ramips: fix number of LAN Ports for Mikrotik RBM33G

The Mikrotik RBM33G has only 2 LAN ports.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
[moved node in 02_network to maintain alphabetic sorting; backport]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 3a55c7935d4efdc86575601cb4aa7bc94e3c5e44)

ramips: fix switch port order for TP-Link Archer C20i

Physical port order watched from the backside of the C20i
(from left to right) is: Internet / 1 / 2 / 3 / 4

Physical Port Switch port
WAN             0
LAN 3           1
LAN 4           2
LAN 1           3
LAN 2           4
(not used)      5
CPU             6

Signed-off-by: Walter Sonius <walterav1984@gmail.com>
[commit message/title improvements; backport to 18.06]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit a065cd29bf2dfd1ce1f07becd65aef96cec658e7)

kernel: bump 4.14 to 4.14.158

Refreshed all patches.

Altered patches:
- 400-mtd-add-rootfs-split-support.patch

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.206

Refreshed all patches.

Altered patches:
- 400-mtd-add-rootfs-split-support.patch

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

mac80211: Adapt to changes to skb_get_hash_perturb()

The skb_get_hash_perturb() function now takes a siphash_key_t instead of
an u32. This was changed in commit 55667441c84f ("net/flow_dissector:
switch to siphash"). Use the correct type in the fq header file
depending on the kernel version.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
(cherry picked from commit eaa047179ad30d156d0c3da7ec225acfae7a9f00)

kernel: bump 4.9 to 4.9.205

Refreshed all patches.

Altered patches:
- 402-mtd-support-layerscape.patch

Fixes:
- CVE-2019-18660

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.156

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

base-files: config_generate: split macaddr with multiple ifaces

netifd does not handle network.@device[x].name properly if it
contains multiple ifaces separated by spaces. Due to this, board.d
lan_mac setup does not work if multiple ifaces are set to LAN by
ucidef_set_interface_lan.

To fix this, create a device node for each member iface when
running config_generate instead. Those are named based on the
member ifname:

  ucidef_set_interface_lan "eth0 eth1.1"
  ucidef_set_interface_macaddr "lan" "yy:yy:yy:yy:yy:01"

will return

  config device 'lan_eth0_dev'
        option name 'eth0'
        option macaddr 'yy:yy:yy:yy:yy:01'

  config device 'lan_eth1_1_dev'
        option name 'eth1.1'
        option macaddr 'yy:yy:yy:yy:yy:01'

ref: https://github.com/openwrt/openwrt/pull/2542

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[always use new scheme, extend description, change commit title]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 298814e6be7640d89328de9e7c90d4349e30683f)

kernel: nf_conntrack_rtcache: fix WARNING on rmmod

Fixes b7c58a1ee ("kernel: nf_conntrack_rtcache: fix cleanup on netns
delete and rmmod")

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit b3779e920ebaa168eaf18ac1140774c32b6ec6b6)

kernel: nf_conntrack_rtcache: fix WARNING on forward path

Fixes b7c58a1ee ("kernel: nf_conntrack_rtcache: fix cleanup on netns
delete and rmmod")

Resolves FS#2624

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 1c5df850a07690451f2878a310c0ea67d0690836)

kernel: nf_conntrack_rtcache: fix cleanup on netns delete and rmmod

Fixes FS#1472, FS#2353, FS#2426

Fixes: b3f95490 ("kernel: generic: Add kernel 4.14 support")
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b7c58a1eeba5be2e1f77ec05b417be9d87e26916)

kernel: Add missing configuration option

This was found by the build bot.

Fixes: 6e2e5d1bf8d5 ("kernel: bump 4.14 to 4.14.155")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 103e49f62e72664ee0d5285007907a75960e8645)

kernel: bump 4.14 to 4.14.155

Refreshed all patches.

Altered patches:
- 707-dpaa-ethernet-support-layerscape.patch
- 421-rtc-initialize.patch

Remove upstreamed:
- 161-MIPS-BCM47XX-Enable-USB-power-on-Netgear-WNDR3400v3.patch

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

ar71xx: fix buttons for TP-Link TL-WDR4900 v2

TP-Link TL-WDR4900 v2 only has one combined WPS/Reset button, so
don't set up an RFKILL for this device.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 25127f58b42d794bd47d56ea107f3dfc9cc4816c)

ar71xx: fix LED setup for TL-WDR4900 v2

In ar71xx there is only one combined mach file for Archer C5/C7 and
TL-WDR4900 v2. This one uses the same LED struct for all devices,
defining "green" LEDs for them. However, WDR4900 uses blue front
LEDs, while only C5/C7 uses green ones. Despite, in base-files
WDR4900 is actually set up with "blue" for the mentioned LEDs.

Thus, this patch creates a separate LED struct for WDR4900, so the
LEDs can be set up correctly. Despite, the wlan5g LED is removed as
it is controlled by ath9k chip for WDR4900 (in contrast to C5/C7).

Note: While front LEDs are blue, USB LEDs (on the back) are green,
so colors are mixed intentionally for the WDR4900 v2.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 93f2bcc35e371ec0c4ceb76c06f90b898c726ba5)

ramips: set uImage name of WeVO 11AC NAS and W2914NS v2

The stock firmware and bootloader only accept uImage with names that
match certain patterns. This patch enables OpenWrt installation from
stock firmware without having to reflash the bootloader or access the
UART console.

Installation via web interface:
1.  Flash **initramfs** image through the stock web interface.
2.  Boot into OpenWrt and perform sysupgrade with sysupgrade image.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 19800ac095f6ddbba03ccab08e5197b1eec4a49e)
[backported]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>

ar71xx: fix MAC address setup for TL-WDR4900 v2

The MAC address setup of the TL-WDR4900 v2 is different from the
C5/C7. This aligns ar71xx with the setup in ath79:

wlan0 (5GHz) : -2
wlan1 (2.4GHz) : -1
eth1 (LAN) : 0
eth0 (WAN) : 1

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit a9d3084b83bb2d0fa2c0b43bf2a0831b5ae1df13)

ar71xx: fix MAC addresses for Archer C5 v1, C7 v1/v2, WDR4900 v2

As discussed in 1d18a14a90c7 ("ath79: really fix TP-Link Archer C7
v2 MAC address"), stock firmware MAC address assignment is
actually as follows:

wlan0 (5GHz) : -1
wlan1 (2.4GHz) : 0
eth1 (LAN) : 0
eth0 (WAN) : 1

This has never been fixed for ar71xx, so let's do it now.
Note that with WDR4900 v2 even both wlan0 and wlan1 where assigned
to basemac-1 before ...

Fixes: FS#408

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit a021268032fb64afdce7bafa91c7c7bf44fa6ff2)

ipq40xx: fix build error

Add missing brace which was accidentally omitted

Fixes: 6d6026021390 ("kernel: bump 4.14 to 4.14.154")
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.154

Refreshed all patches.

Altered patches:
- 902-debloat_proc.patch
- 040-dmaengine-qcom-bam-Process-multiple-pending-descript.patch

Remove upstreamed:
- 303-spi-nor-enable-4B-opcodes-for-mx66l51235l.patch

New symbols:
X86_INTEL_MPX
X86_INTEL_MEMORY_PROTECTION_KEYS
X86_INTEL_TSX_MODE_OFF
X86_INTEL_TSX_MODE_ON
X86_INTEL_TSX_MODE_AUTO
SGL_ALLOC

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.202

Refreshed all patches.

Altered patches:
- 902-debloat_proc.patch
- 817-usb-support-layerscape.patch

New symbols:
X86_INTEL_MEMORY_PROTECTION_KEYS
X86_INTEL_TSX_MODE_OFF
X86_INTEL_TSX_MODE_ON
X86_INTEL_TSX_MODE_AUTO

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

ar71xx: fix WLAN LED names for Archer C7

Update WLAN LED colour identifier for both interfaces on Archer C7

Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
(cherry picked from commit 65762cdd2223d759f5836214143888e32ce5766b)
[backported to 18.06]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>

ar71xx: fix system LED names on Archer C5/C7

Move system LED board definitions of Archer C5/C7 to reflect
actual system LED colour used

Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
(cherry picked from commit a73934fc9ad05207e79a3e58abc3d14eee28b6f2)

mac80211: brcmfmac: fix PCIe reset crash and WARNING

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit cde8c2f2fba019c4cd3b9f6ad463ff86cc783061)

ramips: assign correct key-code to wps buttons

The two ASUS WL-330N and WL-330N3G had the reset keycode
assigned to the WPS button. This patch changes both devices
to use KEY_WPS_BUTTON in the hopes that this fixes unwanted
restarts/ unexpected behavior from the users point of view.

[dropped RG21S]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
(cherry picked from commit ad65d9d7b264d6d17293c59469e770905d2f785a)

ramips: rt3833: fix build breakage

Commit 60f41c6c9ef6 ("ramips: add usb-ledtrig-usbport to DEVICE_PACKAGES
of CY-SWR1100") added stray | during backport which caused build
breakage on the buildbots:

 bash: -c: line 0: syntax error near unexpected token `|'
 bash: -c: line 0: `echo kmod-usb-core kmod-usb-ledtrig-usbport kmod-usb-ohci kmod-usb2 swconfig | | mkhash md5 | head -c 8'

Fixes: 60f41c6c9ef6 ("ramips: add usb-ledtrig-usbport to DEVICE_PACKAGES of CY-SWR1100")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit a1ff175dbf807925a0bae537935455bd1aa44a98)

ramips: add usb-ledtrig-usbport to DEVICE_PACKAGES of CY-SWR1100

CY-SWR1100 has a USB LED but kmod-usb-ledtrig-usbport is missing
in default images. This commit adds it.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
[changed commit title, backported to 19.07]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 261c746631d2bf311a6b62a6d3bacce6fde90976)

ramips: fix MAC address setup for Samsung CY-SWR1100

Ethernet MAC address setup has been broken since c3e420f28cf1. Restore
original setting.

Fixes: c3e420f28cf1 ("ramips: Add support for D-Link DCH-M225")

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 7231c1edd99217c6baa8d7d5d841d75ad9de26f1)
[backported due to base-files split]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>

gitignore: ignore patches in OpenWrt root directory

This will have GIT ignore patches in root directory, as created
when using "git format-patch".

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 2c5413559880c54c5eec980121febfe6c7cd287a)

ar71xx: fix tl-wdr3320-v2 upgrade

Fix the error that tl-wdr3320-v2 can't upgrade firmware via web
interface by using magic_ver="0200" for this device.

Signed-off-by: 南浦月 <nanpuyue@gmail.com>
[commit message facelift]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 0ff2385a92c0a31769fce954b7bd571d6114dbc8)

ar71xx: update uboot-envtools for Netgear WNR routers

Boards added: WNR1000v2, WNR2000v3, WNR2200, WNR612v2, WNDR4300.
Boards changed: WNDR3700 (u-boot env size is 2 sectors not 1).

Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
(cherry picked from commit 11052900494ec8216b9b39ba0b24d5e036f4d323)

kernel: bump 4.14 to 4.14.152

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.199

Refreshed all patches.

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

sdk: fix GCC and Python dangling symlinks

Force prereq again in SDK in order to fix GCC and Python dangling
symlinks:

 staging_dir/host/bin/g++ -> /builder/ath79_generic/ccache_cxx.sh
 staging_dir/host/bin/gcc -> /builder/ath79_generic/ccache_cc.sh
 staging_dir/host/bin/python -> /usr/bin/python3.5
 staging_dir/host/bin/python3 -> /usr/bin/python3.5

Ref: FS#2424
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 200f2666fb1c8d9d128824dc5586e0e66386971f)

build: cleanup possibly dangling Python 3 host symlink

When switching from master branch to 19.07 or older, we need to ensure
that Python symlink in staging bin directory points to Python 2.

We can't rely completly just on SetupHostCommand as its executed only in
cases when the $(STAGING_DIR_HOST)/bin/python doesn't already exist, so
we need to remove it before running SetupHostCommand.

This is a cherry-pick of 3b68fb57c938af3948ae4c2da61501183fbef649
with python3 instead of python2

Signed-off-by: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 799de7c641ffa98323929a20a8d92c7cc4ebb251)

build: fixup python SetupHostCommand to use python2

Here is a way to break your build env without this patch:
1) have python point to python3, and no python2
2) start the build, SetupHostCommand will create a symlink
./staging_dir/host/bin/python -> /usr/bin/python
3) build fails on scons because it can't find any python2
4) install python2 and restart the build
5) the build fails on wireless-regdb compile because python is python3 instead of python

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>
(cherry picked from commit 785d4f3efded4a5094ee8e1ce4535dd0933b956d)

OpenWrt v18.06.5: revert to branch defaults

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

OpenWrt v18.06.5: adjust config defaults

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

ustream-ssl: backport fix for CVE-2019-5101, CVE-2019-5102

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit c5d5cdb759adc890ce6699117b7119acf280ce77)

kernel: bump 4.14 to 4.14.151

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.198

Refreshed all patches.

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

scripts/ubinize-image.sh: fix buildbot breakage

New Docker based buildslaves install just bare minimum of packages, thus
not having bsdmainutils package installed which provides `hexdump`
utility, leading to the following build breakage on buildbots:

 ubinize-image.sh: 12: /builder/scripts/ubinize-image.sh: hexdump: not found

So this patch simply replaces `hexdump` with `od` utility provided by
coreutils package, which should be likely available.

Co-authored-by: Yousong Zhou <yszhou4tech@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit c6d41c320c795b0bb9a9350c7d4b1ce55f25769a)

kernel: mark kmod-usb-serial-wwan as hidden

The kconfig symbol is an invisible one since its introduction.  It is
not supposed to be enabled on its own.

Resolves FS#1821

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
(cherry picked from commit 4bf9bec361699e1c033460964158531adf15d7ee)

kernel: add missing symbol

Discovered during layerscape compile-testing

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.150

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.197

Refreshed all patches.

Altered patches:
- 804-crypto-support-layerscape.patch

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Compiling target layerscape before this patch shows that it's broken.
Fixing it is out-of-scope for bumping the kernel and will
be done in a later patch.

The altered patch is a sample change which leaves the target
exactly as it was before this bump.

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

brcm2708: Add feature flag rootfs-part

Even with squashfs brcm2708 requires ROOTFS_PART_SIZE because the overlay
exists as a loopback device on the space not used by squashfs in the root
partition. Also for ext4 (the other fs option) ROOTFS_PART_SIZE is required,
so use feature flag rootfs-part to enable it.

Fixes FS#2166

Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
(cherry picked from commit 3bb44f42990a75e66972016cde75bed6a3f09ef9)
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

iptables: bump PKG_RELEASE

Package content changed with the previous two cherry-picks

  dff0b2104d kernel: netfilter: Add nf_tproxy_ipv{4,6} and nf_socket_ipv{4,6}
  a2fe698a40 kernel: Added required dependencies for socket match.

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

kernel: Added required dependencies for socket match.

This applies to kernel 4.10 and newer.

See https://github.com/torvalds/linux/commit/8db4c5be88f62ffd7a552f70687a10c614dc697b

The above commit added to kernel 4.10 added new dependency
for building the NETFILTER_XT_MATCH_SOCKET (xt_socket.ko)
module. The NF_SOCKET_IPVx options (both of them) need to
be enabled in order to build the NETFILTER_XT_MATCH_SOCKET
module. Without the change the module is not built.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
(cherry picked from commit 66e875a07033cdcfd8c4a16940d4acfe63c60202)
(required for fixing FS#2531)
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

kernel: netfilter: Add nf_tproxy_ipv{4,6} and nf_socket_ipv{4,6}

The nf_socket.ko module was split in commit 8db4c5be88f ("netfilter:
move socket lookup infrastructure to nf_socket_ipv{4,6}.c") into a
common, n IPv4 and an IPv6 part.
The nf_tproxy.ko module was split in commit 45ca4e0cf27 ("netfilter:
Libify xt_TPROXY") into a common, an IPv4 and an IPv6 part.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 89806545cc1711f4e33c1c2ac5265aec4afe8078)
(required for fixing FS#2531)
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

tcpdump: update to 4.9.3

Fixed CVEs:
CVE-2017-16808
CVE-2018-10103
CVE-2018-10105
CVE-2018-14461
CVE-2018-14462
CVE-2018-14463
CVE-2018-14464
CVE-2018-14465
CVE-2018-14466
CVE-2018-14467
CVE-2018-14468
CVE-2018-14469
CVE-2018-14470
CVE-2018-14879
CVE-2018-14880
CVE-2018-14881
CVE-2018-14882
CVE-2018-16227
CVE-2018-16228
CVE-2018-16229
CVE-2018-16230
CVE-2018-16300
CVE-2018-16301
CVE-2018-16451
CVE-2018-16452
CVE-2019-15166
CVE-2019-15167

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry picked from commit 394273c066b8f4317b77f3ede216cfcdd45250c1)

libpcap: update to 1.9.1

Fixed CVEs:
CVE-2018-16301
CVE-2019-15161
CVE-2019-15162
CVE-2019-15163
CVE-2019-15164
CVE-2019-15165

Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
(cherry picked from commit 44f11353de044834a442d3192b66579b99305720)

libpcap: update to 1.9.0

001-Fix-compiler_state_t.ai-usage-when-INET6-is-not-defi.patch dropped due to upstream
002-Add-missing-compiler_state_t-parameter.patch dropped due to upstream

202-protocol_api.patch dropped due to implemented upstream by another way
upstream commit: https://github.com/the-tcpdump-group/libpcap/commit/55c690f6f834b4762697d7a134de439c9096c921
and renamed via: https://github.com/the-tcpdump-group/libpcap/commit/697b1f7e9b1d6f5a5be04f821d7c5dc62458bb3b

ead is the only user who use the protocol api, we have to use the new api since libpcap 1.9.0

Signed-off-by: Syrone Wong <wong.syrone@gmail.com>

kernel: bump 4.14 to 4.14.149

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.148

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.196

Refreshed all patches.

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.147

Refreshed all patches.

Compile-tested on: cns3xxx, imx6
Compile-tested on: cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.195

Refreshed all patches.

Altered patches:
- 403-mtd_fix_cfi_cmdset_0002_status_check.patch

Compile-tested on: ar71xx
Compile-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

apm821xx: fix fan control on highest step

This patch removes a typo (extra "0") so that the 'cpu-alert6'
step is triggered once the system reaches 85°C.

Note: Unless the WNDR4700 is placed in an hot oven, the
hardware-monitor will never reach this value.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>

brcm47xx: sysupgrade: fix device model detection

$(board_name) was providing content on "boardtype" (and optionally
"boardnum") NVRAM values. That function requires & expects more specific
and detailed model name extracted from the /proc/cpuinfo.

Fixes: f12a32630ff5 ("treewide: use the generic board_name function")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

kernel: bump 4.14 to 4.14.146

Refreshed all patches.

Fixes:
- CVE-2019-14814
- CVE-2019-14815
- CVE-2019-14816
- CVE-2019-14821

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.194

Refreshed all patches.

Fixes:
- CVE-2019-14814
- CVE-2019-14815
- CVE-2019-14816
- CVE-2019-14821

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

hostapd: Fix AP mode PMF disconnection protection bypass

This fixes
* CVE-2019-16275 AP mode PMF disconnection protection bypass
https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit a6981604b30bc1ddc1713b368fe853d89c2ba40d)

hostapd: SAE/EAP-pwd side-channel attack update

Fixes this security problem:
* SAE/EAP-pwd side-channel attack update
https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7bed9bf10fc8d05df34c7efc66e8b4ade37a1a0c)

mbedtls: update to 2.16.3

Remove 300-bn_mul.h-Use-optimized-MULADDC-code-only-on-ARM-6.patch,
the issue has been fixed upstream.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
(cherry picked from commit 49d96ffc5c47e40b7f3d99a91a42ea8a54a38bd9)

mbedtls: Update to version 2.16.2

Signed-off-by: Josef Schlehofer <josef.schlehofer@nic.cz>
(cherry picked from commit a2f54f6d5d98211e9c58420eed8c67f4fca83665)

openssl: bump to 1.0.2t, add maintainer

This version fixes 3 low-severity vulnerabilities:

- CVE-2019-1547: ECDSA remote timing attack
- CVE-2019-1549: Fork Protection
- CVE-2019-1563: Padding Oracle in PKCS7_dataDecode and
                 CMS_decrypt_set1_pkey

Patches were refreshed, and Eneas U de Queiroz added as maintainer.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>

kernel: bump 4.14 to 4.14.145

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.144

Refreshed all patches.

Fixes:
- CVE-2019-15030

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.193

Refreshed all patches.

Fixes:
- CVE-2019-15030

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

mac80211: brcmfmac: backport the last 5.4 changes

This makes brcmfmac use the same wiphy after PCIe reset to help user
space handle corner cases (e.g. firmware crash).

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit f39f4b2f6d4300995270f635261b07197e8cf61e)

ar71xx: fix potential IRQ misses during dispatch for qca953x

If both interrupts are set in the current implementation
only the 1st will be handled and the 2nd will be skipped
due to the "if else" condition.

Fix this by using the same approach as done for QCA955x
just below it.

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

ar71xx: Fix potentially missed IRQ handling during dispatch

If both interrupts are set in the current implementation
only the 1st will be handled and the 2nd will be skipped
due to the "if else" condition.

Fix this by using the same approach as done for QCA955x
just below it.

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.143

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.192

Refreshed all patches.

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

tools: mkimage: fix __u64 typedef conflict with new glibc

Including "sys/stat.h" from newer glibc will cause __u64 from linux uapi
header to be included, causing compilation failure for u-boot tools
USE_HOSTCC

Remove typedef for __u64 in include/compiler.h to fix the issue.  It should be
safe because as of u-boot-2018.03, no ref to __u64 is found under u-boot tools/
directory

Error message snippet follows

  HOSTCC  tools/mkenvimage.o
In file included from /usr/include/asm-generic/types.h:7,
 from /usr/include/asm/types.h:5,
 from /usr/include/linux/types.h:5,
 from /usr/include/linux/stat.h:5,
 from /usr/include/bits/statx.h:30,
 from /usr/include/sys/stat.h:446,
 from tools/mkenvimage.c:21:
/usr/include/asm-generic/int-ll64.h:31:42: error: conflicting types for '__u64'
   31 | __extension__ typedef unsigned long long __u64;
      |                                          ^~~~~
In file included from <command-line>:
././include/compiler.h:69:18: note: previous declaration of '__u64' was here
   69 | typedef uint64_t __u64;
      |                  ^~~~~
make[5]: *** [scripts/Makefile.host:116: tools/mkenvimage.o] Error 1

Ref: https://forum.openwrt.org/t/compile-error-19-07/44423
Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1699194
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

kernel: bump 4.14 to 4.14.142

Refreshed all patches.

Remove upstreamed:
- 0032-usb-host-fotg2-restart-hcd-after-port-reset.patch

Compile-tested on: cns3xxx, imx6
Runtime-tested on: cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.191

Refreshed all patches.

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

ramips: fix duplicate network setup for dlink, dir-615-h1

In 555ca422d1cb ("ramips: fix D-Link DIR-615 H1 switch port
mapping"), port setup for dir-615-h1 was changed without removing
the old one. This was working as the new one was triggered earlier
than the old one.

(In the meantine, changed sorting during ramips rename patches
actually inversed that order.)

Anyway, just remove the wrong case now.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit e35e4a996e26f17b69d200505ecea78af96a2704)

ramips: fix D-Link DIR-615 H1 switch port mapping

Reuse a device-specific switch port mapping which also applies to the
D-Link DIR-615 H1.

Signed-off-by: Mirko Parthey <mirko.parthey@web.de>
[cherry-pick/rebase]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit 555ca422d1cbc2db354c0ed03d1a79650f590859)

ramips: remove duplicate case for MAC setup of freestation5

ARC FreeStation5 is present twice in MAC address setup.

>From older commits/changes, it is not possible to reconstruct
the correct choice only by reading the annotations.

Thus, remove the second case and keep the first one, so behavior
stays the same (as nobody seems to have complained about it).

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
(cherry picked from commit ad4eb2241b33b05b0942a3fa7ed2e53fb6e84386)

mac80211: brcmfmac: backport more kernel 5.4 changes

Patch getting RAM info got upstreamed. A debugging fs entry for testing
reset feature was added.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 681acdcc54d2e59135bb706c38bed942f74ccf74)

bzip2: Fix CVE-2019-12900

More details about this CVE:
https://nvd.nist.gov/vuln/detail/CVE-2019-12900

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

ar71xx: WNR2200: remove redundant GPIO for WLAN LED

Without this patch, an extra entry appears for AR9287 GPIO
that duplicates WLAN LED but in fact drives nothing:

gpiochip1: GPIOs 502-511, ath9k-phy0:
 gpio-502 (                    |netgear:blue:wlan   ) out hi
 gpio-503 (                    |netgear:amber:test  ) out hi
 gpio-504 (                    |netgear:green:power ) out lo
 gpio-505 (                    |rfkill              ) in  hi
 gpio-507 (                    |wps                 ) in  hi
 gpio-508 (                    |reset               ) in  hi
 gpio-510 (                    |ath9k-phy0          ) out hi <===!

The pin pointed above is default LED GPIO (8) for AR9287.
For WNR2200 it is not connected anywhere - pin 0 drives blue WLAN
LED instead - but initialization code is missing that information.

This fix calls ap9x_pci_setup_wmac_led_pin() function at device
setup, forcing WLAN LED pin to be 0 and removing redundant entry.

Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>

kernel: bump 4.14 to 4.14.141

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

ath9k: backport dynack improvements

Close cooperation with Lorenzo Bianconi resulted
in these patches which fix all remaining seen issues
when using dynack.

Fix link losses when:
- Late Ack's are not seen or not present
- switching from too low static coverage class to dynack on a live link

These are fixed by setting the Ack Timeout/Slottime to
the max possible value for the currently used channel width when
a new station has been discovered.

When traffic flows, dynack is able to adjust to optimal values
within a few packets received (typically < 1 second)

These changes have been thoroughly tested on ~60 offshore devices
all interconnected using mesh over IBSS and dynack enabled on all.

Distances between devices varied from <100m up to ~35km

[move patches to correct folder + renumber]
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
(cherry picked from commit f6e8ba0238fe349b7529357793e2fb18635819ed)

kernel: bump 4.14 to 4.14.140

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.190

Refreshed all patches.

Fixes:
- CVE-2019-3900

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.14 to 4.14.139

Refreshed all patches.

Also add a missing symbol for x86 which got used now in this bump.
- ISCSI_IBFT

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

musl: Fix CVE-2019-14697

musl libc through 1.1.23 has an x87 floating-point stack adjustment
imbalance, related to the math/i386/ directory. In some cases, use of
this library could introduce out-of-bounds writes that are not present
in an application's source code.

This problem only affects x86 and no other architectures.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit c262daf308e0f0bd93bb5c5ee6238773935079ee)

iptables: patch CVE-2019-11360 (security fix)

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

musl: ldso/dlsym: fix mips returning undef dlsym

This happens only the second time a library is loaded by dlopen().
After lib1 is loaded, dlsym(lib1,"undef1") correctly resolves the undef
symbol from lib1 dependencies. After the second library is loaded,
dlsym(lib2,"undef1") was returning the address of "undef1" in lib2
instead of searching lib2 dependencies.

Backporting upstream fix which now uses the same logic for relocation
time and dlsym.

Fixes openwrt/packages#9297

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

wolfssl: fixes for CVE-2018-16870 & CVE-2019-13628

CVE-2018-16870: medium-severity, new variant of the Bleichenbacher
attack to perform downgrade attacks against TLS, which may lead to
leakage of sensible data. Backported from 3.15.7.

CVE-2019-13628 (currently assigned-only): potential leak of nonce sizes
when performing ECDSA signing operations. The leak is considered to be
difficult to exploit but it could potentially be used maliciously to
perform a lattice based timing attack. Backported from 4.1.0.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>

kernel: bump 4.14 to 4.14.138

Refreshed all patches.

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

kernel: bump 4.9 to 4.9.189

Refreshed all patches.

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

xfsprogs: Replace valloc with posix_memalign

Fixes compilation under uClibc-ng.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e49b6bb61828b8b903db0ef48113b4065a215c63)

libbsd: Fix compilation under ARC

The 8 year old file does not have any ARC definitions.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
[updated content of the patch with version sent to upstream]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 395bef4bbacc0dd1cca72907529539194504be27)

nftables: Fix compilation with uClibc-ng

Missing header for va_list.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
[updated with upstream version of the patch]
(cherry picked from commit 2f977974714468e1a0ee20e4cce233da63d06dd0)

tools/patch: apply upstream patch for cve-2019-13638

GNU patch through 2.7.6 is vulnerable to OS shell command injection that
can be exploited by opening a crafted patch file that contains an ed style

diff payload with shell metacharacters. The ed editor does not need to be
present on the vulnerable system. This is different from CVE-2018-1000156.

https://nvd.nist.gov/vuln/detail/CVE-2019-13638

Signed-off-by: Russell Senior <russell@personaltelco.net>
(cherry picked from commit bcfd1d76852974170780dbe368e6194dbb0e123e)

tools/patch: apply upstream patch for CVE-2019-13636

In GNU patch through 2.7.6, the following of symlinks is mishandled in
certain cases other than input files. This affects inp.c and util.c.

https://nvd.nist.gov/vuln/detail/CVE-2019-13636

Signed-off-by: Russell Senior <russell@personaltelco.net>
(cherry picked from commit 995bcc532943639f3df36dbcaa361f9167f9f4d5)