb5)

toolchain: Update glibc 2.34 to recent HEAD

This adds the following changes:

31186e2cb7 elf: Sort tests and modules-names
511b244cc5 elf: Add a comment after trailing backslashes
de6cdd6875 elf/Makefile: Reflow and sort most variable assignments
948ebc098e Fix glibc 2.34 ABI omission (missing GLIBC_2.34 in dynamic loader)
b952c25dc7 x86: Black list more Intel CPUs for TSX [BZ #27398]
aa601d0244 x86: Use CHECK_FEATURE_PRESENT to check HLE [BZ #27398]
e09e7b1492 support: Add support_socket_so_timestamp_time64
e098446037 linux: Fix ancillary 64-bit time timestamp conversion (BZ #28349, BZ#28350)
489d0b8b32 Linux: Only generate 64 bit timestamps for 64 bit time_t recvmsg/recvmmsg
008003dc6e tst-socket-timestamp-compat.c: Check __TIMESIZE [BZ #28837]
05c83ccaf5 linux: __get_nprocs_sched: do not feed CPU_COUNT_S with garbage [BZ #28850]
ad615b59c7 Linux: Simplify __opensock and fix race condition [BZ #28353]
d8302ba2da hurd if_index: Explicitly use AF_INET for if index discovery
6eaf10cbb7 socket: Do not use AF_NETLINK in __opensock
0351c75c5f linux: Fix missing __convert_scm_timestamps (BZ #28860)
d64b08d5ba Add reference to BZ#28860 on NEWS
007e054d78 linux: fix accuracy of get_nprocs and get_nprocs_conf [BZ #28865]
04d60ce0f2 string: Add a testcase for wcsncmp with SIZE_MAX [BZ #28755]
38e0d24794 x86: Fallback {str|wcs}cmp RTM in the ncmp overflow case [BZ #28896]
d093b677c3 x86: Test wcscmp RTM in the wcsncmp overflow case [BZ #28896]
15b00d2af0 x86: Fix TEST_NAME to make it a string in tst-strncmp-rtm.c
d5d1c95aaf NEWS: Add a bug fix entry for BZ #28896
852361b5a3 localedef: Handle symbolic links when generating locale-archive
3be79b72d5 Fix elf/tst-audit2 on hppa
c6f9085ee4 hppa: Fix swapcontext
f610d2935f hppa: Revise gettext trampoline design
40fc6a74ee nptl: Fix cleanups for stack grows up [BZ# 28899]
6c9c230765 hppa: Fix warnings from _dl_lookup_address
b5032c3d37 io: Add fsync call in tst-stat
b53f0c11de nss: Do not mention NSS test modules in <gnu/lib-names.h>
54b1273395 nss: Protect against errno changes in function lookup (bug 28953)
c82bdf033f Don't add access size hints to fortifiable functions
0e6ebf06e4 Make sure that the fortified function conditionals are constant
536910724d debug: Add tests for _FORTIFY_SOURCE=3
98ea9372cc __glibc_unsafe_len: Fix comment
10f7bdebe5 fortify: Fix spurious warning with realpath
d6a58bd81d Enable _FORTIFY_SOURCE=3 for gcc 12 and above
f8c2f620f1 debug: Autogenerate _FORTIFY_SOURCE tests
224d8c1890 debug: Synchronize feature guards in fortified functions [BZ #28746]
738ee53f0c hppa: Implement swapcontext in assembler (bug 28960)
d53b9cc391 hppa: Use END instead of PSEUDO_END in swapcontext.S
4b5b8a1cdf powerpc: Delete unneeded ELF_MACHINE_BEFORE_RTLD_RELOC
b19de59d62 elf: Avoid nested functions in the loader [BZ #27220]
c6df39a0bd elf: Fix elf_get_dynamic_info definition
b868b45f67 elf: Fix dynamic-link.h usage on rtld.c
f6a54a3042 elf: Fix elf_get_dynamic_info() for bootstrap
a31bbe3242 elf: Move LAV_CURRENT to link_lavcurrent.h
e25fe99213 elf: Move la_activity (LA_ACT_ADD) after _dl_add_to_namespace_list() (BZ #28062)
ce0cb6d1d2 elf: Add _dl_audit_objopen
66e9d27a09 elf: Add _dl_audit_activity_map and _dl_audit_activity_nsid
ec0fc2a153 elf: Add _dl_audit_objsearch
198660741b elf: Add _dl_audit_objclose
b2d99731b6 elf: Add _dl_audit_symbind_alt and _dl_audit_symbind
31473c273b elf: Add _dl_audit_preinit
fd9c4e8a1b elf: Add _dl_audit_pltenter
a8e211daea elf: Add _dl_audit_pltexit
29496b3103 elf: Avoid unnecessary slowdown from profiling with audit (BZ#15533)
02c6a3d353 elf: Add audit tests for modules with TLSDESC
d1b9bee29a elf: Issue audit la_objopen for vDSO
2255621f0e elf: Do not fail for failed dlmopen on audit modules (BZ #28061)
98047ba95c elf: Add la_activity during application exit
efb21b5fb2 elf: Fix initial-exec TLS access on audit modules (BZ #28096)
056fc1c0e3 elf: Issue la_symbind for bind-now (BZ #23734)
b118bce87a elf: Fix runtime linker auditing on aarch64 (BZ #26643)
165e7ad459 Fix elf/tst-audit25a with default bind now toolchains
aabdad371f elf: Replace tst-audit24bmod2.so with tst-audit24bmod2
4dca2d3a7b hppa: Fix bind-now audit (BZ #28857)
ceed89d089 NEWS: Update fixed bug list for LD_AUDIT backports.
0c03cb54c8 S390: Add new s390 platform z16.
290db09546 nptl: Handle spurious EINTR when thread cancellation is disabled (BZ#29029)
5d8c777634 hurd: Fix arbitrary error code
b87b697f15 mips: Fix mips64n32 64 bit time_t stat support (BZ#29069)

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 0b5a3234369395e886c2902d4b6a490c4ea91634)

ramips: add support for OrayBox X3A

OrayBox X3A is a 2.4/5GHz dual band AC router, based on MediaTek MT7621.

Specification:
* SoC: MT7621
* RAM: DDR3 128 MiB
* Flash: 16 MiB NOR (XM25Q128)
* Wi-Fi: (single chip hosting both 2.4G and 5G)
  * 2.4GHz: MT7615
  * 5GHz: MT7615
* Ethernet: 3x 1000Mbps
  * Switch: MT7530
* LED:
  * Ethernet LEDs: On the back of the router, hardware-controlled.
  * Status LEDs: One "pixel-like" RGB LED in the front of the router,
                 which is actually made up of 3 individual LEDs (with
                 dedicated GPIO pins) with the color of Red, Green,
                 and Blue.
                 The OEM firmware only lights up one color at a time to
                 indicate status, but that's very boring, and the colors
                 actually look great when combined, so I've improvised a
                 little and made them indicate netdev activities.
                 My test results:
                 GPIO 13/14/15
                 000 white (actually more like bright green or cyan
                            because the brightness of the green LED is
                            higher than red and blue)
                 001 bright purple
                 010 bright green
                 011 red
                 100 bright cyan
                 101 blue
                 110 green
                 111 off

Flash Layout:
0x0000000-0x0030000 : "u-boot"
0x0030000-0x0040000 : "u-boot-env"
0x0040000-0x0050000 : "factory"
0x0050000-0x0f50000 : "firmware"
/*0x0f50000 to 0x0fe0000 is undefined, same as OEM firmware*/
0x0fe0000-0x0ff0000 : "bdinfo"
0x0ff0000-0x1000000 : "reserve"

MAC address:
MAC               Source                          Description    Fix
A0:CX:XX:BX:XX:0D BDINFO_9                        LAN(LABEL)     DTS
A0:CX:XX:BX:XX:0E BDINFO_9 + 1                    WAN            DTS
A2:CX:XX:BX:XX:0F FACTORY_4                       WIFI2G         DTS
A2:CX:XX:CX:XX:0F SETBIT 7 (FACTORY_4 + 0x100000) WIFI5G         HOTPLUG
A6:CX:XX:BX:XX:0F N/A                             WIFI2G_CLIENT  N/A
A6:DX:XX:BX:XX:0F N/A                             WIFI5G_CLIENT  N/A

Stock dmesg:
https://pastebin.com/2t2jwLdf

Stock Dumps:
https://pastebin.com/LDLxSWX3

Installation via SSH (does not void your warranty):
1.  -----UNLOCK SSH-----
1.1 Set computer IP to DHCP mode, load 'http://10.168.1.1/cgi-bin/luci' in
    your browser. Password is 'admin'.
1.2 Click the "备份且导出" (backup and export) button, and download the
    config file.
1.3 Open the downloaded file with 7zip, navigate to '/etc/config/'.
1.4 Edit the file './system'. Change the '0' into '1' under
    "config sys 'ssh'".
1.5 Save the file.
1.6 Upload the file by clicking the "导入且恢复" (import and recover)
    button. The router will automatically reboot.
2.  -----FLASH THE OPENWRT FIRMWARE-----
2.1 Use any scp tool to upload the 'sysupgrade' firmware to the '/tmp/'
    folder to your router. It should be root@10.168.1.1 and the password
    is 'admin'.
2.2 SSH into the router, also root@10.168.1.1 and the password is 'admin'.
2.3 **IMPORTANT** Type command 'dd if=/dev/mtd3 of=/tmp/firmware.bin', to
    backup the stock firmware. Since the OEM does not provide firmware
    download on their website, this is the only way to get it.
2.3 **ALSO IMPORTANT** Use any scp tool to download your backed-up stock
    firmware from '/tmp/' to your local drive. Then you'd better use a hex
    reading tool to have a rough look at it to make sure nothing is
    corrupt. Or u can just back up again and cross check the MD5.
2.4 Type command 'mtd write /tmp/XXX.bin firmware', and it should flash
    the firmware.
2.5 Verify that nothing went wrong. If you're confident, type 'reboot' and
    reboot the router.

Revert to stock firmware:
1.  load stock firmware using mtd (make sure u have a backup).

Signed-off-by: Ray Wang <raywang777@foxmail.com>
(cherry picked from commit 9a750aae62de74b488d7df7bdbfa78cd606a8aaf)

realtek: add ZyXEL GS1900-24HP v1 support

The ZyXEL GS1900-24HP v1 is a 24 port PoE switch with two SFP ports,
similar to the other GS1900 switches.

Specifications
--------------
* Device:    ZyXEL GS1900-24HP v1
* SoC:       Realtek RTL8382M 500 MHz MIPS 4KEc
* Flash:     16 MiB
* RAM:       Winbond W9751G8KB-25 64 MiB DDR2 SDRAM
* Ethernet:  24x 10/100/1000 Mbps, 2x SFP 100/1000 Mbps
* LEDs:
  * 1 PWR LED (green, not configurable)
  * 1 SYS LED (green, configurable)
  * 24 ethernet port link/activity LEDs (green, SoC controlled)
  * 24 ethernet port PoE status LEDs
  * 2 SFP status/activity LEDs (green, SoC controlled)
* Buttons:
  * 1 "RESET" button on front panel (soft reset)
  * 1 button ('SW1') behind right hex grate (hardwired power-off)
* PoE:
  * Management MCU: ST Micro ST32F100 Microcontroller
  * 6 BCM59111 PSE chips
  * 170W power budget
* Power:     120-240V AC C13
* UART:      Internal populated 10-pin header ('J5') providing RS232;
             connected to SoC UART through a TI or SIPEX 3232C for voltage
             level shifting.

* 'J5' RS232 Pinout (dot as pin 1):
  2) SoC RXD
  3) GND
  10) SoC TXD

Serial connection parameters: 115200 8N1.

Installation
------------

OEM upgrade method:

* Log in to OEM management web interface

* Navigate to Maintenance > Firmware > Management

* If "Active Image" has the first option selected, OpenWrt will need to be
  flashed to the "Active" partition. If the second option is selected,
  OpenWrt will need to be flashed to the "Backup" partition.

* Navigate to Maintenance > Firmware > Upload

* Upload the openwrt-realtek-rtl838x-zyxel_gs1900-24hp-v1-initramfs-kernel.bin
  file by your preferred method to the previously determined partition.
  When prompted, select to boot from the newly flashed image, and reboot
  the switch.

* Once OpenWrt has booted, scp the sysupgrade image to /tmp and flash it:

  > sysupgrade /tmp/openwrt-realtek-rtl838x-zyxel_gs1900-24hp-v1-squashfs-sysupgrade.bin

U-Boot TFTP method:

* Configure your client with a static 192.168.1.x IP (e.g. 192.168.1.10).

* Set up a TFTP server on your client and make it serve the initramfs
  image.

* Connect serial, power up the switch, interrupt U-boot by hitting the
  space bar, and enable the network:

  > rtk network on

* Since the GS1900-24HP v1 is a dual-partition device, you want to keep the
  OEM firmware on the backup partition for the time being. OpenWrt can
  only be installed in the first partition anyway (hardcoded in the
  DTS). To ensure we are set to boot from the first partition, issue the
  following commands:

  > setsys bootpartition 0
  > savesys

* Download the image onto the device and boot from it:

  > tftpboot 0x81f00000 192.168.1.10:openwrt-realtek-rtl838x-zyxel_gs1900-24hp-v1-initramfs-kernel.bin
  > bootm

* Once OpenWrt has booted, scp the sysupgrade image to /tmp and flash it:

  > sysupgrade /tmp/openwrt-realtek-rtl838x-zyxel_gs1900-24hp-v1-squashfs-sysupgrade.bin

Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[Add info on PoE hardware to commit message]
Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit a5ac8ad0ba9df50bdd0dda1dc26cf36f83006893)

ath79: add support for Sophos AP100/AP55 family

The Sophos AP100, AP100C, AP55, and AP55C are dual-band 802.11ac access
points based on the Qualcomm QCA9558 SoC. They share PCB designs with
several devices that already have partial or full support, most notably the
Devolo DVL1750i/e.

The AP100 and AP100C are hardware-identical to the AP55 and AP55C, however
the 55 models' ART does not contain calibration data for their third chain
despite it being present on the PCB.

Specifications common to all models:
- Qualcomm QCA9558 SoC @ 720 MHz (MIPS 74Kc Big-endian processor)
- 128 MB RAM
- 16 MB SPI flash
- 1x 10/100/1000 Mbps Ethernet port, 802.3af PoE-in
- Green and Red status LEDs sharing a single external light-pipe
- Reset button on PCB[1]
- Piezo beeper on PCB[2]
- Serial UART header on PCB
- Alternate power supply via 5.5x2.1mm DC jack @ 12 VDC

Unique to AP100 and AP100C:
- 3T3R 2.4GHz 802.11b/g/n via SoC WMAC
- 3T3R 5.8GHz 802.11a/n/ac via QCA9880 (PCI Express)

AP55 and AP55C:
- 2T2R 2.4GHz 802.11b/g/n via SoC WMAC
- 2T2R 5.8GHz 802.11a/n/ac via QCA9880 (PCI Express)

AP100 and AP55:
- External RJ45 serial console port[3]
- USB 2.0 Type A port, power controlled via GPIO 11

Flashing instructions:

This firmware can be flashed either via a compatible Sophos SG or XG
firewall appliance, which does not require disassembling the device, or via
the U-Boot console available on the internal UART header.

To flash via XG appliance:
- Register on Sophos' website for a no-cost Home Use XG firewall license
- Download and install the XG software on a compatible PC or virtual
   machine, complete initial appliance setup, and enable SSH console access
- Connect the target AP device to the XG appliance's LAN interface
- Approve the AP from the XG Web UI and wait until it shows as Active
   (this can take 3-5 minutes)
- Connect to the XG appliance over SSH and access the Advanced Console
   (Menu option 5, then menu option 3)
- Run `sudo awetool` and select the menu option to connect to an AP via
   SSH. When prompted to enable SSH on the target AP, select Yes.
- Wait 2-3 minutes, then select the AP from the awetool menu again. This
   will connect you to a root shell on the target AP.
- Copy the firmware to /tmp/openwrt.bin on the target AP via SCP/TFTP/etc
- Run `mtd -r write /tmp/openwrt.bin astaro_image`
- When complete, the access point will reboot to OpenWRT.

To flash via U-Boot serial console:
- Configure a TFTP server on your PC, and set IP address 192.168.99.8 with
   netmask 255.255.255.0
- Copy the firmware .bin to the TFTP server and rename to 'uImage_AP100C'
- Open the target AP's enclosure and locate the 4-pin 3.3V UART header [4]
- Connect the AP ethernet to your PC's ethernet port
- Connect a terminal to the UART at 115200 8/N/1 as usual
- Power on the AP and press a key to cancel autoboot when prompted
- Run the following commands at the U-Boot console:
    - `tftpboot`
    - `cp.b $fileaddr 0x9f070000 $filesize`
    - `boot`
- The access point will boot to OpenWRT.

MAC addresses as verified by OEM firmware:

use   address     source
LAN   label       config 0x201a (label)
2g    label + 1   art 0x1002    (also found at config 0x2004)
5g    label + 9   art 0x5006

Increments confirmed across three AP55C, two AP55, and one AP100C.

These changes have been tested to function on both current master and
21.02.0 without any obvious issues.

[1] Button is present but does not alter state of any GPIO on SoC
[2] Buzzer and driver circuitry is present on PCB but is not connected to
    any GPIO. Shorting an unpopulated resistor next to the driver circuitry
    should connect the buzzer to GPIO 4, but this is unconfirmed.
[3] This external RJ45 serial port is disabled in the OEM firmware, but
    works in OpenWRT without additional configuration, at least on my
    three test units.
[4] On AP100/AP55 models the UART header is accessible after removing
    the device's top cover. On AP100C/AP55C models, the PCB must be removed
    for access; three screws secure it to the case.
    Pin 1 is marked on the silkscreen. Pins from 1-4 are 3.3V, GND, TX, RX

Signed-off-by: Andrew Powers-Holmes <andrew@omnom.net>
(cherry picked from commit 6f1efb28983758116a8ecaf9c93e1d875bb70af7)

ath79: add support for MikroTik RouterBOARD 962UiGS-5HacT2HnT (hAP ac)

This patch adds support for the MikroTik RouterBOARD 962UiGS-5HacT2HnT (hAP ac)

Specifications:
- SoC: QCA9558
- RAM: 128 MB
- Flash: 16 MB SPI
- 2.4GHz WLAN: 3x3:3 802.11n on SoC
- 5GHz WLAN: 3x3:3 802.11ac on QCA9880 connected via PCIe
- Switch: 5x 1000/100/10 on QCA8337 connected via RGMII
- SFP cage: connected via SGMII (tested with genuine & generic GLC-T)
- USB: 1x type A, GPIO power switch
- PoE: Passive input on Ether1, GPIO switched passthrough to Ether5
- Reset button
- "SFP" LED connected to SoC
- Ethernet LEDs connected to QCA8337 switch
- Green WLAN LED connected to QCA9880

Not working:
- Red WLAN LED

Installation:
TFTP boot initramfs image and then perform sysupgrade. Follow common
MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.

Signed-off-by: Ryan Mounce <ryan@mounce.com.au>
(cherry picked from commit c2140e32ce32b9cc60f7d408e20bdf45dce6a634)

ramips: add support for ASUS RT-AC1200-V2

Hardware specifications:
SoC: MT7628DAN MIPS_24KEc@580MHz 2.4G-n 2x2
WiFi: MT7613BEN 5G-ac 160MHz 2x2
Switch: 4x100M built-in SoC
Flash: 16MB W25Q128JVSQ SPI-NOR
DRAM: 64MB built-in SoC

MAC addresses as verified by OEM firmware:
use address source
Lan/Wan/2G *:60 factory 0x4 (label)
5G *:64 factory 0x8000

Serial console: 57600,8n1

Installation:

Asus windows recovery tool:

install the Asus firmware restoration utility
unplug the router, hold the reset button while powering it on
release when the power LED flashes slowly
specify a static IP on your computer:
IP address: 192.168.1.75
Subnet mask 255.255.255.0
start the Asus firmware restoration utility, specify the factory image
and press upload
do NOT power off the device after OpenWrt has booted until the LED flashing
after flashing OpenWrt, there will be first no 5GHz Wifi available probably,
wait until blinking finishes and do a reboot
TFTP Recovery method:

set computer to a static ip, 192.168.1.75
connect computer to the LAN 1 port of the router
hold the reset button while powering on the router for a few seconds
send firmware image using a tftp client; i.e from linux:
$ tftp
tftp> binary
tftp> connect 192.168.1.1
tftp> put factory.bin
tftp> quit
do NOT power off the device after OpenWrt has booted until the LED flashing
after flashing OpenWrt, there will be first no 5GHz Wifi available probably,
wait until blinking finishes and do a reboot

Signed-off-by: Tamas Balogh <tamasbalogh@hotmail.com>
(cherry picked from commit a4bf562aa71ad1e3dcffa392b79110d803a93f11)

ramips: add support for BOLT! Arion

This device is from now-defunct BOLT! ISP in Indonesia.
The original firmware is based on mediatek SDK running linux 2.6 or 3.x in later revision.

Specifications:

- SoC:      MediaTek MT7621
- Flash:    32 MiB NOR SPI
- RAM:      128 MiB DDR3
- Ethernet: 2x 10/100/1000 Mbps (switched, LAN + WAN)
- WIFI0:    MT7603E 2.4GHz 802.11b/g/n
- WIFI1:    MT7612E 5GHz 802.11ac
- Antennas: 2x internal, non-detachable
- LEDs:     Programmable LEDs: 5 blue LEDs (wlan, tel, sig1-3) and 2 red LEDs (wlan and sig1)
            Non-programmable "Power"  LED
- Buttons:  Reset and WPS

Instalation:
Install from TFTP

Set your PC IP to 10.10.10.3 and gateway to 10.10.10.123
Press "1" when turning on the router, and type the initramfs file name

You also need to solder pin header or cable to J4 or neighboring test points (T19-T21)
Pinouts from top to bottom: GND, TX, RX, VCC (3.3v)
Baudrate: 57600n8

There's also an additional gigabit transformer and RTL8211FD managed by the LTE module on the backside of the PCB.

Signed-off-by: Abdul Aziz Amar <abdulaziz.amar@gmail.com>
(cherry picked from commit 78c3534645958c123aa82cec9926a34eed5dd5dd)

ramips: add support for Wavlink WL-WN531A3

The Wavlink WL-WN531A3 is an AC1200 router with 5 fast ethernet ports
and one USB 2.0 port.
It's also known as Wavlink QUANTUM D4.

Hardware
--------
SoC:   Mediatek MT7628AN
RAM:   64MB
FLASH: 8MB NOR (GigaDevice GD25Q64CSIG3)
ETH:
  - 5x 10/100 Mbps Ethernet (4x LAN + 1x WAN)
WIFI:
  - 2.4GHz: 1x (integrated in SOC) (2x2:2)
  - 5GHz:   1x MT7612E (2x2:2)
  - 4 external antennas
BTN:
  - 1x Reset button
  - 1x WPS button
  - 1x Turbo button
  - 1x Touchlink button
  - 1x ON/OFF switch
LEDS:
  - 1x Red led (system status)
  - 1x Blue led (system status)
  - 7x Blue leds (wifi led + 5 ethernet ports + power)
USB:
  - 1x USB 2.0 port
UART:
  - 57600-8-N-1
    J1
      O VCC +3,3V (near lan ports)
      o RX
      o TX
      o GND

Everything works correctly.

Currently there is no firmware update available. Because of this, in
order to restore the OEM firmware, you must firstly dump the OEM
firmware from your router before you flash the OpenWrt image.

Backup the OEM Firmware
-----------------------
The following steps are to be intended for users having little to none
experience in linux. Obviously there are many ways to backup the OEM
firmware, but probably this is the easiest way for this router.
Procedure tested on M31A3.V4300.200420 firmware version.

1) Go to http://192.168.10.1/webcmd.shtml

2) Type the following line in the "Command" input box and then press enter:
mkdir /etc_ro/lighttpd/www/dev; cp /dev/mtd0ro /etc_ro/lighttpd/www/dev/mtd0ro; ls -la /etc_ro/lighttpd/www/dev/mtd0ro

3) After few seconds in the textarea should appear this output:
-rw-r--r--    1 0        0         8388608 /etc_ro/lighttpd/www/dev/mtd0ro

   If your output doesn't match mine, stop reading and ask for
   help in the forum.

4) Open in another tab http://192.168.10.1/dev/mtd0ro to download the
   content of the whole NOR. If the file size is 0 byte, stop reading
   and ask for help in the forum.

5) Come back to the http://192.168.10.1/webcmd.shtml webpage and type:
rm /etc_ro/lighttpd/www/dev/mtd0ro; for i in 1 2 3 4 ; do cp /dev/mtd${i}ro /etc_ro/lighttpd/www/dev/mtd${i}ro; done; ls -la /etc_ro/lighttpd/www/dev/

6) After few seconds, in the textarea should appear this output:
-rw-r--r--    1 0        0          196608 mtd1ro
-rw-r--r--    1 0        0           65536 mtd2ro
-rw-r--r--    1 0        0           65536 mtd3ro
-rw-r--r--    1 0        0         8060928 mtd4ro
drwxr-xr-x    7 0        0               0 ..
drwxr-xr-x    2 0        0               0 .

   If your output doesn't match mine, stop reading and ask for
   help in the forum.

7) Open the following links to download the partitions of the OEM FW:
http://192.168.10.1/dev/mtd1ro
http://192.168.10.1/dev/mtd2ro
http://192.168.10.1/dev/mtd3ro
http://192.168.10.1/dev/mtd4ro

   If one (or more) of these files are 0 byte, stop reading and ask
   for help in the forum.

8) Store these downloaded files in a safe place.

9) Reboot your router to remove any temporary file in ram.

Installation
------------
Flash the initramfs image in the OEM firmware interface
(http://192.168.10.1/update.shtml).
When Openwrt boots, flash the sysupgrade image otherwise you won't be
able to keep configuration between reboots.

Restore OEM Firmware
--------------------
Flash the "mtd4ro" file you previously backed-up directly from LUCI.
Warning: Remember to not keep settings!
Warning2: Remember to force the flash.

Notes
-----
1) Router mac addresses:
   LAN XX:XX:XX:XX:XX:9B (factory @ 0x28)
   WAN XX:XX:XX:XX:XX:9C (factory @ 0x2e)
   WIFI 2G XX:XX:XX:XX:XX:9D (factory @ 0x04)
   WIFI 5G XX:XX:XX:XX:XX:9E (factory @ 0x8004)

   LABEL XX:XX:XX:XX:XX:9D

2) There is just one wifi led for both wifi interfaces.
   It currently shows only the 2.4 GHz wifi activity.

Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
(cherry picked from commit bb505d82add5636da891bb97fdabc57947280e88)

Revert "kernel: backport MT7530 VLAN fix"

There are various reports on Github and in the forum that this commit
causes multiple problems.

This reverts commit ee6ba216d8ba1b02154c287e64d709a8bc7b0054.

Fixes: #9420
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
(cherry picked from commit 3e0daca6447c3d5b9eb6d24ecb8e52f256f385cc)

ath79: add support for MikroTik RouterBOARD wAP-2nD (wAP)

The MikroTik RouterBOARD wAP-2nd (sold as wAP) is a small
2.4 GHz 802.11b/g/n PoE-capable AP.

Specifications:
- SoC: Qualcomm Atheros QCA9533
- Flash: 16 MB (SPI)
- RAM: 64 MB
- Ethernet: 1x 10/100 Mbps (PoE in)
- WiFi: AR9531 2T2R 2.4 GHz (SoC)
- 3x green LEDs (1x lan, 1x wlan, 1x user)

See https://mikrotik.com/product/RBwAP2nD for more info.

Flashing:
TFTP boot initramfs image and then perform sysupgrade. Follow common
MikroTik procedure as in https://openwrt.org/toh/mikrotik/common.

Note: following 781d4bfb397cdd12ee0151eb66c577f470e3377d
The network setup avoids using the integrated switch and connects the
single Ethernet port directly. This way, link speed (10/100 Mbps) is
properly reported by eth0.

Signed-off-by: David Musil <0x444d@protonmail.com>
(cherry picked from commit e20de224427008e0f26161f924bc347d974fd15a)

mac80211: fix QCA9561 PA bias

This patch fixes an invalid TX PA DC bias level on QCA9561, which
results in a very low output power and very low throughput as devices
are further away from the AP (compared to other 2.4GHz APs),
following a suggestion from nbd[1].

This patch has been submitted upstream[2].

[1] https://lore.kernel.org/all/91c58969-c60e-2f41-00ac-737786d435ae@nbd.name
[2] https://lore.kernel.org/linux-wireless/20220417145145.1847-1-hacks+kernel@slashdirt.org/

Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit 7dc52a78ae2c2f748a0c0c4adcb13979260b3498)

mpc85xx: move Extreme WS-AP3825i GPIO extender

Move the GPIO extender to the SoC node. Otherwise, the legacy PowerPC
init code will not populate the BUS and thus never probe spi-gpio.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f0c09d0305835abc7bcc32285dc82c008159936d)

kernel: Remove patch for kernel 5.15

This patch was accidentally backported from master for kernel 5.15 too.
Remove the version for kernel 5.15 and keep the version for kernel 5.10.

Fixes: 9ab337dfbce7 ("kernel: backport pgalloc memory leak fix")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

readline: add host PIC

Python seems to fail to link to libreadline properly because of this.
Not a fatal error but an error nontheless.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b363f7488643882b9c53a1e2c6db2a110703cc1d)

kernel: bump 5.10 to 5.10.111

Removed upstreamed:
pending-5.10/850-0003-PCI-aardvark-Fix-support-for-MSI-interrupts.patch
apm821xx/patches-5.10/150-ata-sata_dwc_460ex-Fix-crash-due-to-OOB-write.patch

All other patches automatically rebased.

Build system: x86_64
Build-tested: bcm2711/RPi4B, mt7622/RT3200
Run-tested: bcm2711/RPi4B, mt7622/RT3200

Signed-off-by: John Audia <graysky@archlinux.us>
(cherry picked from commit 0085dd6cb5e3c57dd22994c22ce893575711b6f7)

linux-firmware: Update to version 20220411

The following files used in OpenWrt changed:
amd64-microcode/lib/firmware/amd-ucode/microcode_amd_fam17h.bin
amd64-microcode/lib/firmware/amd-ucode/microcode_amd_fam19h.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_sdma.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_smc.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/aldebaran_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/arcturus_sdma.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_dmcub.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_me.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_sdma.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_smc.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/beige_goby_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/cyan_skillfish2_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/cyan_skillfish2_me.bin
amdgpu-firmware/lib/firmware/amdgpu/cyan_skillfish2_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/cyan_skillfish2_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/cyan_skillfish2_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/dcn_3_1_6_dmcub.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_dmcub.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_me.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_sdma.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_smc.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/dimgrey_cavefish_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/gc_10_3_7_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/gc_10_3_7_me.bin
amdgpu-firmware/lib/firmware/amdgpu/gc_10_3_7_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/gc_10_3_7_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/gc_10_3_7_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/gc_10_3_7_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_dmcub.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_me.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/green_sardine_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_me.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/navi10_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/navi12_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/navi12_sdma.bin
amdgpu-firmware/lib/firmware/amdgpu/navi12_sdma1.bin
amdgpu-firmware/lib/firmware/amdgpu/navi12_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/navi12_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/navi12_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/navi14_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/navi14_smc.bin
amdgpu-firmware/lib/firmware/amdgpu/navi14_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/navi14_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/navi14_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_dmcub.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_me.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_sdma.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_smc.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/navy_flounder_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_me.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/picasso_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/psp_13_0_8_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/psp_13_0_8_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/psp_13_0_8_toc.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_me.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/raven2_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_me.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/raven_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_dmcub.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_me.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/renoir_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/sdma_5_2_7.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_dmcub.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_me.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_sdma.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_smc.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_sos.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_ta.bin
amdgpu-firmware/lib/firmware/amdgpu/sienna_cichlid_vcn.bin
amdgpu-firmware/lib/firmware/amdgpu/vangogh_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/vangogh_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/vangogh_me.bin
amdgpu-firmware/lib/firmware/amdgpu/vangogh_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/vangogh_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/vangogh_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/vega10_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/vega10_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/vega10_me.bin
amdgpu-firmware/lib/firmware/amdgpu/vega10_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/vega10_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/vega10_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/vega12_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/vega12_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/vega12_me.bin
amdgpu-firmware/lib/firmware/amdgpu/vega12_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/vega12_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/vega12_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/vega20_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/vega20_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/vega20_me.bin
amdgpu-firmware/lib/firmware/amdgpu/vega20_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/vega20_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/vega20_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_asd.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_ce.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_me.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_mec.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_mec2.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_pfp.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_rlc.bin
amdgpu-firmware/lib/firmware/amdgpu/yellow_carp_ta.bin
ibt-firmware/lib/firmware/intel/ibt-hw-37.8.10-fw-22.50.19.14.f.bseq
iwlwifi-firmware-ax210/lib/firmware/iwlwifi-ty-a0-gf-a0.pnvm
iwlwifi-firmware-iwl9260/lib/firmware/iwlwifi-9260-th-b0-jf-b0-46.ucode
iwlwifi-firmware-iwl9000/lib/firmware/iwlwifi-9000-pu-b0-jf-b0-46.ucode

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 54d9051c5596814293edd9e6a534c8d1e56e6fcf)

lantiq: fritz736x: Move GPIO resets to the inidvidual board.dts files

FRITZ!Box 7360 V2 and FRITZ!Box 7360 SL both use GPIOs 37 (for &phy0)
and GPIO 44 (for &phy1) to control the PHY's reset lines. FRITZ!Box 7362
SL however uses GPIO 45 (for &phy0) and GPIO 44 (for &phy1). Move the
GPIO reset definitions to each individual board .dts and while at it,
fix the GPIOs for the FRITZ!Box 7362 SL.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
(cherry picked from commit 56cd49bdc8ff762c52327ee7faa14cb99895e0fd)

comgt: support ZTE MF286R modem

The modem is based on Marvell PXA1826 and uses ACM+RNDIS interface to
establish connection with custom commands specific to ZTE modems.
Two variants of modems were discovered, some identifying themselves
as "ZTE", and others as plain "Marvell", the chipset manufacturer.
The modem itself runs a fork of OpenWrt inside, which root shell can be
accessed via ADB interface.

Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
(cherry picked from commit e02fb42c53bad5dd36726c6ef5a46bfe31d2e400)

comgt: ncm: try to detect interface for ttyACM ports

Some modems expose ttyACM as their control ports, which have the
"device" symlink pointing one level down in sysfs tree. Try to find
network interfaces for them as well, this is commonly used for modems
exposing ACM + RNDIS or ACM + ECM interface combinations.

Co-developed-by: Cezary Jackiewicz <cezary@eko.one.pl>
Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
(cherry picked from commit ed7957810c0aee04943559be9b0ed23431ee0654)

comgt: ncm: select first available network interface for device

Some modems expose multiple network interfaces on the same USB device,
causing the connection setup script to fail, because glob matching in
the detection phase causes 'ls' to output more than one interface name
plus their base directories in sysfs. Avoid that by listing the
directories explicitly and then selecting first available interface.
This is the case for some variants of ZTE MF286R built-in modem, which
exposes both RNDIS and CDC-ECM network interfaces, causing the
connection setup to fail.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
(cherry picked from commit b2940bb8b2878ce193f2edaee3e7d4c44f4a2065)

comgt: ncm: allow specification of interface name

Add ifname property to UCI, which can be used to override the
autodetected interface name in case the detection fails due to having
none or more than one interface exposed by the modem, which is not
explicitly linked to TTY port. This is needed on certain variants of ZTE
MF286R built-in modem, which exposes both RNDIS and CDC-ECM interfaces
on the modem, on which the automatic detection may select the wrong
network interface.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
(cherry picked from commit a67629bbe25ef3d0e159db1e0c6ca81affd06898)

kernel: backport ZTE RNDIS bogus MAC address fix

This is required to support built-in modem of ZTE MF286R, in addition to
other external modems, such as MF831, MF910, MF920, which refuse to
reconfigure their remote MAC address, even if "locally administered" bit
is set, leading to dropped traffic towards the host. Add a workaround
for that issue already present in cdc_ether to rndis_host driver as
well.

Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
(cherry picked from commit c99013e242682a71051619806f9cc4f4e51a58fa)

ipq806x: fix wrong CPU OPP for ipq8062

Fix wrong CPU OPP for ipq8062. Revision of the SoC added an
extra 25mV for every pvs. Also fix the voltage min/max value
that were wrong.

Reviewed-by: Robert Marko robimarko@gmail.com
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 3f0d87fd69b13f7d1fa06bdcc951a2896a0a9360)

ipq806x: fix USB bug in 5.10 dtsi additions

The existing device tree has incorrect definitions for usb3_0 and usb3_1
and the blocks they depend upon: their addresses and interrupts are
swapped. However, their clocks and resets are not. The result is that
the USB blocks are non-functional if only one of them is enabled.

This fix backports the definitions from mainline Linux 5.15 to
OpenWrt's 5.10 dtsi additions. See the relevant mainline code here:
https://github.com/torvalds/linux/blob/v5.17/arch/arm/boot/dts/qcom-ipq8064.dtsi#L1062-L1148

This fix does not break existing ports. But some ports may have enabled
both USB blocks even thought their board only implements one, because
enabling a single USB block would not have worked before this fix.
This means that revisiting all ports of ipq806x devices that implement
a single USB port is advised. This work must be done by maintainers that
can determine which USB block corresponds to the implemented port on
their hardware.

Note that this fix swaps the names of the hardware ports. This is
unfortunate, but will happen anyway when switching to kernel 5.15. Thus,
it is best to do this ASAP, before users get to depend on port names.

It is strongly recommended that this fix is backported to 22.03 before
its release. This will minimize the number of users affected by the port
name swap.

Signed-off-by: Rodrigo Balerdi <lanchon@gmail.com>
(cherry picked from commit 284f2c2ae0e569660effa61c9f8d0f6459a2ae19)

ipq806x: remove non-working fixes for USB bug in 5.10 dtsi additions

These workarrounds are incomplete and non-functional, and thus not needed.

Signed-off-by: Rodrigo Balerdi <lanchon@gmail.com>
(cherry picked from commit 3a4d972d43987e1ab0f697817c0f68d1a4a706dc)

build: target: improve UX of CONFIG_TARGET handling

Make it clear, that for `make kernel_{menu,old}config` it's possible to
use only following values for CONFIG_TARGET variable:

* env
* target
* subtarget
* subtarget_target

This should prevent misuse like `make kernel_menuconfig
CONFIG_TARGET=bcm2710` etc.

Keep support for obsolete `platform` and `subtarget_platform` targets
with deprecation notice so this compat stuff could be removed in the
future.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
Acked-by: Piotr Dymacz <pepe2k@gmail.com>
(cherry picked from commit 68e672f32df3d6b8a75534df5962ac99b693601b)

hostapd: add ubus link-measurements notifications

Notify external ubus subscribers of received link-measurement reports.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit f6445cfa1acb32676723c49da3e3158b64a4b3d2)

hostapd: add ubus method for requesting link measurements

Add a ubus method to request link-measurements from connected STAs.

In addition to the STAs address, the used and maximum transmit power can
be provided by the external process for the link-measurement. If they
are not provided, 0 is used as the default value.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 965aa33a18c76bb2d5a1eeb0cfa01501b08e784a)

hostapd: add support for enabling link measurements

Allow external processes to enable advertisement of link-measurement RRM
capability.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 2ca5c3da04c3f05a7477ae484768e03d4ca30711)

mpc85xx: overhaul WS-AP3825i LED setup

As the LED controller is working now, we can make good use of the LEDs
now.

- Drop the model-name prefix
- Rename eth0 / eth1 LEDs to LAN1 / LAN2, as they are labeled as such
on the casing
- Enable wired LEDs in userspace

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 9024f1e466f5ab64bc752d8a463d1867a2ba8d8e)

image: strip metadata from images when used in other artifacts

Image metadata and signature is of no use for images which are included
inside other artifacts (like an SD-card image). Strip them off before
using images in artifacts or stashing them for the ImageBuilder as the
contained signature breaks reproducibility.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 7a256d97d9ded84d1bfd531e775099774e7b6b06)

mtools: update to version 4.0.39

Improvements since the 4.0.38 release are:
- Rename strtoi to strosi (string to signed int). The strtoi
function on BSD does something else (returns an intmax, not
an int)

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 08ebc3881d3f351d2d4ca9202ca446c96b38a1e1)

scripts/gen_image_generic.sh: fix order of files in EFI bootfs

mtools recursive copy (mcopy -s ...) is using READDIR(3) to iterate
over the directory entries, hence they end up in the FAT filesystem in
traversal order which breaks reproducibility (rather than being added
to the FAT filesystem in a reproducible order). Implement recursive
copy in gen_image_generic.sh in Shell code instead, as in that way we
can force files to be copied in reproducible order.

Fixes: aece8f5ae8 ("scripts/gen_image_generic.sh: generate reproducible EFI filesystem")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 4d289ae7e63893f90957b77962c6b60574d35441)

netifd: relax check in dhcp proto handler

Checking whether /sbin/udhcpc is a symbolic link breaks using the
DHCP proto handler inside procd-ujail where bind-mounts are used for
the resolved link. Check whether /sbin/udhcpc is executable instead
to allow using the proto handler for DHCP-provisioned containers.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit c5f113c43f43c20555298c8500bf91bffbe1f58b)

procd: update to git HEAD

6343c3a procd: completely remove tmp-on-zram support
5c5e63f uxc: fix potential NULL-pointer dereference
eb03f03 jail: include necessary files for per-netns netifd instance

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 2c8873033e3c0b5a5e8f6080ea3a73fde6a55f39)

base-files: more robust sysupgrade on NAND

Make sure sysupgrade on NAND also works in case of UBI volumes having
index >9. While at it, also make sure UBI device is detected and abort
in case it isn't. Use Shell built-in shorthand ':' instead of 'true'.

Fixes #9708
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 0dbca1b2baf9c26514b517a1e5860f6a5b04d5ae)

scripts/gen_image_generic.sh: generate reproducible EFI filesystem

Generate FAT filesystem for EFI boot in a reproducible way:
* use '--invariant' option of mkfs.fat
* set timestamps of all files to SOURCE_DATE_EPOCH
* make sure files are ordered locale-independent

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit aece8f5ae8d15e5e79b8e34a176895209709afb6)

scripts/gen_image_generic.sh: make ext4 bootfs reproducible

Set fixed timestamp for kernel other files in /boot filesystem.
This should help making x86 *combined* images reproducible.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 068ea2cde04e2666fb05731cea941bccfaeddc25)

mediatek/mt7622: enable accelerated crypto drivers

Use ARMv8 Crypto Extensions for AES, ghash and sha256.

This results in a 16 times speed gain in speed for aes-128-ctr, 17x in
aes-128-gcm, and 9 times in sha256.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit c9c2b01b8441195807e8b492c7d3e385e6c6afdc)

ath79: add support for Yuncore A930

Specification:

- QCA9533 (650 MHz), 64 or 128MB RAM, 16MB SPI NOR
- 2x 10/100 Mbps Ethernet, with 802.3at PoE support (WAN)
- 2T2R 802.11b/g/n 2.4GHz

Flash instructions:

If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):

  fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
  sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin

In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:

1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
   'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
   seconds, recovery mode should start downloading image from server
   (unfortunately, there is no visible indication that recovery got
   enabled - in case of problems check TFTP server logs)

Signed-off-by: Clemens Hopfer <openwrt@wireloss.net>
Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit a05dcb07241aa83a4416b56201e31b4af8518981)

ath79: add support for Yuncore XD3200

Specification:

- QCA9563 (775MHz), 128MB RAM, 16MB SPI NOR
- 2T2R 802.11b/g/n 2.4GHz
- 2T2R 802.11n/ac 5GHz
- 2x 10/100/1000 Mbps Ethernet, with 802.3at PoE support (WAN port)

LED for 5 GHz WLAN is currently not supported as it is connected directly
to the QCA9882 radio chip.

Flash instructions:

If your device comes with generic QSDK based firmware, you can login
over telnet (login: root, empty password, default IP: 192.168.188.253),
issue first (important!) 'fw_setenv' command and then perform regular
upgrade, using 'sysupgrade -n -F ...' (you can use 'wget' to download
image to the device, SSH server is not available):

  fw_setenv bootcmd "bootm 0x9f050000 || bootm 0x9fe80000"
  sysupgrade -n -F openwrt-...-yuncore_...-squashfs-sysupgrade.bin

In case your device runs firmware with YunCore custom GUI, you can use
U-Boot recovery mode:

1. Set a static IP 192.168.0.141/24 on PC and start TFTP server with
   'tftp' image renamed to 'upgrade.bin'
2. Power the device with reset button pressed and release it after 5-7
   seconds, recovery mode should start downloading image from server
   (unfortunately, there is no visible indication that recovery got
   enabled - in case of problems check TFTP server logs)

Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
(cherry picked from commit c91df224f54fdd44c9c0487a8c91876f5d273164)

toolchain: musl: Update to version 1.2.3

Changes:
new features:
- qsort_r function (POSIX-future)
- pthread_getname_np extension function
- hard float on SPE FPU for powerpc-sf
- SEEK_DATA and SEEK_HOLE exposed in unistd.h (Linux extensions)

compatibility:
- free now preserves errno (POSIX-future requirement)
- setjmp is declared explicitly with returns_twice for non-GCC compilers
- macro version of isascii is no longer defined for C++
- dynamic linker now tolerates zero-length LOAD segments
- epoll_[p]wait is now a cancellation point
- pwd/grp functions no longer fail on systems without AF_UNIX support
- POSIX TZ parsing is stricter to allow more names to fallback to files
- NULL is now defined as nullptr when used in C++11 or later
- gettext now accepts null pointer as argument

bugs fixed:
- old regression in wcwidth of Hangul combining (vowel/final) letters
- duplocale used wrong malloc when malloc was replaced (1.2.2 regression)
- fmaf rounded wrong on archs without FE_TOWARDZERO (all softfloat archs)
- popen didn't honor requirement not to leak other popen pipe fds to child
- aligned_alloc and variants crashed on allocation failure
- dl_iterate_phdr reported incorrect module TLS pointers
- mishandling of some inputs in acoshf and expm1f and functions using them
- potentially wrong-sign zero in cproj functions at infinity
- multiple bugs in legacy function cuserid
- minor posix_spawn file actions API conformance issues
- pthread_setname_np fd leak
- out-of-bound read in zoneinfo handling with distant-past times
- out-of-tree builds lacked generated debug cfi for x86 asm

arch-specific bugs fixed:
- powerpc (32-bit) struct shmid_ds layout was wrong for some fields
- time64 struct layout was wrong in sound ioctl fallback (32-bit archs)

In addition it contains the following improvements:
* protect stack canary from leak via read-as-string by zeroing second byte
* fix excessively slow TLS performance on some mips models

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Acked-by: Rui Salvaterra <rsalvaterra@gmail.com>
Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
(cherry picked from commit 685ae2687bd1b199dc83ee1e16d47c05afca6102)

mac80211: backport minstrel_ht fix for legacy rates

Fixes OFDM rates on 5 GHz

Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry-picked from commit 5d5afd51772c9a992cb6bb9e0a9dce6feaa3fdef)

musl-fts: add host build

This will be used for libselinux.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 1fb099341e5879a8c5247020e5056676ba2f0745)

kernel: Fix oob layout of XTX XT26G0xA

The correct oob layout is:

ECC:
region->offset = 48;
region->length = 16;

Free:
/* Reserve 1 byte for the BBM. */
region->offset = 1;
region->length = 47;

Signed-off-by: Felix Matouschek <felix@matouschek.org>
(cherry picked from commit a5de91a88a8a33ced147bb5340fd45599f652d4d)

kernel: Fix readid method of XTX XT26G0xA

The correct readid method is SPINAND_READID_METHOD_OPCODE_ADDR.

Signed-off-by: Felix Matouschek <felix@matouschek.org>
(cherry picked from commit 3711aee56d864fab066d76afadc9d04e1c18102e)

nftables: add CONFLICT between versions

Have nftables-json conflict with nftables-nojson.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 1135b75d1fd26049a0644b304b7199e4a73c6a08)

mac80211: Update to version 5.15.33-1

This updates mac80211 to version 5.15.33-1 which is based on kernel
5.15.33.
The removed patches were applied upstream.

This new release contains many fixes which were merged into the upstream
Linux kernel.
This also contains the following new drivers which are needed for ath11k:
* net/qrtr/
* drivers/bus/mhi/

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3aa96efa24c13c6e0aafa5ad826f3f95a3bd74f9)

wolfssl: bump to 5.2.0

Fixes two high-severity vulnerabilities:

- CVE-2022-25640: A TLS v1.3 server who requires mutual authentication
  can be bypassed.  If a malicious client does not send the
  certificate_verify message a client can connect without presenting a
  certificate even if the server requires one.

- CVE-2022-25638: A TLS v1.3 client attempting to authenticate a TLS
  v1.3 server can have its certificate heck bypassed. If the sig_algo in
  the certificate_verify message is different than the certificate
  message checking may be bypassed.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit e89f3e85eb1c1d81294e5d430a91b0ba625e2ec0)

imagebuilder: export SOURCE_DATE_EPOCH to environment

Export SOURCE_DATE_EPOCH to environment so filesystem and image
creation tools will make use of it.
Fixes reproducibility of images generated with the ImageBuilder.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 5cf5dce05ae829ec848ad63a6da300c4fddcd510)

arm-trusted-firmware-mediatek: remove no longer needed Configure step

As anyway only the default is called now we can as well also just remove
the override for Build/Configure.

Fixes: e2cffbb805 ("arm-trusted-firmware-mediatek: update to 2021-03-10")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit dffad93d3e34275b87d97724e64447d8bde537ff)

trusted-firmware-a.mk: make sure include directory exists

ARM Trusted Firmware builds do not depend on any target libraries as
they are bare-metal builds. However, the compiler aborts due to
-Werror=missing-include-dirs if the include dir doesn't exists and this
can happen when building with parallelisation as that makes it likely
for arm-trusted-firmware-* to be build very early before any of the
libraries which would implicitely create the directory.
Fix this by making sure the include dir exists before building.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 738d44f5ea6f6450c2c8a29cf5836e22b479340b)

kernel: bump 5.10 to 5.10.110

Removed upstreamed:
  generic/backport-5.10/350-v5.18-MIPS-pgalloc-fix-memory-leak-caused-by-pgd_free.patch
  generic/pending-5.10/850-0014-PCI-aardvark-Fix-reading-PCI_EXP_RTSTA_PME-bit-on-em.patch
  ipq40xx/patches-5.10/105-ipq40xx-fix-sleep-clock.patch

All patches automatically rebased.

Build system: x86_64
Build-tested: bcm2711/RPi4B, mt7622/RT3200
Run-tested: bcm2711/RPi4B, mt7622/RT3200
Compile-/run-tested: ath79/generic (Archer C7 v2).

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[rebased in 22.03 tree]
Signed-off-by: John Audia <graysky@archlinux.us>
(cherry picked from commit b92ec82235b996ece32bc84af177adf1a4dcb90e)

ipq40xx: add RT-AC2200 alternative name to RT-AC42U/RT-ACRH17

RT-AC2200 is the same device with a different name. The OEM firmwares have the same MD5.

Signed-off-by: Ray Wang <raywang777@foxmail.com>
(cherry picked from commit 3204906569768cabcbedb5eaa3a11e2fcb18cd48)

ath79: Move TPLink WPA8630Pv2 to ath79-tiny target

These devices only have 6MiB available for firmware, which is not
enough for recent release images, so move these to the tiny target.

Note for users sysupgrading from the previous ath79-generic snapshot
images:

The tiny target kernel has a 4Kb flash erase block size instead
of the generic target's 64kb. This means the JFFS2 overlay partition
containing settings must be reformatted with the new block size or else
there will be data corruption.

To do this, backup your settings before upgrading, then during the
sysupgrade, de-select "Keep Settings". On the CLI, use "sysupgrade -n".

If you forget to do this and your system becomes unstable after
upgrading, you can do this to format the partition and recover:

* Reboot
* Press RESET when Power LED blinks during boot to enter Failsafe mode
* SSH to 192.168.1.1
* Run "firstboot" and reboot

Signed-off-by: Joe Mullally <jwmullally@gmail.com>
Tested-by: Robert Högberg <robert.hogberg@gmail.com>
(cherry picked from commit 44e1e5d153d00915a7e516c9af3f440cbd84cf78)

dropbear: bump to 2022.82

- update dropbear to latest stable 2022.82;
  for the changes see https://matt.ucc.asn.au/dropbear/CHANGES
- use $(AUTORELEASE) in PKG_RELEASE
- use https for all uris
- refresh all patches
- rewrite patches:
  - 100-pubkey_path.patch
  - 130-ssh_ignore_x_args.patch

binary/pkg size changes:
- ath79/generic, mips:
  - binary: 215112 -> 219228 (+4116)
  - pkg: 111914 -> 113404 (+1490)
- ath79/tiny, mips:
  - binary: 172501 -> 172485 (-16)
  - pkg: 89871 -> 90904 (+1033)

Tested-by: Stijn Segers <foss@volatilesystems.org>
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
(cherry picked from commit 65256aee23a5104eb0c78411fdc73640c0b757ea)

libmnl: update to 1.0.5

Changes:

Duncan Roe (5):
      nlmsg: Fix a missing doxygen section trailer
      build: doc: "make" builds & installs a full set of man pages
      build: doc: get rid of the need for manual updating of Makefile
      build: If doxygen is not available, be sure to report "doxygen: no" to ./configure
      src: doc: Fix messed-up Netlink message batch diagram

Fernando Fernandez Mancera (1):
      src: fix doxygen function documentation

Florian Westphal (1):
      libmnl: zero attribute padding

Guillaume Nault (1):
      callback: mark cb_ctl_array 'const' in mnl_cb_run2()

Kylie McClain (1):
      examples: nfct-daemon: Fix test building on musl libc

Laura Garcia Liebana (4):
      examples: add arp cache dump example
      examples: fix neigh max attributes
      examples: fix print line format
      examples: reduce LOCs during neigh attributes validation

Pablo Neira Ayuso (3):
      doxygen: remove EXPORT_SYMBOL from the output
      include: add MNL_SOCKET_DUMP_SIZE definition
      build: libmnl 1.0.5 release

Petr Vorel (1):
      examples: Add rtnl-addr-add.c

Stephen Hemminger (1):
      examples: rtnl-addr-dump: fix typo

igo95862 (1):
      doxygen: Fixed link to the git source tree on the website.

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit c3b738933981de601389794152534628b04555dc)

libnfnetlink: update to 1.0.2

Changes:

c63f193 bump version to 1.0.2
3cffa84 libnfnetlink: Check getsockname() return code
90ba679 include: Silence gcc warning in linux_list.h
bb4f6c8 Make it clear that this library is deprecated
e46569c Minimally resurrect doxygen documentation
5087de4 libnfnetlink: hide private symbols
62ca426 autogen: don't convert __u16 to u_int16_t
efa1d8e src: Use stdint types everywhere
7a1a07c include: Sync with kernel headers
7633f0c libnfnetlink: initialize attribute padding to resolve valgrind warnings
94b68f3 configure: uclinux is also linux
617fe82 src: get source code license header in sync with current licensing terms
97a3960 build: resolve automake-1.12 warnings

Removed the patch 100-missing_include.patch, libnfnetlink compiles fine
with musl without this patch.

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit aecf088b3792d556c717510304729fa542ceb770)

gpio-button-hotplug: fix data race

bh_event_add_var can be called by multiple threads concurrently,
so it shall not use a static char buffer

Signed-off-by: Andrey Erokhin <a.erokhin@inango-systems.com>
(cherry picked from commit 1e991e09b73c309321d21b9cb706bd5139d952d2)

tools/meson: update to 0.61.4

Override python to use the one in host instead of hostpkg. There's no
need to use the latter.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 19f3fcc884cab348cfba823f1175baf7aa4de15f)

tools/cmake: fix download url

fix the cmake.org download url

Signed-off-by: leo chung <gewalalb@gmail.com>
(cherry picked from commit 56f091d4677feb693d37959a3fa4af845dcce82e)

libselinux: add missing host-build dependency on libsepol/host

The host-build of libselinux requires libsepol/host.
Add the libsepol/host to HOST_BUILD_DEPENDS to allow build on hosts
which don't have libsepol installed.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 0d3850dc5af4896ab3679dc4d8ef9a664e5e705f)

dnsmasq: add procd interface index tracking

Problem exist when dnsmasq is exclusively bind to particular interface.
After reconfiguring or restarting this interface, its index changes, but
dnsmasq uses the old one. When this problem occurs, dnsmasq does not
listen on the correct interface so DHCP does not work, and clients do not
get an IP address. Procd netdev param can be added to restart dnsmasq when
the interface index is changed.

Signed-off-by: Valentyn Datsko <valikk.d@gmail.com>
[combined into a single &&-connected statement]
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 76f55e3c3f32dea63a385e9b3c8eaed1322089c7)

libselinux: use musl-fts for host builds

Fixes compilation under musl based distros like Alpine Linux.

Also add pcre/host as a build dependency as it's needed.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit abb2683de36ffe7b29a1b6ea5a8d7edf73719152)